PDF Validation and Verification of Automated Systems Results of The Enable S3 Project Andrea Leitner Ebook Full Chapter

Validation and Verification of
Automated Systems: Results of the

ENABLE-S3 Project Andrea Leitner
Visit to download the full and correct content document:
https://textbookfull.com/product/validation-and-verification-of-automated-systems-resu
lts-of-the-enable-s3-project-andrea-leitner/
More products digital (pdf, epub, mobi) instant
download maybe you interests ...
The Digital Factory for Knowledge Production and

Validation of Scientific Results 1st Edition Renaud
Fabre
https://textbookfull.com/product/the-digital-factory-for-
knowledge-production-and-validation-of-scientific-results-1st-
edition-renaud-fabre/
Leveraging Applications of Formal Methods Verification

and Validation Verification 8th International Symposium
ISoLA 2018 Limassol Cyprus November 5 9 2018
Proceedings Part II Tiziana Margaria
https://textbookfull.com/product/leveraging-applications-of-
formal-methods-verification-and-validation-verification-8th-
international-symposium-isola-2018-limassol-cyprus-
november-5-9-2018-proceedings-part-ii-tiziana-margaria/

and Validation Distributed Systems 8th International
Symposium ISoLA 2018 Limassol Cyprus November 5 9 2018
Proceedings Part III Tiziana Margaria
formal-methods-verification-and-validation-distributed-
systems-8th-international-symposium-isola-2018-limassol-cyprus-
november-5-9-2018-proceedings-part-iii-tiziana-margaria/
Automated Reasoning for Systems Biology and Medicine

Pietro Liò
https://textbookfull.com/product/automated-reasoning-for-systems-
biology-and-medicine-pietro-lio/
and Validation Industrial Practice 8th International
Symposium ISoLA 2018 Limassol Cyprus November 5 9 2018
Proceedings Part IV Tiziana Margaria
formal-methods-verification-and-validation-industrial-
practice-8th-international-symposium-isola-2018-limassol-cyprus-
november-5-9-2018-proceedings-part-iv-tiziana-margaria/
Dynamics of the Unicycle: Modelling and Experimental

Verification Micha■ Nie■aczny
https://textbookfull.com/product/dynamics-of-the-unicycle-
modelling-and-experimental-verification-michal-nielaczny/
Automated Hierarchical Synthesis of Radio Frequency

Integrated Circuits and Systems A Systematic and
Multilevel Approach Fábio Passos
https://textbookfull.com/product/automated-hierarchical-
synthesis-of-radio-frequency-integrated-circuits-and-systems-a-
systematic-and-multilevel-approach-fabio-passos/
Modelling and Verification of Secure Exams Rosario

Giustolisi
https://textbookfull.com/product/modelling-and-verification-of-
secure-exams-rosario-giustolisi/
Pharmaceutical and Medical Devices Manufacturing

Computer Systems Validation 1st Edition Orlando López
https://textbookfull.com/product/pharmaceutical-and-medical-
devices-manufacturing-computer-systems-validation-1st-edition-
orlando-lopez/
Andrea Leitner · Daniel Watzenig
Javier Ibanez-Guzman Editors
Validation and
Verification
of Automated
Systems
Results of the ENABLE-S3 Project
Validation and Verification of Automated Systems
Andrea Leitner • Daniel Watzenig •
Javier Ibanez-Guzman
Editors
Validation and Verification

of Automated Systems
Results of the ENABLE-S3 Project
123
Editors
Andrea Leitner Daniel Watzenig
AVL LIST GMBH Virtual Vehicle Research Center
Graz, Steiermark, Austria Graz University of Technology
Graz, Steiermark, Austria
API : TCR RUC 0 52
Renault S.A.
Guyancourt, France
ISBN 978-3-030-14627-6 ISBN 978-3-030-14628-3 (eBook)

https://doi.org/10.1007/978-3-030-14628-3
© Springer Nature Switzerland AG 2020

This work is subject to copyright. All rights are reserved by the Publisher, whether the whole or part of
the material is concerned, specifically the rights of translation, reprinting, reuse of illustrations, recitation,
broadcasting, reproduction on microfilms or in any other physical way, and transmission or information
storage and retrieval, electronic adaptation, computer software, or by similar or dissimilar methodology
now known or hereafter developed.
The use of general descriptive names, registered names, trademarks, service marks, etc. in this publication
does not imply, even in the absence of a specific statement, that such names are exempt from the relevant
protective laws and regulations and therefore free for general use.
The publisher, the authors, and the editors are safe to assume that the advice and information in this book
are believed to be true and accurate at the date of publication. Neither the publisher nor the authors or
the editors give a warranty, express or implied, with respect to the material contained herein or for any
errors or omissions that may have been made. The publisher remains neutral with regard to jurisdictional
claims in published maps and institutional affiliations.
This Springer imprint is published by the registered company Springer Nature Switzerland AG.
The registered company address is: Gewerbestrasse 11, 6330 Cham, Switzerland
Preface
ENABLE-S3 has been built as pan-European project that brings together both value
chains and ecosystems from six different domains in the field of validation and
testing of automated cyber-physical systems. The consortium, consisting of 68 part-
ners from 16 European countries, led to a unique network of experts working on the
verification and validation of automated cyber-physical systems (ACPS). ENABLE-
S3 has emerged as a European cornerstone project that contributes significantly to
the advancement of the state of the art in terms of new methods, tools, and validation
processes covering “Design-for-Safety,” “Design-for-Reliability,” and “Design-for-
Security” to impact end-user acceptance. The technology resulting from this work
strongly supports the market introduction of automated systems by:
• Enabling safe, secure, and functional systems across six application domains
(automotive, aerospace, rail, maritime, farming, and health care)
• Establishing a modular comprehensive test and validation framework for
scenario-based testing
• Driving open standards for higher interoperability.
The diversity and the major challenges to validation and testing that remain to
be resolved to advance automation closer to reality have motivated the edition of
this book. All the contributions have been carefully selected to cover validation
and testing aspects of the three building blocks of automation—sense, reason, and
act—from an academic and industrial perspective. As an industry-driven project,
there is also a section highlighting the achievements by the industrial use cases. All
the contributions review the current state of practice and state of the art in their
respective domains. The articles envision exciting results of ENABLE-S3, future
trends, along with the specific challenges in the validation and testing of automated
cyber-physical systems, sensors (i.e. radar, LiDAR, and camera), the concepts for
improved availability, as well as quality assurance and reproducible test setups for
automation.
ENABLE-S3 can be considered as one of the first industry-driven initiatives to
make autonomy safe, reliable, and acceptable by society. However, we need several
more collaborative projects to progress beyond where ENABLE-S3 left off.
v
vi Preface
We strongly believe that this book on validation and testing of automated cyber-
physical systems greatly summarizes the key achievements of this remarkable
project. ENABLE-S3 provides an overview of current and emerging technical
challenges in the validation of highly automated cyber-physical systems. It provides
in-depth insights into industrial demands. We hope that the reader will be inspired
by the different technical contributions, selected project results, and major outcomes
from the cooperation work across the consortium over the past 3 years.
It is a pleasure to introduce you to the fascinating world of validation of ACPS;
the various contributions should create awareness of the complexities and solutions
available in this domain.
Finally, we would like to express our sincere appreciation and gratitude to all
authors and coauthors, who made the publication of this book possible. We are
grateful to Silvia Schilgerius at Springer for her professionalism and support during
the preparation of this book.
Enjoy your reading.
Graz, Austria Andrea Leitner

Guyancourt, France Javier Ibanez-Guzman
Graz, Austria Daniel Watzenig
Acknowledgement
This work has received funding from the Ecsel Joint Undertaking Under Grant
Agreement No 692455. This joint undertaking receives support from the European
Union’s Horizon 2020 Research and Innovation Programme and Austria, Denmark,
Germany, Finland, Czech Republic, Italy, Spain, Portugal, Poland, Ireland, Belgium,
France, Netherlands, United Kingdom, Slovakia, and Norway.
vii
Contents
Part I Introduction and Motivation

Challenges for Scenario-Based V&V of Automated Systems
from an OEM Perspective .. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. . . . . . . . . . . . . . . . . . . . 3
from an Academic Perspective.. . . . . . . . . . . . . . . . . . . . . . . . . . . . .. . . . . . . . . . . . . . . . . . . . 7
Daniel Watzenig
from a Tool Provider Perspective .. . . . . . . . . . . . . . . . . . . . . . . . . .. . . . . . . . . . . . . . . . . . . . 11
Kai Voigt and Andrea Leitner
ENABLE-S3: Project Introduction . . . . . . . . . . . . . . . . . . . . . . . .. . . . . . . . . . . . . . . . . . . . 13
Andrea Leitner
Part II V&V Technology Bricks for Scenario-Based Verification

& Validation
Using Scenarios in Safety Validation of Automated Systems .. . . . . . . . . . . . . . . 27
Sytze Kalisvaart, Zora Slavik, and Olaf Op den Camp
Traffic Sequence Charts for the ENABLE-S3 Test Architecture.. . . . . . . . . . . 45
Werner Damm, Eike Möhlmann, and Astrid Rakow
A Scenario Discovery Process Based on Traffic Sequence Charts . . . . . . . . . . 61
Werner Damm, Eike Möhlmann, and Astrid Rakow
Digital Map and Environment Generation .. . . . . . . . . . . . . . .. . . . . . . . . . . . . . . . . . . . 75
Gerald Temme, Michael Scholz, and Mohamed Mahmod
Systematic Verification and Testing . . . . . . . . . . . . . . . . . . . . . . . .. . . . . . . . . . . . . . . . . . . . 89
Dana Dghaym, Tomas Fischer, Thai Son Hoang, Klaus Reichl,
Colin Snook, Rupert Schlick, and Peter Tummeltshammer
ix
x Contents
Reliable Decision-Making in Autonomous Vehicles . . . . . .. . . . . . . . . . . . . . . . . . . . 105

Gleifer Vaz Alves, Louise Dennis, Lucas Fernandes, and Michael Fisher
Radar Signal Processing Chain for Sensor Model Development . . . . . . . . . . . 119
Martin Holder, Zora Slavik, and Thomas D’hondt
Functional Decomposition of Lidar Sensor Systems for Model
Development . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .. . . . . . . . . . . . . . . . . . . . 135
Philipp Rosenberger, Martin Holder, Marc René Zofka, Tobias Fleck,
Thomas D’hondt, Benjamin Wassermann, and Juraj Prstek
Camera Sensor System Decomposition for Implementation
and Comparison of Physical Sensor Models . . . . . . . . . . . . . .. . . . . . . . . . . . . . . . . . . . 151
Marcel Mohr, Gustavo Garcia Padilla, Kai-Uwe Däne,
and Thomas D’hondt
Seamless Tool Chain for the Verification, Validation
and Homologation of Automated Driving . . . . . . . . . . . . . . . . .. . . . . . . . . . . . . . . . . . . . 165
Andrea Leitner, Jürgen Holzinger, Hannes Schneider, Michael Paulweber,
and Nadja Marko
Part III Applications

Validation Framework Applied to the Decision-Making Process
for an Autonomous Vehicle Crossing Road Intersections.. . . . . . . . . . . . . . . . . . . 179
Mathieu Barbier, Javier Ibanez-Guzman, Christian Laugier,
and Olivier Simonin
Validation of Automated Valet Parking.. . . . . . . . . . . . . . . . . . .. . . . . . . . . . . . . . . . . . . . 207
Hasan Esen, Maximilian Kneissl, Adam Molin, Sebastian vom Dorff,
Bert Böddeker, Eike Möhlmann, Udo Brockmeyer, Tino Teige,
Gustavo Garcia Padilla, and Sytze Kalisvaart
Validation of Railway Control Systems . . . . . . . . . . . . . . . . . . . .. . . . . . . . . . . . . . . . . . . . 221
Tomas Fischer, Klaus Reichl, Peter Tummeltshammer, Thai Son Hoang,
and Michael Butler
Reconfigurable Video Processor for Space . . . . . . . . . . . . . . . .. . . . . . . . . . . . . . . . . . . . 231
L. Armesto Caride, A. Rodríguez, A. Pérez Garcia, S. Sáez, J. Valls,
Y. Barrios, A. J. Sanchez Clemente, D. González Arjona, Á. J.-P. Herrera,
and F. Veljković
Maritime Co-simulation Framework: Challenges and Results . . . . . . . . . . . . . 251
Arnold Akkermann, Bjørn Åge Hjøllo, and Michael Siegel
Contents xi
Validation of Automated Farming.. . . . . . . . . . . . . . . . . . . . . . . . .. . . . . . . . . . . . . . . . . . . . 271

M. Rooker, J. F. López, P. Horstrand, M. Pusenius, T. Leppälampi,
R. Lattarulo, J. Pérez, Z. Slavik, S. Sáez, L. Andreu, A. Ruiz, D. Pereira,
and L. Zhao
A Virtual Test Platform for the Health Domain . . . . . . . . . .. . . . . . . . . . . . . . . . . . . . 297
Teun Hendriks, Kostas Triantafyllidis, Roland Mathijssen,
Jacco Wesselius, and Piërre van de Laar
Part I
Introduction and Motivation
Challenges for Scenario-Based V&V
of Automated Systems from an OEM
Perspective
The beginning of the twenty-first century is marking a major turn in the technolog-
ical development by mankind. The combination of powerful computing platforms,
networking, advanced algorithms, the ability to manipulate large quantities of data
and machine learning methods has resulted into their tight integration with physical
processes. Cyber-Physical Systems (CPS) represent this integration enabling the
monitoring and control of the physical processes, with feedback loops resulting in
strong interactions between the controlling systems and physical processes.
The deployment of highly automated CPS has moved from laboratories to
public spaces, different levels of automation are being experimented with. The
most known operational trials are represented by robo-taxis which aim to deploy
driverless passenger vehicles as the main form of transport in our cities. Navigating
autonomously in such environments represents perhaps one of the major challenges
within the CPS realm. Multiple applications beyond land, air and sea transportation
have rapidly emerged, these include medical, agricultural and factory applications
all with their own levels of complexity. CPS represent a paradigm change, they
introduce a very strong symbiosis between highly automated systems and the
environment, whilst their control is shifted from humans to computers. It opens
multiple alternatives as shown by the lasting interest in autonomous vehicles beyond
vehicle OEMs and the substantial investments made over the past 5 years.
For managers, to decide whether CPS are to be deployed, substantial factual
assurances are needed. Investments are high due to the different technologies
embedded in CPS; acceptability by society is a key issue. That is, any major
malfunctions leading to hazardous situations could result in the rejection of CPS.
As systems become under more computer control for safety related applications,
the need to know how these would react (if at all) in all types of operating situations
J. Ibanez-Guzman ()
Research Division, Renault S.A., Guyancourt, France
e-mail: javier.ibanez-guzman@renault.com
© Springer Nature Switzerland AG 2020 3

A. Leitner et al. (eds.), Validation and Verification of Automated Systems,
https://doi.org/10.1007/978-3-030-14628-3_1
4 J. Ibanez-Guzman
is a major requirement. Edge-cases (the long tail) represent the largest challenges, it
is difficult to design for all of them. To solve such issues, it is important to validate
the operational component of CPS by running tests that are statistically credible.
However, this brings out a major challenge, how can physical tests be done for
an almost infinite number of situations that CPS will encounter. For example, an
autonomous vehicle crossing a simple intersection, will face thousands of likely
combinations by simply considering the presence within its evolving environment
of several entities e.g. other passenger vehicles, trucks, emergency service vehicles,
pedestrians (adult, elderly, children), motorcycles, bicycles, etc. All converge at
different speeds and different time intervals. If one considers, road, weather and
light conditions, the combinations are too many. Could it be possible to make such
tests physically? Culture influences the way people react. Do we need to test under
different geographical situations? What about the age distributions of the actors
involved? There are many other similar examples. New techniques are necessary,
novel testing frameworks are needed, entire system models are required (e.g. a
digital twin).
ENABLE-S3 represents a major contribution to the emergent field of validation
and testing of CPS. Its strength resides in the combination of domain knowledge
Europe-wide. Different industry led use cases have been studied, different solutions
proposed, from formal methods, simulation and real experimentation as well as
theoretical fundamentals. From an automotive perspective, it has enabled us to
understand the complexities of the problem, to gain knowledge from efforts done
in different domains and on the interaction with test & measurement specialists,
suppliers, academics and our peers at large. Different use cases are examined at
various levels of detail. Some results are very successful others opened a pandora-
box. From the testing of autonomous vehicles perspective, it has allowed us to
appropriate for ourselves of the ENABLE-S3 framework, to define a clear partition
between the system under test (SUT) from the testing systems (TS), to find about
the difficulties of integrating different simulation software into a coherent SUT, to
examine how simulation models can be credible. The different chapters included in
this publication should provide an overview of state-of-the-art solutions, approaches
whose scope originated through work on specific industrial use cases.
ENABLE-S3 was formulated more than 4 years ago, within this period we
have witnessed the renaissance of Artificial Intelligence, the use of deep machine
learning which currently is being applied not only for classification but is also part
of the decision-making process. Progress in this domain is exponential. From a
validation point of view, this raises major difficulties, that of understanding how
machine learning based methods operate and to comprehend why they have failed.
Whilst with conventional algorithmic methods it is possible to understand the whole
process, in the ML approach this is not explicit. It is still an emergent area of
research; methods that facilitate this testing are in progress. Another challenge is
to demonstrate that the testing space covers all the likely scenarios and on how
the experimental space can be minimized to validate the simulations via sampled
experimentation. The whole is known as explicability and robustness of Artificial
Challenges for Scenario-Based V&V of Automated Systems from an OEM Perspective 5
Intelligence based methods. Currently this is the subject of extensive exploratory

research.
The validation of CPS requires common efforts, however, at some point this
should be considered highly-competitive, those companies able to validate complex
CPS will be the first to market, potentially scalable products.
of Automated Systems from an Academic
Perspective
Daniel Watzenig
Automation is seen as one of the key technologies that considerably will shape our
society and will sustainably influence future mobility, transportation modes, and our
quality of life. Many benefits are expected ranging from reduced accidents, efficient
people/freight/goods movement, effective multi-modal transport (on-road, off-road,
sea, air), better road/vehicle utilization, or social inclusion. Beyond mobility,
automation creates tremendous impact in production, health-care, and eventually
our everyday life.
In automotive, it is envisioned that automated driving technology will lead
to a paradigm shift in transportation systems in terms of user experience, mode
choices, and business models. Over the last couple of years, significant progress has
been made in vehicle automation. Given the current momentum, automated driving
can be expected continuously to progress, and a variety of products will become
commercially available within a decade. Not only technological advancements
have been demonstrated in many venues, several states and federal governments in
Europe, the US, and in Asia have moved forward to set up regulations and guidelines
preparing for the introduction of self-driving cars.
However, despite tremendous improvements in sensor technology, high perfor-
mance computing, machine learning, computer vision, data fusion techniques, and
other system technology areas, market introduction of a fully automated vehicle that
is capable of unsupervised driving in an unstructured environment remains a long-
term goal. In order to be accepted by drivers and other stakeholders, automated
vehicles must be reliable and significantly safer than today’s driving baseline. The
ultimate safety test for automated vehicles will have to point out how well they
D. Watzenig ()
Graz University of Technology, Graz, Austria
Virtual Vehicle Research Center, Graz, Austria
e-mail: Daniel.Watzenig@v2c2.at

https://doi.org/10.1007/978-3-030-14628-3_2
8 D. Watzenig
can replicate the crash-free performance of human drivers especially at the level of
conditional and high automation within mixed traffic.
Beyond the technological issues, several regulatory action items for faster
introduction of automated vehicles still have to be resolved by the governments
in order to ensure full compatibility with the public expectations regarding legal
responsibility, safety, and privacy.
Compared to typical functions (SAE level 2, available on the market) which are
designed for specific situations, SAE level 3+ functions need to be designed and
tested for a significantly higher number of situations. The complexity of the real-
world situations (including edge/corner cases and rare but safety-relevant events)
does not allow a complete specification to be available in the requirement phase
when developing along the V-cycle process. Thus, the traditional static specification
sheet as it is used in the automotive development and testing process is no
longer applicable. With increasing the level of automation, the complexity of the
systems and therewith the need for agile development and scenario-based/situation-
dependent testing increases exponentially. Conventional validation methods, tools,
and processes are not sufficient anymore to test highly-interacting vehicle functions
which have to be robust in complex traffic situations, evolving scenarios, and
adverse weather conditions. The transition towards a higher level of artificial and
swarm intelligence poses even greater demands.
As the technology for automated driving becomes more and more advanced,
the research focus is shifting towards the emerging issues for their type approval,
certification, and widely agreed homologation procedures affecting the entire value
chain from semiconductor industry via component suppliers and software vendors to
integrators. Within this complex chain of sensing-processing-controlling-actuating
with a driver-in/off-the-loop many types of failures might occur and have to be
avoided by design and during operation. These include failures of components
and hardware deficiencies, software failures, degraded system performance due to
inoperable sensors or the vehicle is completely inoperable, deficiencies in sensing
(road, traffic, and environmental conditions), or faulty driver and vehicle interaction
(mode confusion and false commanding). Additionally, the question on how to
periodically re-qualify and re-certificate suchlike systems is currently open and
needs to be addressed. This is of particular interest when software updates and/or
hardware upgrades come into play.
Consequently, there is a strong need for an independent and reproducible vali-
dation of automated cyber-physical systems. Without a traceable demonstration of
the maturity (technological readiness), reliability, and safety, the societal acceptance
will lack. Reliable and safe enough means rare enough, i.e. the failure probability
rate should be less than 10-n per hour. If somehow an adequate sample size
n can be argued—which is currently not the case—then appropriate safety and
reliability can be demonstrated by driving (testing) in the order of 10n hours. For
n > 5 this becomes effectively infeasible since effort and related costs will increase
tremendously. In fact, we must test even longer, potentially repeating tests multiple
times to achieve statistical significance. Yes, there is a strong need for methods and
tools to supplement real-world testing in order to assess automated vehicle safety
Challenges for Scenario-Based V&V of Automated Systems from an Academic. . . 9
and shape appropriate policies and regulations. These methods may include but are
not limited to accelerated testing, residual risk quantification, virtual testing and
simulations, scenario and behavior testing as well as extensive focused testing of
hardware and software components and systems. And yet, even with these methods,
uncertainty will remain. This poses significant liability and regulatory challenges
for policymakers, insurers, and developers of the technology.
of Automated Systems from a Tool
Provider Perspective
Kai Voigt and Andrea Leitner
AVL has long experience as solution provider for various automotive testing
applications with a focus on powertrain development and vehicle integration. The
advent of autonomous vehicles poses several new challenges for tool and service
providers in the automotive field. The number of assistant systems and conditionally
automated functions in vehicles will continue to grow quickly and will be deployed
in all kinds of vehicles. New testing and validation methodologies must not only be
applied to autonomous vehicles, but also to conventional vehicles. Therefore, it is
vital for tool providers to take up the challenge of testing autonomous systems.
First, autonomous systems need to take their environment into consideration
and take decisions based on what is happening around them. This means that new
simulation environments representing the surroundings and the behavior of other
traffic participants are required. Autonomous vehicles are further equipped with
different kinds of environment sensors to perceive the environment. Hence, new
sensor technologies need to be considered in the testing process and thus also in
simulation and a lot of effort needs to be spend on the development of accurate
and realistic sensor models. This is not only a requirement for pure simulation, but
also for vehicle-in-the loop environments where these sensors need to be stimulated
appropriately.
The important role of sensors for autonomous vehicles further introduces new
data types that need to be considered throughout the testing tool chain. Besides
traditional time-series data, object data as well as sensor raw data need to be
handled. This does not only mean a paradigm shift in the type of data, but also for
the amount of data that needs to be processed. Autonomous systems are equipped
with various sensors, each perceiving their environment with high resolution. To
be assessed, this data needs to be recorded and processed. As a result, new data
K. Voigt () · A. Leitner

AVL List GmbH, Graz, Austria
e-mail: Kai.Voigt@avl.com; andrea.leitner@avl.com

https://doi.org/10.1007/978-3-030-14628-3_3
12 K. Voigt and A. Leitner
logging technologies and big data solutions for evaluation and data management are
required. Apart from that, autonomous cyber-physical systems are very complex
software systems—usually also including certain parts of Artificial Intelligence.
This is a further huge step towards software-driven systems in a traditionally
mechanics driven industry. Ensuring the reliability of systems based on AI is still a
major research challenge, since it is highly dependent on the amount and quality of
data used to train the system. Development and testing tools need to take this new
development paradigms of train instead of coding into consideration.
Driven by venture capital, there are a lot of software startups popping up every
day promising to provide dedicated solutions for generating training data or ways to
accelerate the autonomous system development process. Most of them don’t have
an automotive background and thus are not completely aware of requirements for
safety-critical systems. For an automotive development tool provider this means
that there are many potential competitors or, depending on the perspective, potential
technology partners in this dynamic business environment. Keeping an overview of
the players is a challenge but necessary to succeed in the market.
Currently there is still no commonly agreed testing methodology and there are no
regulations available. It is still unclear, which testing environments (model-in-the-
loop, hardware-in-the-loop, vehicle-in-the-loop, or proving ground or road testing)
will be required in the long term and to which extend they will be efficiently used.
Nevertheless, a complete system validation can most likely only be done with a
combination of different test environments.
We as AVL believe that we must be capable to provide integrated testing solu-
tions, covering the whole process from test preparation (e.g. test case generation),
test execution in different environments, to test evaluation and reporting. We also
fully understand that not all aspects can ever be covered by one tool or even
by tools from a single provider. Therefore, we are committed to openness and
we support standardization activities facilitating the composition of tools into an
integrated and open development platform, enabling efficient and reliable validation
of autonomous systems.
ENABLE-S3: Project Introduction
Andrea Leitner
1 Introduction
The ECSEL JU funded project ENABLE-S3 [4] (May 2016–May 2019) was
launched due to the need for verification and validation (V&V) solutions in the field
of automated cyber-physical systems (ACPS). ACPS are expected to improve safety
as well as efficiency tremendously. There are already technology demonstrators
in various application domains available (cars, ships, medical equipment, etc.)—
nevertheless, productive systems are not yet available on the market. A main
obstacle for commercialization is the systems’ interaction with the environment.
Not only the automated cyber-physical system itself has to be tested, but also if it
reacts to the behavior and specifics of its surroundings in a correct way. This leads
to a huge amount of potential scenarios the system has to cope with.
For automated driving, Winner et al. [1] as well as Wachenfeld et al. [2] predict
that more than 100 million km of road driving would be required to statistically
prove that an automated vehicle is as safe as a manually driven vehicle. A proven-
in-use certification is simply not feasible by physical tests.
This challenge is not constrained to a specific application domain. Therefore,
industry and research partners from different application domains (automotive,
aerospace, rail, maritime, health and farming) have joined forces to develop the
required technology bricks for the V&V of automated cyber-physical systems.
The EU-research project ENABLE-S3 aspires to develop the missing technology
solutions for the verification & validation of automated cyber-physical system,
proposing a scenario-based virtual V&V approach. The main testing effort should
be shifted to a virtual environment represented in terms of models. This has
A. Leitner ()
AVL List GmbH, Graz, Austria
e-mail: andrea.leitner@avl.com

https://doi.org/10.1007/978-3-030-14628-3_4
14 A. Leitner
several advantages: tests can be conducted much earlier, cheaper, safer, and in a
reproducible way. The input for the testing process are scenarios. Within the project,
the following multi-domain definition was defined:
A scenario class is a formalized description of the multi-actor process, including its static
environment, its dynamic environment and environmental conditions. In a scenario class,
the parameters are described and may have parameter ranges or distributions. A scenario
class may include activities, events, goals of the activity and decisions of actors.
Scenarios can be collected in several ways. They can be engineered (e.g. based
on safety or security analysis), collected from the real-world measurement data,
extracted from accident databases, and so on.
Due to the diverse background of the project partners and the application
domains, the project does not aim for a common, generic software solution. The
idea is to have a common methodology and a set of reusable technology bricks
(tools, methods, models, etc.), which can be used to build up a testing environment
for a certain use case.
Figure 1 shows the main scope of the project: the development of a modular
framework for validation and verification of automated cyber-physical systems.
Because of the large scope and complexity of the problem, it has been split
into two parts. The validation methodologies on the left side describe the necessary
steps and research on data acquisition and storage, scenario and metrics selection,
as well as test generation methods. Since the project aims at a scenario-based
validation approach, scenarios are an integral aspect. Countless variations for these
scenarios exist (i.e. for different environmental conditions, different persons/traffic
Validation Methodology Validation Platform

Scenario extraction
Results of
Real world Input from other
safety &
data analysis related projects Virtual world
security analysis Runtime
models validation
Model/Software in
Proving ground
Scenario variations the loop
Validation
System variants scenarios
Hardware in the System variants in
Environment
loop the loop
Routes Full scenario
coverage with all
Personality types variations
x*10^12 tests
Scenario parameters
... other parameters Intelligent

accelerated
validation
y*10^3 tests Reusable validation procedures
Fig. 1 Scope of the ENABLE-S3 project

ENABLE-S3: Project Introduction 15
participants involved, etc.) leading to an enormous number of potential test cases.

The goal is to provide intelligent methods to select the required test scenarios in a
way that ensures sufficient test coverage.
The validation platform on the right side focuses on reusable validation technol-
ogy bricks (tools and models), which can seamlessly support various development
and testing environments (model-in-the-loop, hardware-in-the-loop, system-in-the-
loop, e.g. vehicle-in-the-loop, as well as real-world testing). By combining both
parts and the respective technology bricks, the project works towards a significant
reduction of the required test effort or even to enable testing of highly automated
cyber-physical systems at all, respectively.
2 Generic Test Architecture
A major goal of the ENABLE-S3 project is to firstly deliver reusable technology

bricks, promoting the development of models and tools that are easily reusable
in different contexts, and secondly seamless development environments. This can
be realised by setting up a testing environment where virtual representations can
easily be exchanged by physical components. For both, the use of a modular
structure with well-defined interfaces is essential. As a result, a generic ENABLE-
S3 test architecture as shown in Fig. 2 was defined to support the integration of
different technology bricks in a test system instance. It consists of three main
layers and includes the most essential parts for testing automated cyber-physical
systems across the six ENABLE-S3 application domains (automotive, aerospace,
rail, maritime, health care and farming). The blocks’ characteristics depend on the
specific use cases. For some use cases, the blocks might be interpreted slightly
different or are not required at all.
On high level, we differentiate between the Test Framework and the Test Data
Management. The Test Data Management covers all aspects, which are valid across
test phases and are reusable for testing different products. The test framework
summarizes all aspects required for the planning (Test Management) and execution
of tests (Test Execution Platform) for a specific product.
2.1 Test Framework
The test framework is divided into two parts: Test Management and Test Execution
Platform, which are described in more detail in the following.
2.1.1 Test Execution Platform
The Test Execution Platform, as illustrated in more detail in Fig. 2, covers all
relevant aspects for testing an ACPS including the SuT (either as a model, as
16
Fig. 2 Test Execution Platform in more detail

A. Leitner
software component, as subsystem or as complete system). The ACPS control

system interacts with its environment (e.g. driving on a road, which is shared with
other traffic participants, etc.), perceiving its environment either via sensors or the
communication to the infrastructure or both. The system itself is described by its
physical dynamics, which again need to be fed back to the environment and so on.
The arrows show the basic interactions of these testing architecture blocks. The
description of the interface depends on the application domain as well as on the
respective use case. For certain aspects, standardization of the interfaces is proposed
as stated in Section “Open Simulation Interface”.
Depending on the development stage, there are different instances of the test
platform/architecture. For example, in a MiL environment, all components will be
available as simulation models. Later simulated components will be successively
substituted by real physical components, resulting in a mixed environment of real-
time and non-real-time components. In this case, the ACPS control system describes
the main system under test (SUT). In later development stages, more aspects are
integrated in the SUT (e.g. real sensors).
2.1.2 Test Management
Figure 3 shows the different aspects of the Test Management part in more detail
covering the generation of a representative set of test cases from scenarios. An
interface to a scenario database is required to query the required information
(relevant scenario classes and parameters, e.g. weather, type of operator, type of
route, equipment, etc.). Depending on the testing purpose, this module has to include
intelligent methods to select and instantiate the required scenario instances and
prepare test cases. Then, the test cases need to be handed over to and executed
in the test execution platform (or more concretely in the Environment block of the
Test Execution Platform). The results need to be recorded, processed and potentially
also visualized for inspection. In the last step, the overall safety of the system needs
to be justified.
2.2 Test Data Management
Test Data Management focuses on all aspects that are valid across different test
environments and includes the management of different types of data (such as
measurement results, scenarios, etc.) as highlighted in Fig. 4. It includes the
establishment of a managed tool chain (validated/qualified tool chain, configuration
management, etc.), which is an important aspect in the long term—especially if
virtual validation environments will be used for homologation and certification.
The ENABLE-S3 project aims for a scenario-based verification and validation
approach. A major prerequisite is the existence of a set of scenario classes, which
can be instantiated. These scenario classes and their potential variation parameters
can either be extracted from real-world data as well as generated synthetically. The
18
Fig. 3 Test Management in more detail

A. Leitner
ENABLE-S3: Project Introduction
Fig. 4 Test Data Management in more detail

19
20 A. Leitner
“scenario generation” block summarizes all activities, methods and tools which
are required to extract scenario information (e.g. by identifying and transforming
critical real-world situations), which can be transformed into something executable
by an environment simulation engine. For traceability and reproducibility, it is
further required to store all test artefacts and their interrelations.
3 Standardization Activities
3.1 Standardization of Scenario Descriptions
In the previous section, the scenario-based virtual V&V approach has been intro-
duced. To make this practicable, scenarios (scenario classes as well as instances)
need to be reusable in different environments and be shareable.
They need to be represented in a format, which is understood and interpreted by
different simulation tools in the same way. For automotive, there are currently two
open formats (OpenDrive®1 and OpenScenario®2 ).
OpenDrive is an already quite established specification for describing the logical
view on the road networks (i.e. road curvature, lane information, speed limits and
directions for single lanes). This specification is supported by various environment
simulation tools.
Currently, the specification is restricted to automotive applications. Nevertheless,
certain aspects and design decisions might be reused in other application domains
(e.g. to describe routes for vessels).
OpenScenario® is an open file format describing dynamic contents in driving
simulation applications. Currently in its early stage, OpenScenario® just starts to be
supported by environment simulation tools and is targeting the dynamic aspects of
the scenario (i.e. traffic participants and their interaction). Again, the specification
is currently developed for the automotive domain, but might be adapted to other
domains as well.
The specifications have been used in the different automotive use cases of the
project, the experiences have been fed back in the OpenScenario working group.
Several project partners have committed themselves to actively participate in the
evolution of OpenScenario, continuing the work even after the project has ended.
1 http://www.opendrive.org
2 http://www.openscenario.org
3.2 Standardization of Sensor Model Interfaces
The Open Simulation Interface (OSI) [3] is an upcoming standard to describe the
data structure (message-based) of virtual perception sensors. It has been introduced
by BMW and the Technical University of Munich and has been published as
an Opensource project. The specification covers ground truth (as output of the
environment simulation) as well as sensor information like lidar point clouds
or object lists, which are relevant as possible output of simulated perception
sensors and sensor systems. Regarding the generic test architecture, OSI thus
provides a standardized data interface between the environment simulation and the
perception sensor as well as for perception sensor data, which is used by automated
driving functions. Hence, this interface enables the connection between function
development frameworks and the simulation environment. A standardized interface
for the description of environment data is helpful to provide compatibility between
different frameworks.
3.3 Sustainability of Results
All specification described above have already existed at the beginning of the
project. Within the ENABLE-S3 project, we identified these specifications as
essential for the automotive domain. Therefore, we applied them and identified
further requirements from our project use cases.
The specifications have been handed over to the ASAM e.V. standardization
organization and are now managed there in dedicated working groups. As a result,
the findings of the project are sustained, accessible and further developed after the
project has ended.
4 Conclusions and Future Work
The project has tackled existing challenges for the verification and validation of
automated cyber-physical systems. Nevertheless, there are still open issues, which
have either been out of scope for this project or have been identified as important
future work as a result of the project.
There is a trend to employ machine learning and other Artificial Intelligence (AI)
techniques for ACPS product differentiation. The use of AI for object recognition in
automated vehicles, first prototypes of AI-based Air Traffic Management or AI-
based identification of health issues based on medical images are just three out
of many examples how products can be improved by the means of AI and how
AI technologies create the basis for intelligent decision making in future systems.
Higher levels of automation combined with the use of AI pose significant new
22 A. Leitner
verification and validation challenges to ensure safety and security of advanced

ACPS. Moreover, future ACPS will require frequent, fast updates and upgrades
after product release in order to deal with changing environmental conditions, to
leverage fast technology innovations and to cope with safety and security issues
experienced in field operation. ACPS are no longer immutable. Instead, learning
systems based on AI combined with online updates and upgrades are employed in
such a way that a systems’ implementation evolves during its lifetime. This trend of
customization and updates will increase the already high number of existing ACPS
product variants by an additional order of magnitude. Due to this system evolution,
the initial verification of a systems’ safety and security is no longer valid across
the full product lifecycle. This requires to ensure that changes, such as over-the-air
updates of (safety-critical) functions and upgraded hardware-components, do not
compromise the overall safety and security of the systems.
All three ACPS-trends—autonomy, use of AI, and continuous system
evolution—pose new verification, validation and certification challenges.
A certification solely based on virtual verification & validation approaches
(without any physical testing) would impose high demands to model fidelity or
might be even impossible—especially because of the required in-depth qualification
of sensor and environment models, used simulation frameworks, V&V tools,
artefact management, etc. An intelligent combination of in-depth virtual V&V plus
economically feasible physical testing in the field is required—and new certification
procedures and standards that reflect this approach. The combination of virtual and
physical certification need to ensure economically feasible effort for the simulation-
based V&V and a significantly reduced number of physical testing—meeting the
required safety and security levels of ACPS in line with European standards and
faster time-to-market for ACPS products.
Due to the complexity of ACPS, the “Open World” problem, the use of AI and
the potentially changing environment conditions after product release, no approach
can ensure error-free operation of ACPS along their lifecycle. Thus, systematic
self-monitoring and self-diagnosis mechanisms need to be built into safety-relevant
ACPS together with suitable fail-operational mechanisms to avoid accidents in
unexpected situations. Examples of these situations could be e.g. component
failures or unanticipated rare environment conditions. The self-monitoring and self-
diagnosis mechanisms are also necessary to provide the in-field information for
corrective system updates and upgrades. These self-monitoring, self-diagnosis and
fail-operational mechanisms also need to be considered in the overall certification
processes to ensure that they indeed implement safely degrading functionality of the
automation (e.g. limited speed).
Acknowledgements This work has received funding from the Ecsel Joint Undertaking Under
Grant Agreement No. 692455. This Joint Undertaking receives support from The European
Union’s Horizon 2020 Research And Innovation Programme and Austria, Denmark, Germany,
Finland, Czech Republic, Italy, Spain, Portugal, Poland, Ireland, Belgium, France, Netherlands,
United Kingdom, Slovakia, Norway.
Another random document with
no related content on Scribd:
When Mr. Taft got back to Washington he found the following
letter from Mr. Root, which completes the triangle of this mutual
admiration society of the Three Musketeers:
Dear Porthos:
I have been disappointed that your most important and admirable speech in
Idaho has not been more freely published and commented on in the East. I have
just suggested to the Editor of The Outlook that he ought to print it in extenso and
call attention to it. He will apply to you directly for it and I hope you will let him
have it.
I am going to start Saturday afternoon to be away for a week, and if you see any
gaping lids about my Department in the meantime, please sit on them gently.
Faithfully yours,
Elihu Root.
“Sitting on the lid” was not in any sense the stationary and
reposeful performance the expression seems to suggest. Before Mr.
Taft returned to Washington from a tour of inspection of brigade
posts, which followed immediately upon his trip to Idaho, Mr.
Roosevelt had gone to Panama, leaving behind him various
questions, including the one which resulted from the discharge
without honour of the three companies of coloured troops at
Brownsville, Texas, for the Secretary of War to keep within bounds
until his return. Then there were many matters of a purely executive
nature which, as long as they did not require the signature of the
President himself, Mr. Taft was authorised and expected to dispose
of. And with the Secretary of State also absent, his office became
government headquarters, practically, where foreign Ambassadors,
Senators and officials of other Departments had to take their chances
of an interview along with visitors or representatives from the
Philippines, Hawaii, Cuba, Porto Rico, Alaska and the Canal Zone,
and with Army officers and War Department clerks.
I finally gave up all idea of ever getting him home to luncheon, but
we nearly always had a dinner engagement, so along about the hour
when I knew he would have just time to rush home and dress I would
call him on the telephone. And then, if I were fortunate enough to get
him without a disgraceful delay, he almost invariably came in,
followed by an extra private secretary bearing a large portfolio of
papers to be disposed of before such hour as he chose to consider
bedtime.
The winter of 1906–7 was too busy to remember as anything
except a sort of hazy nightmare lightened in spots by contemplation
of the delightful possibilities contained in a rapidly growing
Presidential “boom,” but it came to an end, and early in the summer
I gathered up my family and a few necessary belongings and went to
Murray Bay. We were to leave some time in August for the
Philippines and the trip around the world via the Trans-Siberian
Railway, and I wanted very much to have my husband get away for a
few weeks of absolute detachment from public affairs, feeling sure
that it would be his last opportunity for rest and relaxation for many
a day. But no man can be a candidate for President of the United
States and indulge at the same time in even a short period of
complete tranquillity.
Before Mr. Taft joined me he, in deference to the wishes of the
men who were conducting his “boom,” made another speech-making
trip through the West on the method so aptly described as
“whirlwind,” and did not arrive in Murray Bay until the first week in
July.
It just occurs to me that I have covered all these different periods
of our lives without even mentioning Murray Bay, although a large
part of the Taft family has been spending the summers there for
twenty years or more. We went there before the place became in any
sense “fashionable,” when the only kind of hotel accommodation was
in quaint old inns of the real French-Canadian type in which no
English was spoken, but where service of such delightfully simple
and satisfactory quality as can no longer be obtained was smilingly
offered at rates which would now be considered absurdly low. After
our first year in 1892 we always had a cottage,—and on going to
Murray Bay we prepared to enjoy ourselves in the luxury of complete
simplicity.
The cottage which we have occupied for a number of years is
perched on a rocky headland overlooking the sixteen miles wide
stretch of the St. Lawrence river and almost entirely hidden in a
dense grove of fragrant pine trees. It is roomy and comfortable, but
simple as a camp in the woods, being finished in unpainted pine and
furnished with only such things as may be locked up and left year in
and year out. There is nothing to tempt any possible robber, the only
distinctive things in the house being some Philippine curios, wall
decorations and floor mats, called “petates,” which we have brought
with us at different times from Manila.
Mr. Taft stayed at Murray Bay about five weeks, but during that
time our cottage in the woods was the United States War Department
and headquarters of a very probable Presidential candidate. Then,
too, Mr. Taft was beset with the nagging necessity for preparing
speeches which were really to launch his campaign for the
nomination before he left for the trip around the world. The
campaign in Ohio became centred and active during the summer,
with Mr. Taft far in the lead among possible candidates, and all over
the country organisations were forming which demanded whole-
hearted and unremitting attention.
The busy man wrote to Mr. Roosevelt: “I am enjoying my
vacation,” but his vacation consisted in a release from constant social
formalities and a daily round of golf on the links of the Murray Bay
Club which he liked so much and over which he had played for so
many years,—nothing more.
Early in August he left for Washington with the understanding that
I should complete arrangements, and taking Charlie with me, should
meet him at the entrance of Yellowstone Park at the end of the
month. In the meantime he had one more long speech-making trip to
begin at Columbus on the 19th of August and to take him through
Ohio, Kentucky, Missouri, Oklahoma and to Denver.
His mother, to whom the whole family was strongly devoted, was
at this time very ill. It did not seem possible that she could be with us
for long, and all of her sons wished sincerely to be able to remain
near her. One of them, Horace, was able to do so, but when my
husband declared to her his desire to give up the trip to the
Philippines and stay in the United States until she recovered she said
to him:
“No Taft, to my knowledge, has ever yet neglected a public duty for
the sake of gratifying a private desire. You promised the Filipinos
that you would be present at the opening of their first Assembly, and
if you should break that promise and neglect your plain duty on my
account, it would give me no pleasure.”
This was the last serious thing she ever said to him, and it gave
him great comfort throughout the long trip as the reports of her
failing strength came to him. He never saw her again.
With my son Charlie, who was then nearly ten years old, I met my
husband and his party at Livingston Junction, on the Northern
Pacific Railroad in Montana, and we proceeded together to Gardiner
at the entrance to Yellowstone Park. There we were met by General
Young, the Superintendent of the Park, and Colonel Henry T. Allen,
and by the head of the Park transportation company and began at
once a wonderful three days’ trip, which included, among other
things, the business of inspecting the Army post with the purpose of
making recommendations for changes in the Park patrolling system.
As our time was very short we had to drive about fifty miles every
day, which meant hurrying on at top speed, with relays of Army
mules, and not much more than a how-d’ye-do and good-bye at every
place we stopped. In consequence we completely lost track of the
days of the week and made what I then thought would prove to be a
fatal error.
We got back to the Mammoth Springs Hotel one evening and
found the place quite gay with crowds of tourists. There being
nothing else to do, I suggested that after dinner we play bridge in the
lobby where all the people were and where everything seemed so
lively and entertaining. We did. Mr. Taft and I, General Clarence
Edwards and another member of our party sat there and played until
quite late, enjoying ourselves immensely. Everybody looked at us,
and I noticed a few persons taking special pains to pass close enough
for a really satisfactory inspection, but we were used to being gazed
at and paid no attention to it. It was not until the next morning that
every look that was cast upon us assumed for me a special meaning.
The next morning was Monday!
Under any circumstances it would have shocked us somewhat to
find that through forgetfulness we had played bridge during a whole
Sunday evening, but with Mr. Taft generally recognised as a probable
candidate for President, our shock was merged into serious concern
with regard to the effect the story might have on the millions of good
Sabbatarians throughout the country. And there was no possible
explanation that we could make. Playing cards was bad enough, but
to have forgotten Sunday altogether was a great deal worse, so we
were perfectly helpless. Up to the day Mr. Taft was elected I looked
for the story to rise up and smite us. I had visions of glaring
headlines: “Taft Plays Cards on the Sabbath Day.” Having been
brought up on strictly Sabbatarian principles myself, I knew what
good use could be made of the incident in the hands of our political
enemies. But we never heard a word from it, and I have a warm
regard for all those good people who failed to avail themselves of
such an opportunity for a bit of valuable gossip. Or had they all
forgotten it was Sunday, too?
On the way from Yellowstone Park to Seattle I had a taste of real
campaign work and always thereafter enjoyed a full realisation of its
difficulties. I got completely worn out as a mere onlooker, and as I
saw Mr. Taft encountering the throngs at every stopping place,
speaking until his voice was reduced to a hoarse whisper, and
shaking hands until he groaned with the ache of his muscles, my
political enthusiasm waned slightly, though temporarily, and I could
think of nothing to be more thankful for at the moment than the fact
that we were about to set out on a two weeks’ ocean voyage,
beginning a three months’ trip around the world.
(FROM LEFT TO RIGHT) MRS. JAIME DE VEYRA, MRS. TAFT,
GOVERNOR SMITH, MRS. SMITH, MR. TAFT, MR. SERGIO
OSMEÑA, SPEAKER OF THE PHILIPPINE ASSEMBLY, AND
MEMBERS OF THE ASSEMBLY IN THE AYUNTAMIENTO,
MANILA
CHAPTER XV
A HURRIED TRIP AROUND THE WORLD
I have not the space to give a detailed account of this trip around
the world. After a pleasant voyage on the steamship Minnesota we
were given in Japan the same warm welcome that we had always had
there, and Mr. Taft and I were entertained at the Shiba Detached
Palace, one of the Imperial residences. We lunched with the Emperor
and also with Prince Fushimi, and we met the admirals and the
generals who had won such distinction in the Russo-Japanese War.
These included Admiral Togo and Field Marshal Prince Oyama. It
was explained to Mr. Taft by the Court Chamberlain that we were
regarded as personal guests of the Emperor. Marquis Saionji was
then Premier, but Prince Katsura, whom he had succeeded and who
was our old friend, was still powerful in the councils. Mr. Taft held a
number of interesting and useful interviews with these statesmen of
Japan, and also with the Minister of Foreign Affairs, Count Hayashi,
and with Marquis Terauchi, the Minister of War, who has now
become Governor of Korea. He was able, from what they told him, to
understand the attitude of Japan toward the United States, and to
feel confident of her wish to remain in bonds of amity with us. At a
dinner in Tokyo, given by the Minister of Foreign Affairs, Mr. Taft
made a speech in which he pointed out the absurdity of a war
between Japan and the United States, and showed how the true
interests of both nations required a strengthening of the bonds of
friendship between them. This speech attracted much attention
throughout the Orient and was cabled back to the United States as an
expression of the Administration on the subject. The Japanese
residents of Yokohama presented to Mr. Taft and me on this visit a
very handsome silver tea set.
Our course took us by way of Shanghai and we stopped there for
just one busy day. In the morning Mr. Taft dedicated a Young Men’s
Christian Association building which had just been constructed and
to the cost of which a number of Chinese Mandarins, though not
Christians, had made substantial contribution. The afternoon was
devoted to shopping and to a most elaborate and picturesque
reception and tea which was given for us by the Chinese guilds of the
city. At this tea I was presented with a very curious and interesting
bowl of Chinese silver which is among my most valued possessions.
In the evening a great banquet was given by the leading citizens of
Shanghai at the Astor Hotel, where provision was made for the ladies
to hear the speaking from a platform erected at one end of the room.
Mr. Taft made a speech on the subject of the relations of the United
States to the development of China, which was long remembered as a
succinct and forcible presentation of the policy of the United States
toward that country, then in an interesting stage of its awakening
from a long lethargy.
In Manila, at the formal opening of the first Assembly, Mr. Taft
laid down the purposes of the Administration in the passage of the
Philippine Act, plainly saying to the Philippine people that
independence was not near at hand, and that it could only come after
a period of earnest effort on their part to fit themselves for complete
self-government. His candour and frankness did not please many of
the Assembly, but his view has always been that the only way in
which to deal with the Filipino people is to tell them the exact truth,
unpalatable though it may be, and to fulfil promises with the greatest
care. Filipinos may be very lax in discharging the full measure of
their own assurances, but the way to maintain influence over them is
to pursue a policy of clear and candid statement, full performance
and exact justice. They are prone to accept every declaration in the
same sense in which they would like to construe it, and the utmost
care must be taken to prevent their being misled. Demagoguery with
them is likely to be most pernicious in its ultimate results.
During this visit we were the guests of Governor-General Smith at
Malacañan Palace and I experienced a pleasant renewal of old
impressions and sensations. Mr. W. Cameron Forbes, who succeeded
Governor Smith, was then Secretary of Commerce and Police and, in
this capacity, was in charge of Public Works. He had built for himself
at Baguio a fine country residence which he called “Topside,” a name
which fits it exactly, since it stands, literally, at the “topside” of the
island of Luzon, at an elevation of more than five thousand feet, and
overlooks the broadest and most colourful stretch of mountain
scenery imaginable. We visited Mr. Forbes at “Topside” and were
able to see for the first time the splendid achievements in the
development of the summer capital which I anticipated in Chapter
IX. Mr. Taft assured an enthusiastic enquirer that he was not
surprised at the magnificence of the Benguet Road because he had
authorised the expenditure of a sufficient amount to produce
something unusual, and that he would, indeed, have been surprised
if it hadn’t been done. But he had to confess to a little surprise at the
improvement of the town of Baguio. The difference was so great that
it was almost impossible to recognise the place as the site of the
ragged little Igorrote village where I had spent such pleasant and
“uncivilised” days just before my husband’s inauguration as the first
governor of the Philippines.
It would be useless for me to attempt to detail the thousand and
one events of this visit to Manila. Upon our arrival we were handed a
printed schedule of dinners, luncheons, teas, receptions, balls,
meetings, celebrations, trips of inspection, and business conferences
which we had to do our best to carry out. Fortunately provision was
made for a few hours of rest which could be used for other things
when we got behind with the programme.
On a day in November, when blue Manila Bay lay sparkling in the
sun, we set sail for Vladivostok on the U. S. S. Rainbow, flying the
flag of Admiral Hemphill, and convoyed by two other naval vessels.
The most amusing incident of this trip, which was quite a
tempestuous one, was the gradual freezing up of our Filipino
orchestra. They left Manila clad in natty white uniforms, responding
with enthusiasm to the strains of the many bands on shore and on
the fleet of harbor launches which accompanied us down the bay.
They played for us at dinner that night and gave a concert on deck
the next day, but then began the rapid descent of the mercury in the
thermometers and the consequent undoing of our tropical musicians.
They first changed into heavy blue uniforms and tried their best to
look comfortable. Then they put on their overcoats and kept them
on. Finally they deserted the deck altogether and their rather
disconnected strains came up to us through a partly open hatch just
over the engine room. When we reached the forbidding harbour of
Vladivostok, where the temperature stood below zero, the poor
bugler was so thoroughly cold that he couldn’t adjust his lips to his
bugle to pipe distinguished visitors aboard. Our party on this trip
around the world was small, including only my son Charlie, Mr.
Taft’s secretary, Mr. Fred C. Carpenter, General Clarence R.
Edwards, Mr. and Mrs. Martin Egan and two other newspaper
correspondents.
Shortly before we reached Vladivostok there had been a mutiny on
one of the torpedo boats in the harbour, and a woman anarchist had
induced the crew to take the boat out into the stream and raise the
red flag. This outbreak was suppressed with a heavy hand, and a
number of those suspected of complicity in the plot were arrested. As
the Governor had power of life and death over them it was assumed
that the extreme penalty was visited on some of them at least, but no
publicity was given to the proceedings. The effect of the tragedy upon
our arrival, however, was marked. The town was in a most unquiet
state and there were vague rumours of danger to be met on every
hand. We were not permitted to go ashore without a heavy guard of
bristling Cossacks, and everywhere we went we were under the
closest and most careful protection. It was most exciting, though in
the midst of the cordial hospitality of our Russian hosts we could not
feel that there was the slightest cause for apprehension. As soon as
we dropped anchor in the harbour we were welcomed to Vladivostok
by the Governor and General Commanding. He assigned Prince
Bariatinski, Colonel of a regiment stationed at Vladivostok, to act as
Mr. Taft’s aide during our stay, and from Saturday until Tuesday he
and the Princess, both of whom spoke English, were with us
constantly, adding much to our enjoyment. Our visit concluded with
a dinner and ball given by the Governor, and the next morning we
bade good-bye to the Rainbow and Admiral Hemphill and made our
way, surrounded by Cossack guards, to the railway station where the
train waited to start on its twelve days’ trip across Siberia. The
government provided us with a large private car of the armoured
variety which contained a number of compartments that were fully
as spacious and comfortable as an average steamship cabin and we
settled ourselves in them quite as we would have done on a trans-
Pacific liner.
The trip across Siberia is exceedingly interesting. One anticipates
endless monotony, but only the landscape lacks variety. For days
together the train runs along through a country which looks exactly
like South Dakota or Nebraska and which is interesting only in its
wonderful possibilities. It is one of the world’s open spaces,
undeveloped but capable of producing anything. I had always
imagined Siberia as a country filled with sadness and I expected it to
depress me, but it arouses no such feeling. We met trainload after
trainload of happy Russian colonists on their way to the new
settlements, and at all the well built stations along the way we saw a
great number of sturdy peasant farmers and their families who
looked thoroughly comfortable and contented. We whiled away the
hours with bridge and books, and, though the train never made more
than two or three stops a day, the time passed quickly. Throughout
the journey our car was guarded by stalwart Russian soldiers in most
picturesque uniforms, stationed on both platforms, and each time
the train stopped this guard was changed with considerable
ceremony. Also at every station near an army post Mr. Taft was
greeted by the Commander of the District with strict military form,
all of which added colour and interest to the journey.
Mr. Willard D. Straight, then United States Consul at Mukden, met
us at Vladivostok with plans for our reception at Mukden. When we
arrived there we were welcomed by a company of Chinese soldiers
dressed in the old Mongolian custom, and by a squadron of Cossacks.
We were hurried in a carriage behind two fast trotting Orloff horses
to a hotel where all the consuls assembled greeted us with cakes,
champagne and very short speeches. There was considerable
excitement among the consuls with regard to the toasts to be drunk
and the order of precedence in which the rulers of the different
countries were to be named, but Mr. Straight was diplomatic enough
to mention every proper name in right order and the result was a
round of congratulation and merriment. In the meantime the
leisurely and accommodating train was waiting, so we hurried back
to the station at the terrific pace usual to the Russian with his
beautiful horses. No people not inherently fine could ever produce
the kind of horses one sees in Russia. And the Russians love them. I
can think of nothing more pleasing than the picture of a great,
shaggy, gruff-voiced Russian coachman on the box of his carriage or
droshky, gently urging his well-kept horse on to his best speed in
terms of endearment. “On, Little Brother!” says he.
At Moscow we were right royally entertained by the Governor-
General of the city who did everything possible to make our visit
memorable. We arrived late Saturday night and on Sunday the
Kremlin was opened for our especial benefit and we were given full
opportunity to see every part of that ancient and interesting home of
Russian autocracy with all its collections of priceless treasures. A
hurried round of entertainments, which included a special ballet
performance at the Opera, ended with a dinner given by the
Governor-General, and we left on the midnight train for St.
Petersburg. We had not been there more than an hour or so the next
morning when we received a telegram announcing that a woman
Nihilist had thrown a bomb at the Governor’s sleigh which had
exploded under the horses, killing them and the coachman and
throwing the Governor and his aide backward into the snow
unharmed. As these gentlemen had both been very kind to us it
brought home in a startling way the danger that attends high
position in Russia.
In St. Petersburg we dined with the Minister of Foreign Affairs, M.
Iswolski and Madame Iswolski, and with them received the
Diplomatic Corps. Mr. Taft and General Edwards had an audience
with the Czar and attended the annual Saint’s day celebration of a
famous regiment numbering about 3,200, no man of which measures
less than six feet two. They were also present at a luncheon which the
Czar gave to the officers of this regiment at the Czar-KoeSelo Palace.
In the Czar’s suite there were two or three gentlemen who
remembered Mr. Taft’s father as Minister to Russia, so he very
greatly enjoyed the experience of meeting them.
Our visit was a hurried one, and after a stay of three days we left
for Berlin. Mr. Roosevelt and Mr. Root were not disposed to have Mr.
Taft visit any of the courts of Europe except at St. Petersburg and
that only for the purpose of conveying his grateful acknowledgment
of the courtesies shown us in our long trip across Siberia. Nor in the
state of his mother’s health, which we knew to be precarious, was he
disposed to accept the invitations which he received from the
German Emperor, the King of Belgium, the President of France and
others, to visit their countries and become their guest. At Berlin we
had just time to dine with the American Ambassador and Mrs.
Tower, and to meet a few American friends whom they had invited
in, then Mr. Taft and the other members of the party went to
Hamburg to take the Steamship General Grant at that port, while I,
with Mrs. Post Wheeler, rushed down to Paris to do a few hours’
shopping, planning to join the Grant at Boulogne the next evening.
In the meantime a terrible storm began to rage along the coast, and
when we reached Boulogne there was some question about our being
able to get to the Grant which lay at anchor just outside the
breakwater. However, we boarded the little tender and she started
for the very wild looking open channel. She had no sooner struck the
heavy seas before she had broken her rudder and was being buffeted
about in a really terrifying manner. We managed in some way to get
back inside the breakwater where some repairs were made, then we
started out again. We repeated this performance several times,
listening meanwhile to generally voiced predictions that nothing on
earth could save us from going to the bottom, and, although it was
only nine o’clock in the evening when we boarded the little vessel, it
was four o’clock in the morning before she came alongside the Grant
and discharged her dilapidated and exhausted passengers.
Mr. Taft had waited up for us and had seen the tender come out of
the harbour and go back, and, assuming from what was told him that
no attempt would be made to transfer the passengers before
morning, he went to bed. When I got aboard the steamer, filled with
excitement over the dangers through which I had passed, and found
him peacefully sleeping in his cabin, I declined to accept any
explanation. A French sub-prefect, who had been sent out by the
Minister of the Interior of France with greetings and compliments,
and who had come in his full regimentals with a cocked hat, was
waiting to see Mr. Taft and I was cruel enough to insist that he
should get up and receive him. Throwing a long fur coat over his
pajamas the Secretary of War of the United States walked out into
the salon to meet the polite representative of the politest of peoples,
but after a grave exchange of formal salutations the situation proved
too much for their gravity. They burst out laughing at each other, to
the immense enjoyment of the bystanders, and the gloom of the wee
sma’ hour was lifted.
When we touched at Plymouth that afternoon we received a
despatch announcing the death of Mr. Taft’s mother. The funeral
took place in Cincinnati, at the home of Mr. Charles Taft, several
days before we could reach New York.
On our return to the United States we found that my husband’s
rivals for the Republican nomination had been making great
headway. Mr. Roosevelt was quite impatient at the loss of ground
that Mr. Taft’s candidacy had suffered and he urged him to take a
more active interest in the situation. He insisted that Mr. Taft should
change the subject of a speech which he had agreed to deliver in
Boston from the Philippine problem to a discussion of the financial
situation which was then acute after the depression which had taken
place during our absence. Mr. Roosevelt’s forcible expression was
that the business and political public had no more interest in the
Philippines than in the subject of “nature faking.”
I cannot go into the details of the preliminary convention fight. My
husband’s brother Charles devoted a full year to it, established
headquarters in Ohio and Washington, and bore the brunt of the
contest. The afternoon of the convention when the voting came, we
all assembled at my husband’s office in the War Department and
received the news over the telephone as it came in. I have a series of
photographs, taken by a friend, of the expressions on my husband’s
face as the results of the voting were being announced. Soon after the
nomination was made, on the first of July Mr. Taft resigned from the
Cabinet, and we established ourselves at Hot Springs, Virginia,
where he spent some weeks preparing his address of acceptance.
This he submitted to Mr. Roosevelt and Mr. Root before he went to
Cincinnati to deliver it. Mr. Charles Taft made elaborate preparations
to receive and entertain the Committee of Announcement, and on a
platform in front of his fine old house, in Pike Street, on one of the
hottest days of the summer, my husband delivered his acceptance.
We then returned to Hot Springs and spent another month in
preparation for the campaign. From Hot Springs we went to Middle
Bass Island on Lake Erie to spend a week or more there. We then
went to Cincinnati. Upon this latter trip Mr. Taft made a good many
speeches from the platform of our car. In September Mr. Bryan’s
campaign looked very hopeful. The opposition of Mr. Gompers and
organised labour seemed formidable. Mr. Taft determined to meet
this issue fully and frankly. He was attacked because he had
delivered a number of labour decisions supposed to be against the
interest of labour. He had sent to jail, for six months, the chief
lieutenant of Debs in the Debs railway rebellion of 1894, breaking it
up in Cincinnati and the vicinity. He did not apologise in any way for
the action he had taken. A meeting of the railway trade organisations
was called in Chicago at Orchestra Hall, and there he explained his
action, defended it, and avowed that were the same questions
presented to him again, he would do the same thing he had done,
and that he had no excuses to offer. From that point he made a long
trip in the West, upon which I did not accompany him. I remained in
Cincinnati with Mrs. Charles Taft and my sister Mrs. Anderson. It
was the first political campaign in which Mr. Taft was a candidate
before the people. The reports that came indicated that he had lost
his voice, and I was greatly concerned lest he might break down in
his strenuous labours and new experience. The ups and downs of
such a campaign, the prophecies, the hopes, the fears aroused by
favourable and opposing newspapers were all new and trying to me,
and in a way I think I was under as great a nervous strain as my
husband was, without the steadying help of the hardest kind of work.
However as the campaign drew near to a close, the Republican
confidence grew stronger and stronger, so when we were assembled
finally under the hospitable roof of Mr. and Mrs. Charles Taft, with a
company of friends to receive the dispatches on election night, the
news of the great success that came did not surprise us.
CHAPTER XVI
PRESIDENT OF THE UNITED STATES
Shortly after my husband’s election, having spent a couple of

restful weeks at Hot Springs, Virginia, we went to Augusta, Georgia,
and took the old house known as the Terrett Cottage, near the Bon
Air Hotel. To me the weeks we spent there were exceptionally happy
ones and I should like to mention each friend—friends then and
friends still—who contributed to our constant enjoyment, but there
were too many of them and their kindnesses too numerous.
Mr. Taft, of course, immediately became engrossed in the
difficulties of securing a Cabinet which would satisfy everybody and
disappoint none,—an impossibility,—as well as a thousand and one
other matters not connected in any way with the daily games of golf
on Augusta’s sandy links which attracted such wide attention. But
even then my own problems became to me paramount and I began to
give them my almost undivided attention and to neglect the political
affairs which had for many years interested me so intensely. Perhaps
with my husband safely elected I considered all important affairs
satisfactorily settled. At any rate I found little time or inclination at
the moment to worry about who should have the high offices in the
new President’s gift, or what policies should be pursued during his
administration.
At my request Captain Archibald Butt came down to Augusta to
consult with me as to changes I wished to make in the White House
service, and together we went over the whole situation. As President
Roosevelt’s aide he knew the whole lexicon of customary White
House social formalities.
I had been a member of Washington’s official family for five years
and knew as well as need be the various phases of the position I was
about to assume, so my plans were not so difficult to put into form,
however difficult I may have found them to put into execution.
THE WHITE HOUSE AS IT LOOKED ON THE EVENING OF

THE FOURTH OF MARCH, 1909
We made a trip to Panama in February before the Inauguration

and did not reach Washington until the end of the month when we
went to stay with our friends, Mr. and Mrs. William J. Boardman,
and their daughter, Miss Mabel Boardman, at their residence on
Dupont Circle. We spent with them a busy week as the recipients of
varied and delightful hospitality, which was terminated by a splendid
reception in our honour on the evening of the second of March.
Captain Butt, who was to be continued as aide to President Taft,
called on me at once upon my arrival in Washington to assure me
that my instructions had been carried out and that the new régime,
fully organised, would go into effect at the White House on the
morning of March fifth.
Some time before the Inauguration, indeed shortly after Mr. Taft’s
election, President Roosevelt expressed a desire that we should dine
with him and Mrs. Roosevelt on the evening of the third of March
and spend that night in the White House as their guests. This was
breaking a precedent, but it was Mr. Roosevelt’s plan for bidding us a
warm welcome to the post which he was about to vacate, and my
husband accepted with grateful appreciation. My impression is that
neither Mrs. Roosevelt nor I would have suggested such an
arrangement for this particular evening, but, it having been made for
us, we naturally acquiesced.
The third of March, a stormy day, was filled with innumerable
minor engagements and small incidents, with instructions and
counter-instructions and, especially, with weather predictions and
counter-predictions, so it was not until shortly before eight o’clock
that Mr. Taft and I, having dressed for dinner, arrived at the White
House. The other guests at the dinner were Senator and Mrs. Lodge,
Senator and Mrs. Root, Admiral and Mrs. Cowles, Mr. and Mrs.
Nicholas Longworth and Miss Mabel Boardman.
Now there is always bound to be a sadness about the end of an
administration, no matter how voluntarily the retiring President may
leave office, no matter how welcome the new President and his
family may be. Mrs. Roosevelt seemed depressed, not, I am sure,
over the prospect of leaving the White House,—Presidents’ wives are
always given plenty of time to prepare themselves for that event,—
but for other reasons which one easily could surmise. Her husband
and son were about to start for a long and, possibly, dangerous trip
into the jungles of Africa, and she was looking forward to a year of
anxiety. She was leaving a full and busy life; she had occupied her
high position for nearly eight years, during which she had made a
host of friends, and a great number of them had called during the
afternoon to say farewell and to express their deep regret at her
departure. I knew all of these things, realised their depressing effect
and sympathised with her deeply. The President and Mr. Taft,
seconded by other guests, did their best with stories and
conversation, made as general as possible, to lighten the occasion,
but their effort was not entirely successful.
As my husband had an engagement to attend a “smoker” which
was being given to him at the New Willard Hotel by a large gathering
of Yale men, the party broke up very early and, as soon as the last of
the guests had gone, I went immediately to my rooms. We had been
assigned to the suite in the southeast corner, known in the White
House as the Blue Bedroom.
This Blue Bedroom gave me food for interesting reflection.
Conspicuous, under the mantel against the side wall, I found, on a
bronze plate, the following inscription (which I read as I struggled
with my hooks): “In this room Abraham Lincoln signed the
Emancipation Proclamation of January 1, 1863, whereby four million
slaves were given their freedom and slavery forever prohibited in
these United States.” It is only a state bedroom now, having been
made so by the plans of the McKim restoration which was
accomplished during the Roosevelt administration, but it was once
Lincoln’s Cabinet room, a room in which he lived through many
terrible days during the Civil War. It seemed strange to spend my
first night in the White House surrounded by such ghosts.
I went to bed reasonably early, hoping that I might have a good,
long sleep and get up refreshed and ready for an eventful day. But
the press of circumstances was against me. My mind was never more
wide awake. In spite of my determination to rest, I went carefully
over the whole Inaugural programme. I wondered if this had been
done, if that had been attended to. I worried over many petty details
with which I had no reason to be concerned. I suppose I must have
been excited, a condition quite rare with me, but then, too, the
weather had something to do with it. Never was seen such a night in
Washington. It will be remembered that Mr. Moore, the Chief of the
Weather Bureau, had prophesied that the storm of the third would
pass and that the Fourth of March would dawn as clear and bright as
any Inaugural Committee could wish. He made himself very popular
with the anxious officials, who were expending their energies in the
preparation of a fair weather programme, but his popularity was
short lived. He afterward learnedly explained that some wholly
unprecedented thing had happened in the wind currents, causing a
“flareback”—whatever that may be. It was a memorable “flareback”
in any event, not to be forgotten by those who were so seriously
inconvenienced by its results.
After I had fallen asleep in the early morning hours, thinking—
with faith in the prophet—to wake up and find a smiling world, I was
roused by loud, crackling reports which seemed to be in the
immediate vicinity of my windows. I got up and looked out. It was
light enough for me to see that the world was ice-bound and that the
storm, instead of abating, had increased in violence. The crackling I
had heard was the noise of twigs and tree limbs breaking with the
weight of the ice which encased them. It didn’t look hopeful for the
Inaugural Ceremonies, and I had a ludicrous vision of a haughty,
gold-laced parade sliding, rather than marching with measured
precision, down Pennsylvania Avenue, striving to maintain its
dignity while it spasmodically lost its footing. But mine was rueful
mirth.
In the morning Mr. Taft found President Roosevelt in the great
hall below, genially alert.
“Well, Will,” he exclaimed, “the storm will soon be over. It isn’t a
regular storm. It’s nature’s echo of Senator Rainer’s denunciations of
me. As soon as I am out where I can do no further harm to the
Constitution it will cease.”
“You’re wrong,” said Will; “it is my storm. I always said it would be
a cold day when I got to be President of the United States.”
It was really very serious. Railroad and telegraphic
communications were paralysed all along the Atlantic Coast. Wires
were down in every direction and traffic of all kinds was at a practical
standstill. Thousands of people, on their way to Washington for the
Inauguration, were tied up at points outside the city and it was
impossible for awhile even to get a telegram in or out. However,
Inaugurations do not wait for fair weather and the programme had
to proceed.
About half past ten I saw the President and the President-elect, in
a closed carriage, accompanied by Senators Knox and Bacon of the
Inaugural Committee, and a brilliant mounted escort, start on their
slippery way toward the Capitol. The Inauguration ceremonies would
not take place until twelve o’clock, but there were a number of bills
waiting for the signature of Mr. Roosevelt, and it was necessary for
him to go early to the office of the President at the Capitol to attend
to this and other final business details.
Before they left the White House it had not yet been decided
whether or not the Inauguration would take place out of doors. Mr.
Taft regretted exceedingly the necessity for disappointing thousands
of people, but at the same time he recognised the danger of exposing
the crowds to the wet and penetrating cold, and he considered,
especially, the impossibility of asking Chief Justice Fuller, who was

PDF Validation and Verification of Automated Systems Results of The Enable S3 Project Andrea Leitner Ebook Full Chapter

Uploaded by

Copyright:

Available Formats

You might also like

PDF Validation and Verification of Automated Systems Results of The Enable S3 Project Andrea Leitner Ebook Full Chapter

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

PDF Validation and Verification of Automated Systems Results of The Enable S3 Project Andrea Leitner Ebook Full Chapter

Uploaded by

Copyright:

Available Formats

Validation and Verification of

Automated Systems: Results of the

The Digital Factory for Knowledge Production and

Leveraging Applications of Formal Methods Verification

Leveraging Applications of Formal Methods Verification

Automated Reasoning for Systems Biology and Medicine

Dynamics of the Unicycle: Modelling and Experimental

Automated Hierarchical Synthesis of Radio Frequency

Modelling and Verification of Secure Exams Rosario

Pharmaceutical and Medical Devices Manufacturing

Validation and Verification

ISBN 978-3-030-14627-6 ISBN 978-3-030-14628-3 (eBook)

© Springer Nature Switzerland AG 2020

Graz, Austria Andrea Leitner

Part I Introduction and Motivation

Part II V&V Technology Bricks for Scenario-Based Verification

Reliable Decision-Making in Autonomous Vehicles . . . . . .. . . . . . . . . . . . . . . . . . . . 105

Part III Applications

Validation of Automated Farming.. . . . . . . . . . . . . . . . . . . . . . . . .. . . . . . . . . . . . . . . . . . . . 271

© Springer Nature Switzerland AG 2020 3

Intelligence based methods. Currently this is the subject of extensive exploratory

© Springer Nature Switzerland AG 2020 7

Kai Voigt and Andrea Leitner

K. Voigt () · A. Leitner

© Springer Nature Switzerland AG 2020 11

© Springer Nature Switzerland AG 2020 13

Validation Methodology Validation Platform

... other parameters Intelligent

Fig. 1 Scope of the ENABLE-S3 project

participants involved, etc.) leading to an enormous number of potential test cases.

2 Generic Test Architecture

A major goal of the ENABLE-S3 project is to firstly deliver reusable technology

2.1 Test Framework

2.1.1 Test Execution Platform

Fig. 2 Test Execution Platform in more detail

software component, as subsystem or as complete system). The ACPS control

2.1.2 Test Management

2.2 Test Data Management

Fig. 3 Test Management in more detail

Fig. 4 Test Data Management in more detail

3.1 Standardization of Scenario Descriptions

3.2 Standardization of Sensor Model Interfaces

3.3 Sustainability of Results

4 Conclusions and Future Work

verification and validation challenges to ensure safety and security of advanced

Shortly after my husband’s election, having spent a couple of

THE WHITE HOUSE AS IT LOOKED ON THE EVENING OF

We made a trip to Panama in February before the Inauguration

You might also like