Taking things safely to the next level

28 March 2019

More comfort, less pollution and fewer accidents - these are the promises of the proponents of self-driving cars. But what level of autonomous driving do we currently find ourselves on? What do vehicles have to be able to do to independently navigate traffic situations? And how can their safety be subjected to thoroughgoing scrutiny? All these questions are addressed in this interview with Katrin Leicht from TÜV NORD.

#explore: The announcements of various manufacturers give the impression that self-driving cars are going to be trundling along our roads in the near future. But what level of autonomous driving do we actually find ourselves on?
Katrin Leicht: Here, you have to make a distinction between development for mass production and research projects. Although with test vehicles you can trial fully autonomous vehicles up to Level 4 with safety concepts designed specially for real use, series development requires a step-by-step approach and has to be based on legal standards every step of the way. We’re currently at Level 2. What this means is that drivers benefit from the support of assistance systems and can temporarily take their hands off the wheel but must always be ready to intervene and are always fully responsible for every vehicle function.

What will change when we get to Level 3?
At Level 3, the driver can temporarily relinquish responsibility to the vehicle in certain predefined situations and get on with other tasks - this is envisaged, for instance, for traffic jams or with driving assistants for motorway journeys. The vehicle needs to be able to cope with every situation that may arise in any road-use scenario, such as driving in a traffic jam. The vehicle must be capable of making decisions: It needs a basis for decision-making in the form of sensor systems, smart software which can interpret the information, and a decision logic according to which these decisions can be made. It’s also essential that the vehicle is capable at all times of identifying objects under all weather conditions and regardless of the light.

Can Level-3 vehicles be approved for road use under the regulations currently in force?
In principle, it’s already possible to introduce such systems. An amendment to the Vienna Convention means that automated systems are permitted as long as they can be overridden or switched off by the driver at any time. This change was adopted in Germany in September 2016 and transposed into national legislation in 2017 by an amendment to the Road Traffic Act. The international UN regulation for steering functions is currently being updated to define their specific technical design. This process is unlikely to be completed before 2019. How these systems are going to be safely and efficiently tested in the approvals process remains to be seen. The legislation as it currently stands requires the individual testing of brake systems and steering. From Level 2, however, these are effectively paired with one another. This interplay of braking, steering and acceleration functions must be included in the regulations to enable a holistic approach to autonomous driving functions.

Vehicle sensor systems must also work reliably in the pouring rain. Are weather conditions already part of a possible testing scenario?
This isn’t yet the case. Even if manufacturers take such test scenarios into account, the respective system parameters within which the autonomous function will work properly must be communicated to the driver. System parameters refer to more than just weather conditions, however. In any case, we need a definition of how such weather conditions can be specifically tested. You can’t necessarily carry out motorway tests in snow and ice under real conditions - after all, you can’t restrict the tests to wintertime only. Here, we may need to develop meaningful simulations to examine such scenarios under realistic conditions. We also need suitable test sites where such simulations can be carried out in the first place and which meet the requirements of the regulations.

What are the other challenges on the way to Level 3?
The transition from Level 2 to Level 3 is a significant leap - particularly with the temporary transfer of responsibility from the driver to the car. It will have to be possible to track who was responsible for which driving manoeuvre. To this end, the legislature has determined that, as of Level 3, every journey must be mapped by a black box in the car. The system must also be capable of accurately identifying its own limits in advance if it is to be able to tell the driver to take back control with sufficiently early warning. This phase of the transfer of control is especially critical. At this point it’s essential to work out which signals related to the interaction between the system and the driver are most suitable to ensure that the latter always knows what to do. The time allowed for the handover must be clarified along with the activities which drivers should be allowed to engage in, given the need for them to be ready to intervene at a moment’s notice.

To suddenly have to take the wheel in an emergency situation is a major psychological challenge. Can you already draw on previous experience and studies that demonstrate whether and in what time frame this actually works?
Minimum and maximum values which reflect the wide range of driver responses have been evaluated for this purpose. It can take up to 30 seconds. However, when you consider the potentially high speed of travel and the distance that can be covered in that time, this value is clearly unacceptable. One of the challenges is to ensure that each driver has enough time to readjust to having to take back control. On the other hand, the system must be fully functional during this handover period. It needs to be able to recognise its system limits early enough to ensure that the driver is given enough time to take over. As this transfer of control from a human driver to a machine is such a big challenge, some manufacturers have announced their intention to skip Level 3 and go directly to Level 4.

Fully automated driving at Level 4 requires the vehicle to be able to cope with long stretches of driving, such as a whole motorway journey, entirely by itself. But the driver must also be capable of intervening if need be. But don’t I as a driver run the risk of getting out of the habit of driving routinely and safely if the car is in control much of the time?
Proponents of autonomous driving usually argue that cars can drive themselves much more safely than human drivers. But if we build possible uncertainties into the overall system because the driver can no longer respond appropriately, with the ensuing risk of causing an accident, then this argument doesn’t of course hold water. A possible solution would be to introduce special driver training, in which drivers are trained in the handover of control from the car to the human driver, much as airline pilots are.

What does this development mean for approval standards and test procedures, and what role is being played by the testing institutes?
We at the Institute for Vehicle Technology and Mobility (IFM) are advising the German Ministry of Transport on the series development of automated vehicles as part of the special committee on “Driver Assistance Systems”. We’re also involved at the same time in a number of research projects, including the autonomous shuttle buses being tested at the Charité hospital in Berlin. In such research projects, national legislation allows for a few exceptions which would not be possible for series vehicles. The approach to approving these projects currently varies from one federal state to the next. We’re working with other TÜV organisations to develop a guideline to standardise the approval of such research vehicles on a national basis and to give inspectors some guidance on what they need to take into account.

How do you proceed when it comes to the approval of such research projects?
Generally speaking, the vehicle must comply with the laws on road use. In addition to the driving functions, we examine the safety concept of the vehicles and the routes on which their use is proposed. This because these vehicles are permitted only to take a specific route. If, for instance, a route is likely to have a high volume of pedestrians, you can set a limit whereby the top permissible speed is restricted to 10 km/h. After all, the whole point of these research projects is to gather information on how the sensor systems of various manufacturers stand up to scrutiny and how the vehicle responds in daily use so that these data can be used to improve the system. One possible approach to safety might be the definition of a safety tunnel. If individuals or other vehicles stray into this zone, the car comes to a stop. You can’t of course do this on a motorway without running the risk of being rear-ended by another car.

Which aspects are set out in the guidelines for the approval of such research projects?
A key aspect is that the responsibility for the vehicle must be clearly outlined and only trained safety drivers be allowed operate the vehicle. This is because a steward of this kind needs to be in the vehicle at all times. This is stipulated by the Vienna Convention, which doesn’t currently permit self-driving cars without a human driver on board. The ultimate goal of the manufacturers is, of course, to reach Level 5 - in other words, an autonomous vehicle that operates completely independently without human intervention. Here, we’re in the middle of setting up a collaboration with partners to work out the requirements. In other words, we’re seeking to define what requirements would need to be met for driverless cars to be tested safely - and to find out if that’s even possible.