Increasing automation is an ongoing effort across various mobility sectors, including the railway domain, promising to address issues such as sustainability, lack of personnel, and enhancing mobility in rural areas. The development of automated railway systems is a challenging task and the validation of safety of such systems in open context remains an open topic. Simulation-based validation of driverless trains can help to ensure safe operation. This paper presents an extension of the open-source train simulator OpenRails to enable doing a closed-loop simulation with the goal of validating the behavior of a system under test within a simulated environment. We propose a possible scenario-based validation approach and present the whole loop including description of an abstract scenario using Traffic Sequence Charts, derivation of a concrete instance of this abstract scenario, and a novel closed-loop play-out. We share our experiences and the current state of our work and give outlook on future directions.

Artificial Intelligence (AI) plays an important role in managing the complexity of automated driving. Nonetheless, training and ensuring the safety of AI is challenging. The safe generalization from a known to an unknown situation remains an unsolved problem. Infusing knowledge into AI driving functions seems a promising approach to address generalization, development costs, and training efficiency. We reason that ascertaining the relevance of infused knowledge provides a strong indication of the correct execution of previous development phases of knowledge infusion. As a causal reason for AI performance, relevant knowledge is important for explaining AI behavior. This paper defines a novel notion of relevant knowledge in knowledge-infused AI and for requirements satisfaction in traffic scenarios. We present a scenario-based testing procedure that not only checks whether a knowledge-infused AI model satisfies a given requirement R but also provides statements on the relevance of infused knowledge. Finally, we describe a systematic method for generating abstract knowledge scenarios to enable an efficient application of our relevance testing procedure.

Autonomous driving functions (ADFs) are becoming more relevant and complex. Still, their safe and correct operation must be guaranteed. Scenario-based testing, i.e. confronting the ADF under test with other traffic in specified scenarios is an established approach for the validation and verification of ADFs, but tests currently often only consider simple technical requirements. Safe and correct operation is not only the absence of collisions but involves complex spatio-temporal requirements on the externally observable, functional driving behaviour in traffic. In this work, we consider Traffic Sequence Charts (TSCs) as a visual formalism for the specification of complex, functional ADF requirements. We define a monitoring problem for TSCs and finite, sampled observations of ADF behaviour and discuss how monitor verdicts contribute to requirements testing. We show that such monitors can effectively be constructed for realistic requirements and that they can contribute to efficient testing by assessing ADF behaviour at runtime.

Abstract The concept of Digital Twin (DT) has gained enormous momentum over the past years in many fields with a variety of purposes. We investigated the usage of DTs for the development and testing of automated driving functions. In this context, we wanted to train an agent to challenge the automated driving function of a vehicle via reinforcement learning (RL). For this, we build both, a miniature Vehicle in a loop (ViL) testbed and its digital shadow. The idea is to use the digital shadow as the training environment for the agent resulting in reduced cost and time for training. We decided specifically to build a miniature version of a testbed to accelerate development, reduce resource consumption and increase adaptability. This paper contributed to the engineering of DTs by reporting our approach regarding the development of a digital shadow of a miniature ViL testbed and the lessons learned. First, we motivate the decision for a miniature testbed. Secondly, we describe the high-level architecture and the technical implementation including both the digital shadow and its physical counterpart. Third, we describe the application of the DT for RL and the experiments enabled by our setup. We conclude with the lessons learned. The main takeaway is that DTs are an excellent means to develop, disseminate and present new methods for the validation of automated vehicles. Here the benefits outweigh the effort of DT construction.

The homologation of automated vehicles, being safety-critical complex systems, requires sound evidence for their safe operability. Traditionally, verification and validation activities are guided by a combination of ISO 26262 and ISO/PAS 21448, together with distance-based testing. Starting at SAE Level 3, such approaches become infeasible, resulting in the need for novel methods. Scenario-based testing is regarded as a possible enabler for verification and validation of automated vehicles. Its effectiveness, however, rests on the consistency and substantiality of the arguments used in each step of the process. In this work, we sketch a generic framework around scenario-based testing and analyze contemporary approaches to the individual steps. For each step, we describe its function, discuss proposed approaches and solutions, and identify the underlying arguments, principles and assumptions. As a result, we present a list of fundamental considerations for which evidences need to be gathered in order for scenario-based testing to support the homologation of automated vehicles.

In the search of design principles that allow compositional reasoning about safety and stability properties of hybrid controllers we examine a case study on a simplified driver assistance system for lane keeping and velocity control. We thereby target loosely coupled systems: the composed system has to accomplish a task that may depend on several of its subcomponents while little coordination between them is necessary. Our assistance system has to accomplish a comfortable centrifugal force, lane keeping and velocity control. This leads to an architecture composed of a velocity controller and a steering controller, where each controller has its local objectives and together they maintain a global objective. The steering controller makes time bounded promises about its steering, which the velocity controller uses for optimization. For this system, we deductively prove from the components' properties that the objectives of the composed system are accomplished.

We present Stabhyli, a tool that automatically proves stability of non-linear hybrid systems. Hybrid systems are systems that exhibit discrete as well as continuous behavior. The stability property basically ensures that a system exposed to a faulty environment (e.g. suffering from disturbances) will be able to regain a "good" operation mode as long as errors occur not too frequently. Stabilizing Hybrid systems are omnipresent, for instance in control applications where a discrete controller is controlling a time-continuous process such as a car's movement or a particular chemical reaction. We have implemented a tool to automatically derive a certificate of stability for non-linear hybrid systems. Certificates are obtained by Lyapunov theory combined with decomposition and composition techniques.