STPA Applied to Automotive Automated Parking Assist

Size: px

Start display at page:

Download "STPA Applied to Automotive Automated Parking Assist"

Dustin Manning
5 years ago
Views:

1 STPA Applied to Automotive Automated Parking Assist Massachusetts Institute of Technology John Thomas Megan France APA Collaboration with General Motors Charles A. Green Mark A. Vernacchia Padma Sundaram Joseph D Ambrosio

2 AUTOMATED PARKING ASSIST ENGINEERING FOR HUMANS - MIT STAMP WORKSHOP

3 CONTROL LOOP Leveson,

4 CONTROL LOOP Existing systemstheoretic controller model Generic Not specific to humans Leveson,

5 HUMAN CONTROL MODEL Human Controller Control Actions Inputs 5

6 HUMAN CONTROL MODEL Human Controller Control Actions Devise control actions Process states Process behaviors PM Update Inputs 6

7 Identify UCAs Identify variables Identify Flaws Identify flaws in Updates Identify unsafe decisions (Control Action Selections) Human Controller Control Actions Devise control actions Process states Process behaviors PM Update Inputs 7

8 Identify UCAs Identify variables Identify Flaws Identify flaws in Updates Identify unsafe decisions (Control Action Selections) 8

9 UNSAFE CONTROL ACTIONS Brake Not Provided Provided Too early, too late, out of order UCA-1: Driver does not brake when auto-parking and computer doesn t react to an obstacle Stopped too soon, applied too long Driver APA Vehicle 9

10 Identify UCAs UCA-1: Driver does not brake when auto-parking and computer doesn t react to an obstacle Identify variables PM-1: APA is enabled/disabled PM-2: APA computer reacting appropriately/inappropriately PM-3: Obstacle on collision path Identify Flaws Identify flaws in Updates Identify unsafe Control Action Selections 11

11 Identify UCAs UCA-1: Driver does not brake when auto-parking and computer doesn t react to an obstacle Identify variables PM-1: APA is enabled/disabled PM-2: APA computer reacting appropriately/inappropriately PM-3: Obstacle on collision path Identify Flaws Identify flaws in Updates Identify unsafe Control Action Selections 12

12 Identify UCAs UCA-1: Driver does not brake when auto-parking and computer doesn t react to an obstacle Identify variables PM-1: APA is enabled/disabled PM-2: APA computer reacting appropriately/inappropriately PM-3: Obstacle on collision path Identify Flaws Identify flaws in Updates Identify unsafe Control Action Selections 13

13 Identify UCAs UCA-1: Driver does not brake when auto-parking and computer doesn t react to an obstacle Identify variables PM-1: APA is enabled/disabled PM-2: APA computer reacting appropriately/inappropriately PM-3: Obstacle on collision path Identify Flaws Identify flaws in Updates Identify unsafe Control Action Selections Control Actions Human Controller Devise control actions Process states Process behaviors PM Update 14 Inputs

14 Identify UCAs Identify variables PM-1: APA is enabled/disabled PM-2: APA computer reacting appropriately/inappropriately PM-3: Obstacle on collision path Identify Flaws Identify unsafe decisions (Control Action Selections) Identify inadequate Updates Process states Process behaviors Type of PM flaw Incorrect beliefs about process state (including modes) Incorrect beliefs about process behaviors Incorrect beliefs about environment Examples 15

15 Identify UCAs Identify variables PM-1: APA is enabled/disabled PM-2: APA computer reacting appropriately/inappropriately PM-3: Obstacle on collision path Identify Flaws Identify unsafe decisions (Control Action Selections) Identify inadequate Updates Process states Process behaviors Type of PM flaw Incorrect beliefs about process state (including modes) Incorrect beliefs about process behaviors Incorrect beliefs about environment Examples Driver thinks APA is enabled when APA is really disabled (PM-1) 16

16 Identify UCAs Identify variables PM-1: APA is enabled/disabled PM-2: APA computer reacting appropriately/inappropriately PM-3: Obstacle on collision path Identify Flaws Identify unsafe decisions (Control Action Selections) Identify inadequate Updates Process states Process behaviors Type of PM flaw Incorrect beliefs about process state (including modes) Incorrect beliefs about process behaviors Incorrect beliefs about environment Examples Driver thinks APA is enabled when APA is really disabled Driver thinks APA is reacting properly and will brake automatically 17

17 Identify UCAs Identify variables PM-1: APA is enabled/disabled PM-2: APA computer reacting appropriately/inappropriately PM-3: Obstacle on collision path Identify Flaws Identify unsafe decisions (Control Action Selections) Identify inadequate Updates Process states Process behaviors Type of PM flaw Incorrect beliefs about process state (including modes) Incorrect beliefs about process behaviors Incorrect beliefs about environment Examples Driver thinks APA is enabled when APA is really disabled Driver thinks APA is reacting properly and will brake automatically Driver thinks there is no obstacle when there is one Driver knows there is an obstacle but doesn t 18 know it s on a collision path

18 Identifying Flaws Incorrect beliefs about process state Automatic mode changes Previous commands ignored Phases of operation Incorrect beliefs about Process behaviors Consider perceived effect of control actions, behavior in other modes, past experiences, etc. Incorrect beliefs about environment Consider changes to environment, similar past environments, etc. Known Unknown and Unknown Unknowns Believes there is a pedestrian in the way Believes there is no pedestrian Believes they don t know if there is a pedestrian (may trigger a check) Process states Process behaviors Consider inadequate feedback, driver may know something changed but doesn t know the new state, etc. Providing guidance to ensure coverage 19

19 Identify UCAs UCA-1: Driver does not brake when auto-parking and computer doesn t react to an obstacle Identify variables PM-1: APA is enabled/disabled PM-2: APA computer reacting appropriately/inappropriately PM-3: Obstacle on collision path Identify Flaws Identify flaws in Updates Identify unsafe Control Action Selections Control Actions Human Controller Devise control actions Process states Process behaviors PM Update 20 Inputs

20 Driver does not brake when auto-parking and computer doesn t react to an obstacle (UCA-1) Driver thinks APA is enabled when APA is really disabled (PM-1) Consider: 1. Automatic mode changes 2. Previous cmds ignored 3. Phases of operation 4. Etc. Human Controller Control Actions Devise control actions Process states Process behaviors PM Update Inputs 21

21 Driver does not brake when auto-parking and computer doesn t react to an obstacle (UCA-1) Driver thinks APA is enabled when APA is really disabled (PM-1) APA automatically disabled itself but driver didn t notice the change Human Controller Control Actions Devise control actions Process states Process behaviors PM Update Inputs 22

22 Driver does not brake when auto-parking and computer doesn t react to an obstacle (UCA-1) Driver thinks APA is enabled when APA is really disabled (PM-1) APA automatically disabled itself, driver noticed the change but didn t understand it Human Controller Control Actions Devise control actions Process states Process behaviors PM Update Inputs 23

23 Identify UCAs UCA-1: Driver does not brake for an obstacle when computer does not react appropriately to the obstacle Identify variables PM-1: APA reacting appropriately/inappropriately PM-2: Obstacle on collision path Identify Flaws Identify flaws in Updates Identify unsafe Control Action Selections Human Controller Control Actions Devise control actions Process states Process behaviors PM Update 24 Inputs

24 Identify unsafe Control Action Selections Driver does not brake when auto-parking and computer doesn t react to an obstacle (UCA-1) Human Controller Driver knows APA is on Driver knows APA hasn t reacted yet Driver knows there is an obstacle in the way Control Actions Devise control actions Process states Process behaviors PM Update Inputs 25

25 Identify unsafe Control Action Selections Driver does not brake when auto-parking and computer doesn t react to an obstacle (UCA-1) Maybe driver does not know they can control brake with APA on Human Controller Driver knows APA is on Driver knows APA hasn t reacted yet Driver knows there is an obstacle in the way Control Actions Devise control actions Process states Process behaviors PM Update Inputs 26

26 Identify unsafe Control Action Selections Driver does not brake when auto-parking and computer doesn t react to an obstacle (UCA-1) Human Controller Maybe driver decides to disable APA instead Driver knows APA is on Driver knows APA hasn t reacted yet Driver knows there is an obstacle in the way Control Actions Devise control actions Process states Process behaviors PM Update Inputs 27

27 Identify unsafe Control Action Selections Driver does not brake when auto-parking and computer doesn t react to an obstacle (UCA-1) Human Controller Driver may still be waiting for APA to act Driver knows APA is on Driver knows APA hasn t reacted yet Driver knows there is an obstacle in the way Control Actions Devise control actions Process states Process behaviors PM Update Inputs 28

28 Driver does not brake when auto-parking and computer doesn t react to an obstacle (UCA-1) Control Actions Identify unsafe Control Action Selections Consider whether the driver is aware they can control X Consider alternative driver controls/actions Consider other driver goals Human Controller Devise control actions Goals Driver knows APA is on Driver knows APA hasn t reacted yet Driver knows there is an obstacle in the way Process states Process behaviors PM Update Inputs 29

29 Identify UCAs Identify variables Identify Flaws Identify flaws in Updates Identify unsafe decisions (Control Action Selections) Human Controller Control Actions Devise control actions Process states Process behaviors PM Update Inputs 30

30 AUTOMATED PARKING Features of each system considered for this analysis: Level 0* Level 1 Level 2a Level 2b Level 3 No Driving Automation Driver Assistance Partial Automation Partial Automation Conditional Automation Steering - Braking - - Shifting and Acceleration Object and Event Detection and Response *System numbering is consistent with SAE definitions for levels of automation, while a and b indicate different implementations which are classified within the same SAE level. 31

31 AUTOMATED PARKING Level 1 Level 2a Level 2b Level 3 Driver Assistance Partial Automation Partial Automation Conditional Automation Driver UCAs APA Computer UCAs Total

32 AUTOMATED PARKING Level 1 Level 2a Level 2b Level 3 Driver Assistance Partial Automation Partial Automation Conditional Automation Driver UCAs APA Computer UCAs Total

33 AUTOMATED PARKING Level 1 Level 2a Level 2b Level 3 Driver Assistance Partial Automation Partial Automation Conditional Automation 35 in common 32 in common Driver UCAs in common APA Computer UCAs 5 in common 28 in common in common 40 in common 60 in common Total in common

Level 1 Level 2a Level 2b Level 3 Driver UCAs 42 41

34 Level 1 Level 2a Level 2b Level 3 Driver UCAs APA Computer UCAs Total

35 CONCLUSIONS New human engineering extension strengths: Provides additional guidance for engineers to understand and anticipate human interactions Can help suggest solutions, not just problems Can be used earlier in design process than detailed simulations or prototypes 37

STPA-based Model of Threat and Error Management in Dual Flight Instruction

STPA-based Model of Threat and Error Management in Dual Flight Instruction Ioana Koglbauer Graz University of Technology, Austria koglbauer@tugraz.at Threat and Error Management (TEM) Currently the Authorities