Last week BMW quietly released a new Voluntary Safety Self-Assessment (VSSA), which was posted to the National Highway Traffic Safety Administration’s (NHTSA) website. The BMW VSSA is specifically for their Level 3 (L3) automated driving system, and offers a glimpse into AV development and an update where AV policy might be headed.
Over time, VSSAs have generally included more information and supplemental materials, and BMW’s VSSA is one of the most comprehensive and thorough posted to date. It is also only the second VSSA submitted that explicitly focusses on Level 3 technologies, and provides some insight into how a Level 3 system might work. It also highlights the fact that AV systems need more research and development before they are ready for consumers.
VSSAs are part of the NHTSA voluntary safety and regulatory guidance for automated driving systems that fall within SAE’s level 3, 4 or 5 classification. The VSSAs are intended to provide insights into how AV developers are approaching 12 different aspects of safety, including human-machine interface, data recording, and consumer education. To date, 19 companies have posted VSSAs. BMW addresses each of the twelve of the categories requested by NHTSA, with some minor modifications (italicized words are additions by BMW and [bracketed] are omitted words):
- Human Machine Interface
- Object and Event Detection and Response
- Operational Design Domain
- Federal, State, and Local Laws and Regulations
- Fallback (Minimal Risk Condition)
- Crashworthiness
- Post-Crash [ADS] Behavior
- Data Recording and Sharing
- System Safety
- [Vehicle] Cybersecurity
- Verification and Validation [Methods]
- Consumer Education and Training
The BMW L3 system would be available to drivers upon request and the system would drive the vehicle, allowing the driver to “take their eyes off of the road and focus on other activities.” The system would require drivers to stay awake and moderately alert so they are able to resume driving after a takeover (TO) request. The system would be available only on limited access highways and when “weather and environmental conditions allow the vehicle’s sensors to operate without impairment.”
The longest section in the VSSA covers the Human Machine Interface. This is critical to the deployment of a safe and effective Level 3 system because it requires a delicate balance between allowing the driver to divert attention but remain engaged enough so that they can take over the system when prompted. The document discusses the roles of driver monitoring systems and uses straightforward language about the driver’s responsibilities.
The human-machine interface section also demonstrates the current state of BMW’s L3 development. For example, the document lists “several seconds” as the handoff period, but is never more specific. BMW admits the need for more research: “To make sure that the function meets the requirements on a safe human-machine interaction, numerous studies with subjects unfamiliar with automated driving are implemented to test, assess, and validate the concept.” This is consistent with other VSSAs, which have yet to specify a specific TO procedure.
Although the VSSA does not specifically address the technicalities of how a TO handoff might work, it does give insights into how their AV developers are approaching safety. For example, the document specifically brings up vulnerable road users such as pedestrians and motorcyclists, even though they don’t anticipate any pedestrians on limited-access highways. The consumer education chapter includes information for both dealers and consumers, including a multi-faceted communications strategy that includes printed manuals, video tutorials, and in-person clinics. But some aspects are still unanswered, such as how consumers are educated in the used-car market.
From a broader transportation perspective, the BMW VSSA paints a different picture from the fleet of driverless taxis model that many experts envision. Instead of a mass-market system, the BMW L3 technology would be a premium feature on a privately owned luxury automobile. Some researchers and policy experts have questioned whether a Level 3 system would function properly in the real world given the complex human machine interface challenges. But the VSSA presents a commitment by BMW to that model, joining Mercedes-Benz in releasing a Level 3-specific document.
The specifications of operation of the L3 technologies, including its operational design domain, is one of the major aspects that helps address concerns about safety. While AV developers have a responsibility to design safe and secure systems, federal and state policies will also play a major role in shaping the testing and deployment of these systems. The COVID-19 crisis has fundamentally shifted the transportation policy focus, and strained finances might alter timelines and ambitions for automated vehicles. But continual private sector progress on automated vehicles point to the need for clearer policies and collaborative research.