Mathieu Barbier

Alessandro Renzaglia

Jean Quilbeuf

Lukas Rummelhard

Anshul Paigwar

Christian Laugier

Axel Legay

Javier Ibañez-Guzmán

Olivier Simonin

Validation of Perception and Decision-Making Systems for Autonomous Driving via Statistical Model Checking

Automotive systems must undergo a strict process of validation before their release on commercial vehicles. With the increased use of probabilistic approaches in autonomous systems, standard validation methods are not applicable to this end. Furthermore, real life validation, when even possible, implies costs which can be obstructive. New methods for validation and testing are thus necessary. In this paper, we propose a generic method to evaluate complex probabilistic frameworks for autonomous driving. The method is based on Statistical Model Checking (SMC), using specifically defined Key Performance Indicators (KPIs), as temporal properties depending on a set of identified metrics. By studying the behavior of these metrics during a large number of simulations via our statistical model checker, we finally evaluate the probability for the system to meet the KPIs. We show how this method can be applied to two different subsystems of an autonomous vehicle: a perception system and a decisionmaking approach. An overview of these two systems is given to understand related validation challenges. Extensive validation results are then provided for the decision-making case.

I. INTRODUCTION

In the automotive industry, the development and testing of human centric systems must follow the guidelines of the ISO26262. This kind of testing can be divided in two main classes:

• Vehicle-in-the-loop to test interactions between a human and the system in dangerous situation [START_REF] Bokc | Validation of the vehicle in the loop (vil); a milestone for the simulation of driver assistance systems[END_REF]. • Hardware-in-the-loop to test interactions between an embedded system, such as the Active Brake Control Systems [START_REF] Hwang | Development of hils systems for active brake control systems[END_REF], and the physics of a vehicle. For autonomous functionality higher than level 3, as defined by the SAE, drivers will not be responsible of most driving decisions. A thorough validation of the concerned algorithms and subsystems is thus of fundamental importance in these contexts. However, as these systems will rely more and more on machine learning and probabilistic methods, conventional validation methods are not suitable and new solutions need to be adopted. Furthermore, the vehicles will eventually operate in a wide range of scenarios, including dangerous situations. 1 Univ. Grenoble Alpes, Inria, Chroma, F-38000 Grenoble. Email: name.surname@inria.fr 2 Renault S.A.S, 1 av. du Golf, 78288 Guyancourt, France. Email: name.surname@renault.com 3 Univ Rennes, Inria, F-35000, RENNES, France. Email: name.surname@inria.fr Email: name.surname@uclouvain.be 5 INSA Lyon, Inria, Chroma, CITI Lab., 6 avenue des Arts, 69680 Villeurbanne, France. Email: name.surname@inria.fr Interactions between the different elements of the proposed validation pipeline. Dashed lines represents future developments to connect the decision and perception.

As a result, a validation and verification process performed in simulations is preferable, since it allows increasing the coverage of system testing, while also reducing costs.

Two main challenges can be identified in the validation of algorithms for autonomous driving. First, the complexity and variety of scenarios that the vehicles can face is larger than in Advanced Driver Assistance Systems (ADAS). Second, the necessity of considering the constant possibility of interaction between multiple systems. In this study we focus on a use-case that highlights these two difficulties: road intersection crossing. Road intersections are among the most dangerous part of road networks with more than 8% of the total road fatalities in Europe [START_REF] Ibanez-Guzman | Vehicle to vehicle communications applied to road intersection safety, field results[END_REF]. From a perception point of view, this scenario is particularly challenging because of the limitations in the visibility field, resulting in only partiallyobserved vehicles. In terms of decision-making, the possibility of a wrong, unexpected behavior of other drivers makes the road intersections particularly complex to consider. For these reasons, this scenario has been identified as one of the main use-cases addressed in the Enable-S3 European project [START_REF]Validation and testing of complex automated systems[END_REF]. This industry-driven project aspires to propose new methods for validation and verification of Automated Cyber-Physical Systems (ACPS). The global architecture for validation and verification has been simplified to match our scenario and is illustrated in figure 1.

Other examples of validation approaches for highlyautonomous systems can be found in literature, for instance in the aerospace domain, where formal methods are used to validate the behavior of a fleet of satellites [START_REF] Hinchey | Verification and validation of autonomous systems[END_REF]. In the robotic domain, benchmarks allow researchers to compare their results in the same conditions [START_REF] Ulbrich | The opengrasp benchmarking suite: An environment for the comparative analysis of grasping and dexterous manipulation[END_REF], [START_REF] Althoff | Commonroad: Composable benchmarks for motion planning on roads[END_REF]. However benchmarks are often tailored for one specific kind of problem and are not representative enough of the variety of situations that an autonomous system may encounter to actually validate such a system. Waymo was recently confident enough in their system to remove the safety drivers for some tests. This was possible with an effort of 1 billion kilometers driven in a simulated environment [START_REF] Waymo | Waymo's safety report: how we are building a safer driver[END_REF]. Another way is to use formal methods to ensure the safety of the vehicle [START_REF] Shalev-Shwartz | On a formal model of safe and scalable self-driving cars[END_REF] but it would be rather complex to do in uncertain environments.

The main contribution of this paper is to propose and demonstrate the use of a validation method, based on Statistical Model Checking (SMC), able to overcome the aforementioned limitations. In particular, we show its applicability to two different algorithms dealing with the perception and the decision-making problem respectively. The requirements for the testing in simulated environments are discussed for each system. Preliminary results for the decision-making system are presented as well as a discussion on the challenges generated by the perception system.

The rest of the paper is organized as follows. Section II presents the details of our validation approach based on statistical model checking. Section III describes the application of our approach to the perception system and the difficulties in finding applicable metrics for its validation. Then, Section IV presents a more complete application for the decision-making approach and results are provided and discussed.

II. STATISTICAL MODEL CHECKING

In the context of ACPS, it is not possible to afford validation through exhaustive techniques, that is by stating a property and checking that it holds in all reachable states. Indeed, this would require to model and traverse all the reachable states of the ACPS. Such a modelling is possible at a very abstract level, but requires a huge effort to be brought at a more detailed level. Furthermore, even if a very detailed model of the ACPS were provided, exploring all its reachable states would not be possible due to the very large state space. Stochastic algorithms are complex to validate with conventional methods, thus it is interesting to use probabilistic methods to evaluate them [START_REF] Jaynes | Probability theory: the logic of science[END_REF].

Statistical Model Checking (SMC) [START_REF] Hérault | Approximate probabilistic model checking[END_REF], [START_REF] Sen | On statistical model checking of stochastic systems[END_REF] provides an intermediate between test and exhaustive verification by relying on statistics. In order to perform SMC, one needs an executable model and a property to check. The executable model is expected to be stochastic, that is, to have some of its transitions governed by probabilistic choices. Note that most ACPS simulations are already modelled as stochastic processes, because variations in the scenario are defined by probability distributions. The property to check must be decidable on a finite trace. The execution being stochastic, some traces will satisfy the property to check and some other will not. Therefore, we can define the probability that a trace satisfies a property. The main goal of SMC is to evaluate that probability. Note that a probability of satisfying a formula gives actually more information than a yes-or-no answer. Indeed, if the model does not satisfy the formula, there is an evaluation of how well it performs.

In order to perform SMC, one needs to be able to

• Generate traces of the execution of the system to validate. These traces have to be generated according to the probabilities in the model. • Write the property to check as a formula that can be decided on a finite trace, and a procedure for deciding whether a trace satisfies the property. We present in Figure 2 an overview of the approach. On the left we have a simulator that provides stochastic executions of our system. On the bottom we have the property to check. On the top, we have some configuration for the SMC algorithm, such as the required accuracy. The SMC algorithm requires some simulations to the simulator. In turn the simulator provides a trace that is fed to the property checker. Finally the property checker returns its verdict to the SMC algorithm. At this point, if the SMC algorithm has enough information to return a result that meets the required accuracy, it does so. Otherwise, it asks for an additional simulation and the loop is run again. We give an intuition of SMC by illustrating it with the Monte-Carlo Algorithm. This algorithm estimates the probability ω that a system satisfies a property Ω by checking Ω against a set of N random executions of the system. The estimation ω is given by

ω = 1 N N i=1 f (x i ) where f (x i ) = 1 ifx i |= Ω 0 otherwise
Using the formal semantics of the property language, the property is checked against each execution trace. The trace must be long enough to decide whether the property holds.

Of course, the larger is the set of simulations, the more precise is the result. The confidence bounds of the estimation are set by two positive real parameters and δ. The confidence is defined by the Chernoff bound that is stated as:

Pr (|ω -ω| ≤ ) ≥ 1 -δ
Assuming that ω is the value of the probability we want to evaluate and ω is the estimation we compute, the formula means that the estimation error, i.e. the distance |ω -ω|, is bounded by with a probability 1 -δ. In other words, the probability that the error in the estimation is greater than is δ. Once δ and have been set, we can compute the number of simulations N necessary to enforce the above formula. The quality of the approximation is high (and thus N is high as well) when and δ are close to 0. When and δ increase, the estimation is more approximate but requires less simulations to be computed.

A. Defining KPIs

In order to define and evaluate KPIs based on a set of simulations, we proceed as follows. We first identify some KPIs related to the system and scenario under test. We then express the KPIs as temporal formulas involving the identified metrics. Temporal formulas allow a finer formulation of KPIs by taking into account the evolution of the metrics during time. Let us consider acceleration as a metric. A rough formulation of a KPI concerning acceleration might be that the acceleration should be bounded, i.e. to guarantee the comfort of the passengers [START_REF] Yi | Nonlinear brake control for vehicle cw/ca systems[END_REF]. A finer formulation could be that the acceleration should generally be bounded, but the bound can be exceeded for a short period of time.

In order to express such formulas, we rely on Bounded Linear Temporal Logic (BLTL), a bounded version of LTL [START_REF] Pnueli | The temporal logic of programs[END_REF]. The syntax of BLTL is as follows:

φ ::= p | φ ∨ φ | ¬φ | φ U ≤t φ | X ≤t φ.
A BLTL formula is expressed with respect to a trace. In our case a state is a sequence of states, one for each simulation step. Each state contains the value of each of the metrics at that current state. The symbol p represents a predicate expressed on the current state, for instance a comparison between a metric and a bound. The disjunction (∨) and the negation (¬) defined as usual. Finally, the temporal operators until (U ) and next (X) define properties about the time. Since we need to be able to decide whether a property holds on a finite trace, these operators are parameterized by a time bound t ∈ R. The formula X ≤t φ is true if φ is true in the state reached after t units of time from the current state. The formula φ 1 U ≤t φ 2 is true if 1) the formula φ 2 becomes true before t units of time from the current state and 2) the formula φ 1 remains true in every state before the one where φ 2 becomes true. For a formal definition of BLTL semantics, see [START_REF] Zuliani | Bayesian statistical model checking with application to stateflow/simulink verification[END_REF].

In practice, we often use the always (G) and eventually (F ) operators. Eventually is defined as F ≤t φ = true U ≤t φ and means that the formula φ should become true before t units of time happen. Always is defined as G ≤t φ = ¬F ≤t ¬φ and means that φ must always hold for the next t units of time.

III. A FIRST VALIDATION APPLICATION: CMCDOT PERCEPTION SYSTEM

A. Principle of the CMCDOT

The Conditional Monte Carlo Dense Occupancy Tracker (CMCDOT) Framework is a perception system, based on environment representation through probabilistic occupancy grids, a dense and generic representation [START_REF] Elfes | Using occupancy grids for mobile robot perception and navigation[END_REF], [START_REF] Moravec | Sensor fusion in certainty grids for mobile robots[END_REF], and Bayesian fusion, filtering and inference [START_REF] Rummelhard | Conditional monte carlo dense occupancy tracker[END_REF].

This type of Bayesian formalism [START_REF] Bessière | Bayesian Programming[END_REF] allows proper confidence estimation and combination, particularly important features when confronted with incomplete or even contradictory data coming from different sensors. A major feature of the system is its highly-parallelized design: from data fusion, to grid filtering, velocity inference and collision risk assessment, the methods have been designed to allow massive parallelization of computations, and so benefit from parallelcomputing devices [START_REF] Yguel | Efficient gpu-based construction of occupancy grids using several laser range-finders[END_REF], allowing real-time performances on embedded devices.

Sensor data is converted to occupancy estimation using specific sensor model, sensor occupancy estimates are then combined by Bayesian fusion in every grid cell (Fig. 3). The CMCDOT itself is a generic spatial occupancy tracker, which then infers dynamics of the scene through a hybrid representation of the environment consisting of static and dynamic occupancy, empty spaces and unknown areas (Fig. 4). This differentiation enables the use of state-specific models (classic occupancy grids for motionless components and sets of moving particles for dynamic occupancy), as well as relevant confidence estimation and management of data-less areas. The approach leads to a compact model that dramatically improves the accuracy of the results and the global efficiency in comparison to previous approaches.

This method is particularly suitable for heterogeneous sensor data fusion (camera, lidars, radars, etc.). The occupancy of each cell over time can be estimated from various sensors data whose specific uncertainty (noise, measurement errors) are taken into consideration. Filtered cell estimates are thus much more robust, leading to a more reliable global occupancy of the environment, reducing false detections.

While most of risk estimation methods consist in detecting and tracking dynamic objects in the scene [START_REF] Fortmann | Multi-target tracking using joint probabilistic data association[END_REF], [START_REF] Khan | An mcmc-based particle filter for tracking multiple interacting targets[END_REF], the risk being then estimated through a Time to Collision (TTC) approach by projecting object trajectories to the future [START_REF] Labayrade | Experimental assessment of the rescue collision-mitigation system[END_REF], [START_REF] Kaempchen | Situation assessment of an autonomous emergency brake for arbitrary vehicle-to-vehicle collision scenarios[END_REF], the grid-based approach used in the CMCDOT framework [START_REF] Rummelhard | Conditional monte carlo dense occupancy tracker[END_REF] instead directly computes estimations of the position in the near future of every static and dynamic part of the grid, as well as the trajectory of the vehicle. These estimations are iteratively computed over short time periods, until a potential collision is detected, in which case a TTC is associated to the cell from which the colliding element came from (Fig. 5). In every cell, the associated TTCs are cumulated over different time periods (1, 2, 3 seconds for example) to estimate a cell-specific collision risk profile. Risk grids, and global aggregated risks, are thus generated, and later used to generate response impulses for the control system. This strategy [START_REF] Rummelhard | Probabilistic grid-based collision risk prediction for driving application[END_REF] avoids solving the complex problem of multi-object detection and tracking, while integrating the totality of the available information. It provides a probabilistic estimation of the risk associated to each part of the scene.

B. Method Application

1) Simulation for perception: In this project, the simulation relies on the use of two frameworks: CARLA, an open urban driving simulator [START_REF] Dosovitskiy | CARLA: An open urban driving simulator[END_REF], and Robot Operating System (ROS). CARLA simulation environment consists of complex urban layouts, buildings and vehicles rendered in high quality, allowing for a realistic representation of realworld scenarios. The ego vehicle and its sensors, as well as other moving vehicles, as depicted in Figure 6, can be configured in the simulation to match with the actual system. The provided CARLA-ROS bridge enables data acquisition from the simulation in native ROS message formats, where the data can be recorded, stored, and processed by the same code running on the actual vehicle.

In order to establish the ground truth, a grid indicating the position of all simulated objects is needed. This grid must reflect CMCDOT's occupancy grid in the following aspects: origin position, grid direction, cell size and velocities. The bounding box and velocity information provided by CARLA simulator is translated into occupancy grid at each time step to generate the ground truth.

Currently, each lidar is simulated with the appropriate position on the ego vehicle, the same sampling frequency and the same data format as the physical sensor. To match the sensing uncertainty, a Gaussian noise can be added.

In order to be able to efficiently generate a large number of simulated environments, we have designed a parameterbased approach which streamlines the process through which the dimensions and initial position and velocity of non-ego vehicles are specified.

Our simulation scenario aims at checking the behavior of cars at a four-way crossroads and validating Time to Collision (TTC) estimated by CMCDOT. The rule governing this crossroad is that at any given moment in time, a maximum of one simulated vehicle is present on the crossroad. To simulate the different cases, we rely on a random generation of parameter sets (non-ego vehicle class, initial position and initial speed). The test cases are then run, and their results (perception results as in Fig. 6) are stored alongside the parameter sets. The analysis of these datasets enables us to accurately measure the efficiency of our perception and estimation solution.

The strong advantage of this approach is the ease with which a large number of simulated scenarios can be generated, ran, and analyzed.

2) KPI definition: Contrary to most perception systems, the output of CMCDOT is not a direct list of detected objects, but a dynamic occupancy grid, i.e. a rich probabilistic representation of the entire surrounding space. Evaluating such occupancy grids, and especially dynamic occupancy grids, incorporating at a cell level velocity field estimations, is still an important subject of research [START_REF] Grewe | Evaluation method and results for the accuracy of an automotive occupancy grid[END_REF].

A first approach would be to define a global indicator based on the direct estimates of the grid, to be compared to the ground truth. But if by qualitative analysis of results it is quite simple to evaluate if an occupancy grid is correct or not, an objective quantification of this quality is particularly complicated, each metrics focusing on a specific aspect, ignoring others (for example occupied / free space factor, cell by cell comparison, convolution-based metrics, etc.).

Another approach would be to focus on specific applications of the method: the validation of the whole system itself is performed by statistical validation of its usages. In the case of the CMCDOT framework, a direct application of the perception system is an automatic braking system, based on aggregated risk estimates of the system. By comparing the difference in response of the system and expected behavior according to the ground truth, a partial evaluation of the system can be accessed.

We here propose a more straightforward approach taking into account a different output of the CMCDOT algorithm: the estimated risk of collision. In particular, the probabilities for collision in 1, 2 and 3 seconds can be considered.

In order to evaluate the correctness of this output, we can study the traces of the simulation containing the following metrics: cmcdot risk i and real coll i for 1 ≤ i ≤ 3. The metric cmcdot risk i indicate the probability of a collision in i s according to the CMCDOT algorithm. The metric real coll i is a Boolean indicating whether a collision will occur if object continue to move with their current speed, according to their speed and position in the simulation.

For each time interval, a different KPI parameterized by a threshold τ can be defined. We formalize our KPI through the property G ≤t (real coll i ⇒ (1-cmcdot risk) < τ )∧ (¬real coll i ⇒ cmcdot risk) < τ ). This property states that if there is a risk of collision, the probability returned by CMCDOT must be high enough. Conversely, if there is no risk of collision, the probability returned by CMCDOT must be small enough.

IV. A SECOND VALIDATION APPLICATION: A DECISION-MAKING SYSTEM

A. Principle of the POMDP based decision-making

The decision-making system is a key component of an autonomous vehicle. Its task is to plan the movement of the vehicle taking into account the uncertainty in the collected measurements as well as the uncertain consequences that its action will have on the situation.

Partially Observable Markov Decision Process (POMDP) is a mathematical model that can appropriately formalize this two kind of uncertainties and has been widely used for planning in stochastic environments [START_REF] Kaelbling | Planning and acting in partially observable stochastic domains[END_REF].

With recent advancements on online-Pomdp solvers (e.g. [START_REF] Silver | Monte-carlo planning in large pomdps[END_REF], adopted in our work), complex problems such as road intersection crossing has been addressed in [START_REF] Liu | Situation-aware decision making for autonomous driving on urban road using online pomdp[END_REF]. The key element of our approach [START_REF] Barbier | Probabilistic decision-making at road intersections: Formulation and quantitative evaluation[END_REF], inspired by [START_REF] Lefèvre | Risk assessment at road intersections: Comparing intention and expectation[END_REF], is to take into account the difference between intention and expectation of drivers approaching an intersection to enable partial cooperation. The intention corresponds to the maneuver actually performed by the drivers and it can be classified by employing the approach presented in [START_REF] Barbier | Classification of drivers manoeuvre for road intersection crossing with synthethic and real data[END_REF]. The expectation represents what the driver should do regarding the current situation and traffic rules. Situations where intention and expectation do not match could result in risky interactions. These two variables can be inferred from the physical state (velocity and distance approaching the intersection) of both vehicles. Our model is represented as a Bayesian network, as in Fig. 7 where the interaction between variables is shown.

The reward function of the model is constructed to take into account: comfort, velocity, time to collision, traffic rules and differences between intention and expectation. The system interacts with the environment by selecting an acceleration that maximizes the current estimations of the sum of future expected rewards. Because of the stochastic aspect of the model and its solvers, a safe intersection crossing cannot be formally guaranteed. Thus, a large number of simulations is required to validate the model in order to ensure a safe behavior. The challenge is represented by the large dimension of the scenario space, due to the various regulations, different initial velocities and numerous possible behaviors. Then, the parameter space for the model, especially its reward function, is equally large and needs to be correctly explored in order to find the functional range of the system. that have to be realized in the simulated environment. Thus the fidelity, that is how closely the simulator can generate environmental data and model the system, is fundamental. In our scenario, the micro-traffic simulation (vehicle state and interactions between vehicles) is more important than the macro-simulation (simulation of traffic as a group of vehicles). As our system selects actions, it expects the other vehicle to change its behavior. For the ego vehicle, the dynamic model of the vehicle does not need to have a high fidelity. However, since in the future we want to compare results obtained against field operational testing, the possibility of having high fidelity model is a plus. The decision could be of different forms (trajectory, goal points, control input), so the communication between the system under test and the simulation models must be adaptable. Fig. 8 represents the different scenarios that have to be tested (yield, stop controlled, or priority). The simulator must generate the appropriate behavior for each of the corresponding situations. Real-life scenarios could be also be imported to increase the validity of the reproduced situation. It would only require to import maps and perception data from other sources. Scaner [START_REF] Oktal | Scaner studio[END_REF], an automotive grade simulator, has been chosen to test the decision-making systems. It has been mostly used for vehicle in the loop testing. However, most of the features previously described are available, at various levels of maturity. It has simple but interactive models for road intersection crossing and map generation. Scaner features a batch testing function, that we found too complex to interface with the SMC.

B. Method Application

2) KPI definition: In order to evaluate the quality of the decision algorithm, we define some Key Performance Indicators regarding the crossing of an intersection. First, we define two areas in the intersection: a critical area, that corresponds to the actual intersection where stopped vehicles would block all branches of the intersection, and a non-critic area, that corresponds to the entry of the intersection where cars usually stop before crossing the other road. We count the number and total duration of stops in each area, a smaller number indicates a better quality of the algorithm. We also measure the total time needed to cross the intersection, where again a smaller number indicates a better quality. We measure the acceleration to evaluate the comfort of the passenger, where again a smaller number indicates a better quality. For all metrics m for which smaller values indicate a better performance, we check whether m is bounded by a bound b. The formula G ≤t m ≤ b, with t corresponding to the time needed to cross the intersection, states that m is always smaller than b. Stating that the acceleration must always be smaller than a bound might be a too-strong constraint. We thus propose a relaxed version of this KPI where the acceleration is allowed to be above the bound for a short period of time (1s). This is stated by the formula G ≤t F ≤1 acc ≤ b. The previous formula can be read as follows: at any point during the simulation, m will be smaller than b in less than 1s. In other words, it is not possible that m > b for more than 1s. The value of the bound b is defined w.r.t. the considered metric.

Finally, to evaluate whether the intersection is crossed quickly enough, we set a maximum duration d for crossing the intersection and require that the intersection is crossed in less than d seconds, stated by F ≤d crossed .

3) SMC application: In order to obtain results, we selected for each metric some adequate bounds and plot the probability that the KPI is met for each bound. Fig. 9 represents the probability that the acceleration/deceleration remains below a certain bound when crossing the intersection, both for the strict (i.e. the bound is never exceeded) and the relaxed version (the bound is never exceeded for more than 1s). We see that there is a zero probability that the acceleration stays below an absolute value of 0.8m/s 2 , and that it is always below 2m/s 2 . This corresponds to an acceptable range for human comfort and shows that in every scenario the decision-making system took actions to adapt the behavior.

Figures 10 and11 present the probability of respectively having a bounded number of stops and having a bounded total stop duration. We see that there is a probability 0.9 that the car does not stop in the critical zone. With that measure it can be said that most likely the ego vehicle will comply with the traffic law. However, the causes of the remaining 0.1 probability that the vehicle stops in the intersection need to be investigated to determine whether it corresponds to emergency maneuvers or a failure in the system. This could be done by introducing finer KPIs that would take into account the temporality of the problem.

In Fig, 12 we finally show the probability to cross the intersection in less than a given time. All this information can be then exploited to define what is the most likely behavior of the decision-making system in real scenarios, and it can also be useful to guide the improvement of these approaches, highlighting their weak aspects.

V. CONCLUSION

In this paper we presented and demonstrated a pipeline for the validation of different components of an ACPS on two different automotive use-cases. The application of our approach based on Statistical Model Checking to the decision-making system provides useful information to the designers of the system and to the people in charge of the validation. This valuable information is formulated through probability for our system to stay in a certain range of KPIs.

In the future, we intend to complete our analysis on the collision-risk estimation and propose meaningful gridbased metrics for stating more discriminating KPIs for the perception system. We also plan to compare results obtained in the simulated environment with tests on proving ground to ensure the validity of our approach. Additionally, more KPIs for the decision system could be considered to accurately pinpoint the causes of identified failures.

  Louvain-la-Neuve, Belgium.

Fig. 1 .

 1 Fig. 1.Interactions between the different elements of the proposed validation pipeline. Dashed lines represents future developments to connect the decision and perception.

Fig. 2 .

 2 Fig. 2. An overview of SMC

Fig. 3 .

 3 Fig.3. Data fusion in an occupancy grid. Data from each of the 2 lidars are used to generate occupancy grids using sensor models, which are then combined by using Bayesian fusion.

Fig. 4 .

 4 Fig. 4. Data representation in the CMCDOT formulation. The environment is divided into cells, to which are associated static, dynamic, empty and unknown coefficients. The dynamic part is allotted to weighted particles which sample the velocity space.

Fig. 5 .

 5 Fig. 5. Collision risk estimation over time for a specific cell. The cell position is predicted according to its velocity, along with the mobile robot. This risk profile is computed for every cell, and then used to integrate over time the global collision risk.

Fig. 6 .

 6 Fig. 6. Simulated scenario in Carla (top) and output of CMCDOT (bottom).

1 )Fig. 7 .

 17 Fig. 7. The POMDP represented as a Bayesian network. The square node represents the action chosen by the framework.

Fig. 8 .

 8 Fig. 8. Simulated scenario for the decision-making. The ego vehicle (blue) is controlled by the decision-making system and has to interact with the other vehicle (white) respecting the traffic rules.

Fig. 9 .

 9 Fig. 9. Probability that the absolute value of the acceleration remains bounded, for the strict and the relaxed version.

Fig. 10 .

 10 Fig. 10. Probability of bounded occurrences of stops, for critical and noncritical zones.

Fig. 11 .

 11 Fig. 11. Probability of a stop duration below a given bound, for critical and non-critical zones.

Fig. 12 .

 12 Fig. 12. Probability of crossing the intersection in less than a given time.

TABLE I LIST

 I OF VARIABLES EXTRACTED FROM THE SIMULATIONS.

	Name	Description	Unit
	t	Timestamp or time elapsed	s
	nc stops	Number of stops in the non-critical area
	c stops	Number of stops in the critical area
	t nc stops	Duration of stops in non-critical area	s
	t c stops	Duration of stops in critical area	s
	acc	Acceleration	ms -2
	crossed	True if intersection is crossed

ACKNOWLEDGMENT

This work has been developed within the scope of Institut de Recherche Technologique NanoElec, founded by the French program "Investissements d'Avenir" ANR-10-AIRT-05.

This work has been conducted within the ENABLE-S3 project that has received funding from the ECSEL joint undertaking under grant agreement NO 692455. This joint undertaking receives support from the European Union's Horizon 2020 research and innovation programme and Austria, Denmark, Germany, Finland, Czech Republic, Italy, Spain, Portugal, Poland, Ireland, Belgium, France, Netherlands, United Kingdom, Slovakia, Norway.