“How Good Is Good Enough?” In Autonomous Driving

Abstract

A new approach for quantifying “good enough” for the behaviour of autonomous vehicles (AVs) is presented here. It is deducted from general behaviour guidelines for (human) behaviour in traffic, and especially the wording of §1 of the German Traffic Code (“Straßenverkehrsordnung, StVO”) is taken into account. The German traffic code generally requires constant caution and mutual consideration; in a second paragraph, it more specifically requires, that “no one is harmed, endangered or unnecessarily hindered or bothered.” The here presented approach proposes a way how to specify and finally quantify those key words. These quantifications can be derived from normal (i.e. safe) traffic practice, which has ever since been established based on the human capabilities to cope with traffic situations. First, this quantification defines the guidelines for a safe own behaviour of an AV, for normal (avoid hindering or bothering others, but never endanger them) and extraordinary (never harming others) traffic situations. It establishes behaviour rules and thus testable performance guidelines for a single vehicle. Second, based on the fact, that everybody should comply with §1, certain behaviour of traffic partners can be trustfully expected in any interactive traffic situation (even an AV should not be harmed or endangered by any other traffic participant), but a safe and robust reaction on (rare) expectable situations (collision free, if only being hindered or bothered by other participants) needs to be ensured. The quantifications can help to define the functional design space for AV behaviour in normal traffic scenarios, with the goal of “not endangering” traffic partners. This leads to more robust behaviour than the “no collision” goal for extraordinary situations. The concept allows to deduct testable performance goals in reference situations, with reasonable passing criteria. The quantification of the key words is mainly based on the reaction times for safety-relevant actions in traffic scenarios, in combination with manageable reaction patterns. Human reactions are generally limited by necessary perception, interpretation, reasoning and action times. Thus, the requirement for AVs must ensure equal or better total performance. This cannot (and is not required to) be tested in every conceivable situation; but typical traffic reference situations must be agreed on, which define borderline cases. Some outer conditions must be summarized by testing for the extreme case. Any testing procedure should include verification of the ability for autonomous stopping; for the worst case of total sensor loss under extreme weather conditions, the “Blind stopping procedure” is proposed. It must be accepted that there exist conceivable situations, in which a single traffic participant will not be able to avoid an accident (loss of own controllability), once a situation has evolved to a certain criticality. The quantifications help to draw a limit line between “avoidable” and “unavoidable” (force majeure, natural disaster) accidents. In order to stay away as much as possible from getting into such uncontrollable situations, an AV needs to demonstrate a perception of “level of danger” and a sense for its own capabilities (“self-awareness”). Testing for these skills should be part of release and certification procedures.