Risk Assessments for Evasive Emergency Maneuvers in Autonomous Vehicles
Pith reviewed 2026-05-07 14:52 UTC · model grok-4.3
The pith
An integrated HARA-STPA-FSM framework supplies traceable verification for evasive minimum risk maneuvers in autonomous vehicles.
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
Core claim
The authors introduce the first formally integrated pipeline that unifies HARA, STPA, and FSM modeling into a single traceable workflow for EMRM V&V. Hazard-loss mapping identifies hazards and unsafe control actions; the FSM layer captures hazard-to-loss state transitions that neither method models individually; and the unified framework drives automated scenario generation with measurable parameter-space coverage. Applied to a T-junction EMRM case study, the framework guides 1880 RRT-based simulations spanning ego speed, time-to-collision, and road friction, uncovering that the T-junction geometry gives nearly equal difficulty to stopping and to navigating so the intermediate mitigationmode
What carries the argument
The integrated HARA-STPA-FSM framework, which uses hazard-loss mapping to feed finite state machine models of hazard-to-loss transitions and thereby drives automated, coverage-measured scenario generation.
If this is right
- The framework produces 100 percent hazard, unsafe-control-action, and parameter-space coverage for EMRM verification.
- Steering-based EMRM strategies achieve an 81 percent collision-avoidance rate and halve mean residual impact speed relative to braking alone.
- T-junction geometry restricts the intermediate mitigation mode to only 1.9 percent of the feasible parameter space.
- Traditional single-method approaches reach at most 1 percent coverage on the same tasks.
Where Pith is reading between the lines
- The same workflow could be applied to other last-resort safety features such as emergency lane changes or minimum-risk stops on highways.
- Traceable coverage metrics might support regulatory safety cases by showing exactly which scenarios have been examined.
- Extending the FSM layer with probabilistic transitions could quantify remaining uncertainty after the deterministic coverage is complete.
Load-bearing premise
The finite state machine layer fully and accurately captures every hazard-to-loss state transition without missing interactions that the other two methods would overlook.
What would settle it
A real T-junction driving trace or simulation in which an EMRM hazard-to-loss path occurs that the FSM layer never registers.
Figures
read the original abstract
This paper presents a systematic verification and validation (V\&V) framework for the Evasive Minimum Risk Maneuver (EMRM) feature in autonomous vehicles, addressing a critical gap in existing safety assessment methods. We introduce the first formally integrated pipeline that unifies Hazard Analysis and Risk Assessment (HARA), System-Theoretic Process Analysis (STPA), and Finite State Machine (FSM) modeling into a single traceable workflow specifically designed for EMRM V\&V. HARA and STPA are combined through a structured hazard-loss mapping to identify hazards and unsafe control actions; an FSM layer captures hazard-to-loss state transitions that neither method models individually; and the unified framework drives automated scenario generation with measurable parameter-space coverage. Applied to a T-junction EMRM case study, the framework guides 1{,}880 RRT-based simulations spanning ego speed, time-to-collision (TTC), and road friction, uncovering a key physical result: the T-junction geometry gives nearly equal difficulty to stopping and to navigating, so the intermediate mitigation mode occupies only 1.9\% of the feasible parameter space. EMRM steering strategies achieve 81\% collision-avoidance rate and reduce mean residual impact speed from 18.9~km/h to 9.0~km/h compared with emergency braking alone, while the framework attains 100\% hazard, UCA, and parameter-space coverage versus $\leq$1\% for traditional methods. These results demonstrate that the integrated HARA-STPA-FSM framework enables high-resolution, traceable EMRM V\&V that is not achievable with any single method in isolation.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper claims to introduce the first integrated HARA-STPA-FSM pipeline for traceable V&V of Evasive Minimum Risk Maneuver (EMRM) features in autonomous vehicles. Applied to a T-junction case study, the framework drives 1,880 RRT-based simulations over ego speed, time-to-collision, and road friction ranges, yielding 100% hazard/UCA/parameter-space coverage (versus ≤1% for isolated methods), 81% collision avoidance with EMRM steering, reduction of mean residual impact speed from 18.9 km/h to 9.0 km/h, and only 1.9% occupancy of the intermediate mitigation mode due to T-junction geometry.
Significance. If the completeness and traceability claims hold, the work supplies a practical, unified workflow that combines established safety methods with explicit state-transition modeling and automated scenario generation. This could address gaps in current AV safety assessment practices by producing measurable coverage metrics and physical insights (e.g., equal difficulty of stopping versus navigating at T-junctions) that isolated HARA or STPA applications do not deliver. The simulation scale and quantitative performance deltas provide concrete evidence of potential utility for certification-oriented V&V.
major comments (3)
- [Abstract and §4] Abstract and §4 (Case Study results): The central claim that the integrated framework achieves 'high-resolution, traceable EMRM V&V that is not achievable with any single method in isolation' rests on the reported 100% coverage versus ≤1% for traditional methods and on the FSM supplying exactly the missing hazard-to-loss transitions. However, both the 100% figure and the superiority statement are computed inside the framework's own identified hazard set with no independent cross-check (real-world incident data, exhaustive enumeration outside the set, or alternative method) provided; this makes the quantitative superiority relative rather than absolute and directly undermines the necessity/sufficiency assertion.
- [§3] §3 (Framework description, FSM layer): The manuscript states that the FSM captures hazard-to-loss state transitions that neither HARA nor STPA models individually, yet supplies no explicit validation that the FSM transitions accurately reflect real vehicle dynamics, actuator limits, or unmodeled interactions. Without such validation or a completeness argument (e.g., proof that all relevant transitions are enumerated), the claim that the combined model is strictly more complete than its components remains unanchored.
- [§4] §4 (Simulation campaign): The 81% avoidance rate, 1.9% intermediate-mode occupancy, and 18.9-to-9.0 km/h speed reduction are presented without error bars, confidence intervals, or sensitivity analysis on the post-hoc parameter ranges (ego speed, TTC, friction). In addition, the justification for selecting exactly these ranges to guarantee the claimed parameter-space coverage is not supplied, weakening the reproducibility and robustness of the quantitative results that support the framework's superiority.
minor comments (2)
- [Abstract] Abstract: The phrase 'first formally integrated pipeline' would benefit from a brief literature comparison table or explicit citation of prior HARA+STPA combinations to substantiate novelty.
- [§3] Notation: Consistent use of 'UCA' (unsafe control action) versus 'hazard' should be clarified in the first use within the framework section to avoid reader confusion.
Simulated Author's Rebuttal
We thank the referee for the constructive comments, which highlight important aspects of traceability and robustness. We address each major point below, with revisions planned where the manuscript can be strengthened without altering its core contributions.
read point-by-point responses
-
Referee: [Abstract and §4] The central claim that the integrated framework achieves 'high-resolution, traceable EMRM V&V that is not achievable with any single method in isolation' rests on the reported 100% coverage versus ≤1% for traditional methods and on the FSM supplying exactly the missing hazard-to-loss transitions. However, both the 100% figure and the superiority statement are computed inside the framework's own identified hazard set with no independent cross-check (real-world incident data, exhaustive enumeration outside the set, or alternative method) provided; this makes the quantitative superiority relative rather than absolute and directly undermines the necessity/sufficiency assertion.
Authors: We agree that the 100% coverage metric is computed relative to the hazard and UCA set identified by the integrated HARA-STPA process for the T-junction case study. The ≤1% comparison is obtained by applying HARA and STPA separately to the identical scenario, demonstrating that isolated methods miss the majority of hazards due to the absence of structured hazard-loss mapping and FSM transitions. The FSM layer supplies the missing transitions by explicitly modeling state changes from hazard occurrence through unsafe control actions to potential losses. While this study does not include external cross-validation against real-world incident databases (which would require additional data sources beyond the simulation framework), the traceability of the pipeline is designed to support such future integration. We will revise the abstract and §4 to clarify the relative nature of the claims, add explicit wording on the comparison methodology, and include a new limitations paragraph discussing empirical validation opportunities. revision: partial
-
Referee: [§3] The manuscript states that the FSM captures hazard-to-loss state transitions that neither HARA nor STPA models individually, yet supplies no explicit validation that the FSM transitions accurately reflect real vehicle dynamics, actuator limits, or unmodeled interactions. Without such validation or a completeness argument (e.g., proof that all relevant transitions are enumerated), the claim that the combined model is strictly more complete than its components remains unanchored.
Authors: The FSM is constructed by mapping each identified hazard and unsafe control action from the HARA-STPA analysis onto state transitions using standard kinematic vehicle models (longitudinal/lateral dynamics with friction-dependent limits on steering rate and braking deceleration). These transitions are grounded in the control actions feasible within the ego vehicle's actuator constraints as defined in the system description. While we do not provide a formal mathematical proof of exhaustive enumeration, the transitions are derived exhaustively from the complete set of UCAs produced by STPA. We will expand §3 with a dedicated subsection detailing the FSM construction process, including the specific dynamic equations employed, actuator limit assumptions drawn from ISO 26262 and vehicle dynamics literature, and an argument for why the integration yields greater completeness than the components alone. revision: yes
-
Referee: [§4] The 81% avoidance rate, 1.9% intermediate-mode occupancy, and 18.9-to-9.0 km/h speed reduction are presented without error bars, confidence intervals, or sensitivity analysis on the post-hoc parameter ranges (ego speed, TTC, friction). In addition, the justification for selecting exactly these ranges to guarantee the claimed parameter-space coverage is not supplied, weakening the reproducibility and robustness of the quantitative results that support the framework's superiority.
Authors: The 1,880 simulations exhaustively enumerate the discretized parameter space (ego speed, TTC, friction) using RRT-based trajectory generation, rendering the per-parameter outcomes deterministic rather than stochastic; thus traditional error bars are not applicable, but we can report coverage completeness and sensitivity across the grid. The ranges (20–60 km/h, 1–4 s TTC, 0.3–0.8 friction) were selected to span representative urban T-junction conditions per traffic safety standards and prior AV studies. We will revise §4 to (i) explicitly justify and cite the parameter bounds, (ii) add a sensitivity analysis table showing how avoidance rate and residual speed vary with each parameter, and (iii) include a reproducibility note on the discretization and RRT settings. revision: yes
Circularity Check
Coverage superiority is defined relative to the framework's own hazard set
specific steps
-
self definitional
[Abstract]
"the framework attains 100% hazard, UCA, and parameter-space coverage versus ≤1% for traditional methods. These results demonstrate that the integrated HARA-STPA-FSM framework enables high-resolution, traceable EMRM V&V that is not achievable with any single method in isolation."
The hazard set and UCAs are identified via the HARA-STPA-FSM workflow; therefore the workflow attains 100% coverage of the hazards it itself enumerates. Traditional methods are then scored against this internally generated reference set, rendering the 100%-vs-≤1% comparison tautological rather than an independent test that the integration captures interactions missed by HARA or STPA alone.
full rationale
The paper's central claim—that the HARA-STPA-FSM integration produces high-resolution V&V unattainable by isolated methods—rests on the reported 100% coverage versus ≤1% for traditional methods. Because the hazard/UCA set is generated by the integrated pipeline itself, the framework necessarily covers 100% of its own outputs by construction, while single-method coverage is measured against that same set. This makes the quantitative superiority a definitional consequence rather than an externally validated demonstration of completeness. Simulation-derived metrics (avoidance rates, speed reductions) are independent, but they do not address the load-bearing completeness claim.
Axiom & Free-Parameter Ledger
free parameters (1)
- ego speed, time-to-collision, road friction ranges
axioms (2)
- domain assumption HARA and STPA can be combined via a structured hazard-loss mapping without loss of traceability
- domain assumption Finite state machines can capture all relevant hazard-to-loss transitions that HARA and STPA miss
Reference graph
Works this paper leans on
-
[1]
Regulatory trends for enhancement of road safety,
P. Nayak, V . Rawal, K. Patil, V . Tandon, and A. Badusha, “Regulatory trends for enhancement of road safety,” SAE Technical Paper, Tech. Rep., 2024
work page 2024
-
[2]
Safe agile hazard avoidance system for autonomous vehicles,
A. Arab and J. Yi, “Safe agile hazard avoidance system for autonomous vehicles,” Jan. 4 2024, uS Patent App. 18/209,943
work page 2024
-
[3]
Safe motion control and planning for autonomous racing vehicles,
A. Arab, “Safe motion control and planning for autonomous racing vehicles,” Ph.D. dissertation, Rutgers The State University of New Jersey, School of Graduate Studies, 2021
work page 2021
-
[4]
A survey on formal verification techniques for safety-critical systems-on-chip,
T. Grimm, D. Lettnin, and M. H ¨ubner, “A survey on formal verification techniques for safety-critical systems-on-chip,”Electronics, vol. 7, no. 6, p. 81, 2018
work page 2018
-
[5]
A survey of decision-making safety assessment methods for autonomous vehicles,
Z. Pang, Z. Chen, J. Lu, M. Zhang, X. Feng, Y . Chen, S. Yang, and Y . Cao, “A survey of decision-making safety assessment methods for autonomous vehicles,”IEEE Intelligent Transportation Systems Maga- zine, 2023
work page 2023
-
[6]
A hazard analysis approach based on stpa and finite state machine for autonomous vehi- cles,
X. Xing, T. Zhou, J. Chen, L. Xiong, and Z. Yu, “A hazard analysis approach based on stpa and finite state machine for autonomous vehi- cles,” in2021 IEEE Intelligent Vehicles Symposium (IV). IEEE, 2021, pp. 150–156
work page 2021
-
[7]
Motion planning and control of autonomous aggressive vehicle maneuvers,
A. Arab, K. Yu, J. Yu, and J. Yi, “Motion planning and control of autonomous aggressive vehicle maneuvers,”IEEE Transactions on Automation Science and Engineering, 2023
work page 2023
-
[8]
Instructed reinforcement learning control of safe autonomous j-turn vehicle maneuvers,
A. Arab and J. Yi, “Instructed reinforcement learning control of safe autonomous j-turn vehicle maneuvers,” inProc. IEEE/ASME Int. Conf. Adv. Intelli. Mechatronics. IEEE, 2021, pp. 1058–1063
work page 2021
-
[9]
Safe motion control of autonomous vehicle ski-stunt maneuvers,
F. Han and J. Yi, “Safe motion control of autonomous vehicle ski-stunt maneuvers,”IEEE/ASME Transactions on Mechatronics, 2023
work page 2023
-
[10]
Safety verification of autonomous vehicles for coordinated evasive maneuvers,
M. Althoff, D. Althoff, D. Wollherr, and M. Buss, “Safety verification of autonomous vehicles for coordinated evasive maneuvers,” in2010 IEEE Intelligent Vehicles Symposium. IEEE, 2010, pp. 1078–1083
work page 2010
-
[11]
Safety verification of automated driving systems,
R. Kianfar, P. Falcone, and J. Fredriksson, “Safety verification of automated driving systems,”IEEE Intelligent Transportation Systems Magazine, vol. 5, no. 4, pp. 73–86, 2013
work page 2013
-
[12]
Ensuring motion safety of autonomous vehicles through online fail-safe verification,
C. Pek and M. Althoff, “Ensuring motion safety of autonomous vehicles through online fail-safe verification,” inRobotics: Science and Systems– Pioneers Workshop, 2019
work page 2019
-
[13]
E. R. P. Lowe, “A framework for real-time autonomous road vehicle emergency obstacle avoidance maneuvers with validation protocol,” Ph.D. dissertation, 2022
work page 2022
-
[14]
D. Meltz and H. Guterman, “Functional safety verification for au- tonomous ugvs—methodology presentation and implementation on a full-scale system,”IEEE Transactions on Intelligent Vehicles, vol. 4, no. 3, pp. 472–485, 2019
work page 2019
-
[15]
Challenges in autonomous vehicle testing and validation,
P. Koopman and M. Wagner, “Challenges in autonomous vehicle testing and validation,”SAE International journal of transportation safety, vol. 4, no. 2016-01-0128, pp. 15–24, 2016
work page 2016
-
[16]
Verification and validation of intelligent vehicles: Objectives and efforts from china,
F.-Y . Wang, R. Song, R. Zhou, X. Wang, L. Chen, L. Li, L. Zeng, J. Zhou, S. Teng, and X. Zhu, “Verification and validation of intelligent vehicles: Objectives and efforts from china,”IEEE Transactions on Intelligent Vehicles, vol. 7, no. 2, pp. 164–169, 2022
work page 2022
-
[17]
J. Sun, H. Zhang, H. Zhou, R. Yu, and Y . Tian, “Scenario-based test automation for highly automated vehicles: A review and paving the way for systematic safety assurance,”IEEE transactions on intelligent transportation systems, vol. 23, no. 9, pp. 14 088–14 103, 2021
work page 2021
-
[18]
K. Weibull, B. Lidestam, and E. Prytz, “Potential of cooperative intel- ligent transport system services to mitigate risk factors associated with emergency vehicle accidents,”Transportation research record, vol. 2677, no. 3, pp. 999–1015, 2023
work page 2023
-
[19]
How safe is safe enough for self-driving vehicles?
P. Liu, R. Yang, and Z. Xu, “How safe is safe enough for self-driving vehicles?”Risk analysis, vol. 39, no. 2, pp. 315–325, 2019
work page 2019
-
[20]
Modeling and hazard analysis using stpa,
T. Ishimatsu, N. G. Leveson, J. Thomas, M. Katahira, Y . Miyamoto, and H. Nakao, “Modeling and hazard analysis using stpa,” 2010
work page 2010
-
[21]
Finite- state machine method in the safety assessment process using stateflow diagrams,
A. Savelev, E. Eroshchenkov, E. Neretin, and D. Shevela, “Finite- state machine method in the safety assessment process using stateflow diagrams,” inJournal of Physics: Conference Series, vol. 1958, no. 1. IOP Publishing, 2021, p. 012034
work page 1958
-
[22]
Model-based application of iso 26262: the hazard analysis and risk assessment,
M. Suerken and T. Peikenkamp, “Model-based application of iso 26262: the hazard analysis and risk assessment,”SAE International journal of passenger cars-electronic and electrical systems, vol. 6, no. 2013-01- 0184, pp. 114–125, 2013
work page 2013
-
[23]
ISO 26262-1:2018, road vehicles functional safety,
“ISO 26262-1:2018, road vehicles functional safety,” https://www.iso. org/standard/68383.html, accessed: December 2023
work page 2018
-
[24]
ANSI/UL 4600-3:2023, evaluation of autonomous products,
“ANSI/UL 4600-3:2023, evaluation of autonomous products,” https: //www.shopulstandards.com/ProductDetail.aspx?productid=UL4600, ac- cessed: March 2023
work page 2023
-
[25]
High-resolution safety verification for evasive obstacle avoidance in autonomous vehicles,
A. Arab, M. Khaleghi, A. Partovi, A. Abbaspour, C. Shinde, Y . Mousavi, V . Azimi, and A. Karimmoddini, “High-resolution safety verification for evasive obstacle avoidance in autonomous vehicles,”IEEE Open Journal of Vehicular Technology, 2024
work page 2024
-
[26]
Low-latency automotive vision with event cameras,
D. Gehrig and D. Scaramuzza, “Low-latency automotive vision with event cameras,”Nature, vol. 629, p. 1034–1040, 2024
work page 2024
-
[27]
J. P. Thomas, “Extending and automating a systems-theoretic hazard 14 analysis for requirements generation and analysis,” Ph.D. dissertation, Massachusetts Institute of Technology, 2013
work page 2013
-
[28]
Minimal injury risk motion planning using active mitigation and sampling model predictive control,
L. A. S. Guardini, A. Spalanzani, P. Martinet, C. Laugier, T. Genevois, and A.-L. Do, “Minimal injury risk motion planning using active mitigation and sampling model predictive control,” in2022 IEEE 25th International Conference on Intelligent Transportation Systems (ITSC). IEEE, 2022, pp. 1262–1267
work page 2022
-
[29]
Crash mitigation in motion planning for autonomous vehicles,
H. Wang, Y . Huang, A. Khajepour, Y . Zhang, Y . Rasekhipour, and D. Cao, “Crash mitigation in motion planning for autonomous vehicles,” IEEE transactions on intelligent transportation systems, vol. 20, no. 9, pp. 3313–3323, 2019
work page 2019
-
[30]
A data-driven method towards minimizing collision severity for highly automated vehicles,
M. Parseh, F. Asplund, L. Svensson, W. Sinz, E. Tomasch, and M. T ¨orn- gren, “A data-driven method towards minimizing collision severity for highly automated vehicles,”IEEE Transactions on Intelligent Vehicles, vol. 6, no. 4, pp. 723–735, 2021
work page 2021
-
[31]
M. Parseh, M. Nybacka, and F. Asplund, “Motion planning for au- tonomous vehicles with the inclusion of post-impact motions for min- imising collision risk,”Vehicle system dynamics, vol. 61, no. 6, pp. 1707– 1733, 2023
work page 2023
-
[32]
T. Gong, X. Yu, Q. Zhang, Z. Feng, S. Yang, Y . Cao, J. Xu, X. Feng, Z. Pang, Y . Wang,et al., “An emergency operation strategy and motion planning method for autonomous vehicle in emergency scenarios,” Accident Analysis & Prevention, vol. 210, p. 107842, 2025
work page 2025
-
[33]
Incorporating accident risk evolution processes into vehicle motion control for defensive driving,
W. Guo, H. Cao, X. Song, J. Wang, and J. Li, “Incorporating accident risk evolution processes into vehicle motion control for defensive driving,”Control Engineering Practice, vol. 167, p. 106657, 2026
work page 2026
-
[34]
Collision dynamics model and self-learning control for 4wis vehicles,
S. Chen, Z. Li, C. Gao, H. Zhang, Z. Zhu, J. Wu, and Z. Jia, “Collision dynamics model and self-learning control for 4wis vehicles,”IEEE Transactions on Vehicular Technology, 2025
work page 2025
discussion (0)
Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.