⚡ electrical engineering

Risk Assessments for Evasive Emergency Maneuvers in Autonomous Vehicles

This paper introduces a novel, traceable verification and validation framework that integrates HARA, STPA, and Finite State Machine modeling to systematically assess Evasive Minimum Risk Maneuvers in autonomous vehicles, demonstrating through a T-junction case study that this unified approach achieves 100% hazard and parameter-space coverage while significantly improving collision avoidance rates compared to traditional methods.

Original authors: Aliasghar Arab, Milad Khaleghi, Koorosh Aslansefat

Published 2026-04-30

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Aliasghar Arab, Milad Khaleghi, Koorosh Aslansefat

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are teaching a robot driver how to handle a sudden, terrifying emergency: a giant truck has just blocked the road ahead, and you are barreling toward it at high speed. What should the robot do? Slam on the brakes? Swerve wildly? Or is there a "Plan B" if the swerve fails?

This paper is about building a super-smart safety checklist to make sure autonomous vehicles (self-driving cars) can answer those questions correctly, especially in the most dangerous, "edge-case" situations where normal rules might fail.

Here is the breakdown of their new method, explained simply:

The Problem: Three Missing Pieces

The authors say that current safety checks for self-driving cars are like trying to build a house with only a hammer, only a saw, or only a blueprint. You need all three working together. They identified three gaps in how we currently test these cars:

The "Two-Tool" Gap: Engineers usually use two different safety methods (called HARA and STPA) separately. It's like having a map and a compass but never using them together to navigate. The paper creates a single workflow that forces them to work as a team.
The "Movie Scene" Gap: Safety checks often look at a snapshot in time (a hazard exists) or the end result (a crash happened). They miss the movie in between—the split-second moments where the car tries to dodge, fails, and then has to switch to a "damage control" mode. The paper adds a Finite State Machine (FSM), which is like a flowchart that maps out every possible "scene" the car can go through, from "Oh no!" to "I dodged it!" or "Okay, let's minimize the crash."
The "Guessing Game" Gap: Traditionally, engineers pick test scenarios by guessing what might go wrong (e.g., "Let's test it on a rainy day"). This paper replaces guessing with a systematic generator that mathematically ensures they test every possible combination of speed, road grip, and timing, leaving no stone unturned.

The Solution: A Unified Safety Pipeline

The authors combined these three tools into one seamless pipeline:

Step 1 (HARA): Identifies what could go wrong (e.g., "The truck blocks the road").
Step 2 (STPA): Identifies how the car's brain might make a mistake (e.g., "The car swerves too late" or "The car swerves when it shouldn't").
Step 3 (FSM): Maps out the story of the event. If the car swerves and succeeds, it goes to "Safe." If it swerves and fails, it immediately transitions to "Mitigation" (trying to hit the truck at a glancing angle instead of head-on) or "Emergency Stop."

The Real-World Test: The T-Junction Truck

To prove this works, they tested a specific scenario: A self-driving car approaching a T-junction where a large truck has suddenly blocked the path.

They ran 1,880 computer simulations (a massive number compared to the usual handful) covering every possible speed, road condition (dry, wet, icy), and timing.

Here is the surprising discovery they made:
Because of the specific geometry of a T-junction, the car is almost always in a "binary" situation. It's either:

Full Avoidance: There is enough time and space to swerve or stop completely.
Unavoidable Crash: There is absolutely no time to stop or swerve; a crash is inevitable.

The "Middle Ground" is almost non-existent. The paper found that the "intermediate" option—where the car tries to swerve but fails, so it has to switch to a "damage control" mode—only exists in 1.9% of the possible situations. In other words, on a T-junction, you either make it or you don't; there is rarely a "maybe" zone. This is a physical reality that only their high-resolution testing could reveal.

The Results: Why This Matters

When they compared their new "Agile Evasive Maneuver" (swerving) against the old "Emergency Stop" (braking only):

Success Rate: The swerving strategy avoided collisions 81% of the time, compared to only 45% for braking alone.
Impact Speed: When a crash was unavoidable, the swerving strategy reduced the impact speed from 18.9 km/h down to 9.0 km/h. Think of this as the difference between hitting a wall at highway speed versus a slow jog; it drastically reduces the damage.
Coverage: Their method tested 100% of the possible hazards and scenarios. Traditional methods only tested about 1% (leaving 99% of the dangers unexplored).

The Bottom Line

This paper doesn't just say "self-driving cars are safe." It provides a traceable, mathematical proof that a specific safety feature (swerving to avoid a crash) works better than just braking, and it does so by mapping out every single possible way the system could fail or succeed.

They proved that by combining hazard analysis, control theory, and state-flow mapping, we can finally test self-driving cars with the same rigor as a pilot training for an engine failure, ensuring that when the unexpected happens, the car knows exactly which "scene" to play next.

1. Problem Statement

The paper addresses a critical gap in the safety verification and validation (V&V) of Evasive Minimum Risk Maneuvers (EMRM) for autonomous vehicles (AVs). While traditional safety features like Advanced Emergency Braking (AEB) are well-studied, agile evasive maneuvers (steering, drifting) present unique challenges that current safety frameworks fail to address adequately.

The authors identify three specific limitations in existing methods:

Lack of Formal Integration: Hazard Analysis and Risk Assessment (HARA) and System-Theoretic Process Analysis (STPA) are typically used in isolation. There is no standardized framework to map system hazards to unsafe control actions (UCAs) and subsequently to loss scenarios.
Inadequate State Transition Modeling: Neither HARA nor STPA effectively models the dynamic transitions between hazardous states and loss states. This is critical for EMRM, which must adapt in real-time as a situation escalates from a hazard to an inevitable collision.
Poor Scenario Generation: Existing methods lack structured approaches for generating test scenarios with measurable parameter-space coverage, often relying on ad-hoc testing that misses edge cases.

2. Methodology: The Integrated HARA-STPA-FSM Framework

The authors propose a novel, end-to-end V&V pipeline that unifies three distinct methodologies into a single traceable workflow:

A. Formal Integration of HARA and STPA

HARA (Enhanced HARA):* Used to identify hazardous states ( $H$ ) and assess potential losses ( $L$ ), distinguishing between reversible (e.g., minor damage) and irreversible (e.g., injury, fatality) losses.
STPA: Used to identify Unsafe Control Actions (UCAs) within the system architecture that could lead to hazardous states.
Mapping ( $M_{HARA-STPA}$ ): A structured mapping function links system contexts and UCAs to specific hazards, losses, and risk measures, creating a traceable chain from system failure to physical consequence.

B. Finite State Machine (FSM) Modeling

To address the gap in modeling state transitions, the authors introduce a Hazard-Loss FSM.
This model explicitly defines the system's lifecycle during an emergency:
- $S_1$ : Normal operation.
- $S_2$ : Hazard detection.
- $S_3$ : High-risk state requiring aggressive maneuvering (the core EMRM execution phase).
- $S_4$ : Successful recovery (avoidance).
- $S_5$ : Mitigation failure (transition to controlled impact/minimized damage).
- $S_6$ : Post-incident response.
The FSM ensures that the system logic prioritizes avoidance but gracefully degrades to damage mitigation if avoidance is physically impossible.

C. Automated Scenario Generation

The unified framework drives an automated scenario generator.
It uses the FSM transitions and parameter spaces (e.g., speed, time-to-collision, friction) to generate test cases that guarantee coverage of specific hazards, UCAs, and state transitions.

3. Case Study: T-Junction Obstacle Scenario

The framework was validated using a specific edge-case scenario: An autonomous vehicle approaching a T-junction where a large truck suddenly blocks the main road.

Parameters Swept: Ego vehicle speed, Time-to-Collision (TTC), road surface friction, and passage width.
Simulation: 1,880 Rapidly-exploring Random Tree (RRT) based simulations were executed to map the "mitigability region" (where the system can successfully avoid or mitigate the crash).

4. Key Results

The application of the framework yielded significant quantitative and qualitative insights:

Physical Insight on T-Junction Geometry: The simulations revealed a counter-intuitive physical result: In a T-junction blocking scenario, the geometry makes stopping and navigating equally difficult. Consequently, the "intermediate mitigation mode" (where avoidance fails but impact is reduced) occupies only 1.9% of the feasible parameter space. The outcome is predominantly binary: either full avoidance or an unavoidable high-energy collision.
Performance Improvement: Compared to a baseline "Emergency Stop Only" strategy:
- Collision Avoidance Rate (CAR): Increased from 45% to 81%.
- Residual Impact Speed: Reduced from 18.9 km/h to 9.0 km/h (a ~75% reduction in kinetic energy).
- Loss Reduction: The average loss level reduction ( $\Delta Loss$ ) improved from 3.29 to 4.73–4.75 levels.
Coverage Superiority:
- The proposed framework achieved 100% coverage of hazards, UCAs, and parameter-space cells.
- Traditional methods (sparse manual testing or isolated HARA/STPA) achieved ≤1% coverage in the same parameter space.

5. Key Contributions

First Formal Unification: This is the first work to formally integrate HARA, STPA, and FSM modeling into a single, traceable V&V pipeline for autonomous active safety features.
FSM for Hazard-to-Loss Transitions: Introduces a specific modeling layer that captures the dynamic escalation from hazard to loss, enabling rigorous analysis of how EMRM features must degrade gracefully when avoidance fails.
Systematic Scenario Generation: Replaces ad-hoc testing with a principled method that guarantees measurable parameter-space coverage, allowing for the discovery of physical boundaries (like the 1.9% intermediate zone) that sparse testing would miss.

6. Significance

This paper demonstrates that complex autonomous safety features cannot be validated using isolated safety methods. The integration of HARA (for risk context), STPA (for control logic failures), and FSM (for dynamic state transitions) is essential for high-resolution validation.

The findings have profound implications for the industry:

Validation Efficiency: It proves that high-density, automated testing is necessary to uncover the true physical limitations of AV maneuvers.
Safety Assurance: The framework provides a rigorous, auditable path to proving that an AV can not only avoid accidents but also minimize harm when accidents are inevitable, a critical requirement for regulatory approval of Level 4/5 autonomy.
Design Guidance: The discovery that T-junction geometries often eliminate the "middle ground" for mitigation suggests that AV control strategies must be binary (aggressive avoidance or immediate hard braking) rather than relying on complex intermediate maneuvers in such specific scenarios.