How To Design an Autonomous Car – Part 2

Take a look at good old J3016 below and its 6 levels of automation. You can see the chart is split into 2 halves, the first 3 levels are blue, the last 3 green.

But what does this actually mean, when we consider that the driver is always legally responsible for the control of their car the moment they get behind the wheel and start the engine, regardless of the features they paid the extra cash for.

Let’s take Automatic Emergency Braking for example.  The feature is designed to activate if the “System” suspects that the driver has not applied the brake in time, or with sufficient pressure, to avoid colliding with the car ahead.  But what if the feature doesn’t activate? Well simply put, it is still the driver’s responsibility not to insert their vehicle into the back of the one ahead, and even though some OEMs might have concluded that some level of dependency may form between the driver and the emergency braking feature, convincing the judge that the crash was the OEMs fault because the AEB system had prevented so many collisions in the past, that the driver had started to take it for granted and drive negligently, and thus didn’t bother braking that time the system didn’t trigger, is going to be tricky.

Note: Unintended emergency braking, is an entirely different subject and one that S3016 doesn’t worry itself too much about.  I can feel another blog coming on.

The same applies for Blind Spot Monitoring.  Although the system is designed to alert the driver to the hidden proximity of another vehicle, it does not mean that the driver can stop looking in the side mirror or over their shoulder, before they make their mad dash across the lane boundary; the system not triggering is not an approval.

It does however get interesting around the Level 2 mark, when you combine longitudinal and continuous lateral control, otherwise known as acceleration, deceleration and steering.  That’s when the “Maybe I should have read all the warnings in the handbook your Honour, but the system WAS driving and I lost concentration”, might actually give the judge pause for thought.  This of course is where “Driver Engagement Monitoring” comes in, but frankly it’s a bit of a technical mine field, and a subject for a later date.

Now lets take a look at Level 3.  This is where we start getting serious, and of course, autonomous.  Level 3, as I eluded to in the last blog, is a tad murky when it comes to whose insurance company is paying for damages; you’ll notice there hasn’t been huge amount of noise from OEMs declaring their L3 features.

So what does J3016 say? J3016 states that physically, the driver is NOT driving when the feature is engaged i.e.  the system, (not the law), does not need the driver to be involved.  Ergo the driver’s hands may be completely off the steering wheel, or on the wheel but applying no intentional steering torque, and their feet completely free of the pedals, because the feature is in the zone and can handle it.  BUT, the moment the system can’t handle it, the driver is expected to jump back in the saddle and take the reins of whatever situation they have just found themselves in.

In a perfect world, this wouldn’t be a problem, the system would alert the driver in plenty of time, and of course the driver who would have been paying close attention, will already know that the hand over is coming and will be more than happy to once again start driving.  If only we had to design systems for a perfect world.

As for the judge, its going to get complicated.  Although the driver is by law required to be in control of the car at all times, the driver was sold a car that could drive itself.  But even if the driver was paying attention, if the driver was not capable, or skilled enough to get out of the situation the car had put itself in, then what? We will have to wait to find out.

Level 4 and Level 5 are much easier to wrap the old noodle around.  Level 4 will only work in controlled environments, such as enclosed car parks (for privately owned road cars), with beautifully painted white lines, spotless radar reflectors, perfect lidar friendly walls and a zero tolerance for pedestrians and non-level 4 cars, or airports etc.  for public transport vehicles, and Level 5 will work everywhere.  In both cases, the driver may not necessarily be in the car at the time of the inevitable crash, and therefore the clean-up bill will more than likely rest entirely with the OEM.

So what does this have to do with you, the designer? Well for a start, you need to understand what you’re getting yourself into.  The SAE Level at which your system is planning to operate, will massively affect the level of engineering required.  Don’t get me wrong, AEB, a purely longitudinal feature, is not easy to design and implement robustly, but it is in a different ball park to a feature that slows down, speeds up and steers.  But whichever the level, everything from your System Level Requirements, your Use Cases Analysis, your State Machines, your FMA, your Functional Safety Concept and lets not forget your Test Strategy, are going to need to be bullet proof, and over the course of this blog, I’m hopefully going to show you how best to do it all.

Subscribe here

Up next:

How to Design an Autonomous Car – Part 3: Getting Started

Read these too:

How to Design an Autonomous Car – Part 1:  A Brief Intro

How to Design an Autonomous Car – Part 4:  Systems Engineering

How to Design an Autonomous Car – Part 5:  Atomic Requirements

The rise of Autonomous Car and the Death of the OEM

Can an Autonomous Car be safer than a Cargo Ship?

Regulation 79.02 and what it means to you

ADAS Market projected to reach $56bn by 2023

World first launch with off-the-shelf ADAS solutions