text: Vehicle safety depends on (a) the range of identified hazards and (b) the operational situations for which mitigations of these hazards are acceptably decreasing risk. Moreover, with an increasing degree of autonomy, risk ownership is likely to increase for vendors towards regulatory certification. Hence, highly automated vehicles have to be equipped with verified controllers capable of reliably identifying and mitigating hazards in all possible operational situations. To this end, available methods for the design and verification of automated vehicle controllers have to be supported by models for hazard analysis and mitigation.
  @cite_12: Autonomous planning in safety critical systemsis a difficult task where decisions must carefully balanceoptimisation for performance goals of the system while alsokeeping the system away from safety hazards. These tasksoften conflict, and hence present a challenging multi-objectiveplanning problem where at least one of the objectives relates tosafety risk. Recasting safety risk into an objective introducesadditional requirements on planning algorithms: safety riskcannot be "averaged out" nor can it be combined with otherobjectives without loss of information and losing its intendedpurpose as a tool in risk reduction. Thus, existing algorithmsfor multi-objective planning cannot be used directly as theydo not provide any facility to accurately track and updatesafety risk. A common workaround is to restrict availabledecisions to those guaranteed safe a priori, but this can beoverly conservative and hamper performance significantly. Inthis paper, we propose a planning algorithm based on multiobjectiveMonte-Carlo Tree Search to resolve these problems byrecognising safety risk as a first class objective. Our algorithmexplicitly models the safety of the system separately from theperformance of the system, uses safety risk to both optimiseand provide constraints for safety in the planning process, anduses an ALARP-based preference selection method to choose anappropriate safe plan from its output. The preference selectionmethod chooses from the set of multiple safe plans to weighrisk against performance. We demonstrate the behaviour ofthe algorithm using an example representative of safety criticaldecision-making.
summary: @cite_12 present an algorithm for finding permissive robot action plans optimal to safety and performance. They employ (helpful in regarding uncertainty and robot limitations) to model robot behavior, and two abstractions from this model to capture a system's modes and hazards. Our framework uses three layers of abstraction ( @math , @math , @math ), operational situations to capture control modes, and a structure to capture hazards. While they directly encode hazard severity for plan selection, our framework allows the planner to calculate the risk priority based on a causal event tree towards mishaps. As opposed to complete behavioral planning, our approach focuses the construction of mitigation planning models. For example, for system faults we can plan mitigations by using adaptation mechanisms of a given control system architecture.