安全驾驶倡议：创建安全自主车辆政策.docx

34666777991010121313141415161617181920Cover: Getty Images/MetamorworksContentsPreface1 Executive summaryKey terminology1.1 Defining verification methodsOther reference terms2 MotivationState of the industry2.1 Current state of autonomous vehicle policy initiativesTechnical standardsInternational validation initiativesAV policy case studies2.2 USA - self-certificationCase insights2.3 United Kingdom - code of practiceCase insights2.4 Singapore - operational safety assessmentCase insights2.5 DiscussionSynthesis2.6 OpportunitiesAddressing the safety gap in AV policy2.7 Objective of Safe DI frameworkContributorsEndnotes© 2020 World Economic Forum. All rights reserved. No part of this publication may be reproduced or transmitted in any form or by any means, including photocopying and recording, or by any information storage and retrieval system.CaliforniaCalifornia has implemented a self-certification-based permitting programme, requiring applicants to its Autonomous Vehicle Tester (AVT) programme to submit a range of information prior to deployment regarding the AV's development, capabilities, operational plans and organizational safety measures. The state does not directly conduct any validation tests, and reviews information submitted through this programme only. In all cases, California requires reporting of all collisions within 10 days as well as an annual report summarizing all disengagements of the automated driving system during testing.There are currently three stages of permit in California, each requiring information to be submitted with the application by the AV developer:- AV testing with a safety driver (66 holders as of1 July 2020)Acknowledgement that the driver is in immediate control of the vehicle and can take over at any timeInformation regarding operator training course一 AV tests without a driver (three holders as of 17 July 2020)一 Acknowledgement that the vehicle is capable of Level 4, Level 5 driving (SAE J3016) and can operate without a driver一 Demonstration of system that allows two-way communication with passengers- Submission of law enforcement interaction plan to California Highway PatrolNotification to local authorities of plan to test in jurisdiction (local authority approval is not required)- Intended ODD- AV deployment programme (no permits issued at the time of writing):一 Description of intended ODD, any commonly occurring restrictionsDescription of vehicle safety mechanism in the event of ODD excursion, and when occupant is unable to take manual control of vehicle- Summary of manufacturer testing一 Copy of VSSA if publicly available- Requires data recorder to capture at least 30 seconds of data before a collision with another vehicle, person or objectCalifornia's publication of disengagement data has become one of the de facto indicators of autonomous vehicle system development, simply because of its widespread reporting and republication. However, this stand-alone metric provides a very limited insight into the maturity of the technology, and has been widely criticized by industry, academia and other policymakers as insufficient for decision-making purposes.In addition to satisfying the requirements of the California DMV, AV companies in California that intend to operate a passenger service are further subject to regulation by the California Public Utilities Commission (CPUC).Beyond disengagement reporting, regulators in the US have struggled with how to measure and determine safe performance and continue to defer to AV providers to show that systems are safe to operate in public. City regulators have expressed a desire for deeper insight into AV providers, own metrics for system performance to improve upon the existing metrics such as miles per disengagement.ArizonaIn contrast to California, the State of Arizona has taken a very permissive approach to AV testing. In 2018, Arizona's Governor signed an executive order enabling testing of AVs without a safety driver, and Arizona is the only location in the US where driverless AVs have been commercially deployed to date: Waymo operates a driverless taxi service in the greater Phoenix area.Testing with a safety driver requires companies to complete an online form attesting to the following requirements:1- The AV will operate within all applicable laws一 The operator of the AV may be issued a citation in the event that the AV does not comply with traffic laws- The AV will be supervised by a trained employee of the AV company developing the technologyTesting and operation of an AV without a safety driver also requires companies to attest to the above requirements, as well as several further statements:- The AV has all required federal certifications (unless an exemption from the National Highway Traffic Safety Administration NHTSA has been granted) and meets all required licensing and insurance requirementsThe AV can achieve a minimal risk condition in the event it is unable to perform the required driving task within the intended ODD- AV developers must submit and follow a Law Enforcement Interaction Protocol instructing first responders on how to interact with the AV in emergency situations (e.g. how to interact with a fleet support specialist; how to move the vehicle from the roadway)The state of Arizona does not require AV companies testing or operating in the state to submit any ongoing reports about their AV operations, such as accident reporting or disengagements. While there is a limited requirement for documentation, failure on the part of the AV provider to submit the proper notice prior to testing or operation can lead to an immediate cease and desist notice on AV testing until the AV provider is in compliance with all laws and regulations.Case insightsDevolution of vehicle licensing responsibility has created a fragmented market, which may harm widespread deployment of AVs in the US: The federal governmenfs hands-off approach has enabled states to set their own requirements for AVs, but this has led to a variety of different safety requirements in various states. California AV permitting programme is the most stringent in the US, while other states, such as Arizona, place minimal requirements on AV operators. This lower bar may encourage some AV operators to trial their vehicles in other states, but the long-term viability of this patchwork approach is questionable.While the DoT and NHTSA have recently launched new initiatives in AVs (such as the AV TEST initiative) these have done little to harmonize the regulatory patchwork across states.Not all self-certification policies have the same level of oversight. California requires some supporting documentation regarding the AV's development process and safety procedures, while Arizona requires only that companies attest to the AV's ability to operate safely and achieve a minimal risk condition if it leaves its intended ODD. Arizona's approach leans entirely on companies to develop AVs safely, while California has attempted some level of independent assessment and ongoing monitoring.Arizona's lack of regulatory oversight has been identified as a contributing factor in the first fatality from AV development. Following an investigation by the National Transportation Safety Board (NTSB) into the accident, in which an AV struck a pedestrian in Tempe, Arizona, in March 2018, the open policy environment was identified as one of the contributing factors in this collision. In addition to identifying a problematic safety culture and a range of other contributing faults on the part of the AV company, the NTSB wrote in its 2019 analysis of the accident that “Arizona's lack of a safety-focused application-approval process for ADS automated driving system testing at the time of the crash, and its inaction in developing such a process since the crash, demonstrate the state's shortcomings in improving the safety of ADS testing and safeguarding the public". The NTSB also describes the NHTSA's voluntary safety selfassessment requirements as “inadequate”.The California DMV's disengagement reporting has been criticized as lacking suitable context and depth to indicate safety or technology maturity: Many industry leaders have publicly criticized the use of disengagement reporting as a safety metric. Disengagements are a function of complexity of test conditions and the number of miles driven. In addition, a disengagement indicates only that a human test operator took over an AV at a given time, not necessarily that there was a failure of the automated driving system. Moreover, the way this data is reported varies considerably between operators, from lengthy descriptions of each disengagement and of system faults to single-word entries. This highlights the need to improve the way in which such data is reported to standardize inputs, making comparisons possible. Doing so would enable other stakeholders, such as cities, to derive their own insights from this dataset.Despite such vocal criticism of the disengagement reporting approach, AV operators are reluctant to share publicly how they measure safety and development progress internally, as a means of protecting intellectual property. Given the varied approaches AV companies in the US are taking, and the fact that the AV industry as a whole is still in a testing phase, there is not yet consensus on exactly which metrics will be necessary to make this safety case.The industry-led development in the US is creating an environment in which safety can be a source of competitive advantage: Without harmonized, uniform requirements across the country, AV operators treat information on their technology's safety and maturity as the most closely guarded industry secret. When combined with the race to launch commercial AV services, this creates an unhealthy competition where safety is something on which AV companies compete, rather than collaborate with one another.4.2 United Kingdom - code of practiceIn 2019, the United Kingdom published the non- regulatory Code of Practice: Automated Vehicle Trialling2 following a review of existing road traffic laws, to provide guidance for AV companies seeking to test vehicles on UK roads. This code of practice outlines the need for compliance with existing traffic laws, covering subjects from insurance to vehicle roadworthiness, while encouraging engagement with the relevant government agencies and the public.According to this code of practice, no further permit is required to conduct testing of an AV on UK roads, provided there is a safety driver or operator, in or out of the vehicle, ready to take control of the vehicle.This code of practice is not a stand-alone policy in the UK; it has been accompanied by a series of strategic initiatives to strengthen the UK's development of, and investment in, AVs. This began in 2015 with the creation of the Centre for Connected and Autonomous Vehicles (CCAV), a government centre of excellence established jointly from within the Department for Business, Energy and Industrial Strategy (BEIS), and the Department for Transport (DfT). CCAV's mission is to work across the government to support and enable the development of connected and automated vehicles in the UK, thorough funding, conducting direct research and collaborating with other government entities.Following the creation of CCAV, the UK government has continued to make connected and automated vehicles a priority for the nation's industrial policy, and it has embarked upon setting up a further nongovernmental entity to create a strategic roadmap for CCAV policy in the UK, called Zenzic. This roadmap was issued in 2019 and establishes a range of policy priorities across subjects such as cybersecurity and creating test beds for AVs, until 2030.Additionally, the British Standards Institution (BSI) is actively developing a range of connected and autonomous vehicle publicly available specifications (PAS) standards to complement the UK's policy needs. The PAS 1880 series establishes relevant requirements for AV trials in a number of fields, including:- PAS 1880: Guidelines for Developing and Assessing Control Systems for Automated VehiclesPAS 1881: Assuring the Safety of Autonomous Vehicle Trials and Testing- PAS 1882: Data Collection and Management for Automated Vehicle TrialsPAS 1883: Operational Design Domains (ODD) Taxonomy for Automated Driving System (ADS) -SpecificationFurthermore, the UK is also undertaking the development of its own scenario library for the purpose of establishing a scenario-based operational safety assessment in a programme called CertiCAV, led by the Connected Places Catapult (a government-created non-profit organization) and Warwick Manufacturing Group (WMG), University of Warwick.Finally, the UK Law Commission is currently undertaking a three-year review to understand the need to modify the legal framework to further support and enable AV deployment.Case insightsThe British government has established a top-down strategy to position the UK as a leader in connected and automated vehicles: By establishing and funding an initial mission to encourage the development of AVs and related technologies in the UK, the government has been able to subsequently create an achievable policy roadmap to ensure there are minimal barriers to AV testing on UK roads.The broad code of practice provides guidance on how to test AVs on the road in the UK in compliance with UK law: This enables AV operators to ensure AVs can be tested and developed on the public road legally and with the support of the government.While this meets the objectives of not creating additional barriers to testing, and creates a level playing field for AV companies, this code of practice is not a suitable framework for AV deployment at scale, and may require additional stipulations for AV safety as the number of operators trialling in the UK increases. The UK government acknowledges this, and has further commissioned the creation of a certification and approval scheme, called CAV PASS, which is intended to create an assurance process for approving the sale and deployment of AVs at scale in the UK.The UK is developing a scenario library for operational safety assessment: In future, the AV Code of Practice is likely to be superseded by further regulation, creating an operational safety assessment based on the CertiCAV library.4.3 Singapore - operational safety assessmentSince 2017, Singapore's regulators have been highly proactive in creating policies to enable the development and testing of automated vehicles in their city-state. This approach has led to the establishment of a joint centre of excellence (CoE) with Nanyang Technical University (NTU) called CETRAN, and the creation of a series of technical standards and regulations for autonomous vehicles in Singapore.One of the cri