Pith. sign in

REVIEW 4 major objections 5 minor 2 cited by

SCALOFT: An Initial Approach for Situation Coverage-Based Safety Analysis of an Autonomous Aerial Drone in a Mine Environment

T0 review · 4 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read SCALOFT generates 32 test situations from a five-axis grid and uses runtime monitoring to catch the safety violations caused by three HAZOP-seeded faults in a mine-surveying drone simulation.

desk verdict Honest early-stage extension of situation-coverage testing to mine drones; the narrow fault-detection claim holds up, but the coverage metric's meaning is underspecified. read the letter →

arxiv 2505.20969 v1 pith:S5HV7FW3 submitted 2025-05-27 cs.RO

Nawshin Mannan Proma , Victoria J Hodge , Rob Alexander This is my paper
classification cs.RO
keywords situationcoveragesafetytestingautonomousaerialdronemineenvironmentHAZOPfaultinjectionruntimemonitoringgrid
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper is trying to establish that a situation-coverage testing approach called SCALOFT can systematically expose safety violations in an autonomous aerial drone operating inside a mine. It builds a grid of 32 discrete situations from five binary axes (corner turning, obstacle, waypoint placement, lighting, human presence) and uses runtime monitoring to check two high-level safety requirements. The authors seed three faults derived from HAZOP guidewords and report that SCALOFT detects the resulting collisions and the failure to slow down for a person. If correct, this offers a structured way to generate diverse test cases and a coverage percentage that can feed a safety argument for drones in underground environments.

What carries the argument

The central object is the situation coverage grid: five axes (turning a corner, obstacle on path, waypoint placement, lighting condition, human presence), each with two values, producing $2^5 = 32$ discrete situations that define the space to be tested. A coverage grid records which cells have been exercised, and at the end the coverage percentage is the ratio of tested situations to total generated situations. The grid works with runtime monitoring of the two safety requirements and a HAZOP deviation matrix that turns guidewords such as LATE, UNINTENDED, and MORE into concrete seeded faults. Together these pieces let the approach convert the safety-case question 'do the test cases sufficiently cover potential operating scenarios?' into an executable sampling-and-checking loop.

What would settle it

Run SCALOFT's 32-situation grid against faults drawn from real mine-flight failure logs or from a higher-fidelity simulation with sensor noise and compare: if the seeded faults do not match field failure modes, or if SCALOFT misses violations that appear under those faults, the claim that it detects plausible faults is undermined.

Watch

Extended reading notes

Core claim

SCALOFT proposes that safety of an autonomous mine-surveying drone can be assessed by sampling a situation hyperspace rather than scripting individual scenarios. The initial grid combines five binary axes to yield $2^5 = 32$ situations; random situations are generated, logged as covered cells, and simulated in the ALOFT testbed, a physics-based mine simulation. During flight, runtime monitors check SR1 (no collisions) and SR2 (slow down and avoid collision when a person is within range). For the reported experiments, three seeded faults---a 3-second delay in human detection, a false collision every 20 seconds, and an increased goal threshold---each led to a logged safety violation, which the authors present as evidence that SCALOFT can detect small, plausible faults.

Load-bearing premise

The result depends on the ALOFT simulation and the three hand-chosen seeded faults standing in for how a real drone and its real failures behave in an actual mine; if either is unrepresentative, the detected violations say little about real-world safety.

Editorial extensions

If this is right

  • A safety argument for this drone class can cite a concrete coverage percentage alongside a log of every violated situation, each tagged with a unique identifier.
  • Adding new axes to the grid extends the set of situations without changing the monitoring machinery, so the same SCALOFT loop can scale to more environment factors.
  • The three HAZOP-seeded faults map onto the two safety requirements SR1 and SR2, showing that guideword-based fault injection can be used to check whether a runtime monitor can actually observe the failures it is meant to catch.
  • Because violations are logged with collision position and time, the output can drive future design changes and targeted retesting of the failed situations.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the grid were crossed with the HAZOP deviation matrix, the resulting two-dimensional coverage---situations times fault modes---could serve as a stronger safety metric than either dimension alone; the paper builds the two pieces but does not combine them into one coverage count.
  • The dark-lighting cell's collision suggests that a sensor-model axis (depth-camera range in darkness) may be more safety-critical than the five chosen axes; testing with more lighting granularity might expose additional failure boundaries.
  • The false-collision-every-20-seconds fault hints that temporal fault patterns need repeated or long-duration runs to be caught; a single pass through a 32-cell grid may underestimate the violation rate for intermittent faults.
  • A natural next experiment is to compare SCALOFT's situation sampling against random or exhaustive scenario search on the same seeded faults, which could quantify how much structure the grid adds; the paper does not include such a baseline.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes SCALOFT, a situation-coverage-based testing approach for an autonomous aerial drone in an underground mine, built on the ALOFT digital twin. A five-axis binary situation grid defines 32 cells; the system randomly generates situations, marks covered cells, executes the drone mission, and uses runtime monitors to check two safety requirements (SR1: collision avoidance; SR2: the drone shall reduce speed and avoid collision when a person is detected). The paper evaluates SCALOFT by injecting three HAZOP-derived faults (LATE, UNINTENDED, MORE) and reports that each produced a safety violation detected by SCALOFT. The central claims are that the coverage grid helps build a safety argument and that SCALOFT successfully detects small seeded faults.

Significance. The practical direction is useful and the components are sensible: deriving a situation hyperspace from an ODM, keeping the initial grid manageable at 25 cells, using a realistic publicly available ALOFT simulation, and using HAZOP guidewords to select seeded faults. The paper is honest about being an initial approach, and the conclusion appropriately acknowledges the challenge of scaling to infinite operational conditions. However, the evidence as presented does not yet support the safety-argument claim. The stopping condition for coverage is unspecified, the injected faults are constructed so that they directly violate the monitored requirements, and there is no baseline or statistical analysis. The narrow claim that the three injected faults are detected is credible, but the paper does not yet show that situation coverage, rather than the runtime monitors alone, contributes to detection. The paper would be a reasonable starting point for a stronger evaluation rather than a complete validation of the proposed approach.

major comments (4)
  1. [§3.2, Fig. 4] The stopping condition for the coverage search is unspecified. The text states that the process continues 'until a predefined stopping condition is reached,' but neither the condition nor its value is defined anywhere. If the condition is 'iterate until all 32 cells are covered,' then the final coverage percentage is 100% by construction and carries no safety information; if it is something else, the reader cannot interpret any reported coverage value. This is load-bearing because the paper's central claim is that situation coverage helps build a safety argument. Please specify the stopping condition explicitly, report the actual coverage values, and state the denominator of the coverage ratio (tested situations versus total possible situations versus total generated situations).
  2. [§4, Table 4] The seeded-fault evaluation is substantially forced by construction. Each injected fault is defined as a deviation that directly violates one of the two safety requirements being monitored: LATE delays human detection by 3 seconds, which is a direct violation of SR2; UNINTENDED and MORE produce collisions, which direct violate SR1. The monitor need not use any situation-coverage reasoning to detect these faults; it only needs to observe the same property that the fault was designed to break. To support the claim that SCALOFT detects faults, include faults that are not direct negations of the monitored requirements—for example, subtle perception degradation or controller gain changes that degrade mission performance without immediately violating SR1 or SR2—and show that the coverage-guided sampling, rather than the monitor alone, is responsible for finding the violations.
  3. [§4] There is no baseline and no repeated trials in the evaluation. The paper does not compare SCALOFT to the same runtime monitors with random situation sampling and no coverage grid, so it cannot show that situation coverage adds detection power. There are also no repeated simulation runs or error bars, and the fault magnitudes (3-second detection delay, 20-second false-collision interval, unspecified goal-threshold increase) are hand-chosen without sensitivity analysis. At minimum, the paper should report results over repeated runs, vary the fault magnitudes to show the detection boundary, and include a random-testing control.
  4. [§3.2, Tables 2–3] The coverage grid is the paper's main artifact, but no coverage results are reported. The paper never states how many of the 32 cells were exercised, which cells produced violations, or the final coverage percentage. Without these numbers, the proposed coverage metric is not actually evaluated. Please add a per-cell coverage table or plot and report the final coverage value for each fault scenario.
minor comments (5)
  1. [§3.2] The text 'results in25 = 32discrete situations' appears to be a formatting error; it should read \(2^5 = 32\) to justify the 32 discrete situations.
  2. [Fig. 5 caption] The caption contains typos ('obstcale', 'it's') and is more detailed than the main text; please correct the typos and consider moving some of the caption's explanatory content into the body.
  3. [References] Reference [2] is an Intel RealSense forum post; if it is used as evidence for the depth camera's behavior in darkness, consider adding a measured characterization or a stronger technical reference.
  4. [§3.1] The text says the project and log files are available via an associated GitHub repository, but no URL is given. Please include the repository link so the implementation and logs can be inspected.
  5. [§4] The phrase 'for small faults' is vague; define what 'small' means here—magnitude, scope, or detection difficulty—and justify why the chosen injected magnitudes are plausible.

Circularity Check

1 steps flagged · score 6.0 of 10

Seeded faults are constructed to trigger exactly the monitored safety requirements, so the detection success is forced by construction rather than independently demonstrated.

  1. self definitional [Section 4, Table 4 and Section 3.2 (SR1, SR2)]
    "Table 4: LATE: Delay detecting human by 3 seconds — Drone failed to reduce speed due to late detection — SR2; UNINTENDED: Simulate false collision every 20 sec — After experiencing a false collision detection, the drone actually collided with a wall — SR1; MORE: Increase goal threshold — ... collide before reaching the next waypoint — SR1. Section 4: 'The observed safety violations across all fault injection scenarios indicate that the seeded faults were successfully triggered and validate the effectiveness of the SCALOFT testing approach for small faults.'"

    The safety monitor checks SR1 (avoid collisions) and SR2 (reduce speed upon detecting a person within a specified distance). Each seeded fault is chosen so that its consequence is precisely the monitored violation: delaying human detection by 3 seconds is defined as a failure to reduce speed (SR2), a false collision every 20 seconds is chosen so the drone subsequently collides (SR1), and an increased goal threshold is chosen so the drone navigates incorrectly and collides (SR1). Therefore the recorded safety violations are not independent observations of the approach's detection ability; they are the direct manifestation of the injected deviation.

full rationale

The paper's central evaluation claim is that SCALOFT successfully detects the three seeded faults. That claim is meaningful only if the seeded faults could plausibly fail to be detected. Here, however, the faults are defined in terms of the same safety requirements the runtime monitor checks: LATE delays human detection and thereby triggers SR2; UNINTENDED and MORE are configured so that the drone collides, triggering SR1. The detection outcomes are therefore substantially forced by the construction of the fault-injection scenarios. I did not treat the unspecified 'predefined stopping condition' as a circularity because the paper never states it; it is a completeness/evidence gap, not a redefinition. The self-citations to the authors' earlier situation-coverage work (e.g., [5], [7], [21], [22]) are not load-bearing here: the paper is an application of that earlier idea, and the implementation is presented concretely. The coverage grid and final coverage percentage are also not inherently circular; their interpretation as a safety argument is under-supported, but no equation in the paper reduces coverage to fit. Overall, the central validation step reduces by construction to the injected faults, so a score of 6 is appropriate.

Assumptions & free parameters 3 free parameters · 6 assumptions · 0 invented entities

The central demonstration rests on three hand-chosen fault magnitudes and several domain assumptions about simulation fidelity, requirement sufficiency, and sensor behavior in darkness. These are not fitted to data, but they are also not independently validated, so the detected violations are conditional on the assumptions holding. No new physical or conceptual entities are postulated beyond the situation coverage grid, which is borrowed from prior work by the same group.

free parameters (3)
  • Human detection delay (LATE fault) = 3 seconds
    Hand-chosen timing delay for the LATE HAZOP deviation; not derived from field data or a prior study.
  • False collision interval (UNINTENDED fault) = every 20 seconds
    Hand-chosen period for injecting spurious collision detections; no justification for the specific interval.
  • Goal threshold increase (MORE fault) = unspecified
    The magnitude of the goal threshold increase is not stated in the paper; it is chosen by hand to force navigation error.
assumptions (6)
  • domain assumption Component-level coverage is already achieved and sufficient.
    Stated in Section 1 to scope the work to system-level situation coverage; if false, the approach may miss faults at the component level.
  • domain assumption The five axes with two values each adequately represent the relevant operational situations.
    Section 2.1 limits the hyperspace to light level, static obstacles, safe zone, and narrow corridors, excluding many ODM categories such as airflow, moisture, methane, and dynamic machinery.
  • domain assumption ALOFT simulation realistically models the mine and the drone.
    Section 3.1 describes ALOFT as a digital twin with a physics engine and 3D laser-scan-based mine geometry, but fidelity to real mine conditions is not validated in this paper.
  • domain assumption The depth camera can partially detect surroundings in total darkness.
    Section 3.2 relies on an Intel RealSense forum post rather than a controlled measurement in the mine environment.
  • domain assumption The two safety requirements SR1 and SR2 capture the relevant safety properties.
    Table 4 evaluates violations only against these two requirements; other hazards such as gas, dust, and machinery interaction are outside the evaluation scope.
  • standard math 2^5 = 32 enumerates all combinations of the five binary axes.
    Counting argument used in Section 3.2 to define the discrete situation space.

how reviews work

0 comments
Cite this review

Pith. "Pith review of SCALOFT: An Initial Approach for Situation Coverage-Based Safety Analysis of an Autonomous Aerial Drone in a Mine Environment." pith.science (2026). https://pith.science/paper/S5HV7FW3

@misc{pith2026250520969,
  author       = {Pith},
  title        = {Pith review of: SCALOFT: An Initial Approach for Situation Coverage-Based Safety Analysis of an Autonomous Aerial Drone in a Mine Environment},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/S5HV7FW3}},
  note         = {Machine review of arXiv:2505.20969}
}
read the original abstract

The safety of autonomous systems in dynamic and hazardous environments poses significant challenges. This paper presents a testing approach named SCALOFT for systematically assessing the safety of an autonomous aerial drone in a mine. SCALOFT provides a framework for developing diverse test cases, real-time monitoring of system behaviour, and detection of safety violations. Detected violations are then logged with unique identifiers for detailed analysis and future improvement. SCALOFT helps build a safety argument by monitoring situation coverage and calculating a final coverage measure. We have evaluated the performance of this approach by deliberately introducing seeded faults into the system and assessing whether SCALOFT is able to detect those faults. For a small set of plausible faults, we show that SCALOFT is successful in this.

Figures

Figures reproduced from arXiv: 2505.20969 by the authors.

Figure 1
Figure 1. Zoomed view of ODM for an underground mine. See [9] for the full ODM [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Situation hyperspace inspired from [28] In our study, the situation hyperspace has been constructed in a methodical way so that our SCALOFT testing approach can systematically navigate through it to generate situations for AAD. In [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. ALOFT setup 3.2 SCALOFT [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Our proposed testing approach in the simulation. Here, default lighting conditions refer to an artificial overhead light that illuminates the entire mine. The green lines in fig. 5 represent the actual recorded positions of the drone during its journey inside the ALOFT…
Figure 5
Figure 5. Figure 5: Comparison of drone’s journey in different conditions [PITH_FULL_IMAGE:figures/full_fig_p009_5.png]
Figure 6
Figure 6. Figure 6: Drone’s journey in no light setting [PITH_FULL_IMAGE:figures/full_fig_p010_6.png]

Discussion (0). Sign in to comment.

Forward citations

Cited by 2 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Robustness Requirement Coverage using a Situation Coverage Approach for Vision-based AI Systems

    cs.RO 2025-07 conditional novelty 6.0 of 10

    A position paper integrating camera noise factor identification with situation coverage to express robustness requirements as performance requirements qualified by bounded operational context subsets (PODs).

  2. Probabilistic Safety Verification for an Autonomous Ground Vehicle: A Situation Coverage Grid Approach

    cs.RO 2025-07 conditional novelty 5.0 of 10

    A situation coverage grid is augmented with transition probabilities and checked with probabilistic model checking to rank AGV situations by collision risk.

Reference graph

Works this paper leans on

31 extracted references · 28 canonical work pages · cited by 2 Pith papers

  1. [1]

    Px4 vision kit (2023), available at: https://docs.px4.io/main/en/complete_ vehicles/px4_vision_kit.html[Accessed:2025-01-28]

    work page 2023

  2. [2]

    Range of d435 depth camera in darkness (2025), https: //support.intelrealsense.com/hc/en-us/community/posts/ 360037389393-range-of-D435-depth-camera-in-darkness-or-poor-lighting-condition , accessed: 2025-03-20

    work page 2025

  3. [3]

    In: Proceedings of the 40th International Conference on Software Engineering

    Abdessalem, R.B., Nejati, S., Briand, L.C., Stifter, T.: Testing vision-based con- trol systems using learnable evolutionary algorithms. In: Proceedings of the 40th International Conference on Software Engineering. pp. 1016–1026 (2018)

    work page 2018

  4. [4]

    Alexander, R.: AAIP Robot Demonstrator Project Testing Strategy Report (2023), unpublished

    work page 2023

  5. [5]

    Alexander, R., Hawkins, H.R., Rae, A.J.: Situation coverage–a coverage criterion for testing autonomous robots. Tech. rep., Department of Computer Science, Uni- versity of York (2015)

    work page 2015

  6. [6]

    In: Procs of 23rd ACM/IEEE Conference on Model Driven Engineering Languages and Systems (2020)

    Babikian, A.A.: Automated generation of test scenario models for the system-level safety assurance of autonomous vehicles. In: Procs of 23rd ACM/IEEE Conference on Model Driven Engineering Languages and Systems (2020)

    work page 2020

  7. [7]

    arXiv preprint arXiv:1911.06501 (2019)

    Hawkins, H., Alexander, R.: Situation coverage testing for a simulated autonomous car–an initial case study. arXiv preprint arXiv:1911.06501 (2019)

    arXiv 2019

  8. [8]

    arXiv preprint arXiv:2208.00853 (2022)

    Hawkins, R., Osborne, M., Parsons, M., Nicholson, M., McDermid, J., Habli, I.: Guidance on the safety assurance of autonomous systems in complex environments (sace). arXiv preprint arXiv:2208.00853 (2022)

    arXiv 2022

Show all 31 references
  1. [9]

    Hodge, V.J.: Assuring the Safety of UAVs for Mine Inspection (ASUMI), ODM available athttps://www-users.york.ac.uk/~vjh5/myPapers/ASUMI_ODM.pdf

  2. [10]

    Neural Computing and Applications,33(6), 2015– 2033 (2021)

    Hodge, V.J., Hawkins, R., Alexander, R.: Deep reinforcement learning for drone navigation using sensor data. Neural Computing and Applications,33(6), 2015– 2033 (2021)

    2021

  3. [11]

    In: Computer Aided Verification: 29th International Conference, CAV 2017, Heidelberg, Germany, July 24-28, 2017

    Huang, X., Kwiatkowska, M., Wang, S., Wu, M.: Safety verification of deep neural networks. In: Computer Aided Verification: 29th International Conference, CAV 2017, Heidelberg, Germany, July 24-28, 2017. pp. 3–29. Springer (2017)

    2017

  4. [12]

    In: SEAMS’24: Proceedings of the 19th Symposium on Software Engineering for Adaptive and Self-Managing Systems

    Imrie, C., Howard, R., Thuremella, D., Proma, N.M., Pandey, T., Lewinska, P., Cannizzaro, R., Hawkins, R., Paterson, C., Kunze, L., et al.: Aloft: Self-adaptive drone controller testbed. In: SEAMS’24: Proceedings of the 19th Symposium on Software Engineering for Adaptive and S...

    2024

  5. [13]

    Software & Systems Modeling 14, 483–524 (2015)

    Iqbal, M.Z., Arcuri, A., Briand, L.: Environment modeling and simulation for auto- mated testing of soft real-time embedded software. Software & Systems Modeling 14, 483–524 (2015)

    2015

  6. [14]

    In: Procs of 29th International Conference on Computer Aided Verification, CAV 2017, Heidelberg, Germany, July 24-28

    Katz, G., Barrett, C., et al.: Reluplex: An efficient smt solver for verifying deep neural networks. In: Procs of 29th International Conference on Computer Aided Verification, CAV 2017, Heidelberg, Germany, July 24-28. pp. 97–117 (2017)

    2017

  7. [15]

    In: Artificial intelligence safety and security, pp

    Kurakin, A., Goodfellow, I.J., Bengio, S.: Adversarial examples in the physical world. In: Artificial intelligence safety and security, pp. 99–112. Chapman and Hall/CRC (2018) 12 N.M. Proma et al

    2018

  8. [16]

    In: 2019 ACM/IEEE 22nd International Conference on Model Driven Engineering Languages and Systems (MODELS)

    Majzik, I., Semeráth, O., Hajdu, C., et al.: Towards system-level testing with cov- erage guarantees for autonomous vehicles. In: 2019 ACM/IEEE 22nd International Conference on Model Driven Engineering Languages and Systems (MODELS). pp. 89–94. IEEE (2019)

    2019

  9. [17]

    In: Procs of 6th KES International Conference: Agent and Multi-Agent Systems, Technologies and Applications (KES-AMSTA), June 25-27

    Micskei, Z., Szatmári, Z., Oláh, J., Majzik, I.: A concept for testing robustness and safety of the context-aware behaviour of autonomous systems. In: Procs of 6th KES International Conference: Agent and Multi-Agent Systems, Technologies and Applications (KES-AMSTA), June 25-2...

    2012

  10. [18]

    Autonomous Agents and Multi-Agent Systems25, 260–283 (2012)

    Nguyen, C.D., Miles, S., et al.: Evolutionary testing of autonomous software agents. Autonomous Agents and Multi-Agent Systems25, 260–283 (2012)

    2012

  11. [19]

    http://gazebosim.org/ (2019)

    OSRF: Gazebo. http://gazebosim.org/ (2019)

    2019

  12. [20]

    In: proceedings of the 26th Symposium on Operating Systems Principles

    Pei, K., Cao, Y., Yang, J., Jana, S.: Deepxplore: Automated whitebox testing of deep learning systems. In: proceedings of the 26th Symposium on Operating Systems Principles. pp. 1–18 (2017)

    2017

  13. [21]

    In: Procs of the 12th Latin-American Symposium on Dependable and Secure Computing

    Proma, N.M., Alexander, R.: Systematic situation coverage versus random situ- ation coverage for safety testing in an autonomous car simulation. In: Procs of the 12th Latin-American Symposium on Dependable and Secure Computing. p. 208–213. LADC ’23 (2023),https://doi.org/10.11...

    2023

  14. [22]

    In: The Yorkshire Innovation in Science and Engineering Conference (YISEC) 2024

    Proma, N.M., Hodge, V.J., Alexander, R.: Situation coverage based safety analysis of an autonomous aerial drone in a mine environment. In: The Yorkshire Innovation in Science and Engineering Conference (YISEC) 2024. York (2024)

    2024

  15. [23]

    ROS: Ros.org | powering the world’s robots.https://www.ros.org/ (2020)

    2020

  16. [24]

    In: Towards Autonomous Robotic Systems: 25th Annual Conference, TAROS 2024, London, UK, August 21–23, Proceedings

    Ryan, P., Badyal, A., et al.: Safety assurance challenges for autonomous drones in underground mining environments. In: Towards Autonomous Robotic Systems: 25th Annual Conference, TAROS 2024, London, UK, August 21–23, Proceedings. pp. 169–181. Springer (2025).https://doi.org/1...

    2025 doi

  17. [25]

    Ieee Access7, 48572–48634 (2019)

    Shakhatreh, H., Sawalmeh, A.H., et al.: Unmanned aerial vehicles (uavs): A survey on civil applications and key research challenges. Ieee Access7, 48572–48634 (2019)

    2019

  18. [26]

    International Electrotechnical Commission (2001)

    Standard, B., IEC61882, B.: Hazard and operability studies (hazop studies)- application guide. International Electrotechnical Commission (2001)

    2001

  19. [27]

    In: Procs Modelling and Simulation for Autonomous Systems: 8th International Conference, MESAS 2021, October 13–14, 2021

    Tahir, Z., Alexander, R.: Intersection focused situation coverage-based verification and validation framework for autonomous vehicles implemented in carla. In: Procs Modelling and Simulation for Autonomous Systems: 8th International Conference, MESAS 2021, October 13–14, 2021....

    2022

  20. [28]

    Tahir, Z.: Situation hyperspace — using a simulated world to ob- tain situation coverage for av safety assurance (2023), available at: https://assuringautonomy.medium.com/situation-hyperspace-using-a-simulated- world-to-obtain-situation-coverage-for-av-safety-assurance-39fa5ea...

    2023

  21. [29]

    In: Software Engineering for Self-Adaptive Systems II: International Seminar, Dagstuhl Castle, Germany, October 24-29, 2010

    Tamura, G., Villegas, N.M., Müller, H.A., et al.: Towards practical runtime veri- fication and validation of self-adaptive software systems. In: Software Engineering for Self-Adaptive Systems II: International Seminar, Dagstuhl Castle, Germany, October 24-29, 2010. pp. 108–132...

    2013

  22. [30]

    In: Proceedings of the 40th international confer- ence on software engineering

    Tian, Y., Pei, K., Jana, S., Ray, B.: Deeptest: Automated testing of deep-neural- network-driven autonomous cars. In: Proceedings of the 40th international confer- ence on software engineering. pp. 303–314 (2018)

    2018

  23. [31]

    In: 2015 IEEE 18th international con- ference on intelligent transportation systems

    Ulbrich, S., Menzel, T., et al.: Defining and substantiating the terms scene, situ- ation, and scenario for automated driving. In: 2015 IEEE 18th international con- ference on intelligent transportation systems. pp. 982–988. IEEE (2015)

    2015

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.