The switch to service-oriented architectures in the automotive sector offers the opportunity to address key industry challenges, such as the reusability of hardware and software components, and the more efficient integration and maintainability of digital functions. The service-oriented architecture also provides the basis for the implementation of cloud-based vehicle software components. Offloading to the cloud is an upcoming option for compute-intensive functions to satisfy high resource demands. Advanced control mechanisms, such as model predictive control represent a particular component that requires high computing resources. Against this background, the overarching aim of this study is to investigate the control-over-the-air approach using the example of heating,ventilation, and air-conditioning control of battery electric buses. For this purpose, a hardware setup was used to assess the suitability of cloud-based control and investigate the need for a fallback in the vehicle and potential energy savings through offloading.

Precise perception of the environment is essential in highly automated driving systems, which rely on machine learning tasks such as object detection and segmentation. Compression of sensor data is commonly used for data handling, while virtualization is used for hardware-in-the-loop validation. Both methods can alter sensor data and degrade model performance. This necessitates a systematic approach to quantifying image validity. This paper presents a four-step framework to evaluate the impact of image modifications on machine learning tasks. First, a dataset with modified images is prepared to ensure one-to-one matching image pairs, enabling measurement of deviations resulting from compression and virtualization. Second, image deviations are quantified by comparing the effects of compression and virtualization against original camera-based sensor data. Third, the performance of state-of-the-art object detection and semantic segmentation models is analyzed to determine how altered input data affects perception tasks, including bounding box accuracy and reliability. Finally, a correlation analysis is performed to identify relationships between image quality and model performance. As a result, the LPIPS metric achieves the highest correlation between image deviation and machine learning performance across all evaluated machine learning tasks.

Ensuring stability and robustness in highly automated vehicle (HAV) control systems is critical for guaranteeing the safety of the intended functionality (SotiF) under real-world uncertainties inside a defined operational design domain (ODD). This paper presents a formal verification framework utilizing sum-of-squares (SOS) optimization to quantify and guarantee nonlinear system stability and robust performance in the presence of parametric uncertainties and environmental disturbances. We analyze a benchmark automated lane-following use case (UC) and verify polynomial system representations of the vehicle architecture against worst-case deviations using region of attraction (RoA) and robust positive invariant (RPI) sets. Simulation-based statistical validation using high-fidelity vehicle models confirms the effectiveness of the proposed method for formal robust control certification.

Despite advancements in perception and planning for autonomous vehicles (AVs), validating their performance remains a significant challenge. The deployment of planning algorithms in real-world environments is often ineffective due to discrepancies between simulations and real traffic conditions. Evaluating AVs planning algorithms in simulation typically involves replaying driving logs from recorded real-world traffic. However, entities replayed from offline data are not reactive, lack the ability to respond to arbitrary AV behavior, and cannot behave in an adversarial manner to test certain properties of the driving policy. Therefore, simulation with realistic and potentially adversarial entities represents a critical task for AV planning software validation. In this work, we aim to review current research efforts in the field of traffic simulation, focusing on the application of advanced techniques for modeling realistic and adversarial behaviors of traffic entities. The objective of this work is to categorize existing approaches based on the proposed classes of traffic entity behavior and scenario behavior control. Moreover, we collect traffic datasets and examine existing traffic simulations with respect to their employed default traffic entities. Finally, we identify challenges and open questions that hold potential for future research.

Vehicles continue to evolve toward automation and connectivity. These software-defined vehicles comprise more potential vulnerabilities and a larger attack surface, including threats to safety. To ensure these cybersecurity risks are properly managed, it is imperative to implement monitoring, analysis and response capabilities to new threats and vulnerabilities. Analysis and response, to be carried out in a Vehicle Security Operations Center, require decision-making, for which awareness of current risks is required. To this end, this paper proposes two elements: First, a holistic monitoring concept that provides data from the vehicle fleet and background information available particularly in the automotive environment. Second, a formalized data model that connects the monitored information to a comprehensive situational understanding of the security posture. To define such a model, we analyzed cyber situation awareness and automotive data models. Being graph-based, our new model shall enable straightforward retrieval of relationships between risks, assets and existing knowledge and provide a flexible backbone for both immediate as well as strategic decisions.

The seamless and secure integration of subsystems is a pivotal requirement within contemporary automotive development, necessitating the application of design methodologies like the Vee model. While this approach includes dedicated verification steps for the included contexts and provides a high level of assurance that the system will operate correctly under specified conditions, formalizing specifications outside its operational design domain is per definition not included. Additionally, black-box systems like machine learning based functions prove difficulty to test by these traditional methodologies. In this project, we introduce and demonstrate a design workflow combining the Vee model design paradigm with continuous data-driven software engineering. Our workflow assists the continuous, safe and secure development and improvement of consumer vehicle functionality over the product lifecycle. This is achieved through the continuous monitoring of anomalies, as well as system states that deviate from the established design domain. The UNCOVER methodology consists of a continuous reduction in the amount of necessary monitored messages and presents a methodology throughout the entirety of the product lifecycle. We demonstrate our methodology through a simulation and show our automatic generation of monitoring components, and an automated preselection of identified safety or security incidents.

Due to the increasing automation and connectivity of future, software-defined vehicles, there is a growing interest in safety in this area. Vehicle-to-Everything (V2X) communication is a crucial aspect of this. However, testing V2X applications in the real environment poses a number of challenges, such as the cost of renting test tracks and integrating V2X technology. To develop and test V2X applications more cheaply and at early development stages, simulation is a key enabler. There are several open-source tools that can simulate V2X communication, but a comprehensive and easy-to-use solution that enables to simulate V2X communication combined with sensor data required for automated driving is missing. Therefore, this paper presents an open-source approach that extends the CARLA simulation platform with a new module to create a unified environment for developing V2X applications in simulation. Different parameters can be set individually to account for real-world sensor’s differences. Mechanisms for generating, transmitting and receiving Cooperative Awareness Messages (CAM) are implemented. For the transmission, different propagation models are included, taking into account the outlines of vehicles and buildings: Line of sight (LOS), non-line of sight due to vehicles (NLOSv) and non-line of sight due to static objects (NLOSb). We perform a benchmark measurement with a varying number of simulated vehicles, indicating that simulating the V2X communication introduces only a small overhead to the simulated sensors, such as cameras. The code for the V2X additions to CARLA is available online.

Huge image data sets are the foundation for the development of the perception of automated driving systems. A large number of images is necessary to train robust neural networks that can cope with diverse situations. A sufficiently large data set contains challenging situations and objects. For testing the resulting functions, it is necessary that these situations and objects can be found and extracted from the data set. While it is relatively easy to record a large amount of unlabeled data, it is far more difficult to find demanding situations and objects. However, during the development of perception systems, it must be possible to access challenging data without having to perform lengthy and time-consuming annotations. A developer must therefore be able to search dynamically for specific situations and objects in a data set. Thus, we designed a method which is based on state-of-the-art neural networks to search for objects with certain properties within an image. For the ease of use, the query of this search is described using natural language. To determine the time savings and performance gains, we evaluated our method qualitatively and quantitatively on automotive data sets.

The use of neural networks in embedded systems is becoming increasingly common, but these systems often operate in safety-critical environments, where a failure or incorrect output can have serious consequences. Therefore, it is essential to verify the expected operation of neural networks before deploying them in such settings. In this publication, we present a novel approach for verifying the correctness of these networks using a nonlinear equation system under the assumption of closed-form activation functions. Our method is able to accurately predict the output of the network for given specification intervals, providing a valuable tool for ensuring the reliability and safety of neural networks in embedded systems.

Modern vehicles increasingly rely on electronics, software, and communication technologies (cyber space) to perform their driving task. Over-The-Air (OTA) connectivity further extends the cyber space by creating remote access entry points. Accordingly, the vehicle is exposed to security attacks that are able to impact road safety. A profound understanding of security attacks, vulnerabilities, and mitigations is necessary to protect vehicles against cyber threats. While automotive threat descriptions, such as in UN R155, are still abstract, this creates a risk that potential vulnerabilities are overlooked and the vehicle is not secured against them. So far, there is no common understanding of the relationship of automotive attacks, the concrete vulnerabilities they exploit, and security mechanisms that would protect the system against these attacks. In this article, we aim at closing this gap by creating a mapping between UN R155, Microsoft STRIDE classification, Common Attack Pattern Enumeration and Classification (CAPEC), and Common Weakness Enumeration (CWE). In this way, already existing detailed knowledge of attacks, vulnerabilities, and mitigations is combined and linked to the automotive domain. In practice, this refines the list of UN R155 threats and therefore supports vehicle manufacturers, suppliers, and approval authorities to meet and assess the requirements for vehicle development in terms of cybersecurity. Overall, 204 mappings between UN threats, STRIDE, CAPEC attack patterns, and CWE weaknesses were created. We validated these mappings by applying our Automotive Attack Database (AAD) that consists of 361 real-world attacks on vehicles. Furthermore, 25 additional attack patterns were defined based on automotive-related attacks.

Numerous applications in our everyday life use artificial intelligence (AI) methods for speech and image recognition, as well as the recognition of human behavior. Especially the latter application represents an interesting research field for self-learning systems based on AI methods in the automotive domain. Human driving behavior is determined by routines that an AI system can learn, thereby predicting future actions. However, the methods and tools for validating these systems are insufficient and need to be adapted to the new types of self-learning algorithms. Our framework combines scenario-based testing and metamorphic testing to address the challenges of ensuring correctness and reliability in dynamic and probabilistic SLS. A proof of concept is performed using the example of a self-learning comfort function in a vehicle. The correct functionality is shown by comparing the generated test cases. The concept addresses the main challenges in testing self-learning systems, in particular, the generation of test inputs and the creation of a test oracle.

Since interoperability between medical devices is becoming mandatory in the Operating Room (OR), manufacturer-independent communication standards following a Plug and Play (PnP) approach are on the rise. Medical devices such as Operating Room tables (OR tables) are also reconfigurable and modular systems following a PnP approach. But enabling a networked system with multiple reconfigurable medical devices in a highly regulated and safety-critical area requires a continuous architecture with clear semantics. Thus, we propose an ontology-based service composition in a Service-Oriented architecture (SOA) for modular and interoperable medical devices that ensures unified semantics. Therefore, we use an OR table that is connected to other devices in an OR as an example.

Due to the increasing automation and connectivity of future, software-defined vehicles, the interest in safety and security in this field is growing. In contrast to automated driving functions, which today are only tested and approved for specific operating conditions, the vehicle must be safe and secure in any situation, even if there is a malfunction or intentional manipulation. Resilient software and hardware architectures for vehicles are, therefore, a research topic of growing importance. However, due to the holistic nature of this approach, researching and testing these systems is fraught with challenges. For example, once Machine Learning-based approaches come into play, large amounts of data are required. At the same time, tests of the systems need to take into account the whole vehicle and its ecosystem and be scalable and user-friendly. This work, therefore, presents a new simulation-based method for testing and developing functions for software-defined connected vehicles. The focus is especially on safety and security in combination with cloud services and the consideration of the vehicle fleet. The technologies are presented in detail, relying mainly on the simulator CARLA, the virtualization with Proxmox, and ROS2-based vehicle functions. What differentiates this approach from others is the purely virtual and open-source approach, which increases the availability for others. Results are shown based on early quantitative measures and on outlining two exemplary use cases.

Scenario generation is one of the essential steps in scenario-based testing and, therefore, a significant part of the verification and validation of driver assistance functions and autonomous driving systems. However, the term scenario generation is used for many different methods, e.g., extraction of scenarios from naturalistic driving data or variation of scenario parameters. This survey aims to give a systematic overview of different approaches, establish different categories of scenario acquisition and generation, and show that each group of methods has typical input and output types. It shows that although the term is often used throughout literature, the evaluated methods use different inputs and the resulting scenarios differ in abstraction level and from a systematical point of view. Additionally, recent research and literature examples are given to underline this categorization.

An essential requirement for scenario-based testing the identification of critical scenes and their associated scenarios. However, critical scenes, such as collisions, occur comparatively rarely. Accordingly, large amounts of data must be examined. A further issue is that recorded real-world traffic often consists of scenes with a high number of vehicles, and it can be challenging to determine which are the most critical vehicles regarding the safety of an ego vehicle. Therefore, we present the inverse universal traffic quality, a criticality metric for urban traffic independent of predefined adversary vehicles and vehicle constellations such as intersection trajectories or car-following scenarios. Our metric is universally applicable for different urban traffic situations, e.g., intersections or roundabouts, and can be adjusted to certain situations if needed. Additionally, in this paper, we evaluate the proposed metric and compares its result to other well-known criticality metrics of this field, such as time-to-collision or post-encroachment time.

Autonomous Vehicles (AVs) operate in public areas without the intervention of a human driver. This vulnerable environment brings explicit safety requirements to the AV which must be considered in the systems development phase. Such safety critical systems must comply to the safety standard ISO26262 and shall contain mechanisms to detect and react on faults.The current approach in signal-oriented E/E architectures is to use microprocessors with lockstep mechanisms. Those processors execute the same calculation on multiple cores, thereby being able to detect faults. However, the increased safety level of those processors comes along with a limited amount of performance.This work contains a concept to overcome the problem of the limited performance by using a recent service-oriented E/E architecture (SOA). Therefore, the redundant processing is moved from local microprocessors to multiple processors on distributed machines which are connected with Ethernet. The integrity is ensured by the novel approach of "voters as a service" which shares each calculation result across both compute units and redundantly compares it.The general feasibility of the concept is shown by the realization as a systematic approach containing two use-cases. The experiment indicates promising results to overcome the problem of ensuring the integrity of compute intensive safety critical functions which require more performance than the classic lockstep microprocessors are able to provide.

Vehicle electrification is picking up speed in local public transport. Battery electric buses replace diesel buses and must therefore be able to serve the routes of diesel buses on an equal footing. Reducing the energy consumption of electric buses can make a major contribution to significantly increase their driving range and their possible field of application for transport companies. Therefore, an analysis of the different consumers and influencing factors on the energy consumption was conducted on the basis of real measurement data. An overview of existing optimization approaches is given, classifying them in the different layers of component-based, system-based and cloud-based optimization.

Verification and validation are major challenges for developing automated driving systems. A concept that gets more and more recognized for testing in automated driving is scenario-based testing. However, it introduces the problem of what scenarios are relevant for testing and which are not. This work aims to find relevant, interesting, or critical parameter sets within logical scenarios by utilizing Bayes optimization and Gaussian processes. The parameter optimization is done by comparing and evaluating six different metrics in two urban intersection scenarios. Finally, a list of ideas this work leads to and should be investigated further is presented.

The lifecycles of software updates for Cyber Physical Systems are significantly decreasing. Especially for safety-critical functions, these must be carefully tested for compatibility to target configurations. In order to formalize the requirements of the system and to validate software changes in a modular way, contract-based design can be used for formal verification. A contract is defined as a pair of an assumption describing the required conditions for the working environment of a component, and a guarantee, which specifies its expected behavior including timing properties and value ranges of interfaces. In this work, we present a concept for efficient verification of a software update in a contract-based development environment with consideration of several system variants. The concept is based on an incremental refinement verification methodology which uses deltas, i.e. differences between variants, to automatically propagate changes and retest only the incrementally relevant contracts. By applying the methodology in a case study for a network representing a variable Adaptive Cruise Control system, we could demonstrate its applicability and its advantages in reducing the total verification effort for product line evolution.

The development of highly automated driving functions is currently one of the key drivers for the automotive industry and research. In addition to the technical constraints in the implementation of these functions, a major challenge is the verification of functional safety. Conventional approaches aiming at statistical validation in the sense of real test drives are reaching their economic limits. On the other hand, there are simulation methods that allow a lot of freedom in test case design, but whose representativeness and relevance must be proven separately. In this paper an approach is presented that allows to generate critical concrete scenarios and test cases for automated driving functions by means of a reinforcement learning based optimization using here the example of an overtaking assistant. For this purpose, a Q-Learning approach is used that automates the parameter generation for the test cases. While pure combinatorics of the variable parameters leads to an unmanageable amount of test cases, the percentage of actually relevant critical test cases is very low. In this work we show how the share of critical and thus relevant test cases can be increased significantly by using the presented method compared to a purely combinatorial parameter variation.

Abstract Context Automotive software architectures describe distributed functionality by an interaction of software components. One drawback of today’s architectures is their strong integration into the onboard communication network based on predefined dependencies at design time. The idea is to reduce this rigid integration and technological dependencies. To this end, service-oriented architecture offers a suitable methodology since network communication is dynamically established at run-time. Aim We target to provide a methodology for analysing hardware resources and synthesising automotive service-oriented architectures based on platform-independent service models. Subsequently, we focus on transforming these models into a platform-specific architecture realisation process following AUTOSAR Adaptive. Approach For the platform-independent part, we apply the concepts of design space exploration and simulation to analyse and synthesise deployment configurations, i. e., mapping services to hardware resources at an early development stage. We refine these configurations to AUTOSAR Adaptive software architecture models representing the necessary input for a subsequent implementation process for the platform-specific part. Result We present deployment configurations that are optimal for the usage of a given set of computing resources currently under consideration for our next generation of E/E architecture. We also provide simulation results that demonstrate the ability of these configurations to meet the run time requirements. Both results helped us to decide whether a particular configuration can be implemented. As a possible software toolchain for this purpose, we finally provide a prototype. Conclusion The use of models and their analysis are proper means to get there, but the quality and speed of development must also be considered.

The increasing level of connectivity within vehicles and their environment such as backend or infrastructure increases the risk of potential vulnerabilities regarding information security. In order to minimize these risks, vehicle manufacturers are forced to implement appropriate countermeasures, which are increasingly embedded in approval regulations. As a reactive countermeasure, various approaches to Intrusion Detection Systems (IDSs) exist within the research area to detect attack attempts as early as possible. In this paper, we shift into a new research direction and present an approach for the detection of anomalies in automotive diagnostic applications by using a statistical language model. We analyze incoming diagnostic frames using two different n-gram models (sequence-based and byte-based) to determine whether sequences and the bytes embedded are contextually valid. Since there is currently no publicly available data set of diagnostic data, the detection rate is limited to learned diagnostic uses cases from our own data recordings. Since it is very challenging to generate such a large amount of data, a further enhancement of the approach based on unsupervised learning by using a dynamic anomaly threshold would be promising.

Autonomous vehicles are required to operate among highly mixed traffic during their early market-introduction phase, solely relying on local sensory with limited range. Comprehending and navigating complex urban environments is potentially not feasible with sufficient reliability using the aforesaid approach. To address this challenge, our present work aims to conceptualize, implement and evaluate an end-to-end cooperative perception system using novel techniques. A comprehensive yet extensible modeling approach for dynamic traffic scenes is proposed first. It is based on probabilistic entity-relationship models, accounts for uncertain observations and combines low-level attributes with high-level relational knowledge in a generic way. Second, the design of a holistic, distributed software system based on edge computing principles is proposed as a foundation for multi-vehicle high-level sensor fusion. In contrast to most existing approaches, this solution is designed to rely on Cellular- V2xcommunication and employs geographically distributed computation nodes as central data brokers. The modular proof-of-concept implementation is evaluated in different simulated scenarios to assess the system's performance both qualitatively and quantitatively.

Automated driving is one of the main drivers in the automotive industry. On the way to full automation current Advanced Driver Assistant Systems (ADAS) and Automated Driving Systems (ADS) backed by new and enhanced sensor systems take over more and more driving tasks. Developers and engineers are challenged with the increasing Operational Design Domain (ODD) of their systems. The application of these systems has become a daunting task, as a manifold of new situations has to be covered. The number of application parameters has skyrocketed and their scopes are intertwined and not always visible to the vehicle's driver. Virtual, simulation based approaches are on the rise to give developers another tool for the application of their systems. In order to retrieve valid evaluations from the simulation, current research focuses on objectifying the subjective passenger assessments that so far were only conceivable in real world driving tests. Furthermore, with objective and comparable simulation results on statistically significant data samples, application parameters whose effects are not clearly visible in real world driving tests can now be applied systematically and justified. We propose a process reference model for the virtual application of predictive control features with a clear focus on the quality and representativity of the virtual application.

Once considered futuristic, machine learning is already integrated into our everyday life and will shape many areas of our daily life in the future: This success is mainly due to the progress in machine learning and the increase in computing power. While machine learning is used to solve partial problems in autonomous driving, the support of high-resolution maps severely limits the use of autonomous vehicles in unknown areas. At the same time, the structuring of the overall problem into modular subsystems for perception, self-localization, planning, and control limits the performance of the systems. A particularly promising alternative is end-to-end learning, which optimizes the system as a whole. In this work, we investigate the application of an end-to-end learning method for autonomous driving, employing reinforcement learning. For this purpose, a system is developed which allows the examination of different reinforcement learning approaches in a simulated environment. The system receives simulated images of the front camera as input and provides the control values for steering angle, accelerator, and brake pedal position as direct output. The desired behavior is learned automatically through interaction with the environment. The reward function is currently optimized for following a lane at the highest possible speed. Using specially modeled environments with different levels of detail, multiple deep reinforcement learning approaches are compared. Among other aspects, the extent to which a transferability of trained models to unknown environments is possible is examined. Our investigations show that Soft Actor-Critic is the best choice of the tested algorithms concerning learning speed and the ability to generalize to unseen environments.

Ensuring the functional correctness and safety of autonomous vehicles is a major challenge for the automotive industry. However, exhaustive physical test drives are not feasible, as billions of driven kilometers would be required to obtain reliable results. Scenario-based testing is an approach to tackle this problem and reduce necessary test drives by replacing driven kilometers with simulations of relevant or interesting scenarios. These scenarios can be generated or extracted from recorded data with machine learning algorithms or created by experts. In this paper, we propose a novel graphical scenario modeling language. The graphical framework allows experts to create new scenarios or review ones designed by other experts or generated by machine learning algorithms. The scenario description is modeled as a graph and based on behavior trees. It supports different abstraction levels of scenario description during software and test development. Additionally, the graph-based structure provides modularity and reusable sub-scenarios, an important use case in scenario modeling. A graphical visualization of the scenario enhances comprehensibility for different users. The presented approach eases the scenario creation process and increases the usage of scenarios within development and testing processes.

Modern cars are equipped with a wide variety of sensors generating continually growing amounts of data. This data is transmitted via bus systems such as Controller Area Network (CAN) inside of the vehicle to the microcontroller-based Electronic Control Units. By connecting the vehicle to its surroundings using wireless interfaces, this data becomes accessible to the vehicle manufacturer from a distance. Through the opening to the outside, cyber attacks can exploit these interfaces and introduce major risks to the privacy and safety of vehicle users. Hence, suitable methods for vehicle security monitoring such as intrusion detection and logging are needed. In this work, we focus on the logging of network data, since this data is useful for the development of security updates, countermeasures and incident signatures. On this account, we propose a new method to aggregate the data of the CAN bus. The method combines CAN frames into so-called flows. Each flow contains a set of packets that share a certain common attribute (e.g.: frame type and identifier). To integrate security monitoring of vehicle fleets seamlessly into backend server systems, the gathered CAN flow data is stored in an industry standard data format. Additionally, the payload data is included in the flow format using a compression algorithm to leverage deep-packet inspection. The evaluation results with realworld vehicle data indicate that in our case about 40 % reduction of the overall data size is possible with our method compared to industry-standard formats for storing CAN frames. On this account, we propose a new method to aggregate the data of the CAN bus. The method combines CAN frames into so-called flows. Each flow contains a set of packets that share a certain common attribute (e.g.: frame type and identifier). To integrate security monitoring of vehicle fleets seamlessly into backend server systems, the gathered CAN flow data is stored in an industry standard data format. Additionally, the payload data is included in the flow format using a compression algorithm to leverage deep-packet inspection. The evaluation results with realworld vehicle data indicate that in our case about 40 % reduction of the overall data size is possible with our method compared to industry-standard formats for storing CAN frames.

This paper proposes an approach for a tool-agnostic and heterogeneous static code analysis toolchain in combination with an exchange format. This approach enhances both traceability and comparability of analysis results. State of the art toolchains support features for either test execution and build automation or traceability between tests, requirements and design information. Our approach combines all those features and extends traceability to the source code level, incorporating static code analysis. As part of our approach we introduce the "ASSUME Static Code Analysis tool exchange format" that facilitates the comparability of different static code analysis results. We demonstrate how this approach enhances the usability and efficiency of static code analysis in a development process. On the one hand, our approach enables the exchange of results and evaluations between static code analysis tools. On the other hand, it enables a complete traceability between requirements, designs, implementation, and the results of static code analysis. Within our approach we also propose an OSLC specification for static code analysis tools and an OSLC communication framework.

In recent years, numerous innovations in the automotive industry have addressed the field of driver assistance systems and automated driving. Therefore additional required sensors, as well as the need for digital maps and online services, lead to an ever-increasing system space, which must be covered. Established test approaches in the area of Hardware-in-the-Loop (HiL) use predefined and structured test cases to test the systems on the basis of requirements. In the approach of systematic testing, an evaluation is only carried out for a specific test case respectively the duration of a test step. This paper presents a concept for an automated quality assessment of driving scenarios or digital test drives. The aim is the analysis and subsequent evaluation of continuous function behavior during a realistic test drive within a simulated environment. Compared to conventional systematic test approaches, the presented concept allows a continuous evaluation of the test drive, whereby multiple evaluations of systems in similar scenarios with deviating boundary conditions is possible. For the first time, this enables a functional evaluation of a complete test drive comprising numerous scenarios and situations. The presented approach was prototypically implemented and demonstrated on a Hardware-in-the-Loop (HiL) test bench evaluating an adaptive cruise control (ACC) system.

As development of Automated Driving Systems (ADS) advances, new methods for validation and verification (V&V) are needed. A promising approach for V&V is scenario-based testing. Recorded real-world-driving-data constitutes a useful source for the extraction of scenarios as they ensure a high level of realism. Since recorded data is typically unlabeled, the benefits drawn from the large amounts of available data are limited, e.g. the data interpretation with respect to the inherent driving scenarios is challenging. Manual data inspection or rule-based approaches are hardly scalable to neither big datasets nor numerous different scenario types. Hence, there is a need of automated data analysis tools, e.g. for labeling on a semantic level. Many current approaches try to accomplish that based on neural networks. This arises the need for a consistent, valid and machine-readable representation of a driving scenario. In this paper, a representation of a scenario is defined as a top-view grid, comprising the dynamic objects and the static environment, thereby allowing a consistent interpretation of all relevant aspects of a driving scenario. Furthermore, temporal scenario aspects have to be covered as well. Therefore, a neural network architecture for the extraction of both spatial and temporal features is described. Using the proposed feature extractor, the recorded driving data gets transformed to a reduced abstract feature space. With the autoencoder, a method for efficient training of the feature extractor is described. The combined approach enables the development of scalable and efficient methods for data analytics in large quantities of real driving data, e.g. automated labeling of big datasets or the scanning for rarely happening corner cases.

The transformation in the automotive industry continues and topics such as intelligent software applications and over-the-air connectivity push future vehicle innovations, which will lead to a further increase in the number of connected vehicles in the upcoming years. Many wireless connections between vehicles to the infrastructure or mobile devices arise. In order to protect this communication against security attacks, various protection mechanisms have to be integrated into the vehicle to ensure information security. One of these measures is the implementation of a distributed access control to protect different communication channels against unauthorized access attempts. This requires a well-defined assignment of access permissions for each communication node combined with certain environmental conditions such as location, time or vehicle state. However, current automotive systems do not have extensive access controls. Only for the execution of safety-critical diagnostic services an extended authorization level is available. In this publication, we present an attribute-based access control, which is specifically designed for an automotive E/E architecture with several domain controllers. Furthermore, we evaluate our approach with a proof-of-concept for an exemplary diagnostic service request.

Context: As we move towards higher levels of automation in autonomous driving, we see an increase in functionality that either assists or takes over in both normal and emergency scenarios. These new functionalities can be intentionally switched off by the user, but can also be deactivated unintentionally by (i) accident, (ii) a software malfunction, (iii) a hardware defect, or (iv) an intrusion. Aim: In addition to already applied methods at design time, we aim to recognise mistimed and/or unintended deactivation of vehicle functions, in particular, driver assistance functions (ADAS), at run-time. Upon recognition of the occurrence, we propose to inform the user and the original equipment manufacturer (OEM) in order to improve both the future and the current system behaviour, to support development processes, and to support already conducted safety measures. Method: Based on a feature subset, selected by streaming feature selection, we learn the nominal behaviour of the driver in the interaction with ADAS functions in order to find deviations. The approach considers the technical challenges of automotive E/E architectures and is optimised to reduce communication and computational complexity. We evaluate this approach with recorded real car data from customers participating in a field study. Results: Based on eight datasets, we traced a total of 17 state-of-the-art ADAS functions per participant, yielding to a total of 136 runs. We observed that during 24 among them, the user deactivated the functions at least once for more than a few seconds. For 13 of these 24 runs, we were able to detect and flag possible non-nominal behaviour. Conclusion: As at least one participant configured a convincingly large number of ADAS functions, we need a dynamic system to monitor the configuration of these functions actively. Our approach was capable of detecting potential non-nominal behaviour in up to 52% (13/24) out of these reconfigurations. This result is promising and will receive further attention in future work.

Automotive software architectures describe distributed functionality through an interplay of software components. One drawback of today's architectures is their strong integration into the onboard communication network based on predefined dependencies at design-time. To foster independence, theideaofservice-orientedarchitecture(SOA) providesasuitable prospect as network communication is established dynamically at run-time. Aim: We target to provide a model-based design methodology for analysing and synthesising hardware resources of automotive service-oriented architectures. Approach: For the approach, we apply the concepts of design space exploration and simulation to analyse and synthesise deployment configurations at an early stage of development. Result: We present an architecture candidate for an example function from the domain of automated driving. Based on corresponding simulation results, we gained insights about the feasibility to implement this candidate within our currently considered next E/E architecture generation. Conclusion:Theintroductionofservice-orientedarchitecturesstrictly requires early run-time assessments. In order to get there, the usage of models and model transformations depict reasonable ways by additionally accounting quality and development speed.

In recent years, the development of autonomous trucks has progressed rapidly. It can be assumed that such vehicles will be ready within the next decade. In order to make use of the advantages of automated driving along the entire transport chain, it is necessary to use the autonomous vehicles on public roads as well as on the terminal areas. The paper presents the extent to which it is possible to adopt autonomously driving trucks to closed terminal areas. Further it discusses the technical, operational and legal requirements for vehicles, transport service providers and terminals involved. Based on the requirements a concept for autonomous driving of commercial vehicles in cordoned off areas is presented. Afterwards this concept is transformed with the current processes on a fully automated container terminal into a concrete example. This example shows how autonomous commercial vehicles can be integrated in the operational processes of an existing terminal.

For the development of Advanced Driver Assistant Systems (ADAS) and Automated Driving Systems (ADS) a change from test case-based testing towards scenario-based testing can be observed. Based on current approaches to define scenarios and their inherent problems, we identify the need to extract scenarios including the static environment from recorded real-world-driving-data. We present an approach, that solves the problem to extract dynamic-length-segments containing a single scenario. These segments are enriched with a feature vector with information relevant for the feature under test. By clustering these scenarios a logical scenario catalog is created, containing all scenarios within the test data. Corner cases are represented as well as common scenarios. An accumulated total length can be calculated for each logical scenario, giving a brief understanding about existing test coverage of the scenario.

Autonomous systems are an important part of todays and future solutions for the automotive and industrial sector. The research and development activities to enable high/full automated driving and industry 4.0 have to deal with a lot of new requirements (e.g. fail operational, cyber security), technologies (connectivity over 5G, neuronal networks, future computing platforms) and topics (data analytics, artificial intelligence). Furthermore processes, methods und tools lack behind and need to speed up to cope with all the consequences in validation and verification. The short paper will give an overview over these challenges and the actual state of research and the development in the field of digital autonomous systems.

Current automotive trends, such as autonomous and connected driving, are mainly enabled by embedded software that is deployed on a network of several, often more than one hundred, electronic control units. These software parts are responsible for many complex tasks concerning safety, comfort, energy management, and vehicle dynamics. Currently, they are deployed to the units at the end of the assembly line. Although a new software baseline of electronic control units is released in regular terms, normally six months, updates during after-sales are mostly conducted only in urgent cases, such as recall campaigns. Upcoming over-the-air services will enable more frequent updates to fix bugs and add new functionality. The possible alternatives of engines, chassis, and customer wishes lead to a high number of existing vehicle variants, so that the management of releases and configurations becomes more complex and costly. In a survey, we asked participants from different automotive institutions about the current state of practice, and the challenges they face during release development and management. This paper presents and discusses the main results of this survey: We have identified that field updates will be deployed more frequently in the future, and that over-the-air communication is an efficient way to realize them. The reported main update reasons are bug fixes and function improvement. However, the shortening release and update cycles, the increasing number of variants, and the multidisciplinarity in the automotive field are major challenges requiring suitable processes, methods, and tools to achieve software that operates correctly.

Advanced Driver Assistant Systems (ADAS) use a multitude of input signals for tasks like trajectory planning and control of vehicle dynamics provided by a large variety of information sources such as sensors and digital maps. To assure the feature's valid behavior all realistically possible environmental situations have to be tested. The test scenarios used for simulation can be derived from real-worlddriving-data. However, the significance of derived scenarios is weakened by repetitive similar situations within the driving data, which increase the test efforts without providing new insights regarding the test of the ADAS. In this contribution, an automated selection algorithm for test scenarios based on relevant environmental parameters is presented. Starting with a randomly selected initial testset, the machine-learning concept of autoencoders is utilized to recognize novel scenarios within the data pool, which are iteratively added to the initial testset. Furthermore, the key parameters for the autoencoder's performance are shown in depths. The approach is fully automated, so that the identified novel scenarios within an entire testset are automatically combined to a reduced testset of unique relevant scenarios. The achieved testset reduction and thereby the saving potential in simulation time is demonstrated on a dataset including several thousand test kilometers.

Research and evaluation of algorithms and system architectures for automated driving advanced to a stage where transition from prototyping to series development seems practicable in some extent. While particular systems for environmental perception play a key role in advanced driving assistance systems, we still lack feasible methods for specification and validation of complex driving scenarios. This leads to increased effort in testing and inconsistent requirement definition along different development phases. In this paper we propose a methodology for abstract positional and temporal description of driving scenarios. The approach utilizes a movie related and omniscient view composed of sequential acts. Each act combines both states and interactions of distinct participants as well as the rudimental scenery. Selective events trigger changes in conduct leading to transitions between acts. Graphical visualization provides simple presentation of complex scenarios. Rule sets provide consistency checks and support semi-automated generation of test cases. The presented methodology facilitates model based test specification and requirements design constituting a consistent characterization of system environment from early concept and development to validation.