FMVSS Exemption Considerations for Fully Autonomous Vehicles

Summary: The human role in FMVSS should not be removed for exemption request because there is no driver. Rather, what should be stated is how the driver is being replaced in that safety role as a matter of system design.

These comments were filed regarding the General Motors Petition for Temporary Exemption from FMVSS -- Federal Motor Vehicle Safety Standards (https://www.regulations.gov/document/NHTSA-2022-0067-0002)  However, they are likely to apply to any autonomous vehicle that does not have conventional driver controls or operates in a mode which does not have an officially designated driver.

It is good to see companies working to advance the potential benefits of autonomous vehicle technology. However, it is also important for NHTSA to ensure public safety when such technology is deployed on public roads.

There will almost certainly need to be an auxiliary controller to command motion of vehicles without normally accessible driver controls. To the extent that these are in-vehicle wired controls the question arises as to their suitability for safe vehicle control (e.g., using a "Playstation" type video game controller) and whether they can be improperly activated during autonomous operation. To the extent that these are wirelessly connected controls there are serious security issues that must be considered. In the absence of normal driver controls any petitioner should be required to justify the safety and security of its maintenance and supplemental human-operated vehicle control strategy beyond more general claims of working on cybersecurity.

FMVSS 101: Petitioner should demonstrate that all telltales that are intended to prompt human driver reaction similarly prompt a relevant ADS reaction to an indicated exceptional condition. If no such demonstration is provided, NHTSA would simply be taking Petitioner’s word that the telltale functions are implemented in a way that provides equivalent safety. (This also applies to other telltales such as FMVSS No. 126, 138, etc.)

FMVSS 102: While the ADS is said to control the transmission, there will be times in which humans need to know the state of the transmission for safety, especially whether the vehicle is in park or not. This includes emergency responders and maintenance personnel to ensure that the vehicle will not move unexpectedly when it is operating in a degraded or post-crash state. NHTSA should evaluate the suitability of a passenger video display for reliably displaying vehicle park state to non-passenger stakeholders.

FMVSS 104: From the NTHSA summary:  "For GM's petition for exemption from portions of FMVSS No. 104, GM argues that the purpose and intent of the safety standard is obviated by the Origin's sensor system design."  GM's argument is ridiculous from a technical point of view.  (Their technical disclosure is more substantive, but this type of lawyer argument in their summary serves to undermine their filing's credibility.)  In the context of an ADS, the intent of the safety standard is not to permit a human driver's eyes to see out the windshield. Rather, it is to ensure that all visual sensors can see through the windshield (if interior mounted), or through their lenses and weather covers as appropriate. It is completely foreseeable that camera and lidar operation will be impaired by adverse operational conditions. Moreover, the problem is likely to be worse than for human drivers because even a relatively small bug splat on a camera lens will form a visual obstruction covering a much larger fraction of the field of view compared to the same bug impacting the windshield of a human-driven vehicle, because human drivers can and do simply move their heads a bit to see past windshield obstructions.  GM states that it keeps its sensors clean, but provides no objective way for NHTSA to validate the claim.

FMVSS 111: From the NHTSA summary: "GM points out that the purpose and intent of FMVSS No. 111 is based on human perception and visibility so there is no operational safety need for these requirements when applied to a vehicle driven by an ADS." This argument amounts to the common fallacy of: "humans have limitations and therefore computers will be perfect." (Anyone paying attention knows that computers fail, often spectacularly – just in different ways than humans.) There are safety requirements behind FMVSS 111 that are not about "human perception and visibility" but rather, for example, not running over children that are not visible to the driver sensors.  Again, GM's lawyer-phrased argument undermines the credibility of their filing. In addressing this request for exemption the petitioner should explain why it is the case that small children will be protected from being run over at least as well as by a human driver using a rear view camera as one example. Again, the technical substance is better, but leaves a big open question. GM provides pictures indicating that cameras can potentially see areas required. However, there is no data supporting that those cameras will correctly sense and classify children close to the vehicle with high accuracy, especially at night when the vehicle automation might rely more heavily on roof-top mounted lidar sensors. The safety requirement is not camera visibility, but rather that the driver+camera will avoid hitting children. Given apparent issues with camera-based AEB systems having trouble sensing and avoiding hitting children this is an issue that needs to be taken seriously.

FMVSS 201: From the NHTSA summary: "GM argues that sun visors are not necessary because the Origin is not operated by a human driver, and the ADS does not use the windshield for visibility." Again, limitations of human drivers are not the real point for ADS safety. It is well known that cameras struggle when looking into the sun. GM should explain how they handle that problem (sun visors are a way human drivers can handle it) and now NHTSA can validate that sun glare is handled safely.  GM states it is not a problem for this system, hinting that perhaps they rely on lidar+radar instead of a camera in such situations, but that raises additional concerns. GM should provide a way for NHTSA to validate that sun glare does not present undue risk.

Validation: For all requested exemptions it is not enough to simply say more or less "trust us, we have figured this out" for an ADS equipped vehicle than it is for a conventional vehicle. If "trust us" were enough, there would be no need for the carefully design tests in FMVSS for any vehicle. Rather, petitioners should explain (a) why the broader safety objective of the FMVSS element being waived is still being met (e.g., not hitting children vs. field of view), and (b) a way that NHTSA can validate for itself that the safety objective is in fact being met. See:  Koopman, “How to keep self-driving cars safe when no one is watching for dashboard warning lights,” The Hill, June 30, 2018. https://thehill.com/opinion/technology/394945-how-to-keep-self-driving-cars-safe-when-no-one-is-watching-for-dashboard/

 

Regarding Public Interest Considerations:

Safety Benefit: It is essential to keep in mind when evaluating ADS petitions that potential safety benefits are purely aspirational. There is not yet any proof that ADS-equipped vehicles will be even as safe as a comparable active-safety-equipped human-driven vehicle using any currently available or near term deployable technology. While supporting the development of technology that has the potential to reduce harm is laudable, this should not be done at the cost of increased near-term harm. Putting road users at increased risk today because someday, maybe, perhaps, autonomous vehicles might be safer is unacceptable. NHTSA should be in the safety business, not the hopium business. That means exemptions should require a concrete justification of deployed safety that is not weakened by promises of ADS perhaps increasing safety in the future.

Environmental Impact: Requiring environmental impact data reporting is an excellent idea. It is important to be mindful of indirect environmental and safety consequences of ADS-equipped vehicle adoption. One example is that (presumably) decreased cost per mile is prone to increasing demand, resulting in a potential increase in overall emissions if small ADS-equipped vehicles are used for more trips.  Both human harm and environmental damage could be increased if ADS-equipped vehicles draw passenger loads away from mass transit even if the total number of user-miles across all modes remains the same. Moreover, use of uncrewed ADS-equipped vehicles can increase both total pedestrian harm and emissions as well as road congestion if that leads to a large increase in on-demand delivery services.

Equity: As NHTSA notes in their summary, petitioners for exemptions extoll the potential benefits to expand transportation options to under-served areas and customers with disabilities. It is important to point out that these populations can be served with traditional human-operated vehicles as well, so this is not a fundamentally new capability, but rather an argument that cheaper costs will increase vehicle availability (perhaps at the cost of increased road congestion). Note that vehicle sharing does not require autonomy, nor does use of electric vehicles. To the extent that the exemptions are for "robo-taxi" and shuttle type applications, petitioners should not only say that their technology might possibly help disadvantaged populations, but also how they plan to serve such populations directly as a result of the exemption. Promising to serve such populations in an exemption petition but then fielding a single token wheelchair-accessible vehicle or only deploying in a rich urban center would result in such statements of providing equitable transportation being only aspirational rather than directly related to the exemption decision. Credit should not be given for empty promises in evaluating an application.

Safety: While considering economic impacts might be relevant as NHTSA notes in their summary, it is essential to remind all stakeholders that the "S" in NHTSA stands for "Safety." It is imperative that economic motivations not over-ride the NHTSA mission to ensure safety. Safety must come first, and not be overwhelmed by economic pressure.

Standards: Petitioners who want exemptions from FMVSS provisions should have an alternate method of ensuring that a rigorous engineering approach has been used to ensure safety. Such an approach was proposed by NHTSA itself in an ANRPM (Docket No. NHTSA-2020-0106 / RIN 2127-AM15 Framework for Automated Driving System Safety https://www.regulations.gov/docket/NHTSA-2020-0106 ). NHTSA should respond to comments from that ANPRM and work further on setting up such a framework that could provide and an alternate basis for ADS-equipped vehicle regulation.

SMS: NHTSA should require all petitioners to implement an effective Safety Management System (SMS) as a condition of receiving an exemption, with SMS data included in periodic reports for the life of any vehicle.

Crash Reporting: NHTSA should continue to require crash reporting as proposed. The definition of a crash should be scoped to include: (a) any contact between the vehicle and another road user regardless of severity; (b) any contact between the vehicle and other obstacles or infrastructure regardless of severity; (c) any "near hit" that required evasive action from another road users (e.g., pedestrian jumping back on sidewalk to avoid being hit while in a crosswalk); (d) any substantive moving violation (e.g., running a red light).  Any responsible tester/operator of an ADS will have data already compiled on all these events as part of their SMS to ensure that they are operating safely on public roads, so the reporting burden should be minimal.  These reports should be required for the life of any exempt vehicle.

Commenter Qualifications: Prof. Philip Koopman is an internationally recognized expert on Autonomous Vehicle (AV) safety whose work in that area spans over 25 years. He is also actively involved with AV policy and standards as well as more general embedded system design and software quality. His pioneering research work includes software robustness testing and run time monitoring of autonomous systems to identify how they break and how to fix them. He has extensive experience in software safety and software quality across numerous transportation, industrial, and defense application domains including conventional automotive software and hardware systems. He was the principal technical contributor to the UL 4600 standard for autonomous system safety issued in 2020. He is a faculty member of the Carnegie Mellon University ECE department where he teaches software skills for mission-critical systems. In 2018 he was awarded the highly selective IEEE-SSIT Carl Barus Award for outstanding service in the public interest for his work in promoting automotive computer-based system safety. In 2022 he was named to the National Safety Council's Mobility Safety Advisory Group. He is the author of the book How Safe is Safe Enough: measuring and predicting autonomous vehicle safety (2022). https://users.ece.cmu.edu/~koopman/