The Quantitative Risk Norm - A Proposed Tailoring of HARA for ADS

Abstract

One of the major challenges of automated driving systems (ADS) is showing that they drive safely. Key to ensuring safety is eliciting a complete set of top-level safety requirements (safety goals). This is typically done with an activity called hazard analysis and risk assessment (HARA). In this paper we argue that the HARA of ISO 26262:2018 is not directly suitable for an ADS, both because the number of relevant operational situations may be vast, and because the ability of the ADS to make decisions in order to reduce risks will affect the analysis of exposure and hazards. Instead we propose a tailoring using a quantitative risk norm (QRN) with consequence classes, where each class has a limit for the frequency within which the consequences may occur. Incident types are then defined and assigned to the consequence classes; the requirements prescribing the limits of these incident types are used as safety goals to fulfil in the implementation. The main benefits of the QRN approach are the ability to show completeness of safety goals, and make sure that the safety strategy is not limited by safety goals which are not formulated in a way suitable for an ADS.

Real-time Recursive Risk Assessment Framework for Autonomous Vehicle Operations

“…Therefore a further enhancement was suggested in Khastgir et al [15] by adding real-time detection of hazardous events and providing a real-time ASIL to affect the decision and control for AV. However, this determination of hazardous events and thereafter real-time ASIL do not reflect the instantaneous dynamic risk and safety representative of the environment at a specific time and location [8]. The ASIL outcome only reflects the severity and likelihood occurrence of hazardous events.…”

“…risk and safety aspects of sudden pedestrian dashing across the road) need to be considered. Without the driver in place, the existing HARA process is no longer sufficient to replace the human decision in detecting new hazardous events [8]. To address this gap, in addition to simulation and data collection during AV trials (which will only extend the boundaries of the static process), a new additional responsive framework is required to complement traditional methods.…”

Risk Quantification for Automated Driving Systems in Real-World Driving Scenarios

“…Another method to quantify the risk of a driving scenario is proposed in [43], but this method does not consider the likelihood of encountering the scenario and the role of the back-up operator is not explicitly considered. A quantitative assurance framework is proposed in [44], [45], but this framework assumes that the frequency of accidents is known, whereas this is unknown in a prospective assessment. Furthermore, similar to [42], [44] and [45] do not consider the role of a back-up operator.…”

“…A quantitative assurance framework is proposed in [44], [45], but this framework assumes that the frequency of accidents is known, whereas this is unknown in a prospective assessment. Furthermore, similar to [42], [44] and [45] do not consider the role of a back-up operator.…”

Human Interaction Safety Analysis Method for Agreements with Connected Automated Vehicles

“…This has the advantage of being possible to apply using expert knowledge complemented with sources such as results from driving studies (on-road, off-road, and virtual simulation to identify potential human errors) and hardware metrics (for E/E components). A fully quantitative assessment requires more statistical data but, if possible to conduct, could be used towards a probabilistic safety case useful with approaches such as establishing a positive risk norm [3] or the QRN approach [19], which states top-level safety requirements in terms of maximum allowed frequencies of accidents resulting in different severity. HISA could be used with any risk assessment method that can provide a useful link between the interaction analysis results and necessary risk reduction measures.…”