Towards Road Transport Automation: Opportunities in Public-Private Collaboration (2015)

Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

40 APPENDIX A: COMMISSIONED WHITE PAPER 1 Road Transport Automation as a Public–Private Enterprise Steven E. Shladover, University of California, Berkeley, USA Richard Bishop, Bishop Consulting, Granite, Maryland, USA The aim of this white paper is to set the scene for discussions at the EU-U.S. symposium on auto-mated vehicles on April 14–15, 2015, in Washing- ton, D.C. The symposium will discuss the most critical issues that need to be resolved in the coming years in road transport automation and will identify areas in which collaborative research can address these issues. Road transport, as our primary means of transport, facilitates our mobility and lifestyle while also causing major impacts in urban areas and our daily life via air pol- lution, road crashes, and traffic congestion. Experience shows that we cannot solve the issue simply by building new road infrastructure or extending the existing infra- structure. Intelligent transportation systems (ITS) have proven to be effective tools for improving mobility for people and goods. Successful implementation of such technology requires effective integration with policy. The domain of automated road transport technology encompasses passenger cars, public transport vehicles, and urban and interurban freight transport. The field of development and deployment of vehicle automation is quite active, with current developments aiming to pro- vide driver support in the form of conditional and partial automation. Although drivers’ attention and interven- tion are currently required, in the long run, the aim of development is toward fully automated vehicles, which hold the potential to enable us to redesign the transport system, our cities, and the way we live. This paper addresses road transport automation as a public–private enterprise first by introducing the diversity of the different automation concepts, that is, the different goals set for automation, the relative roles of driver and automation systems of different levels of automation, and the complexity of the various operating environments. Next, the state of the art and state of the market are elaborated, including infrastructure support considerations; that section is followed by a discussion of the organizational framework for automation. As background for the symposium discussions, this paper reviews the maturity of technology with regard to wireless communications, localization, human factors, fault handling, cybersecurity, environmental perception, software safety, ethical considerations in computer con- trol, and research opportunities. An assessment of non- technological issues covers public policy, legal issues, vehicle certification and licensing, public acceptance, insurance, and benefits and impacts. Business models and the roles of the public as well as private sector are discussed. Private vehicles and public road infrastruc- ture, types and levels of infrastructure support, road- way infrastructure deployment, and business models for financing infrastructure improvements are addressed. The paper concludes with a discussion of key research and policy issues that could be fruitful topics for EU-U.S. cooperative activities. 1 Diversity of roaD transPort automation ConCePts of oPeration When considering road transport automation topics, we need to begin with explicit recognition of the great diver- sity of automation concepts of operation. This diversity of concepts is often an impediment to understanding

41A P P E N D I X A : C O M M I S S I O N E D W H I T E P A P E R 1 because unless one precisely articulates the concept under consideration, it is likely that another person will be envisioning a different concept. This diversity also limits the validity of any broad generalizations about automation; something that is true about one form of automation may be completely inapplicable to another. For the purpose of framing the discussion here, it is useful to think about road transport automation systems in three dimensions: (a) the types of goals the system is designed to serve, (b) the relative roles of the driver and system in vehicle operation, and (c) the complexity of the operating environment. 1.1 System Goals Road transport automation systems are not ends in themselves but are means of satisfying needs to improve transportation operations or drivers’ individual com- fort and convenience. Specific systems will be designed to achieve different goals, and those different goals are likely to point toward very different designs. These goals could include combinations of 1. Enhancing driving comfort and convenience, 2. Improving quality of life by freeing up time hereto- fore consumed by driving, 3. Reducing vehicle user costs, 4. Improving vehicle user safety or broader traffic safety, 5. Reducing user travel time, 6. Enhancing and broadening mobility options and thus giving users more flexibility, 7. Reducing traffic congestion in general, 8. Reducing energy use and pollutant emissions, 9. Making more efficient use of existing road infra- structure, and 10. Reducing the cost of future infrastructure and equipment. If the priority concern is enhancing the driving com- fort and convenience of individual drivers without regard to the broader traffic system, autonomous, sensor-based systems could serve the purpose, without the need to com- municate or cooperate with other vehicles or the infra- structure. However, if it is more important to address the societal goals of reducing traffic congestion, energy use, and pollutant emissions, it will be necessary to rely on cooperative systems based on vehicle-to-vehicle (V2V), vehicle-to-infrastructure (V2I), and infrastructure to vehicle (I2V) communication of time-critical, real-time operational data. Progress toward these goals will also be enhanced through use of non-time-critical data. If safety is the dominant goal, it will be beneficial to combine the vigilance of the driver with the vigilance of the automa- tion system so that each can handle situations in which the other is not effective, rather than discard the driver’s vigilance (at least until the automation technology can be verified to be safer without any driver involvement than with driver involvement). 1.2 Relative Roles of Driver and Automation System The most critical distinctions between automated driving systems revolve around the relative roles of the driver and the automation system, generally described in terms of the level of automation. Some human factors authorities discourage classification by level of automation because they prefer to think of concepts in which the human and the automation system interact organically, with the boundaries of responsibility shifting dynamically on the basis of the driving environment and the capabilities of the driver. While this may turn out to be true in terms of specific automated driving products, classification by level of automation remains a useful simplification that can help people develop a common understanding of what functions the automation system is required to be able to perform. Several classification schemes have been defined to distinguish between these levels of automation, begin- ning with the Bundesanstalt für Strassenwesen, or Federal Highway Research Institute, in Germany and continuing with the National Highway Traffic Safety Administra- tion and the Society of Automotive Engineers (SAE) in the United States. The six-level SAE classification, which is described at length in the SAE Information Report “Taxonomy and Definitions for Terms Related to On- Road Motor Vehicle Automated Driving Systems” (SAE J3016) and which has the most comprehensive and pre- cise descriptions, is discussed here. 1.2.1 Level 0 Level 0 systems have no automated driving functions, but they may be equipped with warning systems that alert the driver to hazards in the driving environment so that the driver can respond earlier and more effectively to those hazards. Level 0 systems can improve safety by adding the vigilance of sensor and threat detection sys- tems to the driver’s vigilance. 1.2.2 Levels 1 and 2 Level 1 driver assistance systems may provide automatic speed control or automatic steering of the vehicle while the driver continues to perform the other control func-

42 T O W A R D S R O A D T R A N S P O R T A U T O M A T I O N tion. These systems are already on the market on a vari- ety of vehicles, although they represent a small fraction of the number of vehicles sold. Level 2 partial automa- tion systems have recently been introduced on high-end vehicles and will be introduced on premium vehicles from more manufacturers within the next few years. Both Level 1 and 2 systems provide driving comfort and convenience but require that the driver continuously monitor the driving environment for hazards and be pre- pared to resume control immediately when the system encounters situations it cannot handle. 1.2.3 Level 3 Level 3 systems—conditional automation—provide higher levels of driver comfort and convenience by allowing the driver to temporarily turn attention away from driving to engage in other activities; however, these systems still require the driver to be available to retake control within a few seconds’ notice when the system reaches the limits of its capabilities. 1.2.4 Level 4 Level 4 systems—high automation—include a diverse collection of capabilities that need to be considered indi- vidually. These systems can replace drivers completely (i.e., no driver intervention is required). Level 4 systems would operate only under specific limited conditions, which can vary widely from system to system: • Automated valet parking systems. These systems will park cars in parking lots or garages after the driver has exited the vehicle, making it possible to squeeze vehi- cles into smaller parking spaces in areas where land is expensive. • Automated buses. Automated buses on special transitways will be developed as cost-effective alterna- tives to light-rail transit on high-volume urban routes. The automation technology will provide a rail-like qual- ity of service and the ability to fit within a narrow right of way through accurate steering control, but at a much lower cost than a rail system. • Automated trucks. Automated trucks on dedicated truck lanes are another high-value niche application of automation that should be possible within the decade by restricting access to those lanes to trucks. • Automated low-speed shuttles. Such shuttles in campuses or pedestrian zones have been the focus of much attention in Europe through the CityMobil2 proj- ect, and several small companies have been developing vehicles for this type of application. Google also recently shifted its attention to this area with the 2014 announce- ment of its pod car. The European work has depended on certification of the infrastructure in which the vehicle travels, with special design features to limit interactions with other road users and to ensure clear fields of regard for the vehicle sensors that need to detect hazards. • Automated passenger cars. Automated passenger cars that will operate on limited-access highways (free- ways) without the need for driver intervention are likely to be the most broadly applicable Level 4 automation system. Initially (in the 2020 to 2025 time frame), these automation systems will probably only be usable under certain traffic conditions, such as low-speed traffic jams or high-speed operations in light traffic, or in lanes that are restricted to vehicles that are equipped for automa- tion or V2V communication capabilities, analogous to the automated highway system concepts that were devel- oped by the National Automated Highway Systems Con- sortium in the 1990s.1 1.2.5 Level 5 Level 5—full automation—will enable a vehicle to drive itself anywhere and under any condition in which a nor- mal human driver would be able to drive. This concept is the one that captures the public imagination because it allows for full electronic chauffeur service, including • Electronic taxi service for people who are not able to drive (too old, too young, physically impaired); • Shared vehicle fleet repositioning, which enables shared vehicle concepts to be economically efficient; and • Driverless urban goods pickup and delivery. 1.2.6 Discussion of Automation Systems The Level 4 and Level 5 applications are the ones that could have revolutionary impacts on travel behavior and urban form by eliminating the disutility of travel time, decoupling parking locations from travelers’ origins and destinations, facilitating vehicle sharing as well as ride- sharing, and breaking down the boundaries between pub- lic and private transportation. At Level 4, these impacts are likely to be localized to the zones that are capable of supporting the highest automation capabilities, but at Level 5 they could apply throughout urban regions and even nationally. However, the technological prob- lems that need to be solved before these scenarios can become reality are extremely daunting and will require substantial time and resources. Ultimately, the realiza- tion of the highest levels of automation will link strongly 1 Rillings, J. H. Automated Highways. Scientific American, Vol. 277, No. 4, 1997, pp. 80–85.

43A P P E N D I X A : C O M M I S S I O N E D W H I T E P A P E R 1 to the levels of investment in foundational research and system development. It is possible that the user may experience several lev- els of automation on a single trip. At some point in the future, it can be envisioned that a user leaving his or her home on surface streets would engage Level 2 automa- tion and upon entering the freeway switch to Level 3. As a further example, depending on the capability of the system, the vehicle may require driver supervision of a lane change (Level 2) before resuming Level 3 operation once it is settled in the new lane. This scenario is hypo- thetical but serves to illustrate the variations that may appear. One simple means of understanding the opposing approaches to initiating the deployment of automation was defined by Bryant Walker Smith of the University of South Carolina.2 • Everything Somewhere (Google): Very high functionality (Level 4) in a constrained geographi- cal area due to the need to constantly update map- ping and limit the interactions with potentially hazardous (higher speed) traffic. Also, given the high functionality, it is likely that the fleet would need frequent servicing and testing to ensure safe operation is maintained; this is also facilitated by geographic constraints. • Something Everywhere (automotive OEMs [original equipment manufacturers]): This is the classic incremental approach, in which systems are brought to market that are capable of operating on any road (of a certain type, at least) regardless of geographic area. Another approach espoused by some OEMs could be termed a “something eventually everywhere” scenario. This approach entails sections of roadway being indi- vidually approved for automated operation by the OEM or public authorities, or both, on the basis of the avail- ability of map information and potentially by modifica- tions to the supporting infrastructure as required by the public safety agencies or the developers of the automa- tion system. This process may entail the vehicle traveling the route first to collect map information to support the onboard system. (In discussions with industry, Volvo and Ford have voiced support for this approach, although it could be a challenge at the point of sale to explain the system to the customer and for the customer to under- stand and accept that the higher vehicle automation capabilities are only available in some specific locations.) 2 Smith, B. W. Strategies to Encourage Vehicle Automation That Have Little to Do with Vehicle Automation. Presented at symposium Autonomous Vehicles: The Legal and Policy Road Ahead, University of Minnesota, Minneapolis, October 31, 2014. 1.3 Complexity of Operating Environment Road transport automation systems have been proposed for use in a wide variety of operating environments encompassing great differences in complexity. This complexity has a strong influence on the technologi- cal challenges the system designers must overcome and is therefore determinative about the timing for market introduction. We need to begin with the recognition that fully automated elevators have been in operation for many decades and automated people mover (APM) sys- tems have been operating on their own dedicated guide- ways for several decades, carrying millions of passengers through airport terminals and in urban metro systems every day. This is feasible because the operating environ- ments of these systems have been drastically simplified and tailored to their needs to physically exclude hazards and unpredicted occurrences. Dedicated busways or dedicated truck lanes are examples of simplified environ- ments that are more complicated than APM guideways but still a far cry from mixed-use, general-purpose lanes, particularly because they exclude light-duty vehicles, pedestrians, and bicyclists. Limited-access highways are much less protected than APM guideways, but they are much simpler than urban streets. Product development by the automakers is cur- rently focused on this environment. Physically separated lanes within such facilities (high-occupancy vehicle or managed lanes) are more protected, which makes them promising candidates for introduction of higher-level automated driving systems for private light-duty passen- ger vehicles. (However, the interactions between infra- structure operator decisions about the establishment of such lanes and automaker decisions about developing products specifically for this operational environment are likely to be complicated in the manner of the chicken- and-egg problem.) The urban street environment is the most challeng- ing one for automated driving, considering the need to share the street with all other road users, who may appear on very short notice and approach from virtually any direction. Some of these challenges are already being addressed to some degree. The technological foundation is being built with crash warning and mitigation systems that are able to detect some of the threats from vehicles, pedestrians, and bicyclists in urban areas. However, moving to full automation brings substantially higher performance requirements because of the unavailability of a driver to provide the safety backup. Intermediate complexity can be found in special zones within urban areas, such as shopping malls, pedestrian zones, or campuses of educational institutions, hos- pitals, or industrial parks. In these environments, dif- ferent categories of traffic can be separated from each other and rights-of-way can be provided for automated

44 T O W A R D S R O A D T R A N S P O R T A U T O M A T I O N vehicles that minimize their interactions with other road user groups or restrict these interactions and the speed of the automated vehicle to accommodate the technical limitations of the automated vehicle’s sensors. Special- ized system providers are likely to launch services in such environments; for the mass-production vehicle industry, a high availability of such protected environments would be required to spur product introduction. Traffic conditions are not the only measure of the environmental complexity with which automated driv- ing systems must contend. Adverse weather and lighting conditions can also make it much more difficult for sen- sor systems to detect road markings, signs, traffic signals and general hazards. A system that is capable of operat- ing only in benign weather conditions or only in daylight may be viable for introduction as an automotive option but would not necessarily be a significant contribution toward improving the transportation system. The complexity of the operating environment has a strong influence on the level of external support (V2V or I2V communication of data, or both) that an auto- mated vehicle will need to ensure safe operations. As the environment becomes more complex, the need grows for supplementary data communicated to vehicles about hazards that are not within their immediate line of sight or that can be difficult to perceive (e.g., the state of a traffic signal controller, the acceleration of a vehicle sev- eral positions away, or a fault condition in a neighbor- ing vehicle). System developers, motivated by functional safety, need to seek combinations of solutions that have complementary strengths, such as onboard sensing sys- tems that can detect the status of most traffic signals that they approach (subject to lighting conditions and occlu- sion by obstacles) and I2V communication systems that can provide authoritative information on signal status, but only at the signals that are equipped with the I2V capability. Roadway operating environments can differ signifi- cantly between Europe and the United States, and these differences can lead to the need for somewhat different vehicle automation capabilities. The standards for sign- age and pavement markings in Europe and the United States are different, as is the level of compliance with applicable standards. Traffic signal systems follow dif- ferent control strategies, and some of the basic rules of the road are also different (e.g., no passing on the right in Europe, right turns permitted on red signals in most of the United States, strict priority to the right in France). Europe has also taken the lead in recent years on test- ing vehicle automation concepts that depend on suitable interactions with infrastructure. The CityMobil2 project is demonstrating the operation of small, low-speed Level 4 automated vehicles on well-defined routes that have been certified to be safe on the basis of modifications to the infrastructure along those routes.3 These modifi- cations ensure that any obstacles that can intrude into the path of the vehicle will be detectable by the limited- capability sensor suite on the vehicle early enough to allow the vehicle to stop without damaging the obstacle or the vehicle. Similarly, the Drive Me project in Gothen- burg, Sweden, will be testing passenger cars with Level 3 automation available in 2017, but only on a specific roadway route that is being equipped with a variety of infrastructure modifications, including safe harbors along the shoulder for automatic parking of impaired vehicles (in cases in which the driver does not respond to a takeover request).4 1.4 summary of Diversity of ConCePts This brief discussion has illustrated the breadth of the topic of road transport automation and the concomitant need to specify which concept of operations is under consideration in any discussion about technological or institutional challenges. The answer that applies for a concept at one end of the complexity scale is likely to be inapplicable for a concept at the other end of the scale. 2 state of the art anD state of the marKet 2.1 State of the Art: Prototype Systems This section provides a sense of the state of the art in the commercial development of automated driving systems. There is also extensive activity in academia and research institutes, but these institutions are not covered here. 2.1.1 Highway Operation In recent years, many automakers have demonstrated high-functioning prototypes capable of automated longi- tudinal and lateral control (within conditions of their pub- lic demonstrations on test tracks and highways). Recent examples come from Toyota and Honda, who both dem- onstrated high-functioning prototype automated driving vehicles at the 2014 ITS World Congress, and from Audi, whose automated vehicle was driven on public roadways from Silicon Valley, California, to Las Vegas, Nevada, for the 2015 Consumer Electronics Show (CES). On 3 For more information on CityMobil2, visit http://www.citymobil2.eu. 4 Volvo Car Group Initiates Unique Swedish Pilot with Self-Driving Cars on Public Roads. Press release. Volvo Car Group, Dec. 2, 2013. https://www.media.volvocars.com/global/en-gb/media/press releases/136182/volvo-car-group-initiates-world-unique-swedish -pilot-project-with-self-driving-cars-on-public-roads.

45A P P E N D I X A : C O M M I S S I O N E D W H I T E P A P E R 1 freeways in mixed traffic, these vehicles were capable of automated freeway cruising, lane changes, merging, and exiting and can be viewed as Level 2 systems. During CES 2015, Honda demonstrated a lane-level hazard information function in which an automated vehicle, seeing a lane blockage or hazard ahead, takes a photo of the hazard before performing an automated lane change. This information is then provided to upstream vehicles so that these vehicles can perform the lane change with more advance notice. Also at CES 2015, Toyota demonstrated its Predictive and Interactive Human Machine Interface, which pro- vides advance information to the driver about upcoming settings in which system support is likely to be reduced. This information is predicted on the basis of upcoming road geometry and historical sensor performance for the lane in which the vehicle is traveling. Toyota’s approach also employs driver monitoring in the form of detec- tion of the direction of the driver’s gaze and the driver’s hands on the steering wheel to try to ensure the driver’s proper monitoring of the traffic environment for Level 2 automation. Audi’s demonstration for CES was notable in that this automated vehicle was driven by several journalists during the 550-mile journey, thereby showing Audi’s high level of confidence in the system for intercity freeway driving. 2.1.2 Street Operation In 2013, Mercedes demonstrated the ability of a proto- type automated vehicle to drive a 104-kilometer route in Germany that traversed three major cities and 23 small towns. The roadways and streets on the route included a typical range of road elements, including traffic signals and roundabouts. Digital maps were used as a reference to support localization and maneu- ver planning. Similar work has been presented by other automotive OEMs. The activities of Tier 1 suppliers are an important indicator of the state of the art. Key technological ele- ments include onboard sensors (radar, stereo or mono cameras, lidar) and image-processing systems capable of detecting traffic signal status relevant to the host vehi- cle’s lane. Dynamic maps play an important role and are maintained through car data sharing. On the human– machine interface (HMI) side, the monitoring of driver state is an active topic, as is implementation of the HMI to build user trust. 2.1.3 Level 4 Automated Chauffeuring At this point, Daimler is the only auto manufacturer dis- cussing the convergence of car sharing and automated vehicles as a potential future product that seeks to emu- late taxi service with no taxi driver. This is a natural convergence, as Daimler and other automakers have launched car-sharing services. According to Daimler, its approach would bring a vehicle where it is needed to pick up a passenger and drive away on its own when the passenger has disembarked. The vehicle would park itself automatically as needed, as well. The major player in this space, however, is Google. Its initial work focused strongly on highway driving, but now the focus is on city street automated chauf- feuring that operates at low speeds (up to 25 miles per hour). Rather than pursue the incremental approach of the vehicle industry, Google seeks to transform mobil- ity, in particular to serve the needs of those who can- not drive (individuals with visual impairments and the elderly). Vehicles with Level 4 capability would drop off passengers and then continue empty to pick up the next passenger within the zone in which the system has been designed and verified to operate safely. Google’s vehicle concepts do not include typical driver controls—steering, brakes, and throttle. Google has announced plans to begin testing Level 4 chauffeuring on public roads near its headquarters cam- pus in California in approximately 2015. Deployments would be important symbolically but limited in impact, as Google’s systems will operate in confined geographic spaces and the number of vehicles will be small, at least for the foreseeable future. In demonstrations, Google’s vehicles have shown the ability to detect and respond to stop signs that are not on its map, a feature that was introduced to deal with temporary signs used at construction sites. However, in a complex situation, such as an unmapped four-way stop, the vehicle might fall back to slow and very cautious driving to avoid making a mistake. Google says that its vehicles can identify almost all unmapped stop signs and would remain safe if they missed a sign because the vehicles are always looking out for traffic, pedestrians, and other obstacles. Google vehicles have also been demonstrated to rec- ognize and navigate through construction zones, includ- ing lane blockages marked by signs and traffic cones. Additional capabilities include handling railroad cross- ings appropriately, adjusting lateral position for delivery vehicles parked partially blocking the lane, and detecting bicyclists and reading their hand signals.5 It is not yet known how reliably the Google vehicles can execute all of these essential behaviors. 5 See http://www.technologyreview.com/news/530276/hidden-obsta cles-for-googles-self-driving-cars/ and https://www.youtube.com /watch?v=bDOnn0-4Nq8 (Google video).

46 T O W A R D S R O A D T R A N S P O R T A U T O M A T I O N Other potential entrants into this domain are Uber (which Google partly owns), Lyft, and Sidecar. In par- ticular, in early 2015, Uber and Carnegie Mellon Univer- sity announced a strategic partnership to create an Uber Advanced Technologies Center. Press releases stated that the Center will focus on “the development of key long- term technologies that advance Uber’s mission of bring- ing safe, reliable transportation to everyone, everywhere. . . . and to invest in leading edge technologies to enable the safe and efficient movement of people and things at giant scale.”6 The partners noted that research and devel- opment will focus primarily on the areas of mapping, vehicle safety, and automation technology. 2.1.4 Automated Trucks Highly automated driving capability (Level 3) for trucks will most likely come in the next decade (Mercedes Trucks has shown prototypes and indicated a 2025 time frame). In February 2015 Scania tested short-headway platooning (Level 1, longitudinal only) of several trucks on Dutch highways. These types of operations are expected to be limited to well-structured roadways for long-haul freight movement. 2.1.5 Summary For all of the above prototypes, successful operation has been achieved in demonstrations and during many miles of testing. How well and how consistently this technol- ogy can handle everything that can occur on the road is another matter. Each of the major system developers has its own internal metrics and test protocols, but these data are proprietary and therefore not available. 2.2 State of the Market: Product Development and Introduction 2.2.1 Automotive Manufacturers and Suppliers Active safety systems, which form much of the technol- ogy foundation for automated vehicles, are now offered on many car models in the European and North Ameri- can markets. Sales of automotive radars and cameras are in the millions annually. In 2013, Volvo announced it had sold 1 million autobraking automobiles, with the low-speed City Safety system being standard equipment 6 Spice, B., K. Walters, and K. Carvell. Uber, Carnegie Mellon Announce Strategic Partnership and Creation of Advanced Technologies Center in Pittsburgh. Carnegie Mellon University News, Feb. 2, 2015. http://www.cmu.edu/news/stories/archives/2015/febru ary/uber-partnership.html on all of its cars. Active safety systems are becoming standard equipment in increasingly more models; auto- mated emergency braking in the 2015 Mercedes B Class is one example. Some automobile manufacturers are advocating a long view. Under the leadership of Executive Chairman Bill Ford, the Ford Motor Company has produced Blue- print for Mobility—a plan that describes the company’s vision of transportation in 2025 and beyond as well as the technologies, business models, and partnerships needed to get there. Moving beyond today’s crash avoid- ance and automation systems slated for the near term, Ford sees V2V communications becoming mainstream in the midterm. Included will be some automated driving capabilities, such as vehicle platooning to support denser driving patterns. In the longer term, Ford envisions fully automated driving, including parking. Vehicles will com- municate with each other and the world around them and become one element of a fully integrated transporta- tion ecosystem. Ford also expects personal vehicle own- ership to evolve as new business models develop. The benefits include improved safety, reduced traffic con- gestion, and the ability to achieve major environmental improvements.7 2.2.2 Level 2 Highway Use Systems Some vehicle models now offer simultaneous adaptive cruise control and lane centering when operating at highway speeds on well-structured highways with lim- ited curvature. The degree of road curvature handled by the automatic steering is intentionally limited to prevent drivers from overreliance; the level of steering assist dif- fers across automakers. This capability is available now from automakers including Mercedes, Infiniti, Hyundai, and Acura, and rollouts are expected from other auto- makers in the near term. Traffic jam assist is a system that provides automated highway driving in traffic jams; it disables above a speed threshold in the range of 50 kilometers per hour. Even though the system is capable of automatic steering, the driver is expected to keep his or her hands on the wheel. Some systems automatically detect whether the driver’s hands are on the wheel and alert the driver if the hands are off the wheel for a set duration; if the driver does not respond, the feature is disabled. Systems are available now from BMW, Mercedes, and Volkswagen. Availabil- ity of the system has been announced for 2016 by Audi, GM, and Nissan. 7 Ford Reveals Automated Fusion Hybrid Research Car as Blueprint for Mobility Gathers Pace. Press release. @FordOnline, Dec. 13, 2013. http://www.at.ford.com/news/cn/Pages/Ford%20Reveals%20 Automated%20Fusion%20Hybrid%20Research%20Car%20 as%20Blueprint%20for%20Mobility%20Gathers%20Pace.aspx.

47A P P E N D I X A : C O M M I S S I O N E D W H I T E P A P E R 1 Level 2 highway automation is Level 2 capability for highway use across the full speed range and a full range of normal highway curvatures. Because this is an eyes-on system, some systems will actively monitor the driver’s attention or gaze and warn if the driver does not have eyes on the road. Some systems will simply drive the vehicle in lane; others will also do lane changes as needed. These systems are expected to incorporate traf- fic jam assist as well. Announcements have been made for availability in 2016 from Audi and GM, 2018 from Nissan, and 2020 from BMW. Toyota has said such a system will be available “middecade.” Aftermarket systems present a unique case. At least one Silicon Valley company, Cruise Automation, has announced that its Cruise RP-1 system can be retrofitted into an existing vehicle (Audi vehicles initially) and pro- vide Level 2 automated highway driving during daylight hours.8 The company fits a sensor package to the roof of the vehicle and retrofits actuators to the existing pedals and steering wheel. Cruise Automation maintains that the first systems will be delivered in 2015. 2.2.3 Level 3 Highway Use Systems Volvo Cars describes its vehicles being prepared for the Drive Me field test as Level 3. Because members of the public will operate the vehicles, Volvo views this as a production run, albeit very limited in quantity. 2.2.4 Automation on the Streets The complex and varied situations encountered in street driving places this capability much later in the time line; however many automakers are working actively to mas- ter this environment as well. Only Nissan has made a specific announcement regarding street operation, stat- ing that vehicles with intersection autonomy capability will be offered by 2020; however, the capabilities to be provided by that function have not been specified.9 2.2.5 Automated Valet Parking Valet parking is an interesting application that can be expected to arrive near-term because it is low speed and 8 Kolody, L. Before Cars Go Totally Driverless, Cruise Wants to Put Them on “Highway Autopilot.” Wall Street Journal, June 23, 2014. http://blogs.wsj.com/venturecapital/2014/06/23/before-cars-go -totally-driverless-cruise-wants-to-put-them-on-highway-autopilot/. 9 Carlos Ghosn Outlines Launch Timetable for Autonomous Drive Technologies. Press release. Nissan, July 16, 2014. http://nissannews. com/en-US/nissan/usa/releases/carlos-ghosn-outlines-launch-time table-for-autonomous-drive-technologies. operates off the public road. The idea is that the driver steps out of the car at the entrance to a parking facility and uses his or her smartphone to instruct the car to park (manufacturer concepts vary with regard to driver responsibilities for monitoring the vehicle’s actions). The vehicle drives away empty and finds a space, returning to the entrance when called by the driver. Nissan has announced this feature will be available in 2016; several other automakers have demonstrated prototypes. 2.2.6 Automated Driving in Trucking With V2V communications, two or more trucks can electronically couple such that any braking by the lead truck can be instantaneously initiated by following trucks. This capability enables intervehicle spacing to be greatly reduced, which reduces aerodynamic drag and therefore fuel use. Initial systems are expected to be Level 1: the sys- tem will control only the brakes and throttle, and the driver must steer (automated steering does not improve fuel economy). Truck manufacturers and suppliers are actively developing these systems and addressing safety and performance issues that arise from this mode of operation. Steering is likely to be added in a later generation. Silicon Valley start-up Peloton is actively seeking to commercialize this function for two-truck pairs. Testing of a two-truck platoon by Peloton has shown 10% fuel reduction in the following truck and 4% fuel reduction in the lead truck (because of reduced turbulence behind it).10 These are very compelling numbers for the truck industry, and implementation of such systems is expected within 2 to 3 years. 2.2.7 Addressing the Hype Other automakers have made broad statements as to their intentions to offer some level of automated driv- ing capability soon. For instance, Tesla Chief Executive Officer Elon Musk has stated that a “mostly autono- mous automobile” will be released in 2015 that will “probably be 90% capable of autopilot.”11 This state- ment illustrates the hype issue: rolling out automated driving has become highly competitive, and automak- ers seek to position themselves as leaders for public per- ception purposes. Their statements may or may not be 10 M. Roeth. CR England Peloton Technology Platooning Test Nov 2013. Letter report. North American Council for Freight Efficiency, 2013. http://nacfe.org/wp-content/uploads/2013/12/CR-England.pdf. 11 Elon Musk: Tesla: 90% Autonomous in 2015. Video. CNN Money, Oct. 2, 2014. http://money.cnn.com/video/technology/innovation nation/2014/10/02/elon-musk-tesla-90-autonomous.cnnmoney/.

48 T O W A R D S R O A D T R A N S P O R T A U T O M A T I O N grounded in the reality of the specific products they plan to roll out (which are likely not yet fully defined because of uncertainties in technical performance and cost) or the timing of the market introduction. Nevertheless, these highly public statements are meaningful as an indication of internal company priorities and levels of investment. 2.2.8 Infrastructure Support Considerations Will infrastructure support be needed to enhance the safety and reliability of automated driving products offered by the automotive OEMs? The answer relates to the nature of the automotive industry. Current systems such as lane departure warning only function if adequate lane mark- ings are present; if that is not the case, the system disables. The customer, when understanding the system properly, realizes that the system is available only when the infra- structure enables it. The automakers are careful to explain the limitations of the system in the owner’s manual. Thus, lane departure warning is a system that does not require 100% availability. The same is true of current automated lane-centering systems. If we extrapolate forward to early forms of automa- tion, the same principles could apply as long as the driver has eyes on the road (Level 2 automation). As the super- visor of vehicle system operation, the driver is responsible for detecting when the system is not providing support and taking control of the vehicle when needed. However, for higher levels of automation, the driver’s active atten- tion is not required. The vehicle must therefore have an understanding of when the road situation is adequate for automated driving. If it is not, either the driver must be brought back into the loop or the vehicle must find a safe harbor and stop. To deploy highly automated driving, the automobile industry must ensure that fundamental system operation is handled under normal driving conditions by onboard systems. This capability includes detection of other vehi- cles as well as traffic signals and traffic signs; the latter are detected via cameras in current prototypes. Digital infrastructure, which provides up-to-date data on infra- structure elements, appears to be an important factor that vehicle OEMs can control to some degree via con- tractual relationships with map providers. Public infra- structure elements (from high-quality lane markings to more advanced elements such as V2I-based traffic signal phasing and timing), which increase scene understanding for the vehicle, are going to be important in providing the levels of robustness that customers should expect for systems that do not require constant driver supervision. However, automotive OEMs are aware that they can- not depend on public infrastructure in every instance for many years to come, if ever. If these OEMs cannot ensure a basic level of system operation or a means of alerting the driver to resume control in a safe manner through onboard systems within their own sphere of control (e.g., via sensors and maps, as noted above), then the more advanced levels of automation will not be introduced until they can. That said, the efforts by vehicle OEMs to work with the public sector to install electric vehicle charging infra- structure could be instructive. If the OEMs were to take a highly activist stance toward installation of public infra- structure and develop partnerships with road operators, progress toward increasingly higher levels of automation could be accelerated. However acceleration will only be feasible if installation of such supporting elements occurs on a reliable time line. Several possible scenarios can be envisioned as a start- ing point for stimulating discussion: • Straightforward private sector alone: Onboard technology plus data flowing to vehicles via private-sector providers provides sufficient performance to proceed to Level 3 and higher. • Learn-as-you-go private sector alone: OEMs intro- duce onboard technology that is called Level 2, but in most cases Level 3 operation is possible. The owner’s manual has numerous caveats as to the system’s capabil- ity. Customers are left more or less to discover the sys- tem’s limitations themselves and make their own choices about keeping eyes on or not. (As a precedent, customers must have fairly sophisticated understanding for some driver assistance systems now on the market.) • Private industry and the general public goad the public sector into action on infrastructure support: OEMs offer Level 3 systems only on preapproved roads that have sufficient map data and infrastructure support. The public, frustrated with these limitations, clamors for state and local agencies to upgrade their road networks (both physical and digital elements) so as to expand the approved set of roads. • Public sector provides essential infrastructure sup- port to Level 3 systems: Via the normal processes of ITS deployment and road maintenance, I2V-V2I capability is widespread, lane markings are good, signage is good, and so forth. If the road operators judge automation to be sufficiently beneficial for efficiency of operation or for the reduction of infrastructure cost, they could be motivated to shift their investments to support the automation. 2.3 Organizational Framework Many types of organizations will be influenced by the advent of road transport automation and will seek to influence its development and deployment. Indeed, road automation has few rivals as a complicated sociotechni-

49A P P E N D I X A : C O M M I S S I O N E D W H I T E P A P E R 1 cal system with the potential to influence the daily lives of the entire population in developed countries. The list of organizations and groups likely to be influenced by developments in road transport automation includes the following: • Vehicle manufacturers and suppliers. Vehicle man- ufacturers and suppliers will be developing much of the technology to implement road transport automation and deciding its viability in the commercial marketplace. This group includes not only the automotive manufac- turers but also manufacturers of heavy vehicles (truck and bus) and their supply chains. • Other technology industries. The technological requirements for road transport automation extend well beyond the vehicle industry to encompass the broader information technology and telecommunications indus- tries—which will need to provide much of the required enabling technology—and the roadway infrastructure supply industry. • Regulators and public authorities. Road transport automation does not fit neatly within the existing regula- tory framework for vehicle technology and operations, so considerable attention will have to be devoted to determining how the regulatory frameworks will need to be modified to find an appropriate balance between pro- tecting public safety and encouraging innovation. Auto- mation concepts that depend on roadway infrastructure support or cooperation will also have to be implemented within the fiscal constraints that govern public infra- structure investments. • Infrastructure and road operators. These opera- tors are generally public, but in some cases may also be private or public–private partnerships. They will need to interact closely with the technology developers and suppliers to ensure that the needed enhancements to their infrastructure are implemented. In the longer term, there may be opportunities for integrated infrastructure– vehicle-operating organizations that can offer automated road transport as a service to travelers on the basis of on higher levels of automation. • Public transport operators. Public transport opera- tors are potential early adopters of road transport auto- mation technology on the basis of the potential for saving costs, improving service, and building on opportunities to combine their infrastructure and vehicle operation responsibilities. Line-haul transit with high-value vehi- cles operating on geographically constrained fixed routes and feeder services at low speeds in activity centers are promising targets of opportunity. Automation concepts that depend on roadway infrastructure support or coop- eration will also have to be implemented within the fis- cal constraints that govern infrastructure investments for public transport operators, but once a transit operator has built the physical infrastructure that it needs (such as a busway), the incremental cost of enhancements to support automation is small. • Goods movement. Trucking operations could ben- efit enormously from adoption of automation technol- ogy to save money and improve operational efficiency. The early opportunities are in line-haul movements of heavy trucks, but in the long term there could be oppor- tunities for efficient movement of urban goods when the technology becomes available for Level 5 automation. Although low profit margins and the inherent conserva- tism of this industry are impediments to its early adop- tion of new technology, applications that provide strong return on investment (such as fuel economy benefits from truck platooning) could be sufficiently compelling to overcome conservative reservations. • Users–drivers. Drivers of private personal vehicles will be the beneficiaries of improvements in comfort and convenience as well as transportation system improve- ments (safety, traffic flow speed and smoothness, and energy savings) that result from automation. They will also have to be convinced, however, that their direct ben- efits will be sufficient to justify the additional costs of equipping their vehicles with automated driving options. The propensity to adopt automation will vary widely across the population, and there will always be a por- tion of the population opposed to relinquishing driving tasks. • Vulnerable road users. Pedestrian and bicycling interests have been among the most vocal opponents of automation to date because of concerns about how more highly automated vehicles will interact with them. It will be necessary to provide convincing demonstrations that automated driving systems can detect and respond safely to pedestrians and bicyclists before these systems will be widely accepted for use in urban environments. • Operators of shared vehicles and fleets. When Level 5 automation becomes available, it is likely to make shared vehicle operations significantly more effi- cient than they are today by enabling the repositioning of unused vehicles to the locations where they are most needed without the use of human labor. These operators could thereby become one of the primary beneficiaries of automation. • Insurers. The insurance business model seeks to spread risk sufficiently to make a profit. For the foresee- able future, insurance will continue to play its traditional role in the road transport ecosystem, even as crash avoid- ance systems proliferate and automation becomes avail- able. Insurance is further discussed in Section 4.5 of this paper. • Big data service providers. When drivers are able to safely disengage from the driving task because of automation, they will be able to use their time in the car for online activities; as information consumers, they will represent market growth opportunities for online

50 T O W A R D S R O A D T R A N S P O R T A U T O M A T I O N businesses. The increased connectedness of vehicles will create new data collection opportunities for the infor- mation technology industry, but these opportunities are more directly associated with connected vehicles than with automated vehicles. • Research and academia. Road transport automa- tion has the potential to produce large changes in many aspects of road transport that are not easy to under- stand. Research on many of these issues will be needed to develop the knowledge required to inform decision makers throughout the transportation world. Opinions differ with regard to the amount of research that will be needed to provide the technological foundations for the higher levels of automation, ranging from requir- ing significant progress in several technological fields to requiring fundamental breakthroughs in those fields. Research is also needed in nontechnological fields, such as the social sciences, behavioral psychology, law, and economics. • Legal system. The existing legal environment for road transport is based on the assumption that the driver is in control of the vehicle’s movements and is respon- sible for vehicle safety. As automation shifts some of that control and responsibility to vehicle developers, the legal system will adapt and case law will evolve. This evolu- tion will differ in the United States and Europe, given the differences in their respective legal systems. Automation has the potential to create new relation- ships between these different categories of stakehold- ers because of the changes it can enable with regard to the basic functionality of road vehicles. Relationships between insurance companies, drivers, vehicle own- ers, and vehicle manufacturers are likely to become more complicated. Similarly, new partnerships could be formed between vehicle developers, infrastructure owner–operators, and vehicle operators to sell trans- portation services to the public rather than vehicles. The nature of public transportation and goods move- ment could change significantly and in turn and create new opportunities. 3 maturity of the teChnology The technology for road transport automation has been advancing for the past six decades in several dis- tinct waves of progress. SAE Level 1 and 2 automation systems have already advanced to market introduction in limited numbers, while development work contin- ues on the issues that need to be resolved to advance to the higher levels of automation. The maturity of the technology will determine which of the specific automa- tion concepts discussed above can become commercially available for general use. Care is needed in assessing the maturity of the tech- nologies for automation, especially for the higher levels (Levels 3 to 5), at which it cannot be assumed that the driver will be able to intervene when the system has a problem. At these automation levels, the system needs to be fully responsible for ensuring safety, which means that the “ility” measures of effectiveness for the enabling technologies (reliability, availability) become much more important than they were for the lower levels of automa- tion. The probabilities of failure of each safety-critical technology need to be extremely small for the system to meet the minimum acceptability goal of being no less safe than today’s driving. The key enabling technologies are discussed here, in order of increasing difficulty from those that are already relatively mature to those that will require substan- tially more development effort. These issues are heavily focused on the vehicle side rather than the infrastructure side because this is where the main technological chal- lenges appear to be; the infrastructure technologies that already exist for nonautomated ITS (traffic management systems, traffic detectors, V2I-I2V communication sys- tems and their back-office functionalities) appear to be largely adequate to meet the needs of automated road transport systems. 3.1 Wireless Communications Wireless communications have already benefited from a great deal of development effort associated with the Connected Vehicle Program in the United States and Cooperative ITS in Europe and within the broader wireless telecommunications industry. Non-safety- critical wireless communications that use cellular radio technologies (3G, 4G LTE, WiMAX) have been developed commercially for a wide range of applica- tions and are already in widespread commercial use. Development is already advancing on future genera- tion enhancements to support the seemingly boundless demand for wireless information transfers, especially for infotainment applications. Message latencies are decreasing such that a wide range of ITS applications can be supported, but they have not reached a level sufficient for safety-of-life applications (nor are they expected to in the future). Some automotive OEMs see commercial wireless technologies being used exten- sively by automated vehicles to receive quasi-real-time map data, as well as to upload data to refresh the map data. The time-critical, safety-critical wireless com- munication technology of 5.9 GHz dedicated short- range communication (DSRC) has been developed with a large public-sector investment, primarily to support cooperative collision warning applications.

51A P P E N D I X A : C O M M I S S I O N E D W H I T E P A P E R 1 The underlying technology, as used for cooperative collision warnings, should be able to support the large majority of the requirements for road transport automation. The issues that still need to be resolved include • Expanding messages to include information needs specific to automation, • Verifying that the available spectrum and techni- cal standards will be able to support the wireless traffic demand when a high percentage of vehicles in high-density locations are automated, and • Verifying that the security systems are indeed sufficiently secure and scalable to a high market penetration. Other complementary wireless technologies (includ- ing infrared line-of-sight communication at short range) should also be researched as alternatives to DSRC. Because it is not possible to ensure that wireless commu- nications will work 100% of the time, research attention also needs to be given to how to make them as fault toler- ant as possible, a concept that includes broader concepts of functional redundancy. As noted above, the vehicle industry will deploy systems with sufficient onboard sensing to allow for a minimum acceptable level of performance; however, that performance will be limited to lower capabilities than in situations when key data are available via communica- tions. This limitation is unavoidable, as a situation in which absolutely all other vehicles will be equipped with V2V is not in the foreseeable future. 3.2 Localization The most widely used localization approaches involve global navigation satellite systems (GNSS) such as GPS and Galileo, which have become remarkably cheap in recent years. However, these systems’ accuracy of localization is not sufficient to be the primary source of information on relative vehicle positioning for auto- mated driving information. More importantly, they are not sufficiently dependable to serve as the primary localization mechanism for safety-of-life applications because of their vulnerability to disruption on the basis of inadequate sky coverage; occlusion of signals by structures, foliage, and large vehicles; and interfer- ence, including jamming and hacking of signals. At the very least, these systems need to be augmented with inertial measurement units, or IMU, to provide dead reckoning between GNSS updates and for brief signal interruptions. An alternate approach to localization that has been attracting interest recently is simultaneous localiza- tion and mapping (SLAM).12 This technique typically uses wide-angle laser scanners to identify targets in the environment surrounding the vehicle and matches those targets to a preexisting detailed database of the environ- ment. That matching can be done effectively when the laser scanner has a clear line of sight to the surround- ing environment; this characteristic favors mounting the scanner on top of the vehicle to minimize occlusion of static infrastructure elements by adjacent vehicles. Alter- natively, because of styling considerations, future systems may have multiple sensors mounted at the bumper level to seek to provide full coverage. However, the SLAM technique can still be defeated when a vehicle is sur- rounded by taller vehicles that block the scanner’s view of the mapped environment. Creating and maintaining the detailed database of the driving environment requires substantial effort, especially in locations where there is active construction activity or foliage grows rapidly. Although automated vehicle systems will operate pri- marily via onboard sensing for tactical driving, several vehicle OEMs stress the importance of up-to-the-minute map information that can provide data on lane closures, work zones, weather, and other dynamic factors. Addi- tionally, for localization, there is active discussion of the concept of “digital horizon data,” which would primar- ily be provided via probe data communications from cars with relevant sensors (radar, lidar, camera) reporting on an exception basis to update the static SLAM data. These data would provide a reference of what the sensors see in the way it is viewed. From these data, road and road- side features would be detected, including curbs, lamp- posts, trees, and so forth. In this way, the car can localize itself to the road situation in the same way drivers do; this level of accuracy cannot be obtained from satellite positioning. In such an approach, interoperability across map and data providers is essential. Nokia HERE, one example from the mapmaking industry, is aiming to provide maps at a level of detail to match the capabilities of onboard sensors. Continu- ous updates would be provided via probe data, particu- larly for time-variable issues such as lane closures. Nokia HERE’s automated driving framework includes • A high-definition map that provides for precise positioning for lateral and longitudinal control of the vehicle on the road surface, • The provision of dynamic data to support active planning of vehicle control maneuvers beyond sensor visibility, and 12 Leonard, J. J., and H. F. Durrant-Whyte. Simultaneous Map Building and Localization for an Autonomous Mobile Robot. Proc., IEEE/RSJ International Workshop on Intelligent Robots and Systems ’91. Vol. 1: Intelligence for Mechanical Systems, International House Osaka, Osaka, Japan, Nov. 3–5, 1991, pp. 1442–1447.

52 T O W A R D S R O A D T R A N S P O R T A U T O M A T I O N • The use of vehicle probe data to make automated driving more human-like, so as to increase comfort for vehicle occupants.13 In the end, robust localization is likely to require com- binations of different technologies so that the limitations of one technology can be compensated for by another. This requirement obviously increases the cost of the deployed system. Research will be needed to identify the most cost-effective way of achieving vehicle positioning with the required accuracy, reliability, and availability. 3.3 Human Factors The interactions between humans and automated road transport systems will be complicated and require a great deal of research attention. This issue is considerably more than one of enabling technology, but there is an enabling technology dimension that should be addressed here. That dimension is learning (a) how to design driver interfaces that will facilitate transitions between human and automated driving and (b) how to deter drivers from misusing Level 2 and 3 automation systems by engaging in activities that prevent them from being able to inter- vene when they need to provide the backup for the auto- mated driving systems. At the societal level, an alternative to deterring drivers from misuse is to leave this aspect to personal respon- sibility. Although this is an imperfect solution, it is the approach used for other potentially dangerous behavior, such as speeding. There are some differences, however. Speeding is generally a conscious decision to disregard an explicit rule, whereas a driver who is not attending to the road scene in a Level 2 automated vehicle system is more likely to be disregarding the instructions in the vehicle owner’s manual or relying on an incorrect men- tal model of the system capabilities. More-complex HMI factors that can arise with misuse of automation systems could be associated with difficulties in understanding the limitations of human behavior and of the technological capabilities of the automated vehicle system. It is not yet clear whether it will be possible to imple- ment a driver–vehicle interface that can successfully man- age the rapid (within a few seconds) transition of control to a disengaged driver in a Level 3 system and prevent the driver from tuning out so seriously that he or she is unable to intervene when needed. Consequently, it is not clear if and when systems at Level 3 can be brought to market. It is also possible that safety risks could result from drivers misunderstanding the overall (or moment-to- moment) limits of the system. This possibility empha- 13 Rabel, D. Automated Driving Cloud: HD Live Map. Presented at Automotive Tech.AD Berlin 2015, Berlin, German, Feb. 26–27, 2015. sizes the need for intuitive and clearly understandable driver–vehicle interfaces. There is extensive literature in human factors about the inability of humans to retain vigilance for monitoring- only tasks, and there is already anecdotal evidence (You- Tube videos) showing how some drivers will deliberately act to defeat vehicle designers’ attempts to force them to remain engaged in the driving task when the lateral and longitudinal control have been turned over to a Level 2 automated driving system.14,15 Vehicle OEMs are likely to address this issue via carefully worded owner’s manuals to reduce the risk of being held liable for driver misuse. However, from a societal standpoint, these behaviors indicate the need for more research to address human factors issues such as • How can a driver interface best compel a driver to remain vigilant in a Level 2 or 3 automation system without the interface being a nuisance? • If a driver temporarily disengages from driving to perform other tasks, what is the best way for a driver interface to regain the driver’s attention when it is needed? • How much time is needed for the driver to safely retake control of the vehicle at various levels of automation? • What are the safety implications when a driver resumes control of the vehicle after an extended period of automated driving, and what extra assistance may that driver need to avoid errors? (And to what degree will the collision avoidance cocoon provide a safety buffer?) A very important human factors issue arises with the possibility that the driver does not respond to a takeover request because of impairment, inattention, or other fac- tors. Although this may be caused by a human error (or the automation system misleading the human to adopt an incorrect mental model), the response is then left to the vehicle systems to maintain safe operation in some manner regardless of the circumstances. The approach favored by several automakers is to bring the vehicle to a safe stop, ideally by pulling off the road completely. When this is not possible, other alternatives that have been discussed are stopping on a freeway shoulder or even stopping in the lane of travel. The latter is prob- lematic but nevertheless may be safer than continuing vehicle movement when the perception system cannot determine a safe path. The range of possible countermea- sures to this situation may be a topic for policy makers to address as well. Because these issues address general human capa- bilities and limitations, they should be viable topics for 14 Mercedes S Class Active Lane Assist Hack. https://www.youtube .com/watch?v=Kv9JYqhFV-M. 15 Infiniti Q50 Active Lane Control—Selfdriving Car. https://www .youtube.com/watch?v=zY_zqEmKV1k.

53A P P E N D I X A : C O M M I S S I O N E D W H I T E P A P E R 1 international cooperation, even though the characteris- tics of the driver populations and their driving behavior may differ considerably between the United States and the European Union. 3.4 Fault Detection, Identification, and Accommodation To achieve Level 3, 4, or 5 automation with no less safety than today’s manual driving, the automated driving sys- tem will have to reach extremely high levels of reliabil- ity. Achieving that reliability will require that the system have multiple layers of protection against faults so that it can prevent the vehicle from crashing after a fault (or combination of multiple faults) has been encoun- tered. From a consumer product perspective, automo- tive OEMs will need to further ensure that any vehicle maneuvers resulting from system faults do not unsettle the driver and erode trust in the system. The potential faults will be many and varied and may occur individually or in combinations of multiple faults. The faults could be failures of mechanical or electronic components in the subject vehicle or in other vehicles or the infrastructure that are providing information to the subject vehicle, but they could also represent soft- ware errors in any of the embedded processors or one of the many external hazards (e.g., obstacles in the vehicle path, environmental obscurants, or cyberattacks). Although some faults can be anticipated when the automation system is designed, others (especially com- binations of faults and external hazards) cannot be anticipated in specific terms. Nevertheless, the system will have to be able to respond safely to nearly all of these faults in order to reach its system safety goals. That ability to respond has to be built into the automation software from the start, following a general sequence of • Detecting that a fault has occurred (and alerting the driver), • Identifying the nature of the fault with enough specificity that the system can select a safe response, and • Accommodating the fault by modifying the behav- ior of the automation system to isolate the faulty sub- system and commanding the vehicle to switch into a degraded mode of operation that sacrifices normal mea- sures of effectiveness, such as efficiency and ride quality, to ensure that the safety of the subject vehicle’s occupants and its neighbors is protected (this could be as simple as bringing the vehicle to a stop promptly or could involve more complicated evasive maneuvers). Methods of fault detection, identification, and accom- modation have been developed and applied in a variety of application domains, but road transport automa- tion is a particularly challenging application because it is safety-of-life critical, it has to be implemented in a consumer product affordable to the mass market, and it has to operate in a highly stochastic environment with diverse hazards that cannot be predicted. All of these fac- tors require major advances in the state of the art of fault detection, identification, and accommodation, from the level of theory to practical implementation. The classical approach to ensuring high reliability of systems involves designing in redundancy, so that if one component fails there is a backup system available to take over. This is an effective but very expensive approach that is widely used in the aerospace industry (e.g., quadruple redun- dancy of aircraft hydraulic and navigation systems). The price sensitivity of the automotive market makes it dif- ficult to extend this type of brute-force approach to road vehicle automation systems. Nevertheless, the automo- bile industry is strongly focused on developing systems that implement redundancy through other methods. The vehicle industry has made strides in this respect for advanced crash avoidance systems; new techniques and methodologies are now under development for auto- mated driving. Current thinking in the vehicle industry is illustrated by a recent presentation on this subject that noted the following points:16 • Vehicle OEMs will (and have) set their own internal criteria for system operation prior to releasing products. • Definition of safety must be done for each func- tional level. One approach would be to stop the vehicle and await response from the human occupants; another would be to allow for a remote operator to access all controls and drive remotely to maintain safety. • Emergency handling (situations within approxi- mately the next 10 seconds) must be able to function without driver input. • Functional decomposition of complex systems is done to try to find all possibly significant situations by permutation. • Design for high reliability includes redundant, self- monitoring components. • Standards need to cover all significant potential crash causes, but perhaps not the most unlikely multi- reason crash scenarios. It is not yet clear whether this type of approach can be implemented with an affordable level of effort in labor and time to reach a safety level that will exceed the safety of today’s manually driven traffic, or whether method- ological breakthroughs will be needed to get there. 16 Schöner, H.-P. Challenges and Approaches for Testing of Highly Automated Vehicles. Presented at CESA 3.0, Paris, Dec. 3–4, 2014.

54 T O W A R D S R O A D T R A N S P O R T A U T O M A T I O N 3.5 Cybersecurity The media have raised public awareness about cyberse- curity threats after a series of highly publicized attacks. Such threats are typically one of the first concerns to be raised when the subject of road transport automation is discussed by the media or the general public. Experts in the field have cautioned that cybersecurity should already be a concern for the vehicles that are on the market today and that efforts to address it should not wait for the advent of more highly automated vehicles. Modern road vehicles already have electronically controlled engines, brakes, and steering, and the actuation systems for these functions are on vehicle networks. An attacker who could access that vehicle network could issue commands to those actuators in a current production vehicle to cause unsafe behavior. Vehicles that have wireless connections to the outside world (as many vehicles already do) can potentially be attacked through those wireless connec- tions, but an attacker who can gain physical access to the vehicle has easier ways of executing an attack. Connected vehicles will also have more opportunities to detect an attack and to alert each other about attacks in progress.17 With regard to cybersecurity protection, the only sub- stantive difference between today’s vehicles and future, more highly automated vehicles is in the ability of the driver to recognize that something is wrong and to inter- vene to take corrective action. If a driver in a Level 3 to Level 5 automated vehicle is thoroughly disengaged, he or she will not be able to recognize the problem or inter- vene, whereas a driver of a more conventional vehicle is more likely to recognize anomalous behavior (which may or may not help the driver take corrective action, depending on how severe and complete the attack is). Naïve hackers may perceive automated vehicles to be more attractive targets than conventional vehicles, but sophisticated hackers will recognize that all modern vehicles are similarly vulnerable. Automakers are actively working to define and imple- ment adequate levels of security against attacks for today’s products. More research is needed to provide the highest possible robustness against attacks. The result- ing design principles can be expected to be applied and refined for automation. 3.6 Environment Perception The most visible and readily apparent technological requirement for road transport automation is the ability 17 Petit, J., and S. E. Shladover. Potential Cyberattacks on Automated Vehicles. IEEE Transactions on Intelligent Transportation Systems, Vol. 16, No. 2, 2015, pp. 546–556. http://ieeexplore.ieee.org /search/searchresult.jsp?newsearch=true&queryText=Potential%20 Cyberattacks%20on%20Automated%20Vehicles. of the vehicle to perceive its environment accurately and dependably. Extensive resources based on use of a vari- ety of technologies have been devoted to this topic over the decades, and the topic has been a favorite of univer- sity researchers in electrical engineering and computer science, who publish many papers in this field every year. The key challenge in environment perception for auto- mated road transport systems is in ensuring that the sub- ject vehicle can detect and identify all hazards that will adversely affect its safety early enough to take evasive action and, at the same time, avoid false alarms from tar- gets that are not hazardous. The environment perception system typically includes sensors and communication devices that receive input data, signal-processing systems and software to analyze the data from the sensors, and communication devices and threat assessment software to discriminate between the true and false hazards. In cur- rent vehicle systems, the sensors are typically video cam- eras and millimeter wave radar or laser radar (lidar) plus ultrasonic presence detection sensors for very short-range hazards. Each type of sensor has its advantages and dis- advantages, and no single sensor represents a silver bullet that will meet all needs. Indeed, it is likely that combina- tions of sensors with complementary failure modes will be needed to provide robust detection of the most safety- critical environment perception information. Prototypes of Level 2 automated driving systems have used sensors already on production vehicles (with some modifications) plus additional sensors. The messaging from vehicle OEMs is that a technologically mature set of sensors that will be sufficient for the next generation of automation now exists, but that next generation is still only at Level 2. As upgrades are needed for higher levels of automation that can detect all potential threats with a very high probability of success, the cost of the overall sensor package, and of the system as a whole, will be a pacing fac- tor for introduction of systems with higher functionality. Environment perception issues pose severe technical challenges for the higher levels of automation for several reasons: • The probability of a false negative detection (failure to detect a dangerous object or condition early enough to avoid it) must be extremely low in order to achieve system safety no less than today’s driving by a human operator. Some hazards are extremely challenging to detect at a range that is long enough to allow a vehicle to respond to avoid the hazard, especially when the hazard has been occluded from view by other vehicles (potholes, rocks, or bricks in the path of the vehicle’s tires). • The probability of a false positive detection (iden- tifying a benign object to be hazardous) must also be extremely low to attain user acceptance. For example, if an automated vehicle brakes hard to avoid a newspaper or paper bag or balloon blowing across its path, the user

55A P P E N D I X A : C O M M I S S I O N E D W H I T E P A P E R 1 will be extremely unhappy with it, and the sudden brak- ing could potentially lead to secondary crashes involving the following vehicles. Achieving the combination of very low false negatives and false positives requires that the sensor signal processing be able to classify targets with extremely high confidence, which is extremely difficult, considering the essentially unlimited diversity of the tar- get objects that could appear in front of a road vehicle. Although no system will be perfect, the advent of auto- mated emergency braking in 2006 and its proliferation across many car models since then indicate that extremes in false positives have been avoided sufficiently to gain some degree of user acceptance and acceptable system performance. Vehicle OEMs introduce this system on more vehicle models every year. For situations at high speeds, the system is designed to provide a warning suf- ficiently ahead of the hazard to give the driver an oppor- tunity to handle the situation; if not, emergency braking activates when a collision is assessed to be inevitable, so as to reduce the energy in the collision. Even at the warn- ing stage, the systems must be acceptable to the customer in avoiding false positives; however, the requirements for false negatives are less demanding than they will be for more highly automated systems because the driver is still available to detect the large majority of hazards. • The threat assessment function at the downstream end of the perception process needs to predict future motions of a target as well as its current locations in order to enable the automated vehicle to take appropriate eva- sive action. A ball bouncing across the path of the vehicle may be followed by a child running into the street to retrieve the ball. A pedestrian standing at the edge of the road is not a relevant hazard, but if he or she is starting to cross the road, the potential for a hazardous situation is created, depending on trajectory and speed of motion. To some degree, these challenges have been addressed by pedestrian warning and detection systems now on the market, including emergency braking for pedestrians, bicyclists, and animals. Although these systems are not perfect, several vehicle manufacturers have deemed them good enough for product introduction. In contrast to automated driving, however, these systems only augment the driver’s vigilance and collision avoidance capabilities rather than supersede them. For high levels of automated driving, it is not clear whether these challenges can be met with the sensor tech- nologies currently available, given the inherent limita- tions of each of those technologies. A perfect system is not possible; however, current collision warning prod- ucts exhibit threat detection and response behaviors that represent a start toward meeting future needs. Because products continue to be rolled out across the industry, it is clear that internal OEM criteria for acceptable opera- tion are being met, generally speaking, but there has not been an opportunity for independent assessment of how strict those criteria are. It may be necessary to advance to imaging radar, which can provide information on range and range rate for all objects surrounding the sensor (vehicle) under all weather conditions and without interference from precipitation. Imaging radar could potentially combine the advantages of current radar, lidar, and video tech- nologies but will require extensive development effort to become a viable alternative at an automotive price point. 3.7 Software Safety The most daunting of all the technology challenges is in the field of software safety. Currently there is no avail- able method for efficiently developing, verifying, and validating software that can be ensured of being depend- able enough to make safety-of-life critical decisions. The complexity of software, especially for an application as complicated as automated driving, is such that it is not possible to prove its completeness or correctness analyti- cally. Exhaustive enumeration or testing is also impos- sible because of the curse of dimensionality (the number of possible combinations of paths through the software logic, given the diversity of the input measurements that the software will encounter in driving, is too vast to be manageable). Analytical methods have been applied to verification and validation but only on extremely simple example problems, and even those have been found to become extremely complicated. The existing analytical methods are not scalable to a problem of the complexity of auto- mated driving. In practice, software verification and vali- dation are currently done by using brute-force methods that are extremely costly and time consuming to apply. Despite the prevalence of software-intensive devices in modern life, the robustness and dependability of soft- ware does not approach that of the hardware platforms that host the software. Consider the relative incidence of software versus hardware faults in desktop and laptop computers or smart phones. The automotive example is somewhat different, in that the vehicle does not need to host unvetted software from uncontrollable external sources, but the inherent difference in complexity of soft- ware and hardware remains. To our knowledge, there have been no examples of safety-of-life critical decisions having been assigned to software systems. Even though software is used to analyze medical data and make rec- ommendations about treatments for patients, a physi- cian must examine and approve those recommendations before a treatment is given. In automated road transport, decisions about vehicle maneuvering can have similar safety-of-life consequences, and major advances in soft- ware engineering (and extensive testing to prove validity)

56 T O W A R D S R O A D T R A N S P O R T A U T O M A T I O N will be required before those decisions can be trusted to software in a real-world application. If a fully sufficient solution is not available, the ques- tion of what constitutes “good enough” is raised. In the domain of product development in a competitive envi- ronment (the automotive industry), each system devel- oper is answering this question individually. Techniques for addressing software safety that build upon extensive techniques already developed for active safety systems are under active development at this time. The specifics of these approaches are proprietary and not published. At the same time, public agencies with responsibility for protecting the public safety have to exercise their own due diligence regarding the safety claims of system developers rather than simply accept those claims at face value. Because of the technical complexity of automa- tion software and the absence of specific reference stan- dards, it is difficult for an external entity (independent test lab or government agency) to independently verify the safety of automation software, which thus remains one of the primary unresolved technological challenges. The situation is further complicated by aftermarket sys- tems offered by new market entrants that may not have a long legacy of developing robust and safe complex vehicle control systems. Methods put forth by Daimler include extensive sim- ulation for verification of control algorithms and rule compliance plus a systematic search for rare functional deficits (instead of just driving large numbers of test kilometers).18 Specific functions noted are • Continuously assessing and adapting to external conditions and rules, • Judging reliably whether limits of vehicle automa- tion performance are close, • Announcing the end of automated driving mode early enough for the driver to take over, and • Bringing the vehicle to a safe stop if the driver should fail to do so. In principle, this seems like a logical approach, but the devil is in the details, and if the approach is not exe- cuted with complete thoroughness it will not be able to lead to a safe system. Validation of the simulations to be used as the baseline for verification of the control system is a serious challenge in itself, because any simulation is a simplified representation of reality rather than the complete reality, and the safety challenges are typically associated with the corner cases that are most difficult to capture in simulations. Following are European projects that directly address this challenging field: 18 Schöner, H.-P. Challenges and Approaches for Testing of Highly Automated Vehicles. Presented at CESA 3.0, Paris, Dec. 3–4, 2014. • PEGASUS (Germany; project for establishing gen- erally accepted quality measures, tools, and methods as well as scenarios and situations for release of highly automated vehicle functions), which seeks to define an extensive set of traffic situations with methods and thresholds to assess controllability; • The Response 4 project of Automated Driving Applications and Technologies for Intelligent Vehicles (AdaptIVe, European Union), which focuses on safety validation and technical system limits as well as on legal aspects for the introduction of automated driving; and • Test Environment for ADAS and Automated Driv- ing Systems (TEAADS, European Union), which aims to improve testing methods and testing automation for highly automated vehicles with high efficiency. This research is very useful in addressing several of the important issues discussed here; these projects could be a starting point for more extensive transatlantic collaboration. 3.8 Ethical Considerations in Computer Control The media frequently refer to no-win scenarios in which any decision made by the automated vehicle results in death. Who lives and who dies—the occupants of the automated vehicle or someone outside the vehicle? Although such an event would be rare, it cannot be left to chance. This issue has given rise to research based in ethics and philosophy on the one hand and work within the auto industry to begin developing implementable ethics in software on the other hand. The latter research involves translating a predefined ethics of driving sys- tematically into computer code so as to define how an automated vehicle behaves in complex driving situations in which every possible alternative leads to some type of harm. Individual automakers are active in this area, but for the industry as a whole this is a research and develop- ment topic still in the early stages. 3.9 Precompetitive Research Opportunities The technical issues reviewed here primarily require significant research investments. Significant differ- ences of opinion exist about the extent to which fun- damental breakthroughs will be needed in several of these topic areas. In-depth interactions of international experts could make important progress toward con- vergence on defining the critical research problems and a roadmap for resolving them. Key issues could be addressed through precompetitive research activi- ties involving public- and private-sector organizations, as has been successfully done in the development of

57A P P E N D I X A : C O M M I S S I O N E D W H I T E P A P E R 1 crash avoidance systems. There should be opportuni- ties for research collaboration and research coordi- nation between the European Union and the United States in most of these areas before the work advances to the stage of development of potentially competitive commercial products. The technological challenges do not stop at national or continental boundaries, and the solutions will be needed in all countries. The solutions may be more difficult to implement in the United States because of its less consistent and less-well-developed roadway infrastructure, but the technology suppli- ers are global organizations serving global markets (including less developed countries with even more challenging traffic and infrastructure conditions). 4 nonteChnologiCal issues A wide range of nontechnological issues needs to be addressed to facilitate the implementation of road transport automation systems. Automation violates many of the assumptions on which existing policies and practices are based, so it requires their fundamen- tal reexamination and reconsideration, which can be intellectually and politically challenging. Complicated interactions with the competitive forces in the automo- tive industry will be involved, as will the various insti- tutional and regulatory perspectives that derive from diverse regional cultures. Resolving policy and regulatory issues can be dif- ficult because automation is a source of apprehension and uncertainty among the general public, the media, and elected officials, just as it is also a source of wonder and hope for the future. The relative mix of these posi- tive and negative perceptions varies greatly from person to person, which accounts for much of the uncertainty about how these issues will be resolved. It should be pos- sible to minimize negative perceptions, if not entirely to eliminate them, when automation technology matures to the level that developers can offer convincing dem- onstrations and satisfactory assurances of the safety of automated driving systems to the market and to public agencies. That is likely to be a high bar for the more highly automated systems to meet. 4.1 Public Policy Issues Public policies associated with the operation of road transport vehicles have until now been based on the rea- sonable assumption that a human driver is controlling the motions of the vehicle and is responsible for ensur- ing its safety. With the higher levels of automation, that assumption is of course no longer valid. This change has the largest influence on state policies regarding road traffic regulations, known colloquially as the rules of the road. Topics that become ripe for reconsideration include the following: • Which aspects of automated vehicles should be regulated at the national level and which at the state or regional level? • Should driver licensing and testing requirements be changed for automated vehicles? • Should people who are not qualified to drive con- ventional vehicles (e.g., those who are too young, too old or infirm, or impaired by substance use) be authorized to travel unaccompanied in automated vehicles? • Should an automated vehicle be permitted to oper- ate on all public roads, or only on specific subsets of the road network? If the latter, what challenges would arise in enforcing this stipulation? • What criteria should be applied to determine whether an automated vehicle is eligible to be registered for use on public roads? • What motor vehicle codes should be modified to account for the enhanced capabilities of automated vehi- cles (e.g., regarding driver distraction, alcohol and drug use, providing information to law officers after crashes)? For instance, an important issue for deployment of truck platooning relates to current regulatory language stipu- lating allowable following distance. • Should public agencies invest in modifying their roadway infrastructure to better accommodate the needs of automated vehicles? If so, how should they prioritize these investments relative to investments in their more traditional roles? • Should government agencies force more uniform standards to be applied to the roadway and roadside infrastructure to simplify the environment for automated vehicles? • Should new organizational and financing models be used to facilitate infrastructure–vehicle cooperation for automated vehicle operations? This cooperation may include professional capacity building focused on required skill sets (technological and financial) within infrastructure agencies. • Should public agencies provide financial incentives for purchase and use of automated vehicles (e.g., prefer- ential toll rates, tax rebates)? • How should law enforcement interact effectively with automated vehicles? As an interesting near-term case study, automated valet parking (which may be on the market as soon as 2016) raises questions in the policy arena. These ques- tions are likely to touch on the jurisdiction of national, state, and city governments. For example, if vehicles are moving around empty in a shopping center parking lot, will pedestrians feel threatened? How can the needs of

58 T O W A R D S R O A D T R A N S P O R T A U T O M A T I O N public safety and the vehicle market be balanced in the definition of new regulations or certifications? In the longer term, if vehicles are able to operate on most of the road network without drivers, there is potential for significant impacts on land use, urban development patterns, and workplace practices. Park- ing locations could be decoupled from the origins and destinations of the travelers, freeing up valuable urban space that is currently occupied by parking facilities. If drivers are relieved of the driving task to do other things while making their trips, the disutility of travel time would be reduced drastically and people’s productivity could be increased significantly (as it is currently for the high-tech employees commuting on their employ- ers’ private coach buses in Silicon Valley). The choice of residential location could be decoupled from the loca- tion of employment. Personal vehicles could become mobile offices for people who need to travel from place to place during the work day, such as sales people. The implications for land use and travel demand are highly uncertain, potentially significant, and in need of careful study. The International Transport Forum of the Organisa- tion for Economic Co-operation and Development acts as a strategic think tank for transport policy. The forum created a corporate partnership board for dialogue with business. Within this structure, it undertook a study of vehicle automation technology from a policy perspec- tive. Key insights were as follows: • Automated driving comprises a diverse set of emerging concepts that must be understood individually and as part of broader trends toward automation and connectivity. • Uncertainty on market deployment strategies and pathways complicates the regulatory task. • Incrementally shifting the driving task to machines and algorithms and away from people – Will require changes in insurance and – May have an impact on what information devel- opers and manufacturers of automated vehicles share and with whom. • Regulators and developers should actively plan to minimize legacy risks by – Enabling monitoring of older models of auto- mated vehicles and – Making use of over-the-air software updates. Questions going forward were as follows: • Treat automated vehicles specifically or generally? • Let policy lead or lag? • Privilege uniformity or flexibility? • Emphasize ex ante or ex post regulation? 4.2 Legal Issues Prior to the advent of automated driving, challenging issues are likely to arise in determining how responsibil- ity is shared when failures occur in cooperative systems that involve multiple vehicles and infrastructure devices. Automated driving will complicate this further. In dis- cussions with vehicle OEMs, a general opinion is emerg- ing regarding operations in the United States: • Automated driving will shift liability from the driver to other players. • No major overhaul of product liability is needed; OEMs will not be liable for misuse. • Instructions to the driver are very important. • The law needs to accommodate driver use plus nondriving activities. Clarity is needed about driver duties in Level 3 automation and above. • The spread of no-fault insurance (available in some U.S. states) could be helpful; however, vehicle OEMs are still open to civil liability lawsuits. Therefore, no-fault insurance is not a panacea. The Vienna Convention on Road Traffic, written before automated vehicles were envisioned, presents potential roadblocks to automated driving on EU roads.19 (The U.S. is not a signatory to the convention.) Further, the United Nations Economic Commission for Europe (UNECE) defines additional factors that may limit auto- mated vehicles. The automotive industry is working with government to potentially amend these documents. The main items subject to modification are as follows: • Every moving vehicle must have a driver, who shall be able to control the vehicle at all times (Vienna Convention). • Drivers shall at all times minimize activities other than driving (Vienna Convention). • Drivers shall at all times be able to perform maneu- vers required of them; when adjusting vehicle speed they shall pay attention to the surrounding situation; they shall slow down and stop when circumstances require. • Automated steering above 10 kilometers per hour is not allowed (UNECE Regulation 79). Proposed amendments, which have not yet been rati- fied, call for language similar to the following: “Vehicle systems shall be considered as in conformity with the regulation when they can be overridden or switched off by the driver.” It is currently not clear if or when new amendments and interpretations will be in place to clear the way for automated vehicle operation. 19 Convention on Road Traffic, Vienna, 8 November 1968. https:// treaties.un.org/Pages/ViewDetailsIII.aspx?src=TREATY&mtdsg _no=XI-B-19&chapter=11&Temp=mtdsg3&lang=en.

59A P P E N D I X A : C O M M I S S I O N E D W H I T E P A P E R 1 4.3 Vehicle Certification and Licensing One of the biggest challenges to the deployment of road transport automation involves determining how to decide whether a specific vehicle automation system is safe enough that it should be permitted to operate on public roads. This question has two dimensions, each posing different challenges: (a) setting the safety require- ment and (b) verifying that that safety requirement has been met by the specific vehicle system. There appears to be widespread agreement that an automated vehicle must be no less safe than the human drivers of today’s road transport system, although some have suggested that it should be safer by some multipli- cative factor (factors from 2 to 10 to 100 have been pro- posed at various times). Some have also suggested that the safety of an automated vehicle should match that of a highly skilled and experienced driver (rather than an average driver) or even that of a modern railroad system. Even the least demanding of these goals (the safety of the average driver today) will be technologically challenging. One way of quantifying this average safety is to rely on existing traffic safety statistics as the baseline. On the basis of U.S. statistics for 2011, this level of safety cor- responds to a mean time between fatal crashes of 3 mil- lion vehicle hours of driving and a mean time between injury crashes of 65,000 vehicle hours of driving.20 (Because rates of property-damage-only crashes are not well documented, it is difficult to estimate the analogous statistics for those crashes.) Fatality rates for European countries range from half that of the United States (in northern Europe) to twice that of the United States (in eastern Europe) After the safety requirement is determined, the bigger challenge is in identifying a method for verifying that a specific vehicle automation system can actually meet that requirement. Because unsafe events are so rare, natural- istic testing would require huge amounts of exposure data to obtain statistically valid samples and therefore would be unaffordable in resources and calendar time. Automated driving is such a new field that no industry or government performance standards have been defined yet, so there is no baseline standard that can be cited as the point of reference for certification. Several proce- dural alternatives have been suggested, but they all pose various problems, including the following: • Manufacturers self-certify that they meet the requirement, without publicly documenting the basis for their certification. This provides no comfort to skeptics, who do not trust the veracity or the methods of the man- ufacturers. However, this technique has been adopted 20 Shladover, S. E. Technical Challenges for Fully Automated Driving Systems. Proc., 21st ITS World Congress, Detroit, Mich., Sept. 7–11, 2014. by the European New Car Assessment Program (Euro NCAP) for advanced active safety systems.21 • Manufacturers self-certify that they meet the requirement and make the supporting data available for public review and approval. This process would expose manufacturers’ intellectual property and would be very complicated for independent reviewers to assess. • Manufacturers document their functional safety design process for review and approval by a third party (could be an independent expert or a public agency employee reviewer). This focus on the process cannot uncover faults in a specific design. • Manufacturers submit their detailed designs (pos- sibly even their source code) for review by a third party expert. This process would be costly and time consuming and would potentially expose manufacturers’ intellectual property. • Manufacturers submit their vehicles for an accep- tance test by the public agency, analogous to a driver’s licensing test. The design of that test would be very chal- lenging and would be expensive to conduct if it is suffi- ciently comprehensive to be a meaningful test of the safety of the vehicle under potentially hazardous conditions. A complicating factor will be the advent of over- the-air software updates that are now used to a limited extent (Tesla) and are likely to become more common. Although it is reasonable for system developers to learn from experience and provide updated software, doing so potentially would raise the need to recertify after each update, as updates can introduce new faults. This is a topic that will benefit from careful consider- ation by the international experts to determine whether it is possible to learn from the best practices in all coun- tries, including in other domains, to identify an approach that can provide credible assurance of safety at a trac- table level of complexity. 4.4 Public Acceptance The J. D. Power 2014 U.S. Automotive Emerging Tech- nologies Study surveyed more than 15,000 people in the United States about a wide range of automotive tech- nologies.22 Respondents were asked to rate their interest in automated driving, assuming a $3,000 option price. A total of 24% of the drivers surveyed were interested (up from 21% in 2013). Preferences skew toward the 21 Euro NCAP Advanced Rewards. http://www.euroncap.com/en /ratings-rewards/euro-ncap-advanced-rewards/. 22 Youngs, J. 2014 U.S. Automotive Emerging Technologies Study Results. J. D. Power, May 2014. http://www.jdpower.com/cars /articles/jd-power-studies/2014-us-automotive-emerging-technolo gies-study-results.

60 T O W A R D S R O A D T R A N S P O R T A U T O M A T I O N younger generations; by age group, those interested were as follows: • 41% Generation Y (born between 1977 and 1995), • 25% Generation X (born between 1965 and 1976), • 13% Later Boomers (born between 1954 and 1964), and • 13% Early Boomers (born between 1947 and 1953). Pricing can be referenced to today’s most advanced vehicle technology packages; 2014 pricing for technol- ogy packages bundling navigation, infotainment, and safety (including adaptive cruise control, lane-keeping assist, blind spot detection, and emergency braking) was in the range of $3,000. The J. D. Power representative price was in that range. Automated systems will require a degree of redundancy of safety-critical systems and components that could bring the price above this range; however, the price to the customer is difficult to predict, as it is heavily influenced by market factors. As to uptake rates, various predictions have been made regarding diffusion modeling. Uptake is more dif- ficult to predict than for previous automotive innova- tions because no other technology ever offered in cars has allowed drivers to do something else with their brain. 4.5 Insurance Insurers will see their business change as crash avoid- ance systems proliferate and if the predicted crash reduc- tions occur on the basis of the use of these systems. The resulting reduction in crashes, coupled with the highly competitive nature of the industry, will put pressure on premiums. The industry as a whole (in monetary terms) may shrink. As automated driving comes, crashes may be reduced further and new crashes caused by the auto- mation may arise. Additionally, human drivers will still be on the road for the foreseeable future, meaning that they could crash into an automated vehicle. The parties in any litigation become the driver of the crash- ing vehicle, the owner of the vehicle that is struck, and, potentially, the vehicle manufacturer if either vehicle was in automated mode at the time. New business structures for spreading risks will need to be devel- oped. During periods when the automation system is engaged, the insurance premium may in effect be paid by the manufacturer. Event data recorders that capture precrash data exist today and are expected to evolve to capture more com- prehensive data as automated driving systems become available. The evolution of event data recorders will make assigning fault easier than it is today. Insurers historically have focused on driver perfor- mance. Now it is becoming necessary to also understand vehicle performance (the presence and performance of driver assistance and automation functions on board) to more completely assess (reduce) risk. 4.6 Benefits and Impacts The impacts of automated road transport will be diverse, complex, and highly uncertain because it will affect so many aspects of transport system performance, espe- cially at the higher levels of automation. Any prediction of impacts will have to be based on assumptions about many issues that remain highly uncertain and should therefore only be subjected to sensitivity analyses rather than definitive predictions. The following questions are sorted into those that are market oriented and those that are societally oriented: • Market-oriented questions: – Development trajectories of the automation technologies—what capabilities will become techni- cally feasible in what years and how much will they cost? – Development of the market for automated transport systems—how much will customers be will- ing to pay for each capability? – How will the degree and extensiveness of infrastructure support affect market introduction of higher-level automation systems? – What vehicle performance characteristics will customers desire? • Societally oriented questions: – How much cooperative infrastructure support will be available to facilitate the use of automation, and where will it be available? – For vehicle performance characteristics that customers desire, how will that vehicle performance influence traffic flow capacity and stability? – How much reduction in energy and emissions will be achievable with the vehicle performance char- acteristics that customers desire? – How safe will automated transport systems actually be in practice after their own internal failures are accounted for? – How will pedestrians and bicyclists interact with fully automated vehicles that have no human drivers? – How will public preferences for housing evolve, and what impacts will that evolution have on future urban form (i.e., trends in densification versus sprawl)? – How will employment patterns change, and what does that mean for commute trips to workplaces versus telecommuting?

61A P P E N D I X A : C O M M I S S I O N E D W H I T E P A P E R 1 – What is the elasticity of travel demand with respect to travel time when that travel time can be spent doing whatever the traveler wants to do rather than driving? – How will the growth of online shopping affect urban goods movement needs? Depending on the answers to questions such as these, the impacts of automation could vary greatly, ranging from large growth in vehicle miles traveled, with con- comitant adverse impacts on congestion, energy use, and emissions, to new urban forms with reduced traffic impacts and improved quality of life. 5 business moDels anD the roles of the PubliC anD Private seCtors The United States and the countries of the European Union have widely varying traditions and practices in their relationships between the public and private sec- tors. Approaches that fit well within one country’s estab- lished business and legal frameworks may not fit well at all in another country. Regardless of country-specific issues, the definition of business models and the rela- tionship between the public and private sectors in the deployment and operation of road transport automation eventually comes down to identification of who gains and who pays. When the costs and benefits are naturally distributed equitably among the stakeholders, progress can be swift and smooth, but business models become challenging when there is a mismatch between who gains and who pays. In these cases, financial transfer schemes typically need to be created to redress the mismatch, and these schemes can become complicated, especially if political decisions need to be made about taxing stake- holders who gain to compensate others who lose. 5.1 Private Vehicles and Public Road Infrastructure The most common model for road transport involves privately owned and operated vehicles that use publicly owned and operated roadway infrastructure. The costs of the roadway infrastructure are financed through a combination of user fees charged to vehicle operators (fuel taxes, vehicle licensing taxes, and tolls) and general tax revenues. Some countries have stretched the roadway ownership model to include private, public–private, or quasi-public ownership and operation of some sections of their primary road infrastructure (e.g., bridges, tun- nels, turnpikes, major highways). In these cases, the user fees need to be allocated more precisely to reflect the amount of usage of the facility by each user. At the higher levels of automation, where there are technical reasons for vehicles and roadway infrastruc- ture to be well matched to each other, there are oppor- tunities to change the traditional business model to a more closely integrated one. Vehicles and roadway infra- structure could be owned by a common entity (public, private, or public–private partnership), and a transpor- tation service could be offered to end users, who would pay directly for each trip or each period of usage rather than purchasing a vehicle. For this vision to come about, all parties must estab- lish credibility as reliable business partners who are com- mitting to invest at a certain level and within a specific time frame. In the past, such a commitment has been challenging for the public sector because of limitations on and the unpredictability of budgets and because of changing priorities. On the private-sector side, it is chal- lenging for the industry to speak with one voice, owing to the varied actors at play—namely, individual auto- makers and truck manufacturers (the incumbents) plus potential new entrants. 5.2 Types and Levels of Infrastructure Support for Automated Vehicles The business models that are likely to become attrac- tive will depend on the type and level of infrastructure support that automated vehicles will need to reach a beneficial level of system performance. Examples of infrastructure support include the following: Level A. Digital road infrastructure (e.g., digital maps or other static databases about the driving envi- ronment) and dynamic information (e.g., real-time data about lane closures, work zones, incidents, and traffic conditions); Level B. I2V and V2I communication of data relevant to the dynamic driving task; Level C. Improved road markings, roadway lighting, and signage; Level D. Changes to civil infrastructure (e.g., special barriers to protect the automated vehicle’s path, segre- gated lanes or ramps, or completely segregated rights- of-way); and Level E. Standards for asset management, that is, the state of good repair of supporting infrastructure, includ- ing pavement and traffic control devices. Any of these levels of infrastructure support could be provided by public-sector agencies working within their traditional areas of responsibility. Level A infrastruc- ture support could easily be provided by private com- panies operating within their current business models, and Level B support could also be provided publicly or

62 T O W A R D S R O A D T R A N S P O R T A U T O M A T I O N privately, although the latter would require some policy changes by public agencies to make the underlying data readily available to private entities in real time. At Levels C and D, the functions are much more closely tied to traditional public-sector responsibilities, and the invest- ments of capital and operating expenses are considerably higher as well. Providing these types of infrastructure support privately would represent larger changes from current practices in most jurisdictions and larger finan- cial commitments. In cases when Level C or Level D infrastructure sup- port, or both, makes a large difference in the capabili- ties of an automated vehicle system, and especially when this support makes the difference between the technical feasibility or infeasibility of a road transport automa- tion service, there is an opportunity for an integrated vehicle–infrastructure business model. One organization (such as a partnership between a private road operator and vehicle manufacturers) could invest in both vehicle and infrastructure elements (as railroad companies do today) and sell the resulting transportation service to the end users. This idea could make financial sense when the combination of vehicle and infrastructure elements enabled a significantly enhanced level of transportation system performance (such as dramatically increased capacity or speed or the introduction of a new service such as automated repositioning of unoccupied vehicles). The caveat about reliable business partners noted previ- ously applies in this context as well. 5.3 Roadway Infrastructure Deployment Challenges Roadway infrastructure owner–operator agencies are underfinanced in most countries and are challenged to maintain the roadway infrastructure that they already own. It is difficult for them to finance expansions or enhancements of their facilities, even when the benefit– cost ratios and return on investment estimates are favor- able. Addition of sophisticated technology elements to their portfolios is also challenging because the staff of most infrastructure agencies come from traditional civil engineering backgrounds and do not have the techni- cal expertise to effectively acquire, operate, or main- tain information technology systems. The infrastructure development process, which involves public policy mak- ers and their constituents, is typically slow and delib- erative, with multiple layers of checks and balances and reviews for policy, funding, and environmental impacts. This means that the process needs to be started early enough to enable infrastructure changes to be imple- mented by the time they are needed. In the event that onboard systems alone cannot pro- vide sufficient performance for a higher level of auto- mation (the likelihood of which is subject to significant differences of opinion), the financial and technological limitations of public roadway infrastructure agencies could become the pacing factor in limiting the rollout of the more highly automated vehicle systems in some countries or regions. Locations that have the ability to upgrade their infrastructure are likely to experience the benefits of the higher levels of automation earlier, but widespread deployment will be limited by lagging juris- dictions. In this situation, new business models that facil- itate private investment on the roadway infrastructure side could make a large difference. The private market for vehicles with higher automation capabilities is likely to be stunted until those vehicles are usable over a large fraction of the roadway network. How enthusiastic will the car-buying public be about paying extra for features that can only be used when driving in wealthier political jurisdictions? 5.4 Business Models for Financing Infrastructure Improvements In situations in which the lack of infrastructure support is impeding the transportation system improvements that could be gained from automation, there should be a financial incentive to seek or develop new business models for financing infrastructure improvements. The financial incentive comes from the willingness of end users to pay to receive the benefits of those improve- ments (e.g., travel-time savings, stress reduction, ability to do other things safely while driving, avoiding vehicle ownership expenses). The new business models could include • Joint public–private financing of infrastructure modifications; • Charging for road use (tolling or distance-based pricing), perhaps with prices dependent on the fraction of the system capacity that each user consumes; • Formation of a new transportation enterprise (or partnership) that owns the vehicles and their running way and charges users for the distance or time that they use the vehicles; • New public–private partnership arrangements yet to be defined; and • Investments from new types of organizations, such as information service providers who are willing to pay to gain improved access to the eyeballs of drivers who are no longer driving. The United States and the European Union should be able to learn from each other’s experiences with any new business models so as to help each other find the most promising alternatives to suit their needs.

63A P P E N D I X A : C O M M I S S I O N E D W H I T E P A P E R 1 6 ConClusions Road transport automation has the potential to make profound changes to the operation of road systems throughout the world. It is currently unclear how long it will take to realize the potential changes from each level of automation because there are so many uncertainties about the technologies and the policy environment in which they need to be deployed. These uncertainties rep- resent great opportunities for research and development cooperation between the European Union and the United States, which both stand to gain from the products of the research and development work. The challenges are so large that neither region can expect to resolve all of them on its own, and progress will be accelerated through sharing of knowledge and resources. Information exchange about road transport automa- tion is improved when common terms of reference can be relied on in communications. For example, confusion about the state of automation development and capabili- ties is minimized when descriptions of automated driving systems are qualified in terms of their goals, the relative roles of the driver and the automation system, and the type of environment(s) in which the automation func- tions can be used. Some fundamental aspects of road transport auto- mation remain controversial and subject to differences of opinion that are not easily resolved. These questions include the following: • To what extent do in-vehicle automation technolo- gies need to depend on support and cooperation from the roadway infrastructure and other vehicles? • What level of public-sector involvement will be needed to provide infrastructure support for automa- tion, if needed? • Can the higher levels of automation be imple- mented solely on the basis of enhancements to tech- nological capabilities that already exist, or will their implementation require fundamental breakthroughs in some technological fields? • What roles should national and regional or state governments play in determining whether automated driving systems are safe enough for use by the general public? • How safe is safe enough? • How can an automated driving system be reliably determined to meet any specific target safety level (suf- ficient for certification)? • Should designs of automated driving systems be required to inhibit abuse and misuse by drivers, or should the proper use of the system be left to the responsibility of the individual driver? • Are new business models for interactions between the public and private sectors in road transport necessary for the successful implementation of higher levels of auto- mation? If so, what are the most promising such models? • How will road transport automation change the nature of public transport services? Will those changes lead to more or less use of public transport, and will societal goals for mobility be enhanced or degraded? • What will be the net impact of the automation of road transport on vehicle miles traveled and on the energy and environmental impacts of road transport? Some of these issues derive from fundamental philos- ophies about the roles of the public and private sectors, but others are susceptible to resolution through research. Some specific research areas have been suggested in both technological and nontechnological fields. Technologi- cal research is needed on a wide range of topics, listed here in order of increasing level of difficulty: 1. Wireless communication technologies sufficiently robust to support automation; 2. Highly dependable methods of vehicle localization; 3. Human factors and driver interfaces to support mode awareness and safe mode transitions; 4. Practical methods for developing and continually updating high-definition map data to support automated driving; 5. Incorporation of ethical considerations into control system design; 6. Fault detection, identification, and accommoda- tion methods to enhance safety when fault conditions arise; 7. Cybersecurity methods to protect against attacks (applicable to all modern vehicles, not only those with automated driving capabilities); 8. Environment perception technologies that can pro- vide extremely low rates of false positive and false nega- tive hazard identifications; and 9. Software safety design, development, and verifica- tion and validation methods that can be implemented affordably. These topics should be fruitful ones for EU-U.S. coopera- tion on precompetitive research to develop the funda- mental technical capabilities. In the nontechnological areas, the differences between EU and U.S. situations are likely to be larger, so the fit may not be as close. However, studies of the contrasts between the EU and U.S. situations can also be enlight- ening, even if the most appropriate approaches turn out to be different in the end. Nontechnological topics for investigation include the following questions: • Which aspects of automated vehicles should be regulated at the national level and which at the state or regional level?

64 T O W A R D S R O A D T R A N S P O R T A U T O M A T I O N • Should driver licensing and testing requirements be changed for automated vehicles? • Should people who are not qualified to drive con- ventional vehicles be authorized to travel unaccompa- nied in automated vehicles? • Should an automated vehicle be permitted to oper- ate on all public roads or only on specific subsets of the road network? If the latter, what challenges would arise in enforcing this stipulation? • What criteria should be applied to determine that an automated vehicle is eligible to be registered for use on public roads? • What motor vehicle codes should be modified to account for the enhanced capabilities of automated vehicles (e.g., codes regarding driver distraction, alcohol and drug use, providing information to law enforcement officers after crashes, and so forth)? • How should public agencies make decisions about prioritizing investments in modifying their roadway infrastructure to better accommodate the needs of auto- mated vehicles? • Should government agencies force more uniform standards to be applied to the roadway and roadside infrastructure to simplify the environment for automated vehicles? • Should new organizational and financing models be used to facilitate infrastructure–vehicle cooperation for automated vehicle operations? • Should public agencies provide financial incentives for purchase and use of automated vehicles (e.g., prefer- ential toll rates, tax rebates). • How should law enforcement interact effectively with automated vehicles? • How should legal issues such as vehicle codes and the Vienna Convention be addressed to minimize inter- ference with the implementation of automated driving systems? • Should laws be modified to ease liability concerns for the implementation of automation? • How should minimum safety requirements be determined for automated driving systems? • How should a new automated driving system’s compliance with minimum safety requirements be determined? • Who should certify the safety of automated driving systems? • How much will the public be willing to pay for various levels of automated driving systems? • How rapidly will the market grow for the various levels of automated driving systems? • How will the insurance industry have to adapt in response to changes in crash rates and causes after the introduction of automated driving systems? As these issues are studied, new ideas are likely to arise about how to change the traditional split between privately developed, owned, and operated vehicles and publicly developed, owned, and operated road- way infrastructure. Answers to some of the questions raised in this paper could be developed through new forms of public–private cooperation that still need to be designed.