3 ECS Key Application Areas

Europe has the vision of fatality free mobility for all citizens. This is important to provide seamless mobility for an aging society. The European transportation industry has therefore to strengthen their leading position to provide sustainable solutions for safe and green mobility across all transportation domains – automotive, avionics, aerospace, maritime (over water as well as under water transport) and rail. Their competitive asset is a well-established expertise based on developing complex electronic components, cyber-physical systems and embedded intelligence. Nevertheless, a number of challenges in terms of autonomy, complexity, safety, availability, controllability, economy and comfort have to be addressed to harvest the opportunities coming from increasingly levels of automation and related capabilities.

The overall vision is to realise safe and secure, always connected, cooperative and automated transportation systems based on highly reliable and affordable electronic components and systems of European origin, as well as on technologies that offer new types of interaction between humans and machines.

One of the key motivators is to reduce the number of road fatalities and accidents caused by human error to zero by 2050, as well as in ensuring that no additional road fatalities are introduced through automated transport while bringing validation costs down to 50% of development costs from the current 70–80%. Key Digital Technologies will be developed to support the CCAM public/private partnerships (PPPs) in these ambitious goals. No single organisation will be able to capture these tremendous efforts in research and development. For Europe to maintain a leading position, it is therefore necessary to establish collaborations in and across industrial domains, learn from operational field data, and jointly drive the required strategic actions.

Also, in the waterborne transport sector ships will become fully connected across the globe. Remote monitoring of vessels is already possible, allowing for condition-based maintenance. Building on increasing onboard automation, the remote operation of vessels will become possible, eventually moving towards full autonomy for vessels. The wider use of unmanned autonomous vessels (UAVs) – either aerial, underwater or on the surface – will increase the flexibility and energy efficiency of operations.

Connected, cooperative and ultimately automated mobility and transportation is seen as one of the key technologies and major technological advancements influencing our future quality of life. ESBS will enable different levels of partial, conditional, highly and fully automated transportation, posing new challenges for traffic safety and security in mixed scenarios where vehicles with different automation levels coexist with non-automated vehicles. Both development approaches – evolutionary (the stepwise increase of automation level: “conversion design”) and revolutionary (Society of Automotive Engineers, SAE, level 5: “purpose design”, e.g. a people mover in a structured environment) – should be covered, as well as cross-fertilisation with other industrial domains such as Industry 4.0. Cross-fertilization between automotive and 5G evolution and 6G is important to ensure a reliable and resilient communication needed in next generation mobility as described before.

As the proportion of electronics and software, considered as a percentage of the total construction cost of a vehicle increases, so does the demand for the safe, secure, reliable and unhackable operation of these systems. In addition, privacy protection is a key element for car owners and drivers/operators. These requirements demand fail-operational technologies that deliver intrinsically safe operation and dependable fall-back position from component to subsystem, and provides a solution for problems in interaction with the cloud. This requires new developments in terms of multi-core-based platforms and sensing devices, combining advanced sensing in harsh conditions, novel micro- and nano-electronics sensors, advanced sensor fusion and innovative in-vehicle network technologies.

Key elements of ESBS for cars that need to be developed are shown in Figure F.47.

The following research, development and innovations areas and their subtopics have been identified:

• Dependable and affordable environment perception and localisation sensors, and V2X communication. Attention should be paid to sensor interference, more in particular the robustness of sensors to environmental conditions, to interference by other sensors and to malicious interference.
• Integrated sensing and communication systems to further evolve towards fully automated transport and safeguarding VRU’s (Vulnerable Road Users) in all type of traffic situations.
• Centralised service/function-oriented hardware/software architectures, including open APIs, for vehicles, ships, trains that are supported by the cloud and edge computing via 5/6G.
• Dependable and reconfigurable hardware and software, including remote access and Over-The-Air (OTA) software upgrades.
• Hardware and software platforms for control and higher performance in-vehicle networking (up to 25Gbit/s) units for automated mobility and transportation (including support for AI) – e.g. IoT integration platforms for automated and connected environmentally friendly vehicles.
• New developments towards higher performance and efficiency. These are also required to ensure the reliability and safety of the power electronic components and systems for the drivetrain and charging systems, as well as for steering, break/suspension/air condition control in automobiles, trains, ships and flying equipment.
• Trustworthiness of vehicles’ data.
• Interaction between humans and vehicles.
• Active safety systems.
• Vehicle hardware/software to improve comfort in parallel with safety.
• (Predictive) health monitoring and lifetime analysis for the perception and control systems (including all required sensors, V2X systems and localisation systems) and AI components of (highly) automated vehicles used in the operational phase.
• Connected maritime systems and automated transport.
• Smart and autonomous ships.

These requirements result in completely new hardware and software architectures for the control systems due to exploding sensor data volumes as well as new power saving hardware and software components. This requires a new decoupling from hardware with drivers and operating system, from the application components adaptive AI based routing and control algorithms, multimedia components and many more. For these motivations, Major Challenge 3 was introduced to create a common middle ware architecture and implementation.

Today’s mainly hardware-defined cars are rapidly transforming into software-defined transportation platforms. Currently, OEMs and their suppliers are developing automotive software modules in isolation ending up in a complex software architecture which does not scale at all. The following figure (McKinsey and Company) illustrates the state-of-the-art how proprietary platforms are built at present. Even though integration among different domains and vehicle systems is essential to unlock new use cases, companies are currently missing an end-to-end platform to easily connect everything together.

Currently automotive software developers working on different software stacks across a vehicle do not coordinate their activities on a regular basis. Furthermore, it is difficult to align software updates and patches across modules. Because of the rapid transformation to software-defined vehicles (driven by new vehicle functions, features, properties), the automotive industry is facing a widening and unsustainable gap between software complexity and productivity (see Figure F.49 below). To succeed in this dynamically changing environment and to be globally competitive, companies need to minimize (or at least limit) the complexity by reducing the effort required to develop and maintain software. Consequently, the current software operating model needs to be revisited in terms of:

• Architecture, design, requirements.
• Development methodologies (e.g., agile-at-scale, or fundamental changes in development and software testing).
• Software performance management, toolchain infrastructure.
• Where software is developed within the organization, including locations, and partnerships involved.

Ultimately, an end-to-end software platform, consisting of a an operating system and a middleware layer with standardized interfaces abstracting the hardware layer for the application and function software layer is strongly needed to be able to manage the rising software complexity and to develop future vehicles in an effective and efficient manner. Software should be truly integrated end-to-end, software modules should be developed on a common code base, and a primary robust operating system should be able to cover all major systems throughout the vehicle.

• Development of a scalable, cloud-capable, and modular target architecture that supports decoupling of hardware and software and features a strong middleware layer (see illustrative example below). The target platform (middleware) to be developed needs to support current and future operating systems (proprietary, open-source) and also different E/E architectures (domain-oriented, zone-oriented, etc.).

• Development of a neutral SDK (cf. the smartphone world before and after the iPhone of 2007) which allows any software application developer to develop and test independently of hardware and operating system.
• Abstraction of the complexity of underlying hardware, middleware, kernel, interfaces, and drivers into simple to use and to re-use, robust, safe&secure APIs.
• Support of safety and security according to automotive standards (safety-criticality is the main difference to the smartphone and consumer electronics market).
• New software development methodologies (e.g., agile-at-scale).
• Eventually, the targeted software platform should basically fulfil and feature:
  • ROS1 and ROS2 compatibility.
  • Hardware SOC abstraction, runs on x86 and ARM.
  • freedom of choice of SOC.
  • Middleware abstraction, simplifies the use of complex middleware interfaces.
  • Hard real-time execution and real-time logging of data.
  • Fully deterministic software execution.
  • System safety enabled through managed nodes with lifecycle management.
  • System security through process-level security, encryption, authentication.
  • Support for automotive hardware, i.e., ECUs and automotive sensors.
  • Functional safety certification (ISO 26262, SEooC, up to ASIL D).
  • Appropriate testing methods, e.g., condition coverage or integration tests.
  • Development environment, tools, toolchains.
  • Complete and integrated solution for both intra- and inter-ECU communication.
  • Integration of common frameworks such as AUTOSAR, Apex.OS and others.
  • Simple to integrate into custom frameworks.
  • Support for today's most relevant protocols for automotive ethernet.
  • Capable to handle large amounts of data efficiently.
  • High-performance communication with low runtime consumption.
  • Ensuring compatibility to SIMPL150 (cloud-to-edge federations and data spaces made simple). SIMPL is the smart middleware that will enable cloud-to-edge federations and support all major data initiatives funded by the European Commission, such as common European data spaces.

To achieve the EU-wide goal of zero fatalities by 2050, active safety systems and automated vehicles are necessary (the term “vehicle” here covers mobility systems on land, water and in the air: cars, trains, ships and airplanes). Although several technology demonstrators for highly automated vehicles already exist, there is a severe lack of cost-effective, commonly accepted verification & validation (V&V) methods and tools. Winner et al151 predict that more than 400 million km of road driving would be required to statistically prove that an automated vehicle is as safe as a manually driven one, implying that a proven- in-use certification by performing physical tests on the road is no longer feasible. This lack of effectively applicable V&V methods has created a major barrier for the market introduction of these systems. The development and use of Digital Twins is becoming a cornerstone for future development and updates of this type of complex automated systems, interacting with the cloud. Meanwhile many experts in Europe as well as in many other countries of the world work together under the guidance of UN/ECE to create standards for the approval of ADAS and AD functions in mobility. The draft of the Regulation (EU) 2019/2144 for ADAS function is approved and contains definitions for the expected functionality of many ADAS functions as well as first indications how to prove them. The associated ADAS and AD functions are Lane Departure Warning System, Advanced Emergency Braking on Heavy Duty Vehicles, Speed Limitation Devices, Reversing Detection, Pedestrian and Cyclist Collision Warning, Blind Spot Information System, Emergency Lane Keeping System, Advanced Emergency Braking on Light Duty Vehicles, Protection of Vehicles against Cyber Attack, Intelligent Speed Assistance, Emergency Stop Signal, Alcohol Interlock Installation Facilitation, Driver Drowsiness and Attention Warning, Driver Availability Monitoring System, Event Data Recorder, Systems to replace driver's control; Systems to provide the vehicle with information on state of vehicle surrounding area and Platooning.

The main challenge is the tight interaction of these safety-critical automated systems with their environment. These interactions get more complex the higher the automation level gets. This means that not only does the correct functioning of the automated cyber-physical mobility system itself need be tested, but also its correct reaction to the behaviour and specifics of its surroundings. This leads to a huge number of potential scenarios that every automated mobility solution will have to handle in a safe way. It is important to take into account not only the commonly occurring scenarios encountered by the mobility systems as vehicles, trucks, airplanes, ships et al, but also the occurrence of safety critical events during these scenarios. Many of these safety critical events fortunately do occur only seldom, but that makes it even more difficult to test the correct reactions of the automation systems in these situations.

Many highly automated cyber-physical systems have adopted machine learning (ML) and AI to enable autonomous decision-making and render applications smart. While the use of ML and AI components offers great promise for improving our everyday lives in many, sometimes unimaginable, ways, it also brings a host of very difficult verification, validation and certification challenges in the context of safety- critical applications. The opacity of ML/AI components requires the development of completely new V&V techniques, and to accordingly extend existing V&V methodologies. It is important to not only secure stable solutions based on ML, but also how to exploit increased learning based on new data, and to update existing vehicles with updated algorithms using the additional learning from new data, while guaranteeing no side-effects.

Modern highly automated cyber-physical systems increasingly dynamically evolve after their deployment, and OTA updates and upgrades are becoming necessary in such systems. New methods and tools for these updates and upgrades, together with the respective re-verification and re-certification approaches, are necessary to avoid negative impacts on both safety and security.

Automation functions of vehicles rely on environment sensors, such as cameras, lidar, radar and ultrasonic sensors, as well as communication to other vehicles or infrastructures. As these safety- relevant components may degrade over time or be exposed to cyber-threats, accelerated reliability and cybersecurity test methods are required. This will need further diagnostic devices to check the reliability of hardware, sensors and their software.

The role of the driver and any additional passengers in an automated vehicle is completely changing, and therefore new test methods and tools are necessary to ensure comfort and perceived safety (societal acceptance). These are already in the early development phases in terms of new functionality and their safety.

Many of the above issues are mentioned in existing or upcoming automotive standards for cyber-physical systems – for example, Safety of Intended Functionality (SOTIF), ISO 26262 and UL4600 (see ). As none of these standards are mature enough to certify fully automated vehicles with reasonable effort, close cooperation between the standardisation committees and the research consortia will be necessary.

The expected outcome is twofold:

• Digital innovation to increase road safety as specified in the CCAM programme: reduce the number of road fatalities and accidents caused by human errors to zero by 2050, as well as ensuring that no additional road fatalities are introduced by automated transport.
• Reduce validation costs down from the current two-to-five times of the implementation of automation functions in mobility by 60–80%.

To ensure the safety, security and comfort of automated mobility systems consisting of embedded AI-based software, sensors and actuators, as well as processing platforms in vehicles, ships, trains, airplanes and off- road vehicles, several verification, validation and certification toolchains are necessary. These should ensure the safety, reliability, security and comfort for passengers and the surrounding traffic participants based on costs that do not exceed those of the design and implementation of the following functions:

• Verification of components of automated mobility systems as environment sensors/ communication systems, perception systems, environment awareness, route planning and actuator systems, diagnostics devices and black-box monitoring systems. A special case here is the use of consumer-grade components in vehicle automation. Test concepts and tools have to be developed on several levels:
  • Perception system tests focusing on an adequate functionality of sensors and the fusion of several sensor inputs.
  • Manouver planning route decision and track control systems testing.
  • Complete automated vehicle, airplane ship et al in the defined operating environments (ODDs).
  • Correct and secure communication with other traffic participants and/or traffic operators.
  • Validation of complete automated vehicles to perform safely and securely, and to provide comfort for passengers as well as other traffic participants in the specified operation design domain (geolocation area, weather conditions, road/sea/air conditions, etc.).
• Validation of the reliability of all components as well as their interaction as a complete automated cyber-physical system in the specified operation period.
• Validation of the safety, security, reliability and comfort for the deployment of OTA update packages for automated on-road or off-road vehicles, trains, ships and airplanes.
• Verification of the completeness and reliability of training datasets for machine-learning and AI algorithms used in automated cyber-physical systems.
• Validation of the accuracy of simulation models in the specified operational design domain (ODD) used in virtual validation toolchains.
• Development of Digital Twins (for example for vehicles, trucks, drones, ships, airplanes, sensors, pedestrians, environment etc.) for validation of new concepts, verification of car2cloud interactions and preparation of updates of automated vehicles.

Validation toolchains, their components and underlying methods should lead to safe, reliable and secure argumentation describing why the performed tests resulted in the estimated residual risk for automated cyber-physical systems for on-road or off-road vehicles, ships, trains and airplanes. Optimisation methods can be used to balance multiple design objectives – e.g. that the residual risk remains below a certain limit (such as that stipulated by regulatory bodies) while meeting financial design targets. The verification, validation and certification tools and methods may be used for cyber-physical systems with different levels of automation.

A special focus is on the verification, validation and certification of embedded AI-based systems, and the required training data for the respective machine-learning algorithms. Ecosystems for the creation and maintenance of reliable labelled data are envisioned. To integrate with different legacy systems, eco-systems supporting open platforms are required.

Virtual validation, or more concretely scenario-based virtual validation, is considered a cornerstone for the verification, validation and certification of vehicles. Two aspects are essential here: (i) scenarios representing the most relevant situations; and (ii) reliable simulation models.

Scenarios may be derived from requirements of safety analyses, extracted from naturalistic driving or synthetically created using gaming theory-based methods with a defined relevance. Statistical safety evidence from scenario-based verification and validation derived from naturalistic driving is needed. Also, here the establishment for open platforms and ecosystems for the creation and maintenance of reliable scenarios is encouraged. The definition of performance (safety, security, reliability and comfort) indicators for different automation functions and SAE levels (in the case of road vehicles) is necessary. Again, eco systems to share these data are useful.

Reliable simulation models for environmental sensors, vehicles, drivers and traffic participants, as well as traffic, are vital. The development of these models, and the corresponding test systems, are essential. To test safety-critical scenarios using real vehicles in a safe environment requires the creation of stimulators for the different environmental sensors under different weather, traffic and road conditions. The verification, validation and certification of vehicles will be carried out with a combination of virtual test environments using model-in-the-loop (MIL) and software-in-the-loop (SIL) in the cloud with massive parallel processing in order to allow for testing of very high numbers of scenarios in combination with different critical events and varying ODD conditions as sun, rain, fog, snow etc., mixed virtual/real environments (vehicle-in-the-loop, VIL, and hardware-in-the-loop, HIL), as well as a proving ground for real-world public road testing. Road testing will result in amounts of data larger than 20TB per hour per vehicle, and therefore adequate data acquisition, management and (cloud or on-premise) evaluation systems capable of handling the specific data types of the sensors are critical (although these do not exist yet). Additionally, OTA data collection from in-use operations is required to continuously collect unknown scenarios that can be fed back into development to improve the quality of the systems.

Additional challenges covering this topic can also be found in Chapter 2.3 (Architecture and Design: Methods and Tools) and Chapter 2.4 (Quality, Reliability, Safety and Cybersecurity) of this SRIA.

To help provide better health and quality of life for their citizens, European municipalities will continue to ban cars with conventional powertrains from city centres, and promote more equal urban land use. At the same time, the demand for individual accessibility, flexible transit and fast delivery is on the increase. Therefore, multimodality is a cornerstone of the EU’s strategy on transport. This combines collective and individual solutions, ranging from micro-mobility such as e-scooters via car-sharing and ride-pooling fight up to long-haul transport systems through common hubs, platforms and systems for booking, customer services and payment. In the future, Europe will also aim to offer more sustainable and systemic transport solutions besides road transport, such as high-speed rail or electric aircraft. Concurrently, limited peak capacities, missing last-mile connections and self-contained mobility-as-a- service systems will remain somewhat of a bottleneck when it comes to shortening travelling times, keeping supply chains clocked, and reducing single occupancy trips, with the accompanying reductions in congestion, environmental concerns and cost of travel. Therefore, sharing services are the key element to maximising the flexibility of public transport systems, and new technologies such as taxi and delivery drones or guided transport (hyperloop) solutions can be expected to fill the gaps in the time, cost and green environment map.

Recent events such as the Covid-19 pandemic but also natural disasters have put some elements of this quite systemic future vision in question. Public transport, as the cornerstone of a multimodal mobility system, is particularly affected as the desire for readily available, trustworthily hygienic and health-protecting ways of getting from A to B became paramount. And, highly connected and infrastructure-based mobility solutions show limited resilience against flooding and wildfires. It will remain a challenge for mobility service providers to develop and deploy novel solutions, such as self-sanitising and protective mobility shells (physical or virtual), for a vulnerable society that combine the flexibility of a multimodal system with the required infection safety and provide a CO₂ and emission neutral mobility at the same time. The same applies to make autarkic heavy vehicles and machinery for rescue and clean-up operations zero-emission. In another sense, multimodal mobility could also mean putting services and deliveries on wheels, which so far would have required people to travel to places where they risk being exposed to the virus. And, having robotic functionality, ad-hoc networking capabilities and a battery as mobile electricity source on a tractor might provide just the right level of resilience that will be needed future emergencies, and make full use of the opportunities of automation, connectivity and electrification in a new way.

As pointed out by the EU-funded Coordination and Support Action “Action Plan for the Future of Mobility in Europe”152, the vision of a truly integrated and seamless transport system for people and freight must be developed and implemented, and the full potential of transformative technologies has to be exploited. This can only be achieved if user-centredness, cross-modality and technology transfer become the focus of efforts for all stakeholders in transport.

• Design a low/zero emission, safe and accessible transport system tailored to user needs by exploring user needs and expectations, defining user profiles and mobility patterns, and identifying technology options.
• Enable mobility everywhere for everyone through the technological development of, for example, sensors, AI, machine learning, predictive maintenance, safe and secure vehicle software and electronics.
• Enhance efficiency and capacity in rail projects for automated maintenance and transfer of goods between modes.
• Create intelligent decision-support systems for passengers and transport operators that enable smart travel demand management.
• Achieve real-time data handling for multimodal mobility and related services.
• Develop convenient sharing concepts through automated maintenance of vehicles, and define approaches for implementation.
• Develop a framework for cybersecurity in passenger and goods transport across all modes, and provide IT connectivity that allows plug and play data sharing.
• Increase data security and privacy in authentication and payment processes for mobility services (through the concepts of trustee roles, blockchain, etc.), and support the respective initiatives.
• Employ robots, drones and shared public transport services for logistics.
• Infection-risk detection, self-sanitising and protective functions for public transport use.
• Multimodal navigation systems providing travellers with efficient, safe and healthy transfer options.
• Development of modular mobility platforms for the on-site provision of services and goods delivery.
• Integrate cross-modal hubs and interfaces into the urban structure, and connect them by harmonised infrastructure to smart sustainable corridors.
• Provide open application programming interfaces (APIs) and user data and statistics for all modes and providers, enabling demand-oriented and demand-responsive cross-modal transport offers.
• Ensure accessibility of shared services, and incentivise shared fleets of personal mobility devices at hubs to facilitate mode change for those with disabilities and reduced mobility.
• Hygienic and individualized mobility shells for demand-responsive transportation means.
• Make vehicles and transportation systems more resilient by smart application of automation, connectivity and electrification .