Automated Driving: Challenges in the Light of Human Actions Danilo da Costa Ribeiro, Pierre Blüher, Systems & Technology, Continental Chassis & Safety Division Chassis & Safety

Complexity Increase A Glimpse in History 2 November 2018 D. da Costa Ribeiro, P. Blüher © Continental AG

Growing Challenges A Glimpse in History System Complexity Driver Awareness Assumption in a conventional car: There is always a licensed driver to cope with some unexpected scenario New Hazards 2 November 2018 D. da Costa Ribeiro, P. Blüher © Continental AG

Human Interface Highly Automated Vehicles 2 Main Goals Understand the new role New Interfaces Assessment 2 November 2018 D. da Costa Ribeiro, P. Blüher © Continental AG

Future Mobility Role of the Driver vs. Role of the System Privately owned Highly Automated Car incl. Assisted Functions Public shared Driverless Car → Technical check before/while driving (low tire pressure, visual damages, tread depth, …) Manual Driving → Automated Driving → (within use cases) → (within use cases) Secure control of technical operation (accelerating / braking / steering) Manual Driving → Automated Driving → (within use cases) → Evaluate weather/road condition (dry, wet, snow, ice, wind) 2 November 2018 D. da Costa Ribeiro, P. Blüher © Continental AG

Automated Driving Objectives and Challenges Social Acceptance of Residual Risks More Comfort Safety Efficiency “Flawless” Perception “Flawless” Decision Making Safe Driver Interaction Safe & Secure Operation & Degradation Verify & Validate 2 November 2018 D. da Costa Ribeiro, P. Blüher © Continental AG

Automated Driving Safety Objectives Challenges Social Acceptance of Residual Risks More Comfort Safety Efficiency “Flawless” Perception “Flawless” Decision Making Safe Driver Interaction Safe & Secure Operation & Degradation Verify & Validate ! No Matter if Partially / Highly / Fully Automated Driving Silent Testing ≥ 210 million kilometers* Degradation tests Simulation 1st BASIC SAFETY OBJECTIVE No life-threatening hazards in ABSENCE of failure 2nd BASIC SAFETY OBJECTIVE No life-threatening hazards in presence of single failure * Wachenfeld, W., Winner, H., Auswirkungen des autonomen Fahrens auf das Fahrzeugkonzept, Autonomes Fahren, Springer Verlag 2015 2 November 2018 D. da Costa Ribeiro, P. Blüher © Continental AG

Understand the New Role Human Factors? What are the new roles to be performed by the vehicle? To increase safety we need to understand the positive and improving points of the human driver 2 November 2018 D. da Costa Ribeiro, P. Blüher © Continental AG

Understand the New Role: Be Attentive

Understand the New Role: Drive Responsibly

Understand the New Role: Behave Defensively

Human-Machine Interface: Assisting

Human-Machine Interface: Adaptive & Intuitive

Human-Machine Interface: Focused

Human Factors Issues Power Window Switches 1.5 deaths per year (1999-2002)* 5 deaths in 1998* *Source: National Highway Traffic Safety Administration 2 November 2018 NHTSA: https://www.federalregister.gov/documents/2004/09/15/04- 20714/federal-motor-vehicle-safety-standards-power- operated-window-partition-and-roof-panel-systems D. da Costa Ribeiro, P. Blüher © Continental AG

Human Factors Issues Seat Belts Many people do not use the seat belt. Effect: People are not protected by passive safety systems. Optical and acoustical warning Cause: ► Convenience ► Comfort Can we treat the Cause, instead of the effects? ► Robust Product 2 November 2018 D. da Costa Ribeiro, P. Blüher © Continental AG

Automated Driving Example Occupant Protection in a Passenger Vehicle Systems ? New flexibility requires adapted passive safety solutions 2 November 2018 D. da Costa Ribeiro, P. Blüher © Continental AG

New flexibility requires adapted passive safety solutions Automated Driving Example Occupant Protection in a Driverless People Mover Sitting? Standing? Younger? Older? Disabled? Occupant Monitoring Restraint Systems Seatbelt Airbag New flexibility requires adapted passive safety solutions 2 November 2018 D. da Costa Ribeiro, P. Blüher © Continental AG

System-Theoretic Process Analysis (STPA) Unsafe Control Actions Causal Factors Safety Constraints Safety Requirements 2 November 2018 D. da Costa Ribeiro, P. Blüher © Continental AG

Analysis Conclusion Highly Automated Vehicles System-Theoretic Process Analysis (STPA) Top-down Early Phase Suitable for complex systems Less dependent of a very experienced analyst Hazard and Operability (HAZOP) Bottom-up Later Phase Not very suitable for complex systems Dependent of one very experienced analyst In a brand new scenario, there is no one experienced. 2 November 2018 D. da Costa Ribeiro, P. Blüher © Continental AG

Contact System Safety Engineer Danilo da Costa Ribeiro C S&T Systems Engineering Phone: +49 (69) 7603-1274 Email: Danilo.da.Costa.Ribeiro@continental-corporation.com Senior Expert Safety Engineering for Automated Driving Pierre Blüher C S&T Systems Engineering Phone: +49 (69) 7603-1987 Email: Pierre.Blueher@continental-corporation.com 2 November 2018 D. da Costa Ribeiro, P. Blüher © Continental AG

Thank you for your attention! 2 November 2018 D. da Costa Ribeiro, P. Blüher © Continental AG

SensePlanAct 2 November 2018 D. da Costa Rubeiro, P. Blüher © Continental AG