In safety-critical domains such as autonomous driving, systems must be evaluated across a large number of environment conditions, often represented as composite scenarios built from primitive scenarios. Existing statistical model checking (SMC) approaches analyze each composite scenario independently, requiring many expensive simulations and resulting in substantial redundant computation when scenarios share common structure. This work introduces a scenario-based compositional SMC framework for safety and co-safety specifications, enabling efficient analysis of composite scenarios. Our approach decomposes scenarios into primitives and specifications into sub-specifications, verifies each primitive independently, and composes the resulting statistical estimates using importance sampling and kernel density estimation. Our empirical evaluation shows that the proposed framework can accurately answer verification queries for previously unseen composite scenarios while reducing simulation cost through parallelization and trace reuse.
Figures & tables
((a))
((b))
((c))
((d))
Scenario
Monolithic SMC (baseline)
Compositional SMC (ours)
Δ
S → X
0.6750
0.7074
+0.0324
S → X → S
0.6520
0.6898
+0.0378
S → O → C
0.4310
0.4740
+0.0430
C → S → X → S
0.5670
0.6206
+0.0536
C → X → S → X → C
0.3820
0.3819
−0.0001
S → choose ( C , X , O )
0.9800
0.9584
−0.0216
Table 1 : Estimated satisfaction probabilities for the Tollgate specification under the fixed-trace-budget regime.
Figure 2 : Fixed-time-budget convergence for the V-Shaped specification on the C → S → X → S scenario. 753 monolithic and 14871 compositional traces generated within the 15-minute budget.
Appendix figures & tables41 assets
Supplementary material from the paper’s appendix.
Appendix
Figure 3 : Safety and co-safety specifications used in the experiments. Here v is the vehicle speed (m/s) and δ the steering angle; doubly circled states are accepting, q0 is the initial state, and ∗ marks a self-loop on any symbol.
Scenario
Monolithic
Compositional
Δ
2-Stop (safety)
S → X
0.6650
0.6712
+0.0062
S → X → S
0.6000
0.6700
+0.0700
S → O → C
0.3890
0.4511
+0.0621
C → S → X → S
0.5380
0.6156
+0.0776
C → X → S → X → C
0.3550
0.3849
+0.0299
Appendix
Table 2 : Estimated satisfaction probabilities for the monolithic baseline and our compositional method under the fixed-budget regime described in Section 4.1 . Δ denotes the compositional estimate minus the monolithic estimate.
Monolithic
Compositional
Scenario
N
ρ
N
ρ
Δ
Two-stop (safety)
S → X
2347
0.6412
12262
0.6558
+0.0146
S → X → S
1618
0.6057
12262
0.6533
+0.0476
S → O → C
788
0.3820
12335
0.4410
+0.0590
C → S → X → S
753
0.5618
14871
0.5892
+0.0275
Appendix
Table 3 : 15-minute time-budget results. ρ is the satisfaction probability estimate; N is the number of traces generated; Δ denotes the compositional estimate minus the monolithic estimate.
((a))
((b))
((c))
((d))
((e))
((f))
((g))
((a))
((b))
((c))
((d))
((e))
((f))
((g))
((a))
((b))
((c))
((d))
((e))
((f))
((g))
((a))
((b))
((c))
((d))
((e))
((f))
((g))
Monolithic
Compositional
Scenario
N
ρ
N
ρ
Δ
Two-stop (safety)
S → choose ( C , X , O )
188
0.9734
1161
0.9503
−0.0231
S → shuffle ( C , X , O )
76
0.9211
1161
0.8795
−0.0415
Tollgate (safety)
S → choose ( C , X , O )
188
0.9787
1161
0.9568
−0.0219
Appendix
Table 4 : 60-minute time-budget results on the choose / shuffle scenarios. ρ is the satisfaction probability estimate; N is the number of traces generated; Δ denotes the compositional estimate minus the monolithic estimate.
((a))
((b))
((c))
((d))
((e))
((f))
((g))
((h))
Monolithic
Compositional (matched)
Scenario
N
ρ
N
ρ
Δ
Two-stop (safety)
S → X
2347
0.6412
3064
0.6482
+0.0070
S → X → S
1618
0.6057
3064
0.6459
+0.0402
S → O → C
788
0.3820
3082
0.4617
+0.0797
C → S → X → S
753
0.5618
3716
0.5781
+0.0163
Appendix
Table 5 : Compute-matched ablation. ρ is the satisfaction probability estimate; N is the number of traces generated; Δ denotes the compositional estimate minus the monolithic estimate.
The rapid advancement of autonomous driving (AD) technologies has outpaced the development of robust safety evaluation methods. Conventional testing relies on exposing AD systems to vast numbers of real-world traffic scenes -- a brute-force approach that is prohibitively expensive and statistically ineffective at capturing the rare, safety-critical edge cases essential for validating real-world robustness. To address this fundamental limitation, we introduce STRELGen, a scalable framework for the targeted generation of safety-critical driving scenarios. STRELGen synergistically combines a multi-agent trajectory-generation diffusion model (DM) with Spatio-Temporal Logic (STREL) specifications that encode complex safety and realism properties through a highly interpretable formalism. Crucially, monitoring satisfaction levels of these specifications is differentiable, enabling gradient-based search. At inference time, we optimize directly over the DM latent space to maximize STREL formula satisfaction. The result is efficient generation of highly plausible yet safety-critical multi-agent scenarios that lie within the learned data distribution. STRELGen thus provides a flexible, interpretable, and powerful tool for stress-testing autonomous driving systems, moving beyond the limitations of brute-force data collection.
Lorenzo Bonin, Francesco Giacomarra, Luca Bortolussi +2
University of Trieste · University of Southern California
Autonomous vehicles (AVs) require extensive testing in simulation, but test case generation for driving scenarios is laborious. The desired scenarios are often out-of-distribution and have precise requirements on interactions with the AV policy under test. Manually programming scenarios allows for precise controllability but is difficult to scale. On the other hand, statistical models can leverage compute and data, but struggle with precise controllability when out-of-distribution. We cast scenario orchestration as a constraint-solving problem and present a language-in, simulation-out scenario orchestrator for closed-loop testing AVs. Our approach leverages foundation model reasoning to translate general, natural language descriptions into a set of constraints as a scenario representation. This then allows us to leverage off the shelf solvers to solve for actor behaviors which meet precise testing intentions in closed-loop. Under a benchmark of carefully crafted and diverse scenario descriptions, our approach greatly outperforms our baselines in orchestration success rate. We further show that our closed-loop approach is especially important for scenarios which require ego-reactive specifications.
Motion planning for autonomous driving must account for multi-modal uncertainty in both the intentions and trajectories of surrounding vehicles. Handling uncertainty in a worst-case manner guarantees robustness but often leads to excessive conservatism. Stochastic Model Predictive Control (SMPC) reduces trajectory-level conservatism through chance constraints, yet remains conservative with respect to intention uncertainty since constraints must hold across all intentions. We present a novel combination of SMPC and the branching structure, enabling the planner to generate distinct trajectories for different possible intentions while maintaining safety under trajectory uncertainty. A novel scenario clustering is proposed to merge prediction scenarios based on high-level decision similarity, thereby ensuring real-time tractability. Furthermore, an adaptive branching-time computation postpones commitment to separate plans until intention uncertainty is sufficiently reduced. Simulation studies in challenging highway scenarios demonstrate that the proposed method improves safety, reduces conservatism, and achieves real-time computational performance.
Zekun Xing, Ramkrishna Chaudhari, Marion Leibold +2
Chair of Automatic Control Engineering, Technical University of Munich, Arcisstr. 21, 80333 Munich, Germany