arXiv subjects

Markus Maurer

Publications and source records attributed to Markus Maurer.

At least 19 recordsLinked to original sources

arXiv2026

Managing Inherent Risk: On the Conceptualization of Risk in Defense Systems

Certain defense systems are, by nature, deployed in a civilian environment in order to serve a defensive function for that environment. However, the risk involved with their deployment and operation poses a challenge for the public acceptance of these systems. Compared to safety engineering for civilian systems, the risk constellation is quite different. While reducing risk of safety-critical systems is generally desirable, defense systems are required to cause harm in order to be useful. In both cases, not all risk can be eliminated. The complex risk constellation of defense systems has implications for the systems' designs. We compare the concepts of risk in existing standards from both the civilian and the military domains. An extended constellation of risks needs to be considered, including risk caused by external threats to physical security. By including this risk constellation in public communication about defense systems, we aim to stimulate a productive debate.

eess.SY↗

arXiv2026

A Companion App for an Autonomous Family Vehicle: Identification of Values for an Autonomous Mobility System

In this paper, we present a companion app for an autonomous vehicle aimed at user groups who would normally require an accompanying person to drive them. Two aspects of a companion app are presented in this paper: First, the possibility for a trusted person to track the ride of the person in need of support and second, to put the settings of the vehicle for persons in need of support in the hands of a trusted person. In addition, this article describes the requirements and addressed values and discusses the safety-relevant aspects of such a companion app. We also discuss and identify the values that influence passengers and trusted persons using the companion app. Overall, a companion app can provide new perspectives and opportunities for people in need of support, allowing them to take advantage of the features offered by autonomous vehicles. It enables trusted individuals to configure the vehicle according to the passengers needs. Also such an app can be a mechanism to involve trusted persons in the options given by the vehicle and give them the possibility to adapt the vehicle to the needs of the person in need of support.

eess.SY↗

arXiv2026

Teleoperation Operational Design Domain based on Minimal Risk Maneuver Capability

This article discusses the concept of an Operational Design Domain (ODD) designed specifically for teleoperated road vehicles. For this purpose, the ODD concept designed for automated driving is adapted for teleoperation. As teleoperation becomes more common in regular traffic, the question arises under which operating conditions such vehicles are able and allowed to drive. Currently, these conditions are selected primarily based on network performance. From a safety perspective, it is difficult to base such a selection on a reliable connection because it is almost impossible to guarantee sufficient reliability. With this in mind, the ODD concept designed for automated driving is adapted for teleoperation: A concept is proposed for basing the ODD for a teleoperation system on the capability of the teleoperated vehicle to perform a minimal risk maneuver using a dedicated system designed solely for this purpose. This concept is then demonstrated using a use case example.

eess.SY↗

arXiv2026

Equalized Coverage in Motion Control Performance Prediction for Self-Adaptive Road Vehicles

Automated driving systems require monitoring mechanisms to ensure operation as intended, especially when system elements degrade and/or fail. Hence, capability monitoring is crucial in order to evaluate the system's remaining performance and implement capability-based behavior. In this paper, we investigate the dynamics of a highly over-actuated automated vehicle under actuator degradations and failures, affecting the vehicle's motion control capabilities. We propose a lightweight prediction model based on conformalized quantile regression that predicts whether an automated vehicle can be controlled with sufficiently low lateral deviation from a planned trajectory under nominal, degraded, and failed actuator conditions. We recognize that statistical guarantees should hold not only across all data (marginal coverage) but also for different regimes within the data (conditional coverage). We therefore employ equalized coverage methods to address this challenge. During runtime behavior generation our predictor can provide a heuristic for determining the admissible action space. Its application and limitations are discussed in this paper.

eess.SY↗

arXiv2025

Approaching Safety-Argumentation-by-Design: A Requirement-based Safety Argumentation Life Cycle for Automated Vehicles

Despite the growing number of automated vehicles on public roads, operating such systems in open contexts inevitably involves incidents. Developing a defensible case that the residual risk is reduced to a reasonable (societally acceptable) level is hence a prerequisite to be prepared for potential liability cases. A "safety argumentation" is a common means to represent this case. In this paper, we contribute to the state of the art in terms of process guidance on argumentation creation and maintenance - aiming to promote a safety-argumentation-by-design paradigm, which mandates co-developing both the system and argumentation from the earliest stages. Initially, we extend a systematic design model for automated driving functions with an argumentation layer to address prevailing misconceptions regarding the development of safety arguments in a process context. Identified limitations of this extension motivate our complementary design of a dedicated argumentation life cycle that serves as an additional process viewpoint. Correspondingly, we define literature- and expert-based process requirements. To illustrate the safety argumentation life cycle that we propose as a result of implementing these consolidated requirements, we demonstrate principles of the introduced process phases (baselining, evolution, continuous maintenance) by an argumentation example on an operational design domain exit response.

eess.SY↗

arXiv2025

Besondere Anforderungen des automatisierten Fahrens an den Entwurf

The development of automated vehicles and automated driving functions is an exceptionally complex task that requires the integration of numerous, sometimes conflicting interests and various constraints already in the early stages of system design. This chapter explains important challenges in concept specifications for automated driving and presents a systematic process model that contributes to overcoming the special requirements in this field. In addition, it describes the successful implementation of a structured concept specification for an automated vehicle guidance system. -- Die Entwicklung automatisierter Fahrzeuge und Fahrfunktionen stellt eine ausgesprochen komplexe Aufgabe dar, die bereits im Zuge des Systementwurfs die Einbeziehung einer Vielzahl teilweise konfliktärer Interessen und diverser Randbedingungen erfordert. Dieses Kapitel erläutert wichtige Herausforderungen bei Konzeptspezifikationen im Themenfeld des automatisierten Fahrens und stellt ein systematisches Prozessmodell vor, das einen Beitrag zur Erfüllung der besonderen Anforderungen des automatisierten Fahrens an den Entwurf leistet. Darüber hinaus wird die erfolgreiche Durchführung einer strukturierten Konzeptspezifikation für ein automatisiertes Fahrzeugführungssystem beschrieben.

eess.SY↗

arXiv2025

What's Really Different with AI? -- A Behavior-based Perspective on System Safety for Automated Driving Systems

Assuring safety for ``AI-based'' systems is one of the current challenges in safety engineering. For automated driving systems, in particular, further assurance challenges result from the open context that the systems need to operate in after deployment. The current standardization and regulation landscape for ``AI-based'' systems is becoming ever more complex, as standards and regulations are being released at high frequencies. This position paper seeks to provide guidance for making qualified arguments which standards should meaningfully be applied to (``AI-based'') automated driving systems. Furthermore, we argue for clearly differentiating sources of risk between AI-specific and general uncertainties related to the open context. In our view, a clear conceptual separation can help to exploit commonalities that can close the gap between system-level and AI-specific safety analyses, while ensuring the required rigor for engineering safe ``AI-based'' systems.

eess.SY↗

arXiv2025

Toward a Harmonized Approach -- Requirement-based Structuring of a Safety Assurance Argumentation for Automated Vehicles

Despite the increasing testing operations of automated vehicles on public roads, media reports on incidents show that safety issues caused by automated driving systems persist to this day. Manufacturers face high development uncertainty when aiming to deploy these systems in an open context. In particular, one challenge is establishing a valid argument at design time that the vehicles will exhibit reasonable residual risk when operating in its intended operational design domain. While there is extensive literature on assurance cases for safety-critical systems in general, the domain of automated driving lacks explicit requirements regarding the creation of safety assurance argumentations for automated vehicles. In this paper, we aim to narrow this gap by elaborating a requirement-based approach. We identify structural requirements for an argumentation based on published literature and supplement these with structural requirements derived from stakeholder concerns. We apply these requirements to obtain a proposal for a generic argumentation structure. The resulting "safety arguments" address the developed product (product argument), the underlying process (process argument) including its conformance/compliance to standards/laws (conformance/compliance argument), as well as an argumentation's context (context argument) and soundness (soundness argument). Finally, we outline argumentation principles in accordance with domain-specific needs and concepts.

eess.SY↗

arXiv2025

Towards Scenario- and Capability-Driven Dataset Development and Evaluation: An Approach in the Context of Mapless Automated Driving

The foundational role of datasets in defining the capabilities of deep learning models has led to their rapid proliferation. At the same time, published research focusing on the process of dataset development for environment perception in automated driving has been scarce, thereby reducing the applicability of openly available datasets and impeding the development of effective environment perception systems. Sensor-based, mapless automated driving is one of the contexts where this limitation is evident. While leveraging real-time sensor data, instead of pre-defined HD maps promises enhanced adaptability and safety by effectively navigating unexpected environmental changes, it also increases the demands on the scope and complexity of the information provided by the perception system. To address these challenges, we propose a scenario- and capability-based approach to dataset development. Grounded in the principles of ISO 21448 (safety of the intended functionality, SOTIF), extended by ISO/TR 4804, our approach facilitates the structured derivation of dataset requirements. This not only aids in the development of meaningful new datasets but also enables the effective comparison of existing ones. Applying this methodology to a broad range of existing lane detection datasets, we identify significant limitations in current datasets, particularly in terms of real-world applicability, a lack of labeling of critical features, and an absence of comprehensive information for complex driving maneuvers.

cs.CV↗

arXiv2025

Showcasing Automated Vehicle Prototypes: A Collaborative Release Process to Manage and Communicate Risk

The development and deployment of automated vehicles pose major challenges for manufacturers to this day. Whilst central questions, like the issue of ensuring a sufficient level of safety, remain unanswered, prototypes are increasingly finding their way into public traffic in urban areas. Although safety concepts for prototypes are addressed in literature, published work hardly contains any dedicated considerations on a systematic release for their operation. In this paper, we propose an incremental release process for public demonstrations of prototypes' automated driving functionality. We explicate release process requirements, derive process design decisions, and define stakeholder tasks. Furthermore, we reflect on practical insights gained through implementing the release process as part of the UNICAR$agil$ research project, in which four prototypes based on novel vehicle concepts were built and demonstrated to the public. One observation is the improved quality of internal risk communication, achieved by dismantling information asymmetries between stakeholders. Design conflicts are disclosed - providing a contribution to nurture transparency and, thereby, supporting a valid basis for release decisions. We argue that our release process meets two important requirements, as the results suggest its applicability to the domain of automated driving and its scalability to different vehicle concepts and organizational structures.

eess.SY↗

arXiv2025

A Concept for Semi-Automatic Configuration of Sufficiently Valid Simulation Setups for Automated Driving Systems

As simulation is increasingly used in scenario-based approaches to test Automated Driving Systems, the credibility of simulation results is a major concern. Arguably, credibility depends on the validity of the simulation setup and simulation models. When selecting appropriate simulation models, a trade-off must be made between validity, often connected to the model's fidelity, and cost of computation. However, due to the large number of test cases, expert-based methods to create sufficiently valid simulation setups seem infeasible. We propose using design contracts in order to semi-automatically compose simulation setups for given test cases from simulation models and to derive requirements for the simulation models, supporting separation of concerns between simulation model developers and users. Simulation model contracts represent their validity domains by capturing a validity guarantee and the associated operating conditions in an assumption. We then require the composition of the simulation model contracts to refine a test case contract. The latter contract captures the operating conditions of the test case in its assumption and validity requirements in its guarantee. Based on this idea, we present a framework that supports the compositional configuration of simulation setups based on the contracts and a method to derive runtime monitors for these simulation setups.

eess.SY↗

arXiv2025

Safety Blind Spot in Remote Driving: Considerations for Risk Assessment of Connection Loss Fallback Strategies

As part of the overall goal of driverless road vehicles, remote driving is a major emerging field of research of its own. Current remote driving concepts for public road traffic often establish a fallback strategy of immediate braking to a standstill in the event of a connection loss. This may seem like the most logical option when human control of the vehicle is lost. However, our simulation results from hundreds of scenarios based on naturalistic traffic scenes indicate high collision rates for any immediate substantial deceleration to a standstill in urban settings. We show that such a fallback strategy can result in a SOTIF-relevant hazard, raising the question whether this design decision is acceptable. Therefore, from a safety perspective, we call this problem a safety blind spot, as safety analyses in this regard seem to be very rare. In this article, we first present a simulation on a naturalistic dataset that shows a high probability of collision in the described case. Second, we discuss the severity of the resulting potential rear-end collisions and provide an even more severe example by including a large commercial vehicle in the potential collision.

eess.SY↗

arXiv2025

A Review of Conceptualizations of Safety and Risk in Current Automated Driving Regulation

"Safety" and "Risk" are key concepts for the design and development of automated vehicles. For the market introduction or large-scale field tests, both concepts are not only relevant for engineers developing the vehicles, but for all stakeholders (e.g., regulators, lawyers, or the general public) who have stakes in the technology. In the communication between stakeholder groups, common notions of these abstract concepts are key for efficient communication and setting mutual expectations. In the European market, automated vehicles require Europe-wide type approval or at least operating permits in the individual states. For this, a central means of communication between regulators and engineers are regulatory documents. Flawed terminology regarding the safety expectations for automated vehicles can unnecessarily complicate relations between regulators and manufacturers, and thus hinder the introduction of the technology. In this paper, we review relevant documents at the UN- and EU-level, for the UK, and Germany regarding their (implied) notions of safety and risk. We contrast the regulatory notions with established and more recently developing notions of safety and risk in the field of automated driving. Based on the analysis, we provide recommendations on how explicit definitions of safety and risk in regulatory documents can support rather than hinder the market introduction of automated vehicles.

eess.SY↗

arXiv2025

Towards Closing the Gap between Model-Based Systems Engineering and Automated Vehicle Assurance: Tailoring Generic Methods by Integrating Domain Knowledge

Designing, assuring and releasing safe automated vehicles is a highly interdisciplinary process. As complex systems, automated driving systems will inevitably be subject to emergent properties, i. e., the properties of the overall system will be more than just a sum of the properties of its integrated elements. Safety is one example of such emergent properties. In this regard, it must be ensured that effects of emergence do not render an overall system that is composed of safety-approved sub systems unsafe. The key challenges in this regard are twofold: Regarding the interdisciplinary character of the development and assurance processes, all relevant stakeholders must speak a common language and have a common understanding of the key concepts that influence system safety. Additionally, the individual properties of system elements should remain traceable to the system level. Model-Based Systems Engineering (MBSE) provides an interdisciplinary mindset, as well as methods and processes to manage emergent system properties over the entire system lifecycle. By this, MBSE provides tools that can assist the assurance process for automated vehicles. However, concepts from the domain of MBSE have a reputation for not being directly accessible for domain experts who are no experts in the field of Systems Engineering. This paper highlights challenges when applying MBSE methods to the design and development of automated driving systems. It will present an approach to create and apply domain-specific SysML profiles, which can be a first step for enhancing communication between different stake-holders in the development and safety assurance processes.

eess.SY↗

arXiv2024

An Ontology-based Approach Towards Traceable Behavior Specifications in Automated Driving

Vehicles in public traffic that are equipped with Automated Driving Systems are subject to a number of expectations: Among other aspects, their behavior should be safe, conforming to the rules of the road and provide mobility to their users. This poses challenges for the developers of such systems: Developers are responsible for specifying this behavior, for example, in terms of requirements at system design time. As we will discuss in the article, this specification always involves the need for assumptions and trade-offs. As a result, insufficiencies in such a behavior specification can occur that can potentially lead to unsafe system behavior. In order to support the identification of specification insufficiencies, requirements and respective assumptions need to be made explicit. In this article, we propose the Semantic Norm Behavior Analysis as an ontology-based approach to specify the behavior for an Automated Driving System equipped vehicle. We use ontologies to formally represent specified behavior for a targeted operational environment, and to establish traceability between specified behavior and the addressed stakeholder needs. Furthermore, we illustrate the application of the Semantic Norm Behavior Analysis in a German legal context with two example scenarios and evaluate our results. Our evaluation shows that the explicit documentation of assumptions in the behavior specification supports both the identification of specification insufficiencies and their treatment. Therefore, this article provides requirements, terminology and an according methodology to facilitate ontology-based behavior specifications in automated driving.

cs.SE↗

arXiv2024

Conformal Prediction of Motion Control Performance for an Automated Vehicle in Presence of Actuator Degradations and Failures

Automated driving systems require monitoring mechanisms to ensure safe operation, especially if system components degrade or fail. Their runtime self-representation plays a key role as it provides a-priori knowledge about the system's capabilities and limitations. In this paper, we propose a data-driven approach for deriving such a self-representation model for the motion controller of an automated vehicle. A conformalized prediction model is learned and allows estimating how operational conditions as well as potential degradations and failures of the vehicle's actuators impact motion control performance. During runtime behavior generation, our predictor can provide a heuristic for determining the admissible action space.

cs.RO↗

arXiv2024

A Prototypical Expert-Driven Approach Towards Capability-Based Monitoring of Automated Driving Systems

Supervising the safe operation of automated vehicles is a key requirement in order to unleash their full potential in future transportation systems. In particular, previous publications have argued that SAE Level 4 vehicles should be aware of their capabilities at runtime to make appropriate behavioral decisions. In this paper, we present a framework that enables the implementation of an online capability monitor. We derive a graphical system model that captures the relationships between the quality of system elements across different architectural views. In an expert-driven approach, we parameterize Bayesian Networks based on this structure using Fuzzy Logic. Using the online monitor, we infer the quality of the system's capabilities based on technical measurements acquired at runtime.

eess.SY↗

arXiv2024

Identifikation auslösender Umstände von SOTIF-Gefährdungen durch systemtheoretische Prozessanalyse

Developers have to obtain a sound understanding of existing risk potentials already in the concept phase of driverless vehicles. Deductive as well as inductive SOTIF analyses of potential triggering conditions for hazardous behavior help to achieve this goal. In this regard, ISO 21448 suggests conducting a System-Theoretic Process Analysis (STPA). In this article, we introduce German terminology for SOTIF considerations and critically discuss STPA theory in the course of an example application, while also proposing methodological additions. -- -- Um bereits in der Konzeptphase autonomer Fahrzeuge einen fundierten Eindruck bestehender Risikopotenziale zu erhalten, werden im Zuge von deduktiven und induktiven SOTIF-Analysen mögliche auslösende Umstände für gefährliches Verhalten untersucht. In diesem Zusammenhang wird in der ISO 21448 die Durchführung einer systemtheoretischen Prozessanalyse (STPA) vorgeschlagen. In diesem Beitrag führen wir deutsche Terminologie für SOTIF-Betrachtungen ein und setzen uns im Zuge einer Anwendung kritisch mit der STPA-Theorie auseinander, wobei wir begleitend methodische Ergänzungen anregen.

eess.SY↗