Page tree

 

Basis for this document: ACSF-24-05 and ACSF-24-03r1;

further input received during session: please see bottom of this document;

notes and to-dos from the meeting in [green]

 

Proposal for Technical Requirements for an

Automated Lane Keeping System

 

 

2.1 Scope

2.1.1. This Regulation applies to vehicles of categories M 1 .

 

2.2. Definitions [1]

2.2.1. Automated Lane Keeping System (ALKS) ” for low speed application is a system which is activated by the driver and which keeps the vehicle within its lane by influencing the lateral movement of the vehicle and controls the longitudinal movement of the vehicle for extended periods without further driver command.

Within this Regulation ALKS is also referred to as “ the system ”.

2.2.2. Transition demand ” is a logical and intuitive procedure to transfer the dynamic driving task from automated control by the system to human driver control. This request given from the system to the human driver indicates the transition phase.

2.2.3. Transition phase ” means the duration of the transition demand.

2.2.4. Planned event ” is a situation which is known in advance, e.g. at the time of activation such as a journey point (e.g. exit of a highway) etc. and which requires a transition demand.

2.2.5. Unplanned event ” is a situation which is unknown in advance, but assumed as very likely in happening, e.g. [road construction, inclement weather, approaching emergency vehicle, missing lane marking, load falling from truck (collision)] and which requires a transition demand.

2.2.6. Imminent collision risk ” describes a situation or an event which leads to a collision of the vehicle with another road user or an obstacle unless an emergency manoeuvre is executed.

2.2.7. " Minimum risk manoeuvre " means a procedure aimed at minimising risks in traffic, which is automatically performed by the system after a transition demand.

2.2.8. " Emergency Manoeuvre ” is a manoeuvre performed by the system in case of an event in which the vehicle is at imminent collision risk with the purpose of avoiding or mitigating a collision.

2.2.9. Speed

2.2.9.1. “Specified maximum speed” is the speed declared by the manufacturer up to which the system operates under optimum conditions.

2.2.9.2. “Maximum operational speed” is the speed selected by the system up to which the system operates under current environmental and sensor conditions. It is the maximum vehicle speed at which the system may be active and shall be determined by the capability of the sensing system as well as the environmental conditions.

2.2.9.3. “Present speed” or “ speed ” is the current speed selected by the system due to traffic.

2.2.10. “Detection range” of the sensing system is the distance at which the system can reliably recognise a target, taking account of the deterioration of components of the sensing system due to time and usage throughout the lifetime of the vehicle and generate a control signal.

2.2.11. Failures

 

2.2.11.1. An “ ALKS failure ” is any single failure specific to the operation of the ALKS (e.g. single sensor failure, loss of necessary calculation data for the driving path of the vehicle).

2.2.11.2. Failure mode ” is the operation status of the system in which the system operates with an ALKS failure.

2.2.11.3. A “ severe ALKS failure ” is a failure specific to the operation of the ALKS that affects the safe operation of the system when in failure mode with an acceptable occurrence. Single sensor failures are only considered as such  when accompanied by another influence affecting the safe operation of the system.

2.2.11.4. A “ severe vehicle failure ” is any failure of the vehicle (e.g. electrical, mechanical) that affects the dynamic driving task and would also leave the manually driven vehicle in a state unfit to drive (e.g. loss of power supply, failure of the braking system, sudden loss of tire pressure).

2.2.12. Self-check " means an integrated function which checks for any system failure and for a change in detection range of the sensing system on a continuous basis.

2.2.13. A “system override” by the driver means a situation when the driver provides an input to a control which has priority over the longitudinal or lateral control of the system, while the system is still active.

[This definition might need revision once paragraph 2.4.8 is finalized.]

2.2.14. Dynamic Driving task ” is the control and execution of all longitudinal and lateral movements of the vehicle.

2.2.15. Data Storage System for Automated Driving (DSSAD)” enables the determination of interactions between the ALKS and the human driver. [2]

 

2.3. General Requirements [see also proposal for 2.3. (bottom of document)]

The fulfilment of the provisions of this paragraph shall be demonstrated by the manufacturer to the technical service during the inspection of the safety approach as part of the assessment to Annex Y [CEL] and according to the relevant tests in Annex X . [3]

 

[Add: requirement ensure system functions properly over lifetime]

2.3.1. The activated system shall not endanger the safety of the vehicle occupants and all other road users.

2.3.2. The activated system shall cope with all dynamic driving tasks and with any situation including failures or shall otherwise transition the control back to the driver offering sufficient lead time.

Types of situations in which the vehicle will generate a transition demand to the driver shall be declared by the vehicle manufacturer and documentation shall be provided together with the documentation package required in Annex [X] [CEL].

2.3.3. The activated system shall comply with all relevant traffic rules in the country of operation and as appropriate in the current situation in executing the dynamic driving task.

[Add: strategy to cover changes (e.g. in traffic regulations)]

2.3.4. The system shall not cause any collision which is rationally foreseeable and preventable. If a collision can be safely avoided without causing another one, it shall be avoided.

[Add: in case of collision vehicle must come to standstill]

2.3.5. The activated system shall maximize driver controllability (e.g. wipers on in case of rain, headlamps on in case of darkness) in the way of safety due to the fact that system and driver have not the same needs to assure a safe driving.

2.3.6. The system shall continuously perform a self-check (e.g. after ignition the system has at least once detected an object at the same or a higher distance than that declared as detection range according to paragraph 2.5.6.2.).

2.3.7. [Add: evidence for reasonable measures to prevent tampering and misuse]

2.3.8. The effectiveness of the system shall not be adversely affected by magnetic or electrical fields. This shall be demonstrated by compliance with Regulation No. 10, 05 Series of amendments to the Regulation.

2.3.9. [Add: means/measures to prevent activation in case not updated any longer]

 

2.4. Activation, Deactivation and Driver Input [4]

The fulfilment of the provisions of this paragraph shall be demonstrated by the manufacturer to the technical service during the inspection of the safety approach as part of the assessment to Annex Y [CEL] and according to the relevant tests in Annex X . [5]

2.4.1. The vehicle shall be equipped with dedicated means for the driver to activate (active mode) and deactivate (off mode) the system.

2.4.2. The default status of the system shall be the off mode at the initiation of each new engine start/run cycle.

This requirement does not apply when a new engine start/run cycle is performed automatically, e.g. by the operation of a stop/start system.

2.4.3. The system shall become active only upon a deliberate action by the driver and if all the following conditions are met:

-             The driver is in the driver seat and the driver’s safety belt is fastened according to paragraph 2.6.,

-             the driver is available to take over control of the dynamic driving task  according to paragraph 2.6.,

-             no failure affecting the safe operation or the functionality of the ALKS  is present,

-             DSSAD is operational,

-             the environmental and infrastructural conditions allow the operation,

-             positive confirmation of system self-check and

-             the vehicle is on roads where pedestrians and cyclists are prohibited and which, by design, are equipped with a physical separation that divides the traffic moving in opposite directions.

2.4.4.               Manual Deactivation

It shall be possible to manually deactivate (off-mode) the system by an intentional action of the driver using the same means as to activate the system, as mentioned in paragraph 2.4.1.

The means of deactivating shall provide protection against unintentional manual deactivation for example by requiring a single input exceeding a certain threshold of time or a double press, or two separate but simultaneous inputs.

Additionally, it shall be ensured the driver is in lateral control of the vehicle at the time of the deactivation, by e.g. placing the deactivation means on the steering control or confirming the driver is holding the steering control.

2.4.5.                           Automatic Deactivation

The system shall not be automatically deactivated by any driver input other than those described below in paragraphs 2.4.5.1 to 2.4.5.4.

2.4.5.1. Deactivation by input to driving controls

The system shall be deactivated automatically when at least one of the following conditions is met:

- The driver overrides the system by steering while holding the steering control and this override is not suppressed, as specified in paragraph   2.4.8 or

- the driver is holding the steering control and overrides the system by braking or accelerating, as specified in paragraph 2.4.8.

2.4.5.2. Deactivation during an ongoing transition demand

In case a transition demand is on-going, the system shall only be deactivated automatically

- as defined in paragraph 2.4.5.1. or

- upon detection that the driver has taken hold of the steering control as a response to the transition demand and provided the system confirms the driver is attentive as defined in paragraph 2.6.3.

2.4.5.3. Deactivation during an ongoing emergency manoeuvre

In case of an ongoing emergency manoeuvre, the deactivation of the system may be delayed until the imminent collision risk disappeared.

2.4.5.4. Deactivation in case of a severe vehicle failure or a severe ALKS failure

In case of a severe vehicle failure or a severe ALKS failure the ALKS may employ different strategies with regard to deactivation.

These different strategies shall be declared by the manufacturer and their effectiveness shall be assessed by the Technical Service with regard to ensuring a safe transition of control from the system to the human driver.

[Reference to CEL Annex needed?]

2.4.6. When deactivated (off mode) the system shall not provide any continuous control of either longitudinal or lateral movement of the vehicle.

After deactivation, Corrective Steering Function (CSF) may be active with the aim at accustoming the driver to execute the lateral control task by gradually reducing lateral support.

Notwithstanding both paragraphs above, any other safety system delivering longitudinal or lateral support in accident-prone situations (e.g. Advanced Emergency Braking System (AEBS), Electronic Stability Control (ESC), Brake Assist System (BAS) or Emergency Steering Function (ESF)) shall not be deactivated in case of deactivation of ALKS.

2.4.7. Any deactivation shall be indicated to the driver as defined in paragraph   2.8.2.3.

2.4.8. System override

2.4.8.1. A driver input to the steering control shall override the lateral control function of the system when the input exceeds a reasonable threshold designed to prevent unintentional override.

This threshold shall include a specified force and duration and shall vary depending on parameters that include criteria used for driver attentiveness as defined in paragraph 2.6.3. 

These thresholds and the rational for any variation shall be demonstrated to the Technical Service during the assessment according to Annex X [CEL].

2.4.8.2. A driver input to the braking control resulting in a higher deceleration than that induced by the system or maintaining the vehicle in standstill by any braking system, shall override the longitudinal control function of the system.

2.4.8.3. A driver input to the accelerator control may override the longitudinal control function of the system. However, such an input shall not cause the system to no longer meet the requirements of this Regulation.              

2.4.8.4. Any driver input to the accelerator or brake control shall immediately initiate a transition demand as specified in paragraph 2.7., when the input exceeds a reasonable threshold designed to prevent unintentional input.

2.4.8.5. Notwithstanding the provisions laid down in paragraphs 2.4.8.1. to 2.4.8.3., the effect of the driver input on any control may be reduced or suppressed by the system in case the system has detected an imminent collision risk due to this driver input.

2.4.8.6. In case of a severe vehicle failure or a severe ALKS failure the ALKS may employ different strategies with regard to system override. These different strategies shall be declared by the manufacturer and their effectiveness shall be assessed by the Technical Service with regard to ensuring a safe transition of control from the system to the human driver.

2.4.8.7.. The fulfilment of the provisions in paragraph 2.4 and its subparagraphs shall be demonstrated by the manufacturer to the technical service during the inspection of the safety approach as part of the assessment to Annex Y [CEL]. [6]

 

2.5. Dynamic Driving Task, and Sensing Capabilities [HF1]

2.5.1. The activated system shall keep the vehicle inside its lane of travel and ensure that the vehicle does not cross any lane marking . With the exception of an emergency maneuver as specified in paragraph 2.10. the lateral acceleration shall not exceed [ 4 ] m/s² . The system shall aim to keep the vehicle in a stable , not oscillating, lateral position inside the lane of travel to avoid confusing other road users.

2.5.2. The activated system shall detect a vehicle driving beside and if necessary adjust speed and/or the lateral position of the vehicle within its lane as appropriate . With the exception of an emergency maneuver as specified in paragraph 2.10., the lateral acceleration shall not exceed [ 4 ] m/s² .

2.5.3. The activated system shall control the speed of the vehicle.

2.5.3.1. The activated system shall adapt the vehicle speed to infrastructural and environmental conditions (e.g. narrow curve radii, inclement weather).

2.5.3.2. The activated system shall detect the distance to the next vehicle in front as defined in paragraph 2.5.6. and shall adapt the vehicle speed in order to avoid collision.

While the ALKS vehicle is not at standstill, the system shall adapt the speed to adjust the distance to a vehicle in front in the same lane to be equal or greater than the minimum following distance.

In case the minimum time gap cannot not be respected temporally because of other road users (e.g. vehicle is cutting in, decelerating lead vehicle with a deceleration up to [2] m/s² , etc.), the vehicle shall reduce its speed without any harsh braking exceeding a deceleration of [4] m/s² unless an emergency manoeuvre would become necessary. The system shall readjust the minimum following distance at the next available opportunity.

The minimum following distance shall be calculated using the formula:

d min = v ALKS * t front

 

Where:

d min = the minimum following distance

v ALKS = the present   speed of the ALKS vehicle in m/s;

t front = minimum time gap in seconds between the ALKS vehicle and a leading vehicle in front as per the table below:

 

Present  travel speed
of the ALKS vehicle is greater than …

Minimum time gap
in seconds

km/h

m/s

s

7,2

2,0

1,0

10

2,78

1,1

20

5,56

1,2

30

8,33

1,3

40

11,11

1,4

50

13,89

1,5

60

16,67

1,6

 

For speed values not mentioned in the table, linear interpolation shall be applied.

Notwithstanding the result of the formula above for present speeds below 2   m/s the minimum following distance shall never be less than 2 m [7] .

2.5.4. Reaction to an increased risk   level using a regular maneuver

2.5.4.1. The activated system shall be able to bring the vehicle to a complete stop behind a stationary vehicle or , a stationary road user ( both being located fully in the lane of the vehicle) or a blocked lane of travel , using a deceleration of not more than [4] m/s² . This shall be ensured up to the maximum operational speed of the system, as defined in paragraph   2.5.7.

2.5.4.2. The activated system shall detect the risk of an imminent collision with a suddenly cutting in vehicle and be able to avoid a collision, using a deceleration of not more than [4] m/s², up to a cut-in into the own vehicle’s lane, when the distance between the vehicle’s front and the cutting in road user’s rear corresponds to a time-to-collision calculated by the following equation:


������
�������������������������� > �� ������ /(2∙2m/s²)+ [ 0.35�� ]

Where:

v rel   = relative velocity between both vehicles, positive for vehicle being faster than the cutting in vehicle

TTC LaneIntrusion = The time-to-collision value when the foremost point of the intruding vehicle has fully crossed the lane marking.

 

2.5.5. Reaction to the risk of an imminent collision

2.5.5.1. The activated system shall detect the risk of an imminent collision e.g. with another road user (being positioned not fully in the lane of the vehicle or being visible to the vehicle’s sensing system for less than [10] seconds ) ahead or beside the vehicle, due to a [ hard /harsh]   decelerating lead vehicle   deceleration with more than [4] m/s² , a suddenly cutting in vehicle or a suddenly appearing obstacle and shall automatically perform an appropriate emergency manoeuver maneuver and avoid the collision a s specified in paragraph 2.10. . The deceleration used in this man o euver may be higher than [4] m/s² [SP2] .

 

 

2.5.5.2. The activated system shall detect the risk of an imminent collision with a suddenly cutting in vehicle and be able to avoid a collision , using an emergency manoeuvre, when the distance between the vehicle’s front and the cutting in road user’s rear   corresponds to a time-to-collision calculated by the following equation:

������ �������������������������� > �� ������ /( 2∙ 6 m/s² ) + [ 0.35�� ]

Where:

v rel   = relative velocity between both vehicles, positive for vehicle being faster than the cutting in vehicle

TTC LaneIntrusion = The time-to-collision value when foremost point of the intruding vehicle has fully crossed the lane marking.

 

[ 2.5.5. 3 . [SP3] The activated system shall detect the risk of an imminent collision with a crossing pedestrian in front of the vehicle and be able to avoid a collision, using an emergency manoeuvre, for pedestrian crossing speeds up to 5 km/h.]

2.5.6. Sensing system

The ALKS vehicle shall be equipped with a sensing system such that it can determine the driving environment (e.g. road geometry ahead, lane markings) and the traffic dynamics across its own traffic lane, the traffic lane immediately to its left and to its right at least to the minimum detection range.

[Add: areas for field of view; include close proximity detection.]

2.5.6.1. Detection range of the sensing system to the front

The detection range of the sensing system shall be declared by the vehicle manufacturer and shall be at least 46 meters measured from the forward most point of the ALKS vehicle [8] .

The Technical Service shall verify the distance at which the vehicle sensing system is able to detect, recognise and respond to a leading vehicle during the relevant tests in Annex X. The analysis done within Annex Y (CEL) shall demonstrate the ability of the system to detect, recognise and respond to any other relevant scenario in the automated mode [using a two-wheeled motor vehicle of category L3 as the vehicle in front and with a standardised pedestrian target. The target used for the pedestrian detection test shall be a adult “articulated soft target” and be representative of the human attributes applicable to the sensor system of the ALKS under test according to ISO 19206-2:2018] [9] .

The measured value shall be equal to or higher than the declared value.

2.5.6.2. The ALKS shall implement strategies to detect and cope with environmental and technical conditions which might reduce the detection range of the sensing system, e.g. prevent enabling the system, disabling the system and transferring the control back to the driver, reducing the speed when visibility is too low.

These strategies shall be described by the vehicle manufacturer and assessed according to Annex Y (CEL).

2.5.6.3. The vehicle manufacturer shall provide evidence that the effects of wear and ageing do not reduce the performance of the sensing system below the minimum required value specified in paragraph 2.5.6.1. over the lifetime of the system/vehicle.

 

2.5.7. The fulfilment of the provisions of paragraph 2.5. and its subparagraphs shall be demonstrated to the technical service and tested according to the relevant tests in Annex   [X].

It is recognised that the fulfilment of the requirement in paragraph 2.5 .5 . and it’s subparagraphs   may not be fully achieved in other conditions in situations more severe than those for the tests in Annex [X] listed in paragraph 2.5 and it’s subparagraphs . However, the system shall not deactivate or unreasonably switch the control strategy in these other conditions. This shall be demonstrated in accordance with Annex Y [CEL] of this Regulation. [Needs rewording]

2.5.8. A single perception malfunction without failure should not induce harzardous event. The design strategies put in place shall be described by the vehicle manufacturer and their safety shall be demonstrated to the satisfaction of the technical service in accordance with Annex Y (CEL). 

 

2.6. Driver Availability Recognition System [10]

The fulfilment of the provisions of this paragraph shall be demonstrated by the manufacturer to the technical service during the inspection of the safety approach as part of the assessment to Annex Y [CEL] and according to the relevant tests in Annex X. [11]

2.6.0. The system shall comprise a driver availability recognition system.

The driver availability recognition system shall detect if the driver is present in a driving position, if the safety belt of the driver is fastened and if the driver is available to take over the driving task.

2.6.1. Driver presence

A transition demand shall be initiated according to paragraph 2.7. if any of the following conditions is met:

-             When the driver is detected not to be in the seat for a period of more than [1] second or

-             when the driver’s safety belt is unbuckled.

The second level warning of the safety-belt reminder according to UN-R16 may be used instead of an acoustic warning of the Transition Demand.

2.6.2. Driver availability

The system shall detect if the driver is available and in an appropriate driving position to respond to a transition demand by monitoring the driver.

The manufacturer shall demonstrate to the satisfaction of the technical service the vehicle’s capability to detect that the driver is available to take over the driving task.

2.6.2.1. Criteria for deeming driver availability

[see also proposal for 2.6.2.1. (bottom of document)]

Driver availability shall be assessed based on [at least two] availability criteria (e.g. input to driver-exclusive vehicle control, eye blinking, eye closure or conscious head and body movement). 

As soon as the system has assessed the driver to no longer be available, the system shall provide a distinctive warning until appropriate actions of the driver are detected or until a transition demand is initiated.

Latest when the system does not detect appropriate actions from the driver during the distinctive warning for a period of more than 15   s a transition demand shall be initiated according to paragraph 2.7.

 

2.6.3. Driver attentiveness [12]

The system shall detect if the driver is attentive. The driver is deemed to be attentive when at least one of the following criteria is met:

-             Driver gaze direction is confirmed as primarily looking at the road ahead,

-             driver gaze direction is being confirmed as looking at the rear view mirrors or

-             driver head movement is confirmed as primarily directed towards the driving task.

The specification for confirming these or equally safe criteria must be declared by the manufacturer and supported by documented evidence. This shall be assessed by the technical service according to Annex Y (CEL).

[2.6.4. Other activities than driving that are provided by the vehicle to the driver once the ALKS is activated, shall be automatically suspended as soon as the system issues a transition demand or is deactivated whichever comes first.] [13]

2.7. Transition Demand and System Operation during Transition phase

The fulfilment of the provisions of this paragraph shall be demonstrated by the manufacturer to the technical service during the inspection of the safety approach as part of the assessment to Annex Y [CEL] and according to the relevant tests in Annex X . [14]

2.7.1. The activated system shall recognise all situations in which it needs to transition the control back to the driver.

2.7.2. The initiation of the transition demand shall be such that sufficient time is provided for a safe transition to manual driving.

2.7.2.1. In case of a plann ed event, a transition demand shall be given latest [15] s before the event occurs. [see also proposal for 2.7.2.1 (bottom of document)]

2.7.2.2. In case of an un plann ed event, a transition demand shall be given upon detection.

2.7.2.3 In case of any failure of the system or of any function needed for the operation, the system shall immediately initiate a transition demand upon detection. [15]

2.7.3. During the transition phase the system shall continue to operate. The system may reduce the speed of the vehicle to ensure its safe operation but shall not bring it to standstill unless required by the situation (e.g. due to vehicles or obstacles obstructing the path of the vehicle).

2.7.3.1. Once in standstill the vehicle may remain in this condition and shall then activate the hazard warning lights within 5 s.

2.7.3.2. During the transition phase, the transition demand shall be escalated latest after 4 s after the start of the transition demand.

2.7.4. A transition demand shall only be terminated once the system is deactivated or a minimum risk manoeuvre has started.

2.7.4.1. In case the driver is not responding to a transition demand by deactivating the system (either as described in paragraph 2.4.4. or 2.4.5), a minimum risk manoeuvre shall be started, earliest 10 s after the start of the transition demand.

2.7.4.1.1. Notwithstanding paragraph 2.7.4.1. a minimum risk manoeuvre  may be initiated immediately in case of a severe ALKS or severe vehicle failure.

In case of a severe ALKS or vehicle failure the ALKS may no longer be capable of fulfilling the requirements of this Regulation, but it shall aim at enabling a safe transition of control back to the driver.

2.7.4.1.3. The manufacturer shall declare the types of severe vehicle failures and severe ALKS failures that will lead the ALKS to initiate a MRM immediately.

 

2.8. Information to the driver [see also proposal for 2.8. (bottom of document)]

The fulfilment of the provisions of this paragraph shall be demonstrated by the manufacturer to the technical service during the inspection of the safety approach as part of the assessment to Annex Y [CEL] and according to the relevant tests in Annex X . [16]

2.8.1. The following information shall be indicated to the driver:

- the system status as defined in paragraph 2.8.2.,

- any failure affecting the operation of the system with at least an optical signal unless the system is deactivated (off mode),

-                  transition demand by at least an optical and in addition an acoustic and/or haptic warning signal. The warning shall be escalated latest [4]   s after the initiation. From this point in time it shall contain mandatory a haptic warning when the vehicle is moving faster than [20] km/h.

- minimum risk manoeuvre by an optical signal and either an acoustic or a haptic warning signal and

- emergency manoeuvre by an optical warning signal.

The optical signals above shall be in adequate size and contrast and contain an unambiguous indication including a steering control or a vehicle, with an additional “A” or “AUTO”, or  the standardized symbols as dedicated in Regulation No. 121 .

The acoustic signals above shall be loud and clear.

2.8.2. System status

2.8.2.1. System unavailability indication

In case activation of the system following the deliberate action of the driver is denied by the system due to system unavailability, this shall be at least optically displayed to the driver.

2.8.2.2. System status display when activated

The system status (active mode) shall be displayed by an dedicated optical signal to the driver and shall indicate the active system state until the system is deactivated (off mode).

The optical signal shall be easily perceptible for the driver in the peripheral field of vision and located near the direct line of driver’s sight to the outside in front of the vehicle, e.g. prominent indication in the instrument cluster or a dedicated colour light displayed on the steering control and covering part of the outer rim perimeter facing towards the driver.

An adequate perceptible interface design for the optical signal shall be demonstrated by the manufacturer and shall be supported by documented evidence. This shall be assessed by the Technical Service according to Annex   Y (CEL).

2.8.2.3. System status display when deactivated

When the system status changes from active mode to off mode, this shall be indicated to the driver by at least an optical warning signal. This optical signal shall be realized by non-displaying the optical signal used to indicate the active mode.

An acoustic warning signal shall be provided unless the system is deactivated following a transition demand which contained an acoustic signal.

2.8.3. Transition Phase and Minimum Risk Manoeuver

During the transition phase and the minimum risk manoeuver, the system shall provide an interface to instruct the driver in an intuitive and unambiguous way to take over manual control of the vehicle. The instruction shall include pictorial information showing hands and the steering control and may be accompanied by additional explanatory text or warning symbols, as shown in the example below.

 

Hands-on 3

 

2.8.3.1. During the transition phase, in order to emphasize the urgency for the driver to take over manual control of the vehicle, the optical signal for system status display (as described in paragraph 2.8.2.2.) shall be accompanied e.g. by blinking/flashing of the dedicated colour displayed on the steering control (only slow blinking/flashing so as not to upset the driver).

2.8.3.2. With the start of the minimum risk manoeuvre, the given signal shall change its characteristics to emphasize the urgency of an action  by the driver, e.g. by red flashing of the steering control and moving hands of the pictorial information.

2.8.4. Prioritization of ALKS warnings

The warnings of an ALKS during a transition phase, a minimum risk manoeuvre or an emergency manoeuvre may be prioritized over other warnings in the vehicle.

The prioritization of different warnings during the ALKS operation shall be demonstrated by the manufacturer to the satisfaction of the Technical Service during Type Approval.

2.9. Minimum Risk Manoeuvre (MRM)

The fulfilment of the provisions of this paragraph shall be demonstrated by the manufacturer to the technical service during the inspection of the safety approach as part of the assessment to Annex Y [CEL] and according to the relevant tests in Annex X . [17]

2.9.1. During the minimum risk manoeuvre the vehicle shall be slowed down inside the lane or, in case the lane markings are not visible, remain on an appropriate trajectory taking into account surrounding traffic and road infrastructure, with a deceleration demand not greater than [4] m/s².

Higher deceleration demand values are permissible for very short durations, e.g. as haptic warning to stimulate the driver’s attention, or in case of a severe ALKS or severe vehicle failure.

Additionally, the signal to activate the hazard warning lights shall be generated with the start of the minimum risk manoeuvre.

2.9.2. The minimum risk manoeuvre shall bring the vehicle to standstill unless the system is deactivated by the driver during the manoeuvre.

[2.9.3. [18] In case the ALKS is capable of performing lane change manoeuvres during the MRM, including to the hard shoulder, this shall only be permitted if the situation is not critical.

Such lane changes are deemed critical either if there is a risk of a collision with another road user in the target lane, or if an approaching vehicle in the target lane would have to decelerate at a higher level than 3m/s², 0.4   s after the ALKS vehicle has crossed the lane marking, to ensure the distance between the two vehicles is never less than that which the ALKS vehicle travels in 1 s.

Any lane change shall be indicated to other road users according to traffic law and the signal to activate the hazard warning lights may be suppressed during the lane change manoeuvre.

The system’s safety strategies shall be demonstrated and proved by the manufacturer to the satisfaction of the Technical Service.]

2.9.4. A minimum risk manoeuvre shall only be terminated once the system is deactivated or the system has brought the vehicle to a standstill.

2.9.5. The system shall be deactivated at the end of any minimum risk manoeuvre.

The hazard warning lights shall remain activated unless deactivated manually and the vehicle shall not move away after standstill without manual input.

2.9.6. Reactivation of the system after the end of any minimum risk manoeuver shall only be possible after each new engine start/run cycle.

2.10. Emergency Manoeuvre  (EM)

The fulfilment of the provisions of this paragraph shall be demonstrated by the manufacturer to the technical service during the inspection of the safety approach as part of the assessment to Annex Y [CEL] and according to the relevant tests in Annex X . [19]

2.10.1. An emergency manoeuvre shall be carried out in case of an imminent collision risk as described in paragraph 2.5.5.

2.10.2. This manoeuvre shall decelerate the vehicle up to its full braking performance if necessary and/or may perform an automatic evasive manoeuvre, when appropriate.

If failures are effecting the br e aking [SP4] or steering performance of the system, the manoeuvre shall be carried out with consideration for the remaining performance.

During the evasive manoeuvre the ALKS vehicle shall not cross the lane marking (outer edge of the front tyre to outer edge of the lane marking) [unless the system is capable of confirming and has confirmed that no critical situation would result from this manoeuvre].

[The situation is deemed critical either if there is a risk of a collision with another road user in the evasive path, or if a vehicle approaching from the rear in the evasive lane [with the allowed or advised maximum speed] would be forced to decelerate at a higher level than [3] m/s 2 , 0.4   s after the ALKS vehicle has crossed the lane marking, to ensure the distance between the two vehicles is never less than that which the ALKS vehicle travels in 1   s .] [20]

After the evasive manoeuvre the vehicle shall aim at resuming a stable position either in its original or the adjacent lane of travel.

The system shall demonstrate its capabilities to assess the criticality of an evasive manoeuvre crossing lane markings according to the relevant test in Annex X.

2.10.3. An emergency manoeuvre shall only be terminated as soon as the collision risk disappeared or in case of deactivation by the driver.

2.10.3.1. After an emergency manoeuvre is terminated the system shall continue to operate. 

2.10.3.2. If the emergency manoeuvre results in the vehicle being at standstill, the signal to activate the hazard warning lights shall be generated, otherwise the system shall continue to operate.

2.10.4. The vehicle shall implement a logic signal indicating emergency braking as specified in UN-R13H .

 

2.11. System information data [21]

2.11.1. The following data shall be provided, together with the documentation package required in Annex [X] of this UN Regulation, to the Technical Service at the time of type approval.

2.11.2. A list of types of situations in which the vehicle may generate a transition demand to the driver.

2.11.3. Information about how the system detects that the driver is available to take over the control.

2.11.4. The means to monitor the driving environment.

2.11.5. The means to activate, override or deactivate the system including the strategy how the system is protected against unintentional deactivation, the threshold values for a steering override and how the system assesses that the driver has directed his gaze to the driving task.

2.11.6. Information about how the software version(s) and the failure warning signal status can be readable in a standardized way via the use of an electronic communication interface, at least be the standard interface (OBD port).

2.11.7. Description of the types of severe vehicle failures and severe ALKS failures that will lead the ALKS to initiate a MRM immediately.

2.11.8. For driving situations not covered by the tests of Annex   [X], the safe operation of the system shall be demonstrated by the vehicle manufacturer on the base of Annex   X of this Regulation.

2.11.9. Installation

The manufacturer shall provide information regarding the installation options that will be employed for the individual components that comprise the sensing system. These options shall include, but are not limited to, the location of the component in/on the vehicle, the material(s) surrounding the component, the dimensioning and geometry of the material surrounding the component, and the surface finish of the materials surrounding the component, once installed in the vehicle.  The information shall also include installation specifications that are critical to the system’s performance, e.g. tolerances on installation angle.

Changes to the individual components of the sensing system, or the installation options, shall be notified to the Type Approval Authority and be subject to further assessment.

2.11.10. The system behaviour during a MRM.

2.11.12. The system behaviour during an EM.

 

2.12. Data Storage System for Automated Driving (DSSAD) [22]

2.12.1. Any vehicle with an automated driving function such as ALKS must be equipped with a DSSAD which must fulfil the requirements as specified in [Regulation X or Annex X of this Regulation].

[Add: Any driver input which is suppressed shall be recorded and stored.]

 

2.13. Cyber security [23]

 

Annex [X] Testing ALKS [ To be discussed ]

Annex [X] Complex Electronic Systems [24]

              Further input received during 24. ACSF meeting, but not yet discussed.

 

Paragraph 2.3. (provided by UK):

2.3. General Requirements

 

2.3.1. The activated system shall cope with perform the all dynamic driving task s , and manage all situations including failures, and shall not endanger the safety of the vehicle occupants or any and all other road users.

 

The activated system shall not cause any collisions that are rationally foreseeable and preventable. If a collision can be safely avoided without causing another one, it shall be avoided.

 

2.3.2. The activated system shall comply with traffic rules relating to the dynamic driving task in the country of operation . and as appropriate in the current situation .

 

2.3.3. The system shall have the capability to detect [and store] failures affecting the safe operation or the functionality of the ALKS and implement safe strategies until the detection is completed.

The occurrence of a severe ALKS failure is deemed acceptable if it is comparable to similar failures in other well-established and well trusted safety systems (e.g. braking or steering systems).

 

[Note – discussion on storage of failures and also on deleting this sub-paragraph on 18/11/2019]

 

2.3.4. The activated system shall exercise control over the wipers and lights, activating and deactivating as conditions require to support the driver resuming control at any time. maximize driver controllability (e.g. wipers on in case of rain, headlamps on in case of darkness) in the way of safety due to the fact that system and driver have not the same needs to assure a safe driving.

 

2.3.5. When required, the activated system shall issue a transition demand with sufficient lead time and not endanger the safety of the vehicle occupants or other road users . If determined necessary by the activated system, it shall issue a transition demand with sufficient lead time and not endanger the safety of vehicle occupants and all other road users.

 

Types of situations in which the vehicle will generate a transition demand to the driver shall be declared by the vehicle manufacturer and included in the documentation package required in Annex [Y] [CEL].

 

2.3.X If the driver fails to resume control of the dynamic driving task during the transition phase, the system shall perform a minimum risk manoeuvre.

 

During a minimum risk manoeuvre, the system shall minimise risks to safety of the vehicle occupants and other road users.

 

2.3.6. The system shall [ continuously] perform self-checks to detect the occurrence of faults and to confirm system performance (e.g. after vehicle start the system has at least once detected an object at the same or a higher distance than that declared as detection range according to paragraph 2.5.6.2.).

 

[Note – discussion on replacing the word ‘continuously’ on 18/11/2019]

 

2.3.7. The effectiveness of the system shall not be adversely affected by magnetic or electrical fields. This shall be demonstrated by compliance with Regulation No. 10, 05 Series of amendments to the Regulation.

 

2.3.8. Conformity with the safety aspects of electronic control systems shall be shown by meeting the requirements of Annex [Y] [CEL].

 

2.3. X   The manufacturer shall take measures to guard against reasonably foreseeable misuse by the driver and intentional modification of the system.

 

2.3.X  The Manufacturer shall implement a process to manage the safety and security of the ALKS throughout the lifetime of the [vehicle/system] (including continued compliance with applicable traffic rules)

 

[Note – discussion on needing an activation check requirement for system self-checks and updates etc. 18/11/2019]

 

[Cybersecurity requirements – for discussion]

 

The fulfilment of the provisions of this paragraph shall be demonstrated by the manufacturer to the technical service during the inspection of the safety approach as part of the assessment to Annex Y [CEL] and according to the relevant tests in Annex X.

 

 

Paragraph 2.6.2.1. (provided by UK and DE):

The system shall be able to detect if a driver is not available within a maximum of [X] seconds based on at least two availability criteria (e.g. input to driver-exclusive vehicle control, eye blinking, eye closure, conscious head and body movement).

Justification for the number and combination of availability criteria, in particular with regard to the corresponding time interval, shall be provided by the manufacturer by documented evidence. This shall be assessed by the technical service according to Annex (CEL).

 

 

 

Paragraph 2.7.2.1. (provided by Industry):

In case of a planned event that would prevent the ALKS from continuing the operation, a transition demand shall be given latest [10] seconds before the event occurs. early enough that a to ensure the minimal risk maneuver , in case the driver would not resume control, following the transition phase would bring the vehicle to standstill before the planned event occurs.

 

 

Paragraph 2.8. (and 2.7.3. acc.) (provided by Industry):

2.7.3. During the transition phase the system shall continue to operate. The system may reduce the speed of the vehicle to ensure its safe operation but shall not bring it to standstill unless required by the situation (e.g. due to vehicles or obstacles obstructing the path of the vehicle) or when caused by the haptic warning according to paragraph 2.8.1. started at speeds below 20km/h.

Once in standstill the vehicle [may] remain in this condition and shall activate the hazard warning lights within [5] s after the start of the transition demand.

2.7.4.

 

2.8. Information to the driver

2.8.1. The following information shall be indicated to the driver:

-                  the system status as defined in paragraph 2.8.2.

- any failure affecting the operation of the system with at least an optical signal unless the system is deactivated (off mode),

-                  transition demand by at least an optical and in addition an acoustic and/or haptic warning signal.

Latest [4]s after the initiation of the transition demand, the transition demand

  • shall contain a constant or intermittent haptic warning unless the vehicle is at standstill and
  • shall be escalated and remain escalated until the transition demand ends .

- minimum risk manoeuvre by an optical signal and either an acoustic or a haptic warning signal and

- emergency manoeuvre by an optical signal

The optical signals above shall be in an adequate size and contrast and contain standardized symbols in accordance with Regulation 121. The acoustic signals above shall be loud and clear.

2.8.2. System status

2.8.2.1 System unavailability indication

In case activation of the system following the deliberate action of the driver is denied by the system due to system unavailability, this shall be at least [visually/optically] displayed to the driver.

2.8.2.2 System status display when activated

Upon activation the system status (active mode) shall be displayed by a dedicated optical signal to the driver.

The optical signal shall contain an unambiguous indication including

a)        a steering control or a vehicle, with an additional “A” or “AUTO”, and additionally

b)       an easily perceptible indication in the peripheral field of vision and located near the direct line of driver’s sight to the outside in front of the vehicle, e.g. prominent indication in the instrument cluster or on the steering control covering part of the outer rim perimeter facing towards the driver.

The optical signal shall indicate the active system state until the system is deactivated (off mode).

The optical signal shall be constant while the system is in regular operation and with the initiation of a transition demand [at least the indication according to (b)] shall change its characteristics, e.g. to an intermittent signal or a different colour.

When an intermittent signal is used, a low frequency shall be used in order to not unreasonably alert the driver.

During the Transition Phase and Minimal Risk Maneuver, the indication according to a) may be replaced by the instruction to take over manual control according to 2.8.3..

 

2.8.2.3 System status display when deactivated

Upon deactivation when the system status changes from active mode to (off mode) this shall be indicated to the driver by at least an optical warning signal. This optical signal shall be realized by non-displaying the optical signal used to indicate the active mode.

Additionally, an acoustic warning signal shall be provided unless the system is deactivated following a transition demand which contained an acoustic signal.

2.8.3. Transition Phase and Minimum Risk Manoeuver

During the transition phase and the minimum risk manoeuver, the system shall instruct the driver in an intuitive and unambiguous way to take over manual control of the vehicle. The instruction shall include a pictorial information showing hands and the steering control and may be accompanied by additional explanatory text or warning symbols, as shown in the example below.

 

Hands-on 3

2.8.3.2. With the start of the minimum risk manoeuvre, the given signal shall change its characteristics to emphasize the urgency of an action by the driver. e.g. by red flashing of the steering control and moving hands of the pictorial information.

2.8.4. Where examples are given above, an adequate and equally perceptible interface design for the optical signals may be used instead. This shall be demonstrated by the manufacturer and shall be supported by documented evidence. This shall be assessed by the Technical Service according to Annex Y (CEL).

 

2.8. 5 . Prioritization of ALKS warnings

The warnings of an ALKS during a transition phase, a Minimal Risk Manoeuvre or an Emergency Manoeuvre may be prioritized over other warnings in the vehicle.

The prioritization of different acoustic and optical warnings during the ALKS operation shall be declared by the manufacturer to the Technical Service during Type Approval.


[1] Paragraph has only been reviewed in parts in the last meeting.

[2] To be revised in accordance with IWG EDR/DSSAD.

[3] Requirement possibly moved to different section when text for Regulation restructured.

[4] Entire paragraph will be restructured to ease understanding (e.g. avoid “manual” and “automatic” deactivation).

[5] Requirement possibly moved to different section when text for Regulation restructured.

[6] Possibly duplication – If needed, move requirement to different section when text for Regulation restructured.

[7] T he column for minimum following distance to be added to the table.

[8] The value D=46 is calculated by the formula below based on the values V=60km/h, a=3.7m/s 2 and t=0.5s:

��������−��������= − ����������∗ ��������������+����������∗��������������2+2����������∗������������

 

 

[9] Text in square brackets could be moved to test section accordingly.

[10] Entire paragraph will be restructured to ease understanding.

[11] Requirement possibly moved to different section when text for Regulation restructured.

[12] Paragraph will be moved to different section when text for Regulation restructured.

[13] To be shared with WP.1

[14] Requirement possibly moved to different section when text for Regulation restructured.

[15] Possibly duplication – Consistency to be checked after restructuring document.

[16] Requirement possibly moved to different section when text for Regulation restructured.

[17] Requirement possibly moved to different section when text for Regulation restructured.

[18] Including lane change function for GRVA decision (note: lane change may need to be stored in DSSAD (in detail).)

[19] Requirement possibly moved to different section when text for Regulation restructured.

[20] Including lane change function for GRVA decision (note: lane change may need to be stored in DSSAD (in detail).)

[21] Paragraph has not been reviewed in the last meeting.

[22] To be revised in accordance with IWG EDR/DSSAD and subject to GRVA decision.

[23] To be revised in accordance with TF CS/OTA and subject to GRVA decision.

[24] To be revised in accordance with IWG VMAD and subject to GRVA decision.


[HF1] General comment from industry   : no need for further details or complementary requirements addition

[SP2] Do we need to make a reference to an emergency maneuver?

[SP3] Necessary for pedestrian crossing test in test annex.

 

However, the requirement to stop from 60 to a crossing pedestrian with 5 km/h and center impact means a start of the brake intervention at 1.25 s TTC, and the pedestrian is approximately 1 m before the vehicle path.

 

This should be discussed how the requirements for pedestrian avoidance can be formulated, therefore this paragraph has brackets.

[SP4] The breaking performance of the system should rather be zero.