A Fail-Sa e Decision A chi ec u e
o CCAM Applica ions
Ma io Rod ´ıguez-A ozamena1,4(B), Jose Ma u e1, Joshu´e P´e ez1,
Bu cu Ozbay2, De yanu Tezcan2, Enes Begeca slan2, I em Mu lukaya
2,
Ke in Gomez Buque in3,5, Tina Volke sdo e 3,6, and Hans-Joachim Ho 3
1TECNALIA Resea ch and Inno a ion, Basque Resea ch and T echnology Alliance,
De io, Spain
{ma io. od iguez,joseangel.ma u e,joshue.pe ez}@ ecnalia.com
2 FEV T¨u kiye, Is anbul, T ¨u kiye
{oezbay, ezcan,begeca slan,mu lukaya}@ e .com
3 Technische Hochschule Ingols ad , CARISSMA Ins i u e o Elec ic, Connec ed and
Secu e Mobili y (C-ECOS), Ingols ad , Ge many
{ke in.gomez, ina. olke sdo e }@ca issma.eu, [email p o ec ed]
4 Uni e si y o he Basque Coun y (UPV/EHU), Bilbao, Spain
5 F ied ich-Alexande -Uni e si ¨a E langen-N¨u nbe g, E langen, Ge man y
6Uni e si ¨a Passau, Passau, Ge many
Abs ac . In he con ex o Connec ed, Coope a i e, and Au oma ed
Mobili y (CCAM), p ecise ego- ehicle posi ioning and en i onmen al s a-
us assessmen a e c ucial. Howe e , hese asks can be suscep ible o
senso ailu es, misuse, and cybe a acks. Au oma ion disengagemen s
and sys em edundancy a e common s a egies o achie e Minim um
Risk Condi ions when ailu es occu . This pape p esen s a Fail-Sa e
decision a chi ec u e o mula ed wi hin he amewo k o he SELFY
p ojec (h ps://sel y-p ojec .eu/). The main aim is o educe inaccu-
acies in GNSS-de i ed posi ioning h ough he inco po a ion o senso
usion, AI-guided si ua ional assessmen , ajec o y planning, and mode
decision componen s. Addi ionally, he a chi ec u e has been designed
o enable eal- ime upda es and communica ion wi h ex e nal en i ies,
including he Vehicle Secu i y Ope a ions Cen e.
Keywo ds: CCAM · Fail-Sa e · Fallback S a egy · Si ua ional
Awa eness · Decision ·U ban Scena ios
1 In oduc ion
Ad anced D i e Assis ance Sys ems (ADAS) and Au oma ed D i ing Sys ems
(ADS) ha e enhanced comme cial ehicle sa e y in ecen yea s. Howe e , accu-
a e localisa ion emains a c i ical challenge o Au oma ed Vehicles (AVs) in
u ban e n i onmen s, necessi a ing u he esea ch. Mos sys ems ely on edun-
dancy o disengagemen in case o ailu es o isk mi iga ion [1].
c The Au ho (s) 2026
C. McNally e al. (Eds.): TRAcon e ence 2024, LNMOB, pp. 731–737, 2026.
h ps://doi.o g/10.1007/978-3-032-06763-0_104
732 M. Rod ´ıguez-A ozamena e al.
The la es Eu opean Commission epo s emphasize key de elopmen s in
communica ion, cybe -secu i y, onboa d senso s, in as uc u e, mobili y con-
cep s, and ci y con ex s o u ban anspo a ion [2, 3]. ADAS and ADS employ
a ious senso s, including came as, Global Posi ioning Sys em (GPS), and Ligh
and Radio De ec ion and Ranging (LiDAR and RaDAR), o en i onmen al
pe cep ion. Pe cep ion asks a e c i ical o inc easing au oma ion in AVs de el-
opmen s, as en i onmen ecogni ion mus be assu ed in any scena io. Mo eo e ,
hei ailu e- ole an ope a ion du ing au oma ed mode is c ucial o ensu e pas-
senge sa e y, pa icula ly in eme gencies [4].
Some au ho s ha e conside ed senso da a usion o enhance pe o mance
obus ness in diffe en con ex s, including he pe cep ion o he en i onmen
[5], localiza ion [6, 7], and affic sign de ec ion and ecogni ion [8]. A de ailed
desc ip ion o he mos popula me hods and echniques o pe o ming da a
usion has been explo ed. The au ho s conclude ha he app op ia e echnique
o be implemen ed depends on en i onmen al condi ions [9]. Fo example, he
mos widely used global localiza ion app oaches in ol e global na iga ion sa el-
li e sys ems. Howe e , hese sys ems ha e limi a ions in u ban en i onmen s due
o signal blockage o mul ipa h effec s. As a esul , al e na i e localiza ion ech-
niques ha e been e alua ed o add ess hese limi a ions and imp o e pe o mance
in u ban en i onmen s.
Resea ch and de elopmen effo s a e unde way o de e mine when a ehicle
should swi ch o aul - ole an ope a ion. The SELFY p ojec [10] ocuses on
ini ia ing his p ocess, ei he h ough ex e nal commands (e.g., Vehicle Secu-
i y Ope a ions Cen e) o by p ocessing ehicle and in as uc u e da a (e.g.,
Vehicle- o-E e y hing messages). The nex s ep in ol es selec ing a sui able all-
back s a egy, conside ing po en ial ailu es caused by mal unc ioning sys ems
(e.g., elec ic o elec onic de ices), pe o mance limi a ions, and misuse (e.g.,
senso limi a ions, algo i hm ailu es, use e o s due o o e load o con usion).
Ul ima ely, he esul ing aul - ole an mode defines he sys em’s capabili ies
[11].
This wo k p esen s a ail-sa e decision a chi ec u e o posi ioning ailu es o
au oma ed ehicles in u ban scena ios. This a chi ec u e is based on he ame-
wo k o he E U-SELFY p ojec , which aims o inc ease AVs sa e y, secu i y,
obus ness, and esilience.
2 Fail-Sa e Decision A chi ec u e in he SELFY P ojec
The p oposed a chi ec u e, depic ed in Fig. 1, is pa o he Coope a i e
Resilience and Healing Sys em (CRHS) Toolbox, which includes ools ha elici
sel -p o ec ion ac ions whene e a comp omised si ua ion is de ec ed in ela ion
o asse s, ehicles, ope a ions, o he sys em i sel . These ac ions can be aken
locally, o in c oope a ion wi h o he ools in hei en i onmen so ha decisions
can be aken a he global Connec ed, Coope a i e, and Au oma ed Mobili y
(CCAM) le el.
O e all, he a chi ec u e consis s o ou sepa a e componen s, including posi-
ioning, si ua ion assessmen , sa e y mode decision, and pa h planning. The
A Fail-Sa e Decision A chi ec u e o CCAM Applica ions 733
a chi ec u e uns in pa allel wi h he no mal pe cep ion and decision modules
and o e w i es he pa h compu ed by he no mal pa h planne when a l ocalisa-
ion ailu e occu s. I can also ecei e and send s a us in o ma ion o ex e nal
en i ies.
Fig. 1. Fail-Sa e Decision A chi ec u e in he S ELFY P ojec
2.1 Fallback Posi ioning Sys em
This componen in he global a chi ec u e p o ides an al e na i e solu ion o
localiza ion when he p ima y sou ce, ypically he Global Na iga ion Sa elli e
Sys em (GNSS), ails. I offe s pose and wis es ima ions wi h co a iance bu is
less p ecise. This solu ion is conside ed deg aded bu eliable enough o secu e
ehicle ope a ion o se e al seconds.
The module elies on he Ex ended Kalman Fil e (EKF), which blends he
kinema ic bicycle model o he ehicle wi h ex e nal localiza ion sou ces, includ-
ing he deg aded GNSS signal wi h Ine ial Measu emen Uni (IMU) compensa-
ion, coope a i e pe cep ion ia Vehicle- o-X (V2X), and landma k-based local-
iza ion me hods. Mahalanobis ga es a e employed o ejec he senso and ex e -
nal localiza ion sou ces ha a e mo e dis an han he Mahalanobis dis ance
wi h he kinema ic bicycle model. The posi ioning sys em is an adap a ion o
he Au owa e EKF localize [12], which in ol es amendmen s o he ehicle
mo del and he localiza ion sou ces.
2.2 Si ua ional Assessmen Module
The Si ua ional Assessmen Module compa es he en i onmen model ( used
om RSU and on-boa d ehicle senso da a), CAN messages om he ego ehi-
cle, Coope a i e Awa eness Messages (CAM), analyses hese da a by using A i-
ficial In elligence-based me hods o de ec anomalies, misuse, mal unc ions, e c.,
734 M. Rod ´ıguez-A ozamena e al.
and decides he isk le el o he cu en si ua ion. The isk in o ma ion is p o-
ided o he Sa e y Mode Decision Module.
A me hod based on dis ance es ima ion was de eloped o p e en GNSS loss
o GNSS spoofing. Fo his me hod, la i ude and longi ude da a om GNSS,
speed and s ee ing da a om CAN, and o wa d accele a ion da a om IMU
we e used. These da a we e ob ained by simula ion d i ing i n Ca la and o
calcula e he dis ance be ween he wo ime in e als, he Ha e sine g ea ci cle
o mula, which calcula es wi h la i ude and longi ude in o ma ion, was used.
A Long Sho -Te m Memo y (LSTM) model, which is a ype o RNN, was
used o es ima e he dis ance. Since ou algo i hm is a sequence p edic ion p ob-
lem, a LSTM is a p ope model because o i s capabili y o lea ning long- e m
dependencies. Speed, s ee ing angle and o wa d accele a ion we e used as inpu
da a o ain he LSTM. The ou pu is he dis ance be ween wo ime in e als.
A e comple ing he aining on he LSTM model, a fine- uning ope a ion was
pe o med o enhance i s pe o mance and achie e highe accu acy. In pu sui o
ob aining close p edic ions and imp o ing i s capabili ies, addi ional 2 hidden
laye s we e added o he model a chi ec u e. By implemen ing hese measu es,
he aim is o enhance he sys em’s accu acy and pe o mance by imp o ing i s
capaci y o cap u e in ica e ela ionships. Following he fine- uning ope a ion,
i was obse ed ha he p edic ed dis ance alues con e ged owa ds he ac ual
alues and an enhancemen in accu acy was achie ed. A e he dis ance es i-
ma ion is comple ed, a h eshold dis ance alue is se acco ding o he ehicle’s
capaci y and he e o alues in he GNSS signal. When he es ima ed alue
exceeds his h eshold alue, GNSS loss o spoofing is de ec ed.
In addi ion o he LSTM model de elopmen , an inno a i e app oach in ol -
ing da a manipula ion echniques was used o u he imp o e he model’s
obus ness and anomaly de ec ion capabili ies. To simula e a ious anomaly sce-
na ios, a cus om unc ion ha in oduces anomalies in o he da ase by pe u b-
ing he GNSS la i ude and longi ude coo dina es, c ea ing inconsis en sp eed
o accele a ion alues, and gene a ing ou lie s in s ee ing angle and speed was
de eloped. These anomalies co e possible GNSS hacking, spoofing, o signal
deg ada ion scena ios.
A p elimina y NN model was ained and designed as a bina y classifie ha
aims o p edic whe he a gi en sample is no mal o manipula ed acco ding o
he p o ided ea u es. While he simplici y o he neu al ne wo k may limi i s
p edic i e capabili ies, i s ill p o ides aluable insigh in o he o e all impac o
he da a manipula ion echniques. The success ul diffe en ia ion o he NN model
be ween no mal and manipula ed da a encou ages us o use i o efine and fine-
une he LSTM model o ad anced anomaly de ec ion, ul ima ely leading o a
mo e sophis ica ed and accu a e GNSS anomaly de ec ion solu ion.
2.3 Sa e y Mode Decision Module
The Sa e y Mode Decision Module selec s he mos sui able ope a ion mode
acco ding o he en i onmen al ci cums ances and he ego- ehicle s a us. The
algo i hm is capable o swi ching be ween h ee modes o ope a ion, including
A Fail-Sa e Decision A chi ec u e o CCAM Applica ions 735
No mal Ope a ion, Fail-Sa e Ope a ion, and To al Failu e - S op. When engaged,
he Fail-Sa e Ope a ion guides he ehicle owa ds a sa e s a e, which may no
always equi e an immedia e s op. Depending on he si ua ion and he a ailabil-
i y o a sui able s op loca ion nea by, he ehicle migh ha e o con inue d i ing
o a b ie pe iod.
The algo i hm is based on Fuzzy logic, conside ing a ious ac o s, includ-
ing he isk e alua ion om he Si ua ional Assessmen Module, median con ol
e o s, GNSS signal s a us, su ounding agen de ec ion, and localiza ion co a i-
ance. Ex e nal en i ies can also igge he a ailable modes, and he module can
p o ide pe iodic upda es o hese en i ies.
Vehicle Secu i y Ope a ions Cen e. One en i y ha u he u ilizes he
in o ma ion om he ail-sa e decision a chi ec u e is a Vehicle Secu i y Ope -
a ions Cen e (VSOC). Besides communica ion be ween ca s and exchanging
sa e y modes and isks, a VSOC can u he u ilize his da a. A VSOC is espon-
sible o collec ing da a om a ious sou ces wi hin an en i onmen . In he case
o he SELFY p ojec , he VSOC collec s da a om he CCAM, e.g., includ-
ing all ools wi hin he SELFY oolbox and OEMs o hi d-pa y se ices (e.g.,
h ea in elligence p o ide s and ulne abili y da abases). This o e iew allows
he SELFY VSOC o pic u e he e en s wi hin he SELFY ecosys em comp e-
hensi ely. As a esul , de ec ing ulne abili ies, anomalies, and cybe -secu i y
inciden s becomes easible. The VSOC u ilizes he in o ma ion om he sa e y
ope a ional ools o define isk alues o he ehicle o a g oup o ehicles. Dis-
ibu ing he isk alue can u he inc ease knowledge be ween pa icipan s o
he CCAM ecosys em. Implemen ing dedica ed poin - o-poin communica ion
me hods is ime-consuming and complex wi h all he echnologies p esen in
mode n ehicles and hei ecosys ems. I he VSOC dis ibu es his knowledge, a
mo e open knowledge-sha ing me hodology is achie ed. Only some pa icipan s
need o implemen a connec ion o o he pa icipan s. Ins ead, a connec ion
o he VSOC allows he ools o send ele an da a o he VSOC and ecei e
en iched in o ma ion om i .
2.4 Fail-Sa e T ajec o y Planning
The las componen in he a chi ec u e handles Minimum Risk Manoeu e cal-
cula ions. U ilizing eme gency ehicle localiza ion om he Fallback Posi ioning
Sys em, along wi h he posi ions o su ounding agen s like ehicles and oad
use s, as well as he ini ially planned ajec o y and lane map da a, i con inu-
ously compu es he minimum isk manoeu e. This new pa h is execu ed only
when he Fail-Sa e Ope a ion is ac i a ed wi hin he Sa e y Mode Decision Mod-
ule. Unde No mal Ope a ion, he final pa h adhe es o he o iginally planned
ajec o y.
The ul ima e goal du ing Fail-Sa e Ope a ion is o pe o m a con olled s op
a a sui able loca ion, bu his may no always be possible immedia ely. Longi-
udinally, he speed is educed wi hin he legal limi s o he oad. La e ally, he
736 M. Rod ´ıguez-A ozamena e al.
calcula ed pa h is capable o lane changes, o e aking, and eme gency s ops, bu
la ge sa e y ma gins a e buil -in and sa e y is gi en p io i y o e com o .
Acknowledgemen s.
This esea ch has been unded by he Eu opean Union, h ough he Ho izon Eu ope
T anspo p og amme, unde g an ag eemen No. 101069748 - SELFY p ojec . Views
and opinions exp essed a e howe e hose o he au ho (s) only and d o no necessa ily
eflec hose o he Eu opean Union o he Eu opean Clima e, In as uc u e and En i-
onmen Execu i e Agency (CINEA). Nei he he Eu opean Union no he g an ing
au ho i y can be held esponsible o hem.
Re e ences
1. Sa i, B.: Fail-ope a ional sa e y a chi ec u e o ADAS/AD sys ems. In: Fail-
ope a ional Sa e y A chi ec u e o ADAS/AD Sys ems and a Model-d i en App-
oach o Dependen Failu e Analysis. WRFUS, pp. 31–75. Sp inge , Wiesbaden
(2020). h ps://doi.o g/10.1007/978-3-658-29422-9 3
2. Eshe u, A.A., Valilai, O.F., Wicaksono, H.: Eu opean CCAM Ou look 2023: a
e iew o CCAM ad ancemen s and applica ions in Eu ope’s public anspo sec-
o (2023)
3. Eu opean Clima e In as uc u e and En i onmen Execu i e Agency (CINEA).
Towa ds coope a i e, connec ed and au oma ed mobili y: Con ibu ions o ho izon
Eu ope p ojec s managed by CINEA (2023)
4. Tho n, E., Kimmel, S.C., Chaka, M.: A amewo k o au oma ed d i ing sys em
es able cases and scena ios (2018)
5. Fayyad, J., Ja ada , M.A., G uye , D., Najja an, H.: Deep lea ning senso usion
o au onomous ehicle pe cep ion and localiza ion: a e iew. Senso s 20(15), 4220
(2020)
6. Ma u e, J., Rod iguez-A ozamena, M., Pe ez, J., Ka imoddini, A.: Senso usion-
based localiza ion amewo k o au onomous ehicles in u al o es ed en i on-
men s. In: I EEE 26 h In e na ional Con e ence on In elligen T anspo a ion Sys-
ems (ITSC) (2023)
7. Meng, X., Wang, H., Liu, B.: A obus ehicle localiza ion app oach based on
GNSS/IMU/DMI/LIDAR senso usion o au onomous ehicles. Senso s (Swi ze -
land) 17(9), 2140 (2017)
8. Saadna, Y., Behloul, A.: An o e iew o affic sign de ec ion and classifica ion
me hods. In . J. Mul imedia In . Re ie al 6(3), 193–210 (2017). h ps://doi.o g/
10.1007/s13735-017-0129-8
9. Yeong, D.J., Velasco-He nandez, G., Ba y, J., Walsh, J.: Senso and senso usion
ec hnology in au onomous ehicles: a e iew. Senso s 21, 1–37 (2021)
10. SELFY EU P ojec : Sel assessmen , p o ec ion & healing ools o a us wo hy
and esilien CCAM (2022). h ps://sel y-p ojec .eu/
11. S ol e, T., e al.: Taxonomy o uni y aul ole ance egimes o au omo i e sys ems:
defining ail-ope a ional, ail-deg aded, a nd ail-sa e. IEEE T ans. In ell. Veh. 7(2),
251–262 (2021)
12. Au owa e: Au owa e uni e se (2023). h ps://gi hub.com/au owa e ounda ion/
au owa e.uni e se. Accessed 23 Aug 2023
A Fail-Sa e Decision A chi ec u e o CCAM Applica ions 737
Open Access This chap e is licensed unde he e ms o he C ea i e C ommons
A ibu ion 4.0 In e na ional License (h p://c ea i ecommons.o g/licenses/by/4.0/),
which pe mi s use, sha ing, adap a ion, dis ibu ion and ep oduc ion in any medium
o o ma , as long as you gi e app op ia e c edi o he o iginal au ho (s) and he
sou ce, p o ide a link o he C ea i e Commons license and indica e i changes we e
made.
The images o o he hi d pa y ma e ial in his chap e a e included in he
chap e ’s C ea i e Commons license, unless indica ed o he wise in a c edi line o he
ma e ial. I ma e ial is no included in he chap e ’s C ea i e Commons license and
you in ended use is no pe mi ed by s a u o y egula ion o exceeds he pe mi ed
use, you will need o ob ain pe mission di ec ly om he copy igh holde .
