Safety Monitor for Off-Road Planning with Uncertainty Bounded Bekker Costs

Technical Summary: Safety Monitor for Off-Road Planning with Uncertainty-Bounded Bekker Costs

Problem Statement
Reliable off-road autonomy is hindered by the structural uncertainty of terrain properties. Unlike on-road environments, off-road soil strength, moisture, and texture vary significantly over short distances, making traction and sinkage difficult to predict. Existing path planners often rely on deterministic cost maps or learning-based estimates that lack formal uncertainty bounds. When these planners overestimate traction or underestimate sinkage, vehicles risk exceeding safe operational limits, leading to immobilization or loss of control. The core challenge is that soil response depends on variables (e.g., compaction, moisture) that cannot be measured directly in real-time, rendering classical terramechanics models unreliable without explicit uncertainty incorporation.

Methodology
The paper proposes a runtime assurance safety monitor that operates as a supervisory layer alongside any motion planner. The system integrates a Bekker-based cost model with bounded uncertainty to define reliable operational limits.

1. Uncertainty-Bounded Cost Modeling:

   • The system utilizes Bekker's pressure-sinkage relationship ($p = (\frac{k_c}{b} + k_\phi)z^n$) to relate normal pressure to soil deformation.
   • Soil parameters ($k_c, k_\phi, n$) are modeled with a uniform uncertainty margin ($\delta = \pm 20\%$) around nominal values, reflecting experimental observations of soil variability.
   • The monitor computes an upper-confidence traversal cost ($C_{uc}$) by maximizing the predicted sinkage ($z$) over this bounded set of parameters. This creates a conservative cost map that accounts for worst-case soil conditions within the uncertainty bound.
   • A deterministic rollover cost ($C_{roll}$) is also calculated based on local slope gradients derived from elevation data.

2. Runtime Safety Monitor Logic:

   • The monitor evaluates planned motion in real-time against two physical limits: maximum sinkage ($z_{max}$) and critical rollover slope ($\theta_{max}$).
   • Intervention Triggers: If any cell within the vehicle's sensing window exceeds the cost thresholds ($C_{uc} > C_{sink,max}$ or $C_{roll} > C_{roll,max}$), the monitor intervenes.
   • Intervention Sequence:
     1. Immediate Slowdown: The vehicle speed is reduced to a minimum safe velocity ($v_{min}$) regardless of whether the current path intersects the high-cost region.
     2. Buffer Expansion: A kinematic buffer distance ($d_{pad}$) is added around the high-cost region to ensure sufficient clearance for evasive maneuvers.
     3. Re-planning: The monitor triggers a re-plan. The vehicle has a calculated safe time window ($t_{safe}$) to generate a new path.
     4. Halt: If no feasible path is found within $t_{safe}$, or if the sensing window cannot accommodate the required buffer, the vehicle halts at the last verified safe cell.
   • The system resumes nominal speed only after $N_s$ consecutive updates confirm no high-cost cells are detected.

3. Integration:

   • The monitor was integrated with a Vehicle-Dynamic RRT* (VD-RRT*) planner in a simulation environment. The planner minimizes a cumulative cost function ($C_{uc} + \lambda C_{roll}$), while the monitor enforces the safety constraints.

Key Contributions

• Analytical Uncertainty Propagation: The paper introduces a method to analytically carry soil parameter uncertainty into the traversal cost via upper-confidence estimates, rather than relying on statistical sampling or abstract risk metrics.
• Physically Interpretable Safety Layer: The monitor enforces safety limits directly linked to vehicle geometry (wheel load, center of gravity) and soil mechanics, providing a physically interpretable reliability layer that complements existing planners without replacing them.
• Lightweight Runtime Assurance: The approach is designed to be computationally efficient enough for embedded processors, utilizing simple intervention rules (slowdown, buffer expansion, halt) to manage risk.
• Design Implications: The framework demonstrates how uncertainty-bounded models can serve as a bridge between terrain physics and vehicle design, influencing decisions on powertrain torque reserves, suspension stiffness, and sensor placement.

Results
The system was evaluated in a $100m \times 100m$ simulated environment spanning loam to sand with varying slopes.

• Safety vs. Efficiency Trade-off: As the uncertainty margin ($\delta$) increased, the monitor enforced more conservative behavior.
  • At $\delta = 0.20$, the system achieved the best balance, reducing high-cost violations from 12 (in the baseline planner without monitoring) to 1, while increasing path length by approximately 18% and completion time by 58%.
  • At $\delta = 0.25$ and above, high-cost violations were eliminated entirely (0 violations), but path lengths and completion times increased further.
• Intervention Rates: Higher uncertainty bounds led to more frequent interventions (speed reductions and re-plans), confirming that the parameter $\delta$ acts as a tunable knob for trading efficiency for caution.
• Validation: A benchtop static loading check provided initial empirical validation of the underlying Bekker model assumptions.

Significance and Claims
The paper claims that this approach offers a "clear and measurable" improvement in terrain reliability by keeping vehicle motion within safe physical limits while allowing the planner to pursue efficient routes. The significance lies in shifting off-road autonomy from abstract risk thresholds to measurable terrain responses linked to vehicle design.

The authors emphasize that this method allows safety to be enforced through "measurable terrain response linked to vehicle geometry and loading" rather than black-box risk metrics. They posit that this separation of concerns—where the planner focuses on efficiency and the monitor enforces physics-based safety—enables more predictable and safer off-road autonomy. The work suggests that uncertainty-bounded Bekker models can provide a common language for linking mechanical design, control tuning, and operational safety, potentially reducing the need for extensive physical field trials by enabling more robust probabilistic validation in simulation.

The authors remain modest, noting that the current work is validated primarily in simulation and through static benchtop tests, with future work required to validate the framework on hardware under real sensor noise and dynamic conditions.