Written evidence submitted by Professor Oliver Carsten (SDV0018)

1. Introduction

I am Professor of Transport Safety at the Institute for Transport Studies, University of Leeds. I am involved in research on the safety and human factors aspects of automated driving. On behalf of the European Transport Safety Council (ETSC), I participate in the international regulatory activity on automated driving at UNECE in Geneva. At UNECE, I participate in the discussions of both WP.1, the Global Forum for Road Traffic Safety, and WP.29, World Forum for Harmonization of Vehicle Regulations. WP.29 has the responsibility for the development of international vehicle regulations, and the UK is an active participant in WP.29 activities. Under WP.1. I am a member of the Informal Group of Experts on Automated Driving (IGEAD), which is particularly focused on the user and legal aspects of automated driving. Under WP.29, I participate in the meetings of GRVA, the Working Party on Automated/ Autonomous and Connected Vehicles, and the subgroups of GRVA on Functional Requirements for Automated Vehicles (FRAV) and on Validation Methods for Automated Driving (VMAD). FRAV and VMAD together share the responsibility of developing design requirements and test procedures for automation of road vehicles, with FRAV developing the requirements and VMAD developing the processes and procedures to verify that the requirements have been met, i.e. to provide those responsible for vehicle type approval with the means to decide whether a system or vehicle meets the criteria for safe use on the roads. Figure 1 shows the main working groups on automation at UNECE. In my submission, I will focus on the topic of the regulatory framework, including legal status and approval and authorization processes.

Figure 1: Main working groups on road vehicle automation at UNECE

2. Automated Lane Keeping System, the first automated driving system

With the passage of the first version of UNECE Regulation 157, the specification of the Automated Lane Keeping System (ALKS) in June 2020, the path was cleared for manufacturers to introduce for the first time vehicles with an Automated Driving System (ADS) that took over the operation of the vehicle from the human driver, with the human no longer responsible for the driving tasks but having to act as fallback from the ADS when issued a takeover request.[1] That first version of the ALKS was restricted to driving in a single lane in congested traffic on a motorway at a maximum speed of 60 km/h. In 2022, Mercedes Benz put on the market the first vehicle with this ALKS, albeit with approval for use only in Germany.[2]

In November 2021, the ALKS regulation was extended by UNECE WP.29 to cover trucks, buses and coaches.[3] In June 2022, the regulation underwent a very substantial amendment: the maximum speed permitted to an ALKS on a car or light truck was increased to 130 km/h and, as opposed to being restricted to a single lane, lane-change capability was added.[4] This new version of ALKS can thus handle virtually all motorway driving, provided that the lane lines are of sufficient quality to be interpreted and that the on-board sensors can interpret the traffic scene (e.g. not obstructed by heavy rain or snow). If those pre-conditions are not met, then the system will request the driver to take over.

Rather strangely, in view of the fact that the shift from driving in a single lane at a maximum speed of 60 km/h to multilane driving at a maximum speed of 130 km/h requires a very substantial change in capability, the new version of the ALKS regulation is rather similar to the previous one, apart from its specification of the lane change procedure. In other words, rather than recognise that the 130 km/h system has fundamentally different requirements from the 60 km/h system, the previous text has been tweaked to allow for the change in capability. In terms of the interface and interaction with the user, there has been no substantive change, so how is the user to know which version they have on their vehicle? And what are the major safety risks when performing a lane change on a motorway? One might suggest that a very risky scenario would be the approach of a motorcycle from the rear at high relative speed. The regulation stipulates that a motorcycle needs to be detected when it is in a range of 9 metres to the rear on the left or the right of the ALKS-equipped vehicle. Hardly an onerous requirement nor one that gives confidence that an ALKS system can safely change lanes on a road where a motorcycle might be traveling at a speed 20 mph faster than a car, i.e. closing on the car at a rate of 45 metres in 5 seconds.

3. The current situation on global regulation of automated driving

3.1 Parallel working groups

The work to determine the regulatory provisions for ALKS has been carried out separately from the generic work on regulations for automated driving systems, being carried out by the FRAV and VMAD subgroups under GRVA. This is completely anomalous.

A similar anomaly arises from the existence of another subgroup under GRVA: the Task Force on Advanced Driver Assistance Systems (TF-ADAS). This subgroup is currently developing a regulation for a so-called Driver Control Assistance System (DCAS).[5] The proposed DCAS is not strictly an automated driving system. Rather it provides longitudinal and lateral control of a vehicle within a lane on any road in which the driver chooses to enable it. The human driver remains responsible for the safety of vehicle operation and has to be monitor the environment and be ready to take control of steering or longitudinal control at any moment. As such, DCAS falls into the category of a Level 2 system in the SAE hierarchy (see Figure 2), where the human is assisted in vehicle operation but retains responsibility for the safety of the driving task. This is in contrast to an automated driving system where the ADS become the “driver” and has responsibility for safety.

Figure 2: The SAE levels of automation

The possibility of permitting DCAS that allow hands-off driving is currently being discussed in TF-ADAS. All fine if we can guarantee that drivers will continue to pay attention to the road scene with hands-off driving, but not at all fine if drivers perceive a hands-off DCAS as being an automated driving system on which they can rely for safe driving. Thus we need interface designs that clearly distinguish Level 2 assistance from automation at Levels 3 and above. It is very likely that future vehicles will have both types of system.

There is a vague hope that eventually the regulations will become unified, but in the meantime systems are being specified for real-world introduction via a procedure that by-passes the aspiration to create an overarching set of requirements and verification procedures for ADS. There is a reasonable case to be made that since the ALKS systems are not designed to meet the requirements being developed by FRAV and are not approved according to the procedures being developed by VMAD, their arrival on the market is premature.

The work of FRAV and VMAD is by no means complete. Indeed, GRVA has just renewed the mandates of both groups for an additional two years. Furthermore, it is not even clear that a full set of requirements and means of verification can be completed within two years, in large part because there are substantial gaps in knowledge about how to design ADS as well as substantial gaps in the capabilities of required technical systems. Some of these gaps are discussed below.

4. Gaps in knowledge or technical performance

4.1 Gap 1: Commonality of HMI

Today, when switching from one vehicle to another, the human driver does not have to re-learn how to drive the new vehicle. The layout and actions of the pedals (accelerator, brake and optionally clutch) and steering wheel are the same, the dashboard is largely similar, and even the position of the stalks for wipers and external lights is effectively standardised. Manual gearshifts and the controls for automatic transmissions have similar patterns from one vehicle to another. In other words we have commonality (high-level harmonisation) of what is termed “HMI”, Human Machine Interface, the interface between the human and the vehicle, whereby the human interacts with and controls the vehicle. That commonality has not always existed. As late as 1929, Skoda introduced a car with the brake pedal to the right of the accelerator.

With automation, there is a serious risk that we will have disharmony — myriads of different designs that create user confusion and consequently safety risks. If drivers only ever drove a single vehicle this would not be a problem, but that is not a realistic proposition. Many families have multiple vehicles, we rent cars when we go on holiday, we may drive vehicles for work, and we are moving from an environment in which we one private cars to one in which we buy mobility as a service.

In response to this challenge, there is a draft requirement from FRAV that there should be a requirement for harmonisation of HMI. The June 2022 text reads: “User interaction with and the interface of ADS features shall have a high-level commonality of design.”[6] This requirement is eminently sensible and defensible. It ensures that a user who has become accustomed to using an ADS feature on one vehicle can easily switch to using the same or similar features on another vehicle. The FRAV document goes on to specify a number of other sensible design requirements for user interaction with a vehicle equipped with an ADS.

It would be make sense for such a common design to embrace assisted as well as automated driving. In that way, user awareness of current and upcoming responsibilities would supported by the vehicle. That should help to eliminate the current problem of overtrust of L2 systems, where drivers believe they have automation on their vehicles, whereas they only have assistance and retain responsibility for safety. That this overtrust is a real safety problem has been confirmed by the investigation of several crashes conducted by the Dutch Safety Board (2019).

However, the problem is that there is no specification ready to be rolled out on how such commonality can be achieved. For human-driven cars and trucks, it took about 50 years until such commonality was attained. We cannot afford to wait that long in the case of automated vehicles. The research and development to arrive at a solution to this challenge is complex. It requires a combination of top-down (expert) initial specifications of alternative solutions and intensive work with users (user-centred design) to test those solutions and arrive at a coherent whole. No funding agency, whether from the UK or from Europe (let alone North America or Japan) has yet risen to the challenge and instigated the necessary programme of work .

4.2 Gap 2: Current state of the art of driver monitoring systems

The ALKS regulation cited in footnote 4 requires that the ADS “detect if the driver is available and in an appropriate driving position to respond to a transition demand by monitoring the driver” (paragraph 6.1.3). Availability is defined as follows: “The driver shall be deemed to be unavailable unless at least two availability criteria (e.g. input to driver-exclusive vehicle control, eye blinking, eye closure, conscious head or body movement) have individually determined that the driver is available in the last 30 seconds.” The system is required to constantly check for availability.

Following the issue of a transition demand being issued by the system, the system has to check of a driver is attentive. Paragraph 6.3.1.1 states:

“The driver is deemed to be attentive when at least one of the following criteria is met:

(a) Driver gaze direction is confirmed as primarily looking at the road ahead;

(b) Driver gaze direction is being confirmed as looking at the rear-view mirrors; or,

Both the availability and the attentiveness criteria imply that the vehicle needs to be fitted with a driver monitoring system, observing visual behaviour in addition to body position and head movement. While the criteria may appear reasonable, they ignore the phenomenon of “mind off the road” resulting from purely cognitive load, which can be induced, for example, by a hands-free mobile phone conversation or by daydreaming. With such load, the eyes are very likely to be directed at the forward roadway, but research has shown that gaze direction is very narrowly focussed (so-called visual funnelling) and visual information is not being processed (see e.g. Victor et al., 2005; Lenné et al., 2019). Unfortunately current driver monitoring technology cannot detect such narrowed gaze behaviour. This inability to detect cognitive, as opposed to visual distraction, has been confirmed by the vehicle supply industry in recent discussions on the potential of Advanced Driver Distraction Warnings Systems at the EU’s Motor Vehicles Working Group. Thus there is a real risk that an ALKS might hand over driving to a human driver who is not paying any real attention to the forward road and traffic.

4.3 Gap 3: What non-driving related activities (NDRA) should be allowed under automation?

One major point of automation is to free up the “user-in-charge” to engage in NDRA, beyond what is currently legal, and thus use the journey time productively or for enjoyment. The ALKS regulation envisages that such NDRA will be permitted and establishes that the vehicle will control what is allowed and when it is allowed. In parallel, WP.1 has been developing a resolution on “Other Activities than Driving”, which is likely to be passed at its forthcoming meeting in September.[7] The UK is one of the sponsors of the resolution. This resolution will recommend to the contracting parties of UNECE (i.e. the member states) that, in the case of an ADS being in control of the driving task, the user-in-charge should be permitted to engage in certain activities that would currently be illegal. Those activities might perhaps be working on a document, watching a video or playing a computer game. The Department for Transport has proposed that watching TV would be legal when an ADS is driving.[8]

However, we do not in fact know what activities are safe to perform in vehicles which require the human to act as fallback. A problem might arise if the human is motivated to continue an activity, even though the vehicle is demanding a takeover by that same human. From prior research, we also know that certain activities have an effect in prolonging response to a takeover request or in reducing the quality of the human’s driving following resumption of control.[9] But even with that knowledge from prior research, it not possible at the moment to make authoritative evidence-based recommendations on which activities should be permitted for driving by a Level 3 system and which activities — apart from the obvious ones of sleep or alcohol consumption — should be prohibited.

5. Conclusions

The approval now of vehicles with Level 3 driving capability, such as that afforded by the ALKS, would seem premature. There are serious doubts about whether the ALKS can perform the driving task safely at high speed and additional doubts about whether, when the system reaches its operational limits, it can safely hand over to a human driver. The UNECE regulations on requirements and validation are not complete. Finally, there is an urgent need for research and development of the HMI, which serves as the core mean of communication between vehicle and user.

References

Dutch Safety Board (2019). Who is in control? Road safety and automation in road traffic. The Hague.

Lenné, M.G., Yang, S., Wilson, K., Roady, T. and Kuo, J. (2019). The CANdrive Program: Supporting the safer introduction of Level 2 vehicle automation. Proceedings of the Australian Transport Research Forum, Canberra.

Victor, T., Harbluk, J.L. and Engström, J.A. (2005). Sensitivity of eye-movement measures to in-vehicle task diﬃculty. Transportation Research Part F, 8(2):167-190.

August 2022

Endnotes