Level Three vehicle Automation
Level Three Vehicle Automation: Challenges to Safety Submission Details Student
Kristina Morrow Email
[email protected] Telephone
(336) 693-4499
School
Florida Atlantic University Degree Program
Masters in Urban and Regional Planning
Course Title
The Future of Urban Mobility Original Submission Date
April 24, 2017
d
LEVEL THREE VEHICLE AUTOMATION
Challenges to Safety Under Conditional Automation
Abstract Under the Society of Automotive Engineers (SAE) International Standards Defining Autonomous Vehicles, Level 3 (L3) is the only automated driving system (ADS) level where monitoring of the driving environment is undertaken by the ADS but with fallback performance for dynamic driving tasks taken on by the human driver. By definition, a L3 conditional ADS poses certain challenges to safety. The Human-Machine Interface (HMI) plays an important role in facilitating a safe and seamless transfer of control from the ADS to the human driver in L3 automated driving. This research paper examines the following research question: Under what circumstances and environments can L3 automation be safe, and what are the current challenges to safety in L3 automation? The paper also proposes a microsimulation approach to examine potential safety challenges within L3 ADS by identifying environmental and roadway scenarios to consider against various HMI sensory signalizations that may assist in safe car-to-driver takeover of control.
Page 1
Level 3 Automated Vehicles: Challenges to Safety Under Conditional Automation
Introduction After decades of research and development, the automotive industry took a step into the future when adaptive cruise control—a Level 1 autonomous technology—was made available to the U.S. market in 2000 (“Finally”, 2000). Now in 2018, more sophisticated Level 3 (L3) autonomous technologies will slowing begin to infiltrate the automotive market. Audi claims the new A8, equipped with the Audi AI traffic jam pilot, is the first production car to achieve L3 autonomy (“Audi vision,” 2017). While many experts agree that automation at higher automation Level 4 and Level 5 should lend to significant increases in safety, L3 Automated Driving Systems (ADS) rely on continuous driver awareness and ability to provide technical input for certain automated driving tasks. In the case where an outside driving scenario becomes incompatible with the capabilities of the autonomous driving operating system, the human driver becomes the default fail-safe to take back control and continue performing safe operation of the vehicle. This transition of control is a critical moment in the continued safe performance of the dynamic driving task, therefore threats to safety within the constraints of L3 automation need to be carefully identified to ensure appropriate measures are taken to support a safe and seamless transition of control. The Human-Machine Interface (HMI) plays an important role in facilitating a safe and seamless transfer of control from the ADS to the human driver in autonomous vehicles. This research paper examines the following research question: Under what circumstances and environments can L3 automation be safe, and what are the current challenges to safety in L3 automation? This research report is organized as follows: this introductory section introduces the research question and scope. The next section is a literature review,
Page 2
Level 3 Automated Vehicles: Challenges to Safety Under Conditional Automation
summarizing the current state of knowledge in autonomous technology and associated safety challenges, and will be followed by a research plan & methods section to outline how further investigation of the research question could be conducted given more time and resources. By using simulation technology, various factors of the overall driving experience and HMI can be tested in a variety of driving environments, and areas of safety concern and major HMI flaws should become apparent. Finally, the conclusion section discusses lessons learned, and recommends next steps for the autonomous vehicle technology research community to advance the state of knowledge and safe implementation of autonomous vehicle technologies. Literature Review This literature review section is organized into three subsections—or key themes—related to the challenges to safety for L3 automated vehicles: the first section, Five Levels of Automation, establishes the general attributes that qualify L3 vehicle automation in comparison with the other automation levels. Following this background information, the Federal Safety Standards section establishes the acceptable baseline safety standards currently in affect by the federal government and their implications for implementing autonomous vehicles. The Human-Machine Interface (HMI) section explores and evaluates emerging technologies that may be used to avert safety hazards associated with the transfer of control from an ADS to a human driver. Then concluding discussion section will summarize what can be learned from reviewed literature, identifying what is currently known, and what remains to be unknown based on the literature reviewed.
Page 3
Level 3 Automated Vehicles: Challenges to Safety Under Conditional Automation
Five Levels of Vehicle Automation In 2013 the National Highway Transportation Safety Administration (NHTSA) provided baseline definitions for the level of function in automated vehicles. However, discrepancies over the classification of vehicle automation levels remained up until 2016, when the NHTSA abandoned the existing classification system in favor of the Society of Automotive Engineers (SAE) 2016 updated standards. Now, the primary distinction between levels of automation is based on the role of the driver, and the driver’s
responsibility
in
performing
dynamic
driving
tasks
throughout
the
engagement of a given automated system. The SAE, a professional association active in developing engineering standards, established the following table illustrating the distinctions:
SAE International J3016: Taxonomy and Definitions for Terms Related to On-Road Motor Vehicle Automated Driving Systems
Page 4
Level 3 Automated Vehicles: Challenges to Safety Under Conditional Automation
L3 automation is defined as “Conditional Automation” or “Limited Self Driving Automation”, in which all aspects of the driving mode-specific performance are executed by an automated driving system, with the expectation that “the human driver will respond appropriately to a request to intervene” (“J3016: Taxonomy”, 2014). NHTSA further details vehicles at this level of automation “enable the driver to cede full control of all safety-critical functions under certain traffic or environmental conditions (Trimble, 2014)”. The driver is expected to be able to take back control at all times. The driver would be prompted by the operating system after it identifies a situation in which the self-driving system can no longer support automation, and will then signal to the driver to reengage the driving task. This exchange of control poses safety hazards and concerns, as it requires the driver’s full attention and ability to take back control of the vehicle at any time during vehicle operation. Additionally, the subjective nature of defining an “adequate transition time” to allow the driver to respond to a request to safely retake control of the vehicle may pose a challenge. The distinction of Level 3 automation, as opposed to Level 2 automation, is that the driver is not expected to constantly monitor the roadway while the vehicle is operating under Level 3 control, which may pose difficulties and challenges to safety (Trimble, 2014). Federal Safety Standards The National Traffic and Motor Vehicle Safety Act was introduced in 1966, and codified Federal Motor Vehicle Safety Standards in 49 C.F.R Part 571, encompassing 73 standards focusing on crash avoidance, crashworthiness, and post-crash survivability (NTMVSA, 1966). These existing federal motor vehicle design standards
Page 5
Level 3 Automated Vehicles: Challenges to Safety Under Conditional Automation
and regulations pose challenges to the delivery of ADS technologies within the automotive market, particularly in the design standards. As written today, under Federal Motor Vehicle Safety Standards (1966) the presence of a human driver in a vehicle is assumed, and is defined as behind the wheel, alert, and in control of the vehicle at all times. The federal rules and standards currently do not explicitly address autonomous vehicles or situations that could potentially arise with the existence of automated technology. In fact, the interpretation of the existing standards could be subject to ambiguity with regards to automated technologies. Because the standards were written before the onset and without regard to automated vehicle technologies L3 and above, it is understandable that the implementation of these new technologies could pose unique challenges in interpreting the existing standards as it applies. In a study conducted on behalf of the U.S. Department of Transportation (USDOT, 2013) under the National Highway Traffic Safety Administration (NHTSA), a team of researchers conducted an “automated vehicle concepts scan” of the FMVSS to identify areas of concern regarding the regulations in place and potential conflicts with interpreting these standards based on existing knowledge of automated vehicle technologies. The research team developed thirteen different automated vehicle design concepts, and evaluated the FMCSS against these concepts. Overall, as long as future automated vehicle design does not significantly diverge from conventional design, there were few barriers found for automated vehicles to remain compliant with the FMVSS (Kim, 2016). However, given the anticipated safety benefits of highly autonomous vehicles, specific design and materials standards in the FMVSS may become superfluous, and as such, the ability
Page 6
Level 3 Automated Vehicles: Challenges to Safety Under Conditional Automation
to diverge from conventional vehicle construction under existing FMVSS standards could lend ADS an important competitive advantage in the automotive market by keeping costs down. Human-Machine Interface One of the major distinctions between
Level
2
and
Level
3
automation is that L3 is designed so that the driver is not expected to constantly
monitor
the
roadway
Existing dashboard control panels and integrated center consoles.
while driving, yet it is expected that the driver can take back manual control when appropriately signaled by the ADS. The most significant safety challenge currently posed by automated vehicle technology is the potential risks involved in the transfer of control from the vehicle system to the driver and vice versa. Potential mitigation of the associated hazards is possible through the use of a Human Machine Interface (HMI). After the ADS determines automation will no longer be supported, the ADS will communicate to the driver through the HMI. The HMI also serves as the dashboard, communicating real-time, essential information regarding the vehicle’s operation and conditions of the roadway. To
encourage
collaboration,
development, and use of Intelligent Transportation
Systems
(ITS)
and
related applications such as HMI, the U.S. Department of Transportation Nissan's autonomous car HMI concept includes LED indicators on the steering wheel.
Page 7
(USDOT) provides an Open-Source
Level 3 Automated Vehicles: Challenges to Safety Under Conditional Automation
Application Development Portal (OSADP). Funded by the U.S. DOT’s Intelligent Transportation Systems Joint Program Office (ITS JPO), the goal of the OSADP is to help “facilitate the advancement of research, development, planning, testing, and deployment of connected vehicles and traveler-related applications and ITS.” One of the new applications available for download on the OSADP is the Connected and Automated Speed Harmonization software. This application analyzes real-time traffic conditions to calculate and communicate speed commands for connected and automated vehicles (CAVs), with the overall goal of harmonizing traffic flow. The software includes an on-board Human Machine Interface (HMI) that would display pertinent system information to the driver such as current speed, commanded speed, confidence in the commanded speed, and the status of surrounding CAVs to the CAV driver (“The Open Source,” 2016). The HMI is an important aspect of vehicle automation as it is the point of interaction between the driver and the system, providing necessary information for the driver to feel safe and confident in the automated system. One potential HMI function is alarming through visual and/or vibrational indicators of a machine’s issue and its severity. This can improve safety levels during times when the human driver is in control by providing more information about potential hazards in the environment. Along with indicators to the human driver of a request to take back control, the HMI can also be used for ongoing monitoring of the driver’s level of attention. The NHSTA Human Factors Evaluation of Level 2 and Level 3 Automated Driving Concepts report evaluates emerging systems concepts such as driver-state sensing— or monitoring—systems as their effect on increased safety. Driver-state sensing systems provide an “active partnership” between the ADS and the human driver, and
Page 8
Level 3 Automated Vehicles: Challenges to Safety Under Conditional Automation
includes ongoing monitoring of lane-keeping stability, pedal application, steering inputs, manipulation of other controls, seating position, eye-blink rate, and gaze (on the road or off the road). This continued monitoring of the driver’s awareness and attention to the road is relayed through the HMI. One of the goals of the study was to evaluate the system performance risks associated with driver distraction, or involvement with secondary tasks, that could arise during the transition of control from the automated operating system back to the driver. The study found the significant importance of the driver having a clear understanding of active system modes, and the ability to use driver-state sensing to monitor the focus of the driver’s attention at all times. Driver monitoring technology is currently being researched and developed by several Original Equipment Manufacturers (OEMs). The study also suggests that work is underway to develop a system of intelligent filtration that the vehicle’s operating system would apply in order to avoid overloading the driver. This would result in the driver receiving and adapting to the traffic information being presented through the HMI more quickly and thus avoiding potentially unsafe reactions upon taking back control (Trimble, 2014). Discussion of Literature For the most part, safety issues with L3 automation include the issue of transfer of control, driver distraction during L3 automation, and the need for driver monitoring and intelligent filtering of information fed to the driver. Unknowns remain regarding the realities that L3 automation will have on roadway level of service, travel behavior, societal norms, and economic costs/benefits. Potentially, new technological advances can be made at any time, giving way for brand new ADAS, and therefore new challenges or benefits to safety. Investigation at this point is theoretical, with
Page 9
Level 3 Automated Vehicles: Challenges to Safety Under Conditional Automation
the exception of pilot testing, which comes with limitations and minimal generalizability. Comprehensive analysis cannot be achieved until higher quantities of Level 3 automation exist and are systematically tested in a variety of environments. Overall, the literature does give a basic understanding of the challenges to safety posed by automated vehicles through analysis of models and simulations and development of inferences; however a comprehensive list of potential needs for new vehicle safety standards and regulations based on automated vehicle technology is not yet available, and would be a necessary first step for government to be able to formalize actions in legitimizing automated vehicles and investing in infrastructure based on their existence. Research Plan & Methods This section outlines how further investigation of this topic could be made. Given more time and resources. a traffic microsimulation-based approach could be a good method for exploring the research question. According to Weignad (2011), microsimulation models can be used by engineers to “replicate individual vehicle movements on a second-by-second [or subsecond] basis to assess the traffic performance of highway and street systems.” A microsimulation model approach will allow for highly detailed analysis of the various factors that make up a complete driving experience, the effectiveness of the HMI in the transfer of control—or “handover zone”—from driver to ADS, and the associated risk outcomes given varying levels of driver attention. The simulation exercise would also include controlled simulations; each scenario would be performed with the input of Audi’s L3 Traffic Jam Pilot, a selected
Page 10
Level 3 Automated Vehicles: Challenges to Safety Under Conditional Automation
HMI mechanism, as well as without an HMI mechanism. The simulations performed without the HMI input serve as the control group, and would demonstrate the baseline risks of each driving simulation in the case of no HMI feedback being present. In order to more easily explore the risk issues, the likelihood of crashes and/or crash threats occurring could be increased based on real-world crash data averages. The following table lists the input factors used for the experiment. Each input represents a different factor, that altogether, make up a complete risk scenario. Different combinations of the inputs will be simulated, with each specific combination simulated at least 15 – 20 times for averaging purposes. Input 1: Driver Response Times The driver input will be used to simulate
Driver Attention
Input
Low
DL
Medium
DM
High
DH
various driver responses to environmental inputs as well as signals made by the HMI within the various driving situations.
Driver response times (D) will be determined based on the attention level of the driver, and separated into three categories of attention; low, medium, and high. Input 2: Vehicle Handling Performance Vehicle handling (H) performance determines how well a vehicle performs while turning, accelerating, and
Vehicle Handling
Input
breaking. Vehicle handling for the purposes of this
Below Average
HL
research plan and subsequent simulations is solely a
Average
HM
Above Average
HH
factor of the vehicle’s physical properties, including weight distribution, power delivery, aerodynamics, and
rigidity of the frame, among other physical properties. Vehicle handling performance
Page 11
Level 3 Automated Vehicles: Challenges to Safety Under Conditional Automation
will remain constant in the simulations regardless of if the driver is handling the vehicle in the control simulations, or in the automated ADAS simulations. This will allow the analysis of the simulation to understand the impact of other factors, i.e. external conditions that affect handling (weather, road conditions) on the overall findings. Input 3: Road & Environmental Conditions The road conditions input will simulate various types of roadway (i.e. highway, city, rural country, parking lot) and environmental conditions (time of day, weather, visibility) that could be potentially encountered by the driver. Roadway
Input
Weather
Input
Highway
R1
Rain
W1
City
R2
Fog
W2
Rural
R3
Snow
W3
Parking Lot
R4
Clear
W4
Visibility
Input
Time of Day
Input
Low
VL
Daytime
T1
Medium
VM
Nighttime
T2
High
VH
Dusk/Dawn
T3
Input 4: Traffic Conditions Traffic conditions will be based on the three main variables in a traffic stream as identified by the Federal Highway Authority (FHWA), and include: speed (v), density (k), and flow (q) (Lieu, 2017). Page 12
Level 3 Automated Vehicles: Challenges to Safety Under Conditional Automation
Traffic Flow
Flow (q) is the number of vehicles per
Input
Uninterrupted Flow Interrupted Flow Traffic Density
hour
q1
passing
Therefore:
q2
Input
a
reference
point.
𝑞𝑞 = 𝑘𝑘v
Density (k) is defined as the number of vehicles per unit length of the
Mean Critical Density 1 𝐴𝐴𝐴𝐴 = | | �(𝑥𝑥𝑖𝑖 ) (0 − 𝑘𝑘𝑐𝑐 ) 𝑖𝑖=1
Critical Mean Jam Density 𝐴𝐴𝐴𝐴 = |
1
�0 − 𝑘𝑘𝑗𝑗 �
| �(𝑥𝑥𝑖𝑖 ) 𝑖𝑖=1
Jam Density
roadway. The critical density (kc) is kAc kc kAj
the
maximum
achievable
under free flow (q1). The jam density (kj)
is
achievable kj
density
the
maximum
under
Spacing
(s)
distance
between
congestion
is
𝑘𝑘 =
density (q2).
center-to-center two
vehicles.
1 S
Input 5: Level 3 Advanced Driver Assistance Systems (ADAS) Audi’s L3 Traffic Jam Pilot is engaged under slow-moving traffic at up to 37 mph. The system is activated through a manual AI button located on the center consol. Audi Newsroom states the following: The traffic jam pilot handles starting from a stop, accelerating, steering and braking in its lane. Drivers no longer have to continuously monitor the car. When certain conditions are met, they can take their hands off the steering wheel for longer periods and can focus on another activity supported by the on-board infotainment system, depending on the legal situation in the Page 13
Level 3 Automated Vehicles: Challenges to Safety Under Conditional Automation
respective country. As soon as the system reaches its limits, the car requires manual driver control again. (“Audi vision,” 2017) Level 3 ADAS
Input
Audi Traffic Jam Pilot Control Group (No ADAS)
X1 X0
Input 6: Human-Machine Interface Each of the following HMI cues, including the control of no HMI cue, would first be tested in closed-circuit, real-world scenarios and be assigned an average driverresponse time to the based on a pre-determined driver attention or awareness level. HMI
Input
Visual Cues Haptic (or Tactile) Cues Directional Auditory Feedback No HMI Cue
Y1 Y2 Y3 X0
Example Scenario The table below represents example simulation scenarios that would be tested under the criteria set forth above. In the following scenario, the Audi Traffic Jam Pilot (X1) ADAS would be tested alongside varying environmental and physical conditions and compared with a Human Driver with alertness levels varying from Low (DL), Medium(DM), and High(DH). The scenario also includes a roadway type of highway (R1) with uninterrupted traffic flow (q1) but at critical traffic density (kc). Environmental conditions include medium visibility levels (VM) (possibly glare), under clear skies (W4), at dusk/dawn (T3). Various HMI cues (Y1, Y2, or Y3)— or combinations
Page 14
Level 3 Automated Vehicles: Challenges to Safety Under Conditional Automation
of cues (e.g. Y1 and Y3)—and the associated driver response time based on driver alertness (DL, DM, or DH) will be tested within the scenarios. Simulation Scenario
Driver (Alertness)
Vehicle
Road Conditions
Traffic Conditions
ADAS
HMI
1
DL
HH
R1, VM, W4, T3
q1, kc
X1
Y1
2 3 4 5 6 7 8 9 10
DL DL DH DH DH DM DM DM DM
HH HH HH HH HH HH HH HH HH
R1 , R1 , R1 , R1 , R1 , R1 , R1 , R1 , R1 ,
q1, q1, q1, q1, q1, q1, q1, q1, q1,
X1 X1 X1 X1 X1 X1 X1 X1 X1
Y2
VM , VM , VM , VM , VM , VM , VM , VM , VM ,
W4, W4, W4, W4, W4, W4, W4, W4, W4,
T3 T3 T3 T3 T3 T3 T3 T3 T3
kc kc kc kc kc kc kc kc kc
Y3 Y1 Y2 Y3 Y2, Y3 Y3 Y1, Y2 Y1, Y3
Based on the 32 unique input factors presented, there will be approximately 1,024 unique combinations of traffic microsimulations to execute. If each simulation takes an average of 11 minutes to complete, as suggested by Wiegnad (2011), this will require a total simulation time of 188 hours to complete all simulations. Each simulation will be run at least 20 times to reduce the likelihood of an outlier outcome influencing the results. This means the total amount of simulation time will be approximately 3,760 hours of simulation run time. This is about 160 days of total simulation run-time. Discussion of Anticipated Results It is expected that many of the same factors for crash occurrences in the absence of ADAS such as congested driving conditions, and poor environmental factors will remain critical causes of crashes during the use of ADAS, however, the overall frequency of simulation crashes is expected to decrease in the presence of ADAS systems, especially compared to traffic microsimulations with Driver Attention
Page 15
Level 3 Automated Vehicles: Challenges to Safety Under Conditional Automation
input levels of low (DL) or medium (DM). It is also expected that under L3 ADAS control, the overall frequency of simulation crashes occurring during the “handover period” will decrease with the presence of two or more HMI feedback cues. With the use of L3 ADAS systems during poor visibility and poor weather conditions the ideal outcome would be that crash frequency remains the same as during clear conditions, however, and differences in frequency should be good indicators to the exact driving conditions that L3 ADAS can remain appropriately safe, and which conditions can pose problems to L3 ADAS system performance, allowing for further research and changes to create a safer and more reliable Level 3 automated vehicle. Deliverables & Implementation Schedule The above research plan seeks to deliver the following outputs: -
Identification of research questions (e.g. what driving factors of Level 3 Automation impose more risks to safety?)
-
Definitions and metrics of effectiveness (e.g. % reduction/increase in fatal/injury crashes; total reduction in crashes over a period)
-
Description of the basic input factors used and tested by the simulation: driver, vehicle, road conditions, traffic flow, HMI feedback.
-
Outcomes and analysis of the simulations based on the input factors
An implementation schedule in the figure below shows the estimated schedule required to complete all activities:
Page 16
Level 3 Automated Vehicles: Challenges to Safety Under Conditional Automation
Research Schedule Deliverable Inventory of Available Data & Research Questions
Data Collection
Due Mar 3, 2017
Identify Research Questions
Due Apr 3, 2017
Deliverable Description of Metrics for Analysis
Deliverable Description of Inputs
Define Metrics
Describe Input Factors
Due Apr 24, 2017
Due Jun 1, 2017
Deliverable Inventory of Simulations Ran
Deliverable Final Analysis & Report of Findings
Simulations
Simulations
Analyze
Final report
Due Oct 1, 2017
Due Mar 1, 2018
Due May 1, 2018
Run
Conclusions and Recommendations This conclusion section discusses key lessons learned and the recommended next steps for the research community. Overall, further research and implementation of automated vehicle technology and its safety implications should be undertaken in a collaborative approach as much as possible between the public and private sectors to minimize financial risks and maximize information and knowledge dissemination throughout the industry. This research report presents three recommendations to the autonomous vehicle technology community: 1) establish a knowledge-sharing ADS network to support advancement of comprehensive and consistent ADS development, 2) continue research and technological development of ADS and the symbiosis of the HMI and reducing driver distraction in L3 ADS, and 3) revise or amend the Federal Motor Vehicle Safety Standards as applicable to autonomous vehicles such as standardization of safety-sensitive HMI features. In November 2016 the U.S. Department of Transportation sent out a Request for Proposals (RFP) for a designation of automated vehicle proving ground pilot program. Out of sixty-plus submissions, ten cities in the United States were chosen including Orlando, Florida. Efforts were led by the Central Florida Automated Vehicle Partnership (CFAVP) including the City of Orlando, University of Central Florida,
Page 17
Level 3 Automated Vehicles: Challenges to Safety Under Conditional Automation
Florida Polytechnic University, Florida Turnpike, the NASA Kennedy Space Center and other regional private and public partners. These “proving ground” cities will be the first in the nation to test automated vehicle technologies, safety, and implementation on test tracks. These proving ground cities will, unofficially, form an automated vehicle research community, which can serve as a network to share best practices that going forward, can set important precedents and provide indicators to the government as policy formation begins to take place at the national, state, and local levels. Continued research focused on the symbiotic relationship between the HumanMachine Interface and safe automated driving should be endeavored priority. While some automotive manufacturers intend to skip Level 3 altogether and focus research and development of level 4 and higher, there are important lessons to be learned in the safe operation and function of Level 3 ADS, especially as the reality of ADS entering the vehicle fleet is most likely to be a gradual shift towards higher levels of automation; this means a mix of ADS levels will likely be operating on the same roadways. Further research and modelling of the role of HMI’s in safe transitions of control in L3 ADS should continue, with the end-goal of federal standards for effective HMI systems related to communication with the human driver and driver distraction monitoring systems. Additionally, as the relationship between the HMI and safe L3 ADS operation is further investigated, federal standardization of any established safety-sensitive benefits of the HMI’s across the automotive industry will provide necessary uniformity, establishing clear roles for the human driver and realistic expectations for the ADS. By standardizing proven safety-sensitive features of the HMI, safety can be
Page 18
Level 3 Automated Vehicles: Challenges to Safety Under Conditional Automation
maximized by limiting the learning-curve involved in educating new owners of automated vehicle technologies, as driver’s education programs can be updated to include instruction on the standardized HMI features along with basic understanding of the autonomous driver tasks, particularly in the L3 ADS transfer of control phase. Resources “The Audi Vision of Autonomous Driving” Audi Newsroom. (2017, September). Audiusa.com. Federal Motor Vehicle Safety Standards 49 C.F.R Part 571 (1966). "Finally! Adaptive Cruise Control Arrives in the USA". (2000, September). Ivsource.net. Retrieved 2017-10-12. Highway Capacity Manual 2000. (2000) United States National Academy of Sciences: Transportation Research Board. J3016: Taxonomy and Definitions for Terms Related to On-Road Motor Vehicle Automated Driving Systems (Rep.). (2014). SAE International. Kim, A., Perlman, D., Bogard and Ryan Harrington, D., & Harrington, R. (2016, March). Review of Federal Motor Vehicle Safety Standards(FMVSS) for Automated Vehicles: Identifying potential barriers and challenges for the certification of automated vehicles using existing FMVSS (Rep.). Intelligent Transportation Systems Joint Program Office (ITS JPO). National Highway Traffic Safety Administration (NHTSA). U.S. Department of Transportation. https://ntl.bts.gov/lib/57000/57000/57076/Review_FMVSS_AV_Scan.pdf Lieu, H., Cunard, R., and Dr. Hani Mahmassani. "Traffic-Flow Theory". (2017, January) Transportation Research Board (TRB) Special Report 165. U.S. Department of Transportation. Federal Highway Authority (FHWA)
Page 19
Level 3 Automated Vehicles: Challenges to Safety Under Conditional Automation
“The
Open
Source
Application
Development
Portal
Adds
More
Intelligent
Transportation Systems (ITS) Applications for Download.” Communications. Office of the Assistant Secretary for Research and Technology. Intelligent Transportation
Systems
Joint
Program
Office.
U.S.
Department
of
Transportation. https://www.its.dot.gov/press/2016/osadp_download.htm Trimble, T. E., Bishop, R., Morgan, J. F., & Blanco, M. (2014, July). Human factors evaluation of level 2 and level 3 automated driving concepts: Past research, state of automation technology, and emerging system concepts. (Report No. DOT HS 812 043). Washington, DC: National Highway Traffic Safety Administration. Department of Transportation. U.S. Department of Transportation. (2013, April). Visual-Manual NHTSA Driver Distraction Guidelines for In-Vehicle Electronic Devices. (Docket No. NHTSDA2010-0053). Washington, DC: National Highway Traffic Safety Administration. Department of Transportation. Wiegnad, Jonathan D. and C.Y. David Yang. “Traffic Simulation Runs: How Many Needed?” Public Roads. U.S. Department of Transportation. Publication Number: FHWA-HRT-11-002. (Vol. 74, No. 4) January/February 2011.
Page 20
Kristina Morrow Email
[email protected] Telephone
(336) 693-4499
School
Florida Atlantic University Degree Program
Masters in Urban and Regional Planning
Course Title
The Future of Urban Mobility Original Submission Date
April 24, 2017
d
LEVEL THREE VEHICLE AUTOMATION
Challenges to Safety Under Conditional Automation
Abstract Under the Society of Automotive Engineers (SAE) International Standards Defining Autonomous Vehicles, Level 3 (L3) is the only automated driving system (ADS) level where monitoring of the driving environment is undertaken by the ADS but with fallback performance for dynamic driving tasks taken on by the human driver. By definition, a L3 conditional ADS poses certain challenges to safety. The Human-Machine Interface (HMI) plays an important role in facilitating a safe and seamless transfer of control from the ADS to the human driver in L3 automated driving. This research paper examines the following research question: Under what circumstances and environments can L3 automation be safe, and what are the current challenges to safety in L3 automation? The paper also proposes a microsimulation approach to examine potential safety challenges within L3 ADS by identifying environmental and roadway scenarios to consider against various HMI sensory signalizations that may assist in safe car-to-driver takeover of control.
Page 1
Level 3 Automated Vehicles: Challenges to Safety Under Conditional Automation
Introduction After decades of research and development, the automotive industry took a step into the future when adaptive cruise control—a Level 1 autonomous technology—was made available to the U.S. market in 2000 (“Finally”, 2000). Now in 2018, more sophisticated Level 3 (L3) autonomous technologies will slowing begin to infiltrate the automotive market. Audi claims the new A8, equipped with the Audi AI traffic jam pilot, is the first production car to achieve L3 autonomy (“Audi vision,” 2017). While many experts agree that automation at higher automation Level 4 and Level 5 should lend to significant increases in safety, L3 Automated Driving Systems (ADS) rely on continuous driver awareness and ability to provide technical input for certain automated driving tasks. In the case where an outside driving scenario becomes incompatible with the capabilities of the autonomous driving operating system, the human driver becomes the default fail-safe to take back control and continue performing safe operation of the vehicle. This transition of control is a critical moment in the continued safe performance of the dynamic driving task, therefore threats to safety within the constraints of L3 automation need to be carefully identified to ensure appropriate measures are taken to support a safe and seamless transition of control. The Human-Machine Interface (HMI) plays an important role in facilitating a safe and seamless transfer of control from the ADS to the human driver in autonomous vehicles. This research paper examines the following research question: Under what circumstances and environments can L3 automation be safe, and what are the current challenges to safety in L3 automation? This research report is organized as follows: this introductory section introduces the research question and scope. The next section is a literature review,
Page 2
Level 3 Automated Vehicles: Challenges to Safety Under Conditional Automation
summarizing the current state of knowledge in autonomous technology and associated safety challenges, and will be followed by a research plan & methods section to outline how further investigation of the research question could be conducted given more time and resources. By using simulation technology, various factors of the overall driving experience and HMI can be tested in a variety of driving environments, and areas of safety concern and major HMI flaws should become apparent. Finally, the conclusion section discusses lessons learned, and recommends next steps for the autonomous vehicle technology research community to advance the state of knowledge and safe implementation of autonomous vehicle technologies. Literature Review This literature review section is organized into three subsections—or key themes—related to the challenges to safety for L3 automated vehicles: the first section, Five Levels of Automation, establishes the general attributes that qualify L3 vehicle automation in comparison with the other automation levels. Following this background information, the Federal Safety Standards section establishes the acceptable baseline safety standards currently in affect by the federal government and their implications for implementing autonomous vehicles. The Human-Machine Interface (HMI) section explores and evaluates emerging technologies that may be used to avert safety hazards associated with the transfer of control from an ADS to a human driver. Then concluding discussion section will summarize what can be learned from reviewed literature, identifying what is currently known, and what remains to be unknown based on the literature reviewed.
Page 3
Level 3 Automated Vehicles: Challenges to Safety Under Conditional Automation
Five Levels of Vehicle Automation In 2013 the National Highway Transportation Safety Administration (NHTSA) provided baseline definitions for the level of function in automated vehicles. However, discrepancies over the classification of vehicle automation levels remained up until 2016, when the NHTSA abandoned the existing classification system in favor of the Society of Automotive Engineers (SAE) 2016 updated standards. Now, the primary distinction between levels of automation is based on the role of the driver, and the driver’s
responsibility
in
performing
dynamic
driving
tasks
throughout
the
engagement of a given automated system. The SAE, a professional association active in developing engineering standards, established the following table illustrating the distinctions:
SAE International J3016: Taxonomy and Definitions for Terms Related to On-Road Motor Vehicle Automated Driving Systems
Page 4
Level 3 Automated Vehicles: Challenges to Safety Under Conditional Automation
L3 automation is defined as “Conditional Automation” or “Limited Self Driving Automation”, in which all aspects of the driving mode-specific performance are executed by an automated driving system, with the expectation that “the human driver will respond appropriately to a request to intervene” (“J3016: Taxonomy”, 2014). NHTSA further details vehicles at this level of automation “enable the driver to cede full control of all safety-critical functions under certain traffic or environmental conditions (Trimble, 2014)”. The driver is expected to be able to take back control at all times. The driver would be prompted by the operating system after it identifies a situation in which the self-driving system can no longer support automation, and will then signal to the driver to reengage the driving task. This exchange of control poses safety hazards and concerns, as it requires the driver’s full attention and ability to take back control of the vehicle at any time during vehicle operation. Additionally, the subjective nature of defining an “adequate transition time” to allow the driver to respond to a request to safely retake control of the vehicle may pose a challenge. The distinction of Level 3 automation, as opposed to Level 2 automation, is that the driver is not expected to constantly monitor the roadway while the vehicle is operating under Level 3 control, which may pose difficulties and challenges to safety (Trimble, 2014). Federal Safety Standards The National Traffic and Motor Vehicle Safety Act was introduced in 1966, and codified Federal Motor Vehicle Safety Standards in 49 C.F.R Part 571, encompassing 73 standards focusing on crash avoidance, crashworthiness, and post-crash survivability (NTMVSA, 1966). These existing federal motor vehicle design standards
Page 5
Level 3 Automated Vehicles: Challenges to Safety Under Conditional Automation
and regulations pose challenges to the delivery of ADS technologies within the automotive market, particularly in the design standards. As written today, under Federal Motor Vehicle Safety Standards (1966) the presence of a human driver in a vehicle is assumed, and is defined as behind the wheel, alert, and in control of the vehicle at all times. The federal rules and standards currently do not explicitly address autonomous vehicles or situations that could potentially arise with the existence of automated technology. In fact, the interpretation of the existing standards could be subject to ambiguity with regards to automated technologies. Because the standards were written before the onset and without regard to automated vehicle technologies L3 and above, it is understandable that the implementation of these new technologies could pose unique challenges in interpreting the existing standards as it applies. In a study conducted on behalf of the U.S. Department of Transportation (USDOT, 2013) under the National Highway Traffic Safety Administration (NHTSA), a team of researchers conducted an “automated vehicle concepts scan” of the FMVSS to identify areas of concern regarding the regulations in place and potential conflicts with interpreting these standards based on existing knowledge of automated vehicle technologies. The research team developed thirteen different automated vehicle design concepts, and evaluated the FMCSS against these concepts. Overall, as long as future automated vehicle design does not significantly diverge from conventional design, there were few barriers found for automated vehicles to remain compliant with the FMVSS (Kim, 2016). However, given the anticipated safety benefits of highly autonomous vehicles, specific design and materials standards in the FMVSS may become superfluous, and as such, the ability
Page 6
Level 3 Automated Vehicles: Challenges to Safety Under Conditional Automation
to diverge from conventional vehicle construction under existing FMVSS standards could lend ADS an important competitive advantage in the automotive market by keeping costs down. Human-Machine Interface One of the major distinctions between
Level
2
and
Level
3
automation is that L3 is designed so that the driver is not expected to constantly
monitor
the
roadway
Existing dashboard control panels and integrated center consoles.
while driving, yet it is expected that the driver can take back manual control when appropriately signaled by the ADS. The most significant safety challenge currently posed by automated vehicle technology is the potential risks involved in the transfer of control from the vehicle system to the driver and vice versa. Potential mitigation of the associated hazards is possible through the use of a Human Machine Interface (HMI). After the ADS determines automation will no longer be supported, the ADS will communicate to the driver through the HMI. The HMI also serves as the dashboard, communicating real-time, essential information regarding the vehicle’s operation and conditions of the roadway. To
encourage
collaboration,
development, and use of Intelligent Transportation
Systems
(ITS)
and
related applications such as HMI, the U.S. Department of Transportation Nissan's autonomous car HMI concept includes LED indicators on the steering wheel.
Page 7
(USDOT) provides an Open-Source
Level 3 Automated Vehicles: Challenges to Safety Under Conditional Automation
Application Development Portal (OSADP). Funded by the U.S. DOT’s Intelligent Transportation Systems Joint Program Office (ITS JPO), the goal of the OSADP is to help “facilitate the advancement of research, development, planning, testing, and deployment of connected vehicles and traveler-related applications and ITS.” One of the new applications available for download on the OSADP is the Connected and Automated Speed Harmonization software. This application analyzes real-time traffic conditions to calculate and communicate speed commands for connected and automated vehicles (CAVs), with the overall goal of harmonizing traffic flow. The software includes an on-board Human Machine Interface (HMI) that would display pertinent system information to the driver such as current speed, commanded speed, confidence in the commanded speed, and the status of surrounding CAVs to the CAV driver (“The Open Source,” 2016). The HMI is an important aspect of vehicle automation as it is the point of interaction between the driver and the system, providing necessary information for the driver to feel safe and confident in the automated system. One potential HMI function is alarming through visual and/or vibrational indicators of a machine’s issue and its severity. This can improve safety levels during times when the human driver is in control by providing more information about potential hazards in the environment. Along with indicators to the human driver of a request to take back control, the HMI can also be used for ongoing monitoring of the driver’s level of attention. The NHSTA Human Factors Evaluation of Level 2 and Level 3 Automated Driving Concepts report evaluates emerging systems concepts such as driver-state sensing— or monitoring—systems as their effect on increased safety. Driver-state sensing systems provide an “active partnership” between the ADS and the human driver, and
Page 8
Level 3 Automated Vehicles: Challenges to Safety Under Conditional Automation
includes ongoing monitoring of lane-keeping stability, pedal application, steering inputs, manipulation of other controls, seating position, eye-blink rate, and gaze (on the road or off the road). This continued monitoring of the driver’s awareness and attention to the road is relayed through the HMI. One of the goals of the study was to evaluate the system performance risks associated with driver distraction, or involvement with secondary tasks, that could arise during the transition of control from the automated operating system back to the driver. The study found the significant importance of the driver having a clear understanding of active system modes, and the ability to use driver-state sensing to monitor the focus of the driver’s attention at all times. Driver monitoring technology is currently being researched and developed by several Original Equipment Manufacturers (OEMs). The study also suggests that work is underway to develop a system of intelligent filtration that the vehicle’s operating system would apply in order to avoid overloading the driver. This would result in the driver receiving and adapting to the traffic information being presented through the HMI more quickly and thus avoiding potentially unsafe reactions upon taking back control (Trimble, 2014). Discussion of Literature For the most part, safety issues with L3 automation include the issue of transfer of control, driver distraction during L3 automation, and the need for driver monitoring and intelligent filtering of information fed to the driver. Unknowns remain regarding the realities that L3 automation will have on roadway level of service, travel behavior, societal norms, and economic costs/benefits. Potentially, new technological advances can be made at any time, giving way for brand new ADAS, and therefore new challenges or benefits to safety. Investigation at this point is theoretical, with
Page 9
Level 3 Automated Vehicles: Challenges to Safety Under Conditional Automation
the exception of pilot testing, which comes with limitations and minimal generalizability. Comprehensive analysis cannot be achieved until higher quantities of Level 3 automation exist and are systematically tested in a variety of environments. Overall, the literature does give a basic understanding of the challenges to safety posed by automated vehicles through analysis of models and simulations and development of inferences; however a comprehensive list of potential needs for new vehicle safety standards and regulations based on automated vehicle technology is not yet available, and would be a necessary first step for government to be able to formalize actions in legitimizing automated vehicles and investing in infrastructure based on their existence. Research Plan & Methods This section outlines how further investigation of this topic could be made. Given more time and resources. a traffic microsimulation-based approach could be a good method for exploring the research question. According to Weignad (2011), microsimulation models can be used by engineers to “replicate individual vehicle movements on a second-by-second [or subsecond] basis to assess the traffic performance of highway and street systems.” A microsimulation model approach will allow for highly detailed analysis of the various factors that make up a complete driving experience, the effectiveness of the HMI in the transfer of control—or “handover zone”—from driver to ADS, and the associated risk outcomes given varying levels of driver attention. The simulation exercise would also include controlled simulations; each scenario would be performed with the input of Audi’s L3 Traffic Jam Pilot, a selected
Page 10
Level 3 Automated Vehicles: Challenges to Safety Under Conditional Automation
HMI mechanism, as well as without an HMI mechanism. The simulations performed without the HMI input serve as the control group, and would demonstrate the baseline risks of each driving simulation in the case of no HMI feedback being present. In order to more easily explore the risk issues, the likelihood of crashes and/or crash threats occurring could be increased based on real-world crash data averages. The following table lists the input factors used for the experiment. Each input represents a different factor, that altogether, make up a complete risk scenario. Different combinations of the inputs will be simulated, with each specific combination simulated at least 15 – 20 times for averaging purposes. Input 1: Driver Response Times The driver input will be used to simulate
Driver Attention
Input
Low
DL
Medium
DM
High
DH
various driver responses to environmental inputs as well as signals made by the HMI within the various driving situations.
Driver response times (D) will be determined based on the attention level of the driver, and separated into three categories of attention; low, medium, and high. Input 2: Vehicle Handling Performance Vehicle handling (H) performance determines how well a vehicle performs while turning, accelerating, and
Vehicle Handling
Input
breaking. Vehicle handling for the purposes of this
Below Average
HL
research plan and subsequent simulations is solely a
Average
HM
Above Average
HH
factor of the vehicle’s physical properties, including weight distribution, power delivery, aerodynamics, and
rigidity of the frame, among other physical properties. Vehicle handling performance
Page 11
Level 3 Automated Vehicles: Challenges to Safety Under Conditional Automation
will remain constant in the simulations regardless of if the driver is handling the vehicle in the control simulations, or in the automated ADAS simulations. This will allow the analysis of the simulation to understand the impact of other factors, i.e. external conditions that affect handling (weather, road conditions) on the overall findings. Input 3: Road & Environmental Conditions The road conditions input will simulate various types of roadway (i.e. highway, city, rural country, parking lot) and environmental conditions (time of day, weather, visibility) that could be potentially encountered by the driver. Roadway
Input
Weather
Input
Highway
R1
Rain
W1
City
R2
Fog
W2
Rural
R3
Snow
W3
Parking Lot
R4
Clear
W4
Visibility
Input
Time of Day
Input
Low
VL
Daytime
T1
Medium
VM
Nighttime
T2
High
VH
Dusk/Dawn
T3
Input 4: Traffic Conditions Traffic conditions will be based on the three main variables in a traffic stream as identified by the Federal Highway Authority (FHWA), and include: speed (v), density (k), and flow (q) (Lieu, 2017). Page 12
Level 3 Automated Vehicles: Challenges to Safety Under Conditional Automation
Traffic Flow
Flow (q) is the number of vehicles per
Input
Uninterrupted Flow Interrupted Flow Traffic Density
hour
q1
passing
Therefore:
q2
Input
a
reference
point.
𝑞𝑞 = 𝑘𝑘v
Density (k) is defined as the number of vehicles per unit length of the
Mean Critical Density 1 𝐴𝐴𝐴𝐴 = | | �(𝑥𝑥𝑖𝑖 ) (0 − 𝑘𝑘𝑐𝑐 ) 𝑖𝑖=1
Critical Mean Jam Density 𝐴𝐴𝐴𝐴 = |
1
�0 − 𝑘𝑘𝑗𝑗 �
| �(𝑥𝑥𝑖𝑖 ) 𝑖𝑖=1
Jam Density
roadway. The critical density (kc) is kAc kc kAj
the
maximum
achievable
under free flow (q1). The jam density (kj)
is
achievable kj
density
the
maximum
under
Spacing
(s)
distance
between
congestion
is
𝑘𝑘 =
density (q2).
center-to-center two
vehicles.
1 S
Input 5: Level 3 Advanced Driver Assistance Systems (ADAS) Audi’s L3 Traffic Jam Pilot is engaged under slow-moving traffic at up to 37 mph. The system is activated through a manual AI button located on the center consol. Audi Newsroom states the following: The traffic jam pilot handles starting from a stop, accelerating, steering and braking in its lane. Drivers no longer have to continuously monitor the car. When certain conditions are met, they can take their hands off the steering wheel for longer periods and can focus on another activity supported by the on-board infotainment system, depending on the legal situation in the Page 13
Level 3 Automated Vehicles: Challenges to Safety Under Conditional Automation
respective country. As soon as the system reaches its limits, the car requires manual driver control again. (“Audi vision,” 2017) Level 3 ADAS
Input
Audi Traffic Jam Pilot Control Group (No ADAS)
X1 X0
Input 6: Human-Machine Interface Each of the following HMI cues, including the control of no HMI cue, would first be tested in closed-circuit, real-world scenarios and be assigned an average driverresponse time to the based on a pre-determined driver attention or awareness level. HMI
Input
Visual Cues Haptic (or Tactile) Cues Directional Auditory Feedback No HMI Cue
Y1 Y2 Y3 X0
Example Scenario The table below represents example simulation scenarios that would be tested under the criteria set forth above. In the following scenario, the Audi Traffic Jam Pilot (X1) ADAS would be tested alongside varying environmental and physical conditions and compared with a Human Driver with alertness levels varying from Low (DL), Medium(DM), and High(DH). The scenario also includes a roadway type of highway (R1) with uninterrupted traffic flow (q1) but at critical traffic density (kc). Environmental conditions include medium visibility levels (VM) (possibly glare), under clear skies (W4), at dusk/dawn (T3). Various HMI cues (Y1, Y2, or Y3)— or combinations
Page 14
Level 3 Automated Vehicles: Challenges to Safety Under Conditional Automation
of cues (e.g. Y1 and Y3)—and the associated driver response time based on driver alertness (DL, DM, or DH) will be tested within the scenarios. Simulation Scenario
Driver (Alertness)
Vehicle
Road Conditions
Traffic Conditions
ADAS
HMI
1
DL
HH
R1, VM, W4, T3
q1, kc
X1
Y1
2 3 4 5 6 7 8 9 10
DL DL DH DH DH DM DM DM DM
HH HH HH HH HH HH HH HH HH
R1 , R1 , R1 , R1 , R1 , R1 , R1 , R1 , R1 ,
q1, q1, q1, q1, q1, q1, q1, q1, q1,
X1 X1 X1 X1 X1 X1 X1 X1 X1
Y2
VM , VM , VM , VM , VM , VM , VM , VM , VM ,
W4, W4, W4, W4, W4, W4, W4, W4, W4,
T3 T3 T3 T3 T3 T3 T3 T3 T3
kc kc kc kc kc kc kc kc kc
Y3 Y1 Y2 Y3 Y2, Y3 Y3 Y1, Y2 Y1, Y3
Based on the 32 unique input factors presented, there will be approximately 1,024 unique combinations of traffic microsimulations to execute. If each simulation takes an average of 11 minutes to complete, as suggested by Wiegnad (2011), this will require a total simulation time of 188 hours to complete all simulations. Each simulation will be run at least 20 times to reduce the likelihood of an outlier outcome influencing the results. This means the total amount of simulation time will be approximately 3,760 hours of simulation run time. This is about 160 days of total simulation run-time. Discussion of Anticipated Results It is expected that many of the same factors for crash occurrences in the absence of ADAS such as congested driving conditions, and poor environmental factors will remain critical causes of crashes during the use of ADAS, however, the overall frequency of simulation crashes is expected to decrease in the presence of ADAS systems, especially compared to traffic microsimulations with Driver Attention
Page 15
Level 3 Automated Vehicles: Challenges to Safety Under Conditional Automation
input levels of low (DL) or medium (DM). It is also expected that under L3 ADAS control, the overall frequency of simulation crashes occurring during the “handover period” will decrease with the presence of two or more HMI feedback cues. With the use of L3 ADAS systems during poor visibility and poor weather conditions the ideal outcome would be that crash frequency remains the same as during clear conditions, however, and differences in frequency should be good indicators to the exact driving conditions that L3 ADAS can remain appropriately safe, and which conditions can pose problems to L3 ADAS system performance, allowing for further research and changes to create a safer and more reliable Level 3 automated vehicle. Deliverables & Implementation Schedule The above research plan seeks to deliver the following outputs: -
Identification of research questions (e.g. what driving factors of Level 3 Automation impose more risks to safety?)
-
Definitions and metrics of effectiveness (e.g. % reduction/increase in fatal/injury crashes; total reduction in crashes over a period)
-
Description of the basic input factors used and tested by the simulation: driver, vehicle, road conditions, traffic flow, HMI feedback.
-
Outcomes and analysis of the simulations based on the input factors
An implementation schedule in the figure below shows the estimated schedule required to complete all activities:
Page 16
Level 3 Automated Vehicles: Challenges to Safety Under Conditional Automation
Research Schedule Deliverable Inventory of Available Data & Research Questions
Data Collection
Due Mar 3, 2017
Identify Research Questions
Due Apr 3, 2017
Deliverable Description of Metrics for Analysis
Deliverable Description of Inputs
Define Metrics
Describe Input Factors
Due Apr 24, 2017
Due Jun 1, 2017
Deliverable Inventory of Simulations Ran
Deliverable Final Analysis & Report of Findings
Simulations
Simulations
Analyze
Final report
Due Oct 1, 2017
Due Mar 1, 2018
Due May 1, 2018
Run
Conclusions and Recommendations This conclusion section discusses key lessons learned and the recommended next steps for the research community. Overall, further research and implementation of automated vehicle technology and its safety implications should be undertaken in a collaborative approach as much as possible between the public and private sectors to minimize financial risks and maximize information and knowledge dissemination throughout the industry. This research report presents three recommendations to the autonomous vehicle technology community: 1) establish a knowledge-sharing ADS network to support advancement of comprehensive and consistent ADS development, 2) continue research and technological development of ADS and the symbiosis of the HMI and reducing driver distraction in L3 ADS, and 3) revise or amend the Federal Motor Vehicle Safety Standards as applicable to autonomous vehicles such as standardization of safety-sensitive HMI features. In November 2016 the U.S. Department of Transportation sent out a Request for Proposals (RFP) for a designation of automated vehicle proving ground pilot program. Out of sixty-plus submissions, ten cities in the United States were chosen including Orlando, Florida. Efforts were led by the Central Florida Automated Vehicle Partnership (CFAVP) including the City of Orlando, University of Central Florida,
Page 17
Level 3 Automated Vehicles: Challenges to Safety Under Conditional Automation
Florida Polytechnic University, Florida Turnpike, the NASA Kennedy Space Center and other regional private and public partners. These “proving ground” cities will be the first in the nation to test automated vehicle technologies, safety, and implementation on test tracks. These proving ground cities will, unofficially, form an automated vehicle research community, which can serve as a network to share best practices that going forward, can set important precedents and provide indicators to the government as policy formation begins to take place at the national, state, and local levels. Continued research focused on the symbiotic relationship between the HumanMachine Interface and safe automated driving should be endeavored priority. While some automotive manufacturers intend to skip Level 3 altogether and focus research and development of level 4 and higher, there are important lessons to be learned in the safe operation and function of Level 3 ADS, especially as the reality of ADS entering the vehicle fleet is most likely to be a gradual shift towards higher levels of automation; this means a mix of ADS levels will likely be operating on the same roadways. Further research and modelling of the role of HMI’s in safe transitions of control in L3 ADS should continue, with the end-goal of federal standards for effective HMI systems related to communication with the human driver and driver distraction monitoring systems. Additionally, as the relationship between the HMI and safe L3 ADS operation is further investigated, federal standardization of any established safety-sensitive benefits of the HMI’s across the automotive industry will provide necessary uniformity, establishing clear roles for the human driver and realistic expectations for the ADS. By standardizing proven safety-sensitive features of the HMI, safety can be
Page 18
Level 3 Automated Vehicles: Challenges to Safety Under Conditional Automation
maximized by limiting the learning-curve involved in educating new owners of automated vehicle technologies, as driver’s education programs can be updated to include instruction on the standardized HMI features along with basic understanding of the autonomous driver tasks, particularly in the L3 ADS transfer of control phase. Resources “The Audi Vision of Autonomous Driving” Audi Newsroom. (2017, September). Audiusa.com. Federal Motor Vehicle Safety Standards 49 C.F.R Part 571 (1966). "Finally! Adaptive Cruise Control Arrives in the USA". (2000, September). Ivsource.net. Retrieved 2017-10-12. Highway Capacity Manual 2000. (2000) United States National Academy of Sciences: Transportation Research Board. J3016: Taxonomy and Definitions for Terms Related to On-Road Motor Vehicle Automated Driving Systems (Rep.). (2014). SAE International. Kim, A., Perlman, D., Bogard and Ryan Harrington, D., & Harrington, R. (2016, March). Review of Federal Motor Vehicle Safety Standards(FMVSS) for Automated Vehicles: Identifying potential barriers and challenges for the certification of automated vehicles using existing FMVSS (Rep.). Intelligent Transportation Systems Joint Program Office (ITS JPO). National Highway Traffic Safety Administration (NHTSA). U.S. Department of Transportation. https://ntl.bts.gov/lib/57000/57000/57076/Review_FMVSS_AV_Scan.pdf Lieu, H., Cunard, R., and Dr. Hani Mahmassani. "Traffic-Flow Theory". (2017, January) Transportation Research Board (TRB) Special Report 165. U.S. Department of Transportation. Federal Highway Authority (FHWA)
Page 19
Level 3 Automated Vehicles: Challenges to Safety Under Conditional Automation
“The
Open
Source
Application
Development
Portal
Adds
More
Intelligent
Transportation Systems (ITS) Applications for Download.” Communications. Office of the Assistant Secretary for Research and Technology. Intelligent Transportation
Systems
Joint
Program
Office.
U.S.
Department
of
Transportation. https://www.its.dot.gov/press/2016/osadp_download.htm Trimble, T. E., Bishop, R., Morgan, J. F., & Blanco, M. (2014, July). Human factors evaluation of level 2 and level 3 automated driving concepts: Past research, state of automation technology, and emerging system concepts. (Report No. DOT HS 812 043). Washington, DC: National Highway Traffic Safety Administration. Department of Transportation. U.S. Department of Transportation. (2013, April). Visual-Manual NHTSA Driver Distraction Guidelines for In-Vehicle Electronic Devices. (Docket No. NHTSDA2010-0053). Washington, DC: National Highway Traffic Safety Administration. Department of Transportation. Wiegnad, Jonathan D. and C.Y. David Yang. “Traffic Simulation Runs: How Many Needed?” Public Roads. U.S. Department of Transportation. Publication Number: FHWA-HRT-11-002. (Vol. 74, No. 4) January/February 2011.
Page 20
