Autonomy, how much human in the loop? Architecting systems for complex contexts

Transcription

1 Architecting systems for complex contexts by Gerrit Muller University College of South East Norway Abstract The move from today s automotive archictectures to autonomous architectures triggers many questions. Todays architectures are federative, focused on safety through predictability, and legacy and bottom-up driven. Autonomy requires context understanding, and a fundamental discussion on the balance between humans and autonomous systems. This presentation takes the perspective from other domains with software intensive systems, to explore the potential hurdles in the transition to autonomous systems. Distribution This article or presentation is written as part of the Gaudí project. The Gaudí project philosophy is to improve by obtaining frequent feedback. Frequent feedback is pursued by an open creation process. This document is published as intermediate or nearly mature version to get feedback. Further distribution is allowed as long as the document remains complete and unchanged. status: planned

2 An outsiders perspective on Automotive The speaker s background Health care, MRI scanners (and ) Highly integrated architecture: Host computer + controllers Health care, Imaging workstations Object Oriented, workstations + servers Semiconductor equipment From federated to integrated architecture The speaker s perspective on automotive Loooong development cycles (heavy qualification, certification, verification) Where is the system from control perspective? Why do designers constrain themselves so much? (no dynamic memory management!) How can automotive move from such primitive state to autonomous driving? 2 Gerrit Muller AACSoutsidersPerspective

3 Figure of Contents TM architecture example and trends from semiconductor equipment domain automotive architecture and trends health care automation example autonomous driving? 3 Gerrit Muller AACSlogo

4 Example ASML Waferstepper 4 Gerrit Muller ASMLtwinscanPhoto

5 Control Hierarchy of a Waferstepper system control coordination ethernet laser lens illuminator measurement C&T reticle stage reticle handler wafer stage wafer handler VME VME vertical motion horizontal motion vertical motion horizontal motion 5 Gerrit Muller FAIcontrolHierarchy

6 Trend: Increased Frequency of Control Actions trend with increasing performance requirements SW sampling per die per wafer per batch per day preventive maintenance seconds 6 Gerrit Muller FAIcontrolFrequency

7 Evolution of System Control user interface automation interface monitoring and optimization user interface static simple calibration sequencer kloc data store production and installation support feedforward metro exposure control dynamic calibration infrastructure kloc job control data management monitoring 7 Gerrit Muller FAIcontrolEvolution

8 Consequences of Evolution Performance and functionality demands causes Complexity threatens Reliability loss of overview (150kloc fits in 1 mind, 2Mloc not) (more than?) exponential increase of coupling 1:1 relation HW:SW becomes n:m relation autonomous subsystems paradigm shift! integrated system 8 Gerrit Muller FAIevolutionConsequences

9 architecture example and trends from semiconductor equipment domain automotive architecture and trends health care automation example autonomous driving? 9 Gerrit Muller AACSlogoAutomotive

10 Conventional Vehicle Network Master Gateway ECU ECU ECU Free after: A reference architecture for cooperative driving. By Sagar Behere, Martin Törngren, De-Jiu Chen 10 Gerrit Muller AACSvehicleNetwork

11 Cooperative Driving Vehicle Network Master Gateway ECU ECU ECU Coop driving system From: A reference architecture for cooperative driving by Sagar Behere, Martin Törngren, De-Jiu Chen 11 Gerrit Muller AACSvehicleNetworkPlus

12 Conceptual view of the reference architecture Wireless reception To Supervisor Semantic Data analyser From: A reference architecture for cooperative driving. By Sagar Behere, Martin Törngren, De-Jiu Chen Model data supplier Super sensors Local sensors Vehicle gateway Other information sources Model data processors Data Fusion #1 World Model Generic data processor Map matching Model data consumers Wireless broadcast HMI Control Data flow Architecural element Generic data processor Plugin Local Actuators Vehicle Gateway 12 Gerrit Muller AACSreferenceArchitecture

13 architecture example and trends from semiconductor equipment domain automotive architecture and trends health care automation example autonomous driving? 13 Gerrit Muller AACSlogoAutomation

14 MRI: From Human Intent to Technical Realization clinical workflow protocol, request clinical imaging contrast, resolution, position, exam card MRI physics method, TR, TE, preset procedure machine desired waveforms corrected waveforms f.i. Eddy currents 1980 pulse programming digital samples analog currents human access and support 14 Gerrit Muller AACStransformationsMRI

15 Evolution in Operation of MRI operator knowledge and focus: from technical to application to workflow scope: from system to examination (including humans) to department or hospital positive: result orientation How robust is this set-up for more exceptional cases? focus on workflow efficiency focus on clinical imaging MRI physics knowledge machine knowledge Gerrit Muller AACSevolutionMRIoperation

16 What are the Consequences of Automation Benefits Focus on patient and clinical aspects Less errors for routine cases, due to protocolized way of working Concerns How much do clinical users know and understand the imaging system? Will they understand and be able to cope with technical opportunities and constraints? Will they be able to operate the system for non-routine cases? Challenge of automating How can clinical users build up and maintain technical competence? 16 Gerrit Muller AACSautomationBCs

17 Symptom of Problematic Automation Alarm Fatigue Ignoring or switching off alarms that occur too often. Typical pattern When designers do not know how to handle an exception, then they make a configurable alarm, delegating the problem to the next person in the chain. Have you been in Critical Care Units or any control room? How many alarms are ignored? Deepwater Horizon, Gulf of Mexico The alarms in the crew cabins were switched off, since the alarm sounded too often 17 Gerrit Muller AACSalarmFatigue

18 architecture example and trends from semiconductor equipment domain automotive architecture and trends health care automation example autonomous driving? 18 Gerrit Muller AACSlogoAutonomous

19 Should Cars Ignore the Law? Date: Fri, 18 Dec :18: Subject: Driverless cars: too safe at any speed? Keith Naughton, 18 Dec 2015 Accident rates are twice as high for driverless cars as for regular cars, but the driverless cars have never been at fault. DETROIT (Bloomberg) -- The self-driving car, that cutting-edge creation that's supposed to lead to a world without accidents, is achieving the exact opposite right now: The vehicles have racked up a crash rate double that of those with human drivers. The glitch? They obey the law all the time, as in, without exception. This may sound like the right way to program a robot to drive a car, but good luck trying to merge onto a chaotic, jam-packed highway with traffic flying along well above the speed limit. It tends not to work out well. As the accidents have piled up -- all minor scrape-ups for now -- the arguments among programmers at places like Google Inc. and Carnegie Mellon University are heating up: Should they teach the cars how to commit infractions from time to time to stay out of trouble? [...] 19 Gerrit Muller AACScompRisksQuote

20 A functional architecture for autonomous driving off-board guidance systems tele-operation/remote monitoring/fleet management on-board vehicle systems sensing external localization semantic understanding world model external S 1 sensor fusion decision and control cognitive driving intelligence S k trajectory energy platform fault man vehicle platform abstraction vehicle platform internal S 1 S n diagnostics & fault man. reactive control energy management trajectory execution platform stabilization propulsion/steering/braking passive safety internal from: A Functional Architecture for Autonomous Driving, by Sagar Behere, Martin Törngren 20 Gerrit Muller AACSautonomousArchitecture

21 Human and Automotive Minds System 2 slow, lazy, critical thinking situation awareness sometimes lured by System 1 System 1 fast, intuitive situation assessment and handling often right Thinking Fast and Slow by: Daniel Kahneman artificial intelligence? cognitive driving intelligence fast situation assessment and handling how often right or wrong? intelligent transport system (or wider context) sometimes wrong cerebellum autonomic nervous system peripheral nervous system vehicle platform very fast local 21 Gerrit Muller AACSmodelMinds

22 What is your Conclusion? When and why do we benefit from full autonomous driving? Will we have time and energy for new developments? Will we lose our own capabilities? 22 Gerrit Muller AACSconclusion