Toughness-oriented end-to-end automatic driving system safety guarantee method

Abstract

The invention belongs to the technical field of software engineering, and particularly relates to a toughness-oriented end-to-end automatic driving system safety guarantee method. The method comprises the following steps of: judging whether a track generated by an automatic driving system is executed by a vehicle controller or controlled by a risk alleviator according to the states of a takeover buffer area and a recovery buffer area by adopting a takeover judging device; using a risk monitor based on aerial view information and a vehicle dynamics model to predict the motion trails of the autonomous vehicle and the traffic participants around the autonomous vehicle in several seconds in the future, identifying key driving risks, and maintaining a take-over buffer area and a recovery buffer area; a risk mitigator based on an intelligent driving model (IDM) is utilized to generate an alternative driving path and a corresponding speed control strategy during control takeover, thereby realizing risk avoidance.

Description

Technical Field

[0001] This invention belongs to the field of software engineering technology, specifically a safety assurance method for a resilient end-to-end autonomous driving system. Background Technology

[0002] In recent years, end-to-end autonomous driving systems have demonstrated outstanding performance in environmental perception and general decision-making capabilities, attracting widespread attention and substantial investment from both academia and industry, thanks to their dedicated model architectures and large-scale, diverse training data. Unlike traditional modular systems, end-to-end autonomous driving systems can handle diverse driving scenarios without relying on high-definition maps or numerous manually defined rules. However, compared to modular autonomous driving systems, they lack clear logical interpretability and safety boundaries. Scenario-based testing methods show that even in situations highly similar to those in the training dataset, autonomous driving systems can still violate safety rules, thereby weakening system safety and overall performance; numerous recorded traffic accidents serve as evidence. Therefore, enhancing the resilience of autonomous driving systems and achieving effective risk mitigation while ensuring performance in interactive scenarios is of great significance.

[0003] Software resilience emphasizes a system's ability to adapt and recover in the face of unexpected events, that is, its ability to maintain effective operation under risky conditions. Improving resilience requires not only monitoring risks but also building systems capable of proactively mitigating risks, recovering quickly, and operating stably in complex environments. For end-to-end autonomous driving systems, current research in academia and industry focuses only on predicting unexpected conditions or identifying abnormal behavior, lacking runtime solutions for risk mitigation. To prevent safety violations, researchers have proposed various backup strategies, such as emergency braking or manual intervention, to ensure the safety of autonomous vehicles. However, these methods primarily focus on emergency intervention rather than enabling the system to autonomously adapt and continue operating in risky situations. However, according to the SAE Level of Automation standard, for SAE Level 4+ autonomous vehicles, the responsibility for backup response no longer rests with the human driver but must be handled by the autonomous driving system itself.

[0004] To the best of our knowledge, existing safety assurance frameworks for end-to-end autonomous driving systems cannot enhance the resilience of end-to-end autonomous driving systems, particularly their ability to continuously monitor risks, adaptively respond to potential safety violations, and quickly recover to maintain safe operation in risky scenarios. Summary of the Invention

[0005] The purpose of this invention is to provide a resilience-oriented safety assurance method for end-to-end autonomous driving systems, in order to mitigate driving risks, prevent potential safety violations, and improve the driving performance of end-to-end autonomous driving systems, including: monitoring potential driving risks; and mitigating identified driving risks.

[0006] The present invention provides a resilience-oriented safety assurance method for end-to-end autonomous driving systems, comprising: (i) Using the takeover decision-maker, based on the state of the takeover buffer and the recovery buffer, determine whether to hand over the trajectory generated by the autonomous driving system to the vehicle controller for execution, or to let the risk mitigator take over the control; specifically, the takeover decision-maker determines whether to send the trajectory generated by the autonomous driving system to the vehicle controller by checking three takeover buffers and one recovery buffer. (ii) Utilizing a risk monitor based on bird's-eye view information and vehicle dynamics models, predict the movement trajectories of the autonomous vehicle and surrounding traffic participants within the next few seconds (generally 3 seconds, or 60 frames by default), identify key driving risks, and maintain takeover and recovery buffer zones; specifically, based on bird's-eye view information, perform: (1) Trajectory prediction, i.e., asynchronous prediction of the movement trajectory of autonomous vehicles and surrounding traffic participants over a period of time in the future; (2) Risk assessment, which is to assess whether there is a driving risk in each trajectory generated by the autonomous driving system, including collision risk, stop signal violation risk, and vehicle stall risk; (iii) Utilizing a risk mitigator based on an intelligent driving model (IDM), alternative driving paths and corresponding speed control strategies are generated during control takeover to achieve risk avoidance. Specifically, a conservative driving strategy based on the intelligent driving model (M. Treiber, A. Hennecke, and D. Helbing, “Congested traffic states in empirical observations and microscopic simulations,” Physical review E, vol. 62, p.1805, 2000) is adopted. This strategy temporarily takes over control of the autonomous vehicle until the vehicle risk is mitigated and a safe state is restored. This process includes two steps: (1) Waypoint rerouting, i.e. generating alternative waypoints to guide autonomous vehicles to bypass static obstacles within the drivable area as much as possible; (2) Navigator expansion, i.e., dynamically expanding the navigator set to cope with different types of risks, guiding the intelligent driving model to adjust the vehicle speed for safe driving.

[0007] Furthermore, in step (one): (1) The takeover buffer is a fixed-length circular queue that stores the most recent risk assessment results of the trajectories generated by the autonomous driving system, used to identify whether the autonomous vehicle is currently facing a risk; specifically: two circular queues with a length of M Different circular queues are used to record the assessment results of collision risk and stop signal violation risk, respectively, and a queue of length [missing information]. N A circular queue is used to record the assessment results of vehicle stall risk; generally, M Take integers from 1 to 10. N Take an integer between 190 and 210 (preferably 200).

[0008] (2) The recovery buffer; is of length [missing information]. R A circular queue used to record the latest data after takeover. R The results of this risk assessment; it tracks the progress of the autonomous vehicle from a risky state to a safe state, thereby determining when control can safely return to the autonomous driving system; generally, R Take an integer between 10 and 40.

[0009] (3) Takeover and Resumption Mechanism; The takeover and recovery buffers are initially set to empty, and each entry is a binary value (i.e., 0 or 1) to indicate the presence or absence of a potential risk; the values ​​in these buffers are continuously updated and maintained by the risk monitor; using the entries in these buffers, the takeover and recovery mechanism determines whether the vehicle controller should execute the trajectory generated by the autonomous driving system; specifically, if the number of entries with a value of 1 in the collision risk buffer or stop signal violation risk buffer exceeds a threshold. l If all entries in the vehicle stall risk buffer are 1, the current trajectory will not be assigned to the vehicle controller; instead, the downstream risk mitigator will be activated. Once control is taken over, the recovery buffer is reset and begins recording the evaluation results of subsequent trajectories generated by the autonomous driving system. When all entries in the recovery buffer are 0, it indicates that the autonomous driving system remains in a safe state and can resume driving tasks. The takeover decision-maker allows the newly generated trajectory to be assigned to the vehicle controller to return control to the autonomous driving system. Here, the threshold... l The value is usually an integer between 1 and 8.

[0010] Furthermore, in step (two): (1) The trajectory prediction is based on the kinematic bicycle model (KBM) (P. Polack, F. Altchöne, B. d'Andréa Novel, and A. de La Fortelle, “The kinematic bicycle model: A consistent model for planning feasible trajectories for autonomous vehicles?” in Proceedings of the 2017 IEEE intelligent vehicles symposium, 2017, (pp. 812–818) Predict the future trajectory, position, orientation, and speed of autonomous vehicles and surrounding vehicles; construct bounding boxes for traffic participants over a future period by associating their physical boundaries with the generated motion predictions; linearly scale up each predicted bounding box frame by frame over time, up to 130% of the original size for autonomous vehicles and up to 200% for other vehicles; for pedestrians, a constant speed model is used for prediction, and the bounding box is scaled up to 150% of the original size; abstract the influence area of ​​the stop signal as a virtual static bounding box, constructing a 33-meter area on the lane to represent the influence area of ​​the stop signal based on the heading of the autonomous vehicle and the position and orientation of the stop signal; keep the bounding box of the influence area of ​​the stop signal active until the autonomous vehicle comes to a complete stop in the area, at which point the bounding box is deactivated.

[0011] (2) The risk assessment refers to the assessment of three main risks: collision risk, stop signal violation risk, and vehicle stall risk; For collision risk, the Separating Axis Theorem (J. Huynh, “Separating axis theorem for oriented bounding boxes,” URL: jkh.me / files / tutorials / Separating%20Axis%20Theorem%20for%20Oriented%20Bounding%20Boxes.pdf, 2009) is used to assess whether there are unsafe or illegal interactions between the predicted bounding boxes of the autonomous vehicle and other traffic participants, in order to detect potential collisions and calculate the expected collision time. To reduce false positives, the collision risk takeover buffer of the corresponding frame is set to 1 only when the expected collision time is earlier than the previous assessment. Regarding the risk of stop signal violation, when an autonomous vehicle enters the stop signal influence area and fails to come to a complete stop, i.e., during the entire period of intersection with the influence area, its speed is always higher than a predefined threshold, the stop signal violation risk takeover buffer of the corresponding frame is set to 1. Regarding the risk of vehicle stalling, when the autonomous vehicle decelerates to near a stop outside the stop signal's influence area, i.e., when the speed is below a predefined threshold, the stalling risk takeover buffer for the corresponding frame is set to 1. During the risk mitigator's takeover of control, for each frame t, if any potential risk is detected, the value 1 is recorded in the recovery buffer; if no risk is detected, the value 0 is written.

[0012] Furthermore, in step (iii): (1) The waypoint rerouting includes three steps: dense waypoint generation, occupied map generation, and rerouting waypoint generation; wherein: Dense waypoint generation uses a third-order Bezier curve to generate a smooth reference path based on the vehicle's current position and navigation points, and samples this path to obtain a set of dense waypoints; after generating dense waypoints, a local occupancy grid map is initialized with the autonomous vehicle as the center and based on the predefined perception range. To improve resolution, a smaller grid cell size is used when generating the occupancy map. At the same time, the boundary of each static obstacle is expanded to include a buffer zone equivalent to half the length of the autonomous vehicle. All cells that overlap with obstacles or road boundaries are marked as non-drivable, thus forming a binary occupancy map. Rerouting waypoint generation is based on the generated occupancy map. Each dense waypoint is sequentially appended to the rerouting waypoint list until a waypoint is found located in an untravelable cell of the occupancy map. At this point, the cell corresponding to the last waypoint in the waypoint list is recorded as the new starting point, and points located in untravelable cells are iteratively deleted from the dense pathpoint list until a pathpoint located in a travelable cell is found. Then, using these two points as the starting and ending points, the A* search algorithm is applied (PE Hart, NJ Nilsson, and B. Raphael, “A formal basis for the heuristic determination of minimum cost paths,” IEEE transactions on Systems Science and Cybernetics, vol. 4, no. 2, pp. 100–107). (1968.) The remaining dense waypoints were replanned, and a penalty term for deviations from the reference route and abrupt changes in direction was added to the cost function. After adding the path segments generated by the A* algorithm to the list of rerouting waypoints, the algorithm continued to iterate over the remaining dense waypoints, repeating the above process until the navigation point was reached. Finally, a trajectory smoothing algorithm (P. Virtanen, R. Gommers, TEOliphant, M. Haberland, T. Reddy, D. Cournapeau, E. Burovski, P. Peterson, W. Weckesser, J. Bright et al., “Scipy 1.0: fundamental algorithms for scientific computing in python,” Nature methods, vol. 17, no. 3, pp. 261–272, 2020) was applied to eliminate sharp turns or jagged transitions. (2) The navigator expansion is, by default, selecting the vehicle closest to the waypoint along the rerouting route ahead of the autonomous vehicle as the navigator; if the risk monitor detects a potential collision within the prediction range, traffic participants (such as vehicles and pedestrians) that are expected to collide with the autonomous vehicle are also included in the navigator set; in addition, static obstacles on the autonomous vehicle's trajectory are also considered as navigators; subsequently, an intelligent driving model (IDM) (M. Treiber, A. Hennecke, and D. Helbing, “Congested traffic states in empirical observations and microscopic simulations,” Physical review E, vol. 62, p.1805, 2000.) is applied to generate a dominant speed for each navigator and select the minimum speed as the desired speed to adjust the speed of the autonomous vehicle.

[0013] A schematic diagram of the basic process of this invention is shown below. Figure 1 As shown, this invention introduces a modular, resilience-oriented runtime safety assurance framework for complex AI systems lacking clear logical interpretability and safety boundaries. This framework aims to mitigate driving risks, prevent potential safety violations, and improve the driving performance of end-to-end autonomous driving systems. The invention's method designs a takeover decision-maker to make appropriate takeover decisions in risky scenarios; utilizes a risk monitor based on bird's-eye view information and vehicle dynamics models to predict the movement trajectories of the autonomous vehicle and surrounding traffic participants, and identifies key driving risks; and employs a risk mitigator based on an intelligent driving model to achieve risk avoidance during takeover. Attached Figure Description

[0014] Figure 1 This diagram illustrates the basic process of the end-to-end autonomous driving system safety assurance method for resilience according to the present invention.

[0015] Figure 2 This is a sample diagram of a risk mitigator. Detailed Implementation

[0016] The following describes the specific implementation of this invention for the Bench2Drive evaluation set, the CARLA leaderboard 2.0 evaluation set, the TCP autonomous driving system, the UniAD autonomous driving system, and the VAD autonomous driving system. The main process is as follows: (1) Constructing the takeover criterion. A small calibration set was built based on Bench2Drive, and the grid search method was used to adjust it. M , N , l and RThe parameter values ​​are selected to adapt to different autonomous driving systems. Specifically, the parameter range is first defined. Specifically, the length of the stagnation risk takeover buffer is a fixed value. N =200 to reduce the search space. This represents a vehicle remaining stationary for more than 10 seconds without traffic congestion, which is realistic. We define takeovers within the first 3 seconds of a violation as necessary takeovers, and all other takeovers as unnecessary takeovers. For each set of parameters ( N , l , R) Applied to the calibration set, the precision, recall, and F3 score of the risk monitor are calculated. The goal is to achieve high recall while maximizing precision to minimize unnecessary intervention, and parameters are selected accordingly. Generally, M , N , l , R The default configuration uses 5, 200, 4, 20.

[0017] (2) Constructing a risk monitor. A motion bicycle model is used to predict the future trajectory, position, orientation, and speed of the autonomous vehicle and surrounding vehicles, and the bounding box for each prediction is obtained for each future frame based on its physical boundaries. A risk assessment module is constructed using Python based on the separating axis theorem and predefined risk descriptions to automatically identify potential risks and maintain takeover and recovery buffers. The risk monitor and takeover decision-maker are bridged, and the accuracy, recall, and F3 score of takeover behavior are evaluated using the Bench2Drive evaluation set and the CARLA leaderboard 2.0 evaluation set. The Bench2Drive evaluation set requires the autonomous driving system to traverse 220 routes of approximately 150 meters each in different locations and weather conditions, each route containing a safety-critical scenario (e.g., turning left at an intersection without traffic lights, avoiding vehicles running red lights, etc.); the CARLA leaderboard 2.0 evaluation set contains 20 long routes of approximately 12 kilometers each with different weather and traffic conditions. For the TCP autonomous driving system, UniAD autonomous driving system, and VAD autonomous driving system, the average accuracy, recall, and F3 score of the risk monitor on the evaluation set are 0.639, 0.942, and 0.899, respectively.

[0018] (3) Construct a risk mitigator. A sample diagram of a risk mitigator is shown below. Figure 2 As shown. First, set the current location of the autonomous vehicle to... P 0, navigation point set P 3. Calculate the intersection of the autonomous vehicle's heading line and the navigation point's direction line as... P 1, P 2. Then, construct the curve using a third-order Bezier curve. Sampling is performed to obtain dense waypoints. After generating dense waypoints, a local occupancy grid map is initialized with the autonomous vehicle as the center and the vehicle's perception range as the radius. The occupancy grid map uses a small grid cell size (typically 1m), and the boundary of each static obstacle (such as stationary vehicles, traffic cones, etc.) is expanded to add a buffer equivalent to half the length of the autonomous vehicle. All cells overlapping with obstacles or road boundaries are marked as non-drivable, thus forming a binary occupancy map. Finally, based on the generated occupancy map, dense waypoints are iterated, and rerouting waypoints are obtained using the A* search algorithm. A trajectory smoothing algorithm is applied to eliminate sharp turns or jagged transitions. The mitigation effect of the risk mitigator in risky scenarios is evaluated using metrics such as route success rate, route completion rate, and driving score. Based on the number of violations per kilometer provided by CARLA's test report, the ability of the autonomous driving system to prevent violations in risky scenarios, including vehicle collisions, failure to obey stop signals, and vehicle stagnation, is evaluated. Experimental results show that the risk mitigator improves the driving score of the autonomous driving system by an average of 150.30% and successfully prevents 64.38% of violations with almost no additional time.

Claims

1. A safety assurance method for a resilient end-to-end autonomous driving system, characterized in that, include: (i) Using the takeover decision-maker, based on the state of the takeover buffer and the recovery buffer, determine whether to hand over the trajectory generated by the autonomous driving system to the vehicle controller for execution, or to let the risk mitigator take over the control; specifically, the takeover decision-maker determines whether to send the trajectory generated by the autonomous driving system to the vehicle controller by checking three takeover buffers and one recovery buffer. (ii) Utilizing a risk monitor based on bird's-eye view information and vehicle dynamics models, predict the movement trajectory of the autonomous vehicle and surrounding traffic participants within the next few seconds, identify key driving risks, and maintain takeover and recovery buffer zones; specifically based on bird's-eye view information: (1) Trajectory prediction, i.e., asynchronous prediction of the movement trajectory of autonomous vehicles and surrounding traffic participants over a period of time in the future; (2) Risk assessment, which is to assess whether there is a driving risk in each trajectory generated by the autonomous driving system, including collision risk, stop signal violation risk, and vehicle stall risk; (iii) By utilizing a risk mitigator based on an intelligent driving model (IDM), alternative driving paths and corresponding speed control strategies are generated during control takeover, thereby achieving risk avoidance; Specifically, a conservative driving strategy based on an intelligent driving model is adopted. This strategy temporarily takes over control of the autonomous vehicle until the vehicle risk is mitigated and a safe state is restored. This process includes two steps: (1) Waypoint rerouting, i.e. generating alternative waypoints to guide autonomous vehicles to bypass static obstacles within the drivable area as much as possible; (2) Navigator expansion, i.e., dynamically expanding the navigator set to cope with different types of risks, guiding the intelligent driving model to adjust the vehicle speed for safe driving.

2. The safety assurance method for a resilient end-to-end autonomous driving system according to claim 1, characterized in that, In step (one): (1) The takeover buffer is a fixed-length circular queue that stores the most recent risk assessment results of the trajectories generated by the autonomous driving system, used to identify whether the autonomous vehicle is currently facing a risk; specifically, it consists of two circular queues of length [missing information]. M Different circular queues are used to record the assessment results of collision risk and stop signal violation risk, respectively, and a queue of length [missing information]. N A circular queue is used to record the assessment results of vehicle stall risk; (2) The recovery buffer; is of length [missing information]. R A circular queue used to record the latest data after takeover. R The results of this risk assessment track the progress of an autonomous vehicle from a risky state to a safe state, thereby determining when it is safe to return control to the autonomous driving system. (3) Takeover and recovery mechanism; the takeover buffer and recovery buffer are initially set to empty, and each entry is a binary value, i.e., 0 or 1, to indicate the presence or absence of potential risks; the values ​​in these buffers are continuously updated and maintained by the risk monitor; Using the entries in these buffers, the takeover and recovery mechanism determines whether the vehicle controller should execute the trajectory generated by the autonomous driving system; specifically, if the number of entries with a value of 1 in the collision risk buffer or stop signal violation risk buffer exceeds a threshold... l If all entries in the vehicle stall risk buffer have a value of 1, the current trajectory will not be assigned to the vehicle controller, but the downstream risk mitigator will be activated. Once control is taken over, the recovery buffer is reset and begins recording the evaluation results of subsequent trajectories generated by the autonomous driving system. When all entries in the recovery buffer are 0, it indicates that the autonomous driving system has always maintained a safe state and is able to resume the driving task. The takeover decision-maker allows the newly generated trajectory to be assigned to the vehicle controller to return control to the autonomous driving system.

3. The safety assurance method for a resilient end-to-end autonomous driving system according to claim 2, characterized in that, In step (two): (1) The trajectory prediction is based on the motion bicycle model to predict the future motion trajectory, position, orientation and speed of autonomous vehicles and surrounding vehicles; by associating their physical boundaries with the generated motion prediction, the bounding boxes of traffic participants in the future are constructed; each predicted bounding box is linearly enlarged frame by frame in time, up to 130% of the original size of autonomous vehicles and up to 200% of the original size of other vehicles; For pedestrians, a constant speed model is used for prediction, and the bounding box is expanded to 150% of the original size. The influence area of ​​the stop signal is abstracted as a virtual static bounding box. Based on the heading of the autonomous vehicle and the position and direction of the stop signal, a 3×3 meter area is constructed on the lane to represent the influence area of ​​the stop signal. The bounding box of the influence area of ​​the stop signal remains active until the autonomous vehicle comes to a complete stop in the area, at which point the bounding box is deactivated. (2) The risk assessment refers to the assessment of three main risks: collision risk, stop signal violation risk, and vehicle stall risk; For collision risk, the split axis theorem is used to assess whether there are unsafe or illegal interactions between the predicted bounding box of the autonomous vehicle and other traffic participants in order to detect potential collisions and calculate the expected collision time. To reduce false alarms, the collision risk takeover buffer of the corresponding frame is set to 1 only when the expected collision time is earlier than the previous assessment. Regarding the risk of stop signal violation, when an autonomous vehicle enters the stop signal influence area and fails to come to a complete stop, i.e., during the entire period of intersection with the influence area, its speed is always higher than a predefined threshold, the stop signal violation risk takeover buffer of the corresponding frame is set to 1. Regarding the risk of vehicle stalling, when an autonomous vehicle decelerates to near a stop outside the stop signal's influence area, i.e., when the speed is below a predefined threshold, the stalling risk takeover buffer of the corresponding frame is set to 1. During the period when the risk mitigator takes over control, for each frame t, if any potential risk is detected, the value 1 is recorded in the recovery buffer; if no risk is detected, the value 0 is written.

4. The end-to-end autonomous driving system safety assurance method for resilience according to claim 3, characterized in that, In step (three): (1) The waypoint rerouting includes three steps: dense waypoint generation, occupied map generation, and rerouting waypoint generation; wherein: Dense waypoint generation uses a third-order Bezier curve to generate a smooth reference path based on the vehicle's current position and navigation points, and samples this path to obtain a set of dense waypoints; after generating dense waypoints, a local occupancy grid map is initialized with the autonomous vehicle as the center and based on the predefined perception range. To improve resolution, a smaller grid cell size is used when generating the occupancy map. At the same time, the boundary of each static obstacle is expanded to include a buffer zone equivalent to half the length of the autonomous vehicle. All cells that overlap with obstacles or road boundaries are marked as non-drivable, thus forming a binary occupancy map. Rerouting waypoint generation is based on the generated occupancy map. Each dense waypoint is sequentially added to the rerouting waypoint list until a waypoint is found in an untravelable cell of the occupancy map. At this point, the cell corresponding to the last waypoint in the waypoint list is recorded as the new starting point, and points in untravelable cells are iteratively deleted from the dense pathpoints until a pathpoint in a travelable cell is found. Then, using these two points as the starting and ending points, the A* search algorithm is used to re-plan the remaining dense waypoints, with a penalty term added to the cost function for deviations from the reference route and abrupt changes in direction. After adding the path segment generated by the A* algorithm to the rerouting waypoint list, the algorithm continues to iterate over the remaining dense waypoints, repeating the above process until the navigation point is reached. Finally, a trajectory smoothing algorithm is applied to eliminate sharp turns or jagged transitions. (2) The navigator expansion selects the vehicle closest to the waypoint along the rerouting route in front of the autonomous vehicle as the navigator; if the risk monitor detects a potential collision within the prediction range, traffic participants that are expected to collide with the autonomous vehicle are also included in the navigator set; in addition, static obstacles on the trajectory of the autonomous vehicle are also considered as navigators; then, the intelligent driving model is applied to generate the dominant speed for each navigator and select the minimum speed as the desired speed to adjust the speed of the autonomous vehicle.

Images