On a Formal Model of Safe and Scalable Self-driving Cars (自駕車)

Shai Shalev-Shwartz, Shaked Shammah, and Amnon Shashua, On a Formal Model of Safe and Scalable Self-driving Cars, arXiv:1708.06374, Mobileye, 2017.

In order to gain perspective over the typical values for such probabilities, consider public accident statistics in the United States. The probability of a fatal accident for a human driver in 1 hour of driving is 10^−6. From the Lemma above, if we want to claim that an AV meets the same probability of a fatal accident, one would need more than 10^6 hours of driving. Assuming that the average speed in 1 hour of driving is 30 miles per hour, the AV would need to drive 30 million miles to have enough statistical evidence that the AV under test meets the same probability of a fatal accident in 1 hour of driving as a human driver.... (*) 

We can cast the problem of defining a driving policy in the language of Reinforcement Learning (RL). At each iteration of RL, an agent observes a state describing the world, denoted s_t, and should pick an action, denoted a_t, based on a policy function, π, that maps states into actions....

We first argue that it is not realistic to require that the additive error is small for far away objects. Indeed, consider o to be a vehicle at a distance of 150 meters from the host vehicle, and let be of moderate size, say = 0.1. For additive accuracy, it means that we should know the position of the vehicle up to 10cm of accuracy. This is not realistic for reasonably priced sensors. On the other hand, for relative accuracy we need to estimate the position up to 10%, which amounts to 15m of accuracy. This is feasible to achieve (as we will describe later)....

As mentioned before, our policy is provably safe, in the sense that it won’t lead to accidents of the autonomous vehicle’s blame. Such accidents might still occur due to hardware failure (e.g., a break down of all the sensors or exploding tire on the highway), software failure (a significant bug in some of the modules), or a sensing mistake. Our ultimate goal is that the probability of such events will be extremely small — a probability of 10^−9 for such an accident per hour. To appreciate this number, the average number of hours an american driver spends on the road is (as of 2016) less than 300. So, in expectation, one needs to live 3.3 million years to be in an accident. 

There are three main components of our sensing system. The first is long range, 360 degrees coverage, of the scene based on cameras. The three main advantages of cameras are: (1) high resolution, (2) texture, (3) price....

The second component of our system is a semantic high-definition mapping technology, called Road Experience Management (REM)....

The third component of our system is a complementary radar and lidar system. 

(*) Amnon Shashua, CBMM Special Seminar: The State of Autonomous Driving, MIT, March 19, 2019. (33 分鐘處)