Autonomous Vehicle (AV) simulation is broken. How do we fix it?

Autonomous Vehicles (AVs) have been just a few years away for quite a few years. The problem with such technology adoption is that there is a significant difference between having an AV demo and an AV product, since the latter requires reliable evidence that the system is sufficiently safe. But testing in the real world has numerous difficulties. It’s very difficult to find or stage all of the unusual situations (“edge cases”) necessary to show the vehicle is safe, it’s potentially dangerous, developers can’t easily rerun the tests as changes are made to the AV, and it’s very time consuming and expensive to even try.?In recent years most organizations have turned to computer simulation as a solution. The claim is that the safety of the AV in the real world can be demonstrated by doing most of the testing in simulation.?Is that possible? Let’s start by considering how simulation is used in another field of engineering.

How do engineers actually determine the load limit for a bridge? A common engineering tale claims that when Roman engineers built a bridge, it was required that they stand underneath it while the first legion of soldiers marched across. Presumably such a requirement was to ensure that the engineer would carefully design and construct the bridge so it did not collapse on to them.

Despite a few thousand year of bridge building experience, and more modern engineering knowledge, accidents have still occurred. The Tacoma Narrows Bridge catastrophically failed in November, 1940 only months after opening.

An inquiry into the failure found the most likely cause was that the wind on that particular day resulted in unanticipated aerodynamic loads.? These aerodynamic loads interacted with the structural design of the bridge and ultimately led to the collapse.

The design of modern bridges utilizes advanced computer simulations, including aerodynamic effects when deemed necessary.? Even with these simulations a modern bridge, like their Roman predecessors, is still over designed.? A factor of safety is used to ensure the design doesn’t just meet but exceeds requirements.? If a particular structural member needs to support 10,000 lbs, a factor of safety of 2 means the part would actually be designed to nominally support 20,000 lbs.? This over design accounts for imperfect predictions of loads and aspects that are impossible to accurately simulate such as normal variations in material properties and on-site construction processes such as welding.? Factors of safety vary across different engineering disciplines.? For buildings and bridges, a factor of 3 to 7 would be common, whereas 1.2 to 1.5 would be more common in aircraft or spacecraft, since weight is a more significant concern.

Despite advances in computer simulation, and conservative factors of safety, bridge failures still occur.?The rather recent collapse of a pedestrian bridge under construction in my hometown of Miami, FL in the spring of 2018. Unfortunately resulted in six deaths. Which particularly hit literately and figuratively "close to home". The National Transportation and Safety Board (NTSB) concluded that the probable cause was load and capacity calculation errors made by engineers in the project.

There’s a software program called Bridge Designer, a self described “software package designed to provide middle-school and high-school students with a realistic introduction to engineering through the design of a highway truss bridge.”?Would an engineer use it to design a real bridge??Absolutely not!?It’s a fun and somewhat realistic program but that particular software simulation isn’t intended to be used for designing and building a real bridge.?Using it for a real bridge should raise all sorts of ethical and legal concerns.?Engineers use simulation software that has been extensively tested, (hopefully) understand the limitations of these simulations, and as necessary utilize appropriate factors of safety to account for the various uncertainties that can’t possibly be simulated.

The AV community is moving to simulation as the centerpiece of their solution for testing AVs and showing they are sufficiently safe. However, this process introduces another very-difficult, highly-complex problem:

"How to implement and test the AV simulation software and show that it’s suitable for testing a safety critical system?"

Unfortunately many, if not most, of these AV simulation capabilities are being developed using video game engines.? While these game engines are great for creating fun games, they were not designed and tested as a tool for testing safety critical systems, where the risk of someone potentially getting hurt if they aren’t used properly is high. Using a game engine to test an AV is the equivalent of using Bridge Designer to proclaim a bridge is safe for use.

How do we fix AV simulation?

• The AV simulation capability has to be properly designed, implemented, and tested just like any other piece of software.? Additionally it must go through an extensive process of verification and validation to ensure the simulation can be trusted for the purpose of testing the AV software.
• A real AV product, especially the software, must be designed so that it can be properly tested. Developers can’t make changes to the AV software so it works with the simulation, test that modified version in simulation, and then claim that the original version works in the real world.
• Users of AV simulation must understand the limitations of the simulation so that they can use it appropriately. British statistician George E. P. Box famously once said, “All models are wrong, but some are useful.” Simulations are always wrong to some degree, therefore engineers must be able to justify why the inaccuracies are acceptable for specific use cases.

Let's fix AV Simulation together. Shall we?