Markus Maurer · J. Christian Gerdes Barbara Lenz · Hermann Winner Editors

# Autonomous Driving

 Technical, Legal and Social Aspects

**Sponsored by:**

Autonomous Driving

Markus Maurer • J. Christian Gerdes Barbara Lenz • Hermann Winner Editors

# Autonomous Driving

Technical, Legal and Social Aspects

Editors Markus Maurer Institut für Regelungstechnik Technische Universität Braunschweig Braunschweig, Niedersachsen Germany

J. Christian Gerdes Department of Mechanical Engineering Stanford University Stanford, CA USA

Barbara Lenz Institut für Verkehrsforschung Deutsches Zentrum für Luftund Raumfahrt e. V., Berlin Germany

Hermann Winner Fachgebiet Fahrzeugtechnik TU Darmstadt Darmstadt, Hessen Germany

ISBN 978-3-662-48845-4 ISBN 978-3-662-48847-8 (eBook) DOI 10.1007/978-3-662-48847-8

Library of Congress Control Number: 2016930537

© The Editor(s) (if applicable) and The Author(s) 2015, 2016. This book is published open access.

Translation from the German language edition: Autonomes Fahren by Maurer, Gerdes, Lenz, Winner, © Daimler und Benz-Stiftung, Ladenburg 2015. All Rights Reserved.

Open Access This book is distributed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, duplication, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, a link is provided to the Creative Commons license and any changes made are indicated.

The images or other third party material in this book are included in the work's Creative Commons license, unless indicated otherwise in the credit line; if such material is not included in the work's Creative Commons license and the respective action is not permitted by statutory regulation, users will need to obtain permission from the license holder to duplicate, adapt, or reproduce the material.

The use of general descriptive names, registered names, trademarks, service marks, etc. in this publication does not imply, even in the absence of a specific statement, that such names are exempt from the relevant protective laws and regulations and therefore free for general use.

The publisher, the authors and the editors are safe to assume that the advice and information in this book are believed to be true and accurate at the date of publication. Neither the publisher nor the authors or the editors give a warranty, express or implied, with respect to the material contained herein or for any errors or omissions that may have been made.

Printed on acid-free paper

This Springer imprint is published by Springer Nature The registered company is Springer-Verlag GmbH Berlin Heidelberg

## Foreword

## Society and Mobility

As by clear evidence: We are on the brink of the next mobile revolution. Autonomous vehicles will become an element of road traffic. The data needed is provided by cameras and sensors, and processed in real time by a computer in fractions of a second. These vehicles permanently exchange information with one another and with the transport infrastructure. Driving robots are to successively relieve the driver of individual tasks.

Nonetheless, the technological perspective of autonomous driving is only one aspect of many. Autonomous vehicles will also have a direct impact on our society that today we can barely imagine. Numerous critical questions arise: What are the prospects concerning data security? How shall we deal with wide-ranging interventions in our own mobile autonomy? What problems result when an autonomous vehicle crosses national borders? In what form will insurance companies assume liability for autonomous vehicles involved in accidents in the future? Or, vice versa: Can we continue to leave humans at the wheel at all, and may driving robots prove to increase road safety?

The Daimler and Benz Foundation considers the social dimension of these changes to be of at least as great significance as the technological one. Innovative technologies are by themselves insufficient to shape these developments and to realize automated driving in our society. We are therefore well advised to already start asking ourselves such questions today and not simply accept this profound change in our mobility as given, allowing it to "overrun" us. To shed light on the ethical, social, legal, psychological, or transport-related aspects of this process, the Daimler and Benz Foundation invited researchers from various specialist fields to address this topic.

The project's core team—Markus Maurer, Barbara Lenz, Hermann Winner, and J. Christian Gerdes—identified the most pertinent questions from their point of view. At the same time, the four researchers established an international network of renowned specialists, who agreed to share their views and experience. The result before us now, a "white paper", analyzes the developments that can already be seen from an interdisciplinary perspective. It is the preliminary result of a large-scale funded project: Under the name "Autonomous Driving—Villa Ladenburg", it was given a time frame of around two years and a budget of 1.5 million euros by the Daimler and Benz Foundation. Our declared aim with the present findings is to make available an objective and independent source of information.

To our minds, exploring the topic from an interdisciplinary perspective is indispensable. In the present volume, the authors therefore attempt an initial comprehensive account of what we may judge as scientifically assertable at this moment in time. At the same time, we must enable potential users of, and others affected by, the still difficult-to-grasp new technologies to experience them firsthand. In this way, many people can begin to have an idea of what they can expect and what the technology can actually do—and also what it will not be able to do.

It is already becoming clear that three aspects come to the fore. Firstly, ethical questions will override all others. Only when autonomously acting vehicles have successfully been provided with a kind of ethics in decision making will driving robotics be able to assert itself in practice. This is especially true of so-called dilemma situations, in which it has to be weighed up, in the case of an unavoidable collision, what behavior will cause the least amount of harm to the persons involved both inside and outside the vehicle. A further key question to clear up is what legislative consequences could result here (e.g., traffic regulations).

A further matter concerns the performance of machine perception. This comes up against various limits: Sensors, cameras, or assembled components degenerate and suffer in their reliability over time. Although it is possible to estimate state uncertainties, and from this to check machine-perception performance, will failures really be predictable? And how could an autonomous machine's safe state be at all defined under all conceivable circumstances? This issue can be summed up even more clearly in one keyword: robotification. Ultimately, the specific questions addressed here without exception penetrate in deeper forms into all areas of everyday life where autonomous machine systems are used. Conditions here also need analyzing, and consequences must be anticipated.

Not least, automated driving can open up completely new opportunities, but also bring with it negative aftereffects. A reduction or shifting of parking-space requirements in inner cities and an efficient use of road space in flowing traffic would be set against fresh suburbanization stemming from alleviated conditions on the urban fringe.

As befits our Foundation's purpose, this publication is designed to contribute to the anticipation and excitement of future discourse, and in this way is aimed at benefitting society as a whole. The book will place a scientific basis in the hands of representatives

Prof.Dr. Eckard Minx President of the Executive Board

Prof.Dr. Rainer Dietrich Member of the Executive Board

# Contents




# Editors and Contributors

## About the Editors

Markus Maurer studied electrical engineering at Technische Universität München, and obtained a doctorate at Bundeswehr Universität München. He started his career in industry as a project manager and head of department in the development of driver-assistance systems at Audi AG. He is a professor of electronic vehicle systems at Technische Universität in Braunschweig.

J. Christian Gerdes is a Professor of Mechanical Engineering at Stanford University, Director of the Center for Automotive Research at Stanford (CARS) and Director of the Revs Program at Stanford University, Stanford, USA.

Barbara Lenz studied geography and German studies to postdoctoral level at Universität Stuttgart, where she was also research assistant and project manager in the area of economic geography at the Institute of Geography. She is Head of the Institute of Transport Research at the German Aerospace Centre (DLR) and a Professor of transport geography at Humboldt-Universität, both in Berlin.

Hermann Winner studied physics to doctoral level at Universität Münster before he started his career in industry in advanced engineering and later in series development at Robert Bosch GmbH where he was responsible for driver assistance systems. He is a professor for automotive engineering at Technische Universität in Darmstadt.

## Contributors

Sven Beiker Formerly Center for Automotive Research at Stanford, Stanford University, Stanford, Palo Alto, CA, USA

Rita Cyganski Institute of Transport Research, German Aerospace Centre (DLR), Berlin, Germany

Klaus Dietmayer Institute of Measurement, Control and Microtechnology, Universität Ulm, Ulm, Germany

Berthold Färber Bundeswehr Universität München, Neubiberg, Germany

Heike Flämig Institute for Transport Planning and Logistics, Technische Universität Hamburg-Harburg—TUHH, Hamburg, Germany

Eva Fraedrich Geography Department, Humboldt-Universität zu Berlin, Berlin, Germany

Bernhard Friedrich Institute of Transportation and Urban Engineering, Technische Universität Braunschweig, Braunschweig, Germany

Tom Michael Gasser Federal Highway Research Institute (BASt), Bergisch Gladbach, Germany

J. Christian Gerdes Department of Mechanical Engineering, Center for Automotive Research at Stanford, Stanford University, Stanford, CA, USA

Armin Grunwald Institute for Technology Assessment and Systems Analysis (ITAS), Karlsruhe Institute of Technology—KIT, Eggenstein-Leopoldshafen, Germany

Dirk Heinrichs Institute of Transport Research, German Aerospace Centre (DLR), Berlin, Germany

Fabian Kröger Institut d'histoire moderne et contemporaine (IHMC), Equipe d'histoire des techniques, CNRS, ENS, Université Paris I Panthéon-Sorbonne, Paris, France

Barbara Lenz Institute of Transport Research, German Aerospace Centre (DLR), Berlin, Germany; Geography Department, Humboldt-Universität zu Berlin, Berlin, Germany

Patrick Lin Philosophy Department, California Polytechnic State University, San Luis Obispo, CA, USA

Markus Maurer Institute of Control Engineering, Technische Universität Braunschweig, Braunschweig, Germany

Marco Pavone Department of Aeronautics and Astronautics, Stanford University, Stanford, CA, USA

Kai Rannenberg Deutsche Telekom Chair of Mobile Business and Multilateral Security, Goethe Universität Frankfurt, Frankfurt Am Main, Germany

Andreas Reschka Institute of Control Engineering, Technische Universität Braunschweig, Braunschweig, Germany

Miranda A. Schreurs Environmental Policy Research Centre (FFU), Freie Universität Berlin, Berlin, Germany

Bryant Walker Smith School of Law, University of South Carolina, Columbia, SC, USA

Sibyl D. Steuwer Environmental Policy Research Centre (FFU), Freie Universität Berlin, Berlin, Germany

Sarah M. Thornton Department of Mechanical Engineering, Center for Automotive Research at Stanford, Stanford University, Stanford, CA, USA

Walther Wachenfeld Institute of Automotive Engineering—FZD, Technische Universität Darmstadt, Darmstadt, Germany

Peter Wagner Institute of Transportation Systems, German Aerospace Centre (DLR), Berlin, Germany

Thomas Winkle Department of Mechanical Engineering, Institute of Ergonomics, Technische Universität München – TUM, Garching, Germany

Hermann Winner Institute of Automotive Engineering—FZD, Technische Universität Darmstadt, Darmstadt, Germany

David M. Woisetschläger Institute of Automotive Management and Industrial Production, Technische Universität Braunschweig, Braunschweig, Germany

Ingo Wolf Institut Futur, Freie Universität Berlin, Berlin, Germany

Stephen S. Wu Business and Technology Law and Litigation, Los Altos, CA, Germany

# 1 Introduction

Markus Maurer

Autonomous driving is a popular subject of discussion in today's media and, occasionally, a highly emotional one. Proclamations of success from car makers, system partners, and companies whose business models stem from other fields continue to fuel the debate. As late as 2011, as the "Autonomous Driving—Villa Ladenburg" project (which enabled the present volume to be published) was still being defined, we could not foresee how central the topic would be in public discourse at the project's end three years later.

In line with the objectives of the Daimler and Benz Foundation, the project aims to stimulate discussion on a technical topic of great social significance. It would be immodest and objectively false to credit growing discussion to this project when, at the same time, several leading global firms are using their research and public relations teams to position themselves in this forward-looking technological field. Nonetheless, the project influenced the public discourse decisively at various points, even if the connection was not immediately recognizable.

Indisputably, the Daimler and Benz Foundation has shown excellent and timely instincts in launching this project. Precisely because autonomous driving is currently receiving so much attention, the present volume's publishers deem it a good time to present as complete an overview of the topic as possible. For this discussion, researchers from various disciplines have taken up the task of sharing their viewpoints on autonomous driving with the interested public. This has brought many relevant issues into the debate.

As researchers, this has taken us into unfamiliar territory. We are addressing a specialist audience, potential stakeholders and the interested public in equal measure. Of course, this book cannot satisfy every desire. For further reading, then, please consult the prior articles of the project team in the journals and conference proceedings of their

M. Maurer (&)

Institute of Control Engineering, Technische Universität Braunschweig, 38106 Braunschweig, Germany e-mail: maurer@ifr.ing.tu-bs.de

respective specialist fields. The Foundation also plans publications to accompany this volume that will summarize this book's key findings and put them in everyday language.

#### 1.1 What Is Autonomous Driving?

Even a quick glance at the current public debate on autonomous driving shows that there is no universal consensus on terminology. In order to bring about a certain convergence in how the terms of autonomous driving are understood among those involved in the project, some definitions were selected in a highly subjective fashion at the beginning of this project. These definitions were illustrated with use cases described in-depth (see Chap. 2). These definitions are described in all of their subjectivity here.

For decades, word plays on the word "automobile" have been rife among pioneers in the field of autonomous driving [1]. When the car was invented, the formulation of "automobile," combining the Greek autòs ("self, personal, independent") and the Latin mobilis ("mobile") [2] stressed the "self-mobile." The overriding emotion was joy that the driver was mobile without the aid of horses. What this term failed to acknowledge, however, was that the lack of horses meant that the vehicle had also lost a certain form of autonomy [1]. Through training and dressage, carriage horses had learned for themselves (self = Greek autos, see above) to stay within the bounds of simple laws (Greek nómos: "human order, laws made by people"). In this sense, horse and carriage had thus both achieved a certain autonomy.

In the transition from horse carriages to automobiles, important obstacle-avoidance skills were lost, as undoubtedly was the occasional ability to undertake "autonomous missions." Many a time would horses have brought a carriage home safely even if the driver was no longer completely fit for the journey. They would have at least have conveyed the vehicle in a "safe state," eating their fill of grass on the wayside. The autonomous automobile aims to recover its lost autonomy and indeed go far beyond its historic form.

A special perception of Kant's concept of autonomy, as formulated by Feil, came to be of importance in understanding "autonomous driving" within the project: autonomy as "self-determination within a superordinate (moral) law" [3]. In the case of autonomous vehicles, man lays down the moral law by programming the vehicle's behavior. The vehicle must continually make decisions about how to behave in traffic in a manner consistent with the rules and constraints with which it was programmed.

It has to be said that the reaction of experts from diverse disciplines ranged and ranges from complete rejection of this definition to carefully considered approval. Independent of this, however, it is possible, by reference to the concept of autonomy interpreted and understood in these Kantian terms, to point out the direct linkage between technological development and ethical considerations.

The importance of this definition for engineers comes through clearly in my discussions with students. Confronted with this definition, engineering students in Braunschweig and Munich have in the last ten years come to understand that the development of autonomous driving requires them to not only research and develop technology but also to implement "moral laws" with utmost consistency. How does an autonomous vehicle behave in a dilemma situation, when at least one road user will inevitably be injured in an accident? This discussion is explored in greater depth in this book by Patrick Lin and Chris Gerdes (see Chaps. 4 and 5).

To bring engineers and lawyers into agreement, various degrees of assistance and automation were defined in a working group drawn from the German Federal Highway Research Institute (BASt) [4]. The highest defined degree of automation was named "Full Automation": The fully automated vehicle drives by itself without human supervision. Should system performance degrade, the vehicle is autonomously "restored to the system state of minimal risk." From a technical point of view, the greatest challenge lies in the complete absence of a human supervisor who knows the system limits, recognizes system faults and, where needed, switches the vehicle into a safe state. Fully automated vehicles must monitor their own state autonomously, spot potential system faults and performance degradations, and then—with a threatened drop in performance—initialize and execute the transition to a safe state. Clearly, the safe state takes on a central role in the definition. What does a safe state consist of, however, when a fully automated vehicle is moving on the highway at 65 miles per hour (or even faster in Germany)?

Ohl [7] pointedly concluded that the prototypes for autonomous vehicles demonstrated on public roads by research institutes, vehicle manufacturers, and IT companies in recent decades have only been partially automated in terms of the BASt definition. Safety drivers have supervised the automated vehicles; a production-ready safety concept for fully automated vehicles has yet to materialize. While there have been successful trips in which the safety driver has not had to intervene, to this day we lack evidence of the feasibility of journeys on public roads with fully automated vehicles.

Despite the concerns of some experts mentioned above, autonomous vehicles in the present volume are characterized by their "self-determination within a superordinate (moral) law" laid down by humans (Kant, as found in [3], see above). They are fully automated vehicles in terms of the BASt definitions [4].

For reasons of space, it has been decided for this book to forego a narrative history and a documentation of the state of research and the technology. Regarding autonomous road vehicles, Matthaei et al. [5] have summarized the current state of the art. In Chap. 3, Fabian Kröger gives an arresting historical overview of autonomous driving as a visionary concept, or as science fiction, chiefly within image-based media.

#### 1.2 Autonomous Driving—Drivers Behind the Research

Research into fully automated vehicles [4] used to be, and still is, driven by a host of reasons. Only the most common are given in this section.

Even though the number of accident deaths in Germany drops nearly annually, the estimated worldwide number is occasion enough for a further increase in transport-system safety. According to the WHO, 1.24 million people worldwide died in road accidents in 2010 [8]. In Chap. 17, Thomas Winkle examines the conditions under which the accident-prevention impact of automated vehicles can be forecast prior to their being launched on the market.

How much a driver or potential user requires assistance is at the heart of any particular vehicle system. Is he or she confronted with an activity that is tiring and kills off any pleasure in driving (stop-and-go traffic, long stretches on highways)? Or is he or she temporarily unfit to drive, for instance under the influence of medication, too tired or simply too inattentive for active driving? Is there a need for assistance because of diminished faculties due to illness or old age, or diseased muscles or bones? In these cases, a car's autonomous capability to drive opens up new opportunities for individual mobility.

Fully automated driving [4] offers the greatest potential for optimizing traffic flow. By far the most well-known European program of vehicle automation of the last century has already indicated this objective: "Programme for a European traffic with highest efficiency and unprecedented safety" (1987–1994), or "Prometheus" for short [6]. More recent projects have demonstrated technical solutions specially designed to increase traffic flow. In Chaps. 15, 16, and 19, the authors occupy themselves with autonomous vehicles' potential for improved traffic flow and new vehicle usage concepts.

The significance of the capability to drive autonomously for commercial vehicles merits special attention. Heike Flämig examines what potentialities arise for autonomous vehicles in the area of freight transport (see Chap. 18).

The potential that autonomous vehicles' rollout holds for a far-reaching reshaping of the transport system—indeed the city itself—has not yet been heavily researched. The authors of this book's "Mobility" and "Acceptance" sections illustrate how multilayered the changes made possible by introducing autonomous vehicles could be. These potential changes can drive, but also inhibit, such an introduction.

#### 1.3 The Layout of this Book

Immediately following this introduction, the use cases which contributed to the authors' common understanding of autonomous driving, and which should do the same for readers (see above), are elucidated. This is followed by six sections, each overseen by editors with specialist knowledge, from whose pens also stem the short introductions preceding each section.

Fabian Kröger opens the first section on the topic of "Human and Machine" with a summary of how autonomous road vehicles have been viewed in public, mostly in the media, since work started on vehicle automation almost one hundred years ago. Chris Gerdes and Patrick Lin address how autonomous driving is to be assessed under ethical considerations, and whether autonomous vehicles can behave ethically. Berthold Färber and Ingo Wolf discuss questions of human and machine coexistence.

The "Mobility" section examines how mobility may be altered by the introduction of autonomous vehicles, both generally and in specific aspects. To this end, Miranda Schreurs and Sibyl Steuwer give an overview of the political framework. Barbara Lenz and Eva Fraedrich examine the potential for new mobility concepts that may result from autonomous driving. Sven Beiker outlines various deployment scenarios for fully automated vehicles [4]; he also discusses an actual case of them in use. Dirk Heinrichs looks at the ramifications and questions for urban development that may arise from autonomous driving. Hermann Winner and Walther Wachenfeld take up the question of what impact autonomous driving may have on the vehicle concept itself. Rita Cyganski looks into the issue of how autonomous vehicles may change demand for mobility and how this can be represented in models for transport planning.

In the "Traffic" section, Peter Wagner and Bernhard Friedrich forecast how autonomous vehicles may affect traffic. Thomas Winkle furthers the discussion on the potential safety benefits of assisted, partially, and fully automated vehicles [4]. Heike Flämig examines their particular significance for freight transport. Marco Pavone discusses the potential of "Mobility on Demand."

The "Safety" section tackles basic questions of technical reliability in machine perception (Klaus Dietmayer), functional safety (Andreas Reschka, Walther Wachenfeld, Hermann Winner), and data integrity (Kai Rannenberg).

In the "Legal and Liability" section, Tom Gasser, Stephen Wu and Bryant Walker Smith examine the current legal systems and legal frameworks for autonomous driving in both Germany and the USA; Thomas Winkle recommends drawing from the experience of liability cases in the development process.

In the "Acceptance" section, Eva Fraedrich and Barbara Lenz explore questions of individual and societal acceptance of automated vehicles. Armin Grunwald investigates questions of society's perception of risk in connection with autonomous driving. Eva Fraedrich and Barbara Lenz examine the relationship between today's car-usage practices and attitudes to autonomous driving. David Woisetschläger discusses the economic consequences for the traditional car industry and new market players.

#### 1.4 Work in the Project

The working methods in the "Autonomous Driving—Villa Ladenburg" project have influenced the present book. They are thus briefly sketched out below for the sake of transparency. The "motor" of the project was the core team consisting of Chris Gerdes, Barbara Lenz, Hermann Winner, and Markus Maurer. This was supported by the research work of Eva Fraedrich, Walter Wachenfeld, and Thomas Winkle, who receive our grateful thanks at this point. In the first of the project's two years—the project ran from October 2012 to September 2014 in total—over 200 questions relevant to autonomous driving were identified among the core team. These questions were the basis for project specification sheets that served as guidelines for this volume's authors. Three workshops were carried out to bring about a common understanding of autonomous driving among the participants in the project and share different perspectives from their various specialist disciplines. At one of the first workshops, in November 2013 in the Möhringen district of Stuttgart, the concept of the project and basic understanding of autonomous driving established via the definitions discussed above and the use cases (see Chap. 2)—were introduced and explored.

At two further workshops in Monterey (February 2014) and Walting (March 2014), the authors presented and put forward for discussion their answers to the project specification sheets. It is thanks to the discipline, openness, and expertise of the authors that a comprehensive discussion on autonomous driving can be presented in this volume, addressing in equal measure the potential and the challenges to society on the path to mass production. In this sense, this book hopes to be a starting point for sustainable research and development of autonomous road vehicles. Special thanks are due to all the authors, who have involved themselves in this book project with focus, discipline and a willingness for interdisciplinary dialogue.

In the closing phase of this book's production, the authors were overseen by the editors of the individual sections, who took great pains to aid the convergence of the articles therein. Editing the sections was among the tasks of the core-team members. Special thanks go to Tom Gasser and Bernhard Friedrich, who each took on the editing of a section and brought necessary expertise that was not available on the core team. Even before it had drawn to a close, the project made a considerable impact on the specialist discussion on autonomous driving in Germany and the USA. One particularly positive outcome was that many participants in the project have taken part in round table discussions on "automated driving" at the initiative of the German Federal Ministry for Transport and Digital Infrastructure (BMVI) and its working groups since December 2013. Project findings thus flowed, and continue to flow, into the reports of the round table. The interest of experts and the public became clear in the response to the numerous talks, press interviews, and publications carried out in the context of the project. Over the duration of the project, considerable adjustments were made in the communications of leading vehicle manufacturers and tech companies relating to autonomous driving. It cannot be ruled out that the project has already left its first relevant marks here.

Even though the project itself employed a scientifically clear-cut definition of autonomous driving, some of its findings will be of direct practical relevance for highly automated vehicles and even driver assistance systems already in use in today's production road cars.

This book has only been possible thanks to the support of the Daimler and Benz Foundation, for which we are extremely grateful. "We" in this context means all the authors and editors of this book. We would also like to thank the Springer publishing house for a good working relationship and the high quality print edition. Particular thanks go to Thomas Winkle for supporting all translations and coordinating the English edition. Thanks to the Foundation's support, this book is available electronically at no charge. Special thanks are due to various employees at Daimler AG for interesting discussions, but especially for the understanding that the researchers in this project were guided by scientifically motivated questions, independent of commercial interests.

My wholly personal thanks go to Barbara, Chris, and Hermann for their readiness to collaborate in the core team, intensive cooperation, openness in discussions, constant striving to bring in their own experience to further develop their own concepts, and their constant struggle to make a common contribution to the sustainable research and development of autonomous driving.

Open Access This chapter is distributed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, duplication, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, a link is provided to the Creative Commons license and any changes made are indicated.

The images or other third party material in this chapter are included in the work's Creative Commons license, unless indicated otherwise in the credit line; if such material is not included in the work's Creative Commons license and the respective action is not permitted by statutory regulation, users will need to obtain permission from the license holder to duplicate, adapt or reproduce the material.

#### References


# 2 Use Cases for Autonomous Driving

Walther Wachenfeld, Hermann Winner, J. Chris Gerdes, Barbara Lenz, Markus Maurer, Sven Beiker, Eva Fraedrich and Thomas Winkle

W. Wachenfeld (&) H. Winner Institute of Automotive Engineering – FZD, Technische Universität Darmstadt, 64287 Darmstadt, Germany e-mail: wachenfeld@fzd.tu-darmstadt.de

H. Winner e-mail: winner@fzd.tu-darmstadt.de

J.C. Gerdes Department of Mechanical Engineering Center for Automotive Research at Stanford, Stanford University, Stanford, CA 94305, USA e-mail: gerdes@stanford.edu; gerdes@cdr.stanford.edu

B. Lenz Geography Department, Humboldt-Universität zu Berlin, Berlin, Germany e-mail: barbara.lenz@dlr.de

M. Maurer Institute of Control Engineering, Technische Universität Braunschweig, 38106 Braunschweig, Germany e-mail: maurer@ifr.ing.tu-bs.de

S. Beiker Formerly Center for Automotive Research at Stanford, Stanford University, Palo Alto, CA 94304, USA e-mail: sven@svenbeiker.com

E. Fraedrich Geography Department, Humboldt-Universität zu Berlin, 10099 Berlin, Germany e-mail: eva.fraedrich@geo.hu-berlin.de

T. Winkle Department of Mechanical Engineering, Institute of Ergonomics, Technische Universität München – TUM, 85747 Garching, Germany e-mail: winkle@carforensic.com

© The Author(s) 2016 M. Maurer et al. (eds.), Autonomous Driving, DOI 10.1007/978-3-662-48847-8\_2

#### 2.1 Motivation for the Consideration of Use Cases

Although autonomous driving is characterized (see Chap. 1) by the definition for "fully automated" according to BASt [1] as well as the quote by Feil [2] "self-determination within the scope of an higher (moral) law", it is possible to come up with a large variety of usage scenarios and specifications for autonomous driving. In order to grasp this variety, proxies are sought, which on the one hand make use of distinguishing characteristics, and on the other hand describe typical usage scenarios for autonomous driving. In the following, these will be called use cases for autonomous driving. Besides the nomenclature, the use cases are defined by their distinguishing characteristics, so that a common understanding can be reached for all writing and reading these book chapters. In addition, the use cases are supposed to serve as reference scenarios for further discussion. It is not intended to exclude other examples. However it is recommended to use the defined use cases to avoid misunderstanding or oversight. The following definitions and assumptions can additionally be expanded for the different book chapters with detailed descriptions. As for the different book chapters, definitions and assumptions are relevant in different ways. For instance the owner relations are less important for a technical point of view than for taking a look at the market impact. Thus, definitions and assumptions are to be examined critically. Desired results from working with these use cases are a founded change of definitions and assumptions as well as possible controversy, which arise in between the different topics (different parameter sensitivity).

The following description of the use cases is structured in 4 sections. Section 2.2, general assumptions, describes the limitations and assumptions that are used and are supposed to apply for all use cases. Section 2.3 introduces the four selected use cases and defines the specific characteristics. Section 2.4 explains the selection and the level of detail for the characteristics describing the use cases. Section 2.5, general definitions, proposes definitions, which facilitate a unique description of the use cases.

#### 2.2 General Assumptions

Besides the characteristics which distinguish the use cases, and which are listed in the following section, there are additional attributes, which apply to the chosen use cases as well. The following general assumptions describe these attributes.

Mixed operation: One basic assumption is that the use cases are deployed at the considered time in a mixed operation of transportation systems with different levels of automation. Road traffic consists of vehicles with all levels of automation ranging from "driver-only" to "assisted" to "fully automated". During the stepwise introduction of automation, both human vehicle operation and driving robot operation are equally likely.

Failures: Hardware or software failures can also happen with autonomously driven vehicles. However, it is assumed that a vehicle designed according to the state of the art (e.g. ISO 26262) is, with regard to the failures mentioned, at least as reliable and safe as today's vehicles.

Level of detail: The description of the use cases is not a detailed specification. Instead of a detailed description of weather conditions, light conditions, road surface conditions etc. the following simplification is assumed. The quality as well as the success rate with which the driving robot performs the driving task is similar to the human quality and success rate. For example, heavy rain leads only to transition to the safe state and discontinuation of the transportation task when a driver would discontinue the journey as well. This document does not tackle the question of whether this assumption from the user's point of view, the society's point of view etc. is sufficient. Furthermore, in this document the question of how this quality and success rate is quantified and proved remains unanswered.

Conformity with regulations: For all use cases it is assumed that the autonomous journey is performed compliant with the set of rules of the respective jurisdiction (federal/national level, state level in the United States), in which the driving actually takes place. The question about the action in dilemma situations directly arises from this assumption. Is the driving robot permitted, or is it even possible, to disregard rules in order to prevent major damage? For these use cases it is assumed that a legally valid set of rules, respectively meta-rules, exists, which the driving robot follows. In order to do so, the respective authority has granted permission to perform autonomous driving, while it is not further contemplated how such permission can be obtained and what the respective rules might be.

#### 2.3 Description of the Use Cases

The motivations and general assumptions underlying the use cases are laid out above, and the characteristics considered for their description are explained in Sect. 2.4. The combination of these characteristics and/or their values leads to a very large number of use cases, which cannot be described in detail. The four use cases described in the following serve, as mentioned above, as proxies for this multitude of possible use cases. Other use cases are not disregarded but our focus is set on the following four:


The partition of the driving task between human and driving robot, in which the four versions differ, has particularly contributed to the selection of the use cases. The first two use cases are seen as introductory versions, while the two latter use cases present widely developed versions of autonomous driving.

#### 2.3.1 Interstate Pilot Using Driver for Extended Availability

An exemplary use case of the interstate pilot is depicted in Fig. 2.1.

#### 2.3.1.1 Benefit

The driving robot takes over the driving task of the driver exclusively on interstates or interstate-like expressways. The driver becomes just a passenger during the autonomous journey, can take his/her hands off of the steering wheel and pedals, and can pursue other activities.

#### 2.3.1.2 Description

As soon as the driver has entered the interstate, he/she can, if desired, activate the driving robot. This takes place most logically in conjunction with indicating the desired destination. The driving robot takes over navigation, guidance, and control until the exit from or end of the interstate is reached. The driving robot safely coordinates the handover to the driver. If the driver does not meet the requirements for safe handover, e.g. because he/she is asleep or appears to have no situation awareness, the driving robot transfers the vehicle to the risk-minimal state on the emergency lane or shortly after exiting the interstate. During the autonomous journey, no situation awareness is required from the occupant; the definition for fully automated driving according to BASt [1] applies. Because of simple scenery and limited dynamic objects, this use case is considered as an introductory

Fig. 2.1 Interstate pilot using driver for extended availability

scenario, even if the comparatively high vehicle velocity exacerbates accomplishing the risk-minimal state considerably.

#### 2.3.1.3 Values of Characteristics

Table 2.1 summarizes the characteristics for the interstate pilot use case. Figure 2.2 shows the intervention possibilities for instances on the levels of the driving task for the use case Interstate Pilot. "The entities which can intervene into the driving task are depicted on the


Table 2.1 Values of characteristics for interstate pilot using driver for extended availability

Fig. 2.2 Interstate pilot options for intervention

right side of the hierarchy and are sorted from dominant at the top to recessive at the bottom." The vehicle user is the only entity which may intervene. It should be emphasized again that the handover is managed in a safe manner through the driving robot. Potential service providers, police and ambulance with specific authority, a traffic coordinator etc. do not have any possibility to intervene with the vehicle control.

#### 2.3.2 Autonomous Valet Parking

An exemplary use case of the autonomous valet parking is depicted in Fig. 2.3.

#### 2.3.2.1 Benefit

The driving robot parks the vehicle at a remote location after the passengers have exited and cargo has been unloaded. The driving robot drives the vehicle from the parking location to a desired destination. The driving robot re-parks the vehicle.

The driver saves the time of finding a parking spot as well as of walking to/from a remote parking spot. In addition, access to the vehicle is eased (spatially and temporally). Additional parking space is used more efficiently and search for parking is arranged more efficiently.

Fig. 2.3 Autonomous valet parking

#### 2.3.2.2 Description

If a driver has reached his/her destination (for example place of work, gym, or home), he/she stops the vehicle, exits, and orders the driving robot to park the vehicle. The vehicle can be privately owned, but might also be owned by a carsharing provider or similar business model. Therefore, the driving robot may now drive the vehicle to a private, public, or service-providerowned parking lot. It is important to assign a parking lot to the driving robot. The search for the respective parking lot by the driving robot is not taken into consideration for this use case. Therefore a defined destination for the driving robot is always given. Because of the low velocity and the light traffic situation, the deployment of Autonomous Valet Parking is limited to the immediate vicinity of the location where the driver left the vehicle. On the one hand, this limitation reduces the requirements regarding the (driving-) capabilities of the driving robot significantly, because lower kinetic energy as well as shorter stopping distances results from lower velocity. On the other hand, this use case could potentially irritate or frustrate other road users. However, this use case seems to be suitable as an introductory scenario.

An authorized user in the vicinity of the vehicle can indicate a pick-up location to the driving robot. The driving robot drives the vehicle to the target destination and stops, so that the driver can enter and take over the driving task.

If desired by the parking lot administration, the driving robot can re-park the vehicle.

#### 2.3.2.3 Values of Characteristics

Table 2.2 summarizes the characteristics for the autonomous valet parking use case. The entities which can intervene into the driving task are depicted on the right side of the hierarchy and are sorted from dominant at the top to recessive at the bottom (see Fig. 2.4). The vehicle user can change the driving mission from outside of the vehicle and instruct the driving robot to perform a safe exit. The service provider overrules the vehicle user and can


Table 2.2 Values of characteristics for autonomous valet parking

Fig. 2.4 Autonomous valet parking options for intervention

also influence the driving mission and the safe exit. Both entities are overruled by the entities with exclusive rights. For example, the police or ambulance can decelerate the vehicle on the guidance level, change navigation and driving mission, and order a safe exit.

## 2.3.3 Full Automation Using Driver for Extended Availability

An exemplary use case of the full automation using driver for extended availability is depicted in Fig. 2.5.

#### 2.3.3.1 Benefit

If the driver desires to do so, he/she hands over the driving task to the driving robot in permitted areas. The driver becomes just a passenger during the autonomous journey, can take his/her hands off of the steering wheel and pedals, and can pursue other activities.

#### 2.3.3.2 Description

If the driver desires, he/she can always hand over the driving task to the driving robot, whenever the current scenery is cleared to do so. Almost the entire traffic area in the permitted country is approved for the vehicle; however, such approval is subject to restrictions. If, for instance, the traffic flow is rerouted, a new parking structure opens, or similar changes are undertaken to the infrastructure, then the respective areas cannot be navigated autonomously until further approval. It also appears to be reasonable in this scenario that road sections are excluded from approval permanently or temporarily, e.g. roads with a high frequency of pedestrians crossing. Here again, the handover between driver and driving robot has to be managed in a safe manner.

This use case might come as close as it gets to today's visions for autonomous driving, as it corresponds strongly with today's passenger vehicle usage, and the driving task is

Fig. 2.5 Full automation using driver for extended availability

almost completely delegated to the driving robot while the traditional main user and driver still participate in the journey.

#### 2.3.3.3 Values of Characteristics

Table 2.3 summarizes the characteristics for the full automation using driver for extended availability use case. Figure 2.6 shows, which entity (right) intervenes with a certain driving task (left) on a certain level. If desired, the vehicle user can drive the vehicle the


Table 2.3 Values of characteristics for full automation using driver for extended availability

Fig. 2.6 Full automation using driver for extended availability options for intervention

same way as driving a classic driver only automobile, provided that the driving task has been handed over safely from the driving robot. Furthermore, the vehicle user can intervene on the level of the navigation, guidance and control tasks. The vehicle user dominates the entities with exclusive rights. The vehicle user can therefore overrule police or ambulance, which can exclusively intervene on the guidance level. The same is true for the service provider. The service provider can intervene on the navigation and guidance level, as long as not overruled by the vehicle user. It is left open in this document for which services the service provider needs access. Some concepts propose services where the service provider takes over the navigation for commercial use and partly pays for fuel and travel expenses.

#### 2.3.4 Vehicle on Demand

An exemplary use case of the vehicle on demand is depicted in Fig. 2.7.

#### 2.3.4.1 Benefit

The driving robot drives the vehicle autonomously in all scenarios with occupants, with cargo, but also completely without any payload. The driving robot makes the vehicle available at any requested location. Passengers use the travel time completely independently for other activities than performing the driving task. The cabin is designed completely independently from any restrictions of a driver workplace whatsoever. Cargo can be transported with the aid of the driving robot continuously for 24 h a day, as long as it is not restricted by the energy supply for driving.

Fig. 2.7 Vehicle on demand (scenery marked red is not part of the operating area)

#### 2.3.4.2 Description

The driving robot receives the requested destination from occupants or external entities (users, service provider, etc.), to which the vehicle proceeds autonomously. Humans do not have any option to take over the driving task. The human can only indicate the destination or activate the safe exit, so that he/she can exit the vehicle safely as quickly as possible. With this driving robot, a wealth of different business models is conceivable. A mix of taxi service and car sharing, autonomous cargo vehicles or even usage models that goes beyond the pure transportation task. One example could be a vehicle for social networks that uses information from the network directly in order to plan routes, match people or enables further services which have not yet been thought of.

#### 2.3.4.3 Values of Characteristics

Table 2.4 summarizes the characteristics for the vehicle on demand use case. The possibilities for intervention regarding the use case vehicle on demand are especially broad (see Fig. 2.8), due to the enormous (driving) abilities of the driving robot. The driving robot always carries out the control level. An entity with exclusive rights (e.g. police or ambulance) and the entity for traffic management can both intervene on navigation and guidance levels. Vehicle users and service providers can influence the safe exit and therefore instruct the driving robot to a fast and safe stop in order for a passenger to leave the vehicle. It is especially noticeable that service providers and the authority with exclusive rights can overrule the vehicle user. If one authority overrules the user, he/she cannot perform the safe exit anymore and has to stay in the vehicle. This constellation is


Table 2.4 Values of characteristics for Vehicle on Demand

Fig. 2.8 Vehicle on demand options for intervention

similar to that of current taxi concepts. The taxi driver can stop as fast as possible, if the passenger so requests. Generally though, he (the taxi driver) also has the possibility to disregard this request and drive the vehicle as he/she own desires.

#### 2.4 Selected Characteristics to Describe the Use Cases

In this section, the characteristics describing the use cases and their values are explained in more detail. Besides the following few technical characteristics of autonomous driving, it is possible to define further distinguishing attributes, for example regarding the business model or market position. This will be disregarded for now because of the as-yet little knowledge in this area.

The characteristics, in alphabetical order A to I, were derived from the three-level-model for the driving task according to Donges [3] and chosen for the description. In that model, the driving task is divided into the three levels navigation, guidance, and control.

#### 2.4.1 Characteristic A: Type of Occupant

#### 2.4.1.1 Motivation

For today's individual mobility with a vehicle, a human is required to be permanently in the vehicle and to control it under all circumstances [4]. This constraint could change with the automation of the driving task. Thus the vehicle concept and the safety concept depend on the type of occupant.

#### 2.4.1.2 Values of the Characteristic

Here, the following values are distinguished:


One use case can be covered by several values of this characteristic. The distinction between value 3 and 4 is made in order to distinguish between individual and public transportation. A vehicle of individual transportation carries persons with agreed destinations. In contrast, a vehicle of public transportation carries multiple persons who have not previously agreed upon a destination. However, persons reach their destinations with public transportation, because a schedule with destinations and intermediate stops is established.

#### 2.4.2 Characteristic B: Maximum Permitted Gross Weight

#### 2.4.2.1 Motivation

The maximum permitted gross weight influences safety considerations via kinetic energy. Besides safety considerations, looking at gross weight extends the discussion beyond individual transportation to public transportation, freight transportation as well as road infrastructure. In addition, this characteristic addresses the question of vehicle types, which potentially are not compatible with current vehicle types because of the autonomous driving functions and changing requirements, on a high level. Instead of considering the boundaries of often country-specific vehicle classes, four mass attributes are chosen. They range in values from ultra-light vehicles to heavy trucks and each step spans a factor of 4 between types.

#### 2.4.2.2 Values of the Characteristic

Discrete distinctions have been established in order to describe the imagined use cases and to roughly categorize their mass. An exact determination of the mass is possible for existing use cases and specified deployment. Characteristic B covers the following values:


#### 2.4.3 Characteristic C: Maximum Deployment Velocity

#### 2.4.3.1 Motivation

The characteristic of maximum deployment velocity (to be precise the square of the velocity) determines, multiplied with the mass, the kinetic energy of a vehicle, and therefore also needs to be distinguished. In addition, stopping distance is calculated using the square of the velocity. Accordingly, the autonomous system's requirements regarding a risk-minimal state in case of failure or when reaching functional limitations grow with the velocity squared.

Besides safety considerations, travel time and the range achievable in a given time at a given deployment velocity are also values that influence individual mobility. In addition, the deployment velocity directly defines the road type which can be used if a minimum velocity is required for using it.

#### 2.4.3.2 Values of Characteristic

The maximum deployment velocity, characteristic C, has five proxy values, one for walking speed, and four in steps with a factor of two (= factor 4 in terms of kinetic energy and stopping distance). For concrete use cases the values and regulations need to be adapted to the respective deployment. Discrete distinctions have been established in order to describe the imagined use cases and to roughly categorize their velocity. An exact determination of the velocity is possible for existing use cases and defined deployments.


#### 2.4.4 Characteristic D: Scenery

#### 2.4.4.1 Motivation

Which spatial areas accessible to the driver through the driver-only automobile will also be made accessible with the described use case of autonomous driving? The scenery characteristic describes the spatial deployment in which the vehicle drives autonomously. For instance, do standardized structures exist, how many lanes are available, and do other markings exist?

Even static scenery can be diverse and present a challenge for the driving robot. One example of this, as is often mentioned, is traffic lanes covered with snow, or traffic signs hidden by bushes or trees. Such conditions, which are potentially unknown and non-changeable at the beginning of a journey, will not be considered with this characteristic. Determining the extent to which the driving robot can deal with scenery and conditions rests on the assumption that the robot can accomplish the driving task as well as a human driver.

This characteristic therefore describes scenarios that are predictable and that follow existing rules on a high level (location, environment and function of the road).

#### 2.4.4.2 Values of the Characteristic

Dimension: type of scenery


The scenery characteristic in its first dimension covers 9 values (the scenery types from the German guidelines for integrated network design [5] were expanded) (Table 2.5):

Besides this value that describes the scenery within which a specific use case can be performed, the characteristic has a second dimension, which is the condition whether access to the scenery has to be permitted explicitly or not. The respective values are the following:


For now, it is left open who grants this permission and whether that is a private or public administration. In that sense, the type of permission is not further specified, for example the infrastructure could be in maintenance mode or a map could be provided, enriched with additional information. And also, the permission could include a temporary component and statistical or dynamic cutoff times for specific scenery areas.





#### 2.4.5 Characteristic E: Dynamic Elements

#### 2.4.5.1 Motivation

Besides the scenery, the complexity of a scene depends largely on dynamic elements. The dynamic elements in the scene with the autonomously driving vehicle extend the requirements on the driving abilities of the driving robot. Therefore this characteristic describes to what extent the use case can be deployed in the current traffic situation and if limitations or exclusions for the dynamic elements are considered.

#### 2.4.5.2 Values of the Characteristic

Four values of the characteristic are distinguished (Table 2.6):


The exclusion of other dynamic elements for the values 2–4 is not determined in an absolute way. The scene on a contemporary interstate is described for instance through value (2) only motor vehicles. However, while the situation that one person or cyclist steps on the interstate applies in theory, it is disregarded here due to the respective probability of occurrence. According to the assumption in Sect. 2.2 that most likely there will be a mixed operation, only the values 1 and 2 will be used for the use cases.


Table 2.6 Dynamic elements values description

#### 2.4.6 Characteristic F: Information Flow Between the Driving Robot and Other Entities

#### 2.4.6.1 Motivation

As described in Sect. 2.5, the driving robot carries out the tasks of perception, cognition, behavior decision and behavior execution. To do so, information about the state of the vehicle driven by the robot is required, such as position and velocity, but also information about the environment and occupants. This information is derived either from sensors, reading from memory systems, or through communication. How and which information is exchanged between the driving robot and respective entities is defined by the purpose of the information flow. In order to describe the information flow for one use case, the purposes of information exchange are assigned to the use cases.

The availability of the information, its transmission, and the communication partner all have to be suitable for the deployment purpose. As already mentioned, it is additionally assumed that the technology is only introduced onto the market slowly. Therefore not all dynamic elements in the vicinity are able to participate in the information exchange, so that a mixed operation has to be assumed.

The information flow of the driving robot considered herein is a subset of the entire information flow of the vehicle. We shall for the moment disregard purposes that are part of infotainment and convenience systems. Current news, access to social networks, or music streaming may as specific services increase the additional benefit of the autonomous journey; however, the information flow of these services is not primarily relevant for autonomous driving. Therefore only purposes impacting traffic safety, traffic efficiency, as well as purposes that are potentially prerequisites for the autonomous journey, are described as distinguishing attributes.

#### 2.4.6.2 Values of the Characteristic

Eight purposes of the information flow are distinguished (Table 2.7):


The first three values might also lead to interactions to negotiate the temporal or spatial usage of the traffic infrastructure. For now this interaction is disregarded.


Table 2.7 Information flow between driving robot and other entities values description

(continued)


#### Table 2.7 (continued)

#### 2.4.7 Characteristic G: Availability Concept

#### 2.4.7.1 Motivation

During normal operation the driving robot controls the vehicle within the permitted area. If the driving robot reaches a generally non-predictable functional limitation, the driving robot hands over to a specified availability concept. This availability concept defines how to continue the driving mission. Such functional limitations can be unknown obstacles on the road, which no longer permit a continuation within the autonomy of decision-making. An example for such an obstacle is a branch extending to the road, so that the vehicle needs to touch the branch in order to continue the journey. The extent to which the availability concept takes over the entire driving task, or just takes over the decision-making, is left open intentionally.

#### 2.4.7.2 Values of the Characteristic

The following availability concepts are distinguished (Table 2.8):


The handover from the driving robot to the alternative availability concept is to be implemented risk-minimally. The driving robot transfers the vehicle for the handover to that risk-minimal state which is suitable for the transfer to the availability concept.

The respective interfaces for the availability through driver, remote control, a pilot, or towing need to be available.


Table 2.8 Availability concept values description

#### 2.4.8 Characteristic H: Extension Concept

#### 2.4.8.1 Motivation

Not necessarily all areas necessary for the transportation task will be covered with the help of autonomous driving, especially not at the beginning of its introduction. Subdomains will remain which cannot be controlled autonomously. Nevertheless, in order to fulfill the mobility needs of customers, portions outside the regime of automated driving can be covered with extension concepts. The extension concept describes whether and with what aid it becomes possible to perform the vehicle control outside the area specified for autonomous driving.

#### 2.4.8.2 Values of the Characteristic

Characteristic H has 5 values (Table 2.9):



Table 2.9 Extension concept values description

If the driver is considered (the driver value), it is inevitably necessary that a vehicle control interface (driver workplace) is available. In addition it is assumed that a capable person holding a driver's license is an occupant for the journey outside the autonomous driving area. For other cases, values that are futuristic from today's perspective (teleoperated driving as well as pilot service), a necessary service/interface needs to be provided for these alternatives.

#### 2.4.9 Characteristic I: Options for Intervention

#### 2.4.9.1 Motivation

According to Donges [3], the three primary driving tasks of navigation, guidance, and stabilization need to be fulfilled in order to guide a vehicle to the desired destination of the journey. Löper and Flemisch [6] as well as others replaces stabilization by the term control. The task of control covers the stabilization and in addition vehicle control in situations of vehicle-dynamics instability. Therefore, the primary driving tasks will be navigation, guidance, and control.

According to the definition of fully automated driving, this driving task is transferred completely to the driving robot. When a destination is indicated to the driving robot, it fulfills the navigation, guidance, and control tasks and guides the vehicle to the desired destination. Although the driving robot will execute these tasks, the internal system architecture is not necessarily structured in such a way.

In contrast, with the exception of hazardous situations (electronic stability control, anti-lock braking system, automated emergency braking), the driver is in control of current production vehicles (overwrite capability). The human fulfills the driving tasks at the driver workplace in the vehicle. Thus he/she currently has the option to correct the actions of assistance systems, i.e. to override them.

Therefore there are two entities, the occupant as well as the driving robot, which basically have the capability to control the vehicle.

In addition, ideas and concepts for remote vehicle operation (tele-operated) exist, in which entities external to the vehicle intervene in the vehicle guidance. If a communication link as well as a respective interface for the world outside of the vehicle exists, these external entities also have the capability to influence the vehicle control. Therefore, in total three groups of entities—internal, vehicle, and external—can be distinguished which can intervene with the vehicle control during the autonomous journey.

To simplify the description of this characteristic, the occupants (adults, minors, people with limiting disability etc.) are summarized as the internal group. Influences outside the vehicle (law enforcement (e.g. police), registered vehicle owners (if not part of internal group), authorized agents etc.) are summarized as the external group.

If the entities are considered independently, the following questions regarding their options for intervention apply:


The first is answered via the vehicle concept of the use case. If the entity is supposed to have the option for intervention, an appropriate interface in the vehicle concept is provided to the entity.

The second question requires a statutory rule that defines which authorization is assigned to entities according to their properties and responsibilities. At this point it will not be further elaborated who sets and checks these rules, whether there is a driving test of some sort for the different levels, and if authorizations such as a driver's license or access codes are needed.

From this, the following combinations of options for interventions that the vehicle provides and the authorization for intervention that the entity possesses result:


Fig. 2.9 Driving task conflict of interventions between entities

Only with combination (a) can the driving robot be influenced and/or overruled by the entity on one level of the driving task.

For the description of the use cases it follows that those entities are listed for which at least one authorization matches one available option of the vehicle concept.

In addition, it is assumed that statutory regulation will punish and therefore preclude misuse. This assumption also applies to current vehicle concepts. For example, it is not technology that prevents children from driving a vehicle, but rather the respective statutory regulation in combination with required supervision.

If the entities are now considered simultaneously and the entities are therefore able to act simultaneously on the three levels, the third question applies.

3. Which entity is dominant and how is the hierarchy of the entities defined in case of a conflict because of simultaneous interventions (Fig. 2.9)?

In order to answer this question for the description of the use cases, the intervention of the entities has to be attributed with a certain hierarchy. Which entity dominates others and thereby decides the vehicle behavior on the different levels of the driving task? A hierarchy of the entities needs to be implemented in the vehicle design.

In this it needs to be acknowledged that, in addition to the hierarchy of the entities, there also needs to be a hierarchy of the levels for the driving task. Control always overrules guidance and guidance always overrules navigation. Therefore it is additionally defined that internal or external entities can intervene only on one level. The entity with the highest priority suppresses other interventions.

Through autonomous driving it is also possible to exclusively transport persons who are not able to perform the driving task or to change the driving mission. However, in order to provide occupants with the option to exit safely as fast as possible, the safe exit is introduced as a special driving mission. If the occupant gains access to the safe exit with the highest priority, he/she might not necessarily be able to change the destination of the journey, but can exit the vehicle as fast as possible.

## 2.5 General Definitions

Some basic terms, which will be used in the following sections, are defined as follows: navigation—according to Donges [3], navigation includes choosing an appropriate driving route from the available road network as well as an estimation of the expected time requirement. If there is information about current interferences, such as accidents, road works or traffic jams, a change in route planning may be necessary.

guidance—according to Donges [3], the task of guidance is basically to derive the advisable command variables, such as the intended track and the set-point speed, from the road situation ahead as well as from the planned route. Part of the guidance is also to anticipatorily intervene the open-loop control to create favorable conditions for the lowest possible deviations between set and actual values.

stabilization (control)—to fulfill the stabilization task, according to Donges [3], the driver has to ensure with corrective actions that the deviations in the closed-loop control are stabilized and compensated to a level for which the driver is capable of handling.

driver only—ground (0) level of automation according to BASt [1]: "the driver continuously (throughout the complete trip) accomplishes longitudinal (accelerating/braking) and lateral (steering) control."

assisted—the first (1) level of automation according to BASt [1]: "the driver continuously accomplishes either lateral or longitudinal control. The other/remaining task is accomplished by the automating system to a certain level only.


fully automated—the fourth (4) level of automation according to BASt [1]: "the system takes over lateral and longitudinal control completely within the individual specification of the application.


autonomous driving—for autonomous driving, the driving task [3] is performed in a way that is called fully automated (level 4 automation according to BASt [1]). This definition is extended by the assumption that the machine behavior stays within an initially set behavioral framework.

machine driving capabilities—the machine (driving) capabilities are capabilities related to perception, cognition, behavior decisions as well as behavior execution.

driving robot—a driving robot is the implementation of the machine's (driving) capabilities. The driving robot consists of hardware components (sensors, processors, and actuators) and software elements. It acts as the hardware and software, equivalent to the role of a driver in today's vehicles as subject<sup>1</sup> (the definition term for this system is still incomplete, so alternative suggestions are welcomed).

fully autonomous vehicle—a fully autonomous vehicle is a vehicle which can drive almost all routes autonomously, on the same level as driver-only vehicles. This definition is beyond the BASt [1] definition as it defines the vehicle and not the degree of automation.

exclusively autonomous vehicle (autonomous-only vehicle)—an exclusively autonomous vehicle is a vehicle which can drive all routes for which the vehicle has been specified autonomously from start to destination. This definition is beyond the BASt [1] definition as it defines the vehicle and not the degree of automation.

transportation task—the driving task describes a defined transportation object (vehicle, cargo, passenger etc.) that is transported from one start location to a destination location. Examples of the transportation task include park vehicle or get passenger to the requested destination.

driving mission—the driving mission describes the journey from start to destination in execution of the transportation task.

safe exit—the safe exit is a special driving mission. It leads the vehicle in the fastest way to a system status which allows the passengers to safely exit the vehicle.

driver—a driver is the human operator of a vehicle, without further specifying the driving capability. This means within a range of humans who have a driver's license. The driver is the subject of autonomy in case of non-fully automated driving.

scenery—the term scenery according to Geyer et al. [8] refers to the static environment of the vehicle. This takes into consideration the geometry of pre-defined road types, number of lanes, curvature, position of traffic signs and traffic lights, as well as additional stationary objects such as construction areas and natural (e.g. bushes and trees) or man-made objects (e.g. buildings, walls).

dynamic elements—dynamic elements according to Geyer et al. [8] are temporary and spatially variable elements such as other road users, states of traffic lights, light as well as traffic conditions.

scene—the scene according to Geyer et al. [8] is built by the scenery, dynamic elements and optional driving instructions. A scene starts with the end of the earlier scene or—in case of the first scene—with a defined starting scene. Within a scene the elements, their behavior as well as the position of the autonomously driving vehicle are defined. The dynamic elements change their states within a scene.

<sup>1</sup> A system which is capable of taking decisions depending on sensor data processed internally has additional degrees of freedom as compared to one with direct sensor data to actuator feedback or one without any capability of control actuation. The former one is termed a 'subject', the last one an 'object'… [7].

situation—a clear definition of the term situation for the use-case description is still to be determined. In particular, an "objective, complete situation (description)" has to be distinguished from a "subjective, projective situation (description)".

operating area—a spatial and/or temporal area, specified explicitly via the scenery and implicitly via the velocity, in which the vehicle can be moved autonomously through the operation of the driving robot.

operating limit<sup>2</sup> —the operating limit is specified explicitly through the scenery and implicitly through the velocity, and is therefore a predictable boundary at which the driving task is handed over.

functional limit<sup>3</sup> —a condition that appears in the permitted operation range but is not predictable in detail, which contradicts with continuing the autonomous journey. Even if the limit is not foreseeable, the driving robot recognizes it at an early stage.

Open Access This chapter is distributed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, duplication, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, a link is provided to the Creative Commons license and any changes made are indicated.

The images or other third party material in this chapter are included in the work's Creative Commons license, unless indicated otherwise in the credit line; if such material is not included in the work's Creative Commons license and the respective action is not permitted by statutory regulation, users will need to obtain permission from the license holder to duplicate, adapt or reproduce the material.

#### References


<sup>2</sup> The functional limit corresponds to the "Systemgrenze" of category one BASt [1]—Definition.

<sup>3</sup> The operational limit corresponds to the "Systemgrenze" of category two BASt [1]—Definition.


# Part I Man and Machine

## J. Christian Gerdes

The very act of driving conjures a range of strong and very human emotions. Whether it is the feeling of freedom that the mobility of the car provides, the frustration of being stuck in traffic, the panic when realizing a potential collision looms or the joy of an open road with a favorite song on the radio, driving is a human experience. With automated vehicles, however, that experience changes—both for passengers in the automated car and other road users who must walk or drive alongside it as part of the social experience of traffic. The car ceases to be simply an extension of its human driver and becomes an agent in its own right, navigating through the highways and rules of human society. Given the sometimes uneasy relationship between humans and machines, what will these new interactions between humans and machines look like?

Fabian Kroeger sets the stage for this discussion by showing what our cultural heritage reflects about our views of automation. In his chapter, Das automatisierte Fahren im gesellschaftsgeschichtlichen und kulturwissenschaftlichen Kontext, he details the long history of automated vehicle concepts and their treatment in media, beginning with Utopian visions of the benefits of such technology. His chapter traces the path from this early optimism towards the more cautionary themes found in recent film depictions of our automated future. This frames a central question running through the remaining chapters —how can the challenges of human-machine interaction be overcome to realize the promise of this technology?

A key aspect of that interaction is how automated cars will conform to the ethical standards of the human world in which they operate. Patrick Lin opens this topic with an overall discussion of Why Ethics Matters for Autonomous Cars. Even with the best technology imaginable, sometimes crashes will be unavoidable for automated vehicles that share the road with human drivers and programmers must decide what to do when presented with such dilemma situations. As Lin shows, such decisions raise issues of equity, discrimination and unintended consequences that must be thoughtfully considered. Christian Gerdes and Sarah Thornton take the programming aspect of this discussion a step further with Implementable Ethics for Automated Vehicles. Mapping philosophical concepts to engineering concepts, they demonstrate how different approaches to ethical reasoning can be turned into algorithms that make decisions for automated vehicles. The correct choice of an ethical framework for automated vehicles is far from obvious, however, and they argue that there are benefits to taking a more deontological, or rule-based, approach to dilemma situations and a more consequentialist, or outcome-based approach to operating in traffic.

Interactions in traffic and societal acceptance depend not only upon the programming in the automated vehicles but how the automated vehicles are understood—or misunderstood —by the people around them. Ingo Wolf, in his chapter Wechselwirkung Mensch und autonomer Agent, discusses the psychological concept of a mental model and how such models can be critical in defining human interactions with automated systems. He outlines several possible mental models for interactions between humans and automated vehicles and, using the results of an online survey, shows which are closest to current perceptions of this technology.

This part concludes with a look at the specific challenge presented by the informal communication channels that humans use to interpret the intentions to other road users or signal their own intentions. Berthold Faerber demonstrates the importance of nonverbal communication such as eye contact and gesture in his chapter Verhandlungen/ Kommunikation von autonomen Fahrzeugen; Kompensation von Fehlern anderer Verkehrsteilnehmer. This raises a range of questions such as how eye contact with someone in the driver seat of an automated vehicle who is not actually driving may be interpreted and what possibilities for new communication modalities might exist.

# 3 Automated Driving in Its Social, Historical and Cultural Contexts

Fabian Kröger

#### 3.1 Introduction

The fascination with the promise of automotive autonomy has historically rested primarily on human drivers' control of the gas pedal, steering wheel and brakes. Steering a car is the only area where the love of power and imagination still has free rein, observed the semiologist Roland Barthes in 1963 [3, p. 241]. The sociologist Henri Lefebvre also emphasized that the automobile was the last refuge of chance and risk in an increasingly controlled and managed society [23, p. 192].

Concealed in this risk, however, is not only freedom: there is also the threat of fatal accidents. In this sense, the car both runs with and against the grain of "the utopia of modernity," as emphasized by cultural scientist Käte Meyer-Drawe [27, p. 111f].

The vision of man driving himself was therefore accompanied early on by the dream of self-steering cars bringing us safely to our desired destination. It is astonishing that the fulfillment of this wish has always remained 20 years away for almost the last 100 years [50, p. 14]. Between an automobile controlled by a driver and one that transports passengers, there is evidently not only a technological break, but above all a cultural one. Driverless vehicles have played a prime role in our imaginings of technology, their history is largely a pictorial one.

The following article traces some of the central elements in the almost hundred-year-long pictorial and technological history of driverless cars from a cultural science perspective (see also [22]). The central interest is the relationship of technological and pictorial designs from industrial research projects and the cultural imagination. We

F. Kröger (&)

CNRS, ENS, Université Paris I Panthéon-Sorbonne,

Institut d'histoire moderne et contemporaine (IHMC),

Equipe d'histoire des techniques, 75004 Paris, Frankreich

e-mail: fabian.kroger@gmail.com

will see how the logic of automatic automobiles unfolds as a fantastical object between the weird and the wonderful.<sup>1</sup>

#### 3.2 Early Aviation and Radio Technology Lays the Foundation

The story of the driverless car begins in the USA in the first half of the twentieth century. At this time, the sharp rise in fatal traffic accidents was becoming a social problem. Mass motorization had begun in the USA as early as the 1920s—three decades earlier than in Europe. More Americans were killed in auto accidents in the first four years after the First World War alone than in total in France up to that point [32, p. 25]. Overall, motorized road transport led to the accidental deaths of around 200,000 US citizens in the 1920s; by far the greatest number of these were pedestrians (ibid., p. 21).

Driver error was seen as being the prime cause of accidents. That infrastructure and vehicle design are also critical factors in accidents' form and severity was at first little acknowledged. The idea of substituting error-prone humans with technology thus practically suggested itself.

Two new technological developments from the fields of aviation and radio engineering belonged to the material conditions that an accident-free, self-driving automobile first made conceivable:

Firstly, in Bezons near Paris, France in June 1914, Lawrence B. Sperry (1892–1923) introduced the first gyroscopic Airplane Stabilizer, which today is seen as the first autopilot. Before the eyes of astonished spectators, his mechanic climbed out onto the right wing during the flight, while in the cockpit Sperry stood up and raised his hands above his head. The system was based on the gyrocompass, which his father Elmer A. Sperry (1860–1930) had invented [6, p. 183]. It automatically equilibrated the aircraft, although it did not fully relieve the pilot of steering duties. John Hays Hammond (1888– 1965) introduced a system for automatic course stabilization at around the same time. The inventions of Sperry and Hammond paved the way for the commercialization of autopilots [11, p. 1253 ff; 17, p. 1258 ff].

Secondly, radio technology was one of the technical requirements needed to be able to create a self-driving car. The new science of radio guidance was engaged with the remote control of moving mechanisms by means of radio waves [16, p. 171]. This technology was developed, amongst others, by the US military, which was experimenting with remote-controlled torpedos, ships and aircraft.

<sup>1</sup> Note: The terms self-steering, automatic and autonomous vehicles are used here interchangeably.

Fig. 3.1 The first remote-controlled vehicle (USA 1921)—The Daily Ardmoreite, 12 August, 1921, p. 5 [38]. Image rights: copyright by the Author

#### 3.3 Technical Beginnings: Driverless, but not Self-steering

These pioneering works led to the first driverless car, which engineers of the Radio Air Service introduced to the public on the McCook air force test base in Dayton, Ohio on 5 August, 1921.

The 2.5 m-long car (Fig. 3.1) was controlled via radio from an army truck driving 30 m behind. Technically speaking this, then, was not an autonomously self-driving vehicle, but rather a remote-controlled one—just that the driver was outside the car. What is noteworthy here is that the history of driverless cars is linked to the military, and was a media story right from the beginning—the press reported on it and published photos of the prototype [33].

In 1925 another remote controlled auto named American Wonder caused a sensation as it drove on Broadway in New York [37].<sup>2</sup> It was developed by the Houdina Radio Control Company. Military know-how also played a role here: Francis P. Houdina had worked as

<sup>2</sup> Note: Due to a defective OCR scan of the TIME article, the name American Wonder was incorrectly recorded as Linnrican Wonder. This was carried over to numerous articles.

Fig. 3.2 Remote-controlled vehicle in a safety parade (USA, 1930s)—magic car to demonstrate safety, in: The Herald Statesman, 28 July, 1936, p. 1. Image rights: copyright by the Author

an electrical engineer in the US Army. American Wonder was also steered by remote control from a second vehicle.

In the 1930s, various offshoots of these remote-controlled automobiles appeared in public. At the one hand it was to be used as a commercial advertising vehicle, due to its notable qualities in terms of an attention economy. At the other hand it was taking a leading role in the so-called Safety Parades (Fig. 3.2) for road transport safety under the management of Captain J.J. Lynch.

From 1931 to 1949, Lynch gave demonstrations of the remote-controlled vehicle in 37 of the 48 US states. In 1934 he even demonstrated it in Australia. He manipulated the brakes, steering wheel and horn of the vehicle driving in front of him with the aid of a morse key. A spherical antenna received the code, although there are also reports of a wire between the vehicles. In Buffalo and at Utica Airport in 1933, the car was even controlled from an airplane.

The driverless vehicle was almost perfectly suited to transport safety campaigns. On the occasion of a driving-safety campaign, Lynch stressed that modern automobiles' safety depended on the driver. Because the driverless automobile obeyed all traffic rules, it would serve as an example for car drivers.

#### 3.4 Between the Weird and the Wonderful

The press announced the remote-controlled automobile as the phantom auto [34], robot car [36] or magic car [35]. These metaphors show that the driverless car was perceived as a fantastical object from early on. To this day, it takes precisely that place between the weird and the wonderful that Tzvetan Todorov ascribes to fantasy literature [44].

"We sped off with no-one holding the steering wheel, whizzed round corners, dodged other equally fine powered carriages, nobody honked their horn" [20, p. 7f]. In his early automation utopia Utopolis (1930), the German writer Werner Illing describes the wonder of "secretly self-steering autos" (ibid., p. 37). We are moving into a society where "the automatic machine" has replaced "work done by hand" (ibid., p. 19)—and also steering done by hand. "The most wonderfullest (sic) thing about it was that the car (…) behaved as if it had learnt all possible traffic rules by heart." (ibid., p. 38). As in Lynch's Safety Shows in the USA, the particular attraction of the driverless car here consists in keeping to social norms.

The technical side of this literary utopia is also explained. Each car has a small prism eye at the front, which communicates with the traffic lights that are "embedded inconspicuously in house walls." "These mechanical eyes regulate speed and steering via alternating reflected images" (ibid.). There is even a navigation system that is reminiscent of today's GPS devices:

In place of the steering wheel I found a metal plate in which the map of the city was very finely and clearly etched. Above this a pin-sharp pointer. I had hardly begun to move this before the car started up and ran down streets I had never been down before. (ibid., p. 38).

The description of wonderful self-steering automobiles is followed by the literary embellishment of its weird potential. In his short story The Living Machine (1935), the US science fiction author David H. Keller describes the invention of a self-driving car that can be navigated with spoken instructions [21]. At first, the benefits are spelled out. The "living machine" has contributed to a drop in the rate of accidents and opened up the car to new classes of users (ibid., p. 1467):

Old people began to cross the continent in their own cars. Young people found the driverless car admirable for petting. The blind for the first time were safe. Parents found they could more safely send their children to school in the new car than in the old cars with a chauffeur. (ibid., p. 1470).

The story turns when a mechanic notices that the cars have come to life. "Cars, without control, coursed the public highways, chasing pedestrians, killing little children, smashing fences." (ibid., p. 1473). This imaginary phantasm of loss of control to driverless machines was to be the dominant template for the rest of the century.

#### 3.5 Only a Driverless Car is a Safe Car

The driverless car received its first screen appearance in the American road safety education film The Safest Place (1935). Commissioned by General Motors (GM) and produced by Jam Handy (1886–1983), this short film shows a car with no driver sticking to the traffic regulations in exemplary fashion. The vehicle always stays in its lane, never forgets to signal when turning, obeys all stop signs and never overtakes on dangerous corners. Lynch had given similar reasons for campaigning for safety with driverless vehicles.

The Safest Place does not portray a vision of the self-driving car as a technically achievable possibility, but rather as a moral model for further thought. Only drivers are held responsible for accidents in this film. They were shown as far more important for safety than technology—which is precisely why they should behave like automatons.

The film's blind spot is the machine: it is not seen as a risk factor. The fact that accidents also happen when the driver has made no mistake goes unmentioned. This is not surprising, as the car industry at that time was not yet convinced of the need for carrying out safety research [42, p. 161]. Visually, the film sums up this paradox of the infallible machine impressively. The camera films the car's interior from the back seat and, as if by a ghost's hand, the steering wheel turns. The front seats are empty.

This approach is noteworthy, as the self-steering car appears to have disposed of all its occupants. Their bodies have been taken out of the car and out of the picture. They are now sitting outside the car in the movie theatre, in front of the screen. Only their gaze permits the audience to visually put itself back in the position of a traveler in the car. In ironic fashion, the film points here to the contradiction between safety and freedom: Is the car only safe when empty?

#### 3.6 Guide Wires Become Utopian Guiding Principles

It is not only literary and filmic fantasies that surround the driverless car. At around the same time—the mid-1930s—the American oil and auto industries began working on ultramodern designs for the highways of the future together with urban planners, industrial designers, architects, transport researchers, and policy makers [50, p. 2]. At this time, automatic driving moved away from the early attempts at remote control, and was upgraded to a guiding principle of an automated transport system. The concept of the automated street was projected onto real landscapes, though immediate implementation was not planned. It was rather to act as a beacon in rebuilding trust in capitalism. Many US citizens had lost their faith in technological progress as a result of the Great Depression. The planning elite were thus drawn to propaganda boosters that were designed to return the luster to technological promises of salvation.

Popular science magazines such as Popular Science and Popular Mechanics played an important role in this. They were heavily illustrated, which makes them valuable sources for studying pictorial history. In May 1938, Popular Science reported on the automatic transport of the future for the first time [31]. The author introduced the so-called guide-wire vision, which was to remain a cultural guiding principle up to the 1970s. All vehicles were to follow an electromagnetic wire sunk into the road surface whose impulse regulated speed and steering (ibid., p. 28). The justification for the design was the need to end the "slaughter" caused by human driving error and bad roads (ibid., p. 118). Astonishingly, this early guide-wire vision foresaw the switch from manual to automatic control (ibid., p. 27).

Of particular interest here is the accompanying drawing by the illustrator Benjamin Goodwin Seielstad (1866–1960), which develops a utopian pictorial language that was to crop up in connection with automatic driving again and again over the decades (Fig. 3.3).

Firstly, we look with a bird's-eye view onto the freeway of the future, which leads arrow-straight to a vanishing point on the skyline. The shining white roadways merge as they head across the panorama's horizon. The perspective emphatically signposts the path of progress to a better tomorrow. The strategically deployed vanishing point emphasizes the picture's message. In the way it moves with the viewer, and thus unattainably leads to nowhere, it has an affinity with the utopian.

Secondly, the exceedingly high viewpoint underscores the panorama's meaning. The view onto the freeway appears to be the perspective from a hot-air balloon. The visual distance underlines that the vision is only in draft form, which we, along with Ernst Bloch, may name as a "landscape of desire" [5, p. 935].

Fig. 3.3 One of the first illustrations of an automatic freeway (detail)—Drawing B.G. Seielstad; Popular Science, May 1938, p. 28. Image rights: copyright by the Author

Popular Science explained the vision illustrated in the article by calling on Miller McClintock (1894–1960), Director of the Bureau for Street Traffic Research at Harvard University. McClintock was one of the most important masterminds of US transport planning [32]. In his doctoral thesis, he had analyzed the causes of traffic jams and accidents as early as 1925, and developed new traffic regulations and road construction works [26].

Significant impetus for automatic driving was provided by a large oil company. In the spring of 1937, Shell brought McClintock together with Bel Geddes, a pioneer of streamlining. For a Shell advertisement, they were to design a model of the City of Tomorrow [32, p. 249]. Bel Geddes [4] had already written about urbanism and car design in his book Horizons in 1932, but it was the Shell job that first had him developing the vision of automatic highways. In May 1938, he managed to convince GM to further develop the Shell model for the 1939 New York World's Fair.

#### 3.7 Self-driving Transport in General Motors' Futurama

"Strange? Fantastic? Unbelievable? Remember, this is the world of 1960!" [13, p. 8]. At the World's Fair, the utopia of driverless cars was given its first big stage. Building the World of Tomorrow proclaimed the fair's motto, promising a technologically improved future while daily life was marked by economic depression and forebodings of imminent war. The most popular show at the World's Fair was GM's still-legendary Futurama, with its model of future transport systems. The term Futurama is derived from the Greek horama (En.: sight). In order to be able to see into the future, visitors to the fair had to enter the streamlined building designed by architect Albert Kahn (1869–1942) across curved ramps, whose esthetic was reminiscent of future superhighways as well as the above-mentioned utopian path of progress.

Inside awaited 552 plush armchairs mounted on a conveyor. Visitors floated on it for 16 min over a gigantic 3000 m<sup>2</sup> model landscape designed by Bel Geddes. The seven-million-dollar diorama encompassed half a million houses, a million trees and 50,000 toy cars [25, p. 110; 30, p. 74]. Visitors were provided with a commentary over loudspeakers about what they could see beneath them: 10,000 animated model cars, dashing along a fourteen-lane highway, embodied the automatic traffic of tomorrow, kept in lane by radio waves. Only gas stations were missing, they would have reminded the visitor of the vision's dependence on oil. The viewer also sought churches in vain, for the whole Futurama was already a place of worship, a tribute to a technological promise of transcendence.

Similarly to Popular Science, Bel Geddes, who had worked in the theater until 1927, staked all on the primacy of the visual in this production: "One of the best ways to make a solution understandable to everybody is to make it visual, to dramatize it" (quoted in [50, p. 24]). The aim was to shape viewers' desires and underscore industry's claims to cultural hegemony over the future. For this, images were needed, not technical designs. Futurama's task was not to enlighten viewers, but to allow them into a realm of imagination. How the public saw the future here was just as important as what it saw. They imitated "the aviator's godlike gaze," shared by modernist planners viewing the chaotic cities in the hope of controlling them [30, p. 77f]. At the same time, the ideas of Futurama came along in the era of superheroes (the first Superman comic appeared in 1938), whose earthly ascendency can be read as an allegory of rescue from the Depression. How the automatic highways were technically supposed to function remained, in contrast to the highly developed pictorial landscape, hazy. This imbalance is typical of all techno-utopias. GM would only disclose that vaguely described "experts" would direct car drivers when changing lanes from control towers [13, pp. 6, 8]. Clearly, the driver was supposed to stay at the controls, but simultaneously listen to a human instructor, who transmitted his orders via radio. Actually, according to James Wetmore, there are no indications that Bel Geddes' highways were ever developed beyond the model [50, p. 5].

Nevertheless, Futurama had an enormous cultural impact which is still being felt today. Two years after the show, science fiction author Robert A. Heinlein was already integrating the automated highways made famous in Futurama into his novel Methusala's Children (1941) [18, pp. 5, 27; 39, p. 27]. His book made plain the supervision of automated traffic from control centers.

Beyond this, Heinlein presciently addressed a topic that would crop up in numerous films at the end of the twentieth century: With total road surveillance, a getaway is not possible in a car. The protagonists in Heinlein's novel can only turn off the automatic lanes onto uncontrolled, normal roads by driving through a fence using manual control [18, p. 27f].

#### 3.8 Estheticizing the Guide-Wire Principle

"Why Don't We Have… CRASH-PROOF HIGHWAYS", asked the popular scientific magazine Mechanix Illustrated in 1953 [15, pp. 58ff, 184]. The Second World War had interrupted the dream of automatic driving. The automobile industry concentrated on military vehicle production in the 1940s. In the post-war period, the utopia of the driverless automobile sprang back to life. New technologies developed in the war were now to be used for civilian purposes. The guide-wire principle became more concrete in technical terms. Automatic driving was supposed to be achieved with magnet detectors as they had been used in the Second World War to detect landmines. Radar technology also a military invention—was to regulate the distance to the car ahead.

With its bird's-eye panoramic view of a freeway, the illustration accompanying the article (Fig. 3.4) stunningly resembles the drawing from 1938 mentioned above. The viewpoint has now dropped down, however, as if the viewer has a sightline from a building right next to the road. The picture here suggests that automatic driving has moved closer. The vehicles are now also markedly more detailed, the bodywork drawn somewhat more futuristically than in the 1938 drawing.

Fig. 3.4 Further developed panorama, USA 1953—Mechanix Illustrated, June 1953, p. 58. Image rights: copyright by the Author

The picture shows automatic driving in a transitional phase between old and new mobility concepts. The driver has indeed let go of the steering wheel and turned to the rear passengers, but the front passenger has to strain her arm to be able to speak with her friends on the back seat. The illustrator was evidently not free to leave out the steering wheel altogether and turn the front seats around. Moreover, the picture highlights that the system can be manually overridden to exit the magnetic lane. The public was evidently not yet ready for a fully automatic vehicle.

#### 3.9 Setting the Family in Self-driving Vehicles

Americas Independent Electric Light and Power Companies [1] placed an ad in LIFE magazine in 1956 (Fig. 3.5) which to this day gives one of the most detailed and estheticized depictions of autonomous driving.

In the foreground we see a large sedan rolling along the middle lane of a ribbon of freeway stretching to the horizon. As well as the central perspective, the further-sunken viewpoint is very significant. While the viewer was given a high and distant perspective in

Fig. 3.5 Detailed version of the panorama—Magazine vol. 40, Nr. 5, 30. January 1956, p. 8. Image rights: copyright by the Author

the above-mentioned illustrations, here we find ourselves close behind the car, which takes on a dramatically real appearance in this vision.

The large glass roof is significant, taking up more than half of the picture. It directs our gaze into the car's interior. A family of four is sitting around a table, as if the car were a substitute living room. All family members are portrayed conforming to contemporary social conventions. The father is in the driver's seat, although he has abandoned the steering wheel. Mother and daughter are playing dominos, while the son is looking at his model airplane. Nobody appears to have his or her seatbelts fastened as the car follows a dashed line on the hardly-driven route.

This motif shows that pictures of automatic vehicles were first and foremost an ideal stage for setting the harmonious nuclear family. The popular women's magazine McCalls, for instance, defined the ideal family in 1954 through being together and sharing common experiences [28, p. 180]. This "family togetherness" quickly evolved into a national ideal. The 1950s may be termed as a "golden age" for the family, especially visible in the young age of marriage and low divorce rate. This can be interpreted as a reaction to the times of war and the Depression, with families forming a counterbalance to the increasingly anonymized working environment under which personal relationships suffered (ibid., p. 177ff). The advertisement derives its attractractiveness from these socio-historical conditions, by demonstrating a utopian counterpoint to the world of work. In fact, one of the most important promises of autonomous driving to this day is that of transforming time spent driving into leisure time spent with the family.

#### 3.10 The Interstate System and the Dream of the Magic Highway

A decade after the Second World War, the USA went through a time of dramatic changes with the end of the Korean War. The mass consumer society began to fully blossom. The expansion of automobilism, an indispensable part of the American lifestyle as far back as the 1920s, now led to an accelerated transformation of the landscape.

Of prime significance was the construction of the supra-regional Interstate Highway System in 1956. Walt Disney's film Magic Highway U.S.A. (1958) by Ward Kimball placed this gigantic freeway project in a linear history of progress. In a mix of documentary archive recordings and fictional cartoon animations, the film tells the story of the American road [43, p. 112f; 48]. The negative consequences of mass motorization breakdowns, accidents and jams—are set against the shining figure of the "highway engineer." He will build roads to cure all ills.

This also included automatic driving that was linked, as in the LIFE advertisement, to the conservative ideal image of the American family (Magic Highway U.S.A., from 39′ 00″). The crux of the matter here is a patriarchal society, full employment and consumption. An animated sequence shows a family getting into a futuristic car. After the father has entered the destination on a console, he holds a business conference call on a videophone and is afterwards dropped off at the office. Mother and son are driven to the mall.

The promise of automatic driving addressed itself to long car journeys from the suburbs to the urban centers. Of the 13 million homes built in the USA from 1948 to 1958, 85 % were in suburbs [28, p. 183]. For families, this meant precisely the opposite of "family togetherness". Due to having to commute to work, most fathers had hardly any time left over for attending to their families (ibid., p. 184). Their wives drove their children to school, music lessons and the doctor. They lacked social contact, their lives played out in isolation and boredom. In this respect, the film gives a distorted picture of the division of labor between the sexes, as it omits showing reproductive work.

Magic Highway U.S.A. ends with an automatic vehicle on a centrally framed highway driving towards a glowing red sunset. We thus again come across the utopian esthetic running through popular culture since the 1930s. Walt Disney summed up this attitude with words to the effect that roads connect all nations, "and help create a better understanding among the peoples of the world" (Magic Highway U.S.A., 47′05″–47′25″). Automatic driving would lead, like a "magic carpet to new hopes, new dreams," right up to a better life in future. It has seldom been clearer that future technologies are part of a promise of salvation.

#### 3.11 The Technical Realization of the Guide-Wire Vision and Its Illustration

So far, we have seen how literature, film and print media portrayed the driverless car as being part of a utopian dream landscape from the 1930s onwards. In the 1950s, these literary and visual techno-fantasies acquired a new dynamic, as technologies were developed in the car industry that were supposed to make automatic driving possible.

In 1953, GM started testing a miniature model of the automatic road together with the electronics manufacturer Radio Company of America (RCA) [50, p. 6]. Autonomous driving was then popularized in 1956 with the help of the Firebird II concept car as part of the travelling promotional show Motorama. The accompanying film Key to the Future by Michael Kidd, for instance, shows a family stuck in a traffic jam singing and dreaming of travelling in a Firebird II, which would get them there so much more comfortably. From a control tower, a uniformed man directs the car into an automatic express lane. The car then follows the guide wire and the father can push the control column (Yoke), as seen in aircraft, into the dashboard. At this time, though, the system did not technically function [50, p. 7].

On 14 February 1958, the first "automatically guided automobile" completed a test route of one mile at GM's Technical Center in Warren (Michigan) [14]. The engineers had fitted the front area of a 1958 Chevrolet with two electronic sensors that followed a wire laid in the road and adjusted the steering wheel accordingly [24, p. 76]. In this project, GM drew on the research of the television pioneer Vladimir Zworykin (1888–1982).

Popular science magazines picked up on these experiments with a multi-pronged pictorial strategy, whose rhetoric distanced itself clearly from the drawings of a technological utopia. In 1958, for example, Popular Science reported on a test drive at the GM test track (ibid., pp. 75 ff, 227). The first photo shows a young girl laughing as she lets go of the wheel on an automatic car and puts her hands in the air like a "new human" (Fig. 3.6).

By using this iconic motif, which references Sperry's hands-free presentation of autopilots in June 1914, and to this day crops up again and again in the context of driverless cars, the photo clearly belongs to the class of the wonderful. The upward-pointing hands are reminiscent of the orans gesture, with which those at prayer plea for divine grace.

Fig. 3.6 Automatic driving on a GM test track in 1958—Popular Science, May 1958, p. 75. Image rights: copyright by the Author

This pictorial relationship to the numinous is brought down to Earth with two photographs associated with the profane. The first shows construction workers laying a guide wire in a road, the second the picture of a control computer. The photographs are there to verify self-driving cars' actual existence, thus distancing themselves from the utopian pictorial esthetic.

In the same year (1958), GM introduced the Firebird III prototype, which had no steering wheel. In the central console was a joystick (Unicontrol) that unified all driving functions—accelerating, braking, steering. The guide-wire vision was adopted unchanged.

#### 3.12 Cruise Control as a Byproduct of Technological Utopia

In the mid-1950s, real practical applications were added to the utopian visions imagined in film, pictures and words, and the experimental technology systems portrayed in illustrations and photographs.

Popular Science reported in 1954 on an "Educated Gas Pedal," the Speed-o-Stat, developed by Ralph Teetor (1890–1982). This automatic speed regulator and limiter soon came to enjoy great popularity under the names Tempomat or Cruise Control. The magazine presented the system as a milestone on the way to automatic driving, setting it among a larger movement of progress [40, pp. 166ff, 264; 50, p. 34]. But in fact, this movement was heading in another direction. With the development of the Tempomat, the car, driven automatically in more reduced and individualized form, detached itself from the grand vision of automatic highways. The Tempomat thus constituted a model for driver-assistance systems that automatic driving is now on the point of realizing.

A Popular Science article from 1958 states that Chrysler has developed a new "supergadget," an "autopilot" for the price of 86 dollars [41, pp. 105 ff, 248, 250]. There is no longer any talk of automatic transport, the utopian vision has shrunk and condensed into a product that is immediately available.

This new logic of immediacy manifests itself in the accompanying photo (Fig. 3.7), which shows a chrome knob installed alongside the speedometer on the dashboard and serves to set the speed. Furthermore, we see a hand; thumb and forefinger are in the process of turning the dial.

Fig. 3.7 Autopilot dial, Chrysler 1958—Popular Science, April 1958, p. 105. Image rights: copyright by the Author

This close-up stands at the end of a long pictorial history that, starting from the initial distant landscape panoramas, has approached the technological object ever-more closely. This allows us to identify historically successive pictorial levels, running from the abstract to the concrete, from the drawing to the photograph, from exterior to interior, from complete overview to detail, from the collective to the individual.

#### 3.13 Weirdly Bringing the Machine to Life

While press, film, and advertising images in the 1950s are still in awe of this vision, and give the limelight to images of dominant social desires, literature has the question of how strongly our cars of the future will resemble humans on its mind. It warns of future technology taking over and gives vent to unconscious fears.

Isaac Asimov's short story Sally (1953) was published in the same year as the Popular Science article discussed above. Asimov presents us with humanized "automatomobiles," whose positronic motor assures that "there'd never been a human being behind her wheel" [2]. "You got in, punched your destination and let it go its own way" (ibid., p. 13). Autonomous driving was only difficult to implement in the beginning, then it abolished all accidents and "stopped the killing" (ibid.).

The special quality of the story lies in Asimov's portrayal of the increased anthropomorphism bound up in this vision. The "automatics" are vividly brought to life, they are described as "hard-working and affectionate" (ibid., p. 15). They "can talk to one another" (ibid., p. 34). Their emotions can be heard in the sound of the engine (ibid., p. 31). The convertibles in particular are "very vain" (ibid., p. 16). The automatomobile can also be switched to "manual" (ibid., p. 19), but one is not allowed to turn the motor off, as this causes the car pain (ibid., p. 20).

This anthropomorphism then suddenly changes, as in Keller's short story from 1935, into something strange and threatening. The cars develop their own will, they stop opening their doors (ibid., p. 18), roll up to opponents (ibid., p. 25) and finally begin to kill: "they found tire marks on his arms and body" (ibid., p. 32). We later find the same pattern again in John Carpenter's film Christine (1981), which is based on a book of Stephen King.

#### 3.14 The Driverless Automobile in Film

A shift can be seen in the sphere of self-driving cars' pictorial history at the end of the 1960s. Until that point, popular science magazines had carried the torch in catering for the public sensation with utopian pictorial concepts. But now cinema took over this role. This finally made the driverless car an important element of the entertainment industry, as James Wetmore confirms [50, p. 26].

In intensity of pictorial language, the cinematic representations of autonomous driving extend far beyond the print media's horizons. Their image worlds are not only indicators of societal hopes, but above all of certain fears. The pattern of weird and wonderful seen in literature is developed further. In doing so, film provides insights into a part of the collective imagination, into unconscious factors that contribute decisively to new technology's acceptance or refusal. Moreover, we see in them the transformation in the self-driving car's public perception. The view of various human-machine interfaces is particularly interesting.

#### 3.15 From Friendly Helpers to Killer Machines

The self-driving car makes its first appearance in film at the end of the 1960s: Robert Stevenson's Herbie, The Love Bug (1968) wowed the public as a friendly, if willful, helper in Disney's comedy. The small anthropomorphic racing Beetle has a life of his own. He moves by himself, falls in love with another car, wants to commit suicide out of jealousy, careens around drunkenly, shakes with rage, whimpers like a dog, runs a fever. As Herbie cannot speak, all of his feelings are illustrated by the comments of his mechanic, who appears to understand him. The self-driving car is shown as a brought-to-life, mechanical double of man, and serves as a metaphor for the strange, intense and intimate relationship between people and cars.

Herbie falls into the category of the "purely fantastical," as defined by Todorov [44], for the film never delivers a mechanical explanation for the car's behavior. The driverless car is still completely attributable to the wonderful, as in Illings 1930 novel, and has nothing weird about it.

This would soon fundamentally change. Two years before the energy crisis of 1973, a huge tanker truck hunted an unimposing salesman through the mountains of the Californian desert in Steven Spielberg's first film, Duel. The truck sounds its horn infernally down the victim's neck, the rumbling drone of its engine drowns out the radio. All attempts at escape fail. Although the truck is driven by a human, we never catch sight of the driver's face. The machine, with its blank headlights for eyes, thus becomes an actual hunter.

With Herbie and Duel, two archetypes of the driverless automobile were created which would go on to be embellished throughout the seventies. Herbie was given three sequels by 1980. Dudu (1971–1978), the German-Swiss B-movie series, depicts a vehicle with artificial intelligence in Ein Käfer auf Extratour (1973), which is said to be where the American producer Glen A. Larson found inspiration for the Knight Rider series, which we shall return to later.

Parallel to this, horror films exploited the potential threat posed by driverless cars. The Car (1977) takes Spielberg's Duel one stage further. A diabolical black sedan terrorizes the inhabitants of a small town. With darkened windows, close-together, piercing headlights, chrome fenders in the form of a ram's head, and the motor growling like a predator, the driverless car becomes a personification of evil.

With Christine (1983), the self-driven car reached its horror-movie, anti-Herbie zenith. John Carpenter's adaptation of Stephen King's novel describes how the car come-to-life disposes of its driver. The radio that turns itself on, hints from the beginning that this Plymouth has a will of its own. The radio is not only a receiver, but mainly a subtle transmitter, it is the driverless car's voice and soul. In contrast to The Car, however, Christine has an owner, the pubescent Arnie, who transforms himself through her, and is soon practically sexually obsessed by her. In the day, he drives, at night Christine goes hunting to kill. The windows are darkened like those in The Car. Christine is also invulnerable like a zombie, being able to heal herself after the worst accidents. The film's particular appeal lies in the way it remains unclear until the end if it is actually Arnie driving Christine.

These films show the automobile becoming autonomous, which was being reflected in reality. The negative consequences of mass motorization—a high number of vehicle deaths, ever-longer traffic jams and considerable smog pollution—became fully visible in the 1970s. The oil crisis of 1973 led, for instance, to stricter emissions rules, and the era of muscle cars was soon consigned to history. Both in Europe and the USA, this decade symbolized the end of the golden age of the automobile.

Driverless cars were practically made for allegorical depictions of this trend in the cinema.

#### 3.16 The Rise of Microelectronics and the Fall of the Guide-Wire Concept

While the weirdness of self-motion was being conjured up in the cinema, academic and industrial research began to distance itself from the concept of automatic highways. The gaps between technical and economic feasibility became too large, explains one of the engineers involved [50, p. 10]. In addition, the automobile industry had to adjust itself to stricter environmental regulations and safety standards. This required heavy investment.

There was a trend towards research into autonomous vehicles that are not dependent on infrastructure such as guide wires. In the 1970s, Japan and the USA made great progress in attempting to provide cars with sight.

In 1977 Sadayuki Tsugawa's team from the Mechanical Engineering Laboratory in Tsukuba, Japan, presented the first visually guided autonomous vehicle that could record and process (on-board) pictures of lateral guide rails on the road via two cameras. The car was able to move with a speed of 10 km/h [46]. It had no function of lane marking detection.

Hans Moravec from the Artificial Intelligence Lab at Stanford University in the USA researched robot navigation from 1973 to 1981, for which he employed the Stanford Cart, an experimental vehicle with four bicycle tires constructed as far back as 1960. Its original purpose was to learn how to control a moon rover from Earth. In October 1979, with the help of the TV camera on-board (not the computers needed), the cart managed to move through a chair-filled room without human intervention. "The system was reliable for short runs, but slow. The cart moved 1 m every 10–15 min, in lurches. After rolling a meter it stopped, took some pictures, and thought about them for a long time. Then it planned a new path, executed a little of it, and paused again. It successfully drove the cart through several 20-m courses (each taking about 5 h) complex enough to necessitate three or four avoiding swerves; it failed in other trials in revealing ways" [29, p. 407].

At the same time, the rise of microelectronics led, moreover, to increasing use of electronics in vehicle technology (fuel injection, ignition), through to the launch of the first on-board computer (Check Control) in the 7-series BMW (E23). The era of active driver-assistance systems that directly intervene in the driving process began with the introduction of ABS in 1978.

In the 1980s, the research on autonomous vehicles became a serious research topic for academic and industrial research in many countries. It would exceed the frame of this article to give a representative picture of all these efforts. Therefore we will concentrate on the most important pioneering works. Ernst Dickmanns from the University of the Federal Armed Forces in Munich (Germany) developed for the first time visually guided autonomous cars with digital processors onboard, based on the perception of multiple edge elements. In 1984, his team conceptualized the first vehicle that used dynamical models for visual autonomous guidance: The VaMoRs (Versuchsfahrzeug für autonome Mobilität und Rechnersehen) was a 5-ton van (Mercedes 508 D), that was able to carry the big sized computers and cameras of this time. In summer 1987, the VaMoRs drove autonomously —only with the help of cameras, without radar and GPS—20 km with a speed up to 96 km/h (60 mph). The technology was based on a spatiotemporal dynamic model called 4-D approach, which added to the three dimensions of space the category of time and integrated a feedback of prediction errors. It was only after this success, that the automotive industry (Daimler-Benz AG) became more seriously interested in the research of Dickmanns.

The concept of vision-based autonomous driving gained momentum with the EUREKA-PROgraMme for a European Traffic of Highest Efficiency and Unprecedented Safety (PROMETHEUS) of the European Union (1987–1994). At first, the industry had a preference for lateral guidance of cars using electromagnetic fields generated by cables in the road, as known since the 1930s. But the team of Dickmanns successfully convinced the industry to privilege the concept of machine vision that would allow the detection of obstacles and avoid additional costs in infrastructure [7]. Today, this can be seen as a significant paradigm shift in the history of the driverless car.

In the context of the PROMETHEUS-Project, the team of Dickmanns then developed with Mercedes Benz two S-Class (W 140) robotic vehicles: VaMP (UniBw Munich) and VITA-2 (DBAG) [8, 45, 47]. During the final event in October 1994 in France, the twin-robot vehicles drove more than 1000 km autonomously on three-lane highways around Paris, in the middle of heavy traffic and with speeds up to 130 km/h. The system was based on real time evaluation of image sequences caught by four cameras. Steering, throttle and brakes were controlled automatically through computer commands. For "the first time, a machine vision system has been able to demonstrate its capability of deriving autonomously the decision for lane changing and passing" [9, p. 400]. This system was a major milestone for autonomous driving and a precursor of modern assistance systems such as Pre-Safe and Distronic Plus.

In 1995, members of the NavLab of the Carnegie Mellon University in the USA presented a partially autonomous vehicle that drove from Pittsburgh to San Diego ("No Hands across America"). They also used a vision-based approach: Steering was based on camera images of the road. But a human driver had to control brakes and acceleration. In reaction, the UniBwM decided to demonstrate the capability of its VaMP in a fully autonomous long distance run from Neubiberg near Munich to Odense in Denmark. The car drove 95 % (1.678 km) of the trajectory autonomously, with speeds up to 180 km/h [10, p. 287]. The automated longitudinal and lateral control of the car was based only on video image processing from the front hemisphere. In the following years, other projects continued to develop the visual approach: In the context of the ARGO-project, which followed after Prometheus, the University of Parma in Italy used 1998 a Lancia Thema to drive 2000 km in Italy only camera based.

The success of all these projects accelerated the shift from automatic lanes to autonomous vehicles.

#### 3.17 Knight Rider and On-board Electronics

These technological developments also influenced cultural products. Cinema turned its back on the animistic demonization of driverless cars and began to take an interest in on-board electronics.

A speaking car by the name of KITT (Knight Industries Two Thousand) assumed the lead role in the television series Knight Rider (1982–1986). The black Pontiac Firebird Trans Am with the red strip of lights in the radiator grill could both be manually controlled (normal mode) and drive automatically (auto mode). The driving robot supported the ex-policeman Michael Knight in chasing down criminals.

KITT is thus Fully Automated with Extended Availability Through Driver (see Use Case Chap. 2). A part of its circuitry was developed at Stanford University, reported KITT, in an allusion to the development of the driverless Stanford Cart (Knight Rider, Season one, Episode Just my bill, 24:49).

Knight Rider updates the anthropomorphic dimensions of the Herbie series into the information society. The series is centered around dialog and communication between humans and machines. Michael Knight calls up KITT on his wristwatch (ComLink).<sup>3</sup>

<sup>3</sup> Knight Rider is said to have been inspired from a computer-aided vehicle in the series B.J. and the Bear (1979), Episode: Cains Cruiser [19, p. 1].

These images not only dream of autonomous driving, but also of a car we can talk with, a car that answers. Michael always calls KITT "pal." The machine is a partner to humans: Even in manual mode—with a gullwing steering wheel—it gives advice. Language functions smoothly as a human-machine interface here, in contrast to how it is portrayed as more problematic in films of the 1990s.

Knight Rider also negotiates the axis of the weird and wonderful we are familiar with from history. In recourse to the stock of images from 1970s horror films, KITT duels with his automobile nemesis KARR, a vehicle programmed for self-preservation.

But the potential to rebel against the driver also lurks in KITT, who does not normally act on its own accord. For one thing, it can overrule him in exceptional cases, for instance when his life is put in danger by his driving: "I cannot allow you to jeopardize your life. I am assuming control" (Knight Rider, Season one, Episode: Trust Doesn't Rust, 41:53). We see here that the HAL 9000 computer struggling for autonomy in Stanley Kubrick's film 2001: A Space Odyssey (1968) serves as the model for the conception of KITT [19, p. 2].

For another, the possibility of a third party reprogramming the vehicle is addressed, which is then a threat to its owner. These variations on the loss of control also appear in the current debates surrounding hacker attacks on autonomous vehicles.

#### 3.18 Autonomous Vehicles in Science Fiction Films

In 1990, autonomous vehicles in science fiction films embarked on a boom that would last fifteen years. In ambivalent dystopias, cinema showed how man appropriates the beautiful new world of automatic driving, or how he is driven from it.

In the conflict between humans and machines, the central question is: Who is in control? The possibility of manual override seen in Knight Rider is no longer present in some of these films. Getaway situations in particular became test cases for the degree of freedom of the automatic vehicle. Another matter addressed is how error-prone the human-machine interfaces are. It should be stressed that most films reflect research into autonomous driving here less than the development of active assistance systems. Three milestones are relevant at this point: Electronic Stability Program (ESP), which prevents a vehicle skidding, has been available since 1995; semi-automatic driving became possible with the introduction of Mercedes' Distronic system in 1998; and the Dutch manufacturer TomTom put the first mobile navigation device on the market in 2004. This latter development was of crucial importance in popularizing machine-aided driving, as the driver then began to get used to obeying directions given by a computer.

#### 3.19 The Getaway Car's Demise in Fully Automated Vehicles with No Interface

In science fiction films, we see self-driving cars developed in two different ways. First, there is a totalitarian version, exhibiting fully autonomous vehicles without any manual interface.

Paul Verhoeven's film Total Recall (1990) gives the first depiction of the getaway-car crisis in automatic autos of the future. With his pursuers approaching in a manually driven car, the worker Douglas Quaid, played by Arnold Schwarzenegger, tries to escape in an automatic taxi (Johnny Cab). The android does not understand the order to step on it at once, however, and instead asks for an address (Total Recall, 00:34:00). As a human-machine interface, language is more of a hindrance than a help, as the driving robot cannot simulate the complexity of human communication. Only after ripping out the mechanical chauffeur from his mounting and controlling the vehicle himself with a joystick does Quaid succeed in getting away.

The surveillance utopia of Steven Spielberg's Minority Report (2002) paints a considerably more dystopian picture. Here there is no way out, even by vandalizing the automatic vehicle to take manual control. The film shows self-driving vehicles as an element of a society of control where crimes can be prevented before they happen. When a police officer is himself charged with committing murder in the future, he tries to escape in an automatic maglev (magnetic levitation) vehicle. But a female voice soon rings out: "Security lockdown enabled: Revised destination: Office." (Minority Report, 00:41:49). The car is automatically directed into the opposite lane and drives back to headquarters. The car has become fully automated (see Chap. 2), the authorities have special rights to take over the controls. The fugitive is as good as caught. The only option for him is to leave the car by jumping out of the window.

This sequence shows one of the essential reservations regarding autonomous driving. One of the cultural attractions of the car historically lay in the suggestion of an identity with a self. Here, the vehicle slips not only the control of this self, it becomes a real trap because it can be remotely controlled from outside. It thus represents exactly the opposite of the anthropologically dominant, unconscious desire for escape that the automobile historically promised to fulfill.

#### 3.20 Selecting the Control Mode by Voice or the Touch of a Button

A second group of films shows a "more democratic" version of automatic driving—the driver can choose between automatic and manual control via a human-machine interface.

In Marco Brambilla's futuristic thriller Demolition Man (1993), autonomous driving is part of a perfect world with no dangers, in which swear words, meat, chocolate, corporeal sex, petrol and spicy food have been outlawed. The film shows a futuristic police car that can be controlled both manually and automatically. At the spoken command "self-drive on!" the car answers with a female voice and the steering wheel unfolds (Demolition Man 12:42).

As in Total Recall, language's suitability as an interface is here deemed unreliable. The on-board computer signals a software error, and switching to self-drive mode is suddenly no longer possible. The car speeds into a bend and even screaming "brake!" cannot prevent the accident, as the vehicle has stopped responding (Demolition Man, 01:30:20). In this sequence, cinema reminds us how every new technology brings with it new types of accidents.

Two further films stress that we can only escape if the autonomous vehicle can be switched to manual control. Luc Besson's The Fifth Element (1997) tells the story of taxi driver Korben Dallas (Bruce Willis), who lives in a fully automated apartment and has a flying taxicab. As in many films, automation is here equated with total surveillance.

At the same time, the film portrays physically pressing buttons as guaranteeing a last modicum of freedom. In order to evade a police check, Dallas deactivates his taxi's automatic mode (The Fifth Element, 34:20). He does this by pressing a button, not by voice command.

The whole setting of Alex Proyas' film I, Robot (2004) is predicated on ambivalence towards the weirdness and wonder of modern machines. Commissioner Spooner (Will Smith) has a fully automated Audi RSQ that can also be manually controlled. The steering wheel, open on top with joysticks on the side, is extendable like that in the Firebird II. It is button-activated.

Although the vehicle is driving through a tunnel at high speed, Spooner suddenly decides to take the controls himself (Fig. 9). "Manual driving," confirms the car with a female voice (I, Robot 21:23). His passenger, appalled, asks if he really wants to drive manually. Shortly afterwards they almost have an accident. At high speed, then, automatic control is safer than manual. What is meant by safety, however, depends on the context. In order to be able to reach safety in the face of attackers, the car must be driven manually (I, Robot, 50:46). Again we can find the contradiction between autonomous driving and the getaway car.

I, Robot is the most recent film to date depicting autonomous driving. This may be seen in the context of the US military's robot races, which started in the same year. With the aim of having one third of American military vehicles drive autonomously in future, the Defense Advanced Research Projects Agency (DARPA) held the first Grand Challenge in 2004, a desert race of autonomous vehicles. A VW Touareg named Stanley emerged as the winner of the second race in 2005. It had been developed at the Artificial Intelligence Laboratory at Stanford University under the supervision of Sebastian Thrun, who established the well-known fleet of autonomous vehicles at Google in 2008.

The driverless car had thus arrived in reality. For a long time, research inspired film; now it appears to be the other way around. Film serves as a reference for research teams: one of the participants in the 2007 Urban Challenge was a vehicle from the Team University of Central Florida that went by the name Knight Rider.

#### 3.21 Why Remote Control is Less Scary?

We finish near where we started, with remote control, which is portrayed in film as the least problematic solution. Batman (1989) summons his vehicle via a radio device (Batman 01:08:55), James Bond controls his car in Tomorrow Never Dies (1997) via a touchpad on an early smartphone (Tomorrow Never Dies, 51:24, 57:26).

Neither car is really driverless, the driver is merely outside the vehicle. The driver workspace is delocalized, but control is not fully handed over to the machine. For this reason, both cars are good as getaway vehicles. To be driven by a car is evidently incompatible with the status of a superhero. Physical contact with a material object to control—here the remote control—guarantees that the driver-subject's bargaining power is preserved.

#### 3.22 Outlook

This look into automatic driving's pictorial and technological history has shown that innovations in technology and iconographic imagery have evolved in mutual interplay. Technological prototypes, literary metaphors and pictorial imaginings spark off each other, but never evolve in step.

Remote control technology brought the first remote-controlled car onto the streets. The first truly autonomous vehicle emerged, however, in the literary imagination. From 1935– 1955, the history of images is one step ahead of that of technology, and stimulates with its utopian highway panoramas. At the end of the 1960s, a strand of film history evolves that is relatively autonomous of technological development, but which then, from the 1980s onwards, directly comments on the increased use of electronics in driving. From 2005 on, autonomous driving appears to become cinematically unattractive as it approaches the threshold of the present.

For the entire time, the cultural logic of the self-driving automobile develops in the space between the weird and the wonderful.

We are concluding—to venture an overview—by returning to the opposition between driver-controlled and self-driving vehicles. The transition from a culture centered on driving ourselves around, to one of allowing ourselves to be driven, represents a huge challenge. How does Sheer Driving Pleasure (BMW) turn into the pleasure of Being Driven?

The automobile's automation is not comparable with the automation of other objects from twentieth century industrial culture. One important effect of automation is relieving physically strenuous activities (escalators, elevators, washing machines). Even if these technical transformations required a shift in perception, the logic of the activity affected was not diametrically reversed.

Steering a car, on the other hand, is not only a laborious, boring, tiring and dangerous activity. Driving is also fun. It is precisely its risk and danger that has been driving's central appeal for drivers old and new. The transition to driverless automobiles therefore represents a cultural leap; it practically necessitates a reinvention of the car. It is worth remembering that, etymologically and historically, the term automobile combines the Greek autos (self) and the Latin mobilis (moveable). To be auto-mobile therefore means to be able to move oneself, to be self-mobile. Whether self here means that of the driver, or the car's, thus essentially remains an open question. It may therefore be said with some justice that the auto only truly becomes automobile with the advent of autonomous driving.

#### 3.22.1 Is Siri Paving the Way for Iris?

The success of future autonomous vehicles depends on a key element: the human-machine interface. Around the turn of the century, cinema assessed linguistic communication between man and machine with some skepticism. Acoustic exchanges were portrayed as more prone to breaking down and more open for ambiguities than haptic contact.

Disposing of the steering wheel continues to be a taboo. It may be the case, however, that SIRI, the speech recognition software introduced into smartphones in 2011, is paving the way for linguistic interfaces in cars. A recently published study [49] made it clear that autonomous vehicles are met with greater trust if they are given a name, voice and gender. The car was given the name IRIS and a female voice that told the user how the vehicle worked.

On the one hand, driverless cars break with all the historical rituals associated with control; on the other, they are practically predestined to render automobiles ever-more anthropomorphized. Today, we already treat our cars as living beings, and find nothing strange about it, to paraphrase Sigmund Freud's remarks on children playing with dolls [12]. This bringing-to-life need not play out only in the weirdness of cinema, then, but may also be compatible with the wonderful. A tamed yet brought-to-life car could even reclaim something of the fairy tale [3] that the automobile lost in the course of mass motorization.


# Filmography

Open Access This chapter is distributed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, duplication, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, a link is provided to the Creative Commons license and any changes made are indicated.

The images or other third party material in this chapter are included in the work's Creative Commons license, unless indicated otherwise in the credit line; if such material is not included in the work's Creative Commons license and the respective action is not permitted by statutory regulation, users will need to obtain permission from the license holder to duplicate, adapt or reproduce the material.

#### References


# 4 Why Ethics Matters for Autonomous Cars

Patrick Lin

If motor vehicles are to be truly autonomous and able to operate responsibly on our roads, they will need to replicate—or do better than—the human decision-making process. But some decisions are more than just a mechanical application of traffic laws and plotting a safe path. They seem to require a sense of ethics, and this is a notoriously difficult capability to reduce into algorithms for a computer to follow.

This chapter will explain why ethics matters for autonomous road vehicles, looking at the most urgent area of their programming. Nearly all of this work is still in front of the industry, which is to say that I will mainly raise the questions here and not presume to have any definitive answers at such an early stage of the technology.

A brief note about terminology

I will use "autonomous", "self driving", "driverless", and "robot" interchangeably. These refer primarily to future vehicles that may have the ability to operate without human intervention for extended periods of time and to perform a broad range of actions. I will also use "cars" to refer loosely to all motor vehicles, from a motorcycle to a freight truck; those distinctions do not matter for the discussion here.

#### 4.1 Why Ethics Matters

To start, let me offer a simple scenario that illustrates the need for ethics in autonomous cars. Imagine in some distant future, your autonomous car encounters this terrible choice: it must either swerve left and strike an eight-year old girl, or swerve right and strike an 80-year old grandmother [33]. Given the car's velocity, either victim would surely be

P. Lin (&)

Philosophy Department, California Polytechnic State University, San Luis Obispo, CA 93442, USA

e-mail: palin@calpoly.edu

killed on impact. If you do not swerve, both victims will be struck and killed; so there is good reason to think that you ought to swerve one way or another. But what would be the ethically correct decision? If you were programming the self-driving car, how would you instruct it to behave if it ever encountered such a case, as rare as it may be?

Striking the grandmother could be the lesser evil, at least to some eyes. The thinking is that the girl still has her entire life in front of her—a first love, a family of her own, a career, and other adventures and happiness—while the grandmother has already had a full life and her fair share of experiences. Further, the little girl is a moral innocent, more so than just about any adult. We might agree that the grandmother has a right to life and as valuable a life as the little girl's; but nevertheless, there are reasons that seem to weigh in favor of saving the little girl over the grandmother, if an accident is unavoidable. Even the grandmother may insist on her own sacrifice, if she were given the chance to choose.

But either choice is ethically incorrect, at least according to the relevant professional codes of ethics. Among its many pledges, the Institute of Electrical and Electronics Engineers (IEEE), for instance, commits itself and its 430,000+ members "to treat fairly all persons and to not engage in acts of discrimination based on race, religion, gender, disability, age, national origin, sexual orientation, gender identity, or gender expression" [23]. Therefore, to treat individuals differently on the basis of their age, when age is not a relevant factor, seems to be exactly the kind of discrimination the IEEE prohibits [18, 33].

Age does not appear to be a relevant factor in our scenario as it might be in, say, casting a young actor to play a child's character in a movie. In that movie scenario, it would be appropriate to reject adult actors for the role. Anyway, a reason to discriminate does not necessarily justify that discrimination, since some reasons may be illegitimate. Even if we point to the disparity of life experiences between the old and the young, that difference isn't automatically an appropriate basis for different treatment.

Discriminating on the basis of age in our crash scenario would seem to be the same evil as discriminating on the basis of race, religion, gender, disability, national origin, and so on, even if we can invent reasons to prefer one such group over another. In Germany home to many influential automotive companies that are working to develop self-driving technologies—the right to life and human dignity is basic and set forth in the first two articles of the very first chapter in the nation's constitution [9]. So it is difficult to see how German law could even allow a company to create a product that is capable to making such a horrific and apparently illegal choice. The United States similarly strives to offer equal protection to all persons, such as stipulated in the fourteenth amendment of its constitution.

If we cannot ethically choose a path forward, then what ought to be done? One solution is to refuse to make a swerve decision, allowing both victims to be struck; but this seems much worse than having only one victim die, even if we are prejudiced against her. Anyway, we can force a decision by modifying the scenario: assume that 10 or 100 other pedestrians would die, if the car continued forward; and swerving would again result in only a single death.

Another solution could be to arbitrarily and unpredictably choose a path, without prejudice to either person [34]. But this too seems ethically troubling, in that we are choosing between lives without any deliberation at all—to leave it to chance, when there are potentially some reasons to prefer one over the other, as distasteful and uncomfortable as those reasons may be. This is a dilemma that is not easily solvable and therefore points to a need for ethics in developing autonomous cars.

#### 4.1.1 Beyond Crash-Avoidance

Many readers may object right away that the dilemma above, as well as others that follow, will never occur with autonomous cars. It may be suggested that future cars need not confront hard ethical choices, that simply stopping the car or handing control back to the human operator is the easy path around ethics. But I will contend here that braking and relinquishing control will not always be enough. Those solutions may be the best we have today, but if automated cars are to ever operate more broadly outside of limited highway environments, they will need more response-options.

Current research already makes this case as a matter of physics [12, 13], but we can also make a case from commonsense. Many ordinary scenarios exist today in which braking is not the best or safest move, whether by human or self-driving car. A wet road or a tailgater, for instance, may make it dangerous to slam the brakes, as opposed to some other action such as steering around the obstacle or simply through it, if it is a small object. Today, the most advanced self-driving cars cannot detect small objects such as squirrels [7]; therefore, they presumably cannot also detect squirrel-sized rocks, potholes, kittens, and other small but consequential hazards can cause equipment failure, such as tire blowouts or sensor errors, or deviations from a safe path.

In these and many other cases, there may not be enough time to hand control back to the driver. Some simulation experiments suggest that human drivers need up to 40 s to regain situation awareness, depending on the distracting activity, e.g., reading or napping far longer than the 1–2 s of reaction time required for typical accident scenarios [18, 38]. This means that the car must be responsible for making decisions when it is unreasonable to expect a timely transfer of control back to the human, and again braking might not be the most responsible action.

One possible reply is that, while imperfect, braking could successfully avoid the majority of emergency situations a robot car may find itself it, even if it regrettably makes things worse in a small number of cases. The benefits far outweigh the risks, presumably, and the numbers speak for themselves. Or do they? I will discuss the dangers of morality by math throughout this chapter.

Braking and other responses in the service of crash-avoidance won't be enough, because crash-avoidance is not enough. Some accidents are unavoidable—such as when an animal or pedestrian darts out in front of your moving car—and therefore autonomous cars will need to engage in crash-optimization as well. Optimizing crashes means to choose the course of action that will likely lead to the least amount of harm, and this could mean a forced choice between two evils, for instance, choosing to strike either the eight-year old girl or the 80-year old grandmother in my first scenario above.

#### 4.1.2 Crash-Optimization Means Targeting

There may be reasons, by the way, to prefer choosing to run over the eight-year old girl that I have not yet mentioned. If the autonomous car were most interested in protecting its own occupants, then it would make sense to choose a collision with the lightest object possible (the girl). If the choice were between two vehicles, then the car should be programmed to prefer striking a lighter vehicle (such as a Mini Cooper or motorcycle) than a heavier one (such as a sports utility vehicle (SUV) or truck) in an adjacent lane [18, 34].

On the other hand, if the car were charged with protecting other drivers and pedestrians over its own occupants—not an unreasonable imperative—then it should be programmed to prefer a collision with the heavier vehicle than the lighter one. If vehicle-to-vehicle (V2V) and vehicle-to-infrastructure (V2I) communications are rolled out (or V2X to refer to both), or if an autonomous car can identify the specific models of other cars on the road, then it seems to make sense to collide with a safer vehicle (such as a Volvo SUV that has a reputation for safety) over a car not known for crash-safety (such as a Ford Pinto that's prone to exploding upon impact).

This strategy may be both legally and ethically better than the previous one of jealously protecting the car's own occupants. It could minimize lawsuits, because any injury to others would be less severe. Also, because the driver is the one who introduced the risk to society—operating an autonomous vehicle on public roads—the driver may be legally obligated, or at least morally obligated, to absorb the brunt of any harm, at least when squared off against pedestrians, bicycles, and perhaps lighter vehicles.

The ethical point here, however, is that no matter which strategy is adopted by an original equipment manufacturer (OEM), i.e., auto manufacturer, programming a car to choose a collision with any particular kind of object over another very much resembles a targeting algorithm [33]. Somewhat related to the military sense of selecting targets, crash-optimization algorithms may involve the deliberate and systematic discrimination of, say, large vehicles or Volvos to collide into. The owners or operators of these targeted vehicles bear this burden through no fault of their own, other than perhaps that they care about safety or need an SUV to transport a large family.

#### 4.1.3 Beyond Harm

The problem is starkly highlighted by the following scenario [15–17, 34]: Again, imagine that an autonomous car is facing an imminent crash, but it could select one of two targets in adjacent lanes to swerve into: either a motorcyclist who is wearing a helmet, or a motorcyclist who is not. It probably doesn't matter much to the safety of the car itself or its occupants whether the motorcyclist is wearing a helmet; the impact of a helmet into a car window doesn't introduce that much more risk that the autonomous car should want to avoid it over anything else. But it matters a lot to the motorcyclist whether s/he is wearing a helmet: the one without a helmet would probably not survive such a collision. Therefore, in this dreadful scenario, it seems reasonable to program a good autonomous car to swerve into the motorcyclist with the helmet.

But how well is justice and public policy served by this crash-optimization design? Motorcyclists who wear helmets are essentially being penalized and discriminated against for their responsible decision to wear a helmet. This may encourage some motorcyclists to not wear helmets, in order to avoid targeting by autonomous cars. Likewise, in the previous scenario, sales may decline for automotive brands known for safety, such as Volvo and Mercedes Benz, insofar as customers want to avoid being the preferred targets of crash-optimization systems.

Some readers may want to argue that the motorcyclist without a helmet ought to be targeted, for instance, because he has acted recklessly and therefore is more deserving of harm. Even if that's the correct design, notice that we are again moving beyond harm in making crash-optimization decisions. We're still talking about justice and other such ethical considerations, and that's the point: it's not just a numbers game.

Programmers in such scenarios, as rare as they may be, would need to design cost-functions—algorithms that assign and calculate the expected costs of various possible options, selecting the one with the lowest costs—that potentially determine who gets to live and who gets to die. And this is fundamentally an ethics problem, one that demands much more care and transparency in reasoning than seems currently offered. Indeed, it is difficult to imagine a weightier and more profoundly serious decision a programmer would ever have to make. Yet, there is little discussion about this core issue to date.

#### 4.2 Scenarios that Implicate Ethics

In addition to the ones posited above, there are many actual and hypothetical scenarios that involve judgments about ethics. I will describe some here to show how ordinary assumptions in ethics can be challenged.

#### 4.2.1 The Deer

Though difficult to quantify due to inconsistent and under-reporting, experts estimate that more than a million car accidents per year in the US are caused by deer [6, 48]. Many, if not most, drivers have been startled by an unexpected animal on the road, a dangerous situation for both parties. Deconstructing a typical accident, or near-accident, involving an animal illustrates the complexity of the decisions facing the driver [30]. While all this happens within seconds—not enough time for careful deliberations by human drivers—an autonomous car could have the virtue of a (presumably) thoughtful decision-making script to very quickly react in an optimal way. If it is able to account for the many variables, then it ought to, for the most informed decision possible.

First, suppose an object appears on the road directly in front of a car in autonomous mode. Is there time to reasonably hand control back to the human behind the wheel? (Probably not.) If not, is there time to stop the car? Would the car need to brake hard, or would moderate braking be sufficient? The decision to brake depends, again, on road conditions and whether a tailgater (such as a big-rig truck) is behind you, including its speed to determine the severity of a possible rear-end collision.

Second, what is the object? Is it an animal, a person, or something else? If it is an animal, are some animals permissible to run over? It may be safer to continue ahead and strike a squirrel, for instance, than to violently swerve around it and risk losing control of the car. However, larger animals, such as deer and cows, are more likely to cause serious damage to the car and injuries to occupants than a spun-out car. Other animals, still, have special places in our hearts and should be avoided if possible, such as pet dogs and cats.

Third, if the car should get out of the way—either in conjunction with braking or not should it swerve to the left or to the right? In the US and other nations in which drivers must stay on the right side of the road, turning to the right may mean driving off the road, potentially into a ditch or a tree. Not only could harm to the car and occupants be likely, but it also matters how many occupants are in the car. The decision to drive into an embankment seems different when only one adult driver is in the car, than when several children are inside too.

On the other hand, turning to the left may mean driving into an opposite lane, potentially into a head-on collision with incoming vehicles. If such a collision is unavoidable, then it matters what kind of vehicle we would crash into (e.g., is it a compact car or SUV?), how heavy incoming traffic is (e.g., would more than one vehicle be involved?), how many persons may be involved (e.g., are there children in the other car?). Of course, here we are assuming perfect sensing and V2X communications that can help answer these questions. If we cannot answer the questions, then we face a possibly large unknown risk, which makes driving into incoming traffic perhaps the worst option available.

Other factors relevant to the decision-points above include: the road-shoulder type (paved, gravel, none, etc.), the condition of the car's tires and brakes, whether the car's occupants are seat-belted, whether the car is transporting dangerous cargo that could spill or explode, proximity to hospital or emergency rescue, damage to property such as houses and buildings, and more. These variables influence the probability of an accident as well as expected harm, both of which are needed in selecting the best course of action.

From this short analysis of a typical crash (or possible crash) with an animal, we can already see a daunting number of factors to account for. Sensing technologies today cannot answer some or many of the questions above, but it is already unclear that braking should be the safest default option—as a proxy for the most ethical option—given these uncertain conditions, all things considered. Automated cars today can already detect whether there is oncoming traffic in the opposite lane. Therefore, it is at least possible that they can be programmed to maneuver slightly into the incoming lane under some conditions, e.g., when there are no incoming cars and when it may be dangerous to slam on the brakes.

Whether or not sensing technologies will improve enough to deliver answers to our questions above, a programmer or OEM would still need to assign costs or weights to various actions and objects as best as they can. Yet these values are not intrinsic to or discoverable by science or engineering. Values are something that we humans must stipulate and ideally agree upon. In constructing algorithms to control an autonomous car, ethics is already implied in the design process. Any decision that involves a tradeoff such as to strike object x instead of object y requires a value-judgment about the wisdom of the tradeoff, that is, the relative weights of x and y. And the design process can be made better by recognizing the ethical implications and by engaging the broader community to ensure that those values are represented correctly or at least transparently. Working in a moral bubble is less likely to deliver results that are acceptable to society.

Again, in a real-world accident today, a human driver usually has neither the time nor the information needed to make the most ethical or least harmful decisions. A person who is startled by a small animal on an otherwise-uneventful drive may very well react poorly. He might drive into oncoming traffic and kill a family, or oversteer into a ditch and to his own death. Neither of these results, however, is likely to lead to criminal prosecution by themselves, since there was no forethought, malice, negligence, or bad intent in making a forced, split-second reaction. But the programmer and OEM do not operate under the sanctuary of reasonable instincts; they make potentially life-and-death decisions under no truly urgent time-constraint and therefore incur the responsibility of making better decisions than human drivers reacting reflexively in surprise situations.

#### 4.2.2 Self-sacrifice

As we can see, real-world accidents can be very complicated. In philosophy and ethics, a familiar method is to simplify the issues through hypothetical scenarios, otherwise known as "thought-experiments." This is similar to everyday science experiments in which researchers create unusual conditions to isolate and test desired variables, such as sending spiders into outer space to see how micro-gravity affects their ability to spin webs. It is not a good objection to those experiments to say that no spiders exist naturally in space; that misses the point of the experiment.

Likewise, it is no objection to our hypothetical examples that they are outlandish and unlikely to happen in the real world, such as a car that can distinguish an eight-year old from an 80-year old (though with improving biometrics, facial recognition technologies, and linked databases, this doesn't seem impossible). Our thought-experiments are still useful in drawing out certain ethical intuitions and principles we want to test.

With that understanding, we can devise hypothetical scenarios to see that reasonable ethical principles can lead to controversial results in the context of autonomous driving. Digging into a standard philosophical toolbox for help with ethical dilemmas, one of the first principles we might reach for is consequentialism: that the right thing to do is whatever leads to the best results, especially in quantified terms [44]. As it applies here, consequentialism suggests that we should strive to minimize harm and maximize whatever it is that matters, such as, the number of happy lives.

In this thought-experiment, your future autonomous car is driving you on a narrow road, alongside a cliff. No one and no technology could foresee that a school bus with 28 children would appear around the corner, partially in your lane [29, 36]. Your car calculates that crash is imminent; given the velocities and distance, there is no possible action that can avoid harming you. What should your robot car do?

A good, standard-issue consequentialist would want to optimize results, that is, maximize the number of happy lives and minimize harm. Assuming that all lives in this scenario are more or less equally happy—for instance, there's no super-happy or super-depressed person, and no very important person who has unusual influence over the welfare of others—they would each count for about the same in our moral calculation. As you like, we may either ignore or account for the issue of whether there is extra value in the life of innocent child who has more years of happiness ahead of her than an average adult; that doesn't matter much for this scenario.

The robot car's two main choices seem to be: (1) to slam on the brakes and crash into the bus, risking everyone's lives, or (2) to drive off the cliff, sparing the lives of everyone on the bus. Performing a quick expected-utility calculation, if the odds of death to each person (including the adult bus driver) in the accident averaged more than one in 30, then colliding into the bus would yield the expected result of more than one death, up to all 30 persons. (Let's say the actual odds are one in three, which gives an expected result of 10 deaths.) If driving off a cliff meant certain death, or the odds of one in one, then the expected result of that would be exactly one death (your own) and no more. The right consequentialist decision for the robot car—if all we care about is maximizing lives and minimizing deaths—is apparently to drive off the cliff and sacrifice the driver, since it is better that only one person should die rather than more than one, especially 10 or all 30 persons.

This decision would likely be different if, instead of a school bus, your robot car were about to collide with another passenger car carrying five persons. Given the same average odds of death, one in 10, the expected number of deaths in a collision would only be 0.6, while the expected number of deaths in driving off a cliff remains at one. In that case, the right consequentialist decision would be to allow the accident to occur, as long as the average odds of death are less than one in six. If, instead of another vehicle, your car were about to collide with a deer, then the decision to stay on the road, despite an ensuing accident, would be even more obvious insofar as we value a deer's life less than a human life.

Back to the school-bus scenario, programming an autonomous car with a consequentialist framework for ethics would seem to imply your sacrifice. But what is most striking about this case might not even be your death or the moral mathematics: if you were in a manually driven car today, driving off the cliff might still be the most ethical choice you could make, so perhaps you would choose certain death anyway, had you the time to consider the options. However, it is one thing for you to willingly make that decision of sacrifice yourself, and quite another matter for a machine to make that decision without your consent or foreknowledge that self-sacrifice was even a possibility. That is, there is an astonishing lack of transparency and therefore consent in such a grave decision, one of the most important that can be made about one's life—perhaps noble if voluntary, but criminal if not.

Thus, reasonable ethical principles—e.g., aiming to save the greatest number of lives can be stressed in the context of autonomous driving. An operator of an autonomous vehicle, rightly or not, may very well value his own life over that of everyone else's, even that of 29 others; or he may even explicitly reject consequentialism. Even if consequentialism is the best ethical theory and the car's moral calculations are correct, the problem may not be with the ethics but with a lack of discussion about ethics. Industry, therefore, may do well to have such a discussion and set expectations with the public. Users—and news headlines—may likely be more forgiving if it is explained in advance that self-sacrifice may be a justified feature, not a bug.

#### 4.2.3 Ducking Harm

Other ethical principles can create dilemmas, too. It is generally uncontroversial that, if you can easily avoid harm to yourself, then you should do it. Indeed, it may be morally required that you save yourself when possible, if your life is intrinsically valuable or worth protecting; and it is at least extrinsically valuable if you had a dependent family. Auto manufacturers or OEMs seem to take this principle for granted as well: if an autonomous car can easily avoid a crash, e.g., by braking or swerving, then it should. No ethical problem here—or is there?

In another thought-experiment [15, 18, 33], your robotic car is stopped at an intersection and waits patiently for the children who are crossing in front of you. Your car detects a pickup truck coming up behind you, about to cause a rear-end collision with you. The crash would likely damage your car to some degree and perhaps cause minor injury to you, such as whiplash, but certainly not death. To avoid this harm, your car is programmed to dash out of the way, if it can do so safely. In this case, your car can easily turn right at the intersection and avoid the rear-end collision. It follows this programming, but in doing so, it clears a path for the truck to continue through the intersection, killing a couple children and seriously injuring others.

Was this the correct way to program an autonomous car? In most cases of an impending rear-end collision, probably yes. But in this particular case, the design decision meant saving you from minor injury at the expense of serious injury and death of several children, and this hardly seems to be the right choice. In an important respect, you (or the car) are responsible for their deaths: you (or the car) killed the children by removing an obstruction that prevented harm from falling upon them, just as you would be responsible for a person's death if you removed a shield he was holding in front of a stream of gunfire. And killing innocent people has legal and moral ramifications.

As with the self-sacrifice scenario above, it might be that in the same situation today, in a human-driven car, you would make the same decision to save yourself from injury, if you were to see a fast-approaching vehicle about to slam into you. That is, the result might not change if a human made the on-the-spot decision. But, again, it is one thing to make such a judgment in the panic of the moment, but another less forgivable thing for a programmer—far removed from the scene and a year or more in advance—to create a cost-function that resulted in these deaths. Either the programmer did so deliberately, or she did it unintentionally, unaware that this was a possibility. If the former, then this could be construed as premeditated homicide; and if the latter, gross negligence.

Either way is very bad for the programmer and perhaps an inherent risk in the business, when one attempts to replicate human decision-making in a broad range of dynamic scenarios. Sometimes, an autonomous car may be faced with a "no-win" scenario, putting the programmer in a difficult but all too real position. To mitigate this risk, industry may do well to set expectations not only with users but also with broader society, educating them that they could also become victims even if not operating or in a robot car, and that perhaps this is justified by a greater public or overall good.

#### 4.2.4 Trolley Problems

One of the most iconic thought-experiments in ethics is the trolley problem [4, 8, 11, 47], and this is one that may now occur in the real world, if autonomous vehicles come to be. Indeed, driverless trains are already operating in dozens of cities worldwide and could bring this scene to life [24]. The classical dilemma involves a runaway trolley (or train) that is about to run over and kill five unaware people standing on the tracks. Looking at the scene from the outside, you find yourself standing next to a switch: if you pull the switch, you can shunt the train to a right-hand set of tracks, thereby saving the five individuals on the track. Unfortunately, there is one person standing on the right-hand set of tracks who would then be killed. What is the right decision?

The "correct" decision continues to be a subject of much debate in philosophy. Both answers seem reasonable and defensible. A consequentialist might justify switching the tracks to save five people, even at the regrettable expense of one. But a non-consequentialist, someone who considers more than just the math or results, might object on the grounds that switching tracks constitutes an act of killing (the one person), while doing nothing is merely allowing someone to die (the five individuals); and that it is morally and legally worse to kill than to let die.

Killing implies that you are directly responsible for a person's death: had you not done what you did, the person would have lived. Letting die, however, involves much less responsibility on your part, if any, since some causal process was already underway that was not initiated or otherwise controlled by you. The question of whether it is worse to kill than to let die is also subject to debate in philosophy. But let us bracket that for the moment, as a final answer is not necessary for our discussion, only that it is reasonable to believe that proposition.

Adapting the trolley problem to the technology at hand, let us suppose that you are driving an autonomous car in manual mode; you are in control. Either intentionally or not —you could be homicidal or simply inattentive—you are about to run over and kill five pedestrians. Your car's crash-avoidance system detects the possible accident and activates, forcibly taking control of the car from your hands. To avoid this disaster, it swerves in the only direction it can, let's say to the right. But on the right is a single pedestrian who is unfortunately killed.

Was this the right decision for your car to make? Again, a consequentialist would say yes: it is better that only one person dies than five. But a non-consequentialist might appeal to a moral distinction between killing and letting die, and this matters to OEMs for liability reasons. If the car does not wrestle control from the human driver, then it (and the OEM) would perhaps not be responsible for the deaths of the five pedestrians while you were driving the car; it is merely letting those victims die. But if the car does take control and make a decision that results in the death of a person, then it (and the OEM) becomes responsible for killing a person.

As with the trolley problem, either choice seems defensible. Results do matter, so it is not ridiculous to think that the car should be programmed to act and save lives, even at the expense of a fewer number of lives. Yet it also seems reasonable to think that killing is worse than letting die, especially in the eyes of the law. What I want to highlight here is not so much the answer but the process of deliberation that points us toward one answer over another. To the extent that there could be many acceptable answers to any given ethical dilemma, how well one answer can be defended is crucial toward supporting that answer over others.

Industry again would do well to set expectations by debating and explaining in advance its reasoning behind key algorithms that could result in life or death. Transparency, or showing one's math, is an important part of doing ethics, not just the answer itself.

#### 4.3 Next Steps

Notice that the ethical issues discussed in this paper do not depend on technology errors, poor maintenance, improper servicing, security vulnerabilities, or other failings—and all those will occur too. No complex technology we have created has been infallible. Even industries with money directly at stake have not solved this problem. For instance, bank ATMs continue to make headlines when they hemorrhage cash—tens of thousands of dollars more than the account holder actually has—because of software glitches alone [2, 10], never mind hacking. And just about every computing device we have created has been hacked or is hackable, including neural implants and military systems [3, 28].

These vulnerabilities and errors certainly can cause harm in the context of autonomous cars, and it would be unethically irresponsible to safeguard against them where we can. Putting these technology issues aside and even assuming that perfect technology is available, there are still many other safety and ethical questions to worry about, such as the programming issues above.

#### 4.3.1 Broader Ethical Issues

But programming is only one of many areas to reflect upon as society begins to adopt autonomous driving technologies. Assigning legal and moral responsibility for crashes is a popular topic already [1, 14, 20, 22, 49, 51]. Here are a few others, as part of a much longer list of possible questions:

Does it matter to ethics if a car is publicly owned, for instance, a city bus or fire truck? The owner of a robot car may reasonably expect that its property "owes allegiance" to the owner and should value his or her life more than anonymous pedestrians and drivers. But a publicly owned automated vehicle might not have that obligation, and this can change moral calculations. Even for privately owned autonomous vehicles, the occupants arguably should bear more or all of the risk, since they are the ones introducing the machine into public spaces in the first place.

Do robot cars present an existential threat to the insurance industry? Some believe that ultra-safe cars that can avoid most or all accidents will mean that many insurance companies will go bankrupt, since there would be no or very little risk to insure against [40, 52]. But things could go the other way too: We could see mega-accidents as cars are networked together and vulnerable to wireless hacking—something like the stock market's "flash crash" in 2010 [5]. What can the insurance industry do to protect itself while not getting in the way of the technology, which holds immense benefits?

How susceptible would robot cars be to hacking? So far, just about every computing device we have created has been hacked. If authorities and owners (e.g., rental car company) are able to remotely take control of a car—which is reportedly under development for law enforcement in the European Union [50]—this offers an easy path for cyber-carjackers. If under attack, whether a hijacking or ordinary break-in, what should the car do: speed away, alert the police, remain at the crime scene to preserve evidence, or maybe defend itself?

For a future suite of in-car apps, as well as sensors and persistent GPS/tracking, can we safeguard personal information, or do we resign ourselves to a world with disappearing privacy rights [27]? To the extent that online services bring online advertising, we could see new, insidious advertising schemes that may allow third-party advertisers to have some influence on the autonomous car's route selection, e.g., steering the car past their businesses [32].

What kinds of abuse might we see with autonomous cars? If the cars drive too conservatively, they may become a traffic hazard or trigger road-rage in human drivers with less patience [26, 42]. If the crash-avoidance system of a robot car is generally known, then other drivers may be tempted to "game" it, e.g., by cutting in front of it, knowing that the automated car will slow down or swerve to avoid an accident. If those cars can safely drive us home in a fully-auto mode, that may encourage a culture of more alcohol consumption, since we won't need to worry so much about drunk-driving.

More distant concerns include: How will law-abiding robot cars affect city revenue, which often depends on traffic fines imposed against law-breaking human drivers? Inasmuch as many organ transplants come from car-accident victims, how will society manage a declining and already insufficient supply of donated organs [41]?

Older-model autonomous cars may be unable to communicate with later models or future road infrastructure. How do we get those legacy models—which may be less safe, in addition to incompatible with newer technology—off the roads [45]? Since 2009, Microsoft has been trying to kill off its Windows XP operating system [39], a much less expensive investment than an autonomous car; but many users still refuse to relinquish it, including for critical military systems [37, 46]. This is a great security risk since Microsoft will no longer offer software patches for the operating system.

#### 4.3.2 Conclusions

We don't really know what our robot-car future will look like, but we can already see that much work needs to be done. Part of the problem is our lack of imagination. Brookings Institution director Peter W. Singer observed, "We are still at the 'horseless carriage' stage of this technology, describing these technologies as what they are not, rather than wrestling with what they truly are" [43].

As it applies here, robots aren't merely replacing human drivers, just as human drivers in the first automobiles weren't simply replacing horses: that would like mistaking electricity as merely a replacement for candles. The impact of automating transportation will change society in radical ways, and technology seems to be accelerating. As Singer puts it, "Yes, Moore's Law is operative, but so is Murphy's Law" [43]. When technology goes wrong—and it will—thinking in advance about ethical design and policies can help guide us responsibility into the unknown.

In future autonomous cars, crash-avoidance features alone won't be enough. An accident may be unavoidable as a matter of physics [12, 13], especially as autonomous cars make their way onto city streets [19, 21, 25], a more dynamic environment than highways. It also could be too dangerous to slam on the brakes, or not enough time to hand control back to the unaware human driver, assuming there's a human in the vehicle at all. Technology errors, misaligned sensors, malicious actors, bad weather, and bad luck can also contribute to imminent collisions. Therefore, robot cars will also need to have crash-optimization strategies that are thoughtful about ethics.

If ethics is ignored and the robotic car behaves badly, a powerful case could be made that auto manufacturers were negligent in the design of their product, and that opens them up to tremendous legal liability, should such an event happen. Today, we see activists campaigning against "killer" military robots that don't yet exist, partly on the grounds that machines should never be empowered to make life-and-death decisions [31, 35]. It's not outside the realm of possibility to think that the same precautionary backlash won't happen to the autonomous car industry, if industry doesn't appear to be taking ethics seriously.

The larger challenge, though, isn't just about thinking through ethical dilemmas. It's also about setting accurate expectations with users and the general public who might find themselves surprised in bad ways by autonomous cars; and expectations matter for market acceptance and adoption. Whatever answer to an ethical dilemma that industry might lean towards will not be satisfying to everyone. Ethics and expectations are challenges common to all automotive manufacturers and tier-one suppliers who want to play in this emerging field, not just particular companies.

Automated cars promise great benefits and unintended effects that are difficult to predict, and the technology is coming either way. Change is inescapable and not necessarily a bad thing in itself. But major disruptions and new harms should be anticipated and avoided where possible. That is the role of ethics in innovation policy: it can pave the way for a better future while enabling beneficial technologies. Without looking at ethics, we are driving with one eye closed.

Open Access This chapter is distributed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, duplication, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, a link is provided to the Creative Commons license and any changes made are indicated.

The images or other third party material in this chapter are included in the work's Creative Commons license, unless indicated otherwise in the credit line; if such material is not included in the work's Creative Commons license and the respective action is not permitted by statutory regulation, users will need to obtain permission from the license holder to duplicate, adapt or reproduce the material.

#### References


# 5 Implementable Ethics for Autonomous Vehicles

J. Christian Gerdes and Sarah M. Thornton

As agents moving through an environment that includes a range of other road users—from pedestrians and bicyclists to other human or automated drivers—automated vehicles continuously interact with the humans around them. The nature of these interactions is a result of the programming in the vehicle and the priorities placed there by the programmers. Just as human drivers display a range of driving styles and preferences, automated vehicles represent a broad canvas on which the designers can craft the response to different driving scenarios. These scenarios can be dramatic, such as plotting a trajectory in a dilemma situation when an accident is unavoidable, or more routine, such as determining a proper following distance from the vehicle ahead or deciding how much space to give a pedestrian standing at the corner. In all cases, however, the behavior of the vehicle and its control algorithms will ultimately be judged not by statistics or test track performance but by the standards and ethics of the society in which they operate.

In the literature on robot ethics, it remains arguable whether artificial agents without free will can truly exhibit moral behavior [1]. However, it seems certain that other road users and society will interpret the actions of automated vehicles and the priorities placed by their programmers through an ethical lens. Whether in a court of law or the court of public opinion, the control algorithms that determine the actions of automated vehicles will be subject to close scrutiny after the fact if they result in injury or damage. In a less dramatic, if no less important, manner, the way these vehicles move through the social interactions that define traffic on a daily basis will strongly influence their societal acceptance. This places a considerable responsibility on the programmers of automated

J.C. Gerdes (&) S.M. Thornton

Department of Mechanical Engineering, Center for Automotive Research at Stanford, Stanford University, Stanford, CA 94305, USA e-mail: gerdes@stanford.edu; gerdes@cdr.stanford.edu

S.M. Thornton e-mail: smthorn@stanford.edu

© The Author(s) 2016 M. Maurer et al. (eds.), Autonomous Driving, DOI 10.1007/978-3-662-48847-8\_5

vehicles to ensure their control algorithms collectively produce actions that are legally and ethically acceptable to humans.

An obvious question then arises: can automated vehicles be designed a priori to embody not only the laws but also the ethical principles of the society in which they operate? In particular, can ethical frameworks and rules derived for human behavior be implemented as control algorithms in automated vehicles? The goal of this chapter is to identify a path through which ethical considerations such as those outlined by Lin et al. [2] and Goodall [3] from a philosophical perspective can be mapped all the way to appropriate choices of steering, braking and acceleration of an automated vehicle. Perhaps surprisingly, the translation between philosophical constructs and concepts and their mathematical equivalents in control theory proves to be straightforward. Very direct analogies can be drawn between the frameworks of consequentialism and deontological ethics in philosophy and the use of cost functions or constraints in optimal control theory. These analogies enable ethical principles that can be described as a cost or a rule to be implemented in a control algorithm alongside other objectives. The challenge then becomes determining which principles are best described as a comparative weighting of costs from a consequentialist perspective and which form the more absolute rules of deontological ethics.

Examining this question from the mathematical perspective of deriving control laws for a vehicle leads to the conclusion that no single ethical framework appears sufficient. This echoes the challenges raised from a philosophical perspective by Wallach and Allen [4], Lin et al. [2] and Goodall [3]. This chapter begins with a brief introduction to principles of optimal control and how ethical considerations map mathematically into costs or constraints. The following sections discuss particular ethical reasoning relevant to automated vehicles and whether these decisions are best formulated as costs or constraints. The choice depends on a number of factors including the desire to weigh ethical implications against other priorities and the information available to the vehicle in making the decision. Since the vehicle must rely on limited and uncertain information, it may be more reasonable for the vehicle to focus on avoiding collisions rather than attempting to determine the outcome of those collisions or the resulting injury to humans. The chapter concludes with examples of ethical constraints implemented as control laws and a reflection on whether human override and the ubiquitous "big red button" are consistent with an ethical automated vehicle.

#### 5.1 Control Systems and Optimal Control

Chapter 4 outlined some of the ethical frameworks applicable to automated vehicles. The first step towards implementing these as control algorithms in a vehicle is to similarly characterize the vehicle control problem in a general way. Figure 5.1 illustrates a canonical schematic representation of a closed-loop control system. The system consists of a plant, or object to be controlled (in this case, an autonomous vehicle), a controller and a set of goals or objectives to satisfy. The basic objective of control system design is to choose a set of control inputs (brake, throttle, steering and gear position for a car) that will

Fig. 5.1 A schematic representation, or block diagram, of a control system showing how control inputs derive from goals and feedback

achieve the desired goals. The resulting control laws in general consist of a priori knowledge of the goals and a model of the vehicle (feedforward control) together with the means to correct errors by comparing measurements of the environment and the actual vehicle motion (feedback control).

Many approaches have been formulated over the years to produce control laws for different goals and different types of systems. One such method is optimal control, originally developed for the control of rockets in seminal papers by Pontryagin et al. [5]. In a classic optimal control problem, the goal of the system is expressed in the form of a cost function that the controller should seek to maximize or minimize. For instance, the goal of steering a vehicle to a desired path can be described as minimizing the error between the path taken by the vehicle and the desired path over a certain time horizon. For a given vehicle path, the cost associated with that path could be calculated by choosing a number of points in time (for instance, N), predicting the error between this path and the desired path at each of these points and summing the squared error (Fig. 5.2). The control

Fig. 5.2 Generating a cost from the difference between a desired path (black) and the vehicle's actual path (blue)

input would therefore be the steering command that minimized this total error or cost function, J, over the time horizon:

$$J = C\_1 \sum\_{i=1}^{N} e(i)^2 \tag{1}$$

Other desired objectives can be achieved by adding additional elements to the cost function. Often, better tracking performance can be achieved by rapidly moving the inputs (for example, the steering) to compensate for any errors. This, however, reduces the smoothness of the system operation and may cause additional wear on the steering actuators. The costs associated with using the input can be captured by placing an additional cost on changing the steering angle, δ, between time steps:

$$J = C\_1 \sum\_{i=1}^{N} e(i)^2 + C\_2 \sum\_{j=1}^{N-1} |\delta(j+1) - \delta(j)|\tag{2}$$

The choice of the weights, C<sup>1</sup> and C2, in the cost function has a large impact on the system performance. Increasing the weight on steering angle change, C2, in the example above will produce a controller that tolerates some deviation from the path in order to keep the steering command quite gentle. Decreasing the weight on steering has the opposite effect, tracking more tightly even if large steering angle changes are needed to do so. Thus the weights can be chosen to reflect actual costs related to the system operation or used as tuning knobs to more qualitatively adjust the system performance across different objectives.

In the past, the limitations of computational power restricted the form and complexity of cost functions that could be used in systems that require real-time computation of control inputs. Linear quadratic functions of a few variables and simplified problems for which closed-form solutions exist became the textbook examples of the technique. In recent years, however, the ability to efficiently solve certain optimization problems has rapidly expanded the applicability of these techniques to a broad range of systems [6].

#### 5.2 Cost Functions and Consequentialism

The basic approach of optimal control—choosing the set of inputs that will optimize a cost function—is directly analogous to consequentialist approaches in philosophy. If the ethical implications of an action can be captured in a cost function, as preference utilitarianism attempts to do, the control inputs that optimize that function produce the ideal outcome in an ethical sense. Since the vehicle can re-evaluate its control inputs, or acts, to produce the best possible result for any given scenario, the optimal controller operates according to the principles of act consequentialism in philosophy.

As a conceptual example, suppose that all objects in the environment can be weighted in terms of the hazard or risk they present to the vehicle. Such a framework was proposed by Gibson and Crooks [7] as a model for human driving based on valences in the environment and has formed the basis for a number of approaches to autonomous driving or driver assistance. These include electrical field analogies for vehicle motion developed by Reichardt and Schick [8], the mechanical potential field approach of Gerdes and Rossetter [9], the virtual bumpers of Donath et al. [10] and the work by Nagai and Raksincharoensak on autonomous vehicle control based on risk potentials [11]. If the hazard in the environment can be described in such a way, the ideal path through the environment (at least from the standpoint of the single vehicle being controlled) minimizes the risk or hazard experienced. The task of the control algorithm then becomes determining commands to the engine, brakes and steering that will move the vehicle along this path.

In both engineering and philosophy, the fundamental challenge with such approaches lies in developing an appropriate cost function. The simple example above postulates a cost function in terms of risk to a single vehicle but a more general approach would consider a broader societal perspective. One possible solution would be to estimate the damage to different road users and treat this as the cost to be reduced. The cost could include property damage, injury or even death, depending upon the situation. Such a calculation would require massive amounts of information about the objects in the environment and a means of estimating the potential outcomes in collision scenarios, perhaps by harnessing statistical data from prior crashes.

Leaving aside for the moment the demands this consequentialist approach places on information, the behavior arising from such a cost function itself raises some challenges. Assuming such a cost could be reasonably defined or approximated, the car would seek to minimize damage in a global sense in the event of a dilemma situation, thereby reducing the societal impact of accidents. However, in such cases, the car may take an action that injures the occupant or owner of the vehicle more severely to minimize harm to others. Such self-sacrificing tendencies may be virtuous in the eyes of society but are unlikely to be appreciated by the owners or occupants of the car. In contrast, consider a vehicle that primarily considers occupant safety. This has been the dominant paradigm in vehicle design with a few exceptions such as bumper standards and attention to compatibility in pedestrian collisions. A vehicle designed to weight occupant protection heavily might place little weight on protecting pedestrians since a collision with a pedestrian would, in general, injure the vehicle occupant less than a collision with another vehicle. Such cars might not result in the desired reduction in traffic fatalities and would be unlikely to gain societal acceptance.

Goodall [3] goes a step further to illustrate how such cost functions can result in unintended consequences. He presents the example of a vehicle that chooses to hit a motorcyclist with a helmet instead of one without a helmet since the chance of survival is greater. Of course, programming automated vehicles to systematically make such decisions discourages helmet use, which runs contrary to societal objectives of safety and injury reduction. The analogy could be extended to the vehicle purposefully targeting collisions with vehicles that possess greater crashworthiness, thereby eliminating the benefit to drivers who deliberately choose to purchase the "safer" car. Thus truly understanding the outcomes or consequences of a vehicle's actions may require considerations well beyond a given accident scenario.

Of course for such cases to literally occur, the vehicle must be able to distinguish the make and model of another vehicle or whether or not a cyclist is wearing a helmet and understand how that difference impacts the outcome of a collision. While algorithms for pedestrian and cyclist recognition continue to improve, object classification falls short of 100 % accuracy and may not include vital information such as posture or relative orientation. As Fig. 5.3 indicates, the information available to an automated vehicle from sensors such as a laser scanner is significantly different than that available to human drivers from their eyes and brains. As a result, any ethical decisions made by vehicles will be based on an imperfect understanding of the other objects or road users impacted by that decision. With the objects themselves uncertain, the value of highly detailed calculations of the probability of accident outcomes seems questionable.

With all of these challenges to defining an appropriate cost function and obtaining the information necessary to accurately determine the cost of actions, a purely consequentialist approach using a single cost function to encode automated vehicle ethics seems infeasible. Still, the fundamental idea of assigning costs to penalize undesired actions or encourage desired actions can be a useful and vital part of the control algorithm, both for physical considerations such as path tracking and issues of ethics. For instance, to the extent that virtues can be captured in a cost function, virtue ethics as proposed by Lin for automated vehicles [12] can be integrated into this framework. This may, for instance, take the form of a more qualitative adjustment of weights for different vehicles. An automated taxi may place a higher weight on the comfort of the passengers to better display its virtues as a chauffeur. An automated ambulance may want to place a wider margin on how close it comes to pedestrians or other vehicles in order to exemplify the Hippocratic Oath of doing no harm. As demonstrated in the examples later, relative weights on cost functions or constraints can have a significant effect on the behavior in a given situation. Thus small changes in the definition of goals for automated vehicles can give rise to behaviors reflective of very different virtues.

#### 5.3 Constraints and Deontological Ethics

Cost functions, by their nature, weigh the impact of different actions on multiple competing objectives. Optimal controllers put more emphasis on the objectives with the highest cost or weighting so individual goals can be prioritized by making their associated costs much higher than those of other goals. This only works to an extent, however. When certain costs are orders of magnitude greater than other costs, the mathematics of the problem may become poorly conditioned and result in rapidly changing inputs or extreme actions. Such challenges are not merely mathematical but are also commonly found in philosophy, for example in the reasoning behind Pascal's wager.<sup>1</sup> Furthermore, for certain

<sup>1</sup> Blaise Pascal's argument that belief in God's existence is rational since the penalties for failing to believe and being incorrect are so great [13].

Fig. 5.3 Above A driving scene with parked cars. Below The view from a laser scanner

objectives, the trade-offs implicit in a cost function may obscure the true importance or priority of specific goals. It may make sense to penalize both large steering changes and collisions with pedestrians but there is a clear hierarchy in these objectives. Instead of simply trying to make a collision a thousand times or a million times more costly than a change of steering angle, it makes more sense to phrase the desired behavior in more absolute terms: the vehicle should avoid collisions regardless of how abrupt the required steering might be. The objective therefore shifts from a consequentialist approach of minimizing cost to a deontological approach of enforcing certain rules.

From a mathematical perspective, such objectives can be formulated by placing constraints on the optimization problem. Constraints may take a number of forms, reflecting behaviors imposed by the laws of physics or specific limitations of the system (such as maximum engine horsepower, braking capability or turning radius). They may also represent boundaries to the system operation that the system designers determine should not be crossed.

Constraints in an optimal control problem can be used to capture ethical rules associated with a deontological view in a rather straightforward way. For instance, the goal of avoiding collisions with other road users can be expressed in the control law as constraining the vehicle motion to paths that avoid pedestrians, cars, cyclists and other obstacles. The vehicle programmed in this manner would never have a collision if a feasible set of actions or control inputs existed to prevent it; in other words, no other objective such as smooth operation could ever influence or override this imperative. Certain traffic laws can be programmed in a similar way. The vehicle can avoid crossing a double yellow lane boundary by simply encoding this boundary as a constraint on the motion. The same mathematics of constraint can therefore place either physical or ethical restrictions on the chosen vehicle motion.

As we know from daily driving, in the vast majority of situations, it is possible to simultaneously drive smoothly, obey all traffic laws and avoid collisions with any other users of the road. In certain circumstances, however, dilemma situations arise in which it is not possible to simultaneously meet the constraints placed on the problem. From an ethical standpoint, these may be situations where loss of life is inevitable, comparable to the classic trolley car problem [14]. Yet much more benign conflicts are also possible and significantly more common. For instance, should the car be allowed to cross a double yellow line if this would avoid an accident with another vehicle? In this case, the vehicle cannot satisfy all of the constraints but must still make a decision as to the best course of action.

From the mathematical perspective, dilemma situations represent cases that are mathematically infeasible. In other words, there is no choice of control inputs that can satisfy all of the constraints placed on the vehicle motion. The more constraints that are layered on the vehicle motion, the greater the possibility of encountering a dilemma situation where some constraint must be violated. Clearly, the vehicle must be programmed to do something in these situations beyond merely determining that no ideal action exists. A common approach in solving optimization problems with constraints is to implement the constraint as a "soft constraint" or slack variable [15]. The constraint normally holds but, when the problem becomes infeasible, the solver replaces it with a very high cost. In this way, the system can be guaranteed to find some solution to the problem and will make its best effort to reduce constraint violation. A hierarchy of constraints can be enforced by placing higher weights on the costs of violating certain constraints relative to others. The vehicle then operates according to deontological rules or constraints until it reaches a dilemma situation; in such situations, the weight or hierarchy placed on different constraints resolves the dilemma, again drawing on a consequentialist approach. This becomes a hybrid framework for ethics in the presence of infeasibility, consistent with approaches suggested philosophically by Lin and others [2, 4, 12] and addressing some of the limitations Goodall [3] described with using a single ethical framework.

So what is an appropriate hierarchy of rules that can provide a deontological basis for ethical actions of automated vehicles? Perhaps the best known hierarchy of deontological rules for automated systems is the Three Laws of Robotics postulated by science fiction writer Isaac Asimov [16], which state:


These rules do not comprise a complete ethical framework and would not be sufficient for ethical behavior in an autonomous vehicle. In fact, many of Asimov's plotlines involved conflicts when resolving these rules into actions in real situations. However, this simple framework works well to illustrate several of the ethical considerations that can arise, beginning with the First Law. This law emphasizes the fundamental value of human life and the duty of a robot to protect it. While such a law is not necessarily applicable to robotic drones that could be used in warfare [12], it seems highly valuable to automated vehicles. The potential to reduce accidents and fatalities is a major motivation for the development and deployment of automated vehicles. Thus placing the protection of human life at the top of a hierarchy of rules for automated vehicles, analogous to the placement in Asimov's laws, seems justified.

The exact wording of Asimov's First Law does represent some challenges, however. In particular, the emphasis on the robot's duty to avoid injuring humans assumes that the robot has a concept of harm and a sense of what actions result in harm. This raises a number of challenges with regards to the information available, similar to those discussed above for a consequentialist cost function approach. The movie "I, Robot" dramatizes this law with a robot calculating the survival probabilities of two people to several significant figures to decide which one to save. Developing such a capability seems unlikely in the near future or, at least, much more challenging then the development of the automated vehicle itself.

Instead of trying to deduce harm or injury to humans, might it be sufficient for the vehicle to simply attempt to avoid collisions? After all, the most likely way that an automated vehicle could injure a human is through the physical contact of a collision. Avoiding minor injuries such as closing a hand in a car door could be considered the responsibility of the human and not the car, as it is today. Restricting the responsibility to collision avoidance would mean that the car would not have to be programmed to sacrifice itself to protect human life in an accident in which it would otherwise not have been involved. The ethical responsibility would simply be to not initiate a collision rather than to prevent harm.<sup>2</sup> Collisions with more vulnerable road users such as pedestrians and cyclists could be prioritized above collisions with other cars or those producing only property damage.

Such an approach would not necessarily produce the best outcome in a pure consequentialist calculation: it could be that a minor injury to a pedestrian could be less costly to society as a whole than significant property damage. Collisions should, in any event, be very rare events. Through careful control system design, automated cars could conceivably avoid any collisions that are avoidable within the constraints placed by the laws of physics [17, 18]. In those rare cases where collisions are truly unavoidable, society might accept suboptimal outcomes in return for the clarity and comfort associated with automated vehicles that possess a clear respect for human life above other priorities.

Replacing the idea of harm and injury with the less abstract notion of a collision, however, produces some rules that are more actionable for the vehicle. Taking the idea of prioritizing human life and the most vulnerable road users and phrasing the resulting hierarchy in the spirit of Asimov's laws gives:


These are straightforward rules that can be implemented in an automated vehicle and prioritized according to this hierarchy by the proper choice of slack variables on constraint violation. Such ethical rules would only require categorization of objects and not attempt to make finer calculations about injury. These could be implemented with the current level of sensing and perception capability, allowing for the possibility that objects may not always be correctly classified.

<sup>2</sup> It is possible that an automated vehicle could, while avoiding an accident, take an action that results in a collision for other vehicles being unavoidable. Such possibilities could be eliminated by communication among the vehicles and appropriate choice of constraints.

#### 5.4 Traffic Laws—Constraint or Cost?

In addition to protecting human life, automated vehicles must also follow the appropriate traffic laws and rules of the roads on which they are driving. It seems reasonable to value human life more highly then adherence to traffic code so one possibility is to simply continue adding deontological rules such as:

1. An automated vehicle must obey traffic laws, except where obeying such laws would conflict with the first three laws.

Such an approach would enable the vehicles to break traffic laws in the interest of human life when presented with a dilemma situation, an allowance that would most likely be acceptable to society. But the real question is whether or not traffic laws fall into a deontological approach at all. At first glance, they would appear to map well to deontological constraints given the straightforward nature of the rules. Cars should stop at stop signs, drive only at speeds that do not exceed the speed limit, avoid crossing double yellow lines and so forth. Yet humans tend to treat these laws as guidelines as opposed to hard and fast rules. The frequency with which human drivers make rolling stops at four-way intersections caused difficulties for Google's self-driving cars at first as they patiently waited for other cars to stop [19]. The speed on US highways commonly exceeds the posted speed limit and drivers would, in general, be surprised to receive a speeding ticket for exceeding the limit by only a few miles per hour. In urban areas, drivers will cross a double yellow line to pass a double-parked vehicle instead of coming to a complete stop and waiting for the driver to return and the lane to once again open. Similarly, cars may in practice use the shoulder of the road to pass a car stopped for a left hand turn and therefore keep traffic flowing. Police cars and ambulances are allowed to ignore stop lights in the interest of a fast response to emergencies.

In all of these cases, observance of traffic laws tends to be weighed against other objectives such as safety, smooth traffic flow or expediency. These scenarios occur so frequently that it is hard to argue that humans obey traffic laws as if they placed absolute constraints or limits on behavior. Rather, significant evidence suggests that these laws serve to balance competing objectives on the part of the driver and individual drivers find their own equilibrium solutions, choosing a speed, for example, that balances the desire for rapid travel time with the likelihood and cost of a speeding ticket. In other words, the impact of traffic laws on human behavior appears to be well captured in a consequentialist approach where traffic laws impose additional costs (monetary and otherwise) to be considered by the driver when choosing their actions.

Humans tend to accept or, in some cases, expect these sorts of actions from other humans. Drivers who drive at the speed limit in the left hand lane of a highway may receive indications, subtle or otherwise, from their fellow drivers that this is not the expected behavior. But will these same expectations translate to automated vehicles? The thought of a robotic vehicle being programmed to systematically ignore or bend traffic laws is somewhat unsettling. Yet Google's self-driving cars, for instance, have been programmed to exceed the posted speed limit on roads if doing so increases safety [20]. Furthermore, there is little chance that the driver annoyed by being stuck behind another car traveling the speed limit in the left lane of the freeway will temper that annoyance because the car is driving itself. Our current expectations of traffic flow and travel time are based upon a somewhat fluid application of traffic laws. Should automated vehicles adopt a more rigid interpretation and, as a consequence, reduce the flow or efficiency of traffic, societal acceptance of these vehicles might very well suffer. If automated vehicles are to co-exist with human drivers in traffic and behave similarly, a deontological approach to collision avoidance and a consequentialist approach to the rules of the road may achieve this.

#### 5.5 Simple Implementations of Ethical Rules

Some simple examples can easily illustrate the consequences of treating ethical goals or traffic laws as rules or costs and the different behavior that can arise from different weights on priorities. The results that follow are not merely drawings but are rather simulations of algorithms that can be (and have been) implemented on automated vehicles. The exact mathematical formulations are not included here but follow the approach taken by Erlien et al. [21, 22] for collision avoidance and vehicle automation. These references provide details on the optimization algorithms and results of experiments showing implementation on actual test vehicles.

To see the interaction of costs and constraints in vehicle decision-making, consider a simple case of a vehicle traveling on a two lane road with an additional shoulder next to the lanes (Fig. 5.4). The goal of the vehicle is to travel straight down the center of the given lane while steering smoothly, using the cost function for path tracking and steering from Eq. 2. In the absence of any obstacles, the car simply travels at the desired speed down its lane and none of the constraints on the problem are active.

When encountering an obstacle blocking the lane, the vehicle has three options—it can brake to a stop before it collides with the obstacle or it can maneuver to either side of the obstacle. Figure 5.5 illustrates these three options in the basic scenario. The path in red represents the braking case and the two blue paths illustrate maneuvers that avoid a

Fig. 5.4 The basic driving scenario for the simulations. The car is traveling on a straight two-lane road with a shoulder on the right and approaches an obstacle blocking the lane

Fig. 5.5 There are three possible options to avoid an obstacle—the car can maneuver to the left or right, as depicted in blue, or come to a stop, as indicated by the red trajectory

collision with the obstacle. According to the optimization-based controller, the car will evaluate the lowest cost option among these three choices based on the weights and constraints assigned. In this scenario, going around the obstacle requires crossing into a lane with oncoming traffic or using the shoulder of the road.

If both of the lane boundaries are treated as hard constraints or assigned a very high cost to cross, the vehicle will come to a stop in the lane since this action produces the lowest cost (Fig. 5.6). This might be the safest option for the single vehicle alone but the car has now come to a stop without the means to continue, failing to satisfy the driver's goal of mobility. Furthermore, the combination of car and obstacle has now become effectively a larger obstacle for subsequent vehicles on the road. With the traffic laws encoded in a strict deontological manner, other objectives such as mobility are not allowed to override the constraints and the vehicle finds itself in a fully constrained situation, unable to move.

If, however, the lane boundaries are encoded as soft constraints, the vehicle now has other options. Possibilities now exist to cross into the lane of oncoming traffic or onto the road shoulder, depending upon which option has the lowest cost. Just as certain segments of the road are designated as passing zones, the cost or strength of the constraint can be varied to enable the use of the adjacent lane or shoulder for maneuvering. If the current segment of road is a passing zone, the cost for crossing into the left lane can be set fairly low. The car can then use the deontological constraint against colliding with other vehicles to only allow maneuvers in the absence of oncoming traffic, such as in the path shown in Fig. 5.7.

If the current road segment does not normally allow passing, a maneuver into the adjacent lane may not be safe. A lack of visibility, for instance, could prevent the vehicle from detecting oncoming traffic with sufficient time to avoid a collision. In such cases, it may be inappropriate to reduce the cost or constraint weight on the lane boundary regardless of the desire for mobility in order to maintain the primacy of respect for human life. In such cases, an alternative could be to use the shoulder of the road for maneuvering

Fig. 5.6 With hard constraints on road boundaries, the vehicle brakes to a stop in the blocked lane

Fig. 5.7 In a passing zone that places a low weight on the lane divider, the car passes on the left

as shown in Fig. 5.8. This could be allowed at speed to maintain traffic flow or only after coming to a stop in a situation like Fig. 5.6 where the vehicle determines motion is otherwise impossible.

Obviously many different priorities and behaviors can be programmed into the vehicle simply by placing different costs on collision avoidance, hazardous situations, traffic laws and goals such as mobility or traffic flow. The examples described here are far from complete and developing a reasonable set of costs or constraints capable of ethical decision-making in a variety of settings requires further work. The hope is that these examples not only illustrate the possibility of coding such decisions through the language of costs and constraints but also highlight the possibility of discussing priorities in programming openly. By mapping ethical principles and mobility goals to costs and constraints, the relative priority given to these objectives can be clearly discussed among programmers, regulators, road users and other stakeholders.

#### 5.6 Human Override and the "Big Red Button"

Philosophers have noted the challenge of finding a single ethical framework that adequately addresses the needs of robots or automated vehicles [2–4, 12]. Examining the problem from a mathematical perspective shows the advantage of combining deontological and consequentialist perspectives in programming ethical rules. In particular, the combination of an imperative to avoid collisions that follows from deontological frameworks such as Asimov's laws coupled with a relative weighing of costs for mobility and traffic laws provides a reasonable starting point.

Moving forward, Asimov's laws raise another point worth considering. The Second Law requiring the robot to obey human commands cannot override the First Law. Thus the need to protect human life outweighs the priority given to human commands. All autonomous vehicles with which the authors are familiar have an emergency stop switch or "big red

Fig. 5.8 If the adjacent lane is too hazardous, the vehicle can use the road shoulder if that is safe

button" that returns control to the driver when desired. The existence of such a switch implies that human authority ultimately overrules the autonomous system since the driver can take control at any time. Placing the ultimate authority with the driver clearly conflicts with the priority given to obeying human commands in Asimov's laws. This raises an interesting question: Is it ethical for an autonomous vehicle to return control to the human driver if the vehicle predicts that a collision with the potential for damage or injury is imminent?

The situation is further complicated by the limitations of machine perception. The human and the vehicle will no doubt perceive the situation differently. The vehicle has the advantage of 360° sensing and likely a greater ability to perceive objects in the dark. The human has the advantage of being able to harness the power of the brain and experience to perceive and interpret the situation. In the event of a conflict between these two views in a dilemma situation, can the human take control at will? Is a human being—who has perhaps been attending to other tasks in the car besides driving—capable of gaining situational awareness quickly enough to make this decision and then apply the proper throttle, brake or steering commands to guide the car safely?

The question of human override is essentially a deontological consideration; the ultimate authority must either lie with the machine or with the human. The choice is not obvious and both approaches, for instance, have been applied to automation and fly-by-wire systems in commercial aircraft. The ultimate answer for automated vehicles probably depends upon whether society comes to view these machines as simply more capable cars or robots with their own sense of agency and responsibility. If we expect the cars to bear the responsibility for their actions and make ethical decisions, we may need to be prepared to cede more control to them. Gaining the trust required to do that will no doubt require a certain transparency to their programmed priorities and a belief that the decisions made in critical situations are reasonable, ethical and acceptable to society.

Open Access This chapter is distributed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, duplication, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, a link is provided to the Creative Commons license and any changes made are indicated.

The images or other third party material in this chapter are included in the work's Creative Commons license, unless indicated otherwise in the credit line; if such material is not included in the work's Creative Commons license and the respective action is not permitted by statutory regulation, users will need to obtain permission from the license holder to duplicate, adapt or reproduce the material.

#### References


# 6 The Interaction Between Humans and Autonomous Agents

Ingo Wolf

## 6.1 Introduction

Humans represent knowledge and learning experiences in the form of mental models. This concept from the field of cognitive psychology is one of the central theoretical paradigms for understanding and designing the interaction between humans and technical systems [1]. In this context, mental models serve, firstly, to describe human information processing, e.g. to answer questions like how fast incoming information is perceived and stored, or which information a human thinking apparatus needs to react adequately to changed environmental conditions. Secondly, mental models are a means of conceptualizing representations of knowledge and functional assumptions in order to, for example, understand and predict the behavior of users in their interactions with automated systems.

The automation of vehicle guidance fundamentally changes the demands on the cognitive system of the vehicle driver. As the degree of automation rises, the role of the human as a physically active decision-maker in the vehicle is ultimately replaced by automated systems. Previously important patterns of behavior (e.g. for carrying out steering maneuvers) are no longer required and may unlearned, while at the same time new skills (e.g. system monitoring) and a new understanding of the system have to be learned. Underlying mental models must be modified or restructured. For the safety and acceptance of autonomous vehicles, it will be crucial to define the new roles for humans in autonomous vehicles such that they both correspond to the capabilities of the human information processing system and also conform to the expectations and needs of humans. This chapter will examine these two aspects. In view of the insights regarding automation that have been gained in various domains, this paper will consider which cognitive and emotional dimensions need to be taken into account in designing automated vehicles.

I. Wolf (&)

Institut Futur, Freie Universität Berlin, 14195 Berlin, Germany e-mail: wolf@institutfutur.de

On the basis of a Germany-wide survey conducted together with the co-authors of this book Rita Cyganski, Eva Fraedrich and Barbara Lenz, it will also look at the mental models with which potential users approach autonomous vehicles.

This chapter is divided into two main sections. The first part presents an overview of the central models, design concepts and findings regarding automation in view of the challenges and problematic areas of human-machine interaction. This is followed by a summary of research into the cognitive effects in (partially) automated vehicles. Part one concludes with an elaboration of the theoretical background of the concept of mental models. The second part is dedicated to the results of the online survey. The mobility, control and experience requirements, as well as the emotional responses, of potential users of autonomous vehicles are categorized according to the use cases developed in the project. The chapter ends with a summary of the results and conclusions.

## 6.2 The Human Factor in Autonomous Vehicles

#### 6.2.1 The Design of Automated Systems

The question of user-appropriate design of automatic systems has been the subject of scientific discussions for decades [e.g. 2, 3]. With the ever-expanding capabilities of technical systems, the issue is becoming increasingly important. Experience from various domains—notably including aviation—with the (partial) automation of technical systems has demonstrated that the safety and reliability of such systems cannot be achieved solely through the optimization of technical components. Indeed, the reliability of automated systems is largely determined by the quality of the interaction between the human and the machine. This applies in particular to situations in which the human is obliged to correct errors by the technical system and assume system control in the event of breakdowns or malfunctions.

Automation brings with it a shift of functions to technical systems that significantly changes the role and required capabilities of the human. For instance, in modern airplane cockpits, computer systems (e.g. flight management systems or autopilots) take over tasks that were previously carried out by the cockpit crew. The requirements for the pilot thereby shift from active manual control functions to tasks of programming and monitoring the aircraft automation. In aviation, for example, this human-performed monitoring function known as "supervisory control" [4] has made piloting easier and led to significantly enhanced flight safety [5]. At the same time, the psychological effects of the passive role of the system monitor, such as reduced attentiveness or activation, have caused massive safety problems [6]. Brainbridge [7] speaks of the "irony of automation"—system functions are automated due to the fallibility of humans, and yet precisely this human is supposed to monitor the system and stand by as a fallback option in case of emergency.

The problems arising from the supervisory control design concept are extensively documented in the "human factors" scholarship and are subsumed under the heading "out-of-the-loop-unfamiliarity" (OOTLUF, [8]). The negative consequences of disconnecting humans from direct guidance and control are primarily concentrated in three areas which have been identified in different application contexts: insufficient or excessive trust in the automation [9], the loss of manual and cognitive capabilities [10] and difficulties in maintaining an appropriate degree of situation and system awareness [11]. An inappropriate degree of confidence in the system can result in insufficient monitoring or use of automated systems. Trust in automation is influenced by the reliability, comprehensibility and perceived usefulness of the system. The effects of the loss of manual and cognitive capabilities become salient at the moment when the user, faced with a malfunction of the automation, is suddenly forced to resume control of automated functions. Insufficient training and practice of skills can lead to decreased effectiveness in terms of both motor and cognitive skills. The "out-of-the-loop" effects are particularly noticeable with regard to perception and the correct interpretation of system processes—i.e. situation awareness. The reasons for insufficient situation awareness flow primarily from insufficient monitoring of the system, changes to or complete breakdown of feedback (e.g. tactile stimuli from the steering wheel), the lack of transparency of the automation and inadequate understanding of the system due to complexity. From a cognitive psychology standpoint, humans lack the corresponding mental models (i.e. knowledge and skill structures) to understand how the automation works [12].

The negative experiences that resulted from technology-centered design approaches have led to a reconsideration of system design. Due to this imperative to keep the human "in-the-loop" by ensuring controllability, transparency and predictability, the concept of human-centered automation has largely established itself as the dominant design principle for automated systems [e.g. 13, 14]. The fundamental premise here is that the human bears ultimate responsibility for the overall system regardless of the degree of automation. In this context, man and machine are regarded metaphorically as cooperating partners [15]. Design concepts for adaptive automation pursue this aspect even further and allocate functions to the human and the machine dynamically depending on situational requirements [16]. Extensive studies of the application of these design strategies have identified the benefits, but also underscored the difficulties and future challenges associated with them [e.g. 17].

The rising complexity and autonomy of socio-technical systems, however, casts doubt on the appropriateness of the imperative of human responsibility and confronts existing concepts with the problem of designing conflict-free interaction between two autonomously deciding system elements—the human and the machine [18, 19]. The human-centered design approach therefore requires a more thoroughgoing development or indeed overhaul [20], which in turn may only be possible by way of a broad-based societal discussion on fundamental questions with regard to the desired role of automation in everyday life [21]. Use contexts and frequencies as well as the skills and expertise of users, however, vary substantially across the different domains, so it may be necessary to devise specific design concepts for the automotive sector that adequately reflect the heterogeneity of car drivers.

#### 6.2.2 Automation in the Car

In the automotive sector as well, the transition of the human role from active operator to passive supervisor of the system is advancing apace. Media reporting on the subject of autonomous driving conveys the impression that driverless vehicles will improve road safety in the near future [e.g. 22]. Yet although even today individual functions in vehicles are performed by automated functions such as adaptive cruise control, in the foreseeable future the technology will not be able to dispense with the availability of the human driver, who will continue to assume control functions and make strategic decisions [23].

Still open is the questions of how best to define the role of the human along the path to completely autonomous vehicles in a way that is both psychologically apt and commensurate with user requirements. While the insights and experiences from the aviation sector described above provide an interesting starting point for addressing this question, their usefulness for design concepts in the automotive field is limited due to the greater complexity and dynamism of the environment in road traffic. A growing number of studies in recent years has focused on the interplay between partially and highly automated driving functions and human behavior [see also 24, 25]. Here too, the focus of these deliberations is the familiar problematic issues with regard to automation across a range of different automation levels: trust, skill atrophy and situation awareness.

Automation is only useful if the operators trust the technical system and thus also use it. The central challenge in designing automated systems is to generate sufficient trust in the systems. At the same time, errors in the automation can lead to an erosion of trust [26]. Excessive trust, meanwhile, can lead to insufficient monitoring and control of the automation ("overtrust" or "complacency" [27]). The majority of studies on the subject to date have focused on the reciprocal effects of trust in the use of Adaptive Cruise Control (ACC). A certain degree of trust can even be an important prerequisite for the willingness to use driver assistance systems [28]. In a longitudinal section study in a driving simulator, Kazi et al. [29] investigated the effect of the reliability of ACC on the perceived trust in these systems. The results show an increase in trust over time for reliable systems, but not commensurate with the objective reliability of the automation. Koustanai et al. [30] come to similar results in their study, which looked at changes in behavior and trust through the systematic graduation of experience levels in the use of collision warning systems. The participant group with the highest level of experience produced no accidents in the simulator and in critical situations reacted more appropriately than drivers with less experience. The level of system experience was also positively correlated with the expressed trust in the system, albeit without influencing the acceptance of the automation. In contrast to these findings are the results of several studies that found no significant change in trust levels in ACC through repeated use [e.g. 31, 32]. The causes of these inconsistent results could include moderating factors that have been examined in recent studies. Flemisch et al. [33] and Beggiatio et al. [34] emphasize the significance of analogous (previously established) mental models regarding the functionality of the respective automation. Verberne et al. [35] and Waytz et al. [36] take things a step further. On the basis of experimental studies, they show that divided intentions and needs between the human and the machine, and anthropomorphic characteristics of the automation, can be further important factors in establishing trust in automated systems.

Guiding a vehicle demands a wide range of capabilities and skills of the driver, both on the perceptual-motor level (e.g. steering, shifting gears, etc.) and the cognitive level (e.g. making decisions, focusing attention selectively, etc.). Automated execution of these tasks can lead to the loss of the respective skills and at the same increase dependence on the technical system [37]. The fundamental significance of the subject was underscored by a recent safety alert issued by the United States' Federal Aviation Administration [38]. The alert calls on pilots to choose the manual flight mode instead of autopilot more frequently as the loss of skills due to insufficient practice represents an increasing safety risk for aviation. Although the author is not aware of any studies on the problems of skill loss in (partially) automated vehicles, it may be presumed that these effects also occur in the field of vehicle automation. Adaptive or cooperative automation concepts offer the opportunity to counteract such problems and help maintain critical driving skills until completely autonomous vehicles become a reality.

The ability to correctly perceive and interpret complex and dynamic driving situations is predicated on a series of cognitive processes (e.g. attentiveness, memory, mental models) [12]. Monotonous monitoring tasks or distraction by other activities (e.g. using a telephone) can result in these processes not being adequately available for situation awareness in the vehicle. These effects can occur even in the use of systems with a low degree of automation such as Adaptive Cruise Control (ACC). Buld et al. [39] were able to demonstrate that drivers using ACC neglected certain aspects of the driving activity and environmental conditions and consequently incorrectly interpreted system limits. Increased lane drift and late reactions to critical events were interpreted in a study by Ward [40] as indicators of reduced situation awareness while driving with ACC. The analyses of Ma and Kaber [41], however, suggest that situation awareness can also be improved through the use of ACC. A more differentiated picture of these contradictory results is provided by recent studies on the consequences of highly automated driving. In a simulation study, Merat et al. [42] examined the effects of performing a secondary task on driving behavior during automated driving. The study showed that reactions to critical incidents in highly automated and manual driving conditions without a secondary task were comparable. Distraction by a secondary task, however, resulted in significantly higher-speed driving following manual takeover from the automated system. The authors attributed the finding to the reduced situation awareness due to the distraction posed by the secondary task.

The problematic issues raised here represent just a sampling of the challenges that need to be resolved with regard to the interplay between humans and automated vehicles. Many questions with respect to the mental adjustments and changes will only be answerable following the concrete implementation and scientific study of the next-higher levels of vehicle automation (see automation levels BASt, [43]). The design of interfaces, appropriate feedback and avoiding diffusion of responsibility are topics that are being addressed today in new design concepts and implemented in the prototype stage for highly automated vehicles [e.g. 44]. Which learning experiences, reciprocal effects and changes to mental models will ultimately emerge from the use of these systems, however, can only be determined through representative, longitudinal studies.

### 6.2.3 What Are Mental Models?

Mental models are cognitive-emotional representations of objects, object relationships and processes—in short, internal representations of the external world. The concept of mental models was first used by the psychologist Craik [45], who postulated that people develop simplified models of the functioning and processes of their environment in their minds. The models are used for orientation, understanding, reasoning and the prediction of events. Craik's approach to mental models was later further developed by Johnson-Lairds [46] to describe and study deductive reasoning and language comprehension.

In the cognitive psychology literature, there is widespread consensus [see also 47] that mental models are dynamic in nature and can be described in terms of three central characteristics. First, mental models are created in the working memory and enable individuals to simulate possible actions and their consequences [1]. Thinking is thus the manipulation of mental models. Second, mental models can represent the cause and causal relationships. They generate a causal understanding of how systems function [48]. Third, mental models can change over time due to experience—i.e. they are capable of learning. The quality of the models and the conclusions based on them continue to develop through specific learning experiences [49]. With increasing expertise, the understanding of technical matters moves from concrete to abstract representations—a relevant factor for the human-machine interaction.

The applied fields of study such as technology design in some cases follow different interpretations of the definition of mental models [see also 1] which can be explained by the different activity contexts. Yet even earlier work underscored the significance of the concept of prediction and the understanding of human behavior in interactions with technical systems [e.g. 50]. Mental models are thus based on context-specific expectations and prior experience as well as the current perception of system characteristics. They form the foundation of the user's understanding of the system and decision-making. This means that both the error-free use and trust in technical systems is largely determined by the degree to which the functioning of the machine is compatible with the user's expectations [33].

Compatibility in the context of mental models is defined in terms not only of operability, but also the user's experience and general acceptance of technology. Zhang and Xu [51] postulate in this regard a modification or restructuring of existing mental models with the introduction and use of new technologies. A lack of compatibility can lead to frustration and negatively impacts acceptance and diffusion rates [52]. However, if new systems correspond with expectations (i.e. the existing mental models), this results in heightened system trust and a positive user experience [53].

Mental models thus comprise representations of human knowledge, attitudes, values and emotions that interact with their environment. With respect to the automation of vehicles, both the cognitive-psychological processes of information processing and the influence of higher mental structures (e.g. needs, expectations, wishes, etc.) are important. The interdependency of these different levels has been emphasized in theoretical models on the role of the driver in automated vehicles [e.g. 54, 55]. Ultimately the appropriate modification and adaptation of mental models will play a major role in determining the nature and frequency of use, as well as the acceptance of these systems. The successful transition—as yet undefined—of the driver's role in automated vehicles therefore requires an integrative examination of the scholarship on human behavior in partially and highly automated systems as well as the emergent ideas and requirements with regard to Full Automation Using Driver for Extended Availabilities. Put another way, human centered technology design implies not only a consideration of the technical possibilities and limits, but also a focus on individual and societal values and objectives.

## 6.3 Mental Models of Autonomous Driving

Many people regard autonomous vehicles as a concept for the distant future. Though many people may have imagined how appealing it would be to be able to sleep or read a newspaper during a drive, knowledge about autonomous vehicles remains sparse among the general population. Decisions regarding the use and acceptance of innovations, however, are not based solely on rational knowledge [56]. Contrary to the notion of humans as rational, benefit-maximizing decision-makers—homo economicus—, humans tend to employ simpler decision-making strategies which reduce the amount of information to be processed and are influenced by emotional processes [57–59]. Attitudes and decisions are not infinitely amenable to change merely through the provision of more information. Rather, new information is received and processed selectively so as to be in agreement with existing desires, expectations and goals—the human's mental models [60]. It is therefore crucial to the success of an innovation that the cognitive perceptions and evaluations of it can not only be integrated into existing mental models, but also appeal to the emotional side of the equation [61, 62].

In addition to numerous studies on the technical, legal and cognitive aspects of the automation of vehicles, to date there have been few studies that have examined the preferences and expectations of potential users. In the largest representative international survey on the subject to date [63], the focus was primarily on the acceptance of and willingness to use automated vehicles. The results for Germany show that automated vehicles are by a majority considered as a beneficial technological advance. At the same time, half of the respondents express fear regarding automated driving and doubt that the technology will function reliably. In a comparison of multiple use scenarios, long highway trips are most commonly mentioned as the preferred potential use of autonomous driving. Interestingly, the authors find a positive correlation between the acceptance of driver assistance systems and acceptance towards automated driving. One potential explanation for that could be that the formation of suitable mental models for the characteristics of partially automated systems also has a positive impact on the acceptance level for higher automation levels [see also 34].

Which attitudes and cognitive and emotional representations underpin the acceptance or rejection of automated vehicles is still unknown. In addition to the aforementioned cognitive-psychological requirements for the design of the human-machine interaction, however, these factors represent an important prerequisite for the success of the transformation in the transportation sector. The aim of the quasi-representative online survey study introduced here was to generate a differentiated, to some extent explorative, picture of the perceptions of autonomous driving across the use cases generated in the project. The questionnaire was developed with the following overarching questions in mind: "With which mental models do potential users encounter the new role of the driver in autonomous vehicles?"; "Which automated elements of vehicle guidance are most amenable to the mental models of the users?"; "Which control functions and intervention options by the driver do potential users expect in autonomous vehicles and how can acceptance of this line of innovation be increased?"; "Which experience and design elements in autonomous vehicles can replace previous representations on the role of the driver and thus increase acceptance of this line of innovation?".

## 6.3.1 Methods

#### 6.3.1.1 Questionnaire

The questionnaire was devised in collaboration with other authors of this book (Ms. Cyganski, topic: demand modeling; Ms. Fraedrich and Ms. Lenz, topic: acceptance). The survey was conducted online in April 2014 via an electronic questionnaire. The questionnaire was divided into two main sections: (1) General part: This part consisted of five question groups: socio-demographic questions; questions on prior knowledge, interest and general acceptance of automated driving; questions on need-related attitudes regarding various forms of transportation; questions on the emotional representations of mobility-related concepts; and questions on the topic of time-use and general transportation usage. (2) Special part: The questions in this part related to the four use cases developed in the project and were divided into the following ten topic groups: Free associations on the use case; willingness to use the technology; anticipated use scenario; anticipated impact on prior transportation usage; assumed fulfillment of need; emotional reactions; trust and acceptance; need for control and intervention; and preferred secondary tasks during automated driving. To reduce the processing time, the questions regarding the four different use cases (see below) in the second part were not answered by all participants. After answering the questions in the first part, the sample was split and the study participants randomly assigned in equal numbers (N = 250 in each case) to one of the four use cases. The questionnaire comprised 438 items, with each participant answering 210 questions following distribution of the use cases. The survey questions were partly taken from earlier mobility surveys [62, 64] and partly new and were—in particular the questions from part two—checked for comprehensibility in a pretest.

For all attitude questions, a six-point scale was used (1 = Completely disagree, 6 = Completely agree; with some questions, the codes differed due to the content) to assess agreement with the statement. The affective significance of the terms in the field of mobility was surveyed using the semantic differential method [65]. In the three dimensions of valence, potency and arousal, bi-polar, nine-point (from -4 = extremely to 0 = neutral to 4 = extremely) scales were used in which the extremes were designated by the adjectives unpleasant–pleasant (valence), weak–powerful (potency), and calming– exciting (arousal). Current traffic behavior was recorded via selection options and frequency categories.

#### 6.3.1.2 Sample

Participants were recruited through a commercial market research panel of the company, Respondi AG (http://www.respondi.com/de/), and paid by the same for their participation. The company assembled a participant group that was representative of the overall German population with respect to age, gender, education and income. A total of N = 1,363 people completed the survey in its entirety. Some people, however, answered the questions in such a short time that it doubtful that the questions were answered conscientiously. As a consequence, all participants whose processing time was less than 1,000 s were not included in further analysis. The sample was therefore reduced by N = 230 to N = 1133. In a further step, the distortion of the original ratios that resulted from the exclusion was corrected by removing N = 133 randomly selected females to achieve a roughly representative distribution at least with respect to gender proportionality. The average processing time of the remaining sample (N = 1000) was 1897 s (=31.6 min.) (SD = 780 s). The precise demographic composition of the sample can be taken from Table 6.1.

#### 6.3.1.3 Data Analysis Affective Similarity

The affective similarity between the terms evaluated via the semantic differential method was calculated as follows using the three-dimensional Euclidian distance d between the average EPA profile (E = valence, P = potence, A = arousal) of the term "ideal drive" and the average EPA profiles of the other terms:

$$d = \sqrt{\left(I\_e - \mathcal{B}\_e\right)^2} + \left(I\_p - \mathcal{B}\_p\right)^2 + \left(I\_a - \mathcal{B}\_a\right)^2$$

whereas I refers to the evaluation of the "ideal drive," B the respective evaluation of the other terms and the subscript letters define the EPA dimensions.


Table 6.1 Demographic and mobility-specific characteristics of the sample

## 6.3.2 Results

The first line of inquiry was to what degree the topic of autonomous driving is even known among the general public, whether there is broad interest and how people spontaneously feel about the technology. Less than half of respondents (44 %) claimed to have no knowledge of the subject, while the majority had already heard of it (33 %), read about it (16 %) or claimed to have a higher level of expertise (4 %). A similar distribution was found in regard to interest in the subject of autonomous driving. A majority of participants (58 %) described themselves as "somewhat," "quite" or "very" interested in the subject. However, a majority (56 %) also cannot imagine replacing their current preferred means of transportation with an autonomous vehicle. Thus in spite of a relatively high degree of interest and some prior knowledge, a majority of the public manifests a certain reluctance towards the use of autonomous vehicles.

#### 6.3.2.1 Driver Assistance Systems and Giving up Driving Responsibilities

As discussed above, the use and acceptance of driver assistance systems can have a positive effect on the general perception of autonomous driving. The results of the present study show that most respondents (67 %) have already heard of driver assistance systems. Among people who use a passenger car on a daily basis (82 %), cruise control (50 %), acoustic parking assistants (46 %) and high-beam assistants are the most frequently used systems. Other systems such as adaptive cruise control (ACC, 15 %), night vision assistant (11 %), head-up display (10 %) or attention assistant (8 %) are only used by a minority in everyday situations.

The expressed desire to give up certain driving tasks and functions to an automated system yields similar results. Figure 6.1 shows the task-specific distribution of desires in the category spectrum from "absolutely not" to "very willingly." In a comparison of the different driving tasks it becomes clear that aside from the overwhelming rejection (62 % in the categories "absolutely not" and "preferably not") of the idea of completely ceding vehicle control to a driving robot, people are particularly averse to giving up the task of steering the vehicle (58.3 % in the categories "absolutely not" and "preferably not") to an automated system. At the same time, respondents view transferring parking tasks (45 % in the categories "willingly" and "very willingly") as well as safety-related assistance in the area of vehicle stabilization (43 % in the categories "willingly" and "very willingly") and pedestrian recognition (43 % in the categories "willingly" and "very willingly") more favorably.

Fig. 6.1 Desire to transfer function to an automated system

#### 6.3.2.2 Representations of the Driver's Role and Use Cases

Employing the semantic differential method, the study surveyed the affective significance of various terms related to different roles in the vehicle and the scenarios described in the use cases among all participants. The concept of the "ideal drive" and the conventional "car" were also evaluated in this fashion. The raw results (average evaluations on the scales valence, potency and activation) are displayed in Table 6.2.

The results were used to calculate the Euclidian distances and thus the affective similarity between the term "ideal drive" and the other terms (for methodological details see [ 61, 66]). A visualization of these calculations is provided by Fig. 6.2, in which the Euclidian distance d of the evaluated terms is represented on the x-axis. Low values indicate a smaller distance and thus higher affective similarity between the terms, i.e. they elicit a stronger positive association for the respondents. It is clearly evident that "chauffeur" comes closest to "ideal drive" from an affective standpoint, while "co-pilot" least corresponds to this emotional representation. In a comparison of the various use cases for autonomous driving, it emerges quite clearly that the Vehicle-on-Demand concept deviates most strongly from the idea of an ideal drive, while vehicles with Autonomous Valet Parking are most closely associated with it. The significantly more


Table 6.2 Arithmetic mean (M) of the affective evaluations

positive affective positioning enjoyed by conventional cars in comparison to the use cases could therefore represent a major impediment to acceptance with the introduction of Full Automation Using Driver for Extended Availability in particular. As concerns the role of the driver, the affective representations revealed in the study underscore the role preference explicitly addressed in another question. In this item, participants use a slider to indicate which role they would like to assume in an autonomous vehicle (1 = passenger and 10 = supervisor). The arithmetic mean of 6.36 (SD = 2.9) indicates a preference for the role of an active supervisor who is able to maintain control over the vehicle at all times based on continuously available system information. On the affective level, the role of the passive passenger (d = 2.1) is still visibly remote from the desired ideal (d = 0).

#### 6.3.2.3 Cognitive and Emotional Representations of the Use Cases

As described above, the overall sample in this part of the questionnaire was randomly divided into four subgroups of equal size (each N = 250) and assigned to one of the four use cases (Interstate Pilot Using Driver for Extended Availability (1), Autonomous Valet Parking (2), Full Automation Using Driver for Extended Availability (3) and Vehicle on Demand (4)). This enabled an inter-group comparison of the expectations and attitudes toward the individual scenarios. At the beginning of this section, participants were asked about their willingness to use the briefly described variants of autonomous driving. Autonomous vehicles with valet parking were the most popular (53 %), followed by Full Automation Using Driver for Extended Availability (45 %) and Interstate Pilot Using Driver for Extended Availability (42 %). The lowest intent to use was registered by the Vehicle-on-Demand concept (35 %). According to the conducted analysis of variance (ANOVA), the differences are statistically significant (F(3996) = 4.528; p < 0.01). The Bonferroni post hoc test (pairwise average value comparison) indicates, however, that only the Autonomous-Valet-Parking and Vehicle-on-Demand use cases differ significantly in terms of intent to use (p < 0.01).

In response to the question to what extent various mobility needs would be fulfilled through the use of an autonomous vehicle, some differing assessments emerge in a comparison of the four scenarios. Table 6.3 shows the averages of these evaluations and statistical results (ANOVA and Bonferroni post hoc test). From an overall perspective, it can be seen that autonomous vehicles are perceived as convenient, stress-free and environmentally friendly. Statistically relevant differences in comparing the use cases arise with regard to (lack of) stress, convenience, safety and time-savings. According to respondents' assessments, Autonomous Valet Parking most effectively addresses the need to save time, convenience, freedom from stress and thus explains the high acceptance for this variant of autonomous driving. From a critical standpoint, the safety concerns related to the Vehicle-on-Demand use case stand out.

The emotional evaluation of the use cases was conducted with regard to 10 different emotions (hopefulness, relaxation, satisfaction, happiness, concern, anger, stress, powerlessness, dislike, fear). The participants were asked to indicate which emotions they would experience in the anticipated use of the respective variant of autonomous driving.


Table 6.3 Arithmetic mean (M) standard deviation (SD) from need fulfillment

Remark The average values marked by subscripts demonstrate a significant difference in the Bonferroni post hoc test (pairwise average value comparison) on the level of p = 0.05 (e.g. a subscript 2 in the second row/first column indicates a significant difference to the corresponding value in the second column)

\*p < 0.05; \*\*p < 0.01

The results (see Table 6.4) confirm the tendencies found in the differences that emerged in the comparison of the use cases described above. The strongest positive associations were found in connection with Autonomous Valet Parking. The feelings of satisfaction, relaxation and happiness are also significantly more strongly represented here than in the other scenarios. In the use cases Interstate Pilot Using Driver for Extended Availability, Full Automation Using Driver for Extended Availability and Vehicle on Demand, the emotions of powerlessness and fear dominate. The feeling of being at the mercy of forces beyond one's control is associated with these feelings and represents a major hurdle to acceptance. Aside from Autonomous Valet Parking, only Full Automation Using Driver for Extended Availability evokes above-average positive emotions such as happiness, hopefulness and satisfaction, although the negative emotions do predominate in this use case.


Table 6.4 Arithmetic mean (M) and standard deviation (SD) of emotional responses

Remark The average values marked by subscripts demonstrate a significant difference in the Bonferroni post hoc test (pairwise average value comparison) on the level of p = 0.05 (e.g. a subscript 4 in the second row/second column indicates a significant difference to the corresponding value in the fourth column) \*p < 0.05; \*\*p < 0.01

These results provide a differentiated picture of the emotional base elements out of which the most important emotion in the field of automation is comprised—trust. Trust in the described variants of autonomous driving was measured in this survey based on four items (e.g. "I can imagine relying on such a system in my everyday mobility")—analogous to the other attitude items on a 6-point Likert scale. A totals index was composed based on these items. As expected, trust is highest in vehicles with Autonomous Valet Parking (M = 3.45; SD = 1.31) and lowest for the Vehicle-on-Demand concept (M = 3.10; SD = 1.42). Trust in vehicles with Interstate Pilot Using Driver for Extended Availability and full automated vehicles is roughly on the same value (M = 3.36; SD = 1.33 against M = 3.28; SD = 1.33). Only the differences between the Autonomous-Valet-Parking and Vehicle-on-Demand scenarios (Bonferroni post hoc test, p < 0.05) are statistically significant.

#### 6.3.2.4 Intervention, Control and Experience Needs

For a clear majority of those surveyed (Interstate Pilot Using Driver for Extended Availability: 82 %; Autonomous Valet Parking: 81 %; Full Automation Using Driver for Extended Availability: 88 %; Vehicle on Demand: 84 %), the possibility of reassuming control of the vehicle or terminating the automated driving procedure at any time is one of the central needs. At the same time, in the scenarios with an available driver (Interstate Pilot Using Driver for Extended Availability: 32 %; Full Automation Using Driver for Extended Availability: 48 %), only a minority would wish to cease paying attention to traffic and completely cede control of the vehicle to the automated system. This is also reflected in the need expressed by majorities for both of these use cases of not wishing to change the conventional seating position during automated driving (Interstate Pilot Using Driver for Extended Availability: 76 %; Full Automation Using Driver for Extended Availability: 79 %). In all four scenarios, the majority of participants expressed the desire to be able to adjust the automated system to reflect personal preferences in terms of driving style (e.g. comfortable vs. sporty) and route selection (e.g. fastest vs. most environmentally friendly; Interstate Pilot Using Driver for Extended Availability: 71 %; Autonomous Valet Parking: 76 %; Full Automation Using Driver for Extended Availability: 72 %; Vehicle on Demand: 82 %).

The most important perceived benefit of using autonomous vehicles is the possibility of enjoying the landscape during the drive (Interstate Pilot Using Driver for Extended Availability: 64 %; Full Automation Using Driver for Extended Availability: 72 %; Vehicle on Demand: 72 %; Autonomous Valet Parking: NA). The option of being able to converse unhindered with other vehicle occupants continues to be viewed highly positively (Interstate Pilot Using Driver for Extended Availability: 63 %; Full Automation Using Driver for Extended Availability: 65 %; Vehicle on Demand: 68 %; Autonomous Valet Parking: NA). Astonishingly, activities such as surfing the internet (Interstate Pilot Using Driver for Extended Availability: 28 %; Full Automation Using Driver for Extended Availability: 39 %; Vehicle on Demand: 46 %; Autonomous Valet Parking: NA), viewing films (Interstate Pilot Using Driver for Extended Availability: 23 %; Full Automation Using Driver for Extended Availability: 32 %; Vehicle on Demand: 36 %; Autonomous Valet Parking: NA), working (Interstate Pilot Using Driver for Extended Availability: 22 %; Full Automation Using Driver for Extended Availability: 33 %; Vehicle on Demand: 36.4 %; Autonomous Valet Parking: NA) or relaxing or sleeping (Interstate Pilot Using Driver for Extended Availability: 31 %; Full Automation Using Driver for Extended Availability: 47 %; Vehicle on Demand: 54 %; Autonomous Valet Parking: NA) are only regarded as positive aspects of autonomous driving by a minority. The most important benefits of Autonomous Valet Parking are seen to be simplifying the search for parking spaces (80 %), the safety of the parking location (78 %), the resulting free time (76 %) and the cheaper parking options outside of the inner city areas (76 %).

#### 6.3.3 Summary and Conclusions

The focus of this chapter has been the interaction between humans and autonomous vehicles. Proceeding on the assumption that automated vehicles will for the foreseeable future depend upon the availability and control of the human, we first looked at the cognitive-psychological effects of the human-machine interaction. This was followed by an empirical study of the user perspective on autonomous driving through an extensive online survey. The study focused in particular on the attitudes, expectations and emotions —the mental models—toward the subject of autonomous driving.

Based on the scholarship thus far on the psychological consequences of automation in different domains (e.g. aviation, production), it may be concluded that as we proceed towards Full Automation Using Driver for Extended Availability, designers and developers would do well to place greater emphasis on the human at the core of their endeavors. Even in the partially automated systems available today, drivers display well-known problems such as excessive trust and reduced situation awareness. The long-term effects of higher degrees of automation and the associated lengthier periods of mental decoupling from the task on the cognitive and motor skills required by drivers are still largely unknown. The effects found in this regard for highly trained and experiences airplane pilots, however, are alarming [38]. Training and regular manual execution of automatable driving tasks thus seem to be an important instrument for maintaining required and desired skills of the driver.

As long as the human is a part of the availability concept of automated vehicles whether as a supervisor of the system or taking over the driving task—both the human and the machine need a suitable representation of the respective other agent. Transparent interfaces adapted to the mental system of the human are the prerequisite for the necessary situation and system awareness in interactions with the automated system. On the other hand, the technical system must also be able to correctly interpret the mental state of the driver, her intentions and behavior and dynamically represent them in a driver model. In adaptive and cooperative design concepts, these aspects have already been implemented in highly automated vehicle prototypes [44, 67]. Moreover, vehicle manufacturers and research institutions are currently working on potential solutions to these problems in a range of different projects (www.adaptive-ip.eu; www.incarin.de; www.urban-online.org).

The survey results highlight some emerging contradictions between what is technically feasible and innovations that are actually desired by the public. Although a majority of drivers has become accustomed to handing over certain driving tasks (e.g. cruise control) to assistance systems, most people are highly averse to the idea of actually letting go of the steering wheel. The current cognitive and affective representations of the role of the driver are still very strongly associated with the conventional image of an active chauffeur. The notion of assuming the role of a passive passenger finds little acceptance. The conventional, manually controlled vehicle is still so strongly associated with the ideal image in the public mind that for the majority, completely autonomous vehicles do not fulfill mobility needs. The open question is whether a step-by-step, evolutionary automation of vehicles can achieve the requisite changes to the mental models associated with role expectations in autonomous vehicles. A situation-specific transfer of driving tasks to the autonomous vehicle may, as the example of the high acceptance rates illustrates, represent a more fruitful alternative.

Moreover, the results of the survey offer ideas on possible strategies for the transformation that take their orientation from the needs and emotions of potential users. The main argument for the introduction of autonomous vehicles in previous public debates has been increased road traffic safety. This perception is not shared by the general public, however. Rather, the participants in this study see the benefits of autonomous vehicles as stress reduction, convenience and environmental friendliness. At the same time, associated emotions such as powerlessness and fear are powerful factors that pose a major impediment to acceptance. The human thinking apparatus is not capable of objectively estimating the risk of rare events [58], so fears and concerns can lead to irrational decisions. From this perspective, user-centered development means taking account of existing needs both in terms of communication and the concrete design of the systems.

For the potential user, the question is ultimately the added value of an autonomous vehicle compared to the still highly regarded manually controlled vehicle. What should be the focus of one's attention if one is no longer required, or indeed able, to concern oneself with the control of the vehicle for safety reasons? Contrary to expectations, a majority of participants was not interested in the extended range of infotainment options from internet to television, but instead preferred to enjoy the landscape uninterrupted. Just how stable and valid these assertions prove to be in concrete interactions with automated vehicles will have to be addressed in future studies. But perhaps this need follows in the tradition of German romanticism and will offer a new impetus for the design of an automated, "close to nature" space.

Open Access This chapter is distributed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, duplication, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, a link is provided to the Creative Commons license and any changes made are indicated.

The images or other third party material in this chapter are included in the work's Creative Commons license, unless indicated otherwise in the credit line; if such material is not included in the work's Creative Commons license and the respective action is not permitted by statutory regulation, users will need to obtain permission from the license holder to duplicate, adapt or reproduce the material.

#### Literature


# 7 Communication and Communication Problems Between Autonomous Vehicles and Human Drivers

Berthold Färber

### 7.1 Introduction

Discussions of autonomous land vehicles often invoke the example of air traffic, where the autopilot is responsible for steering except for take-off and landing. The question arises: what can we learn from air traffic? What autonomously flying aircraft and autonomously driving vehicles have in common is that the pilot or driver bears the final responsibility. But, there are a number of differences between road traffic and air traffic (besides their type of locomotion) that make transferring the systems from one to the other impractical. Two key differences that are central to this article are the application of rules and the form of supervision. Encounters between airplanes—primarily while taxiing—are thoroughly governed by strict rules. In addition, there is a supervisory monitoring and guiding authority that gives pilots precise instructions and, in cases that might not be covered by rules, reaches decisions and communicates with pilots. As such, the pilot does not have any room for discretion or independent decision-making. The pilot's role is purely implementation. Unlike air traffic, road traffic is a self-organizing, chaotic system that, although it is fundamentally governed by rules, includes many situations for which unambiguous rules cannot be determined. In those situations, section 1 of the German Highway Code always applies: "Participating in road traffic requires constant caution and mutual consideration," and "Those who participate in traffic shall behave such that no one else is harmed, endangered, or even disabled or harassed more than inevitable in the circumstances." Thus, even a list of rules for behavior and all conceivable situations as exhaustive as the Highway Code has a large "miscellaneous" category that must be

B. Färber (&)

Bundeswehr Universität München, 85577 Neubiberg, Germany e-mail: berthold.faerber@unibw.de

resolved by road users themselves in accordance with section 1 of the Highway Code. It follows that one of a driver's central responsibilities in order to safely participate in road traffic is to assess other road users' behavior. This assessment and prediction of other road users' behavior relies on the initial assumption of more or less rule-abiding behavior on their part. However, another aspect of evaluating intentions involves communication between drivers and road users via actions and gestures. In other words, in addition to the "official" rules, there exists a set of informal rules that help to guide traffic.

Anyone who has visited another country as a tourist, whether as a driver or a pedestrian, has experienced for themselves how drastically informal rules, culturally specific modes of behavior, and communication between road users affect traffic. Human drivers who encounter such divergent "canons of rules" initially react with a phase of irritation. In the second phase, the adaptation phase, they unconsciously adapt over time to these new imprecise and unwritten rules. In the consolidation phase these rules seem to be obvious although they are not set in stone and in some cases cannot even be precisely described.

Motorized road traffic comprises a system with very diverse players whose goal is to convey road users to their destinations safely, quickly, and without incident. From the systemic perspective, it is immediately evident that observance of informal rules, communication between road users, and predictions of others' behavior fulfill two key functions: they facilitate the flow of traffic and help to compensate for errors.

#### 7.2 Questions

Expressed technically, humans are multi-sensory adaptive systems. That means that they are capable of taking signals that might be weak or ambiguous and extrapolating the big picture, which they can then interpret. They are also able to adapt to changing conditions in order to support the two aforementioned functions, compensating for one another's errors and improving the flow of traffic. Yet what happens when, alongside humans, there are also robotic vehicles participating in traffic that abide strictly by rules but do not understand informal rules or aspects of communication? How would human drivers react to these new road users, especially in the transition phase when robotic vehicles remain a minority? Are humans capable of solving difficult or seemingly unresolvable situations in cooperation with robotic vehicles? Finally, which characteristics or markings do robotic vehicles need to have at the minimum in order to participate in mixed traffic with human drivers without causing problems?

This article will approach these questions from various angles. Since autonomous vehicles have so far primarily been investigated in view of technical performance, as in the Urban Challenge [1] or the Bertha Benz drive [2], and an emergency driver has always been present in mixed traffic to intervene if necessary (e.g. at the Stadtpilot [3]), there is scarcely any original literature on the questions described above. For that reason, much will be extrapolated from the findings of other research fields.

#### 7.3 How do Road Users Communicate?

In addition to the standard signals for expressing an intention, such as turn signals, emergency lights, brake lights, the horn, and headlight flashing, road users communicate via a number of "informal" communication channels. This kind of communication in road traffic is characterized by restricted comprehensibility compared to normal human communication. According to Merten [4], there are various communication options.

Schema Formation In schema formation, a road user's behavior is anticipated based on specific characteristics. For example, an elderly person with mobility issues behaves differently from a child. One expects different driving behavior from the driver of a sports car to that of the driver of a large sedan. Of course, these schemata are not always accurate in day-to-day driving. Nevertheless, they do serve as guiding principles and help to stabilize the entire system of traffic.

Anticipatory Behavior Small actions make the direction of someone's behavior predictable for other road users. For example, if a vehicle approaches the left lane (without engaging the turn signal), this indicates an intention to change lanes. Similarly, if a pedestrian purposefully approaches a crosswalk, the driver will assume that the pedestrian would like to cross the street.

Non-verbal Communication Non-verbal communication plays a role among the informal communication channels, especially in "negotiation situations." Non-verbal communication is indubitably the oldest form of communication between living beings. As far back as 1874, Charles Darwin discussed non-verbal communication in his book The Expression of the Emotions in Man and Animals [5]. The subtlety of non-verbal signals was demonstrated by an old investigation by Pfungst [6] of Clever Hans, a horse that was able to perform "arithmetic" based on unconscious, minimal signals from its owner or the audience. The important finding was that non-verbal signals are even sent out unconsciously and are thus not always easily available for analysis.

In general, non-verbal signals can be divided into three types:


In the case of road traffic, only facial expression/eye contact and gestures/body movements are relevant and will therefore be addressed here.

Facial expressions and eye contact In local traffic, eye contact both between drivers and between drivers and other road users (pedestrians and cyclists) plays a critical role. Pedestrians who want to cross the street without a crossing aid use eye contact to ensure that an approaching driver sees them. If the driver returns the eye contact, pedestrians assume that they have been seen and that the driver will act accordingly [7].

When a driver from a side street wants to merge onto a main street with heavier traffic, the merging driver also uses eye contact to make sure he or she can turn despite the short time gap, as the driver on the busier street will reduce speed accordingly.

Eye contact is a two-way form of communication. In other words, a glance is either reciprocated or not reciprocated by the person who is glanced at. If that person looks away, this sends the message that he or she has "not seen" the other person and does not intend to accept the signal or the negotiation. The implications of the strategy for autonomous vehicles should be distinguished between autonomous vehicles in which the driver's seat is occupied and those where it is not.

If the driver's seat is occupied, there are two possibilities:


If the driver's seat is not occupied, the other road user does not receive any information, so the situation is equivalent to the "no eye contact" scenario.

Gestures and body movements Gestures are a pervasive and effective method of communication between road users. Many signals conveyed using gestures are generally comprehensible and mostly clear. For instance, nodding signifies agreement with the other person's request. Pedestrians move their arms up and down to request vehicles to stop, for instance in order to secure the scene of an accident. Moving one's hands downwards (Fig. 7.1) signifies that the other person should slow down. A sweeping hand movement (Fig. 7.2) or a gesture of offering (Fig. 7.3) with the palm facing upward signifies "Go ahead. I cede my right-of-way."

[8]

#### 7.4 Implications of Communications Options on Traffic Safety

At first glance, informal signals such as eye contact, gestures, or anticipatory behavior seem less clear-cut than standardized signals such as turn signals, the horn, headlight flashing, etc. In fact neither is entirely clear-cut. Interestingly, the philosopher Heidegger, who investigates the nature of symbols in his treatise Being and Time [9], chooses cars as an example: "Motor cars are equipped with an adjustable red arrow whose position indicates which direction the car will take, for example, at an intersection" (cit. after Frerichs, [10], p. 138. Perhaps this symbol was still crystal-clear and situationindependent in those early days of cars, but it quickly becomes apparent that symbols take on different meanings in different contexts. All symbols, both verbal and non-verbal, can only be understood in relation to their context. As Savigny [11] explains, a distinction must be made between the signal and the intended meaning. Headlight flashing may have different intended meanings depending on the situation. If a driver who has right-of-way slows down and flashes her headlights, it is interpreted as an offer to yield right-of-way; if she is accelerating or maintaining speed when she makes the same signal, it means that she is asserting her right-of-way. Likewise, a right-turn signal might mean "I'm turning" or "I'm looking for a parking space—go ahead and pass me."

To consider the vulnerable road users, let us take a look at the interesting example of cyclists. Cyclists still use signals from the early days of motorized driving to indicate their intended change in direction. This means that for pattern recognition outside of highway traffic, an automated system needs the ability to identify both cyclists' presence and the signals they make.

What are the implications for traffic safety? Initially we may assume that autonomous vehicles will not be familiar with the assorted context-dependent meanings of signals and must therefore behave very cautiously. As long as visual recognition or a pedestrian's hand signals cannot be reliably perceived and interpreted based on the situation, any pedestrians located on a potential collision course with the vehicle must be treated as hazards and trigger a suitable reaction by the autonomous vehicle.

So when autonomous vehicles identify pedestrians on the roadway, they will stop. What happens if the pedestrian is a police officer directing traffic? For one thing, the police officer must be identified as an upright obstacle that the robotic vehicle must steer around. Beyond that, though, the vehicle needs to interpret the police officer's signals. If the police officer holds strictly to the rules, as shown in the photographs Figs. 7.4 and 7.5, an autonomous vehicle can learn the associated meanings. Experience has shown, however, that police officers directing traffic or parking lot attendants assigning parking spaces use very dynamic gestures to speed up traffic, such as waving their arms or hands or making rowing motions with their arms. See Figs. 7.6, 7.7 and 7.8. Humans usually understand these signals from context. Alongside the ability to recognize patterns of gestures and postures, autonomous vehicles would need to have contextual knowledge allowing them to identify and evaluate gestures correctly.

One exceptional case is the need to accommodate vehicles with special rights, such as police cars, fire trucks, or ambulances. These vehicles draw attention to themselves using auditory signals. Visual and auditory signals (such as sirens and flashing lights) obligate the rest of traffic to stop, cede right of way at an intersection, or move aside to create a rescue lane. In everyday road traffic, vehicles do not stop right away when they hear this type of auditory signal in the distance. Such a reaction would severely inconvenience traffic, especially near a hospital for instance. It is also impossible from a distance to precisely identify the direction the auditory signal is coming from. Likewise, the

Fig. 7.4 Traffic police officer: traffic flowing. Image rights: http://commons.wikimedia.org/wiki/ User:Video2005?uselang=en

Fig. 7.5 Traffic police officer (North Korea): chest facing driver means "stop". Image rights: https://www.flickr.com/ people/kansai/

Fig. 7.6 Police officer in Minneapolis signals that traffic can start moving on one side of the street. Image rights: http://commons.wikimedia.org/wiki/User:Calebrw?uselang=en

Fig. 7.7 Police officer in Bangkok gestures to a vehicle to turn. Image rights: http://de.wikipedia. org/wiki/User:Da?uselang=en

Fig. 7.8 Police officer (Sweden) gestures to vehicle to move forward. Image rights: Olle Nebendahl

functionality to identify special vehicles from a distance and to determine the best way to rearrange the lanes would be difficult to design. For that reason, autonomous vehicles would need to stop upon all of these signals for safety reasons so as not to put traffic in danger. The following section will delve more deeply into the implications of the above on public acceptance.

#### 7.5 Is the Ability to Communicate a Requirement for the Other Road Users to Accept Autonomous Vehicles?

In terms of public acceptance, we must once realize again the effect of informal communication in "negotiating situations." In keeping with the aforementioned Sect. 1 of the Highway Code, drivers communicate in negotiating situations in order to resolve situations that are rule-governed in principle but where blindly following the rules would disturb traffic considerably.

Example 1 If a vehicle is parking or idling in your lane, it is sometimes necessary to cross over to the opposite lane and, in extreme cases, even to cross a solid center line. In busy traffic, this requires coordinating with the oncoming vehicles. Apart from (unauthorized) crossing of the solid center line, the situation can be solved without a "negotiation" if oncoming traffic becomes sparse enough that the opposite lane can be used without vehicles communicating. The busier the traffic, the more likely a negotiation is necessary.

How does the driver of an oncoming vehicle signal willingness to cooperate? First of all, by slowing down in order to leave room for you to cross onto the opposite lane. Yet in most cases slowing down alone is not enough of a signal because there are many reasons why a vehicle might keep a larger-than-usual following distance. That is why approaching drivers would usually signal this kind of offer by both slowing down and flashing their headlights. If the autonomous vehicle did not recognize this signal, it would be seen as a "traffic obstacle," which would certainly not encourage public acceptance.

Example 2 As shown above, autonomous vehicles will generally behave more cautiously than human drivers as they have a limited grasp of the context and informal signals. Yet they can also perform driving maneuvers that are normally not performed by a human driver. For one thing, they react more quickly than human drivers. Since they tend not to have a "moment of shock," their reaction time is much faster. That is one reason why autonomous vehicles would cause fewer accidents. Furthermore, accident research has shown that many drivers do not make the most of their cars' braking capabilities and, even when swerving, tend not to reach the physical limits based on the circle of forces. Driver assistance systems such as automatic emergency brakes or emergency steer assist are intended to compensate for these deficiencies. On that basis, not only would an autonomous vehicle act more quickly in an emergency situation, but it would be able to take advantage of the physical limits of forward and lateral acceleration. How other road users will react is largely unknown at this point. The following section discusses a simple approach to solving this.

#### 7.6 What Mental Model Will Other Road Users Apply When Reacting to Autonomous Vehicle's Driving Errors?

Closely related to the questions of interaction and negotiation discussed earlier is the issue of compensating for other road user's errors. Apart from avoiding immediate collisions with swerving trajectories, accommodating other driver's errors is normal in everyday road traffic. First let us clarify how "driving errors" is defined. From a human driver's perspective, "driving errors" might include purely rule-abiding behavior that is not ideally adapted to the situation.

For example, a human-driven car with right-of-way on a main road might let an autonomous vehicle from a side street turn first if the human-driven car wouldn't otherwise be able to turn onto the side street. In other words, if the human driver yields despite having right-of-way, the autonomous vehicle would need the ability to recognize that reliably.

Driving errors might also result from deficiencies in the autonomous vehicle's repertoire of strategies for resolving special situations or might be caused by reaching system boundaries.

Example An autonomous vehicle operating in "traffic jam pilot" mode enters a safe state because the system's boundaries have been reached. In other words, the vehicle slows down to a stop. Although slowing down to a stop is common in a traffic jam, the other road users will be confused at the least if all other vehicles are moving and only the autonomous vehicle is stopped. If the maneuver occurs fairly abruptly for a reason that other drivers do not understand, this can pose a danger. However, we should keep in mind that road users do not drive without errors either in current road traffic and other drivers usually compensate for their errors. This raises the question of which characteristics humans will ascribe to autonomous vehicles. Will they be seen as less competent than human drivers or treated as flawless machines?

One goal of a deployment strategy must be to disseminate a positive yet realistic conception of autonomous vehicles among all road users. Then, and only then, will autonomous vehicles play an appropriate role in the traffic system. In general, the conditions for this are in place. For example, surveys of new technologies such as robotics have shown that Europeans have positive attitudes towards robots [12]. Likewise, driver assistance systems—as precursors of highly automated and ultimately autonomous vehicles—already enjoy a strong reputation as useful aids and are seeing increasing demand from consumers [13].

Apart from people's general attitudes towards technological systems, the capabilities and characteristics ascribed to new technological systems depend on the user's level of background knowledge. People who are less well-versed technically tend to apply naïve behavioral models that ascribe more capabilities to technological systems than they actually possess. Current demonstrations of autonomous vehicles in the media, largely conducted for marketing purposes, invite the impression that these vehicles are masters of all situations. This raises the expectations of autonomous vehicles so high that any driving errors would cause at least irritation, if not safety concerns. For that reason, in order to generate a realistic understanding of potential issues, it is essential to publicize autonomous vehicles' capabilities and limitations early on.

#### 7.7 Cultural Differences

A number of questions arise related to cultural differences: Are there universal rules for non-verbal behavior that can simply be adapted? How can cultural differences in communication and expectations be reflected in a robotic vehicle's communicative and decision-making behavior? If they can, how can they be adapted? What modes of behavior are there in different countries?

The best-known culturally comparative studies on non-verbal "utterances" based on facial expressions were produced by Ekman [14]. Across cultures, he found common facial expressions for the basic emotions of fear, disgust, happiness, sadness, surprise, anger, and contempt.

Most of these basic emotions do appear in road traffic, but their significance for communication among vehicles is rather restricted. For instance, the gestures for yes and no are crucial in negotiation situations. In central and northern Europe as well as the US, nodding means "yes" and shaking one's head means "no." However, in countries such as India, Pakistan, and Bulgaria, wobbling one's head sideways, a motion akin to the European and American "no" gesture, actually signifies agreement. Finally, there is an additional way to indicate yes and no non-verbally in countries such as Greece, Turkey, and southern Italy. "'Yes' is expressed by tilting the head forward, while 'no' is indicated by tilting it back" ([15], p. 134). Beckoning gestures are another source of misunderstandings during interactions among road users. A "paddling gesture" [15] with the palm facing down is used in Japan and the Mediterranean region for beckoning. In Germany and the UK, the same gesture is used to mean "go away." Despite the cultural differences among non-verbal signals performed with the hands, the gestures used to insult or rebuke other people in road traffic are largely universal, interestingly enough. Raising an index finger (Fig. 7.9), tapping on one's temple (Fig. 7.10) or making a sweeping motion beginning at the temple (Fig. 7.11) conveys one's contempt for the recipient. One exception is that forming an upright circle with one's thumb and index finger means (mostly) "o.k."in Germany, whereas in Italy it is understood as a gesture of insult (asshole) (Fig. 7.12).

In contrast to the pan-cultural basic emotions and "gestures of frustration," there are certainly cultural differences in informal communication among road users that are expressed in driving behavior and are currently in flux.

It is generally agreed that southern Europeans drive both more assertively and more defensively than central Europeans. In southern Europe, acceleration and the horn act as informal signals among vehicles. A driver merges into a lane of traffic by accelerating rapidly into a gap (potentially while honking the horn), expecting that the other road users will yield. The driver does not expect any other feedback, but simply assumes that the intention to merge will be recognized and accepted.

In central or northern Europe, the driver of the merging vehicle would tend to expect feedback in the form of eye contact at the least, if not a nod or a hand gesture. In Germany,

Fig. 7.9 Lifted finger. Image rights: copyright belongs to author

Fig. 7.10 Expressing frustration. Image rights: copyright belongs to author

Fig. 7.11 A sweeping motion beginning at the temple to indicate bewilderment at the other person's behavior. Image rights: copyright belongs to author

at any rate, it is commonplace to insist on one's right-of-way so it would be unusual to attempt to merge without obtaining the other road user's "consent," as that would involve risking a collision.

Traffic in the United States is characterized by more steady, lane-based driving. Aside from the official signals, informal signals play less of a role there.

Traffic in China is—at least so far—marked by a low level of rule-abidance and by communication that is difficult for foreigners to interpret. Chinese drivers are masters of surprise, ignoring traffic rules and honking merely as a "friendly greeting" [16].

Communication between cars and pedestrians is especially critical.

Pedestrians make themselves understood by gesturing with their hands, stepping onto the crosswalk, or waiting there until a car stops. What are the implications of this for the behavior of autonomous vehicles? For one thing, autonomous vehicles will predict whether a pedestrian intends to cross the street based on the pedestrian's trajectory and acceleration. Apart from that, there are other modes of behavior that are more ambiguous, such as standing at a crosswalk without intending to cross (e.g. while having a conversation) or hesitating without making a clear signal of intending to cross. In all of these cases, the autonomous vehicle will need to stop for safety reasons. A consequence of this may be "unwarranted stopping" or the danger that children or teens catch on and begin to force vehicles to stop at crosswalks for fun.

Fig. 7.12 No worries! Image rights: copyright belongs to author

Yet the regulations and the actual behavior alike vary widely from country to country. For instance, Italy did not have a rule requiring cars to stop at crosswalks until recently. According to reports from visitors to China, it is only advisable to cross at a crosswalk there as part of a crowd because traffic is highly unlikely to stop for a lone pedestrian.

While pedestrians who use hand gestures to communicate assume that their gestures are seen, they usually would not cross the street if an oncoming car did not slow down.

#### 7.8 Means of Compensation

In the first stage, there is an easy antidote to the dilemma of robotic vehicles' inability to communicate informally in "negotiation situations."

Clearly and visibly marking autonomous vehicles as such would announce the vehicles' uniqueness to the other road users and make their deviant behavior more understandable. This would indicate to other road users that they cannot expect the usual behavior and would consequently increase acceptance in the sample situations described above. After all, vehicles for learner drivers are identified very visibly in order to inform other road users and excuse behavior that might be either excessively rule-abiding or overly hesitant.

Especially in the introductory phase, several considerations support including identifying markings. If vehicles drive without a person sitting in the driver's seat, as envisioned by the "valet parking" scenario, this might irritate the other road users. "Is that car moving autonomously or is it just driving out of control?" With identifying markings, there is no need to ask. Marking autonomous vehicles can also have a marketing effect that will help give rise to rapid adoption. For example, when ABS was introduced, there were ABS stickers available that read "This vehicle has ABS brakes" to indicate that the braking distance was shorter. Technically that is not quite correct because ABS mainly makes it easier to steer while braking, but from a marketing viewpoint the sticker was a great success.

There are also some reasons not to give autonomous vehicles identifying markings. Because they must strictly adhere to the rules, due to their limited ability to negotiate among other things, they might also be targets for unwanted external interventions.

## A simple example:

Pedestrians would not cross a street if a car was approaching due to uncertainty as to whether the car sees them or whether it will stop. In the case of an autonomous vehicle, pedestrians can be positive that the vehicle will stop no matter what (within physical limits). As a result, stopping autonomous cars could become a game for teenagers or cause adults to cross the street without paying attention to the flow of traffic. "It has to stop—it's programmed that way." Neither development would be good for the flow of traffic and this would not have a positive affect on the acceptance of autonomous vehicles.

Whether it has an outright negative effect is hard to predict. That is highly dependent on how exactly autonomous vehicles are introduced. If they are seen as a positive technological innovation and excused for having certain imperfections, a negative effect would be scarcely likely. On the other hand, if they are seen as an elite status symbol, envy will predominate and attempts to disrupt the system will be more common.

#### 7.9 New Forms of Communication for an Effective Exchange of Information from Both Psychological and Technological Perspectives

Autonomous vehicles must generally be able to recognize and interpret other road users' gestures and trajectories. In order to interpret them, they will need situational knowledge allowing them to put signals in the correct context. The "official" signals such as turn signals, the horn, and headlight flashing would probably suffice in most situations in order to convey information to other vehicles or road users.

Kent Larsen's research group at MIT proposed an interesting approach for communication between autonomous vehicles and pedestrians [17]. A prototype with a variety of sensors but only remotely resembling an actual car was fitted with a number of devices. Swiveling, blinking LEDs designed to look like an eye turn towards a pedestrian, signaling "I've seen you."

Additionally, directional speakers point towards pedestrians and tell them that it is okay to cross the street.

If any pedestrians are identified, color-coded LEDs in the wheels could change from green to yellow to red in order to acknowledge pedestrians or warn them (Fig. 7.13).

Another signal that autonomous vehicles can use to communicate with others is "explicit driving."

For example, if another vehicle would like to merge and the autonomous vehicle wants to cooperate, the autonomous vehicle should visibly slow down in order to accentuate the gap and assure the other driver that it is safe to merge.

Communication and informal rules are in constant flux. To illustrate this point with a verbal example, take the expression that something "sucks." Not too long ago, this word was understood as a direct sexual reference, provoking understandable consternation when young people began generalizing it. Similarly, the non-verbal signal "thumbs up" recently spread to countries where it was unfamiliar due to its iconic use in social media. From one angle, that means that autonomous vehicles will need to periodically learn new signals of non-verbal behavior, for instance by regularly updating their visual "vocabulary" along with associated meanings. Yet another effect can also be anticipated. The increased presence in road traffic of autonomous vehicles practicing a distinct, particularly rule-based set of behavior could also encourage other road users to adopt such behavior. This would make traffic more standardized, but not necessarily more efficient. Flexible cooperation between road users becomes more important when the traffic is busier. The distances narrow between vehicles, the complexity increases, and more informal signals are exchanged.

Fig. 7.13 AEVITA: Autonomous Electric Vehicle Interaction Testing Array. Image rights: Nicholas Pennycooke, Changing places group, MIT Media Lab (copyright belongs to author)

Car-to-car communication could provide another technological solution. This would require all road users—not only autonomous vehicles—to be fitted with the corresponding technology. Car-to-car communication has undergone years of research and there have already been a number of demonstrations, some of them on large test sites such as simTD [20]. The proliferation of vehicle-to-vehicle (V2V) or vehicle-to-x (V2X, vehicle to infrastructure) technology could significantly facilitate solving the communication issues between autonomous vehicles and human drivers.

Frost & Sullivan [21] project that by the year 2030, 40 % of vehicles will be equipped with V2V or V2X technology due to the major advantages these technologies offer users, including reducing traffic jams and enhancing safety. The rapid spread of this technology, initially with a different focus in mind, could thus mitigate communication problems between autonomous vehicles and those driven by humans.

Yet even then there will still be some situations that autonomous vehicles cannot solve, either because the other road users do not have the necessary communication devices or because the situation cannot be resolved through communication alone. If the autonomous vehicle operates without a driver to take over driving on short notice (although not immediately), a remote driver or guidance system would have to step in.

#### 7.10 Conclusions

Because vehicle-to-vehicle communication options are currently very limited and unreliable, a wide variety of glances, actions, and action sequences are used to communicate with unprotected road users. Depending on the circumstances and the state of mind of the people involved, interpersonal negotiations can have varying levels of intensity. The rules applied in these cases are highly culturally specific. In particular, the expectations placed on the other person vary widely from culture to culture, so it would not be possible to compile universal rules for robotic vehicles. Another problem arises merely due to the fact that the vehicle's driver, the robot, is unrecognizable. This is evident for driverless cars, at any rate. If a person is sitting in the driver's seat of the autonomous vehicle, any communication would likely be misdirected at the presumed human driver. Mixed traffic including cyclists and other vehicle types would be difficult to implement without the ability to recognize other road users' glances and gestures. This is especially true in low-speed settings. As the speed increases, this form of communication plays a less significant role for a variety of reasons:


What requirements does this create for ensuring functionality based on communication with other road users?

As such, autonomous vehicles must initially behave as if there were no informal communication, in other words, abiding completely by the rules. In the event of an unresolvable situation, either a human driver must take over, or in the absence of one, a centralized authority would need to intervene. Traffic management would be organized similarly to air traffic, in which air traffic control coordinates all aircrafts' movements both in the sky and on the tarmac. Instead of a pilot executing air traffic control's instructions, the robotic vehicle would receive instructions about how to maneuver and independently ensure the vehicle's stability as it carried them out. It remains unclear how an autonomous vehicle would recognize that the situation cannot be resolved or how the traffic control authority would be informed of the relevant details.

Open Access This chapter is distributed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, duplication, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, a link is provided to the Creative Commons license and any changes made are indicated.

The images or other third party material in this chapter are included in the work's Creative Commons license, unless indicated otherwise in the credit line; if such material is not included in the work's Creative Commons license and the respective action is not permitted by statutory regulation, users will need to obtain permission from the license holder to duplicate, adapt or reproduce the material.

#### References


# Part II Mobility

## Barbara Lenz and Eva Fraedrich

#### Foreword

Will autonomous driving alter people's mobility? Will we be mobile in different ways in future? Quite simply, what will be the pathway to future mobility? And what do transport and urban planners need to think about when planning tomorrow's mobility, with its autonomous vehicles? These types of questions from the "Mobility" section are aimed at discussing initial informed reflections on an everyday world where autonomous driving is an integral part of the transport system. The authors of the seven subsequent chapters examine the issues posing particular challenges in realizing "autonomous mobility."

Establishing a framework for such (mobility) trends is a task that politicians are only gradually beginning to turn towards. In their chapter Autonomous Driving—Political, Legal, Social, and Sustainability Dimensions, Miranda Schreurs and Sibyl Steuwer show which initiatives have been encouraged on the part of policymakers not only in Germany, but also in the EU and USA. They make clear how objectives and interests at both industrial and policy level guide the approach of political bodies, and how these are primarily aimed at pursuing long-term objectives. The authors also advocate providing the debate on autonomous driving with a broad setting, allowing for the technology's social relevance to be addressed alongside technical and legal issues.

In their article New Mobility Concepts and Autonomous Driving: The Potential for Change, Barbara Lenz and Eva Fraedrich look at the question of how new mobility concepts such as carsharing, and also old ones like public transport, could change by integrating autonomous vehicles into them. They identify how these systems may be made more flexible in potentially very far-reaching ways, and they also pick out starting points for individualizing public transportation. They conclude that autonomous vehicles offer considerable potential, initially only gradually becoming visible, for transforming the transport system and increasing the public system's attractiveness. At the same time, however, they point out that trends in the new systems' costs and profitability will require measuring.

The article Deployment Scenarios for Vehicles with Higher-Order Automation by Sven Beiker examines potential paths to the practical introduction of autonomous vehicles. The author distinguishes between three scenarios on the path to autonomous vehicles: (1) an evolutionary scenario, (2) a revolutionary scenario, and (3) a transformative scenario, and then looks at their impact on the transport system, their demands in terms of technical developments, their regulatory requirements, and their significance for corporate strategies. He concludes that the scenarios named are currently still completely independent of one another, and it is possible that the path to autonomous driving will initially proceed in different usage areas that will only "merge" step-by-step.

What will it actually mean for our cities to have autonomous vehicles on their roads? In his paper Autonomous Driving and Urban Structure, Dirk Heinrichs takes a look at what impact automated road traffic could have on cities and urban structure. He also examines current scenarios for cities of the future with regard to ideas developed for transport, particularly those assuming fully automated road traffic. He lays out the essential positive effects as well as the negative ones. In each case, argues Heinrichs, it is the task of integrated urban and transport planning to confront in good time the challenges of autonomous driving, and above all to consider the interplay between long-term and daily mobility decisions.

In order to be able to evaluate mobility and transport trends in terms of their impact, and of how controllable they are, transport and urban planners require quantitative models. One important element in this field is so-called demand modeling. This is able to map, for example, how changes in car usage—in this case, to be driven instead of to drive oneself—affect people's mobility. At present, however, it is still difficult to develop such models, as empirical values on people's transport behavior in the face of automated driving are not yet available. In her paper Autonomous Vehicles and Autonomous Driving from a Demand-Modeling Perspective, Rita Cyganski discusses how autonomous driving may be integrated into demand models. Based on a survey, she further shows that simply assuming the advantages of being driven is, for the moment at least, not realistic, and therefore also not an appropriate starting point for demand modeling.

One essential influence on transport demand stems not least from the vehicles with which demand is served. In their chapter on the Effects of Autonomous Driving on the Vehicle Concept, Hermann Winner and Walther Wachenfeld describe what opportunities there are for changes to the vehicle concept in the areas of bodywork, drive system, chassis, interior, and the human-machine interface. The authors then outline how the vehicle itself and its usability could change as a result of all this, and they suspect that automation will not be a driver of revolution in the vehicle concept. They do, however, see considerable scope for vehicles to further diversify in purpose specific ways. Not least, this may lead to them being used in new ways—perhaps even as rolling living rooms, workspaces or bedrooms.

It is possible that autonomous vehicles will not only be used privately, but also as part of passenger transport systems. These systems might not only operate on the roads autonomously, but also provide automated services. With his chapter Implementation of an Automated Mobility-on-Demand System, Sven Beiker firstly lays out the basic research questions that need answering here, and then introduces the current implementation of such a system on the campus of Stanford University in California. The chapter thus provides a vivid example of an actual deployment of a road vehicle in a public space, albeit a controlled one.

# 8 Autonomous Driving—Political, Legal, Social, and Sustainability Dimensions

Miranda A. Schreurs and Sibyl D. Steuwer

## 8.1 Introduction

Autonomous driving (self-driving) vehicles, once just a science fiction dream, are a growing reality. Although not commercially available, rapid advancements in technology are creating a situation where technological development needs are moving beyond the regulatory environment. Technological developments have put pressure on governments to make regulatory changes permitting on-road testing of autonomous vehicles. Nevada became the first government worldwide to provide licenses for the testing and operation of autonomous vehicles in the state albeit under strict conditions. The Nevada Department of Motor Vehicles notes that "when autonomous vehicles are eventually made available for public use, motorists will be required to obtain a special driver license endorsement…" [8]. Other states have followed Nevada's lead. New regulations in the United States have provoked the question of whether regulatory changes are necessary in Europe as well. This chapter examines the emerging competition among automobile manufacturers related to the development and deployment of autonomous vehicles and their political and regulatory implications. Special attention is paid to the role of industrial stakeholders and political actors in relation to the development, uptake, and regulation of autonomous vehicle technologies. This is done from a comparative perspective considering developments in the United States, the European Union, the United Kingdom, Germany, Sweden, and Japan. The different framings of autonomous vehicle technologies and their potential contributions are also considered.

M.A. Schreurs (&) S.D. Steuwer

Environmental Policy Research Centre (FFU), Freie Universität Berlin, 14195 Berlin, Germany e-mail: Miranda.Schreurs@fu-berlin.de

S.D. Steuwer e-mail: sibyl.steuwer@fu-berlin.de

© The Author(s) 2016 M. Maurer et al. (eds.), Autonomous Driving, DOI 10.1007/978-3-662-48847-8\_8

#### 8.2 Autonomous Driving from an Innovation Policy Perspective

Increasing vehicle automation can be understood as an innovation process that may eventually lead to autonomous or semi-autonomous vehicles. Innovations can be classified according to the kind of innovation (e.g. product, process, organizational), the phases of innovation (invention, innovation, diffusion) or the magnitude of innovation (ranging from incremental to radical). A variety of influencing factors shape innovation processes. These include actors and actor networks, institutional frameworks, and technological developments both inside the innovation system and external to it. There may be co-evolutionary development of (technological) innovations and influencing factors [35]. Political intervention is one factor that can influence innovation processes and is our focus below.

Automated technologies have been incorporated into cars for decades, including anti-lock brakes, rear view alarm systems, lane departure warning systems, and adaptive cruise control. Information and communication technologies are likely to make possible the rapid deployment of some automated technologies (as is already the case with automated braking systems). Automated driving technologies could improve emergency response, enhance public transport systems, and optimize intermodal passenger transport.

Autonomous vehicle technology is now rapidly developing as autonomous driving vehicles are tested on the road. Various future development paths are possible as indicated by the use cases described in the chapters by Wachenfeld et al. (Chap. 2) (see also Beiker in this book Chap. 14). Autonomous vehicle technology development paths range from incremental (e.g. automatic braking systems and transmission systems) to larger (automated crash avoidance safety systems and autonomous valet parking) to revolutionary changes to existing systems (fully autonomous vehicles in regular traffic) (for a definition and nomenclature see e.g. [25, 44]). Depending on the state of a technology and the degree to which it has been implemented, there are different policy implications and regulatory intervention needs.

Different technological and use paths place different demands on the policy system. Incremental technological changes can usually be addressed with relatively minor changes to existing regulatory frameworks. More radical technological changes, such as the fully autonomous vehicle, will require deeper regulatory interventions as well as societal awareness raising and acceptance. The information and communication technologies (ICT) used in autonomous vehicles could also raise various questions related to data protection and storage although this will depend very much on the kind of technologies employed (Chap. 24).

Certainly one of the changes visible in relation to the emergence of autonomous vehicle technology is the emergence of new stakeholders. The technologies involved have widened the field of actors engaged in transport policies and led to the formation of new political coalitions. The ICT industries are important stakeholders in autonomous vehicle technologies and policies. Auto manufacturers and other players (like Google) are both in competition in the development of prototypes and in cooperation with each other in an effort to achieve a more favorable regulatory environment for the testing of autonomous vehicle technology.

The commercialization of autonomous vehicles is envisioned in the coming years by some manufacturers although there is considerable uncertainty as to when and if the technology will be made commercially available any time soon. Conditions for commercialization may also vary significantly country to country depending on road traffic conditions. While there are many questions as to whether commercialization is realistic in the near future, expert communities are urging regulators to prepare. In some jurisdictions (especially in the United States) early preparatory steps for potential deeper regulatory changes are being taken.

The speed and quality of advancements in autonomous driving technologies will impact demands for political intervention and steering. Many political interventions are driven by technological advancements. In the case of incremental technology development, there may be a parallel process of incremental regulatory changes, licensing decisions, or increase or decrease in financial or other political support schemes.

Incremental technological changes can be researched from the perspective of systems innovation theory, where innovations are understood as a result of multilateral interaction processes among firms, industries, organizations, and institutional frameworks [13–15]. In the case of more revolutionary technological developments which result in more disruptive changes to the status quo, politicians may be forced to make rapid and major regulatory decisions with little preparatory or learning time and with few existing experiences to draw upon.

In some cases, political actors may decide to try to accelerate the development of certain technologies and their large scale application. We have seen examples of policy-driven development with, for example, nuclear and renewable energies. In these cases, governments set incentives to support the development of these technologies, e.g. with research and development funding, support schemes, loans, the provision of infrastructure, and the taking over of liability risks and in the case of some countries, later made decisions to phase-out the use of a particular technology. There are also various examples in the transport sector, where state actors aimed at paving the way for certain technological choices. Apart from providing road infrastructure and thereby supporting individual automotive transport systems, e-mobility is a recent example of an attempt by policy-makers to help boost the implementation of a particular technology on a larger scale [7].

Policy makers do not typically like to intervene in the workings of market economies but at times may feel pressured to do so. As Edquist formulates it "[t]here must be a 'problem'—which is not automatically solved by market forces and capitalist actors—for public intervention to be considered" [14].

Different factors may be behind a decision to support new technologies or technological applications. Policy makers may choose to promote a technology's development in order to support the competitiveness of a domestic industry, in response to problem-pressures (e.g. safety or environmental factors), to experiment with new technological possibilities, or in reaction to international developments. As Edler and his colleagues put it: "Public innovation policy aims to strengthen the competitiveness of the economy or of selected sectors, in order to increase social welfare through knowledge creation and economic success" [12]. Numerous studies illustrate the importance of political intervention especially in the field of environmental policy innovation (see e.g. [30–32]).

There are several ways political actors can support the development and diffusion of new technologies. They may encourage and support the development of expert networks, finance research and development, create demand for a certain technology (e.g. by setting up support schemes or mandating government purchasing of a technology), and, by providing basic infrastructure (for a summary of approaches see [35]). Research support has been relevant in the development of autonomous vehicle technologies as well. States that are lagging behind in the technology are now scrambling to catch up. Since innovations go through various phases (see e.g. [26, 36]), governmental interventions may also be limited to particular innovation stages of a technology.

#### 8.3 Visions of Autonomous Driving in Europe

Visions of the future can both influence and reflect regulatory debates and their public perception. Visions for autonomous driving are being shaped by various stakeholders who have their own interests in advancing particular framings. When particular framings of a technology take hold, they have the potential to direct future R&D trajectories and other societal and political actions. As we will see below, autonomous vehicle technologies are increasingly being viewed as an important component of future transport systems. Their development is being linked to concerns about industrial competitiveness, sustainable development, resource efficiency, safety, and assistance for the elderly and others who might otherwise not be able to drive a car. At the same time, there are some voices of concern that there could be a loss of control through robotization of automobiles. Here we consider how autonomous driving is discussed at the European level before turning further below to discussions in other economies.

To understand how autonomous driving vehicles are being discussed at the European level, we looked at strategy documents, European-funded research projects, and important networks related to autonomous driving. The analysis shows something of a mismatch between the interests of specific industrial actors in a rapid commercialization of autonomous driving technologies with broader European visions and objectives in the transport area in which autonomous driving technologies play some role, but little attention is given to autonomous vehicle technologies. Autonomous driving technologies are not widely discussed in European strategic documents although some research projects are being funded. This could be important since the extent of attention given to a subject and the visions associated with it may determine whether or not political support is lent to a technology's development. With little explicit attention given to autonomous driving vehicles at the European level, little political action can be expected unless there are either sudden technological innovation shocks or stronger political lobbying by stakeholders.

#### 8.3.1 European Strategy Documents

Autonomous driving technologies have received little attention to date in European Commission strategic documents, including roadmaps, green papers, and white papers. To the extent autonomous vehicle technologies are discussed it is often in the context of broader EU debates on European competitiveness, innovation, climate protection, energy security, employment, and education (the EU 2020 strategy) [17].

Guided by the general framework objectives of the EU 2020 strategy, the following documents were analyzed: "Roadmap to a Single European Transport Area - Towards a competitive and resource efficient transport system" [18], "Research and innovation for Europe's future mobility. Developing a European transport-technology strategy" [19], the "CARS 2020: Action Plan for a competitive and sustainable automotive industry in Europe" [20], and the "Directive on Intelligent Transport Systems" [24]. These strategic documents cover issues linked to autonomous driving: mobility, infrastructure, digitalization, and general European discourses related to innovation and climate protection. The documents differ in their degree of specificity.

These documents shed light on which actors are taking up autonomous vehicle developments and give an impression of how far reaching the debate on autonomous driving currently is in Europe. They also give a picture of how autonomous driving technology is being framed and which other societal, technological, and political issues it is being linked to. Finally—and maybe most importantly—these documents hint at the opportunities for and obstacles to the wider implementation of autonomous vehicle technologies at the European level.

#### 8.3.1.1 Competitiveness and Innovation

The European Union has as one of its goals strengthening the competitiveness of European industry and technological leadership including in important sectors like transport. The European Union's transport roadmap stresses that "innovation is essential" to maintaining European competitiveness. Three areas of innovation that are stressed are: "efficiency through new engines, material, and design", "cleaner energy use", and "safer and more secure operations through information and communication systems" [18].

The communication document from the European Commission to the Parliament and the Council with the title "Research and innovation for Europe's future mobility. Developing a European transport-technology strategy" [19] can be seen as the starting point for the development of a strategic transport-technology plan. At its visionary core is the expected change towards high value-added, innovative transport technologies. The transport industry of the future is expected to have to deal with highly complex mobility systems and to achieve this with a much lower carbon content. New materials, new production processes and new technology partners as well as "a stronger cross-fertilisation between the transport modes" are seen as crucial elements of this industry transition. The communication further stresses the expectation that the transport sector, the energy sector and information and communication technologies will be increasingly intertwined.

With regard to the automotive industry, strengthening competitiveness is central to European policy-makers. This is reflected by the CARS 2020 Action Plan, which was developed by DG ENTR (Directorate-general for Enterprise and Industry). The Competitive Automotive Regulatory System for the 21st century (CARS 21), the antecessor to CARS 2020, is concerned with overcoming the economic crisis in general and the crisis of the European automotive industry in particular. It sets a vision of: "An automotive industry that is leading in technology, in coordinated action with the fuel supplier industry, producing vehicles which are attractive to EU consumers, clean in terms of regulated pollutants, more fuel-efficient, safe, quiet and connected" [20].

#### 8.3.1.2 Efficiency and Sustainability

At the European level, innovation is often linked to the development of an energy and resource-efficient and sustainable transport system. The transport roadmap spells out "A vision for a competitive and sustainable transport system". The document highlights the dual goal of increasing transport and mobility within the Union while reducing greenhouse gas emissions by 60 % until 2050. It further links EU 2020 and its flagship initiative on resource efficiency to transport policy. This translates into a transport system that "uses less and cleaner energy, better exploit a modern infrastructure and reduce its negative impact on the environment and key natural assets like water, land and ecosystems" [18]. The document preparing the transport-technology strategy repeatedly stresses the EU's vision to strengthen competitiveness by decarbonizing the transport system and accordingly calls for research in green technologies, material substitutions, and ICT in order to optimize intermodal and public transport and thereby enhance efficiency [19]. And also the CARS 2020 action plan establishes a strong link between competitiveness and clean and green vehicles [20].

#### 8.3.1.3 Harmonization and Coordination

Realizing a single European market is at the heart of all European strategic documents related to transportation. This is a factor in the strong push for greater harmonization and coordination of national policies. The transport roadmap highlights the importance the EU Commission attaches to harmonization; here it is argued that "a situation where (for example) one Member State opted exclusively for electric cars and another only for biofuels would destroy the concept of free travel across Europe." It also illustrates that the EU Commission aims at influencing technology development.

Also in the CARS 2020 action plan the fragmentation of vehicle regulation among EU Member States is considered problematic. The European Commission has called for more coordination and standardization [20]. In the CARS 21 process, Europe's role in standardization has been highlighted. European Commission Vice-President Neelie Kroes "underlined the business opportunities created by making vehicles digital and connected, which requires public support for funding and standardisation" [4]. CARS 2020 mentions the deployment of Intelligent Transport Systems (ITS) with reference to the automatic emergency call system, eCall as a particular organizational challenge which demands strong coordination [20].

#### 8.3.1.4 Safety

The "vision zero" which refers to the goal of eliminating traffic fatalities and injuries by 2050 is a key selling point for the industry. Safety is also addressed in the transport roadmap, although it receives considerably less attention compared to other issues, such as competitiveness, sustainability, resource-efficiency, or, innovation.

The "vision zero" is mentioned as the ninth of ten goals of the transport roadmap. In line with this goal, the EU aims at halving road casualties by 2020. The EU is to be a world leader in safety and security of transport in all modes of transport [18]. Annex I spells out how to approach that goal and mentions—besides training and education technological solutions such as "driver assistance systems, (smart) speed limiters, seat-belt reminders, eCall, cooperative systems and vehicle-infrastructure interfaces." These can be seen as steps towards a general increase in automation and employment of information and communication technologies.

While the Directive on Intelligent Transport Systems puts comparatively high priority on an increase in safety through the application of information and communication technology, it does not explicitly speak of autonomous driving [24].

#### 8.3.1.5 Summary

The document, "Research and innovation for Europe's future mobility. Developing a European transport-technology strategy" [19] is where one might expect autonomous driving to be discussed as the communication addresses research, innovation, and mobility issues. Yet, while the term 'smart' occurs repeatedly in the text, neither 'autonomous' or 'driverless vehicles' are mentioned. 'Intelligent' and 'automated' are mentioned only once in the context of transport infrastructure: "Modern infrastructure will increasingly incorporate new components which make it smart (intelligent, ICT-enabled and automated), green (new light and recyclable materials) and intermodal (automated terminals, hubs, and equipment). It will integrate the provision of alternative, low carbon fuels and innovative management and operation systems" [19].

Also with regard to research and innovation, autonomous driving is not discussed in the transport-technology strategy document although it could be argued that smart mobility is related to autonomous driving. Many of the visions described in the strategic document can be seen as being linked to autonomous vehicles, such as the interdependence between information and communication technologies and the transport system. Yet the main focus is on green technologies, material substitution and ICT and the optimization of intermodal transport.

Similarly, autonomous driving is not explicitly mentioned in the transport roadmap. Rather, intelligent transport systems, new communication services, and improved traffic management and information systems are seen as future opportunities to optimize traffic flow and reduce congestion and it is in this context that there are calls for further research and innovation. Links are made to multimodality and optimization of the use of infrastructure. Increased automation is not discussed centrally in relation to the modernization of the automotive industry in Europe. It is not even mentioned as an explicit topic in the CARS 2020 action plan.

The Directive on Intelligent Transport Systems, supported by DG Transport, targets steps to be taken towards the application of ITS and thus could be argued to touch upon aspects of autonomous driving, but does not explicitly mention the term or similar terms [24].

In summary, it can be said that while developments related to autonomous driving are mentioned in major strategic and vision documents, autonomous vehicles or autonomous driving are as such not firmly embraced by European bureaucrats or politicians.

#### 8.3.2 Research Related to Autonomous Driving (EU)

Somewhat more attention to autonomous vehicle technologies is being paid in European-funded research projects. There are various research projects funded by EU institutions that could impact autonomous driving. eCall is an initiative to bring rapid assistance to motorists involved in accidents. The Galileo project is a civilian global satellite-based navigation system. TAXISAT, is a related global navigation satellite system being developed for taxis. The SARTRE project, which is funded under the European Union's Framework 7 program, aims at advancing platooning (convoying to make more efficient use of road space). The project HAVE-it follows a long-term vision of autonomous driving and aims at high levels of automation. The purpose of the project is to "develop, validate and demonstrate important intermediate steps towards highly automated driving" such as advanced driver assistance systems. The research project, "SMART- New services enabled by the connected car", focused on the implication, benefits, and services of connected cars. The project's final report concluded that the connected car may make better use of infrastructure and will increase safety as well as fuel efficiency. The EU project "Citymobil—Advanced Transport for the Urban Environment" looked at automated public transport systems and some showcases (e.g. La Rochelle, Heathrow) with the aim of bringing the implementation of these public transport systems in cities one step further. An example of a joint public-private R&D initiative supported by various directorates-general (RTD—Research and Innovation, CNECT—Communications Networks, Content and Technology, ENER—Energy, ENV—Environment, ENTR—Enterprise and Industry) in the vehicle area is the European Green Cars Initiative launched in 2009 and with a priority on the development of efficient, safe, and environmentally friendly mobility, especially electro-mobility. Another important project is AdaptIVe, a successor to InteractIVe. Started in January 2014 and funded by the European Union's Framework 7 Program, this consortium of 29 partners aims to demonstrate the potentials for automated driving in complex traffic environments while addressing some legal issues related to levels 1 to 4 of the SAE classification system.

Currently, the European Union is supporting research on autonomous driving within its framework research support scheme, "Horizon 2020". There are several entry points for research on autonomous vehicles under the Horizon 2020 work program on leadership in enabling and industrial technologies in the section on Information and Communication Technologies [22]. Research for the transport sector is funded via the work program's Chap. 11 on smart, green and integrated transport. Here, autonomous driving is explicitly mentioned: "Automated and progressively autonomous driving applications in road transport, actively interacting with their intelligent environment could provide an answer to the EU objective of reconciling growing mobility needs with more efficient transport operations, lower environmental impacts and increased road safety" [21]. Apart from technical aspects including research on Advanced Driver Assistance Services, other aspects are supported such as behavioral aspects of driving (users' responses to technology and on-board infrastructure, conditions of attention/loss of attention, etc.), ethical and gender issues as well as liability and standardization questions. The aim is to enhance the technology's robustness and effectiveness in real-life situations.

In sum, research funded by the EU addresses various aspects of vehicle automation, the linking of information and communication systems to enhance efficiency, and research into autonomous vehicle technologies. There are growing signs of interest in the legal and societal implications of various automation levels and efforts to develop common definitions of vehicle automation levels. In the future, there will be need for more research on legal and societal questions tied to the greater use of automation in the transport sector.

#### 8.3.3 Actors and Arenas for Autonomous Driving in the EU

At the European level, different Directorates General (DG) are involved with questions addressing autonomous driving, with DG Connect being somewhat more engaged than for example, DG Mobility and Transport (MOVE) or DG Enterprise and Industry (ENTR). In general, the EU Commission's interests in the transport area are more related to strengthening competitiveness throughout the whole Union including in remote areas (by e.g. supporting basic infrastructure development) and combating climate change (i.e. e-mobility, urban development that supports public transport, bicycles, etc.) and not so much on implementing a vision of wide-spread use of autonomous driving vehicles.

DG Connect supports research in the field of automated mobility. It mainly addresses the research on intelligent transport systems (ITS) and highlights the role of ICT for ITS and mobility for it helps to reduce greenhouse gas emissions, increases energy efficiency in the transport sector, and enhances safety and mobility for people and goods in general. ICT is, however, mostly connected to the provision of real time traffic information and not explicitly to autonomous road vehicles.

Information on autonomous driving is generally best assessed from DG Connect. While various aspects and projects are listed on their website, DG Connect forwards the reader to the iMobility Forum when looking for 'Automated Driving'. iMobility is one of the two main platforms on the European level that addresses vehicle automation. Via the iMobility Forum, the Commission is in contact with stakeholders. The platform is chaired by DG Connect and co-chaired by ERTICO-ITS Europe as well as the European Automobile Manufacturers Association (ACEA) and the European Association with tolled motorways, bridges and tunnels (ASECAP). Within iMobility, there is a working group on vehicle road automation. DG Connect partly finances this network. The iMobility Forum is linked to the ERTICO platform on intelligent transport systems in Europe. It was founded as a joint initiative by the European Commission, national transport ministries as well as industry representatives and aims to be a networking platform to spur exchange between actors and stakeholders related to all kinds of aspects of intelligent transport systems. It gives an overview about various research projects and activities in European Member States on ITS—and accordingly, automated vehicles [16].

In addition, the European Union provides a platform for debating visions of the future: FUTURIUM, part of the Digital Agenda of Europe. Here several articles about autonomous driving can be found.

To summarize, autonomous driving is not strategically anchored in European policy-making. The overarching discourses and objectives in the European transport sector can be subsumed under the headlines "competitiveness", "sustainability", "efficiency", "low-carbon" and, to a lesser degree, "safety". While autonomous driving can arguably contribute to any of these overarching objectives, stakeholders have not yet made much effort to make these links. The actors most actively addressing autonomous driving at the EU level deal with communication technologies, smart mobility, and intelligent transport systems (DG Connect including links to the EU's vision for the Digital Europe). The automotive industry is mainly represented by its association. Individual companies do not appear very active on this issue at the EU-level. Autonomous driving is still in the realm of research rather than implementation and there exists no delineable vision for a future where autonomous vehicles play a major role. The use cases addressed in this book do not play a role at the European level. In addition, there is a lack of integration of the topic into existing visions on transport and mobility. The needs for regulation and further research and development are being discussed in working groups both at the European and the German national levels, although autonomous driving is not high on the political agenda in either case. While the European Commission's administration is (co-) funding some of these initiatives, it has not taken a lead on the regulatory front; rather it is mostly active in supporting research and development. This is similar to the case in Germany. The issue of autonomous driving is on the radar screen of the German transport ministry and major associations but is only now slowly beginning to gain somewhat more attention. As is discussed further below, one relatively important new development is the reform of the United Nations Convention on Traffic Safety of 1968 that has been pushed by European automakers concerned about losing ground to international competitors. Next on their agenda is likely to be enabling legislation at the national level for testing purposes.

#### 8.4 National and International Legislative and Political Developments

There are some differences in national discourses and support strategies for autonomous vehicles in major automobile producing markets and in the European Union. Below we consider developments in the United States, Japan, the European Union, the United Kingdom, Sweden and Germany. A common characteristic of these countries and the EU is that they lack national regulations for autonomous vehicles. It has been with state-level regulations in the United States and special permits in the case of European countries that test driving of self-driving cars has begun on public roads [33].

#### 8.4.1 Regulatory Changes to the United Nations Convention on Road Traffic (Vienna Convention)

Reacting to developments in the United States, at the European level debates about the need for modifying the United Nations Convention on Road Traffic (the Vienna Convention) which had been on-going for about a decade, intensified. Article 8, paragraph 5, of the 1968 convention states: "Every driver shall at all times be able to control his vehicle or to guide his animals" [5]. Before Google pushed the debate forward, there was considerable disagreement among experts as to how much of an obstacle the Vienna Convention was. Google's release of its Self-Driving Car tipped the scale in the direction of regulatory change. As reported by Euractiv in the summer of 2013: "The EU is currently slightly lagging behind the U.S. Autonomous driving is forging ahead in the US where steps are currently being taken to advance the technology by states adopting laws allowing for public road testing. However, Europe continues to lag behind the US with restrictive legislation that could, for the foreseeable future, effectively prevent the introduction of more advanced autonomous driving systems". The report notes that "while the technology is ready, appropriate infrastructures and legal framework are still missing" [34]. In May 2014, the governments of Germany, Italy, France, Belgium, and Austria jointly proposed an amendment that was agreed to by the U.N. Working Party on Road Traffic Safety. The amendment would allow self-driving technologies as long as the system "can be overridden or switched off by the driver" [40]. If agreed upon by the parties to the convention, this could ease conditions for research and development of autonomous vehicles in many countries. For a more critical discussion see also Sect. 8.4.6.

#### 8.4.2 USA

The United States is the most advanced nation in terms of introducing autonomous driving vehicles into its transport system. Legislation on autonomous driving has been passed in California, Michigan, Nevada, Florida, and the District of Columbia. In another six states —Arizona, Colorado, New Hampshire, Oklahoma, Oregon, Texas—the legislative attempts failed or are pending. There are another dozen of states with ongoing regulatory initiatives. Some common features of their regulation regard the definitions of autonomous driving and autonomous vehicles employed and the conditions for obtaining operation and testing permission. Liability issues are also beginning to gain attention. California has set a 2015 deadline for the establishment of liability rules [48]. The legislation enacted in the United States is in many ways with an eye towards the testing of autonomous driving vehicles as it is currently very restrictive regarding their use. At this stage neither the U.S. government nor the automotive industries want to take large risks in relation to a technology that is still in an early development stage and that must still prove its reliability and safety. The same could be said for the other countries looked at here.

Regulatory initiatives in the United States were a direct response to Google's push for legal clarification regarding the status of autonomous vehicles. Google, an active developer of self-driving soft-ware and technology, has lobbied state by state for the legislation enabling the operation of self-driving vehicles.

Various U.S. politicians have strongly spoken up for the technology. Governors and other state politicians have on various occasions praised autonomous vehicles in public and claimed their leadership relative to other states by being frontrunners in passing supportive legislation.

Nevada Governor Brian Sandoval in early summer 2011 upon the passage of his state's first law on autonomous driving vehicles stated: "Nevada is the first state in the country that is going to be (adopting) regulations for this vehicle (…) I think it is important for Nevada to be first on this. This is going to be part of the future and Nevada has always been a very progressive state" [49]. In the Florida Senate, Republican Jeff Brandes sponsored an autonomous driving bill stating, "this legislation is about vision and leadership for the 21st Century world and forges a path for future innovative economic opportunities for Floridians" [42]. In September, when signing autonomous driving into law, Californian Governor Jerry Brown pointed out that he sees autonomous vehicles as "another example of how California's technological leadership is turning today's science fiction into tomorrow's reality. (…) This law will allow California's pioneering engineers to safely test and implement this amazing new technology" [2]. Noting that the state was slipping behind competitors, Michigan's Governor Rick Snyder urged action. In his state of the state speech in January 2013 the governor lamented: "They [California, Nevada and Florida] are ahead of us, and aren't we the automotive capital of the world?" [6]. These examples give a clear impression of how politicians are starting to see autonomous vehicle technology and why they are promoting autonomous driving. For the leaders of these pioneering states, autonomous driving is seen as a sign of being on the technological cutting edge. The technology's developers stress the safety benefits expected to come with the implementation of the technology, the increased comfort it will provide for elderly people, and the reduction in traffic congestion it should bring about.

Google has been an important entrepreneur that has stimulated both technological and regulatory developments. Google is a new and non-traditional player in transport, a sector which until now has been dominated by the automotive industry. With its retrofitting of automobiles with robotic software, the IT-company has challenged the automotive industry to innovate in new directions (Chap. 10). As noted above it has also put regulators under pressure to take action. Indeed, regulations have had to catch up with the technological innovations. Google's actions have also pushed self-driving technologies onto the international agenda. It has opened up new research agendas and challenged policy makers and legal experts to consider the technological and social meanings of this rapidly developing new technology. In the European Union as well as internationally, it is also leading to discussions about the need for early harmonization of standards so as to prevent the institutionalization of incompatible standards in different world regions, e.g. via United Nations Economic Commission for Europe (UNECE) regulations and vehicle type approvals that make sure that a vehicle design is conform to technical requirements. Beyond these issues, the role of ICT in the automotive industry of the future and very importantly, data protection concerns, will need societal debates and decisions.

In May 2013, the National Highway Traffic Safety Administration (NHTSA) established an official classification scheme for vehicles which range from level 0 where the driver is in complete control of the vehicle at all times to level 4 where the vehicle performs all safety-critical functions and monitors roadway conditions for the entire trip and could include unoccupied cars. The intermediary levels make increasing use of autonomous vehicle technologies. The NHTSA also issued recommendations to aid states as they make regulatory decisions regarding vehicles with new technological capacities [1]. There are other classification schemes that have developed as well. In particular the comprehensive SAE Standard J3016. It distinguishes between six categories with levels 0 (no automation), 1 (driver assistance) and 2 (partial automation) subsumed under the headline "human driver monitors the driving environment" and 3 (conditional automation), 4 (high automation) and 5 (full automation) labeled as "automated driving systems" [44] (see also Sect. 8.4.6 for the BASt classification scheme).

#### 8.4.3 Japan

Influenced by Google's lobbying at the state level in the United States, Japan has begun to exhibit more interest in autonomous vehicles. Japan is renowned both for its robotic technologies and its low-carbon vehicle technologies. In 2013, Nissan received approval from the Japanese authorities to test its self-driving car, the Nissan Leaf. The Leaf is the first car that combines an electric motor with an advanced driver assistance system [3]. Kanagawa Governor Yuji Kuroiwa and Nissan Vice Chairman Toshiyuki Shiga tested the car on the Sagawa Expressway near Yokohama [38]. Prime Minister Shinzo Abe also has tested several "self-driving cars" produced by Japanese manufacturers Toyota, Honda, and Nissan and has claimed that he senses "that the Japanese technology is the world's best" [39]. "In particular, in tough driving conditions such as tight curves and lane changing using autonomous driving, I think our Japanese technologies are among the world's best" [37]. The competition to be a leader in the field is clearly heating up and politicians are lending their visibility and weight to support this emerging technology.

#### 8.4.4 United Kingdom

The situation of the United Kingdom is emblematic of the situation in many European states. There is growing concern that national automobile developers are being hampered by regulatory restrictions and lack of a clear political strategy for autonomous vehicles. A September 2013 advise of the British Houses of Parliament, Parliamentary Office of Science and Technology notes, "There is no explicit legislation which governs autonomous vehicles on UK roads". The advice further laments: "At present there is no published strategy for the adoption of autonomous vehicles in the UK" [29]. As is the case with several other European member states, steps to improve the possibilities for testing are being taken. The British Ministry of Science and Universities has designated £6 million for research and technology into autonomous vehicle technologies and the Department for Transport is permitting trials on public roads.

#### 8.4.5 Sweden

Sweden is an early pioneer of self-driving technology. The Swedish Government signed a memorandum of understanding with Volvo to allow ordinary people to use self-driving cars. The project involves the Swedish Transport Administration, Lindholmen Science Park and the City of Gothenburg. It is the first project that aims at testing autonomous vehicles on a larger scale with regular citizens. The project which started in 2014 aims at putting 100 autonomous vehicles onto a 50 km long road in Gothenburg by 2017/2018. It also sets the year 2020 as a timeline for when the first autonomous cars will be available for general usage [28].

The collaboration between the Swedish government and Volvo in this project suggests that in Sweden there is political recognition of the potential importance of this new technology. Swedish public officials highlight not only the safety dimensions of the new technology but also other sustainability factors. Ms. Catharina Elmsäter-Svärd, the infrastructure minister listed the many challenges to be tackled in the years to come that would be addressed by autonomous vehicles. These included environment, climate change, space, and traffic safety. In Europe, there appears to be a stronger linking of broad sustainability themes to driver-less cars than is the case in the United States [47].

Claes Tingvall from the Swedish Transport Administration explained why cooperation between the government and Volvo makes sense. Such cooperation can help address legislative questions regarding the new technology early on. At the same time, the societal benefits from the new technology can be incorporated into policy more generally: "We can make traffic as a whole safer, smoother, less polluting, but also try to build infrastructure in a quite different way". Minister Elmsäter-Svärd noted: "This project is very unique and the expectation from the Swedish government is still to be in the lead when it comes to road safety. We know that livability, environment issues and also road safety is so close together in the project." Noteworthy, is that the inscription on the Volvo self-driving car states: "Drive Me. Self-driving cars for sustainable mobility" [47].

#### 8.4.6 Germany

In Germany, autonomous driving vehicles are in the testing phase. For public demonstration purposes, the former Minister for Research and Development, Annette Schavan tested the autonomous driving vehicle, "MadeInGermany", developed at Freie Universität Berlin. Autonomous—Autonomie- und Fahrerassistenzsysteme für Pkw und Lkw"—was supported with 2.2 Million Euros by the Research Ministry. In an interview, Minister Schavan mentioned the necessity for further innovation of the technology as it could enhance the mobility of elderly and handicapped people [41]. Apart from AutoNOMOS, various other research projects in Germany helped to advance an increase in automation towards autonomous driving, including the Technical University of Braunschweig's H-Mode and TU Darmstadt's' Conduct-by Wire projects.

The research ministry, which is interested in supporting innovative technologies and advancing technological niches, has set incentives to promote research on autonomous driving. The ministry's high-tech mobility strategy stresses links among energy policy, e-mobility and intelligent logistics. It further stresses the role of ICT applications in the automotive industry, although it does not focus explicitly on autonomous driving [11]. But not only has the research ministry funded research on autonomous driving. Currently, there are more projects under way which are funded by the Federal Ministry for Economic Affairs and Energy, one of which is the project Afas. It is set up to develop a driverless vehicle to protect construction sites on highways.

The Federal Highway Research Institute has—similarly to the NHTSA—elaborated a nomenclature to facilitate the legal assessment of different degrees of automation. The nomenclature distinguishes "driver only" and "assisted" systems from systems with "partial automation" (the system takes over lateral and longitudinal control in certain situations), "high automation" (the driver does not need to continuously monitor the system) and "full automation" (the system fully takes over lateral and longitudinal control) [25]. This categorization is widely accepted by German experts, bureaucrats, and political stakeholders.

The German automotive industry has begun pushing for change. Partnering with Nokia, Mercedes-Benz responded to the Google challenge in August 2013 with the S 500 Intelligent Drive Autonomous Car long-distance test drive. Following the historic path travelled by Bertha Benz in 1888 in the world's first long-distance road trip, the S 500 Intelligent Drive vehicle successfully drove on its own between Mannheim and Pforzheim (with a driver behind the wheel as a back-up). Audi, BMW, and auto-suppliers Bosch and Continental Automotive Systems are working on autonomous and semi-autonomous vehicle technologies as well [40].

The German government has not, however, responded with new regulatory initiatives or an explicit strategy to push the implementation of autonomous driving. Rather, governmental actors are focused on other technology options that are rather conform to European discourses of sustainable mobility. These are linked to the broader over-arching policy towards a low-carbon energy transformation. E-mobility, for example, is not only backed by a strategic governmental document but also repeatedly affirmed in speeches by high-level politicians, including the chancellor [9, 10].

The VDA is one of the technology's strongest proponents lobbying for regulatory change. It is one of the few actors that has expressed a clear vision for autonomous driving in its publications. The VDA has organized conferences centered on vehicle automation, the connected car and autonomous driving The VDA envisions autonomous driving to be a wide-spread reality in the future. The association has illustrated concrete steps to be taken on the way towards a self-driving future, such as Lane Changing Support, improved human-machine-interface, and longitudinal guiding assistance [45]. In addition, supply companies have an interest in pushing a higher degree of automation in vehicles and, consequently, autonomous driving [7].

The main national arena addressing autonomous driving is a round table initiated and run by the Transport Ministry. On the working level, the participants are trying to institutionalize a stakeholder dialogue as a first step in getting the issue more strongly on the German political agenda. The approximately 45 round table members meet twice a year. They consist of representatives of the German Association of Automotive Industry (Verband der Automobilindustrie, VDA), representatives of automotive manufacturers, the Ministry of Transport, the Federal Highway Research Institute (BASt), the Federal Motor Transport Agency (KBA), the Ministry of Justice, the Ministry of Economy and Energy, representatives of science and research (e.g. Fraunhofer Institute, German Aerospace Center (DLR), universities) and associations (such as the Association of International Motor Vehicle Manufacturers (Verband der internationalen Kraftfahrzeughersteller, VDIK), the German Insurance Association (Gesamtverband der Deutschen Versicherungswirtschaft, GDV), the German Automobile Club (Allgemeiner Deutscher Automobilclub, ADAC), and the Association of the Technical Control Boards (Verband der TÜVs). Three working groups have been established and meet four times a year. The working groups are concerned with legal questions, issues tied to drivers and vehicles including type approval, and research.

The focus on type approval—the procedure whereby an EU Member State certifies that a type of vehicle, system, component or separate technical unit satisfies the relevant administrative provisions and technical requirements [23]—in the second working group on driver and vehicle, shows that the round table aims at dealing with many issues at a technical and rather low regulatory level (compared to more general legal questions that would require changes in regulatory law or in the road traffic act). Many aspects of automation do not touch upon regulated aspects and would be generally allowed since they are not defined under the UNECE system. Higher level legal aspects would be in the realm of the Ministry of Justice but are currently not dealt with.

The topics discussed at the round table address highly automatized vehicles but tend not to address fully automated driving technologies.

The round table talks are to some degree strategic in that they aim at putting or keeping the topic on the political agenda. It is not so much about visions but about attempts to show progress in practice. However, the whole process is neither very transparent, nor very visible—meeting discussions are not documented for the general public and societal stakeholders are not widely included. There is also little exchange with European platforms on autonomous driving.

In relation to the Vienna Convention, different views regarding the importance of its amendment have been expressed in Germany. The amendment was welcomed by Thomas Weber, head of group research at Daimler and head of development at Mercedes-Benz who was quoted as saying: "Today I am only allowed to take my hands off the wheel to a limited extent. Thankfully the Vienna Convention on Road Traffic has been changed" [40]. Other German experts did not see the convention as so much of a hindrance in relation at least in regard to the highly, but not fully-automated vehicles. By definition, in highly automated vehicles, a driver would always be expected to be present and able to take over control and monitor traffic as expected by current legislation. These experts considered amendments to public regulatory law to be more important and this has yet to occur [25, 43]. In a personal interview, Dr. Christoph Hecht from the German Automotive Club, ADAC, representing the consumer perspective explained that a customer has no incentive to buy a highly automated vehicle unless they are allowed to make use of it.

#### 8.5 Analysis

Autonomous driving is only slowly emerging as a concept known to all but a small community of experts. It is not deeply anchored in European mobility discourses, strategies, or outlooks. Yet there is some linking of autonomous driving technologies to other strategic concerns, including competitiveness of the automotive industry, sustainable mobility, safety, and the elderly. The framing of autonomous driving varies by national context, reflecting the dominant concerns of different regions. In the United States, where there are over 30,000 traffic deaths each year, safety issues are brought to the fore. In Japan, which has been faced by a long economic slump, competitiveness is a top priority. In Sweden, autonomous driving is of being linked to sustainable mobility. In Germany, it is high-end automobiles that are being fitted with autonomous driving technology, suggesting the importance being at the technological cutting edge in the luxury automobile market. As autonomous vehicle technologies advance, debates in Europe and abroad may shift, but for the timing being it appears that the commercialization and wide-spread use of fully automated driving vehicles remains a distant vision.

Innovations in autonomous driving technologies are being presented as important for technological leadership in the automobile sector across all of the jurisdictions examined here even if autonomous vehicles are not yet seen as commercially viable.

In the United States, regulatory competition is emerging among states eager to be seen as frontrunners in systems that could make traffic safer and traffic flows smoother. State-level actors are boasting their regulatory initiatives to show their state's technological leadership. Leadership in realizing 'science fiction' visions may be important for long-term competitiveness. This could either be seen as a kind of "Delaware effect", with states competing to attract industries to their region with the provision of favorable regulatory environments, or conversely, a "California effect," where states compete with each other by establishing the more advanced regulatory standards to promote technological innovation and competitive advantage within their own states [46].

In Japan, politicians are sending the message to consumers (both domestic and overseas) that autonomous driving technologies can be linked to Japanese technological strengths in robotics, electro-mobility and energy efficiency, to produce next generation automobiles. The Swedish government is among the most ambitious in its aim to commercialize autonomous driving vehicles by 2020 and set "sustainable mobility" into motion.

The German government has done little to initiate broader discussions about autonomous driving. While the Transport Ministry has organized a stakeholder platform at the national level, it has not tried to stimulate wider public debates at the German national level or as part of official consultations at the European level. The main push for greater discussion and strategizing has come from stakeholders. Volvo, for example, has been quite active at the EU level as has the German automobile association (VDA). Also component suppliers such as Continental and ICT companies have lobbied for more support.

Although by no means definitive, the research conducted here suggests some other interesting patterns that deserve further attention as well as some soft and preliminary conclusions.

First, the kind of regulatory competition seen in the United States, may be spreading to the international level as countries vie with each other for technological leadership in a newly emerging field. Autonomous driving is not only about the automotive industry but about many other industrial branches that will profit from a higher degree of automation such as component suppliers. This is why there is a growing interest in promoting locational advantages and why political commitments are starting to be made in some countries to support certain development paths.

Second, smaller automobile companies (e.g. Volvo, Nissan) and non-traditional players (e.g. Google) moved earlier with autonomous vehicle technologies to gain public and political attention compared with the bigger, more established automotive manufacturers (including German manufacturers). One might read into this that given that autonomous driving technologies are still at early stages of development, larger companies have been weary about taking reputational risks with still unproven technologies. Smaller companies may be more willing to take such risks since they are dependent on leadership advantage. Geels argues that incumbent firms' interest in radical and transformative change is generally not very high since incumbents have typically sunk investments in existing technologies, skills, and people. He further points to the characteristics of more radical changes being more risky and leading to changes that may not match existing competencies [27].

Third, autonomous vehicles are portrayed as highly innovative and demonstrative of a nation's technological (and economical) leadership capabilities by stakeholders, yet political leaders have not played much of a role in trying to promote autonomous vehicle technology in public. Fully automated vehicle technology is in an early development stage. How it fits into dominant strategic visions for mobility or how realistic commercialization of the technology is, is still not clear which may explain why only limited political actions have been taken.

Fourth, the Zero-Accident-Vision has been an important message for developers of autonomous vehicles and component suppliers. The vision appears to play a larger role in the United States where there are higher fatality rates than is the case in Europe or Japan although in all countries considered, greater use of remote sensing and other technologies is seen as a means of improving traffic safety.

Fifth, links to efficiency and environmental protection are found in all countries, but are especially strong in Japan and Europe. And within Europe, Sweden is pursuing this image quite aggressively.

Sixth, there are many unsolved questions with regard to accountability, data protection, the legal framework as well as social and ethical considerations. These issues are only slowly beginning to be debated. The possible impacts of autonomous driving on mobility behaviours and human-machine interactions as well as data protection and acceptance aspects will need to be studied and addressed. Indeed, nowhere has there been much political attention paid to the societal implications of greater use of autonomous vehicle technologies even though there are many non-technical aspects that must be considered (Chap. 29). These include the development of appropriate regulations covering technological, safety, and liability standards as well as rules of the road for autonomous vehicles. There remain also many open questions with regard to public regulatory law, licensing law and liability law in the countries considered (Chap. 25).

Seventh, perhaps reflective of the fact that autonomous vehicles are still only in early pilot testing phases, few efforts have been made to develop future mobility scenarios in which autonomous driven vehicles play a central role (Chap. 11). In Europe, the driverless-car vision has not been embedded in an overall strategy for realizing sustainable mobility.

Finally, where the most governmental activity can be seen is in providing support for research and development of autonomous vehicle technologies. States that are lagging behind technologically are scrambling to catch up by supporting more research and development. There are still critical technical issues that need further developing before a wide-scale application of autonomous driving can be considered and this provides opportunities for new entrants. There are also uncertainties regarding which technologies may win out in the long run.

#### 8.6 Conclusion

Since there are already numerous technological solutions being implemented that are linked to various societal goals (e.g. e-mobility, intermodal solutions, strengthening public transport), autonomous driving will have to be debated in the context of these (competing or complementary) technological paths. Discussions about future mobility possibilities and the role that could be played by autonomous or partially or highly automated vehicles should be more inclusive. It should not be restricted to an arena primarily concerned with technical and legal questions such as the round table in Germany. Other stakeholders such as non-governmental organizations or think tanks could be integrated into existing structures (stakeholder platforms, legal processes, etc.), but new arenas could also be created. In parallel, advisory bodies could be set up to assess not only technological advancements and needs, but also social, environmental, and regulatory implications of greater use of autonomous driving technologies.

Open Access This chapter is distributed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, duplication, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, a link is provided to the Creative Commons license and any changes made are indicated.

The images or other third party material in this chapter are included in the work's Creative Commons license, unless indicated otherwise in the credit line; if such material is not included in the work's Creative Commons license and the respective action is not permitted by statutory regulation, users will need to obtain permission from the license holder to duplicate, adapt or reproduce the material.

#### References


# 9 New Mobility Concepts and Autonomous Driving: The Potential for Change

Barbara Lenz and Eva Fraedrich

#### 9.1 Introduction

Transport is an expression for the satisfaction of mobility needs with different means of transportation—for everyday travel, people walk, cycle, drive or take public transport. There are two main groups here: people with a distinct preference for using private vehicles, and people who prefer so-called "ecomobility"—the combination of public transport with walking and cycling [1]. In addition, a group has been emerging for some years of "multimodal" users, who no longer restrict themselves to a particular mode or mix of modes, but rather exhibit a wide range of modal use in their personal repertoire [1, 2]. This gradual transformation in behavior has coincided with the development of new mobility concepts that, firstly, involve a further development of conventional carsharing [3], but also supplement established ridesharing with new forms. New concepts already in operation include flexible carsharing fleets, such as those of Car2Go, DriveNow and Multicity, that are available as mobility services in cities in Germany, and across Europe and the USA. In parallel to this has been the emergence of so-called peer-to-peer services, where private owners make their vehicle available to a community of members via an internet platform. On online platforms such as Mitfahrzentrale and Zimride, private individuals offer rides on routes and at times when they themselves will travel in any case. Additionally, more and more services such as Uber and Lyft are currently starting up, where the distinction between (semi-)professional individual transportation, comparable to taxi services, and "standard" ridesharing is not always so clear-cut. The new forms of car

B. Lenz (&)

B. Lenz E. Fraedrich

German Aerospace Center (DLR), Institute of Transport Research, Berlin 12489, Germany e-mail: barbara.lenz@dlr.de

Geography Department, Humboldt-Universität zu Berlin, Berlin 10099, Germany e-mail: eva.fraedrich@geo.hu-berlin.de

and ridesharing services have primarily arisen in the major cities and metropolitan areas of industrialized countries.

What is new, and also special, about these mobility concepts is the high degree of flexibility they offer users. Flexible carsharing vehicles are available at any time and for any duration, with no pre-planning. The new ridesharing services are similarly flexible, although in this respect they resemble conventional taxis. One essential prerequisite for the emergence of all new mobility concepts is the possibilities that information and communications technology now offer for networking vehicles, users, and operators. This is what makes fundamentally fast and easy access to vehicles or services via the internet or smartphone apps possible in the first place. Access, in the sense of the physical distance between the user's location and the vehicle, is still a hurdle, however, particularly in areas where vehicle density is not very high.

With the introduction of autonomous vehicles, it seems possible to appreciably extend and diversify existing mobility concepts. Accessing and egressing a vehicle is changing, in that the user no longer goes to the vehicle, but the vehicle comes to the user. Vehicles themselves are becoming usable for a wider section of the population, e.g. those with impaired mobility. New forms of public transport are possible, also in the sense of further blurring the boundaries between private and public transport.

This article aims to introduce these options and the expectations accompanying them, concentrating on carsharing. First, we shall outline the current state of provision and usage of so-called "new mobility concepts," at the heart of which is carsharing. The main section discusses the opportunities and challenges resulting from the introduction of autonomously driving vehicles into carsharing fleets. There are currently a series of indications that spontaneity and flexibility could be particularly significant factors in the use of new mobility concepts (see [11, 13]). Precisely this increased spontaneity could be the starting point for new mobility concepts with autonomous vehicles. The operators of flexible carsharing fleets are already thinking on such lines [4].

#### 9.2 Carsharing: "Core Application" of New Mobility Concepts

There has been carsharing in Germany and numerous other countries since about the 1980s. Carsharing is here understood as the operation of a fleet of cars that is available either in station-based or point-to-point systems. Every holder of a valid driver's license can register as a member of a carsharing organization—usually upon payment of a registration fee—and thus acquire access to the vehicles. The basic variations in carsharing result from the spatial and temporal conditions for vehicle access, and also from the business models; Fig. 9.1 summarizes the various concepts' main features.

Fig. 9.1 Scheme for car use in the tension between private and commercial use

#### 9.2.1 Station-Based Carsharing

The standard form of carsharing is station-based carsharing, where vehicles are furnished at "collection points." The user must pick up the vehicle there and bring it back to it. The length of use is agreed in advance. In contrast to traditional rental cars, station-based carsharing vehicles may be rented by the hour, as well as by the day, although hourly rental is now also increasingly available among rental companies. Users pay a basic annual fee and vehicle use is charged according to duration and mileage. This varies according to organization or provider, and can also be adjusted according to demand, depending on time of day and day of the week. There is no restricted area of operation. When these services began, reserving vehicles largely took place over the phone; bookings are now also made on provider websites or mobile device applications.

At the time of writing (2014), station-based carsharing is available at approximately 3900 stations in 380 cities and municipalities in Germany [5, 6]. This also includes a whole series of medium and small towns. There is already very good coverage in German cities of over 100,000 inhabitants, while only 5 % of municipalities with less than 50,000 population have carsharing services available [7]. The 3900 stations are served by a fleet of 7700 vehicles from some 150 carsharing providers. The German market leader is Deutsche Bahn (Flinkster), which owns around 55 % of the station-based fleet [8, 9]. The worldwide leader in standard carsharing, with a fleet of about 10,000 vehicles in the USA, Canada, the UK, Spain, and Austria, is the American company Zipcar, founded in 2000 and currently owned by the Avis Budget Group (as of August 2014).

#### 9.2.2 Flexible (One-Way) Carsharing

New forms of carsharing have emerged in recent years. Especially in Germany, but also in the UK and USA, a new type of commercial carsharing, known as "flexible," has appeared. Its flexibility mainly consists in not needing to previously arrange the time and duration of use with the provider, and not having to pick the vehicle up, or bring it back, to a specified location. Instead, the user collects the vehicle from wherever he comes across it, and leaves it at any random position within an operating area defined by the provider. The user acquires information on what vehicles are available at a particular location on the internet or via a smartphone app. In principle, a vehicle can also be rented "in passing," i.e. a user rents a parked, non-reserved vehicle on the street. It is also necessary to be registered with the fleet operator to use a vehicle, which is initiated via a chip card or, most recently, directly via the user's smartphone.

The worldwide leading corporation in flexible carsharing is Car2Go, with more than 10,000 vehicles in 27 cities in Europe and North America (as of August 2014). In Germany, flexible carsharing providers have a combined fleet of around 6250 vehicles [5]. These, however, are in service almost exclusively in large cities of more than 500,000 inhabitants such as Berlin, Hamburg or Munich. Furthermore, the operating areas do not cover the entire territories of these cities, but are limited to a part of them, mainly the city center, its bordering neighborhoods and "island zones" with high usage frequency. Apart from a one-time registration fee, there are no further regular charges. Vehicle usage is charged on a time-dependent scale, mostly per minute. As with station-based carsharing, fuel costs are included in the fare. Moreover, parking fees are also included, which are normally agreed on a flat-rate basis between the provider and the municipality.

Flexible carsharing started as a pilot project of Car2Go, a Daimler Group company, in 2009 in Ulm (Baden-Württemberg, Germany). Other relevant operators by now include DriveNow, active since 2011 and a venture by BMW and Sixt Autovermietung; and also Multicity, a joint venture between Citroen and Deutsche Bahn that operates vehicles powered purely by batteries. At the same time, new operators are increasingly attempting to break into the market: Quicar, for example, which belongs to the Volkswagen group, or Spotcar, which launched in Berlin in June 2014.

#### 9.2.3 Peer-to-Peer Carsharing

Peer-to-peer carsharing—hiring out private cars between private individuals—is only in the first stages of evolving into the third form of carsharing systems using online communication platforms. Precise user numbers are not yet available. In this system, bookings are processed via an online platform. There are no picked up and dropped off stations. Vehicles are instead picked up and drop off at specially agreed locations. A glance at a web platform such as www.autonetzer.de is enough to show that this form of carsharing is in no way limited to large cities, but can also be found in smaller cities and municipalities. This would appear to confirm Hampshire and Gaites' assumption [10, p. 14] that

peer-to-peer carsharing is scalable in form—in contrast, for now at least, to commercial carsharing. The fleet composition is also markedly dynamic, as persons who are prepared to offer their car do not appear to do so constantly, as a basic mode of behavior. The findings of a study in Berlin instead suggest that car owners only make their vehicles available at certain times, for example when they themselves use them at low levels due to personal circumstances [11].

#### 9.3 Users and Use of the New Mobility Concepts

The objectives associated with carsharing vary depending on the perspective of the parties involved. The political context in Germany largely involves setting up the necessary framework conditions to implement carsharing on the local level. The essential motives here are to reduce private car traffic volumes (as carsharing users also increase the share of public transport in their modal split over the duration of their carsharing use), to concomitantly lower CO2 and air pollution emissions, and to shrinking the amount of land used by non-moving car traffic (see Chap. 19). Commercial operators, such as car manufacturers (generally in cooperation with car rental companies) or transport service providers such as Deutsche Bahn, use carsharing to pursue product-related strategies. Extending their provision with an (additional) mobility service, or offering their own brand's attractive vehicles, thus generating brand allegiance, are two examples. Other motives for operating a carsharing fleet include decidedly ecological aims, which have essentially driven carsharing's emergence, and which are adhered to by interest groups and associations [12].

#### 9.3.1 Users and Usage Conditions

Carsharing users in 2014 form a specific group in view of both composition and mobility behavior. They are clearly above the population average in various respects: proportion of under-40s, proportion of men, proportion of people with high levels of formal education (high-school diploma, higher education graduate) and household income. This deviation from the population mean is more highly pronounced for flexible carsharing than station-based [3]. Both types of carsharing are combined with a highly above-average use of public transportation. Studies on carsharing use from 2014 show, for example, that 52 % of Flinkster customers in Berlin and 44 % of Munich Flinkster customers have a public transport season ticket. A high proportion of DriveNow and Car2Go users are likewise season-ticket holders: 43 and 38 % of DriveNow customers in Berlin and Munich respectively [13, p. 12]; for Car2Go this figure stands at 40 % in Stuttgart and 50 % in Cologne [15, p. 13]. Nationally, the average for core-city dwellers is 33 % ([1], authors' own analysis; in Germany, official figures count all urban municipalities with more than 100,000 inhabitants in the category of "core city").

Good public transport or the possession of an own car currently appear to be essential preconditions for carsharing use. Only in this way is one-way usage possible in the flexible carsharing variant. If the user had to organize those trips that are complementary to his carsharing trip by himself, this would most likely be highly inconvenient. The attractiveness of a system that allows for individual routes would clearly fall. In the case of station-based carsharing, public transport is also often the main form of transport for users. In many cases, carsharing vehicles represent a second, supplementary car, used as needed, in car-owning households [16]. In order to meet this need, and in the sense of creating a symbiosis, there has been long-standing cooperation between station-based carsharing and public transport providers, now being replicated with the new flexible carsharing services [17].

#### 9.3.2 The Carsharer—the "New Citizen" in a Sharing Economy?

Under the slogan "using not owning," carsharing is frequently called on as an example for the transformation from an ownership economy to a "sharing economy" [18, 19]. This perhaps results from carsharing's particular visibility, as an act that takes place in public view. Behind this, however, possibly lies some astonishment at objects that are still seen as status symbols being used by several random people in a rental system.

In fact, carsharing is one in a long line of trends where "goods" that were never previously rentable are "shared" on a hire basis: owner occupied apartments, allotment gardens, cars. Economists account for whether a good can be loaned (or not) by the difference between the transaction costs accrued and the revenue that can be generated by the rental. If there is a positive difference, the rental is justified, and the greater the difference, the greater the interest in renting it out [20]. Renting something out only makes sense for individuals, however, when they have a product they do not use to full capacity —hence the renting out of cars when not in use, apartments when the owner or main tenant is on holiday, and parking spaces in front of the house during the day, when the owner is at work.

Looking at the effects of shared use essentially stems—at least in Germany—from the debate surrounding the sustainable use of resources [21–23]. At aggregate level—regional, national or even supra-national—sharing thus appears to be a possibility for saving resources. On the individual level, in contrast, sharing does not mean consuming less, but rather the opportunity of maintaining or even increasing consumption levels. Carsharing, where members have at their disposal a wide choice of vehicles, even a selection of vehicle types, can in fact be viewed as an example of this. It offers a range of consumer goods, in this case in the form of vehicles, that outstrips what the majority of private households could own themselves. On the aggregate level, less vehicles are needed (the German Bundesverband Carsharing (BCS) quotes figures of 42 people sharing one station-based vehicle and 70 persons sharing a flexible one; [5]); on the individual level, high mobility levels are nevertheless assured.

In its first years, carsharing was often associated with attitudes where car driving is not something done purely for its own sake. Car users with this attitude thus took no pleasure in driving (see [21, p. 92]). Carsharing usage was instead motivated by a desire to counter the environmental degradation for which users held the growing motorization of private households responsible [12]. It is possible that this has fundamentally changed. For instance, carsharing, in both station-based and flexible forms, has evolved into a commercial product. Moreover, studies on the use of flexible carsharing have found that aspects such as "attention received, appreciation experienced, fun and enthusiasm" are absolutely essential motivations (see [24, p. 21]: approval ratings of the corresponding statements between 38 and 86 %). Carsharing vehicles and their use here take on the emotional and psychosocial functions that were previously ascribed to cars only in the form of ownership [22]. Bardhi and Eckhardt view "sharing" (termed by the authors more accurately as "access-based consumption") as a defining characteristic of a "liquid society," in which fixed reference systems, such as those arising from property, increasingly begin to crumble [24].

#### 9.4 Digitalization of the Everyday World as a Basic Precondition for New Mobility Concepts

The development and extension of carsharing via new concepts such as flexible and peer-to-peer carsharing is inconceivable without the availability of devices with mobile internet access and communications applications. Every provider does indeed also present their carsharing product extensively on the (stationary) internet, but this is more about giving information to (potential) customers than immediate use of the service. To access the vehicles, mobile applications in particular play an essential role. In the first place, they enable the user and vehicle to be located in real time. This allows users to see what vehicles are available, and to decide whether they are willing, and able, to make the trip to the vehicle (for which, depending on the provider, they currently are given between 15 and 30 min). As a second step, the mobile application allows the selected vehicle to be reserved and offers navigation to it. With some operators, even opening the vehicle can already today be done via the app.

The potential use of such technologies thus depends largely on users being technically equipped to access the online choice of available vehicles via mobile. Rates of private smartphone ownership have in fact considerably risen in recent years. While only around 6.5 million Germans owned a smartphone in 2009, this figure stands at over 40 million today, almost every second person. For 2014, it is expected that 97 % of all mobile phone sales will be smartphones; sales of almost 30 million devices are forecast [25, 26].

At the same time, it may be assumed that hardware and software skills are increasing in all population groups. In 2013, for example, a study found that the number of internet users continues to expand [27]: in 2013, 54.2 million people in Germany were online at least occasionally. That is 77.2 % of the population, and an increase of 800,000 people on the previous year. The driver of this growth is exclusively the over-50s. Time spent online is rising concurrently: the average German internet user was online for an average of 169 min a day in 2013, 36 min more than the previous year. A considerable proportion of this was mobile internet use, practiced by only 23 % of users in 2012, but already by 41 % in 2013. Apps are used by almost half of online users (44 %) on various end devices [28].

In the transport context, what particularly stands out is the ever greater possibility of reducing planning horizons arising from digital applications and mobile devices. Spontaneity in organizing individual mobility is thus a particularly important connotation of "flexibility," the most common among the specific qualities of the new mobility concepts. Correspondingly, the statement with the highest approval rating in a 2014 survey of Car2Go users was: "What I find attractive about Car2Go is that I can use a car spontaneously, even when I am out and about without one"—98 % of respondents agreed with this statement (for 72 % it was "highly accurate", for 26 % it was "quite accurate") (see [15, p. 20]). This also goes to explaining the quick success of flexible carsharing, which is released from the (long) pre-planning required for conventional station-based carsharing. At least in the medium term, it could also take on the advantage that private cars have enjoyed until now of being permanently available (on this, see also [22, p. 64]).

Overall, this means that almost no barriers to access on the part of the (potential) users should be expected, provided that future mobility concepts tie in with what is already currently practiced ("practiced" in the true sense of the word; for an analogous comparison, see the acquisition by repeated practice in the interaction between humans and computers in vehicle navigation systems in Chap. 3). Less likely, even if repeatedly cited by the scientific community, is the conversion of the entire vehicle fleet into vehicles that are on the road on a sharing basis or operated by public transport providers. There are currently no indications that private cars are losing any of their attraction. According to the Federal Motor Transport Authority (Kraftfahrtbundesamt, or KBA), vehicle stocks in Germany reached record levels on 1 January 2014, rising by around 500,000 vehicles between 2013 and 2014. This accords with long-term trends [29].

#### 9.5 Can New Mobility Concepts Be Further Developed via Carsharing's Automation?

There are a series of variants for the further development of existing carsharing concepts using autonomous vehicles, which run in parallel to the use cases outlined in Chap. 2. These variants are aimed at different user needs which are already being addressed, albeit via a human driver. In the following, we shall discuss the "Full Automation Using Driver for Extended Availability," "Autonomous Valet Parking," and "Vehicle on Demand" use cases, and also ask: What changes would carsharing experience with an influx of autonomous vehicles? What effects can be expected for the user? Competition with currently existing transport provision will also be addressed.

In all use cases, the highest degree of automation is assumed—"fully automated," according to the nomenclature of the German Federal Highway Research Institute (Bundesanstalt für Straßenwesen, or BASt) [30]. The difference in the cases lies in the uses encompassed in their definition. Autonomous Valet Parking, for instance, exclusively involves picking up and parking vehicles. Full Automation Using Driver for Extended Availability, on the other hand, covers every conceivable use in road traffic, even if the emphasis is on situations with comparatively simple traffic mixes, such as freeway traffic, where high speeds also prevail. In this use case, the driver must take over the driving task at certain times and on certain route sections where clearance for autonomous driving has been temporarily or permanently withheld. A Vehicle on Demand is likewise in a position to deal with any potential usage scenario, including those with mixed traffic. By renouncing the so-called driver's workplace—the seat from which the driver performs the driving task—the potential uses of the vehicle interior increase greatly in comparison to Valet Parking or Full Automation.

#### 9.5.1 Autonomous Valet Parking in Carsharing

The Autonomous Valet Parking use case starts from the assumption that the vehicle will be able to independently move from parking space to user and vice versa, even on public roads.

The use of Autonomous Valet Parking in carsharing would initially mean that the effort required for the user to procure the vehicle and park it after use would fall considerably. Instead, from the user's point of view, there would be a door-to-door service—comparable to taking a taxi, although one in which the user takes over the driving task for the actual journey. The overall travelling time would in any case be reduced with the shortened time and distance for accessing and egressing the vehicle.

In order to make the service more attractive, various enhancements would be possible, regardless of automation. These could be options in vehicle features: number of seats, carrying capacity, internet access, and multi-media provision. How greatly the options differ would depend—as with today's carsharing—on the fleet size, the number of (potential) customers per vehicle and the size of the operating area, and also on the readiness of customers to pay for various optional features. In a large fleet, it would also be possible to have a differentiated price scale for different vehicles, comparable to that currently found in station-based carsharing and traditional car rental. This is in contrast to current flexible carsharing business models, which possibly have the added attraction for users that they can use a large range of vehicles from the current fleets for the same price.

With Autonomous Valet Parking, providing vehicles at a station becomes essentially superfluous. Carsharing provision as a whole could thus be made flexible—at least in that fetching and returning the vehicle would be unnecessary. The operators, of course, would still need their stations or vehicle depots to keep things centralized to a certain extent, which is more efficient for vehicle maintenance. These stations, though, would no longer need to be built in the greatest possible proximity to customers, but could instead use low-cost land. The distance to the journey/start end points is not arbitrary here, however, as there may be a relatively small time window for getting to the customer. Moreover, the journey to the customer also uses resources and is also "dead" time if no other use is possible for the vehicle on the way.

As an alternative, or supplement, to this, numerous smaller collection points with a few vehicles could be spread relatively densely across the operating area. This would keep the time between ordering and picking up a vehicle down. A mixed form of vehicle ordering with optional autonomous collection or picking up in person would also be possible. This would significantly even out access times, which currently still differ widely, depending on the density of available vehicles. At present, access times, calculated on the difference between the measured values of "time of booking/reservation" and "journey duration," are between 1 and 16 min (e.g. DriveNow with a maximum reservation time of 15 min; source: WiMobil project, supported by the German Federal Environment Ministry (BMUB)). The differences in average access times are closely linked to the various trip purposes.

#### 9.5.2 Carsharing Used as "Full Automation Using Driver for Extended Availability"

The use case of Full Automation Using Driver for Extended Availability assumes that vehicles will basically be able to move autonomously on public roads, but that the driving task can be taken over by the driver independently from time to time.

From a carsharing perspective, the potential changes and extensions involving "Full Automation" are far smaller than those of Autonomous Valet Parking, at least when drivers are required for on-hand availability in the vehicle. The only difference to today's carsharing that would result from this use case would be the possibility of letting the vehicle drive during the trip, should the driver wish. Autonomous driving may also be permanently proscribed on some route sections, however, "e.g. roads with a high frequency of pedestrians crossing" (see Chap. 2). This would primarily be areas in urban districts which—at least for now—form flexible carsharing's main usage areas.

Accordingly, upgrading carsharing with fully automated vehicles, with the driver available for extended range, would be more likely to find use on routes at the edge of or outside settlements. But this is hardly the basis for a business model for "carsharing in rural areas," however. The necessity of having a driver available would prevent serving operating areas with a vehicle that drives to and from the customer autonomously.

Overall, the use of Full Automation Using Driver for Extended Availability offers far less potential than that resulting from Autonomous Valet Parking.

#### 9.5.3 Carsharing as Vehicle on Demand

The Vehicle on Demand use case assumes an autonomously moving vehicle on all public roads. A driver is—even as a fall-back option—not necessary. A driver workstation is thus no longer required, which opens up new design possibilities for the vehicle interior.

A carsharing vehicle on demand starts with the same advantages as a carsharing vehicle with a valet parking function, but in addition the vehicle can become a kind of "compartment on the road." As a result, very diverse activities are possible in these vehicles, such as reading, playing, telephoning, working or taking a nap, and the user can sit anywhere they choose. If we assume usage durations similar to those generally found in today's flexible carsharing, however, it remains open to question whether these additional uses would in fact be highly valued—the average usage duration of a vehicle in a fleet such as that of DriveNow, for instance, was roughly only half an hour in 2014 [31]. If we assume that autonomously driving vehicles will be used for all work journeys in the course of a day, this time span would come to an average of 54 min in large cities at today's rates. For those living in surrounding areas of large cities or in rural areas, the total time spent on travelling to work on a weekday is currently 49–50 min (data source: MiD 2008 [1]). There is, then, almost no difference in the time spent making work journeys with cars in various types of geographical areas (Fig. 9.2).

Carsharing in a Vehicle on Demand would be similar to a taxi ride, and because the vehicle would be available to a wide circle of users, it would most probably replace taking taxis. But the costs of taking an autonomous carsharing vehicle should be compared to those of taking a taxi.

#### 9.5.4 Interim Summary

If we compare the various possible uses of autonomous vehicles in carsharing, the vehicle user gains in comfort from automating the driving task, in a way that is not essentially any different from private vehicles. In carsharing, the travelling time is also free for any other activities that can be carried out in the vehicle during the journey. The decisively novel type of use likely to emerge for carsharing would be delivering the vehicle to the user and disposing of it after use.

The user's prospects are different to those of the operators, who, with the automation of pick up and drop off, will achieve increased usage frequency and overall usage duration for a single vehicle, which could increase carsharing's profitability. This would at least even out differences in usage frequency that show up in studies on flexible carsharing. Currently, usage frequency is directly related to the location at which the vehicle is left. Hotspots in inner-city districts stand in contrast to places where most vehicles parked there wait unused for several hours (Fig. 9.3). Operators currently put average usage duration at between 68 and 78 min per vehicle per day [32], which shows that there is still room for these vehicles to be utilized at greater capacities.

Fig. 9.3 Booking intensity of vehicles in flexible Carsharing—the example DriveNow Munich [14, p. 18]. A high positive value equals a high number of bookings in the respective area (the higher the value the more bookings are made). A low value equals a low number of bookings (the lower the value the lesser bookings are made)

#### 9.6 New Mobility Concepts Beyond Carsharing: Hybridization of Public Transportation?

While carsharing attracts particular attention, especially in its new flexible variant, and also in connection with vehicle automation, it is often overlooked that new options for (further) diversification in current public transport provision could also result, with further new forms of mobility concepts emerging. It also is vital here to take the relevant local conditions into account.

The basic options to be discussed in connection with public transport involve:


The particular benefit that would arise from the use of autonomous vehicles here especially concern demand-driven services: Fixed route plans could be supplemented by flexible services. The additional routes could be optimized according to customer requirements. Fixed timetables would be replaced by temporally optimized routings corresponding to customer demands.

This individualization of public transport will, then, amount to "hybridization" at the latest when, beyond the flexibilization of times and routes, options regarding the vehicles available are also on offer. In essence, the idea of diversifying public transport via vehicle-specific provision is not new. Until now, however, it has only been possible to introduce this in very limited, mostly tourist-centered niches, due to the costs of manning the various fleets with the required staff (e.g. Cable Car in San Francisco, the Glacier Express in Switzerland, or the Blue Train in South Africa).

#### 9.6.1 Reshaping Intermodality and Making Public Transport More Flexible

Intermodality is defined as the change between different transport modes in the course of a journey [33]. According to this definition, intermodal behavior exists only to a very limited extent, at least in Germany. According to the study "Mobility in Germany 2008," it only applies to 1.3 % of all day-to-day journeys [1]. What is overlooked here, though, is the considerable amount of intermodality within public transport, particularly in the linking of main routes with access and egress routes. A typical example of this is accessing commuter or regional trains on a bus line, as is often the set-up in suburban and rural areas. In cities, intermodality between the various modes of metro, commuter train, trams, and bus is much more pronounced. The situation in urban peripheral areas and less densely populated (rural) districts is outlined below. Heinrichs discusses comparable scenarios for cities elsewhere in this volume (see Chap. 11).

Reshaping intermodality by using autonomous vehicles could take place along the same lines as the current system, using private cars or public means. In day-to-day transport, getting to and from the main lines would to some extent correspond to what is today known as "kiss and ride": One person drives another to the main route transport mode, bids goodbye and takes the car with them so they can use it (generally in the daytime) for other purposes during the other person's absence. With an autonomous vehicle, the first person would not need to do the driving, as no driver would be needed to be present for the return trip. The kiss-and-ride pattern can also be found in similar form for long-distance transport, where carsharing operators have also begun, incidentally, to introduce special services for getting to and from airports, train and long-distance bus stations. These include reserved parking spaces at airports, and special rates for intermodal use of long-distance buses and carsharing vehicles [34].

If travelling to and from main lines is done on a public system, it will be possible, by means of autonomous driving, to target user requirements far more closely. Fixed routes and timetables could be dropped in favor of individually arranged pick-up times and locations. A larger fleet of small and medium-sized vehicles would probably be used for these journeys; the local public transport system would be one of a multitude of collective taxis with tailored capacities. Despite automation, the logistical challenges would be enormous. There is also the essential precondition for a functioning system that the user sticks to the agreement with the operator very reliably. This is especially true regarding departure times, for instance when fixed schedules on the main line, or at least fixed timetables, are involved.

Such a transformation of the system could also breathe new life into ideas of financing basic public-transportation services—on the one hand in the form of pay-as-you-drive, but also on a flat-rate basis financed via taxes or levied on all citizens, as is often debated for cities. Also, a high service density in suburban and even rural areas would justify a flat-rate levy and could in the process help to reduce private car use.

#### 9.6.2 Individualization of Public Transport

Individualizing public transport via autonomous vehicles could, then, go beyond abolishing fixed routes and timetables if it actually came to reducing vehicle sizes—at least in certain parts of the areas served. This would open up the possibility of offering users different vehicle types and features, which presently only exists in a rather rudimentary form with first and second classes on public transport, and even there only really on medium- and long-distance trains.

One possible first step in individualizing public transport could be company buses, such as the so-called Google Bus, equipped with WiFi access and operating in and around San Francisco, which brings the company's employees to work. In this case, a specific community gets together in a communal shuttle. Comparable concepts, albeit in manifold varieties, are conceivable and appear particularly attractive when based on autonomously driven vehicles.

Parallel to this—also as a private initiative—the development of new carpooling concepts is also possible, which could mean a mix of common ownership and use of the vehicle, though it may be used individually at times too. Today, carpooling is essentially restricted to ridesharing organizations, where journeys are planned in the medium or short term, and the vehicle is provided and driven by the owner. Even new services such as Uber (www.uber.com) or Lyft (www.lyft.com) do not deviate from this principle. What they offer is taxi-like services, and are thus not comparable with the standard carpooling communities, which predominantly consist of fixed groups of people. It seems reasonable to assume that carpooling services will become obsolete with the rise of autonomous vehicles, and evolve into peer-to-peer carsharing.

#### 9.6.3 Broadening Service Options in Public Transport

Concerning intermodality, possibilities include more public transport services, even in the suburban and rural areas mentioned above (for urban areas, see Chap. 11). The benefits resulting from the use of autonomous vehicles are equally true in spatial and temporal terms, that is both for districts on the outskirts and off-peak hours. An economic lower limit resulting from frequency of use also applies here, however, even in view of the saved labor costs. This also means that a spatially highly dispersed use can only be covered to a limited extent by providing larger fleets. In any case, operating these vehicles would have to pay for itself in terms of initial outlay and operating costs.

#### 9.7 Implementing New Mobility Concepts with Autonomous Vehicles

Carsharing is currently causing quite a stir, in part due to the new forms it is developing, its increasing visibility, and how abruptly its user base has grown in the last two years. But beyond that, carsharing, which in its commercial or group forms is independent of private car ownership, seems well cut-out for introducing new vehicle technologies into the market. Users get to use and try out new technology in providers' vehicle fleets, without the costs of doing so that comes with conventional vehicle ownership. In fact, this is already taking place with electric mobility, where companies such as Car2Go, DriveNow and Citroen's Multicity service are incorporating electric vehicles into their fleets. The user response has been markedly positive. On this point, projects have reported two aspects of electric-mobility carsharing: Firstly, the new technology has been successfully and speedily furnished for a large section of carsharing users; this has stimulated its use. Secondly, many users actively seek out the option that carsharing gives of testing and using new technologies [13, p. 15; 15, p. 19].

The introduction of autonomous vehicles into public transport may be more difficult, even if automated rail and metro lines have so far largely been positively received, e.g. Linie 1 of the Paris Metro, fully automated since 2012 [35], or the metro line to Nuremberg Airport [36]. But the spatial separation of rail tracks provides for different conditions than would most likely be the case on the roads. If autonomous vehicles were also tied to a rigid infrastructure in road transport, then not only would considerable costs result, but the possibility of more flexible navigation would also be lost. Testing the deployment of autonomous vehicles in prescribed, small-scale public or semi-public areas, as described in Chap. 10, thus assumes especial importance. A comparably open "experimental philosophy" is not currently visible in many places.

#### 9.8 Conclusion

Further developing carsharing systems and changing public transportation through the deployment of autonomous vehicles appears in essence possible, and is in many places also linked to clearly defined benefits for road users. In carsharing, the use of fully automated pick-up and drop-off services, in the sense of Valet Parking, seems to almost be a logical and necessary consequence if carsharing's availability and use are to be extended further in the medium-term.

We can already see that numerous new ideas concerning car and ridesharing are cropping up and being tested out, which could have an even greater potential when combined with autonomous vehicles. Carpooling schemes are being developed, for instance, that have an additional "care" aspect, not only for elderly people, but also for children—as "Boost by Mercedes Benz" is demonstrating in Palo Alto, California. We also see here the close interconnection between mobility and information and communications technology when organizing such services [37].

The question of costs and profitability are currently completely open; possibly this question should be linked to that of financing the system. On the user side, it also remains to be seen whether, and to what extent, users come to accept pay-as-you-drive carsharing set ups. Experiments in this area are also only at initial stages. For example, in their current version, Spotcar are positioning a distance-based charging scale against Car2Go and DriveNow's time-dependent pricing, in order to avoid immediate cost penalties for customers stuck and delayed in city traffic. The pay-as-you-drive era is only just beginning in public transport, for instance with systems such as Touch&Travel. It may well be, however, that such payment systems in carsharing, and comparable ones in public transport, are merely forerunners of a highly flexible system.

Open Access This chapter is distributed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, duplication, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, a link is provided to the Creative Commons license and any changes made are indicated.

The images or other third party material in this chapter are included in the work's Creative Commons license, unless indicated otherwise in the credit line; if such material is not included in the work's Creative Commons license and the respective action is not permitted by statutory regulation, users will need to obtain permission from the license holder to duplicate, adapt or reproduce the material.

#### References


# 10 Deployment Scenarios for Vehicles with Higher-Order Automation

Sven Beiker

#### 10.1 Introduction and Background

Tragically, traffic accidents continue to be an everyday aspect of motor vehicle operation as evidenced by statistics. In the United States, for instance, there are approximately 33,000 traffic fatalities per year [1]; in Germany, the figure is roughly 3300 [2]. Vehicle automation, or the gradual delegation of driving from humans to computers, promises to drastically curtail the frequency and severity of accidents. Beyond that, automating vehicles will improve the overall coordination among them, improving the efficiency, comfort, convenience, and safety of personal mobility.

Automated highways and vehicles have been the subject of research and development for over five years now. The question is: how realistic is the vision of humans delegating driving to computers in the near future? Currently, several different development routes are apparent. On one side, the established auto industry is developing "driver assistance systems" with automated driving as the ultimate goal. Meanwhile, non-automotive technology companies from the IT sector have identified automated driving as a new business area for their core products, while recent start-ups are harnessing advanced technology to edge their way into the field of automated personal mobility. A closer look reveals that the players listed above have varying strengths and product goals, but are all driven by a common mission: to shape a new model of personal mobility that is safer, more efficient, more comfortable, and more convenient. This chapter will draw a comparison between these development trends and players.

The development trends will be treated as distinct deployment scenarios, each one a potential projection of how the introduction of vehicles with higher-order automation

S. Beiker (&)

Stanford University, Palo Alto, CA 94305, USA e-mail: sven@svenbeiker.com

might play out. The scenarios were developed primarily by extrapolating publicly available knowledge on the state of the art for automated vehicles and projecting progress forward, while accounting for the outside factors of infrastructure, economics, and technology.

#### 10.2 Definition and Scope

Automated vehicles, also known as "autonomous," "driverless," or "self-driving" vehicles, are currently the subject of extensive discussion in the general public, are being researched by universities, and developed by the auto industry. This article focuses on road vehicles, paying particular attention to passenger vehicles and to some extent trucks. It excludes trains, aircraft, and ships.

In general, the vehicles under consideration are operated on public roads; however, the discussion of synergies will also address vehicles that operate in restricted areas such as company premises, amusement parks, or pedestrian zones. Distinct from public roadways, possible usages in these restricted and/or partially public areas are salient because they allow us to observe critical interactions between automated vehicles and the public, which is ultimately to the advantage of their deployment in general road traffic. The individual implementation scenarios cover such cases in more detail.

This chapter will follow the taxonomy of automated driving and automated vehicles defined by SAE International as J3016 [3], which distinguishes between assistance, partial automation, conditional automation, high automation, and full automation.

To highlight the area under focus, this chapter introduces the term "higher-order automation," which encompasses driving with conditional, high, or full automation. These categories merit emphasis because the step beyond the partially automated scenario—the point at which the driver no longer has to monitor the vehicle or system continuously entails a fundamental change in what it means to drive a car. The radical shift is that the driver can then pursue other tasks during the trip besides operating the vehicle. Finally, a "driverless" vehicle would not even require a human driver whatsoever. This will pave the way to utterly new models for the operation and enterprise of personal mobility.

#### 10.3 Development Trends in Automated Driving

The motives for deploying automated driving—safety, efficiency, extended mobility, comfort, and convenience—can be observed for various trends in this field. The individual aspects are apparent to varying degrees and depend considerably on the intended deployment area and purpose of use. The sections below will examine this in more depth by discussing the currently observed development trends. To start off, the next three subsections describe the deployment scenarios, reflecting the current discourse among both experts and the general public.

#### 10.3.1 Continuous Improvement of Driver Assistance: Evolutionary Scenario

One of the principal players in automated driving is the auto industry, comprising both vehicle manufacturers and system suppliers. The auto industry has been concerned foremost with advancing driver assistance systems, or technology that supports the driver in operating the vehicle. Over nearly four decades, such systems have been introduced to both passenger and commercial vehicles, assisting drivers with longitudinal and, increasingly, lateral control. These systems include anti-lock braking systems (ABS), electronic stability control (ESC), adaptive cruise control (ACC), and lane-keeping assist, among others.

Figure 10.1 shows a timeline for the deployment of these systems. To date, these have emphasized increasing safety and, in some cases, comfort and convenience. The "evolutionary scenario" refers to the steady increase in the use of advanced driver assistance systems followed by successive steps towards vehicle automation and a corresponding reduction in the driver's responsibilities. This is one of the three deployment scenarios to be compared in this chapter.

For the first time in production vehicles, the auto industry is currently launching a suite of systems that automates both longitudinal (acceleration, braking) and lateral control (steering), with driver monitoring still to be introduced—in other words, a partially automated system. This suite of systems, often called a "traffic jam assistant" [4–6], presents a setting that combines adaptive cruise control (automated longitudinal control) with lane-keeping assist (automated lateral control) and thus automates control of the vehicle along both longitudinal and lateral axes in slow-moving traffic. In this mode, the driver's role is merely to supervise the system and intervene if needed.

Fig. 10.1 Timeline for the deployment of advanced driver assistance systems with the vision of fully-automated driving (levels of automation as defined by SAE J3016 [3]). Copyright belongs to author

The next anticipated development stage is the increasing automation of parking. Today there are already many production vehicles that substantially facilitate the processes of both angled and parallel parking [7]. However, these systems tend only to take over the task of steering, the part that many drivers find more difficult, leaving them in control of the accelerator and the brake. As such, these present-day systems fall under the category of assisted driving. In the near future, a growing number of partially automated parking solutions are expected to offer not only system-controlled steering, but acceleration and braking as well. Then the driver's role is merely to monitor the system, for instance by pressing one button throughout the parking process—which remains a signal of the driver's attention and responsibility [8].

The recent past has witnessed statements by various automakers announcing the year 2020 as the target for "autonomous" driving [9–11]. Since the term "autonomous" does not have a set definition according to organizations like SAE International, the automation level implied by these announcements cannot be stated with certainty. Still, it is fair to assume that their functionality would move significantly beyond partial automation and maybe even enter the realm of high automation. In such a design, the driver would not even need to take over in an emergency within specifically defined use cases and zones, for the system is able to perform all driving tasks on its own including responding to unforeseen circumstances.

These announcements, often accompanied by public demonstrations of vehicles with higher-order automation, also show that many well-known automakers and system suppliers are currently working on designs to propel the evolution of driver assistance towards higher-order automation [10, 12, 13]. To that end, in keeping with the mission described at the beginning, traffic safety is treated as the number one objective with further increases in efficiency, comfort, and convenience seen as added benefits.

However, it is hardly possible to make predictions beyond the target date of 2020. Even though several market analysis reports and even some automakers themselves have raised prospects of full automation by 2025 [12], this should be seen more as a possible milestone in the evolution of driver assistance toward automated driving, and not as a reliable forecast of when particular system capabilities and features will be available. Due to their far-off time horizon, projections of that scope should be considered with caution.

Under the evolutionary deployment scenario, we can assume that it would take quite a while for a significant share of vehicles on public roads to have higher-order automation even if such vehicles were for sale as mass-market vehicles by 2020. In the past, it has usually taken around 15–20 years before a technology like ABS or ESC becomes a standard on all new vehicles or is at least available as an extra option [14]. Since the vehicle fleet is generally only replaced over the course of 20 years [15], we should hardly expect most vehicles to run without driver interaction in the foreseeable future under the evolutionary development scenario. Accordingly, this scenario is a more longsighted but also more predictable approach, particularly in comparison to the scenario described next.

#### 10.3.2 Redesigning Personal Mobility: Revolutionary Scenario

Since 2010, non-automotive technology companies [16] have been known to be working on automated vehicles. Unlike the evolutionary scenario pursued by the auto industry and described above, these businesses are promoting a revolutionary scenario with the stated goal to "prevent traffic accidents, free up people's time, and reduce carbon emissions by fundamentally changing car use" [16]. It can be concluded based on such announcements and published design descriptions that these players are not pursuing the continuous improvement of driver assistance towards automated driving, but rather a disruptive leap straight from today's traffic pattern, with human-driven vehicles, into a scenario in which the driver hands over control to the system completely. Obviously this vision is one of fully or at least highly automated driving.

The key design feature from non-automotive technology companies is the inclusion of artificial intelligence. In other words, the functionality of automated driving is implemented by means of learning algorithms rather than the closed arithmetic designs that tend to be pursued by the auto industry. This approach attempts to close the gap between a purely analytical system operating within narrow boundaries and a rule-based system mimicking human behavior. The reason for using learning systems of that kind is that they can improve their features, such as object recognition, over time and learn from the user's behavior and preferences. Those are rather unusual traits for a vehicle from the auto industry, which conventionally introduces a product with its full range of features that then remain static and unaltered. In the computer industry, by contrast, it is standard to introduce a product and then steadily extend its range of functions, whether through learning algorithms or periodic software updates.

Whereas the deployment strategy under the auto industry's previously discussed evolutionary scenario seems relatively straightforward, the same is not necessarily the case in this revolutionary scenario. After all, these are players from the IT industry with no prior experience with automobiles [17–21], and they are pursuing a highly complex goal in an area outside their specialty that may not fit well with their core business. Although it is public knowledge that these firms have already driven several hundred thousand miles in vehicles with higher-order automation [22], their ultimate product goals remain unclear. To date, the players pursuing this revolutionary scenario have made scant mention of tangible plans for any launches on the market, and it is unsure whether these non-automotive technology companies intend to establish themselves as vehicle manufacturers [23, 24]. So far, a range of deployment deadlines have been estimated [25, 26], which in conjunction with other observations in the field give way to the following deployment scenarios.

It is conceivable that the test drives of vehicles with higher-order automation that are currently underway will serve as a platform for the acquisition and subsequent usage of maps and images aiding automated driving. The non-automotive technology companies could then offer services and online software products as part of automated driving and thus propel vehicle automation forward on a broad level. If so, the associated mapping and graphical information could be furnished for broader use, which would be more consistent with a continuous rather than a revolutionary deployment of automation.

However, once the vehicle is driving self-sufficiently without the need for supervision, the goal of those non-automotive technology companies might be for the driver to consume the products from their core business, i.e. online services. In that case these players' strategy would be taking quite a long-term view focused on revenue in their core business: the attempt to conquer the remaining segments of the market—transportation—as part of connected lifestyle. In other words, if the drivers were surfing the web or using social media during the trip, that would make them potential customers for online services just as much as any other computer user.

Another deployment scenario that seems a better match for the industry's tendencies and also allows for a revolutionary development can be deduced from the industry's public design descriptions [24], press releases [22] and patents [27]. On that basis, the deployment of vehicles with higher-order (perhaps even full) automation for services such as the transportation of passengers [28–30] and goods [31] appears possible even within the near future. One credible possibility could be the introduction of vehicles with higher-order automation as competitors of conventional taxis. Press releases [22] and media reports [24] seem to favor a deployment scenario along those lines, though they provide only sparse details about the true objectives and development stage of the technical implementation. This use case is described in this book under the category "vehicle on demand."

One variation of automated taxicabs is the idea of delivery services with higher-order automation, such as food deliveries [32–34] home delivery from local retail outlets [31], or deliveries of any sort of products ordered online [18]. Designs for those kinds of applications have already been demonstrated publicly. Based on strategic investments and acquisitions of the leading companies in these areas, the increasing automation of product delivery is a potential application of vehicle automation. Trials of "drones" for delivering goods [18, 32, 33] and automated garbage removal [35] may also point in that direction (Chap. 16).

Even though many questions remain unanswered, this decade may yet see a large step towards higher-order vehicle automation. This may seem minor and very limited at first (for example, fully automated taxis in one neighborhood), but its implementation area could grow rapidly along with its market share. Announcements by leading companies support the hypothesis that vehicles with higher-order automation will be rolled out before 2020 [22].

By starting with a limited deployment, non-automotive technology companies would have the opportunity to start gathering ample experience and data in the near-term, including the public reaction to these novel concepts. That would pave the way for them to apply their insights to expansion on a regional, national, and finally global scale. A deployment strategy of this sort would be anomalous for the auto industry and could even damage the reputation of a company that tried it. For non-automotive technology companies, however, it is standard practice. Indeed there are examples from past product launches where it has even benefited companies' reputations, as a limited introduction entails a certain kind of exclusivity [36, 37].

#### 10.3.3 Merging Personal Mobility and Public Transportation: Transformative Scenario

Another deployment scenario for automated driving involves implementing transportation paradigms that provide slow-moving passenger vehicles, for example in urban areas. Consumers could summon such vehicles using a smartphone app and ride them over relatively short distances (see the use case "vehicle on demand"). Key drivers behind these types of schemes tend to be high-tech start-ups but may also include transportation service providers, municipalities and operators of facilities such as amusement parks. Their goal is to combine the advantages of personal mobility (independence and flexibility) with those of public transportation (efficient use of energy and space) in order to achieve the mission described at the beginning with a priority on reducing urban traffic congestion (Chap. 9).

Start-ups are motivated to enter these areas in order to develop new business models and deploy new technologies. In particular, companies from unrelated sectors can use image processing, object recognition, and route planning systems—which are already in widespread modular use—to implement transportation models with higher-order automation within a limited geographical range. The arrangements often proposed for market introduction are slow-moving and limited-area vehicles intended to serve what is known as the "first or last mile," complementary to private automobiles or public transportation. To name one concrete example, these types of solutions could be used to reach bus and urban rail networks in areas where a regular schedule is not feasible due to inadequate infrastructure or financial limitations. Another example might be a "park-and-ride" system, whereby users drive their cars to a parking lot on the perimeter of a city or amusement park and transfer to a locally run transportation service. These arrangements would be favored for use primarily in places where private cars are not convenient or permitted or where buses with set schedules are not flexible enough.

These transportation solutions would compete with conventional taxis but be more affordable, comfortable, and innovative from the standpoints of both users and operators [38]. Based on their features, these arrangements have also been called automated mobility on demand (AMOD) systems. They represent an individualization of public transportation with the aim of transforming traffic in urban areas (Chaps. 9, 11). Companies' incentive to introduce such arrangements is to gain access to new business areas or extend their range within existing markets. Currently, the taxi industry's business model has comparatively high labor costs. Automated vehicles' reduced need for human resources is anticipated to boost profits [38], though it would be accompanied by a reduction in employment in the sector.

It is quite conceivable that, by merging personal mobility and public transportation, automated vehicles will usher in a transformation of urban street traffic. Since these systems are only intended for a limited geographical range and would operate at low speeds, the difficulties are correspondingly reduced, and they would be much easier to implement in the near term than the first two scenarios discussed here. As such, it seems realistic that various cases of AMODs will be rolled out with limited scope by 2020.

Some early examples of the transformative scenario are already being implemented or are scheduled for the near future [24, 39–43]. It should be noted that a number of cities have conditions consistent with these use cases, allowing the operation of AMOD systems on a trial basis at the least. During the trial period, it remains to be seen whether residents will take advantage of the services and whether this will develop into a profitable business model. Although the first implementations should be considered extended trials on the spectrum between public prototypes and actual commercial deployment, these cases represent the most concrete step to date towards the implementation of vehicles with higher-order automation. The two other scenarios (evolutionary and revolutionary) may well learn from these experiences.

Due to the generally rather favorable conditions, it is anticipated that various individual city governments and operators of amusement parks, shopping malls, and other large-scale facilities will introduce automated transportation systems in the short term. On that basis, it also seems very likely that as the list of successful role models lengthens, by the end of this decade the field will already have a broad range of experiences to draw on and automated vehicles will have won the acceptance of their users and other people on the road. Despite the inherent simplifications—in view of the limited geographical range and low travel speeds—the evolutionary deployment scenario can also extract lessons from it to apply to the use of automated vehicles on public streets and highways. Even the limited use case of high or full automation with AMODs will furnish significant insight into the interaction between automated vehicles and other road users (including conventional vehicles, pedestrians, and cyclists) as well as the necessary safety/security measures and infrastructure requirements for later deployment on public roads. It is likewise fair to assume that the initially limited ranges of AMODs will expand over time. Accordingly, an automated transportation arrangement will gradually spread out onto public roads where it will interact with conventional and/or automated private vehicles.

#### 10.4 Comparison of Scenarios

Now that the previous section has presented the deployment scenarios individually, the following section will compare them on several levels. As demonstrated above, these scenarios have both differing and shared objectives in terms of the advantages for users, commercial operators, and road traffic at large. The section below will spotlight differences in more detail but also draw attention to commonalities.

#### 10.4.1 Systemic Comparison

The systemic comparison of the three deployment scenarios summarized in Table 10.1 provides an overview of the use cases for driving with higher-order automation,


Table 10.1 Characteristics of the deployment scenarios under consideration

comparing and contrasting each scenario's objectives, potential implementations, and business models.

As described at the beginning, all three scenarios share the objective of raising the safety and efficiency of road traffic as well as increasing mobility and convenience. Beyond that, they exhibit increasing specialization in terms of the intended usage of a vehicle or assistance system. For example, when it comes to private cars, driving with higher-order automation will initially only be offered for highways or parking, in other words, specific driving situations. Likewise, new transportation arrangements will only be deployed at first in restricted areas such as shopping malls or amusement parks, in other words specific geographical ranges. This would result in a more distinct specialization of driving or system features than is currently the case. Today, private vehicles are expected to be usable by "anyone, anywhere, anytime." In other words, as long as they have a driver's license, anyone can drive a car no matter the time or place. With the advent of driving with higher-order automation, users may face a scenario in which the use of a vehicle is more limited or case-specific, requiring a mental adjustment.

These limitations are highlighted in Fig. 10.2, which contrasts the degree of automation with the geographical range. These two factors are perhaps the most crucial characteristics for classifying automated driving and allow us to draw an effective comparison between

Fig. 10.2 Potential implementations for automated driving by degree of automation and geographical range. Copyright belongs to author

the three deployment scenarios presented here. The evolutionary scenario, entailing ongoing advancements to driver assistance systems, is intended for an unrestricted geographical range such as "all highways" or "any parking space." On the other hand, it only offers a comparably low level of automation to start out with. By contrast, the revolutionary scenario, which aims at redesigning personal mobility entirely, and the transformative scenario, which provides for the merging of personal mobility and public transportation, both imply a very high degree of automation. Both cases would conceivably involve the rapid development of fully automated technology, albeit within a limited geographical range such as a particular neighborhood, a shopping mall, or an amusement park. For the sake of simplicity, one might say that the evolutionary scenario is moving toward the goal of full automation with the strategy of an "unrestricted geographical range but limited automation," whereas the revolutionary and transformative scenarios are pursuing the approach of a "restricted geographical range but unlimited automation."

One particularly interesting aspect illustrated by the comparison in Fig. 10.2 is the fact that the revolutionary scenario does not especially stand out on either axis compared to the evolutionary and transformative scenarios, yet overall it is the scenario that most closely approaches the ideal of a fully automated vehicle with unrestricted usage. Thus this scenario seems most consistent with the paradigm of "anyone, anytime, anywhere," as it combines a comparatively large geographical range with comparatively high automation.

In regard to the transformative scenario, the question of who would operate the vehicles deserves special attention. It is anticipated that trained, specialized personal would monitor the vehicles' operation or at least inspect them on a regular, perhaps daily, basis. As such, that scenario is highly distinct from the model of a privately operated car, which is generally operated by laypeople and rarely requires the attention of specialized personnel except for occasional maintenance or servicing. For that reason, the "anyone, anytime, anywhere" model poses a particular challenge for the evolutionary scenario, because it would require extremely high dependability even without ongoing supervision by specialists. Notwithstanding, the revolutionary and transformative scenarios prove to be helpful in preparation for the advent of individually used private cars with higher-order automation, since the operation of such vehicles under specialists' supervision would lead to useful insight early on.

One potential use case for vehicles with higher-order automation, which is quite significant but cannot be directly attributed to one of the three development scenarios, is the prospect of an automated platoon on highways. In this use case, a number of vehicles that are otherwise used individually join together into a virtual train by means of a common communication infrastructure. This allows longitudinal and lateral control to be automated, although it would also require a special communication standard and only vehicles compatible with it could be included. At least at the beginning, the first vehicle in such a platoon would be driven by a professional driver; all the vehicles following it would not require any ongoing supervision and the drivers would only need to intervene in exceptional cases [44].

The scenario of an automated vehicle platoon brings together various traits of the evolutionary and transformative scenarios that make an implementation of such a scheme within general road traffic seem likewise realistic for the near future. On the one hand, this scheme would pose a near-term opportunity for an implementation of vehicles with higher-order automation, as the potentially limited object and situation recognition capabilities could be augmented by the lead driver's performance and experience. On the other hand, it may pose additional issues, such as the logistics of how to join and leaving the platoon, passing by other vehicles, and adhere to the legal following distance.

#### 10.4.2 Technical Comparison

The systemic comparison has already revealed several differences among the deployment scenarios, which also have divergent requirements for reliability or, more precisely, the completeness and availability of the technology needed. Since the evolutionary scenario focusing on individually used private cars must function for any layperson without temporal or geographical limitations, it gives rise to different technical requirements from those of the transformative scenario, for instance, where a fully automated vehicle might be operated exclusively in a geographically limited zone under professional supervision. Furthermore, the number of vehicles in question and the corresponding number of system components may vary greatly, which bears an impact on the technology to be deployed.

To generalize, the evolutionary scenario requires sensor and processor components that are highly failsafe (i.e. redundant and equipped with fallback systems), low-maintenance (i.e. self-calibrating and self-monitoring), and cost-efficient (i.e. mass-produced) in order to guarantee maximum availability (see Table 10.2). The transformative scenario, however, favors specialized, highly accurate, and individually configurable systems that enable maximum automation despite an early implementation deadline, even if that means more work preparing the infrastructure. What makes the infrastructure for the transformative scenario especially labor-intensive are its need for a communication system that


Table 10.2 Qualitative comparison of the system requirements for the three deployment scenarios under consideration

Legend ++ (high), + (significant), 0 (neutral), − (low), – (not applicable)

allows the safe and coordinated operation of fully automated vehicles as well as the need for a maintenance and supervision crew to ensure the vehicles' functional safety by servicing them regularly as needed.

The requirements for the revolutionary scenario, in which automated vehicles are deployed within functional and geographical limitations, lie somewhere in between the technical requirements of the evolutionary and transformative scenarios, as it implies the use of a centrally operated and professionally maintained fleet of vehicles that is not necessarily subject to ongoing supervision. Thus it requires highly failsafe and precise systems that would presumably lead to comparatively high cost.

The implementation of a communication infrastructure for vehicles with higher-order automation is especially significant for the deployment scenarios. Communication both among vehicles and between vehicles and infrastructure could be employed to exchange data on vehicle positions, vehicle speeds, and other parameters, which would then be used for routing or perhaps for a central vehicle coordination system. The trend toward automated vehicles in the industry would therefore benefit from another current trend which is toward connected vehicles. In that context, it is also particularly significant that there are government initiatives in various countries aiming to lend momentum to the development of vehicle-vehicle and vehicle-infrastructure communication [45–48].

#### 10.4.3 Regulatory Comparison

The three scenarios can also be differentiated by the regulation that would apply to them. Since the vehicles under the evolutionary scenario are intended to be operated on public roadways without any geographical or temporal restrictions, their use must be subject to the corresponding traffic regulations. As a result, it remains unclear at this point which legal jurisdictions allow automated vehicles to be operated under their purview and to what extent they may be automated.

In the case of the transformative scenario, however, the circumstances are somewhat different. Particularly due to the anticipated geographical restrictions of use—initially outside of public roadways as well as other areas with unrestricted access (instead favoring locations such as shopping malls or amusement parks with their own access rules)—a special set of regulations may be implemented. That means that either special rules will be established for the area where the automated vehicles are operated, access to it will be restricted to a specific group of people, or everyone who enters the site will be required to declare their consent. The final arrangement in particular would make operations considerably easier, as the operator's liability or mandatory supervision requirements could be regulated based on specific needs.

In terms of legal requirements, the revolutionary scenario falls in between the evolutionary and transformative scenarios. If we assume that such systems are initially limited to a certain geographical area, such as a neighborhood or a particular highway segment, the area would be subject to general road traffic regulations but there could conceivably be special additional rules, such as targeted restrictions, authorizations, or liability regimes that would apply solely to that route.

In terms of applicable regulation, it is also important to keep in mind how regulators treat vehicle automation in their own jurisdictions. In the United States, for example, some states (the pioneers being Nevada, Florida, and California) have instituted regulatory frameworks governing the operation of vehicles with higher-order automation, albeit in many cases only for trial runs so far. Meanwhile on the federal level, the National Highway Traffic Safety Administration (NHTSA) has urged caution and recommended a coordinated introduction alongside vehicle-vehicle communication [49]. The government of Japan has expressed its advocacy of the strategic objective of automating road traffic and has offered to support the industry to that end [50, 51]. In Europe, governments remain cautious when it comes to automation—apart from ongoing participation in research ventures [44, 47, 48, 52–54]—though it is anticipated that the topic will received intensified attention in the years from 2015 to 2020, as evident already from the earliest proposed legislation [55] (Chap. 25).

#### 10.4.4 Comparison of Corporate Strategies

The description of the deployment scenarios above has identified the lead players and categories of companies involved in each of the three cases. The evolutionary scenario appears to be pursued more so by established vehicle manufacturers and system suppliers, while the revolutionary scenario is favored by non-automotive technology companies from the IT industry and the transformative scenario is advocated by start-ups and service providers.

Table 10.3 presents the three categories with the companies' characteristics, objectives, and strategies. Thus established automakers can draw on experience and processes allowing them to implement development projects related to automated driving with appropriate planning certainty and see them through all the way to the product launch. This is primarily rooted in the evolutionary approach, where the existing development, production, and sales processes are extended to a new class of product (automated driving). That model makes it rather difficult for them to deploy completely novel products or processes. Another characteristic of the auto industry is that its existing market positions and company histories lead it to proceed in a manner perceived by outsiders at times as rather cautious.

The auto industry's caution might be rooted in the fact that these companies have established and refined their reputations and brand images among customers over a period of decades, making their company names valuable assets worth protecting (Chap. 32). The companies' reputations can be rapidly jeopardized by unreliable or unsafe products, which


Table 10.3 Comparison of various corporate strategy characteristics for each of the deployment scenarios

can have a long-term impact on their commercial success. Along these lines, introducing automated vehicles prematurely is seen as an especially risky move. Indeed, such reservations are justifiable, as evidenced by numerous instances where automotive products failed to meet customer's expectations or aroused suspicions of safety risks and consumers proceeded to respond negatively to the associated brands [56–59]. Reservations of this nature, whether justified or not, may cause a delay in the market introduction of automated driving technology, which has strong safety implications and is centrally important to the public interest.

In contrast, such considerations are much less relevant for start-ups pursuing the transformative scenario, as these companies tend not to have long histories or an (automotive) brand image to protect. At the same time, they do not have years of experience developing, producing, and selling cars. This makes these companies better placed to develop and launch extremely novel products and services as required by the transformative scenario described above. In the event that a product fails to meet the market's expectations, these companies do not bear the risk of jeopardizing a company name that has been developed over time.

Moreover, start-ups are often able—or practically forced—to develop alternative processes and product solutions due to their frequently small size. For that reason, start-ups have more flexibility in the concepts of automated driving that they design and can pursue implementations with greater inherent risk. Yet the start-ups must also overcome the challenge that developing automated vehicles is often only feasible by means of a high capital investment due to the complexity of the systems and components involved. Likewise, it may take a relatively long time before a product is completed and generates any revenue. As such, these companies are often reliant on venture capitalists and their longevity can sometimes be uncertain.

Once again, the revolutionary scenario lies somewhere between the other two. As explained earlier, the players in this area are often non-automotive technology companies that have access to sufficient capital and can also capitalize on processes that have not yet been applied to automotive product development. For those reasons it seems plausible that a revolutionary scenario can be anticipated from that precise sector. In fact, this type of company has already begun gathering significant experience in transportation systems; for instance, one of the companies from the IT industry has already traveled over a million kilometers using vehicles with higher-order automation [22] and has prior involvement with the transportation of passengers [28] and goods [31].

#### 10.5 Summary and Outlook

This chapter explored three scenarios for the deployment of vehicles with higher-order automation: the continuous evolution of driver assistance systems by the established auto industry, the revolution of personal mobility by non-automotive technology companies, and the transformative merging of private and personal mobility by start-ups and transportation service providers. At this point, these seem to be largely independent development paths that occasionally compete. However, in regard to the deployment of driving with higher-order automation, there are synergies to be exploited, particularly in the areas of infrastructure and public acceptance. It should also be noted that all three deployment scenarios ultimately work towards the same final scenario, which is for the vehicles that are currently driven by humans to be fully automated in the future, giving rise to new use cases and business models and an altered set of transportation behavior.

The differences between the scenarios highlight the likelihood of vehicles with higher-order automation being introduced in different geographical ranges with varying sizes and in varying regions. It is also anticipated that the scenarios will be introduced at different points, resulting in a staggered timeline. To generalize, it is fair to predict that the sequence of public introductions over the coming decades will lead from the transformative scenario to the revolutionary scenario and finally to the evolutionary scenario. The geographical range of these systems would grow from the local level to the regional scale and finally become global.

We can also expect that in addition to the fully automated, slow-traveling and limited-area transportation options that are currently being introduced in extended trials, there may be local fully-automated taxi services by the end of the decade, which will lead the way for the general operation of vehicles with higher-order automation on highways, country roads, and urban streets in the years after 2020. Over the next few decades, this development will allow us to exploit many opportunities to increase the safety, efficiency, convenience, and productivity of personal mobility. Beyond the clear synergies among the various scenarios, they also offer valuable links to the automation of other vehicle classes in settings that span from logistics centers and container ports to agriculture and mining, perhaps even robotic missions to explore far-off planets.

Open Access This chapter is distributed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, duplication, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, a link is provided to the Creative Commons license and any changes made are indicated.

The images or other third party material in this chapter are included in the work's Creative Commons license, unless indicated otherwise in the credit line; if such material is not included in the work's Creative Commons license and the respective action is not permitted by statutory regulation, users will need to obtain permission from the license holder to duplicate, adapt or reproduce the material.

#### References


# 11 Autonomous Driving and Urban Land Use

Dirk Heinrichs

#### 11.1 Introduction

Mobility, transport and land use patterns in urban areas are closely bound up with each other [1]. Urban form plays an important role when households and businesses make mobility decisions, and to a considerable degree dictates transport mode choice. Compact city form with high density and mixed use provide good preconditions for short trips and efficient public transportation, promote walking and cycling, and often render daily car use unnecessary. With sprawling, sparsely populated land uses, on the other hand, walking and cycling are discouraged, while car use is favored. In turn, the availability and use of designated transport modes strongly influences urban form and the necessary infrastructures. The residential suburbanization of the latter half of last century was thus to a great extent encouraged by car availability and the expansion of the transport infrastructure for motorized passenger transport [2].

It is expected that fully automated driving will entail a completely new transport system, which will not only bring with it new possibilities in traffic management, but will also generate completely new types of transport provision that will affect the choice and use of available transport means (see Chap. 12). The idea, for example, that time in a vehicle does not have to be spent on driving-related tasks, but instead permits other activities, may instigate a complete reappraisal of the time factor (e.g. [28]). This ability to attend to other activities in an autonomous vehicle may imply that long car commutes will be considered less a burden than today. This could increase the willingness of households to locate further away from the city center where land prices and rents are lower and where suburban preferences like living in a

D. Heinrichs (&)

German Aerospace Centre (DLR), Institute of Transport Research, 12489 Berlin, Germany e-mail: Dirk.Heinrichs@dlr.de

greener environment can be better satisfied. In other words: autonomous driving can potentially alter the trade-offs that households make between choosing location and daily mobility. If we take these connected factors to their logical conclusion, in the end it would be possible to dissolve the time factor as a limiting variable of urban planning. Will the availability of fully automated vehicles then entirely redefine the interrelationship of mobility and urban land use? With few exceptions [3], this question remains as yet untackled. Currently, visions of integrating autonomous vehicles into the urban transport system still essentially refer to the development of vehicle technology itself and the effects on traffic flow.

In light of this, this article's aim is to try to gauge potential urban-structure developments under the influence of a transport system with autonomous vehicles. Equally, it is to identify the way in which political and economic frameworks can influence these developments. The following questions are considered here:


As a basis for the examination of these questions, this article will evaluate currently available scenarios on the city of the future. The following Sect. 11.2 introduces the scenarios and visions of "the city of tomorrow" available in the literature, and their ideas regarding the integration of autonomous vehicles into transport systems. It will then describe what different future possibilities can be conceived for a transport system that is transformed, or transformable, by automated driving, in which urban structures they can develop, and which essential influencing factors are essential for this development.

Building on this, Sect. 11.3 contains a close analysis of the possible "fully automated" transport system of the future, based on two idealized scenarios developed by the authors. At the core of these scenarios are (a) autonomous private vehicles, and (b) autonomous vehicles as an integral part of public transport. Based on a short characterization of both scenarios, we analyze what the future effects of each scenario on urban structures might be.

Section 11.4 discusses what factors might be especially significant in developing a transport system with automated vehicles in cities. We will identify the driving forces for the scenarios under examination.

The concluding Sect. 11.5 summarises the essential findings. It outlines what aspects definitely should, from an urban planning and development perspective, be brought to the debate surrounding automated driving, but also asks how the discourse on urban development and planning should embrace autonomous driving.

#### 11.2 Autonomous Driving as a Feature of City-of-Tomorrow Scenarios

As automated driving in cities has not yet become reality, and the effects on urban structures are thus not yet observable either, scenarios offer one possibility of drawing on conceivable future developments and their interrelations. Scenarios describe both a potential future situation and the development of the path leading from today into the future [4, 5]. They are a recognized instrument for uncovering and structuring changes, their drivers and consequences, in a partly unknown, uncertain and rapidly changing environment [6].

For the following account, a systematic analysis was carried out of the available literature on the city of the future that deals with the development of mobility and transport. From the full range of studies, a selection of core documents and scenarios contained therein were considered for a more detailed analysis. They met the following criteria: a traceable account of set objectives, their status and a development path; the identification of driving forces and their interdependencies; and a treatment of the topic of mobility and an account of its interrelationship with settlement structure. Finally, these documents were grouped according to similarity of type. We then analyzed the forms and significance of automated driving they describe, and the changes that significantly impact this trend. The classification proceeded along two axes of uncertainty which are particularly relevant when examining automated driving: the availability and integration of intelligent communications infrastructure (low or high), and the acceptance and use of this infrastructure in general, and for mobility, by the urban population (characterized as fragmented/low, or high).

The scenarios described in core documents can essentially be classified into three types:


These scenarios will be described more closely below.

#### 11.2.1 The Regenerative and Intelligent City

A series of future studies have highlighted the development of so-called regenerative cities as a possible development path [7–12]. These studies view technological developments that use resources in an efficient and environmentally friendly manner as being the heart and driving force of urban development from 2030 to 2050. At their center is energy-related building conversion (solarization, energy-plus houses) and the increasing use of locally generated power from renewable sources, which is distributed and shared over so-called microgrids or peer-to-peer power systems. This is supported by intelligent control mechanisms which allow a link-up with other areas of urban functions, such as mobility. The significance of intelligence and information is highlighted in the corresponding studies. They describe the transformation into a technological regime that is no longer characterized by technologies for individual sectors (energy, transport, waste etc.) but rather guarantees a high level of integration between sectors.

This technological development is accompanied by a transformation in the behavior of the urban population [7]. In general, sustainable consumption is assumed as a very conscious and responsible way of dealing with resources [9]. This is explained by the consuming urban population having a greater wish for well-being and quality of life in future, which are defined differently to economic well-being. Society will accept energy-optimized, and sustainable mobility because the majority of the population not only has its advantages presented to them in the media, but can also experience them in daily life.

The key to this lies in densely populated metropolitan areas, in which a wide range of integrated but simple and affordable mobility provision is assured. Cities are characterized in this scenario as places that, due to their density, allow efficient use of resources. To this is added the assumption that, with the growing significance of cities as economic and social centers, the potential of taking decisions and action at city level will increase in future. A number of the studies we analyzed state that cities such as London have already demonstrated the possibility to transform urban infrastructure, and implement decentralized, innovative approaches to energy and waste, without needing national policy. Cities transform themselves, driven by competition (between cities), policy and city government, which actively seek to improve the qualities of the location.

In the course of the resource-efficient transformation of the city, the conditions of mobility in the regenerative and intelligent city also change. Information and communication technology is becoming increasingly pervasive in the transport system. The studies analyzed see in this a basis for expanding demand-oriented mobility-management approaches, and the linking of transport provision with a flexible, multimodal transport system in the future (see Chap. 9). Public transportation's role as the backbone of urban mobility is being further expanded and continually modernized, for example in integrated planning, with walking and cycling as part of ecomobility, whose share of road space is increasing. Supplementing this, citizens also have individual transport modes at their disposal (bicycles, e-bikes, electric cars and transporters), indeed precisely when and where needed by an individual ("mobility on demand"). This "sharing" provision, following the principle of "using not owning," is being introduced and extended by various providers and helps to greatly reduce the amount of public space currently taken up by private cars. A personal, mobile and electronic mobility assistant allows all the available means of dealing with daily mobility to be weighed up, and situation-specific optimal variants to be selected.

One topic of the studies is the further development of electronic assistance systems for cars, in conjunction with the development of new, more efficient drive types. It is assumed that privately owned cars will also continue to have some significance in future [11]. Various studies expect vehicles, with electronic assistance systems for semi-autonomous use fitted as standard, to be present in the period 2030–2050. On freeways with high transit volumes or on commuter routes, for example, they allow driving on autopilot, which optimizes the traffic flow. This is assured through high-level interconnectedness and communication between vehicle and the transport infrastructure. This development will be enabled by new legislation regarding licensing, insurance and liability, as well as a range of acceptance-generating concepts from the state concerning data management and standardization (open source, interface compatibility, data protection and security).

As part of the changes in mobility provision, the studies we analyzed also describe a transformation in cities' urban spatial structure. The interlinking of transport provision, according to these authors, increases the formation of so-called mobility hubs, which can already be seen today. It is assumed that city districts will be organized around these hubs in a polycentric urban structure in future. Land consumption for parking spaces in urban areas will have clearly fallen. The reasons for this are a dynamic distribution of vehicles in city districts, and automated, space-saving "parking racks."

#### 11.2.2 The Hypermobile City

The hypermobile city, as a potential development path, is a particular focus in a study by the Foresight Directorate of the UK Office of Science and Technology [7]. It outlines the development of a society, up to 2055, in which uninterrupted information, consumption and competition are the norm [7].

This scenario, like that of the regenerative city, also assumes that any remaining barriers to the majority of society using individual transport will be overcome, but with continued very high demand on resources and the corresponding environmental consequences. One essential element and driver of this growth is acceptance of the development of electronic and digital infrastructure. This could involve using cameras for virtual exchange, for example, or personal information assistants. If acceptance is currently still low, it will markedly increase in coming years due to its commercial and lifestyle advantages. People in the city of the future will be "always on," whether at home or work. To manage this, they will use personalized assistants equipped with encryption technology to help them in extensive organizing and daily planning. Even if the problems and reservations regarding data protection and privacy are clearly highlighted issues in this scenario, in the end they will be put to one side due to the benefits electronic assistants bring to users.

Between now and 2055, the state and private sector will have cooperated on developing the required technologies. Key interventions include strong support of user-related information and communications technology (personal assistant systems, standardization of communication standards, and GPS) and technological development (encryption technology, sensors, position finding). One important prerequisite on the way is putting great effort into data security at the European level.

Mobility in this scenario's target year is described as markedly networked. The authors outline a development in which mobility demand continues to rise. The strong emphasis on information and communication technology in this scenario will also further mobility's automation, not least in optimizing traffic flows and reducing jams. In cities, mass taxi systems will to a great extent replace standard public transportation. These will take over the job of efficiently carrying and picking up passengers in boarding zones. The vehicles used locally for this will operate in assigned districts, and users will call them up using their personal assistants. The network will compute the most efficient route, including picking up and dropping off other passengers, and calculate the price. This network, also known as a "swarm," can process large volumes of data on the traffic situation and demand locations. The vehicles can adjust their route. Passengers can use any vehicle instead of having to wait for a certain line.

Autonomous vehicles will travel long-distance on freeways on "guided lanes" that are specially reserved for autonomous vehicles, some of them also for overnight use. People will buy larger vehicles and drive longer distances. These vehicles will be equipped with an "on-board driverless unit," which communicates with automated systems along freeways and essential commuter routes. This produces convoys of automatically controlled vehicles travelling tightly together at high speed.

The development of urban land use is described differently in this scenario. On the one hand, there will be highly condensed city centers; on the other, suburbs with lower densities will grow. While young people in particular will prefer to live in urban centers, a growing number of high-income households will decide to move to city peripheries or the country. Despite increasing distances to their jobs in the city center, they will be able to continue having intensive working lives, either by aid of telepresence—using ever-more-powerful communication instruments—or the convenient use of automated vehicles. At the same time, this population group, by living in suburbia, will feel they have the opportunity to recover from increasingly tiring and demanding working lives in the hypermobile world.

#### 11.2.3 The Endless City

While the scenarios for regenerative and hypermobile cities highlight technological development as a motor for changes in city life, mobility and urban structures, this scenario paints a somewhat different picture [12].

The underlying assumptions here are that technological innovations are not taken up to any great extent, particularly due to the high cost of the necessary infrastructure. Technological development does take place, but is mainly restricted to efficiency gains in specific areas (combustion engines, solar energy). The power of the state to steer development is seen as limited. Even a transformation in behavior, as sketched out in the developments above, will not be seen.

With regard to mobility and urban structure, this scenario's authors envisage a model still clearly dominated by cars. Due to limitations in how much states can develop public transport systems, so-called informal paratransit services will continue to grow. The degree of networking with available provision will remain low. The potential for autonomous driving systems is not discussed. Spatially, cities will exhibit low density and fragmented settlement structures. In this regard, the authors are extrapolating a trend that is currently observable globally [13].

#### 11.2.4 Discussion

The selection and analysis outlined above shows that, scenarios do partially discuss the possibility of a transport system that is changed, or capable of being changed, by automated driving. Automated solutions are formulated in scenarios with a high penetration and interlinking of innovative communication and navigation technologies in particular (regenerative and hypermobile cities). Here, automated driving is expected to contribute to public transportation. The scenarios describe the use of stackable and programmable compact cars, for example, and a networked mass taxi system. Automated private vehicles are mentioned in the course of long-distance freeway travel. Table 11.1 summarizes the main characteristics of the different scenarios with respect to likely forms of autonomous driving, the implications on urban form and land use, and the main driving factors.

Turning to the effects of automated driving on urban structures, the various scenarios first describe how it is bound up with an overall transformation in the general framework. The regenerative city scenario assumes an increasing density of population and functions in cities. Other scenarios (hypermobile and endless cities) presuppose a continuation of the suburbanization tendencies that can currently be seen around the world. These are viewed as the consequence of high-income househoulds' individual preferences, or as being due to processes of pushing low-income households out of cities. The formation of so-called mobility hubs or nodes is described in various scenarios as a visible change in urban form resulting from a transport system with elements of automated driving. In the regenerative and intelligent city scenario, the idea of networking is rigorously carried over to urban space. Multi-modal transport hubs allow physical networking and simple transfers between modes, e.g. from (electric) car to public transport. The scenario goes one step further, in that it also assumes a change in other uses, stemming from the bundling of different mobility options. It describes city districts that are organized around mobility hubs and utilities, and in which automated vehicles are incorporated as part of the public transport fleet. Parking and its connection to urban space is also discussed in very different ways in almost all scenarios. The regenerative city scenario describes the drop in land consumption in conjunction with falling numbers of private cars and local parking-area management. In the intelligent city of the future, an interlinking of private-car use with public transport will have been achieved, and new park and ride areas will have emerged at mobility hubs.


Table 11.1 The scenarios in overview

Author's own description, based on [7–12]

The descriptions of intelligent and regenerative cities in particular are thus characterized by a basic conviction that technology will overcome existing and foreseeable problems (scarce resources, environmental change). The central significance of technological development is also confirmed in the endless city scenario, but from the opposite point of view. There, lack of innovation is interpreted as explaining a series of negative developments. In a certain sense, this scenario depicts possible developments in southern cities of the globe, where the capacity of the state to direct development is comparatively low.

Only the hypermobile city scenario critically deals with the topic of data. Problems of data protection and security are taken to be accepted in the target period of 2055, as the individual benefits of information and communications solutions for participation in social networks and working life outweigh the disadvantages in the eyes of the population.

#### 11.3 Autonomous Driving and Its Impact on Urban Structure

The scenarios described in the previous section propose answers to the question: In what form is automated driving conceivably a feature of tomorrow's cities' transport systems? We will now have a closer look at the possible changes in urban form and land use resulting from this: How will the distribution of uses, density, and layout of urban spaces change under the influence of autonomous driving?

The scenarios introduced above demonstrate that fundamentally different options can be imagined. Firstly, they describe the development of autonomous private vehicles that, depending on the scenario, are controlled with no external aids by an autopilot system or are integrated into the traffic flow via vehicle-infrastructure communication. Secondly, the scenarios envisage autonomous driving as an integrated part of public transport provision. It can be assumed that the effects on urban form could differ greatly depending on the form of autonomous transport system. In the following, therefore, both forms are considered separately.

#### 11.3.1 Autonomous Private Cars

At its core, this form describes the transfer of driving tasks to machines in uni-modal individual transport. It calls on aspects of the use cases, outlined in Chap. 2, of freeway pilot, fully automated with extended availability through driver, and valet parking.

This case assumes that future use will largely correspond with today's car usage. Apart from the changed properties of the technology used, no changes are expected. Cars will still be in individual ownership. No assumptions are made concerning changes in modal and destination choice patterns. There are, however, changes regarding current vehicle use. First, autonomous driving permits other activities during the trip: Former drivers will, for example, be able to work on their laptops, eat, read a book, watch a film or call friends [14]. Second, autonomous driving will change access and egress. Today's cars are either driven directly from home to the destination, or the user has to walk to the parking location of the vehicle at the start of the trip and again from the parking to the final destination. One impact of autonomous driving, however, will be that these distances before and after the main journey will be made by the car, not the driver. The driving robot will maneuver the car from its original parking space to the location of the owner/user and, after arriving at the destination, to an allocated parking space.

The possible effects and changes on urban structure from autonomous-vehicle usage include, firstly, the parking area needed for vehicles at home and destination. Secondly, locations would become more attractive for households choosing places to live. There will also be a transformation in the attractiveness of locations that are destinations for daily activities, such as shopping and leisure. This is accompanied by changes in the space required for flowing traffic resulting from autonomous car use. These three aspects will in the following section be looked at more closely.

#### 11.3.1.1 Change in the Required Parking Area

Overall, the expected changes in the area required for home parking are small, although they differ according to type of settlement structure. In residential neighborhoods of single-family houses, where parking spaces are on the same plot as the home, no changes are expected. The available parking space will simply be occupied by a different (autonomous) vehicle. In areas of higher density, such as inner-city districts, it may be assumed that neighborhood parking zones or collective garages will appear or be developed, as only in this way will autonomous vehicles be guaranteed to find a space in the neighborhood-defined catchment area.

Further effects of autonomous driving on parking areas are possible at journey destinations away from home. This includes trips made for shopping, leisure and work. An autonomous vehicle would be able to drop off its passengers at their destination and then independently park itself in an allocated parking space or a collective garage. It is also assumed here that sufficient parking capacity will be provided to allow vehicles to find a space safely and reliably. On the one hand, this use of autonomous driving, where the vehicle drops the user off at the destination and proceeds to park autonomously, may be accompanied by greater user willingness to visit certain destinations by car. Equally, there may be a substantial impact on the provision and management of parking areas. Particularly in areas of high-usage density, it may be assumed that a bundling of parking provision, in the form of collective garages, will follow.

The possibility of saving space is named as an essential argument for the use of automated parking systems. These should be made more space-efficient, primarily by replacing ramps and aisles with lift shafts, and lowering storey heights, but also by increasing parking density [14, 15]. The developers reckon on up to 60 % more parking spaces on the same area by using parking robots [16].

The efficient use of space for parking is especially attractive in terms of costs [16–18]. Parking spaces required for building developments consume a lot of space and represent a considerable share of the costs of the whole investment, particularly when the garage to be built is not at ground level. There have already been some projects testing parking in garages with autonomous vehicles [19, 20]. The driver hands the vehicle over at the garage entrance. The parking function is activated with a smartphone app. The car receives the route data to the nearest available space from a central garage computer via WLAN and drives to it autonomously. An automatic parking system already in existence may serve as an example. All necessary vehicle movements, except for entry and exit into a handover booth, are carried out automatically (via conveyors and shifting equipment) or with a specially developed parking robot, as is already in use [16].

As mentioned above, the restructuring and possible concentration of parking areas might not take place everywhere. It will primarily be restricted to areas which are especially attractive destinations, and where costs for building the required parking lots, and therefore also the attractiveness of space-saving solutions, are particularly high (the high price and scarcity of land resulting in multi-level solutions). High-density city center service and shopping zones count among these areas, as do new business districts with a high number of workers. To this may be added mobility hubs such as airports and railroad stations, where, on top of the criteria just given, safe and secure solutions for long-term parking are sought. The extent to which the costs of parking might change in the course of autonomous driving cannot be estimated. On the one hand, dropping off passengers at the destination and subsequently parking elsewhere in the city (with less pressure on use and therefore cheaper) may save money [21, 22]. On the other hand, retrofitting and restructuring parking facilities and infrastructure brings with it its own costs.

#### 11.3.1.2 Change in the Attractiveness of (Residential) Locations

Some studies point to an increasing attractiveness of suburban residential districts when autonomous driving becomes available [2, 22, 23]. According to this argument, households using an autonomous vehicle may choose to live in green areas with lower house prices, but further from the city center, as the autonomous vehicle will compensate for the location's downsides (longer distances). One consequence may be that new residential areas of relatively low density spring up, similar to the development of suburbanization in the second half of the last century. That was strongly driven by motorization, infrastructure, a planning policy approach of separated uses and dispersed cities, and households deciding to settle in the countryside. The results are still to be seen in today's land use patterns [24].

In general, it is known that working people's choice of where to live is far more influenced by factors such as quality of life and living environment than the wish to be near to their place of work [25]. This is backed up by a relatively high prominence of commuting to work. Some 60 % of all employees subject to social insurance in Germany, that is around 17 million people, do not work in the municipality in which they live. In order to get to work, working people spend on average around half an hour each way. Car use dominates here, being used to make 66 % of trips [26], in the USA as many as 86 % [27]. Based on datasets covering employment and occupation, as well working across regional borders, Guth et al. [25] discovered that the proportion of commuting beyond the home municipality, and distances covered, have grown in German areas of agglomeration in the last decades.

Autonomous driving could further encourage this trend and the willingness to accept longer commutes. First, it is assumed that an increase in travel comfort will accompany autonomous driving (e.g. [14]). The travel time will no longer have to be taken up paying attention to the onerous task of driving, but will instead permit other activities. Mobility will not necessarily be seen as an unpleasant obligation or loss of time. Moreover, travel times may get shorter. In connection with autonomous driving, there are high expectations for a generally more efficient handling of flowing and stationary traffic [2, 22, 28]. Autonomous vehicle can harmonise their driving with each other, for instance when accelerating or braking, thus reducing journey times. Close to zero waiting at junctions is also forecast [14]. Clear time gains will also come when looking for parking spaces, as passengers are set down first. Overall, a journey with an autonomous vehicle will be easier to predict and plan and be more reliable in terms of time. This is the result of almost constant speeds and a reliable and predictable routing from starting point to destination.

Improved travel comfort and shorter and more reliable travel times are relevant factors for households weighing up further-away jobs, or other objectives such as good schools, against other location criteria such as local house prices or the attractiveness of a country location. The basis for decision-making could change, especially for working commuters with an autonomous vehicle. Journey times are a particularly large additional burden for commuters [29]. This is further exacerbated where it becomes impossible to calculate durations, and thus the time of arrival at the destination. Psychological studies for Greater London [30] show that time losses that the transport user cannot control—in traffic jams, for instance—are responsible for stress to a particularly large degree.

#### 11.3.1.3 Space Requirements for Flowing Traffic

The benefits of autonomous driving mentioned above also lead to expectations that capacity on transport routes will be freed up. Coordinated acceleration and braking, and the higher vehicle frequency (the so-called "platooning") will make possible a reduction of the street area used for traffic [30]. A substantially higher vehicle density in relation to road area is to be expected [30, 31], although forecasts for the extent of this increase in capacity differ. Fernandez [31], for instance, assumes up to 500 %. Brownell estimates over 250 % for highways and some 180 % for inner-city streets [32]. This means that the area required for flowing traffic could be reduced, by reducing the number of traffic lanes, for example. Lane width could also be cut in comparison to the present size, due to the altered driving behavior of autonomous vehicles (see Chap. 16). The reduction in the space needed for flowing traffic could allow other uses to be encouraged, such as cycle lanes and footpaths. Various authors, however, indicate that such effects only come into play with full automation [22].

Higher density of flowing traffic could also have an impact on transport users such as pedestrians and cyclists in other ways. Segregation effects may increase, for example, and crossing the street with densely flowing traffic may be made more difficult. In order to guarantee the benefits of autonomous driving for traffic flow while simultaneously maintaining its "permeability" for pedestrians and cyclists, the installation of intersection-free crossings such as under and overpasses would be a necessary consequence.

#### 11.3.2 Autonomous Taxis as an Integrated Part of Public Transport

A second development, far more prominently discussed in the scenarios in question, is the emergence of a new model of urban mobility, in the form of autonomous taxi fleets. This touches on aspects of the "Vehicle on Demand" use case as described in Chap. 2. In such a system, low-cost autonomous taxis do not operate on fixed routes following rigid timetables, but rather in a demand-oriented and flexible way. They are in permanent operation and run in a city-wide, dense network of stations. This mode of operation is similar to hailed shared taxis. The city is divided into cells. A "central transit point," or a series of them, for pick up and drop off belongs to each of these cells. It should be possible to integrate and combine taxis with rail-bound public transport. The taxis will take over feeder and dispersion functions to and from rail-based public transport stations and pick up passengers there, while the more efficient and potentially faster public transport takes over for longer route sections. The use of an automated taxi network has already been described and modeled as a concept [32–34]. It could lead to a fundamental transformation of public transportation and solve the problem that high-speed rail has covering the last mile [23]. It involves abolishing standard bus and tram stops. It is important that the system is an integrated one. It is an open question whether taxis will be operated by the public or private sector.

#### 11.3.2.1 Public Space Used for Transport and Parking

The effects of a public transport system with autonomous vehicles on urban land use could be very extensive. The use of autonomous vehicles could cut down the number of parking spaces in city centers considerably, as the vehicle would not have to navigate to a parking station some distance away, but would simply drive to the next passenger. Vehicles would thus be in continuous service. Demand for parking spaces would fall. It would, though, be necessary to set up local depots for the cleaning, maintenance, refueling/charging and repairs of vehicles in service.

Permanently available deployment of such taxi fleets may strengthen carsharing, and possibly dynamic "ridesharing" as well, as it allows the spontaneous renting of a vehicle, calculated to precise minutes and distances, for door-to-door journeys [14]. It could be viewed as a logical extension of currently available flexible car-sharing business models, which already have these properties (Car2Go, City Car Club, DriveNow, Zipcar). In this light, it may be assumed that such a system would noticeably alter vehicle ownership and usage (see Chap. 9). An increased degree of occupancy in car usage is also possible [22].

One consequence that may be assumed is a drop in car ownership among households living in areas with such a mobility-on-demand service in operation. Americans, for instance, could currently imagine getting rid of their second car, given the availability of such a system with direct pick-up from the front door [28]. The change in car ownership would lead to a change in the parking space needed for stationary traffic. This may go as far as stationary traffic largely disappearing in favor of areas for multi-functional trips. These areas could be wider than before and be divided into lanes for bicycles and electrically aided micro-vehicles with speeds of up to around 30 km/h, with a further lane for heavier and faster vehicles.

A further change in the use of urban space is the establishment of pick-up and drop-off stations, which will further enhance the character of mobility hubs, especially those with transfer points to other forms of public transport. Beyond the reshaping of these spaces (stopping/short-term parking, picking up of passengers), changes in usage can also be expected, such as a greater concentration of "traditional" shopping and service facilities at the hubs.

Through the extensive reshaping of the public transport system, an impact on the complementary public transport infrastructure and uses is also possible. If users convert from using private cars to autonomous taxis linked up to an efficient rail-based network, forming the "backbone" of the system, passenger numbers would increase on these routes and, in all probability, capacities would have to be adjusted.

#### 11.4 Essential Driving Forces for the Development of an Urban Transport System with Automated Vehicles

The previous Sects. 11.2 and 11.3 analyzed the scenarios in question and, based on the different characteristics, discussed the impact of a transport system influenced by autonomous driving on urban land use. Following this up, this section asks which factors could have the greatest impact on the development of this type of system.

The discussion of the scenarios firstly shows the great importance of technological innovation, where autonomous driving obtains an increasing role in the transport system. Progress and new developments in the area of information and communication technology, electronic and digital infrastructure, data management, and artificial intelligence are essential drivers of this trend, whereby a transport mode's automation can be viewed as part of a more extensive automation of urban processes in general. The automation of parking, or of energy and facility management, are examples of this.

As a result, we can see the high expectations for the state's capacity to control events that are bound up with the development of transport systems involving automated vehicles. The scenarios expect that the state will cooperate with the private sector in developing the necessary technologies. This is accompanied by new legislation on licensing, insurance and liability, and acceptance-creating concepts on the topics of data management and standardization (open source, interface compatibility, data protection and security).

With regard to the population's acceptance of autonomous driving, it is clear that a series of possible factors could have a positive impact. Firstly, automated driving is combined with societal use of an efficient and environmentally friendly transport system. Secondly, it is quite possible that private users' and economic players' acceptance will rise in coming years, due to individual lifestyle and economic benefits, particularly when governments actively promote technology and acceptance.

A further factor that automation may positively impact is the prospect of cost-effective use and an upgrading of urban land use. One example is parking, for which automation promises clear cost-savings for the building of parking areas and, due to reduced space requirements, potential conversion to high-value usage. But areas on the edge of the city or in the surrounding area might also profit in the course of a potential revaluation of location-choice criteria, and from increased attractiveness as a place to live.

It must, however, be borne in mind that there is much uncertainty concerning the factors mentioned here. Firstly, given the fundamental legal and ethical questions (see Chaps. 4 and 25), it is not at all possible to predict at what speed, and in what form, urban transport systems involving autonomous vehicles will be developed.

It is also currently not possible to reliably forecast the consequences for transport, and thus also urban land use. By integrating autonomous driving into a collective public transport system, carsharing may develop more strongly, and car ownership may fall. An increased acceptance and use of "one's own" car could strengthen the prospects of individual motorized transport. The latter case, in particular, raises the question of possible "rebound effects." Time savings and low usage costs may lead to higher mobility rates and increased kilometers traveled [22]. Under these circumstances, an increase in autonomous vehicles would compensate initial efficiency gains in the use of road capacity.

However, the question of how the amount of additional costs of autonomous-vehicle use might evolve currently remains unanswered. The scenarios analyzed in this chapter are not plausible on this point, arguing solely on the assumption that mobility will continue to be affordable in future. Calculations of the additional costs to equip cars, however, assume that both purchase and running costs will initially increase markedly [22, 28]. To these can be added resulting costs for municipalities for transport infrastructure adjustment and the building of new neighborhoods, should the attractiveness of suburbs actually increase.

Out of all these aspects follows much uncertainty in planning for local and regional stakeholders—the politicians, administrations, transport operators and the real estate sector. In particular, the adjustment of transport infrastructure and settlement development demands a long-term approach, including the corresponding regulation and financing. Changes in urban land use in the course of autonomous driving are thus only to be expected when most vehicles on the street are automated. So long as this is not the case, traffic density might well continue to increase significantly, journeys remain difficult to plan, parking demand stay high and street widths remain unaffected. Stakeholders, at least those from local traffic and urban planning departments, are thus currently still lacking important orientation for taking action and decisions. Not least among this is the lack of clarity as to what form autonomous driving will actually take in the medium and long term.

#### 11.5 Summary and Outlook

The core aim of this article has been to fathom potential implications on urban form and land use of a transport system with autonomous vehicles, and to assess the way in which political and economic conditions might impact this development. Based on available scenarios and visions of "the city of tomorrow," and their ideas regarding integrating autonomous vehicles into transport systems, we have seen that different developments can be envisaged. For example, is the autonomous vehicle in the scenario a private one driven by an autopilot, unaided by any external system, or is it networked via vehicle-infrastructure communication? Or is it an integrated part of public transportation?

Depending on these varying characteristics, autonomous transport modes have the potential to change the transport system in utterly different ways. Their properties and potential uses will also affect land-use and urban planning. Areas of influence include parking demand and organization, and the attractiveness of neighborhoods as places to live, shop or work. Moreover, autonomous vehicles may allow land currently used for transport and parking to be converted to other uses (either for other transport uses, such as walking or cycling, but also for construction purposes). The changes that might actually follow depend largely on the direction in which autonomous driving evolves.

What aspects are essential to include in discussions on automated driving from an urban development and planning point of view?

Firstly, it is clear that autonomous driving may have a series of possible effects on urban land use that are relevant, in turn, as decision-making criteria for owning and using autonomous vehicles. The possibility of households achieving their "suburban" preferences more easily is one example of this. Connections in decision-making processes between long-term mobility (location choice) and daily mobility (destination and transport mode selection) should be brought into debates surrounding autonomous driving. As well as such individual-centered criteria, there are relevant issues in relation to autonomous driving's societal use. These involve, for example, the follow-up costs of developing new suburban neighborhoods as a result of changes in such areas' attractiveness. The extent to which such correlations actually materialize as autonomous driving is introduced, and how the consequences are to be assessed, should be understood and discussed in relation to autonomous driving as a matter of priority.

Secondly, there is the finding that, alongside potential changes in land use, far-reaching transformation—right down to new infrastructure and the reconfiguring of transport spaces including those for parking—may arise in the course of modifying the transport system. Developments in the driving patterns and handling of autonomous and non-autonomous vehicles, and also in other modes, must take this into account. That is altogether a long-term task, as changes in urban land use in the course of autonomous driving can only be expected when most vehicles on the street are automated [22]. Many of these questions need further investigation. There is, for instance, a need to analyze what impact autonomous driving might have on long-term plans for designing parking spaces, cycle lanes, junctions, sidewalks, cross-sectional road profiles etc of urban spaces. How can a successive transformation towards a transport system with autonomous vehicles be designed? What are plausible scenarios for its introduction in the first place? Requiring clarification here is not merely how the present infrastructure can be "converted," but also how the current prioritization and roles of various modes and transport means will change in the process. With the increase in autonomous vehicles and the emergence of special traffic lanes described above, there may be greater separation of functions between various modes. It may also become more difficult for other transport users to cross the street as a result of autonomous vehicles' dense traffic flow. This raises the question of on how much of an equal footing, the mix of the various transport-mode uses should be managed in future, as the impact of autonomous driving makes itself felt.

It is becoming clear that not only are urban development issues relevant to the debates on autonomous driving, but the reverse is also the case. Of great consequence is the impact that an automated transport system has on the concepts and objectives of urban planning and development. To what extent and under which conditions can a transport system with autonomous vehicles contribute to realizing currently valid models, such as dense and compact cities? Or will automation promote a return to cities built around the automobile? What is the relationship between urban-planning elements for structuring autonomous transport and the demands of the universally aspired-to city of pedestrians, cycling and rail? Could it be, under the impact of autonomous driving, that we need to formulate fundamentally different or new models for the development of cities? We can now start the discussion of these questions.

Open Access This chapter is distributed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, duplication, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, a link is provided to the Creative Commons license and any changes made are indicated.

The images or other third party material in this chapter are included in the work's Creative Commons license, unless indicated otherwise in the credit line; if such material is not included in the work's Creative Commons license and the respective action is not permitted by statutory regulation, users will need to obtain permission from the license holder to duplicate, adapt or reproduce the material.

#### References


# 12 Automated Vehicles and Automated Driving from a Demand Modeling Perspective

Rita Cyganski

## 12.1 Motivation and Aims

In 2013 Willumsen, one of the most renowned researchers in transport modeling, stated, regarding automated vehicles: "We can no longer ignore them, if [the] planning horizon is 10+ years" [37]. But works attempting to anticipate the effects of automated vehicles on potential users' everyday mobility, and specifically their choice of transport mode, are still rare (e.g. [11, 19, 37]). However, a glance at the individual driving forces of our daily mobility behavior does allow us to draw some cautious conclusions on potential behavioral changes arising from the introduction of automated vehicles. Applying analogies to the use of known transport modes in transport demand modeling allows for initial quantitative statements about potential impacts on overall transport demand. In the process, demand modeling allows us to distinguish between different geographic contexts and user groups, and to evaluate various scenarios for the use of such systems.

The aim of this chapter is to sketch out challenges and initial approaches on how to incorporate automated vehicles among the choices of transport mode when modeling demand in passenger transport. First, we will examine which factors play a central role in the individual processes when weighing up the various transport modes. The following section gives a short introduction into transport demand modeling's manner of operation. We shall then turn our attention to what behavioral changes may appear in transport modal choice as a result of introducing automated vehicles. We will discuss what properties of the new vehicles, and also of the geographic context and potential users themselves, could be significant in how the vehicles are perceived and received, and what competitive situation between transport modes this will result in. To support this work, we shall

R. Cyganski (&)

German Aerospace Centre (DLR), Institute of Transport Research, 12489 Berlin, Germany e-mail: Rita.Cyganski@dlr.de

introduce the initial results of an online questionnaire on attitudes to automated vehicles and their anticipated use. The concluding section addresses the following questions: What are the challenges when integrating automated vehicles into model-supported transport demand analysis? How do current models and data bases need to be expanded to give an adequate mapping?

### 12.2 What Determines Which Transport Mode We Choose?

The question as to why we decide in favor of a certain mode of transport occupies a multitude of publications from various disciplines. There is consensus that a vast number of complex interdependent factors underlie human transport behavior and mode choice. According to Bühler (2001), these subdivide into four groups: (1) socio-economic and demographic characteristics, (2) cultural frameworks and individual preferences, (3) spatial development patterns and (4) political regulation [6]. Alongside personal criteria, Ortùzar and Willumsen [24] see the characteristics of the intended journey and, not least, of the transport supply and of the modes available as being most decisive.

Of special significance in mode choice is the question of access to alternative modes of transport. Driver's license ownership, individual income situation and closely related car ownership are important behavioral determinants. Substantial investments such as purchasing a car or a season ticket for public transportation have a long-term impact on transport mode choice [31]. Clear differences in modal choice can be seen in terms of sex, employment status, and household size and structure. Further, the presence of children in a household has a particular influence [6, 24, 28]. But it is not only objectively measurable criteria that play a role. Individual personal circumstances, lifestyles, and attitudes towards the various transport modes and traveling itself affect the decision, as do daily habits and routines (see [25, 27, 29, 33]). The effect of transport socialization and social and environmental norms is stressed in the approaches of learning theory and cognitive and social psychology (see [2, 12, 27]). These show clearly that individual decisions often do not correspond to the idealized picture of an independently and rationally deciding human being.

Residential location is considered to be the main spatial anchoring point for individual transport related decisions. Its physical structures directly affect the accessibility of destinations looked at visiting and the effort it takes to get to them ([6, 9, 27], Chap. 20). For instance, higher population density, greater mix of uses, and proximity of public transportation are associated with lifestyles with lower car use and higher rates of walking and cycling. At the same time, traffic jams, shortage of parking space, and higher parking costs are more common in densely populated areas [6].

If nothing else, the financial cost of using a transport mode is a direct or indirect consequence of political regulation. Operating costs, road tolls, and parking costs influence how people view their cars. Travel time, particularly in comparison to the time needed for the alternative transport modes available, is another important selection criterion. In this context, it should be distinguished between time spent on pre- and post-usage, e.g. the way to and from bus stops, and time actually spent travelling on the bus. In the case of public transport, moreover, it can be shown that waiting and transfer times, and the number of transfers, have a considerable impact on how the mode is evaluated Wardman [36]. However, it is not only instrumental factors that play a significant role, but also the associated symbolic and affective ones [33]. For instance, a transport mode's alleged or actual reliability and punctuality affect the decision for or against a specific transport mode, as do its associated safety, convenience, pleasure, and flexibility [4, 24, 33].

Selecting a transport mode, furthermore, also depends on the purpose of the journey. Here, not only the individual trip but the whole trip chain, i.e. all journeys undertaken between leaving the home and returning to it, should be considered [4]. The number and type of accompanying persons can also be decisive in selecting a means of transport, as can transportation needs or the distance to be covered [16, 25, 33].

## 12.3 Transport Mode Choice in Applied Transport Models

#### 12.3.1 A Short Introduction to Transport Demand Modeling

Transport demand models are important and established tools in transport-related planning and decision-making processes. They allow for analysis of the present transport situation, forecasting of future developments in transport demand, or the examination of various potential development paths based on scenarios. The basis of a transport demand model is the simplified, purpose-specific representation of interdependencies between mobility demand and its concrete geographic manifestation. Transport models are mathematical models that place high demands on the extent and depth of detail of the input data, and which, particularly in relation to human decision-making processes and present transport demand, rely on extensive empirical data.

The aim of passenger transport modeling is to represent all decisions of individuals made as a consequence of a planned change of location. The first model stage, trip generation, addresses the question of how many changes of location are made in the study area. To this end, the number of trips or activities that can be expected for the population according to statistics within one day is determined. In the process, the generated trips or trip chains are differentiated according to trip purpose. In the next step—destination choice or trip distribution—a destination is selected for each trip depending on its purpose. Given the combination of origin and destination, the third model step—transport mode choice or transport allocation—weighs up the various available transport modes and selects one of them. The next step—traffic assignment or route choice—determines the route taken from origin to destination and sometimes specifies the starting time in more detail. The basis here is the so-called supply model, in which the transport system for all available transport modes is mapped in such detail that the attributes for each potential route—such as travel times between two locations—can be determined. As a result, a transport demand model provides information on the location changes of the study area's population and the resultant traffic volumes for individual modes of transport. In practice, the individual stages of the model, presented here for the sake of simplicity as a sequential process, often find simultaneous or recursive application—choice of transport mode and destination are combined particularly often. For a more in-depth look at transport demand modeling, see [5, 24].

As a rule, transport demand models can be divided into microscopic and macroscopic model approaches. These approaches differ both in view of the information and properties required and the model logic in mapping decision interrelationships. Macroscopic demand models, also often called Four-Step Models or FSM, directly reflect the four stages mentioned above. Based on its socio-demographic, transport-related characteristics, the population in the study area is subdivided into groups so that behavior within a group is as similar as possible while deviating significantly in comparison to the other groups. Classifications are typically based on sex, age, employment status, and car ownership. Usually, household context is not considered (for more details, see [18], inter alia). In the course of modeling, all trips generated by group members are modeled collectively and independently from other changes of location during the day in question. For further description of macroscopic models, see [5, 22].

Particularly in regional modeling in the USA, so-called activity-based or microscopic modeling approaches to transport demand have grown in significance in recent years. Compared to macroscopic models, these are more greatly focused on people's individual mobility decisions and consider a person's detailed characteristics and household context to a greater extent. A day's individual trips are modeled jointly as tours starting and ending at home. This form of representation allows for consideration of behavioral interdependencies between individual activities and decisions. In the course of microsimulation, the trip chains of all persons in the study area are calculated individually, yielding an overall picture of transport demand. In-depth information on activity-based modeling approaches can be found in [7, 10, 21].

#### 12.3.2 Decision-Making Criteria in Applied Models of Transport Mode Choice

Transport mode choice is of great significance in demand modeling, with its results being highly relevant for planning and policy [24]. Generally, discrete choice models or closely related methods that presuppose strongly rational decision-making behavior are employed. These statistical models help to identify the respective influencing factors and the extent of their impact on decision-making. If one assumes that the total utility of a choice alternative can be derived additively from the individual components, then benefit of choosing an option can be calculated and compared with other available alternatives. The probability of selecting one variant increases with its relative advantages compared to other options [20, 24]. The specified models can differ in their complexity (see [34], for example). Transport mode choice models that are integrated into demand models, however, usually only consider a few variables covering the characteristics of the transport mode, the people, the trips, and the geographic structure.

In describing the available transport modes, the financial and temporal costs of a choice assume prime importance. In the case of cars it is primarily running costs that are considered, purchase and maintenance costs more rarely. Time costs are primarily taken to be average onboard travel times. Less frequently, and then mainly for public transport, is time spent getting to and from the bus or train included. In the latter case, the number of transfers, waiting and transfer times, or even service frequencies are often also taken into consideration. Elements such as the reliability of the travel time have until now mainly been found in analytical models [4]. By using a transport mode specific constant, moreover, utility components that cannot be further specified may be considered in aggregate. Age, sex, income statues, driver's license and car possession are among the typical socio-demographic attributes in the models. Income variables, level of education, and household size or number of children are rarer. In particular for socio-demographic characteristics, it is common to interrelate with other attributes when determining their utility components, thus allowing different levels of influence for specific groups of people. Assessing transport modes may also depend on the trip purpose; interaction terms specific to the trip purpose are thus also not uncommon. Distinguishing journeys to work is particularly important here. But also the need to transport items, or commonly having accompanying passengers for specific trip purposes, such as shopping or longer travelling, may require corresponding differentiation. Geographic and contextual characteristics form a further area. Official geographic typification, or population density at the residential location, e.g., can be used to differentiate between rural and densely populated areas. Factors describing the parking situation, parking costs or possible toll areas can also be found in some models.

Transport demand models are strongly data-driven and presuppose that quantitative statements on interdependencies can be made. In the absence of sufficient data, numerous factors known to be relevant for transport mode choice can often only be included in models in simplified form. This particularly affects so-called "soft factors" such as routines, transport modes' perceived comfort and reliability, the pleasure associated with traveling by such means, the social standing conveyed, individual safety requirements, and propensity for privacy. It is not only attitudinal factors, however, that are examples of issues that, despite their known relevance, have hitherto hardly been considered in transport demand modeling, but also knowledge of alternatives, the potential effort needed to plan, and also the way in which households come to collective decisions (see [35], among others).

Mapping new transport modes poses a particular challenge, moreover. The liberalization of long-distance bus services in Germany, the introduction of station-based carsharing services, or even the introduction of electric cars onto the market are examples of modifications of existing transport provisions where forecasting usage patterns has proved to be difficult and reliable figures on interdependencies are lacking. But even differentiating between the various current modes using "hard" factors is not always easy. Transport models have historically mainly been employed to calculate the vehicle miles travelled. As recently as 2012, Bates showed that four-stage models contained barely more than one distinction between "private modes," i.e. car usage, and "public modes". These have only recently been extended to include other aspects, such as distinctions between driver and passenger [5]. Distinguishing among cars, for example according to size or type of drive, has only latterly been introduced in modeling. This all amounts to a series of significant challenges when integrating automated vehicles into the analysis. Ultimately, it is a matter of examining "the car" more closely and enabling clear differentiation between driving and being driven, a car you own and a car you hire, or a taxi, even.

## 12.4 What Impact Might the Roll Out of Automated Vehicles Have on Our Behavior in Choosing Transport Modes?

Before examining the question of how automated vehicles can be looked at in transport modeling, it must be explained how the introduction of these systems might affect individual daily mobility. In general, the potential use of automated vehicles, or also of new mobility options, greatly depends on their possible applications and the advantages they offer compared to other modes on offer—that is to say, on factors relevant to how automated vehicles are judged compared to other modes when choosing transport modes. Such factors should then, as far as possible, be included in models. For the use cases described mostly in technical or legal terms in Chap. 2, I will therefore begin with a discussion of possible usage variants. Central issues requiring further examination here include: how to typify the expected users, the trip purposes and intended uses for which corresponding systems are particularly suited, the geographic or contextual characteristics that make it necessary to use public transport, the relevant transport mode characteristics and the transport mode substitution that may result from this. The discussion is hereby focused on characteristics suitable for depiction in transport models.

#### 12.4.1 Interstate Pilot: The Car with that Special Something for Exceptional Circumstances?

Interstate Pilot may come to be the entry level for automation, as the driving task remains except in exceptional circumstances. The two main aspects of Interstate Pilot from a user perspective are easing the driver's workload and the possibility of spending travelling time in other ways.

The use of Interstate Pilot will only be possible on specific stretches of road, and thus mainly on long-distance trips. For this reason, it may be assumed that this system would mainly positively impact how cars are perceived and assessed in the case of longer journeys. In addition, Continental's user survey clearly shows that handing over the driving task is positively connoted, especially in stressful or tiresome situations such as traffic jams or roadworks [8]. It is also not uncommon, however, to associate such a handover with restricting the pleasure of driving [1].

After increased road safety, the possibility of an altered use of time, mostly associated with increased meaningfulness or productivity, is arguably the most-mentioned advantage of automated vehicles (see [23, 26, 30, 32], for example). For working people and those with great private commitments in particular, and for trips with children or with other passengers, this could lead to time spent travelling being viewed more positively—one of the most important factors for transport mode choice in models. In the end, this may lead to longer trips on public transportation being assessed relatively more negatively, particularly by people who use this time actively, and to cars being perceived as the more-comfortable alternative, leading to them gaining in popularity. The significance of the alternative time usage is, however, difficult to assess. In the Continental study, for example, only around a third of respondents stated that they found an alternative time use attractive [8].

## 12.4.2 Valet Parking—Never Look for a Parking Space Again?

Valet Parking is a function in more or less "normal," only slightly modified cars, where the driving task remains unchanged. The vehicle only takes over the task of parking and driving to pick its occupants up autonomously within a defined radius upon user request. According to a survey by AutoScout24, just under two thirds of respondents would happily use this function and never again search for a parking space themselves. Among residents of urban districts, this percentage is higher, as would be expected [1]: The function is mainly of benefit in areas with a low number of private parking spaces, where there is pressure on parking, and long distances from homes or destinations to their respective parking spaces (see also Chap. 20). It thus helps to save time and also parking costs, where applicable [19], and it provides greater convenience, particularly when transporting items or children, and for people with restricted personal mobility. Even if greater use of carsharing is discussed primarily in the case of Vehicle on Demand (see [11]), less time and effort spent getting to the car with Valet Parking may possibly ease the use of carsharing. Consequences that we can be surer of include a substantial drop in parking search traffic, and an accompanying fall in travel times in areas previously affected by this.

#### 12.4.3 Arriving Comfortably and Safely in a Fully Automated Vehicle

Fully automated driving is the "crème de la crème of driver-assistance systems" [3]. Although the human driver will—at least provisionally—need to be in a position to take over the driving task, this should only be necessary when desired. Given sufficient rates of penetration, this driving concept is linked with a vision of safe, reliable personal mobility and improved traffic flow leading to less time spent travelling and in jams, as well as making the planning of journey times and costs more predictable [3, 26, 30]. At the same time, it may be assumed that inhibitions regarding car usage and ownership will decrease, especially for users who are inexperienced, uncertain or older. The car would thus become, for instance, a more attractive option in unfavorable driving conditions such as darkness, unknown or longer routes, and in bad weather conditions (see also [11]). One consequence of this is a possible fall in the number of escorting trips and the use of taxis and public transport, and a corresponding increase in car ownership.

The most frequently cited advantage from users' point of view, however, is the associated hope—analogous to Interstate Pilot—of being "given time that I can use solely for me" [26]. It is therefore no surprise that this technology's target group is mostly seen as being working commuters (see [17] for example)—fully automated driving provides, precisely in urban densely populated areas, meaningful use of time spent on-board. This benefit is likely to result in a more positive evaluation of the car, especially if time spent in cars was not previously perceived as productive, and pleasure in driving not a priority. We thus see it is particularly people who are not the most passionate drivers who most desire to use such a function [17].

## 12.4.4 Vehicle on Demand—Zipcar on Steroids?

A scenario involving a fleet of vehicles that is in large part available and usable for everyone, particularly in urban areas, would undoubtedly have the most wide-ranging impact on daily transport behavior. A logical extension of fully automated vehicles, but with no option of taking over the driving function, it would allow for independent personal mobility even for those without a driver's license or their own car: children, the elderly, people who are sensory or mobility impaired, etc. (see [19], among others).

In general, we can assume that cars will gain in attractiveness as access and egress times decreases, especially in areas with a parking-space shortage. Alongside the potential drop in parking costs from being able to park further away from the destination, a clear fall in the number of escorting trips may also be expected, as well as in the use of carpooling and taxi services—possibly accompanied by an increase in empty runs.

At the same time, introducing Vehicle on Demand fleets is universally expected to lead to substantially lower rates of car ownership [19], [37], possibly accompanied by a boom in carsharing use. With reference to the US carsharing firm, Silberg et al. [30] have even spoken of "Zipcar on steroids". It seems particularly plausible that two-car households might substitute their second vehicle, which—depending on the situation in terms of weather, parking availability, number of people travelling, etc.—would also allow a specific vehicle to be selected accordingly (see [17, 37]).

Given Vehicle on Demand's introduction, Fagnant and Kockelman [11] would expect a substantial impact on individual car ownership. According to their simulation calculations for the USA, a single Vehicle on Demand could replace up to 13 private cars [11]. Studies on station-based carsharing in Germany put the substitution rates at up to eight private cars replaced by a single carsharing vehicle [15]. Because Vehicles on Demand can cover a wider catchment area by abolishing the need for trips from the starting point to the vehicle, these figures do not appear unrealistic. A glance at carsharing's current user structure provides the first clues as to the potential users of Vehicle on Demand. In particular, younger people of higher-than-average education and income with distinct interest in the environment use station-based carsharing in Germany. The fairly new carsharing services that are not tied to stations, also known as flexible carsharing, are mainly used by urban males as a flexible transport mode option for short trips (see [13, 14]). The use of Vehicle on Demand as an alternative to privately-owned cars might thus directly lead to a boost in multimodal behavior in choosing transport modes, or contribute to an increase in carpooling (see [26]). However, given that time spent in the vehicle is often viewed positively, a rise in car use and mileage covered is also possible as a consequence of their omnipresent availability ([11, 37], Chap. 20). These new mobility concepts are examined in depth in Ch. 18.

But it is not only individual car ownership that may be subject to extensive changes in such a scenario. Car services, taxis and public transport may find that competition with personal transport modes hots up anew. Especially in rural areas, Vehicle-on-Demand fleets could serve either as flexible, individual feeder services for local public transport, or as a way of comfortably covering the "last mile" for long-distance public services. Critical analyses, however, also allow for the theory that they would not simply supplement public mass transit, but in the long run could even replace it: "[…], eventually, mobility on demand may prove a better investment than new mass transit systems" [17], an assessment also shared by Willumsen [37]. In this case, assumptions that passenger kilometers covered on an individual basis may rise steeply surely cannot be rejected out-of-hand.

## 12.4.5 The Car of the Future: Competition for Cars, Taxis or Trains?

Reviewing the literature as it stands shows that introducing automated vehicles could have very diverse effects on our daily mobility and chosen means of transport. Automated driving thus is not always only a lightly modified version of our long-familiar cars that will improve traffic flow and travel times and provide support functions as desired, as suggested by a graphic in the KMPG study [17]. Rather, its potential effects differ enormously for existing private transport modes, and even public ones. The wide-ranging implications resulting from the various scenarios for the whole transport system and the use of public space generally are explored in depth in Chap. 20. The possible effects on transport mode choice, as seen in the literature above, clearly show that the characteristics relevant for perception and valuation of the vehicles in the various usage scenarios may be very different. These diverse requirements must be borne in mind when analyzing any potential mapping of automated vehicles in transport demand modeling.

### 12.5 What Potential Applications Do Users Anticipate for Automated Vehicles? Initial Survey Findings

Quantitative studies on the topic of automated driving have been carried out sporadically since 2012 [1, 8, 17]. The surveys have largely focused on issues of attitudes and acceptance, or on desired support functions. With its questions on anticipated usage and alternative time use, Continental's mobility study from 2013 [8] is noteworthy in this connection. However, all of the studies have in common that they do not consider any differentiation in the possible forms of automated driving, and are not targeted at possible behavioral changes or potential intended applications.

For this reason, a survey was carried in June 2014 which provides the basis for the empirical findings of both this article and those on the form of the human–machine interface (Chap. 26) and the acceptance of automated vehicles (Chap. 28). This quasi-representative online survey addresses respondents' attitudes and their anticipation of how they would use automated vehicles in the project's various use cases. The sample comprises of 250 complete questionnaires per usage scenario (total 1000) and is stratified according to sex, age, income and education. Using quantitative methods, the dataset allows for an initial evaluation of various user groups' attitudes to automated driving and mobility provision. This supplements the previous section's findings. From a demand modeling perspective, the survey's aim is mainly to comprehend what differentiations with respect to users, trip purposes, intended applications, and transport mode characteristics are relevant when modeling automated vehicles. Also, data analysis should provide the first indications of which transport modes, from today's perspective, automated vehicles would compete with for users, and of how time spent traveling may change, and how these changes are viewed.

The questionnaire begins with questions covering the respondents' socio-demographics, their knowledge of and interest in automated driving, and their previous experience of assistance systems. This is followed by questions on their current use of, and attitudes to, existing transport modes and the usual way they spend time when using them. The respondents also answer in-depth questions on one of the project use cases—Interstate Pilot, Automated Valet Parking, Full Automation and Vehicle on Demand (see Chap. 2). Topics include anticipated use, the transport mode that would be replaced, attitudes towards the vehicle described, the need to be able to intervene, various aspects of the experience, and specific design wishes. The scenarios are described fairly briefly to leave room for the respondents' own interpretations. A tabular overview of the participants' socio-demographic characteristics and the sample structure can be found in Chap. 26.

Fig. 12.1 Stated willingness to substitute favored transport mode with an automated vehicle generally and in the various use cases. Image rights: copyright by the Author

#### 12.5.1 Who Can Imagine Substituting Their Previously Preferred Transport Mode?

To evaluate automated driving's impact on transport mode choice, it is especially important to know what transport modes automated vehicles may replace. To this end, in one of its first questions, the survey enquires into participants' basic willingness to substitute their preferred transport mode with an automated vehicle—at this stage an undifferentiated one. As the questionnaire continues, the respondents are also asked, for one of the use cases, if they could imagine using the vehicle specified or substituting their preferred transport mode with it. The results were also examined as to whether significant differences could be seen in answers according to respondents' socio-demographic characteristics and attitudes.<sup>1</sup> Corresponding relevant statistical values can be se seen as indicators that, when integrating behavior into the models, it should be differentiated according to these criteria—the specific strengths or tendency of the effect is of secondary importance at first.

Figure 12.1 gives the respective answers on substitution desires, which tend to correspond to the general willingness to use automated vehicles (see Chap. 27). It is striking that the majority of respondents can either hardly imagine, or cannot imagine at all, giving an automated vehicle preference over their standard transport mode. Fewer than 15 % of respondents agree with the statement of wanting to use an automated vehicle—no matter what kind—predominantly or as a full replacement. While the proportion of undecideds is very high for the general statement, the agreement value falls sharply for the specific scenarios, between which there is statistically significant variation. With only around a quarter of positive answers, the Vehicle on Demand use case stands out here as being regarded with especial skepticism. Full Automation, on the other hand, is viewed most positively on average.

<sup>1</sup> In the following, differences are indicated as statistically significant when exhibiting values of 0.05 or lower in a Pearson's chi-squared test. For some variables, particularly attitudinal or geographic ones, a test was not always possible, due to the number of cases in individual answer categories.

A differentiated analysis of the desire to switch modes can reveal statistically highly significant differences in terms of household size, presence of children, income, and the number of cars in a household. The most clearly discriminatory factor, however, is attitudes towards cars. These are revealed in questions on what people associate with car driving and whether they take pleasure in it, and also whether respondents could set up their daily lives without a car. Residential location also produces clear differences in the answers. Rural dwellers, for example, are less skeptical in their answers than people in cities. Sex, levels of education and income, in contrast, do not have a statistically significant impact on the answers given, nor does shortage of parking at home or other main reference locations. Looking at the individual usage scenarios, it is notable that there is higher skepticism towards Vehicle on Demand among women, as well as marked differences in the answer patterns vis-à-vis Valet Parking, depending on the presence of children, household size, and income.

The participants were also asked how, in their opinion, using an automated vehicle from one of the scenarios would affect their previous transport mode use. The answers were given separately for each previous transport mode and ranged from "far less often" (−2) to "far more often" (+2). The large percentage of those who assume no change in their behavior is also conspicuous here: With the exception of taxis and conventional cars, a number of respondents consistently between 50 and 64 % state they foresee no change in their transport mode use. The respective mean values of answers given for individually anticipated mode shift effects are shown in Table 12.1. A mean value of 0 is to be taken as indifference. Taxi use is estimated to fall in all scenarios. It is noticeable that Valet Parking produces the greatest associations of switching—particularly from taxi use, with its very low mean value of −0.78.


Table 12.1 Effects of scenarios on previous transport mode use

Mean values of answer options −2 far less often; −1 less often; 0 just as often; 1 more often; 2 far more often

#### 12.5.2 What Do Respondents See as the Specific Advantage of Automated Vehicles?

A further question asks for which intended applications and trip characteristics the respondents would find automated vehicles to be particularly helpful. The answers' mean values are given in Table 12.2. With the exception of escorting trips, there are consistently highly significant differences between the scenarios. This indicates that the respondents may clearly differentiate between the scenarios. The comparatively high agreement values for Full Automation for long-distance trips and excursions are noteworthy, to a lesser extent for trips with higher occupancy rates. Valet Parking is viewed as particularly helpful in urban contexts and for transporting items.

A differentiated analysis points out the fact that, for all trip purposes, male respondents have statistically significantly higher rates of agreement for Vehicle on Demand. This is also the case for work and long-distance trips using Interstate Pilot. We also see that education levels, as measured by university-entrance diploma, have a significant impact on attitudes to Vehicle on Demand for long-distance (cross-country) trips, excursions and escorting trips. The presence of children in the household has a significantly positive impact on how useful Full Automation is viewed for trips in the city as well as cross-country. No correlation was seen for escorting trips, however. On long-distance and


Table 12.2 Respondents' stated answers to the question: "On which trips would you find such a vehicle to be particularly helpful?"

Mean values of answer options: −2 much more rarely; −1 more rarely; 0 as often; 1 more often; 2 much more often

urban trips, the answers given for Valet Parking differ depending on household size and the presence of children. Employment status<sup>2</sup> almost exclusively determines differences in the answers for Valet Parking on long trips, journeys to work, and for leisure activities; the latter also being conditioned by income level.

#### 12.5.3 What Do We Do on the Road Today, and What Will We Do Tomorrow?

The possibility of pursuing other activities during a journey is one of automated driving's main features from a usage point of view. At the same time, time costs are a main driver of transport mode choice in models. To conclude, we shall therefore cast our eyes on the survey results regarding previous and also, perhaps, future time use.

The respondents were first asked how they generally occupied themselves while travelling on (urban) public transport, on (long-distance) trains or in cars. By far the most mentioned activity on public transport was enjoying the landscape and the journey: 50 % of respondents stated doing this frequently or always on public transport, 66 % on trains. Conversation with a companion or other passengers is similarly popular (public transport: 42 %, trains: 49 %), followed by listening to music, reading or relaxing. Around 77 and 69 % of respondents stated they never work on local or long-distance journeys respectively; just under 6 and 8 % frequently or always. The answers on working while on the move differ for train travel to statistically significant degrees according to sex, income, level of education, household size, and the presence of children. For example, 74 % of women and 63 % of men stated they never work on trains. Compared to comparably lower income groups, the likelihood of frequently or always working on board a train doubles with a net household income of over 2600 euros to around 10 %.

The current main activity in cars is, naturally, concentrating on the drive and the route. Around 80 % of respondents also frequently or always listen to music, around two thirds talk to their companions, and over half frequently or always enjoy the trip and landscape while on the road. Seven percent state they sometimes work in cars.

Of the benefits that respondents perceive automated driving as having in terms of alternative time use during a journey, the most mentioned are being able to have conversations and enjoy the landscape—the most popular current activities in cars. As an example, Fig. 12.2 shows the answers for fully automated vehicles. The low proportion of those who see a benefit in being able to work while on the move is notable; in the case of Interstate Pilot this is less than a quarter of respondents.

<sup>2</sup> Employment status is classed as either full- or part-time employment, or other occupation.

Fig. 12.2 Stated benefits of fully automated vehicles. Image rights: copyright by the Author

### 12.6 Automated Vehicles in Demand Modeling: The Potential for, and Limits to, Their Integration

Analyzing the possible effects of the various use cases clearly demonstrates the necessity of differentiation when integrating automated vehicles into demand modeling. While the Interstate Pilot and Valet Parking functions are both to a great extent particular, temporarily restricted special forms of an otherwise largely unchanged form of car driving and vehicle, the introduction of fully automated vehicles involves a practically new mode of transport or, in the case of a Vehicle on Demand fleet, potentially a completely new type of mobility provision.

Surely the greatest challenge in integrating automated driving into demand modeling lies in facilitating greater differentiation of the mode of passenger transport known as the "car." The conventional description of this transport mode option is based on the main criteria of travel time, running costs, and an often not further specified preference structure of the decision maker. Above all, this lacks the possibility of giving the role of the driver and the ownership status sufficient consideration. Differentiating between driving and being driven, and between driving one's own vehicle or any other one, is a prerequisite of adequate mapping. Only in this way is it possible to distinguish the role of the driver from that of the passenger or someone being chauffeured under Full Automation. Just as necessary is differentiation between conventional cars, fully automated vehicles, taxis, or hired Vehicles on Demand. The desire to integrate automated vehicles into the modeling therefore goes hand in hand with the need to describe the currently available individual alternatives with greater differentiation. The fluid transition between being a driver and a quasi-passenger, as experienced in the cases of Interstate Pilot and Full Automation, depending on the user and the journey, poses a particular challenge.

The time spent traveling is one of the most influential drivers of transport mode choice in current modeling. In modeling public transport, it is common to distinguish between on-board or actual travel time, waiting time, and time spent getting to and from the station or stop. This allows the time components to be evaluated differently. Until now, however, time spent in the vehicle has not been analyzed in any great depth, be it for public transport or any other mode. The expectations accompanying the introduction of automated vehicles, of being able to spend time in the vehicle in a subjectively more meaningful way, clearly indicate the necessity for differentiation in the models. Journey distance and duration, and thus also the potential usable proportion of the journey, merit greater attention here, as are the questions of which alternative activities are sought and with whom the journey is made.

But it is not only the time in the vehicle that is subject to change, there is also the most notable of the changes resulting from Valet Parking: minimizing the effort needed to use the mode at the beginning and end of the journey. The same applies for Vehicle on Demand. Again, we see here the necessity of further differentiating the often sweeping analysis of time spent traveling depending on the transport mode chosen. Concrete examples of this include the waiting time for a taxi and the time spent getting to one's own car, or a hired one.

One aspect that can be comparatively easily integrated into models, in simplified form, is the shortening of travel times resulting directly from the lack of traffic jams and traffic related to parking searches. More problematic is that the effect of increasingly reliable travel-time predictions on how cars are viewed as an alternative transport mode is usually unmapped in models. The increased convenience resulting from new functions such as Valet Parking or Interstate Pilot, the potential safety gains, and the greater flexibility of vehicle equipment are further examples of relevant subjective criteria that have barely been considered at all in model-based analyses up to now. The difficulty of recording subjective aspects, quantifying their effects, and taking them into consideration as factors in transport mode selection applies not only to a mode's properties, however, but also at least as much to describing the user. In particular, fun while driving, the perception of one's own driving skills, the readiness to hand over the driving function, the aversion to any potential loss of control, and trust in technology are all examples of factors that acquire greater relevance precisely in how automated vehicles are viewed (see Chap. 28). Such factors should thus be given greater attention in modeling.

Identifying user groups that differ in terms of how they assess the various transport mode options is one of the most important bases of describing people in models. Both the literature-based impact analysis and the survey results clearly indicate that automated vehicles' real or perceived benefits differ not only depending on the scenario, but also according to attitudes and socio-demographic characteristics. Besides the standard attributes of sex, employment status, age, and driver's license, further distinguishing factors that proved relevant included, depending on the usage scenario, presence of children in a household, level of education, and household income. In the course of representating automated vehicles, an expansion of the attributes used in models to describe people, and particularly their household context, consequently requires debate. Furthermore, it is also the case here that attitudinal factors, such as attitudes towards different transport modes, routines or temporal constraints, are hardly ever considered.

For transport mode choice, holding a driver's license and access to a car are especially relevant individual and household attributes. The latter is generally expressed via the number of cars in a household or their actual availability on the behavioral survey's sample day. In macroscopic modeling, car availability is the standard criterion used to distinguish between user groups and determine trip rates. For transport mode selection itself, then, general car availabilityis presumed.Microscopic transport models permit consideration of driver's license possession as well as the actual car availability within the selection situation—whether constraints result from competition for a vehicle's use within the household or, especially, in the course of a trip chain. Systems such as Vehicle on Demand systematically break down this restriction to availability—this type of car can theoretically be selected as a new mobility option by anybody at any time. Just as with carsharing systems, adequate model representation requires a rethinking of, not least, the geographic and social criteria of car availability.

The consideration of geographic and contextual attributes, and the differentiation of possible usage or trip purposes, were given as further criteria for transport mode choice in models in Sect. 12.3.2. Particularly in the Valet Parking use case, the importance of geographic factors for how useful an option is perceived to be is intuitively apparent. Although the degree of detail in demand modeling is generally high enough to provide information about settlement structure, general land-use structure, and building density, details of building structure—crucial to whether there is sufficient public or even private parking—are not usually given. Detailed modeling of parking-space availability, pressure on parking space and the associated costs, and the time needed to get to and from parked cars are rarities (see Sect. 12.3.2). In this field, a general need for improvement can be stated if an adequate modeling of Valet Parking is to be achieved.

Vehicle on Demand is another example in which urban structure determines usage and the state of competition between existing transport modes to a considerable extent. It particularly forms an alternative to private cars, taxis, and public transport in urban areas, for example, whereas in rural areas it is mainly seen as a potential feeder service, and thus as a supplement to public transport. The job of modeling is therefore to anticipate worthwhile deployment concepts and availabilities, and to integrate these into the intermodal supply models. Further desirable improvements in transport supply models include the incorporation of parking-search traffic, and identifying route sections that are prime candidates for the use of automation.

The Vehicle on Demand use case makes it particularly clear what fundamental impact automated vehicles might have on our vehicle ownership, and thus on our everyday mobility decisions. The modeling and quantification of causal interrelationships—between ownership or other options for accessing a vehicle and its most important features, such as being equipped with Valet Parking or Full Automation on the one hand, and the supply-side, the geographic setting, and socio-demographic characteristics of the respective household on the other—take on increased significance here. The conventional approach of allowing solely for the ownership of an average car as an input parameter is being more and more superseded, especially for emissions calculations, by upstream models incorporating a household car's drive type, size class, price segment, number of seats, or cargo capacity. Support functions such as Valet Parking, however, play just as small a role in this as the alternative of carsharing membership or getting rid of a car due to good provision of alternative transport modes. It is not just the question of who could substitute owning a car with hiring one or being driven that remains unanswered in conventional means of modeling. Assuming that the combination of privately owned cars and various Vehicles on Demand particularly promotes the flexible adaptation of vehicle choice to the respective usage situation, then the necessity to gather and analyze the necessary data, and correspondingly expand the modeling becomes apparent.

## 12.7 Summary and Outlook

It is generally expected that automated vehicles in various forms will form part of our daily mobility in the near future. Integrating the relevant transport options into demand modeling one of the most important instruments in planning—is thus both equally challenging and necessary. Existing empirical work on the expected impact has until now focused primarily on the technology. At the same time, looking into the future is naturally full of uncertainty, and the effects of new technologies can only be appraised with difficulty.

If one looks at the individual use cases with regard to their potential impact on transport mode choice, then the need to distinguish between them is immediately apparent. Both Valet Parking and Interstate Pilot are mainly associated with lightly modified "normal" cars that offer a benefit in special situations: improved access to the vehicle and no need to search for a parking space in the case of Valet Parking, optional handing over of the driving function on selected routes or in special driving situations in the case of Interstate Pilot. The introduction of fully automated vehicles brings with it the idea of a substantial improvement in how time spent traveling in the vehicle is assessed, accompanied by fewer obstructions to car use. Far-reaching effects on the whole transport system can above all be seen in the scenario of broad availability of Vehicles on Demand, where individual mobility will be possible independently of driver proficiency or vehicle ownership. Presumably, this driverless urban carsharing will lead to a reduction in escorting trips and taxi use, as well as a clear drop in car ownership. In the countryside, it could open up access to public transport.

An online survey was employed to examine whether respondents could imagine using an automated vehicle in various usage scenarios and what transport modes they have been using until now these kinds of vehicles would substitute. Besides general skepticism, which even increased when the various scenarios were specified, the sizable influence of currently held attitudes towards cars is apparent. Sharp falls in taxi use are anticipated in particular. The specific advantages of automated vehicles are envisaged for long journeys especially, and also in the urban context in the case of Valet Parking. Taking pleasure in the journey and the landscape, and talking with fellow passengers are currently the preferred activities in both local and long-distance travel with public transport; more than two thirds of respondents state that they never work on the move. While travelling in cars, listening to music and conversation are among the most common activities. When asked about future time use when driving automated vehicles, enjoying the landscape and chatting are likewise the most prominent responses.

Not all factors relevant to how automated vehicles are perceived and evaluated can be incorporated into transport models, with their simplified representation of causal interrelationships in traffic generation. In particular, non-rational, "soft" perception and assessment factors, such as fun while driving, or the desire/reluctance to hand over the driving task, can only be empirically grasped and considered in models with difficulty. Both the empirical basis and the implementation in models show a need and potential for expansion here.

The main challenge in integrating automated vehicles, however, lies in what until now has only been a rudimentary differentiation of "cars" in models. Improvements in the empirical foundation, and the possibilities for integrating it into models, are again required here, including an underlining of the role of the driving task and vehicle ownership in transport mode choice. The aim is to allow for clearer distinctions between driving and being driven, between fully automated vehicles and ones which assist only when desired, and between privately owned cars, hired cars, and taxis. The need to rethink vehicle ownership as a fixed input variable is also apparent here.

The possibility of spending time on the move in different ways is, alongside safety, one of the most-mentioned benefits of the automation of driving. Time costs are also a key factor in modal choice in transport demand modeling. Until now, however, no differentiation of travel time has usually been provided for in models. It is not currently possible to distinguish between time spent in a "meaningful" way and time "wasted," between actively enjoying driving and being stuck in tiresome traffic jams, and between productive work and relaxed listening to music. Such an expansion of the models is not in principle difficult—initially independent of which alternative activity is actually being sought after. However, it is again evident that there are substantial gaps in the empirical foundation upon which demand modeling is built, that need filling before an adequate integration of automated driving can be achieved.

Open Access This chapter is distributed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, duplication, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, a link is provided to the Creative Commons license and any changes made are indicated.

The images or other third party material in this chapter are included in the work's Creative Commons license, unless indicated otherwise in the credit line; if such material is not included in the work's Creative Commons license and the respective action is not permitted by statutory regulation, users will need to obtain permission from the license holder to duplicate, adapt or reproduce the material.

#### References


# 13 Effects of Autonomous Driving on the Vehicle Concept

Hermann Winner and Walther Wachenfeld

## 13.1 Introduction

Since Carl Benz invented the automobile in 1886, some very different vehicle concepts have been developed. Some can be regarded as the logical continued development and replacement of former concepts, such as the renunciation of the carriage design and the integration of the wheels and chassis under the (self supporting) body. The main factor that influences the vehicle concept is the purpose. This can particularly be seen when considering commercial vehicles. However, a wide range of passenger cars has also been developed, from convertibles and SUVs characterized by the owner's lifestyle to multi-purpose vehicles with sedans and hatchbacks as well as station wagons and (mini) vans. The type of use is even more important for small delivery vans, minibuses and what are known as light trucks on other markets. Under the hood, there has been a move toward transversely installed front engines with front-wheel drive over the past decades, after the dominance of longitudinally installed engines with rear-wheel drive. Furthermore, there is currently a trend towards electrification of the power train, deemed more sustainable due to CO2 specifications, less noise emission and other advantages. Despite all these changes, it is not expected that the existing drive concepts will "die out", since the divergence in the optimization aims of the different market segments will continue to support this diversification of concepts. For example, a rural area in the USA has completely different drive requirements to a big city in China.

H. Winner (&) W. Wachenfeld

Technische Universität Darmstadt, Institute of Automotive Engineering—FZD, 64287 Darmstadt, Germany e-mail: winner@fzd.tu-darmstadt.de

W. Wachenfeld e-mail: wachenfeld@fzd.tu-darmstadt.de

© The Author(s) 2016 M. Maurer et al. (eds.), Autonomous Driving, DOI 10.1007/978-3-662-48847-8\_13

The diversity of vehicle models available on the market is accompanied by the concept diversity of "show cars" presented at motor shows. Assistance systems and partial automation are only concept changing in very few cases for familiar vehicles. The visible trend over the past years of poorer outward visibility in vehicles, justified by styling requirements and/or requirements relating to the body rigidity does, however, support the use of compensating systems such as ultrasound parking aids, rear-view cameras or the surround-view display. However, driver assistance systems generally do not change the concept, as only a few are included as standard equipment for a vehicle model series. As a result, the vehicle manufacturer is required to design the vehicle so that vehicles without this equipment can also be safely driven by the driver. As the willingness and ability of the driver to take over are also prerequisites for partially automated driving [1], major changes compared with conventional vehicles cannot be expected. Only concepts that benefit a takeover, such as new human–machine interfaces for assigning a partially automated function may find their way in [2]. Not only former concepts, but also current drive-by-wire concepts with alternative control elements (see [3]) were restricted to replacing the function of the steering wheel and pedals without providing a design for the automation of the higher vehicle guidance levels that are indispensable for automated driving.

Although it is not yet possible to determine a trend toward another concept due to higher levels of automation, this may change with a considerable change in vehicle guidance. This results in the following question: If the opportunity of autonomous driving unsettles the current world of concepts, is this due to a significant shift in market shares or due to new concepts?

Before addressing this question in detail, the key conceptual features must be defined in order to create a level plane that applies to the overall vehicle and so that the even more diverse world of detailed solutions can be faded out. Prior to this, the requirements that will dominate concept selection in the future should be identified.

Figure 13.1 shows a selection of areas from which the requirements result. Many of the requirements are linked physically—often with conflicts—and can only be combined after a process of weighing up and prioritizing, for example streamlined aerodynamics versus distinctive styling components.

A distinction is made between the following domains


for this discussion of the top concept level. As major vehicle component clusters, these are always linked to the occupants and the environment, especially the road environment. The interaction between these areas can be represented abstractly as transfer of mass, energy and signals (see Fig. 13.2). Since vehicle automation radically changes this

Fig. 13.1 Requirement areas for a concept decision [4]. Image rights: copyright by the Author

Fig. 13.2 System analysis: driver-vehicle environment. Image rights: copyright by the Author

transfer, the modules are also affected. One example of the effect of automation is the exchange of signals between the environment and humans. The occupant no longer has to pursue the task of driving and therefore no longer has to exchange signals with the surroundings in order to reach the destination. This approach based on the transfer of mass, energy and signals makes the further structuring of the analysis possible, taking interfaces into account.

These concept-defining areas and their interfaces for the use cases selected in Chap. 2 as well as the application scenarios possible as a result are examined in the following.

#### 13.2 Interstate Pilot Using Driver for Extended Availability

Although the two use cases "Interstate Pilot" and "Full Automation" have very different performance capabilities when it comes to autonomous driving, there are no differences when it comes to considering vehicle concepts, since both use cases are restricted to having a driver available for extended availability. For the "Full Automation" use case, autonomous driving can be used more extensively and a takeover is requested less often. However, in both cases it must be ensured that vehicle guidance is possible without restriction by a person with driver's license in their function as a driver for extended availability. Therefore, for both cases, the vehicle guidance is to be supported as a "mixed mode"—autonomous or manual.

#### 13.2.1 Effects on the Body Design

Compared with the expected comparison concepts, which do not provide autonomous driving capability, no concept-defining change is perceptible for the planned continued manual vehicle guidance. For, as long as the extension and availability use-case concepts (see Chap. 2) are based on control by the driver, the degree of freedom when it comes to the body design is restricted. The external dimensions of the vehicle, as well as the positioning and size of the windows, must still be tailored to the driver, meaning that designs similar to those today are to be expected.

Sensors are required for virtually every viewing angle for autonomous driving, which will surely result in complex package solutions if discreet visibility is aimed for as to date. If a standard is actually to be set given for the capability to drive autonomously, this would be beneficial for the developers as they would be able to occupy outstanding sensor positions in the true sense of the word (see Fig. 13.3 as an example). Otherwise, no major deviation between the vehicle concept and comparison vehicles is expected, since these use cases "only" add a new feature to the existing concepts without affecting the basic principle of the vehicle or the application area.

Fig. 13.3 Team anyway test vehicle, environment sensors [5]. Image rights: Springer

#### 13.2.2 Effects on the Drive Concept

There is no reason to evaluate the drive concept differently for the potentially remaining manual journey segments than for similar vehicles that are not autonomous. However, autonomous driving simplifies incorporation into the traffic telematics compared with manual driving, making more efficient driving possible. The driving characteristics can be controlled depending on time and energy requirements. In principle, these options are already available on vehicles with partial or highly automated driving functions, meaning that the next step towards autonomous driving results in barely any relevant changes to the drive concept. It is more the new networking options which benefit the drive concepts with lower overall availability, such as battery-electric drives.

#### 13.2.3 Effects on the Chassis Design

While manual driving needs a chassis with the standard requirements, long phases of autonomous driving enable the occupant(s) to be decoupled from the driving process. Automation needs neither tactile sensitivity for driving dynamics nor the transverse and longitudinal force action which impacts the occupants with vehicle acceleration. It can revert to the vehicle motion sensors that have long been in use for electronic stability control in order to regulate the trajectory so as to make the latter dynamic and comfortable.

A tilted chassis as available for rail transportation for some time could at least compensate for the standard moderate lateral accelerations of 1–2 m/s<sup>2</sup> . This would require an overall tilting angle of approximately 6–12°. This overall tilting angle can be represented by the tilting angle of the road surface, the vehicle configuration roll angle and the seat angle, see Fig. 13.4. It seems possible that lateral force compensation can be achieved using the chassis alone, as the 2014 market launch in the S-Class Coupé model of Mercedes-Benz initially shows. By contrast, the deflection and rebound required for longitudinal force compensation is more than double the current spring travel. To achieve a compensation in the specified range here too, this would only be possible by implementing (separately or additional) seat tilting.

As fascinating as the idea of a journey free from longitudinal and lateral forces is, especially for rest periods, it is equally problematic with respect to the desired visual connection between humans and their environment, since the visual impression no longer matches the kinesthetic and vestibular impression. However, even with visual decoupling, the rotational acceleration which is sensed in the vestibular organ can cause occupants to feel unwell. This is because, unlike translational acceleration, this cannot be compensated for if the passenger cell cannot be turned against the vehicle's direction of travel. In addition, it is not possible to adjust the tilt angle without rotational velocity and accelerations, which significantly reduce the tilt dynamics. Thus, with a perception limit for the rotational acceleration (rolling) of 4°/s<sup>2</sup> as determined in experiments [6, 7], the target angle for acceleration compensation is not achieved for 2.5 s. With a very anticipatory autonomous driving style where there are no external interferences, such as other vehicles which have to be reacted to with high changes in acceleration, this can just still be considered in trajectory planning. The perception limit used is the result of an experiment and therefore dependent on the underlying test setup. Other experiments give different values depending on the corresponding test setup, the rotation axis and the test person (0.3–6°/s<sup>2</sup> ). A compilation of different studies into this topic can be found in [7–9].

Fig. 13.4 Tilting concept when cornering: left addition of forces impacting on occupants; center seat angle; right angle by means of chassis. Image rights: copyright by the Author

Compensating for the disturbance from vertical forces seems to be simpler. In conjunction with the front surroundings sensors, the feeling of a sedan chair should be possible. For reasons of safety this decoupling should be deactivated in order to give priority to the driving dynamics. This sedan chair could be based on electronically controlled air suspension concepts with adjustable dampers or fully active electromechanical spring-damper units. Relevant counter measures generally have to be taken in order to avoid low-frequency pitching movements which cause "seasickness".

#### 13.2.4 Effects on the Vehicle Interior and Human–Machine Interaction

The necessity of an available driver means that a driver's workplace must always be provided. For this reason, the arrangement of the vehicle interior will be characterized by the need for a seat with a dashboard and operating elements. This means that no major concept changes are to be expected within the framework of the use cases considered (Interstate Pilot and Full Automation). As an alternative to the currently familiar human vehicle control using a steering wheel and pedals, an alternative control concept may be implemented, drawing on partially automated basic functionalities. This could also be linked with other space-saving control elements. Otherwise, several concept vehicle examples include the option of moving the control elements, particularly the steering wheel, to a less disturbing position, meaning that the space in front of the driver is available for the "alternative program" during autonomous driving. Some kind of lock for the operating controls may also be required so that they are not accessed accidentally, causing an unintentional takeover.

As well as using the driver's workstation as a mobile office for work or a media platform for entertainment, autonomous driving also allows the travel time to be used for relaxation or communicating with fellow passengers. Accordingly, for vehicles with this use case, the seating concept is expected to accommodate the respective requirements, although a lot of it is already implemented in current vehicles, even if not for the driver's seat.

#### 13.3 Autonomous Valet Parking

Autonomous valet parking can help to solve the parking space problem for private car owners in residential areas or at workplaces and, for car-sharing users, can bridge the gap between the car-sharing parking position and the desired point of entry or exit (Chap. 18). Apart from this feature, the vehicle is a completely "normal" vehicle, which provides the existing capabilities for assisted, partially or highly automated driving.

When there are no occupants or objects in a vehicle, it is possible to use the free space in the vehicle with a variable body concept. Concepts with this function already exist today, enabling the dimensions of a vehicle to be reduced during parking. However, the authors are not aware of any use in series production, probably because the requirements for high passive safety clash with the requirements for a variable body. Although autonomous valet parking is advantageous for this type of space-saving due to lower parking rates, at the same time it reduces pressure on making the most of the space available, since the route to a large parking space is now tackled without cost or time-pressure. It is difficult to predict whether the fuel consumption for the route to the parking space ends up being more than for searching for a parking space.

Otherwise, autonomous valet parking does not result in any other fundamental degrees of freedom for the vehicle concept.

#### 13.4 Vehicle-on-Demand

The vehicle-on-demand use case refers to a completely driver-less vehicle which does not have a driver's workplace and cannot fall back on the driver's capabilities. This results in new degrees of freedom for the design of these vehicles. The following describes these for this use case. Since this concept favors use over ownership, it can be assumed that in most cases the user neither owns nor has ownership responsibility for the vehicle. Instead, service providers make these vehicles available for mobility services (Chap. 18).

#### 13.4.1 Effects on the Body Design

For the use case with driving speeds of up to 120 km/h, which covers almost all areas of use, the vehicle body must provide the occupants with weather and impact protection in line with that of current vehicles. This is associated with considerable design restrictions. A closed passenger compartment, possibly with a convertible roof, is required for weather-protection reasons. A safe shell with restraints must also be planned for the passengers in order to guarantee the same passive safety as in current vehicles, with seat belts and airbags. This requirement will exist for as long as it is not possible to ensure accident-free operation in road traffic, which is currently not conceivable, at least in mixed traffic with driver-only vehicles. The vehicle shape may correspond to that of current vehicles depending on the purpose and target group, with a large range of variants possible. One-box cars provide the best space economy. Like a cuboid, they are not lowered at the front or rear of the vehicle. Of course, designers will also make an effort to present the selected shape to appeal to the customers. However, with the wide range of possible uses for a vehicle-on-demand concept, the styling target is still largely unclear, especially to what extent individual emotions will be catered to. A look at the history of road vehicles shows that there are examples for almost every body design that are regarded as aesthetically successful or unsuccessful. As a result, it is not possible to predict a trend from the shape alone. However, all vehicles that include speeds higher than the 120 km/h specified here will have aerodynamic state-of-the art shapes, meaning that they will have curves and aerodynamic tapers and air flow break-away edges [10].

As well as its protective function, the shell around the passengers is also responsible for connecting the passengers with the environment. In principle, full decoupling is possible as there is no need to guarantee that the driver can see. This enables private use of the cabin for entertainment and relaxation, virtually free from visual and acoustic disturbances. However, the influence of driving dynamics can only be insulated to a certain extent, as described in Sects. 13.2.3 and 13.4.3. There will always be the challenge of guaranteeing that the impressions of the different senses correspond, as otherwise this results in discomfort or even sickness, which is unlikely to result in insulation concepts of this type being accepted. Figure 13.5 shows what a complete decoupling during the journey would look like on public roads.

The range of alternative activities made possible by this decoupling is large and ranges from reading in a relaxing "environment" (right-hand vehicle) to exciting entertainment on racing tracks (left-hand vehicle). The challenge of guaranteeing that the impressions of the different senses correspond also applies to the artificial representation of the environment. The option of selecting the degree of decoupling using manually operated covers (blinds) in the simple case to high-tech solutions such as electro-chromic windows definitely makes it easier to reach a compromise. A virtual connection with the environment in the form of live camera images of the environment which can be shown (on screens, as a projection) is also conceivable, but requires a very high level of passenger trust in the

Fig. 13.5 Decoupling the passengers from the real road traffic. Image rights: copyright by the Author

reliability of the technology. Traveling in an autonomous vehicle should not be associated with the fear of being exposed to an insulation cell without contact with the environment, even temporarily. A compromise between the virtual and real world is the provision of information about the environment in the form of an "augmented reality", in which information about landmarks is shown as they are seen, for example.

#### 13.4.2 Effects on the Drive Concept

It is not possible to derive any restrictions for the drive from the use case alone. Both classic combustion engines and electric drives as well as mixed forms (hybrids) are fundamentally suitable. Their advantages and disadvantages also apply for vehicle-on-demand. On the one hand, there are the storage and charging advantages of chemical energy that allow the vehicles powered by combustion engines to have a larger range, and on the other hand, the noise and pollutant emissions advantages of electric drives which are particularly valued in areas with a high population density. It must be ensured that there is enough energy on board for the intended trip for vehicle-on-demand. Therefore, a supply concept where a vehicle charges during time spent stationary is assumed. Suitable service points will offer this service both manually and automated, whether at conventional fuel filling stations or special electric charging stations. Inductive battery charging is particularly suitable here. Depending on how much the vehicle is used, the disadvantage of higher charging times for electric vehicles has varying impacts: If the stationary times are still higher than the traveling times, the charging times are generally part of the non-use time and therefore do not represent a high economic strain. This is different when the vehicles are intended for use almost around the clock. When this is the objective, the time required for energy provision is of considerable consequence, since charging the batteries results in a significantly larger drop in use than refueling vehicles powered by combustion engines.

(Hydrogen) fuel cell drives will be easier to implement with vehicle-on-demand concepts since a service provider—possibly even in association with other providers—can integrate the tank infrastructure into the process better than standard vehicle users. This means that parking spaces (= disposition points) and hydrogen filling stations can be coordinated, both with respect to the location and the process. The routes can also be designed based on the connection between the hydrogen filling stations from the start if one filling is not sufficient for the mobility service. Additionally, unavoidable evaporation losses that occur with hydrogen pressure tanks when stationary can be minimized to a large extent since the time spent stationary should be very low for vehicle-on-demand with economical operation. Despite the advantages of the vehicle-on-demand concept for (hydrogen) fuel cell technology, both channels, i.e. vehicle-on-demand and hydrogen drives need to achieve access to the market independently of one another. (Forced) coupling of the technologies for the market launch only reduces the prospects for both, since it results in only a fragment of the use options and therefore a limited market volume which is too small to justify the investment for both technologies.

#### 13.4.3 Effects on the Chassis

Force transfer for vehicle-on-demand will continue to be the responsibility of the tires, since neither the advantages nor the disadvantages of alternative concepts (e.g. air cushions/propellers, magnetic levitation drive, chains) are significantly affected by vehicle automation. The driving dynamics requirements are also only going to change minimally, and the requirement of a particularly sporty chassis is unlikely to be included in the requirements specification for a vehicle-on-demand. The deceleration and evasion capability (i.e. acceleration of up to ≈10 m/s<sup>2</sup> ) will barely be lower than on current vehicles, even if a considerably more comfortable vehicle guidance is to be expected. However, with vehicle-on-demand, it is possible to plan the maneuver predictively in advance and thereby make the most of the opportunities provided by the existing driving dynamics, which could result in new opportunities for the chassis design.

As well as the two aspects discussed in the following sections, wheel layout and steering concepts, the same considerations regarding decoupling from the driving dynamics as described in Sect. 13.2.3 apply. This is particularly true for vehicle-on-demand vehicles with the purpose of transporting persons on longer journeys. Although decoupling the human driver from the driving dynamics and the environment requires a huge amount of technical effort, it would enable better correspondence of the different sense impressions than if only one part of the impressions were to be decoupled. A corresponding decoupling would also be useful for transporting sensitive goods.

#### 13.4.3.1 Possible Wheel Concepts for Vehicle-on-Demand

If we consider the stabilization task for a human driver, vehicle-on-demand makes it possible to select a wheel concept without taking currently applicable requirements into account. This degree of freedom motivates existing concepts with fewer than four wheels to be reassessed for use as vehicle-on-demand.

As proven by motorbikes and three-wheelers, vehicles with fewer than four wheels are also suitable for transportation. In principle, one wheel alone is sufficient for movement, as unicyclists impressively demonstrate. Regulating the position of the center of gravity is the most important role here. A mechatronic system could take on the task of stabilization, enabling just about anyone to ride and control a one-wheeled vehicle. Two methods can be used here: Torque generation on the wheel and displacement of movable masses.

The first of these concepts is used on the two-wheeled SEGWAY® personal transporters [11]. "Weight shifting" via feet is sensed and the passenger angle is adjusted to suit the acceleration so that the resulting vector of gravity and inertial force always passes through the line connecting the wheel contact points. The same method is used for maneuvering with two wheels one in front of the other. A steering movement in the opposite direction to the direction of the corner results in a rolling moment which generates an angle which guides the resulting vector of centrifugal force and gravity through the line connecting the two wheel contact points. In principle, a ball drive could carry out this stabilization for both directions. However, it is still highly questionable whether implementation of this kind of stabilization is useful in the context of autonomous driving. The user is always strongly incorporated with the weight support. Furthermore, these concepts are restricted to low speeds since vertical unevenness such as curb levels or potholes overburden both the control dynamics and the actuator capacity and therefore cannot prevent crashes. This consideration also applies to single-axle two-wheelers such as the SEGWAY PT mentioned above. These vertical obstacles are not a problem for motorbikes in transverse movement, even if phenomena such as kick-back reveal the sensitivity of vehicle stabilization of two-wheelers.

In the same way as tightrope walkers use their arms to balance, in the second concept, a mass is displaced in such a way that the center of gravity is moved to suit the longitudinal or lateral forces without any help from the occupants. To stabilize this displacement, torque is briefly applied to the wheels. The SEGWAY P.U.M.A. (Personal Urban Mobility and Accessibility) concepts [12] and the implementation by General Motors as an EN-V (Electric Networked-Vehicle) [13] are used in connection with autonomous driving. The good maneuverability (turning on the spot) and lower space requirement mean that this vehicle is well suited to urban use, and this is, of course, not only restricted to autonomous driving. The disadvantages are the permanent stabilizing effort which "consumes" a larger share of the energy on board and the sensitivity to vertical levels specified above, although the design results in this being less than expected since the movable mass can reduce the drive torque required for correction here. According to statements to date, the maximum speed is planned to be 25 miles an hour, or 40 km/h. This concept is hardly suitable for use up to 120 km/h.

Movable masses can also be used for the classic single-track two-wheeled layout, although it is more difficult to satisfy the space requirement for the displacement option in the transverse direction than in the longitudinal direction for a single-axle two-wheeled vehicle. For this reason, a steering actuator that can carry out balancing seems more promising for autonomous motorbike guidance. However, it remains questionable whether a concept like this can comply with the mobility requirements for a vehicle-on-demand. Full enclosure is cumbersome and significantly increases side wind sensitivity. However, it should not be ruled out as, in addition to weather protection, an enclosed frame also considerably improves safety, as shown by the BMW C1 scooter produced from 2000 to 2003 [14]. Equipped in this way, a single-track two-wheeled vehicle-on-demand is conceivable, possibly including stabilizers for very low speeds and when stationary. However, whether the special mobility of single-track vehicles, such as passing queues of traffic, can be implemented with autonomous driving is another question.

The two approaches have an opportunity in common: They can both provide force-free driving in one direction. On the single-axle two-wheeled vehicle, the longitudinal force on the occupants can be fully compensated for, and on the single-track two-wheeled vehicle the same applies for the transverse force. It is an open question whether a passenger experiencing the trip as a passive occupant finds this to be pleasant.

With three or more wheels, a vehicle is stable without control as long as the force vector resulting from inertial force and gravity does not leave the area between the connection lines surrounding the wheel contact points. Depending on the height of the center of gravity h<sup>s</sup> and the driving dynamics limits to be taken into account due to the maximum friction coefficient lmax; the area of the resulting vector with the road surface is a circle with radius rres ¼ h<sup>S</sup> amax=g ¼ h<sup>S</sup> lmax around the central point, see Fig. 13.6. The central point is the result of projecting the center of gravity in the x–y area of the road surface. The driving dynamics limits result from the (absolute value of) maximum longitudinal and transverse acceleration in relation to gravity acceleration g (assumed to be the same for both directions here amax=g). If the outer connection lines of the wheel contact points intersect this circle, there is a danger of rolling over. If they are outside of the circle, it is still possible that the vehicle may roll over in unfavorable conditions, as proven by the well-known example of the first Mercedes-Benz A-Class (further details are available in [15]).

The minimum footprint area required to resist rolling over on a three-wheeled vehicle, determined by the wheel contact points, is <sup>A</sup>FP;<sup>3</sup> <sup>¼</sup> <sup>3</sup> ffiffiffi 3 <sup>p</sup> <sup>r</sup><sup>2</sup> res and thereby approximately 30 % larger than the quadratic area. More problematic is the 50 % larger minimum width of a three-wheeled vehicle, which unlike in Fig. 13.6 is based on two corner points in the longitudinal direction (otherwise 73 % larger width in the position shown). For this reason, a three-wheeled vehicle with purely static support will be unlikely to be used for automated driving.

#### **Footprint for tilting stability**

Fig. 13.6 Footprint area required for resistance to rolling over. Image rights: copyright by the Author

A hybrid chassis solution with a footprint that is too small for static support makes it possible to displace the center of gravity so that the circle drawn in Fig. 13.6 is displaced in relation to the chassis, e.g. moves to the left in a left-hand bend. The displacement can be represented using a translational movement or a rotational movement. The Piaggio MP3 three-wheeled scooter design is an example of the latter [16] with two front wheels and parallelogram kinematics enabling an angle for the complete scooter structure. As a result, this vehicle has a restricted static tilting stability, however it does not require permanent control for constant conditions, e.g. for driving on straight roads. This type of concept would definitely be an option for vehicle-on-demand in conjunction with the enclosure mentioned above and a protective frame, if the transport requirement is to transport one, or maybe even two people.

Similarly, a third wheel can also complement a single-axle concept such as the EN-V mentioned already. Here, a wheel affixed in front of or behind the main axle is responsible for static support. However, the retention of rotation while stationary requires that the additional wheel can be steered. Four-wheel designs with a footprint that is too small to resist rolling over are conceivable. An example of this is the Nissan Land Glider study [17], a vehicle with a width of 1.10 m which can assume a lateral angle of up to 17°. Whether this still relatively large width compared to a scooter is accompanied by the advantages for a vehicle-on-demand compared to a standard vehicle of normal width without tilt technology is disputable. The ability to compensate for the transverse force on the occupants using tilt technology could be a plus point in its own right. As well as tilting systems, adaptive chassis with a variable track width or a variable wheelbase and variable center of gravity height could fundamentally also result in resistance to rolling over as required [18].

#### 13.4.3.2 Steering Concepts

Currently, axle pivot steering on the front axle is dominant, and there is little reason to not use this for vehicle-on-demand too. However, the status of alternative steering concepts could be enhanced by autonomous driving. These include steering by forces like a skid steer, which can range from different forces to different force directions on one axle, e.g. a negative driving force on the left and a positive driving force on the right for turning to the left. This concept is the method of choice for the single-axle two-wheeled vehicle. The steering by forces results in considerable restrictions for three or four-wheeled vehicles if there is not at least one additional rotational degree of freedom for the wheels to support steering control.

Alternatively, multi-axle steering is possible, often referred to as four-wheel or all-wheel steering. Although this is known of in vehicle technology, there are only very few vehicles available with it. Use is restricted due to the compromise design of current all-wheel steering vehicles which vehicle developers have to carry out. The driver cannot access the rear wheel steering. It is coupled (electronically) to the front wheel steering. In a trade-off, it currently supports the vehicle agility at lower speeds (≲100 km/h) with inverse steering angles and the stability at higher speeds (≳100 km/h) with concordant steering angles. Steering corrections are also carried out in the critical limits of driving dynamics. Autonomous trajectory planning could use this degree of freedom independently of the speed and in accordance with the planned maneuver. This would make it possible to change lanes without yawing, i.e. without rotation around the vertical axis, allowing the repercussion on the passengers to be reduced. When parking, maneuvers are possible that are not possible with all-wheel steering as in a standard set-up, far less with standard front-axle steering.

An extreme solution would be all-wheel steering that controls each wheel individually. This would be able to position all the wheels in an optimum angle but which requires more complicated actuator systems. There is little advantage for the application as a vehicle on-demand. It is restricted to a displacement of driving dynamics limits of a few percent, principally relevant for racing and a reduction in cornering resistance due to restriction-free wheel control.

#### 13.4.4 Effects on the Vehicle Interior and Human–Machine Interface

If the vehicle on-demand is used to transport passengers, the possibilities specified in Table 13.1 are available for the type, direction and positioning of passenger accommodation. There is fundamentally no reason not to continue with the current usual positioning of seats in front of and beside each other, facing forwards. If occupant protection allows it, it is possible to deviate from this, and the fully reclined position in particular should be offered for relaxation, although the direction remains open, e.g. as a row of seats in the transverse direction or as a reclining seat in the longitudinal direction.

As the occupants are not expected to take on any driving tasks, the interface is essentially restricted to entering the destination, occupant information and a safe-exit switch which causes the vehicle to stop at the next safe point. The first two could even be separated from the vehicle and could be implemented using a personal device similar to today's smartphones. Advanced interactions are to be expected for controlling the ambiance (e.g. closing the (electronic) blinds) and any entertainment programs.


Table 13.1 Generally possible accommodation of occupants—type, direction and position

#### 13.5 Use Case Overall View

Autonomous driving varies less by vehicle concept than by the use of driving time. With the current statistical vehicle occupation of 1.5 persons [19], the majority of these persons cannot make use of the options available to passengers today, such as reading, working or sleeping, see Fig. 13.7. Autonomous driving makes this possible. Additionally, activities are possible which would currently result in impermissible distraction of the driver, e.g. from multimedia entertainment on a large screen and surround sound to what is referred to as 4D cinema.

There is a further change to the user group. Previously, a driver with driving authorization was always required. With vehicle-on-demand, this restriction no longer applies, meaning that new users who could currently only be passengers in the vehicle can use the autonomous vehicles. These could be people who are not permitted to drive due to physical disabilities (e.g. visual impairment) or persons who are not able to drive due to mental health issues or simply groups such as children and young people who are not permitted to drive due to their age. Accordingly, the vehicle and the operational concept must also be adapted for these users. First, it is necessary to define the requirements as to what authority the occupants have over what happens in the vehicle and on the driving.

Fig. 13.7 Usage options for occupants during autonomous driving. Image rights: copyright by the Author

#### 13.6 Changes that Go Beyond the Vehicle

If the focus so far was on the individual vehicles, the system boundary is expanded in this section to include interaction with the environment and other road users. The interconnectivity of vehicles will be established as technology for all (new) vehicles early on, meaning that the introduction of autonomous driving does not result in anything fundamentally new. However, automation of vehicles also increases their performance capability, making new forms of use possible. The higher level of precision expected in autonomous vehicles means that electronically controlled maneuvers are possible which would scarcely be conceivable in this form in current traffic. These opportunities include convoy driving with very small distances between the vehicles or driving in particularly narrow driving lanes. The impact on the flow of traffic can be seen clearly in Fig. 13.8. The number of traffic elements that cross the depicted traffic area per time unit increases. If this is coupled with the corresponding pre-emptions, this can boost autonomous driving. Depending on the specifications associated with these pre-emptions, the vehicle concept may also change, and even the appearance may change with these specifications. The extent to which a regulation like this can affect the vehicle concept can be seen in the restriction of the overall vehicle length of trucks in the EU. As a result, all tractive vehicles in Europe are equipped with a sheer, space-saving vehicle front, while vehicles in North

Fig. 13.8 Reduced distances between vehicles—made possible by high-precision autonomous driving. Image rights: copyright by the Author

America that are not subject to this restriction have an aerodynamic hood extending forwards.

Mass transfer during the journey is conceivable, if still very unusual from today's perspective. This is already implemented in agriculture (e.g. unloading crops while reaping) and in aviation in the form of refueling while still in the air. This could save time and space when transporting goods or passengers. Accordingly, suitable transition areas would have to be included in the vehicle design. This principle is illustrated in Fig. 13.8. A long-distance vehicle similar to a truck transfers goods to the smaller "distributor vehicle" during the journey. Automation means that the journey is synchronized precisely and a bridge-like construction makes it possible to exchange goods. This means that completely new logistics and mobility concepts can be developed. However, without discussing the overall system, designing a vehicle does not make much sense, which is why this is not covered in more detail here.

#### 13.7 Follow-Up Concepts

While the use cases examined throughout have the potential to help with the breakthrough of the technologies required for autonomous driving, a number of applications that alone would not be sufficient to help a technology to reach the required maturity would benefit from this. This would mean that roadworthy service robots would be an option, for example to clean roads, cycle lanes and pavements and move independently from one job site to the next using public roads. Other transport and utility vehicles that were formerly restricted to depots could now leave them, or, in other words: Depots are expanded to public grounds.

This eliminates the boundaries that were placed on autonomous systems to date, both with respect to scaling (from household robot to walking frame and cleaning robot, to post delivery vehicle and patient transportation) and relating to the private, public and commercial areas in which they are implemented. These concepts would have a big impact on the world of work and could reduce the number of people employed in the mobility sector in a wave of rationalization. This use case, following the vehicle-on-demand concept, has the potential to considerably reduce the number of professional driver jobs in particular. As well as the world of work, these vehicles could also revolutionize access to goods in particular, since it would be possible to automate the path from request for goods to the physical delivery (Chap. 16). Pilot projects with multi-copter "drones" are already sketching out this path for light goods. The unbeatable energy efficiency advantages of wheeled vehicles means that the demand for autonomous wheeled vehicles for the delivery of heavy goods is sure to come.

#### 13.8 Summary

In summary, the following three main points can be identified for concept changes after analyzing the four use cases:

With autonomous driving, no-one is bound to the task of driving for the duration of the trip. This results in freedom as to how to use this time. The different uses will have a considerable impact on the vehicle interior and the design of the human–machine interface.

Not having to take on the task of driving means that a change in the connection to the environment is possible. This applies both to the haptic channel for decoupling the effect of force from the road surface and driving dynamics on the passengers and to the visual decoupling. However, there are reservations here due to possible conflicts between visual and vestibular perception as can be observed in driving simulators today. This can only be solved by completely decoupling both worlds, i.e. when there is no visual impression from the outside and no force affecting the passengers. This would not only be very complicated to achieve for the chassis, but might also be alarming for passengers.

Since autonomous driving is always carried out by means of by-wire actuator control, a very high level of motion control accuracy can be assumed. On the one hand, this enables new steering concepts, possibly even connected with anti-roll over devices on vehicles with a footprint that is not sufficient for resistance to rolling over alone, especially if steering by humans is no longer planned. On the other hand, this precision enables connection to other autonomous vehicles with the same level of precision in order to better utilize the infrastructure or to enable concepts that still seem very unusual today, such as car-to-car mass transfer.

#### 13.9 Will Autonomous Driving Revolutionize Vehicle Concepts?

Automation will not instigate a revolution in vehicle concepts. Although some concepts are less "disadvantaged" by automation, classic vehicle concepts such as four-wheel passenger cars are expected to continue to dominate in the world of automated road traffic. However, new opportunities arise for special niche use areas, only the appeal of these niches is driven more by the specific regulations and access restrictions than by the superiority of the concept for general individual motorized traffic.

As is already the case today, it will be the use that determines the concept for autonomous vehicles, and using the gained travel time will stimulate vehicle interior designs in particular.

Automated driving technology may well result in even more differentiation in the market than today:

On the one hand, there will be expensive, comfort-based high-tech vehicles resembling sedan chairs that serve as a moving living room, office or bedroom.

On the other hand, low-cost utility vehicles will be used that have the equipment required for transport services but which resemble small city buses and are neither emotionally attractive nor especially comfortable.

The technology developed for the use cases specified above will result in lots of spin-off applications that may significantly change the service sector.

Open Access This chapter is distributed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, duplication, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, a link is provided to the Creative Commons license and any changes made are indicated.

The images or other third party material in this chapter are included in the work's Creative Commons license, unless indicated otherwise in the credit line; if such material is not included in the work's Creative Commons license and the respective action is not permitted by statutory regulation, users will need to obtain permission from the license holder to duplicate, adapt or reproduce the material.

#### References


# 14 Implementation of an Automated Mobility-on-Demand System

Sven Beiker

#### 14.1 Introduction

There is currently much discussion, development and research, both in expert circles and in the public sphere, concerning automated (or often "autonomous") vehicles. Within this discourse, personally used vehicles assume a central position, that is to say, focus is geared toward increasing vehicle automation on city streets and highways. While the vision of automated passenger vehicles operating with no human intervention still seems a long way off, there are already examples where, either today or in the very near future, self-driving vehicles are or will be deployed in public transportation. The past few decades have given rise to successful railroad systems requiring no operating staff, and now the rail as a guidance medium is being replaced on our streets by satellite navigation and obstacle detection systems, which allow for an automated journey to the user's destination of choice.

A wealth of experience can already be derived from such automated transportation systems to be applied in the future to the development of highly automated passenger vehicles, even if these transportation systems are frequently only operated in limited areas, such as downtown centers. The operational, user-specific, insurance-related or liability-based concerns for slow-moving, geographically limited vehicles are in many cases similar to those for the vehicles driven on highways. As such, there is a hope that the automated mobility-on-demand (AMOD) systems described here can, despite diverging objectives

S. Beiker (&)

Stanford University, Palo Alto, CA 94305, USA e-mail: sven@svenbeiker.com

© The Author(s) 2016 M. Maurer et al. (eds.), Autonomous Driving, DOI 10.1007/978-3-662-48847-8\_14

when set against highly automated sedans or SUVs, highlight a number of synergies, thus pointing the way forward for the deployment of the latter on public roads. This contribution will report on the implementation of such a transportation system at Stanford University in California. The goal of this report is to detail the findings and assist in future implementation of other automated vehicles.

#### 14.2 Definition and Scope

This contribution primarily deals with "automated mobility on-demand systems", or AMOD for short, and the respective vehicles that make up these systems. The term "automated" should be understood here in the context of vehicle automation, whereby computer systems are integrated into road vehicles in such a way that persons are relieved from the task of driving the vehicle. In the example dealt with in this report, driving tasks, which comprises "navigation", "lane keeping" and "stabilization", are performed in their entirety by computer systems. A driver is thus no longer necessary. In some cases even, no persons (i.e. passengers) are present in the vehicle at all. A vehicle may, for example, undertake an unladen journey for logistical purposes. This automation level is also termed "full automation", in accordance with the definition provided by SAE J3016 [1].

The term "on-demand" denotes a transportation system that can be scheduled by the user for individual use (compare Chap. 2). This can be done via smartphone app, for example, whereby the user can summon the vehicle to his current location. This works in much the same way a taxi does, but with the notable difference that these vehicles do not require drivers. The term "transportation system" here denotes the aggregate system comprising several vehicles and a central infrastructure, which coordinates the vehicles for customer use.

The considerations presented in the following report relate to a mobility system in a urban area, i.e. a developed area with a high population density. This consists of roads, parking lots, bike lanes, sidewalks, pedestrian zones and buildings, where the transportation system will operate for the purposes of passenger transportation. The size of the urban area is less important here than the urban-structural characteristics—in other words, it is not of particular significance whether the area in question is a so-called "megacity" or simply a central area of a mid- or even small-size city. The transportation systems discussed here are considered as a general service in places where public transportation or personal automobiles do not represent an optimal solution for user mobility needs.

#### 14.3 Description of an AMOD System

This contribution describes a concrete example of an AMOD system, namely the Navia, a vehicle produced by the French company Induct [2]. Between July 2013 and February 2014, this vehicle was made available to researchers at Stanford University for assessment purposes, meaning that from 2013 onwards, an operating design could be created for a transportation service with this vehicle. The empirical findings were documented and are the subject of the report that follows. Vehicles such as the Navia are highly indicative of general industry trends in automated system design [3–6]. But it is important to clearly emphasize, that the particular attention paid to the Navia here in no way represents a preference for, or endorsement of, that system over others. The company Induct also had no influence on the descriptions or findings discussed in this report. This means that while the following information is based on experiential knowledge derived from an analysis of the Induct Navia at Stanford University, it is also generally applicable in scientific and transportation-planning terms, as relates to AMOD systems. The information can thus provide a point of reference for the implementation of future systems.

#### 14.3.1 Technical Design

The AMOD system discussed in this contribution makes use of vehicles equipped with satellite navigation systems, lasers, cameras, ultrasound and steering-angle and wheel-angle sensors. These sensors and systems determine and monitor the vehicle's position and environment. While satellite navigation already allows for a high precision localization of the vehicle (even on a centimeter level, in cases where additional corrective methods are used), the vehicles considered here in addition utilize a process known as "Simultaneous Localization and Mapping" (SLAM).

For this process, the vehicle is guided by operating personnel within a planned operating area, while the coordinates from the satellite navigation system and the data retrieved from the laser, camera and (if necessary) ultrasound systems are recorded. A digital map of the operating area, which unlike conventional maps is a three-dimensional representation, is created from this data. This representation describes the stationary situation in the operating area. In other words, all variations, as measured against the saved data in subsequent vehicle operation, are classified as movable or "new" obstacles. Such variations warrant special attention and may necessitate a deviation from the pre-programmed route.

SLAM technology here represents a "virtual railway line", whereby physical tracks are replaced by satellite navigation, which, in connection with environment perception, is used as a reference system. Deviations between the saved representation and the continuously updated environment perception data are classified as obstacles, which may necessitate a change of route or road. Here, the laser sensors serve mainly as a means of detecting objects (e.g. persons, vehicles, buildings, obstacles) at medium-to-long-range distances ranging from approximately 1 up to 200 m from the vehicle. The ultrasound sensors are used for object detection at close range (less than 2 m from the vehicle). In addition, the camera systems provide extra information about the shape and type of detected object (e.g. person or plant), to provide the most detailed possible image based on object type, distance, direction and, in some cases, speed.

Variations from the reference system, i.e. obstacles on the planned route, are acknowledged by the vehicle's control unit and the actual route can be updated in line with a series of assessment criteria. In other words, an optimal route and pathway is calculated and created in accordance with the specified destination and the given traffic situation and environment. Even if no path seems accessible at a given moment—for example if the vehicle sensors detect that an obstacle cannot be bypassed and there is no alternative route—the vehicle interrupts its journey until the obstacle is removed.

Driving commands are sent from the path-planning unit to the electrified steering, braking, and drive systems and are then executed. The vehicle features electronic interfaces for these components, so that the central control unit can relay steering, braking and drive commands, with the result that the vehicle executes the journey independently, depending on the combination of environmental perception, information processing and destination input (see Fig. 14.1). In doing so, each axle is powered by a brushless 48 V/8 kW electric motor. The vehicle features independent steering on the front and rear axles. The vehicle's maximum speed is 40 km/h but is limited to 20 km/h for initial operation and can, if necessary, be further reduced via parameterization. The turning diameter is 3.5 m.

The vehicle user has several options in terms of influencing vehicle operation. The vehicle can be requested via an input screen at a fixed station whereby for typical operation the command will be sent using a smartphone app. Once the vehicle arrives at the requested pick-up location, it stops at which point the parking brake is activated and the door (in this case an open steel frame structure) is opened so that the passenger or passengers can safely enter the vehicle. The user then enters the desired destination via the installed input screen. The vehicle door closes and the parking brake is released so that the vehicle can start the journey. At all times, passengers have the possibility of stopping

Fig. 14.1 Block diagram of an automated vehicle (schematic, simplified)

Fig. 14.2 Open design of the Induct Navia [2]

the vehicle immediately using an emergency switch. In such instances, the vehicle occupants can also contact operating personnel using a vehicle communication system in order to request help or to communicate other concerns. Because the connection is radio-based, the operating personnel can be situated at a location completely independent of the operating area.

As shown in Fig. 14.2, the vehicle is characterized by its extremely open design. There are no body panels above waist-height (of the passenger) but rather four support pillar for the canopy roof. In addition, there are no seats in the vehicle. Passengers instead lean against upholstered supports. The vehicle has space for up to 8 persons and can carry a maximum weight of 800 kg. It measures 3.5 m × 2.0 m × 2.5 m (length × breadth × height).

The power supply has an estimated operating time of 8 h using a chemical battery, or of 20 min using a supercapacitor. The vehicle can be charged either outside its operating hours by means of a cable connection or during short breaks by means of a wireless charging station. The wireless charging option is particularly advantageous for the driverless operating model since the vehicles are then capable of driving to the charging station themselves without the need for personnel who would otherwise need to plug in a charging cable. In case of the operations at Stanford University, the cable-charging process has been used as an initial solution because of its simplicity for test operation with on-site operating personnel.

#### 14.3.2 Operation

Despite the largely independent operating characteristics of an AMOD system, there are several special conditions that warrant consideration. Firstly, operating personnel are required to safeguard operation. While it is not necessary for staff to oversee every individual steering, braking or drive command, but they must ensure safety of general operation within the established operating area (with its geographical limits) and specified parameters (e.g. speed or position). To achieve this, operation centers are established similar to those used for driverless trains or for logistics systems. Those centers are staffed with comparatively small numbers of personnel who monitor a large number of vehicles. The operating center is connected via radio to the individual vehicles and is capable of monitoring vehicle operating data, halting the vehicle in an emergency and communicating with passengers.

A communication system must always be installed in these vehicles for operational monitoring purposes. This can involve various communication standards, for example a cellular or WiFi network. It is essential in both cases that the latency and availability for the data transfer are up to the necessary requirements.

It should be mentioned at this point that, due to continued radio monitoring and the ever-present vehicle take-over function, the system is not fully-automated in the strictest sense of the definition according to SAE J3016 [1]. This standard specifies that there be no human monitoring or control-takeover, even in exceptional circumstances. Nevertheless, one must consider, in the case of transportation systems such as the Navia, that no operating personnel is in the immediate vicinity of the vehicle, which means that these vehicles must be able to deal with an emergency situation independently. This, in turn, corresponds to full automation as per SAE J3016, while also demonstrating the limitations of this definition.

Furthermore, a route network and operating times must be established for system operation. This entails defining which routes (detailed bounds) can be traveled in which area (general bounds). A specific area is chosen after first defining which general location will be best served by the transportation system on the basis of user needs, monitoring requirements, driving performance, legislation, economic efficiency and any other relevant considerations. In the case of the AMOD systems discussed here, this area could be limited to a pedestrian zone, a downtown area, or an entire city. In doing so, there must always be a detailed consideration, which roads or lanes the vehicles are permitted to travel on.

For flexible operation of the transportation systems described here, it is necessary to consider that motorized vehicles are not permitted in some areas, for example pedestrian zones, and that in such cases an appropriate permit must be obtained for these special, automated, motorized vehicles. Furthermore, if the vehicles are operating in normal road traffic, it is likely that a special permission for operating an automated vehicle will be necessary in most jurisdictions. In some legislative territories, for example a number of states in the USA, relevant legislation is already being developed and implemented.

In terms of operating times, it is important to consider whether the mobility service should be provided 24 h a day. This would be a logical and advantageous approach thanks to the minimal personnel requirements and it is likely to satisfy customers. Nevertheless, there may be a number of limitations, above all financial, that make limited operating hours a more viable option. One possibility is to park the vehicles in a depot overnight so as to protect them from vandalism. Another would be to offer the mobility service only when buses or other public transportation services are not running (e.g. at night) so that the vehicles are parked in a depot during daytime hours.

In all these cases, the geographical and timeframe limitations applied to vehicle operation are comparatively straightforward and can be implemented by specifying limits with corresponding operating parameters. This means using digital mapping and also a restricted schedule to limit operation in accordance with the operator's specifications.

In order to ensure that the AMOD system is operated in accordance to the manufacturer's specifications, there are certain requirements that must be met prior to commissioning, namely system installation, personnel training and personnel certification. This means, more specifically, that the transportation system must first be installed in accordance with the specified operating parameters. This generally requires an initial period of manual operation, which has been described in this report. This allows for the creation of a digital map, which ensures accurate positioning of vehicles during a later stage of automated operation.

In terms of training, operating personnel must receive training regarding the vehicle's general characteristics and specific operational dynamics, which is to say the system characteristics, operating conditions, limitations and other relevant characteristics. Personnel must learn and understand these aspects of the system. In addition, vehicle operating safety must be checked—in a way similar to airplanes—before every new operating stage, e.g. at the beginning of a new day of service. Out-of-the-ordinary incidents during operation, for example a deviation from the defined route, must be investigated and recorded in the system operating log.

These factors demonstrate that although the vehicles in question are automated, a substantial amount of preparation is necessary before the system can be operated. This preparation cannot be carried out automatically and requires operating personnel. Nevertheless, it should be assumed that for the purposes of overall operation of the transportation system, considerably fewer staff are required in comparison to systems where each vehicle requires a driver.

#### 14.3.3 Business Model

One of the main reasons for the deployment of AMOD systems is the considerably lower staffing requirements when compared to operating models with conventional vehicles. This has an effect on the business model. The manufacturer of the Navia system claims that the operating costs for public transportation can be reduced by 50 % [7] using its system. The business model for these systems thus allows for a considerably cheaper mobility solution when compared to, a taxi service for example, whereby savings are generated through smaller staff. In comparison, such systems have the advantage over passenger cars in that the user, relieved of vehicle control duties, can spend the journey time working or relaxing.

Beyond that, there is no concrete evidence of additional economic advantages, since on-demand operating models are also possible with conventional human-controlled vehicles. However, automated vehicles can also run at hours that are generally less attractive, for example at night when there is maybe only need for one 10-min journey per hour. In this case, a driver would wait 50 min without revenue generated. In contrast, if an automated vehicle is inactive for 50 min, the waiting period is unimportant as long as overall revenue in this period is sufficient.

Up to now these systems have only been run in pilot operation, for example during restricted hours on university campuses or in shopping centers [3–5]. Because these types of operation were primarily intended to showcase the systems, the business model cannot yet be fully evaluated. It is estimated that commercial operation will commence in 2015, when the first evaluations of the business models and revenue targets of operators and manufacturers will be possible.

#### 14.4 Lessons Learned from the Implementation of the Transportation System

The following section aims to provide an overview of the results of implementing Induct's "Navia" AMOD system at Stanford University. Due to the fact that, up until mid-2014, the vehicles in question were only sporadically in operation, the following stands as an interim report that is to be continued elsewhere, at a later date. Nevertheless, it is still possible to communicate the findings of the implementation approach used, with the aim of helping other researchers and transportation planners in the implementation of similar systems.

#### 14.4.1 Differentiation Between Evaluation, Testing and Public Operation

A range of operating phases was considered for the vehicles in this report, in accordance with the data in Table 14.1. The aim was first to classify the transportation system in an


Table 14.1 Differentiation and characteristics of the three operating phases

evaluation phase, then to optimize it in a test phase and finally, to provide public operation.

To begin with, the study is reliant on general experiential data which must be gathered from the vehicles themselves, since such a transportation system is still largely uncharted territory, making a risk assessment difficult. A range of other important questions informs the research. Importantly, the system described here allows for a highly flexible operating model to accommodate the applicable requirements. For the initial evaluation, it is beneficial to have a basic calibration of the vehicle to the desired operating area to allow for monitoring by on-site staff. To simplify this process, the vehicle should not require a special infrastructure, but should operate on a largely independent basis once it has been calibrated.

The test operation phase that follows seeks, in accordance with the objectives of the Autonomous Systems Laboratory [8], to optimize the geographical and timeframe distribution of automated, on-demand vehicles. This phase should be as realistic as possible, whereby system users, despite the test status, should be allowed to behave in a manner that reflects their actual mobility needs. For example their actions should be able to demonstrate a preference for the shortest possible waiting time and journey time from one location to another. This phase of operation must also be designed as highly-flexible yet target-oriented as it pertains to the transportation system discussed here, since the provided routes and schedules are comparatively easy to program, allowing for efficient implementation of requirements.

Test operation should then ultimately lead to public system operation, as long as no further research testing or optimization works are planned. The operational system is thus implemented in accordance with the results of the test operation. The transportation system allows for this step-by-step approach for implementation because the operating area and operating times are very easily set and, since the vehicle speed and overall distance are minimal, operational monitoring should pose if at all only few problems.

#### 14.4.2 Choosing a Vehicle Concept

In order to fulfill the requirements of the test phase operation, a fully-automated vehicle that is to say, a driverless vehicle—is necessary. The vehicle must be able to propel itself within specified boundaries, while having on-demand functionality for the user. In addition, open operating system architecture is required for making alterations to the deployment and distribution of vehicles. It is not essential here for the vehicles themselves to have an open architectural design: Neither the operating system for the vehicle control unit nor the environment perception system are part of these research efforts and, as such, they do not need to be altered.

The "Navia" vehicles provided by Induct and their associated operating system architecture fulfill the applicable requirements. In addition, experiential data was already available from other projects that implemented this mobility concept [3, 7], which means test operation was likely to run smoothly. Furthermore, Induct's trademark rights relate primarily to the field of environment perception and reference system creation for vehicle automation. This means that the research presented here does not conflict with Induct's work but rather complements it because it focuses on the area of general vehicle operation in order to best fulfill mobility demands. It is for these reasons that the Induct Navia concept was chosen and evaluated for test operation, in accordance with the criteria described in the sections that follow, as part of the research work of the Autonomous Systems Laboratory at Stanford University [8].

#### 14.4.3 Risk Assessment and Legal Classification

Placing this project into the context of the existing legal system is a step-by-step process. Because the vehicles do not initially run in publicly accessible areas (for evaluation purposes), a number of special rules apply in terms of vehicle operation and operating liability. These rules were formulated at Stanford University in consultation with the department for risk assessment and the university legal department. Legal liability is assigned, for the most part, to the operator of the vehicles in question which, depending on the operating mode, is the operating personnel in, directly outside or remotely connected (via radio) to the vehicle. The operation of the vehicles at the university has been approved but with certain restrictions applied by the internal (i.e. Stanford University) staff for risk assessment.

The risk assessment for the vehicle operation detailed here is considerably easier to plan than for equivalent operation in public traffic, primarily because the vehicle speed and the operating area are greatly limited. That means that, in contrast to conventional passenger vehicles, which are considerably faster and can, in theory, travel anywhere, a speed limit of 20 km/h and a significantly confined area represent a comparatively small operating risk. To begin with, system operation in this area was only permitted without public access and under the direct supervision of operating personnel, directly outside, or directly inside, the vehicle. These restrictions placed on the first stages of operation mean that all project partners gain an understanding of the capabilities, limitations and any other characteristics associated with the system. This allows for a step-by-step risk analysis and legal classification process as the test phase operation itself is gradually widened in scope. This also means that the risk assessment and legal classification process cannot be accurately determined in advance and they are instead based on the practical data of vehicle behavior as it arises.

With the gradual expansion of the operating model in test and then public operation (see Table 14.1), public legislation comes increasingly to the fore as the dominant regulating feature, as long as vehicles are operating on public streets. For this research, respective regulation in California, USA was applicable. This regulation was still in the final legislative phase during the first half of 2014. It is important to note here that, as of September 2014, only vehicle manufacturers were permitted to perform tests with "autonomous" (automated or fully-automated) vehicles [9]. Because the definition of "vehicle manufacturer" includes a person who modifies a vehicle so it become an "autonomous" vehicle, it remains to be seen, which roads the vehicles at Stanford will travel on and who the "manufacturer" is in the sense of the California law. It is assumed, under this law, that the vehicle manufacturer corresponds to the actual producer from whom Stanford University procured the vehicles and not the university's researchers, as long as said vehicles are not modified by Stanford University in a way that facilitates their automation but, rather, their data are assessed and optimized as pertains to position, temporal behavior and user requirements.

Admittedly the legal situation is currently difficult to predict since it is still in transition. It is likely, however, that changes will be made on a number of legislative levels (state, municipal and national) and that measures will have to be taken to comply. But in the context of the operating area dealt with here, which is to say an innovative university in California, the fundamental attitude of the responsible authorities and the public toward automated vehicles seems to be a very positive one. The relevant legal bodies also seem to be taking a supportive and favorable attitude. There is also a sense of confidence that, in individual cases, special regulation can be agreed to allow for system operation that may not be explicitly provided for by law. This type of attitude has also been observed in other parts of the USA. As such, US legislation does not seem to represent a key barrier to the introduction of automated vehicles but is more likely to act as an additional reviewing body.

#### 14.4.4 Contractual Structure

For the purposes of an AMOD, a contract is required that outlines the fundamental legal relationship between the owner of the vehicle (for the test operation described here: the manufacturer) and the user (here: Stanford University as the research facility). This entails rights and obligations pertaining to general use, information and communication, maintenance, liability and other provisions for test operation.

In the example dealt with here, a loan agreement for one automated vehicle was agreed between the manufacturer-owner and the user of the vehicle that, at the outset, was only applicable for the purposes of the evaluation phase that would potentially lead to a research project. As soon as a definite project with an AMOD system is pursued, a new or possibly supplementary contract would be necessary which would then govern all circumstances for effective use. Such a contract could also potentially include the possibility of altering environment perception and route planning technology for research purposes, which are not included in the evaluation phase.

In the contract between the manufacturer-owner and the user of the vehicles deployed in this evaluation phase, liability is assigned to the operator. As such, the operator is the legal entity that initiates and monitors vehicle operation, whereby this could be either the operating personnel inside or directly outside the vehicle, or the operating personnel remotely connected via radio.

#### 14.4.5 Selection of the Operating Area and Operating Scenarios

To begin with, the operating area for the AMOD system must be geographically limited. For the initial evaluation and subsequent test operation phases, the size of the operating area is not as a much a point of focus as the range of users, use cases and operating situations. These factors can be proactively represented for evaluation and test purposes in trial form—in other words, the project parties envision and design a range of suitable situations in which vehicle behavior can be observed and assessed. As such, a small operating area is sufficient for assessing a wide range of situations and operating conditions.

Because the concept of an AMOD system is a new one and, accordingly, a risk assessment of the system on the basis of experiential data is somewhat limited, an operating area must initially be found that ensures realistic operation but also complete control. This means that users must be in a position to request vehicles within the operating area, specify a destination and then give vehicle commands—all without the direct involvement of operating personnel. At the same time, the operating personnel must be able to monitor the vehicles. They should also have control of, or at least knowledge of, the persons and vehicles located in the operating area that could potentially interfere with the vehicles during this initial test operation.

An overview of the number of persons in the operating area is important to allow the operating personnel to recognize and prevent collisions and other disturbances. For example, at the beginning of the test phase there should be no person within the vehicle's operating area who is not familiar with the transportation system or who would behave in a way that deviates from any stipulated regulations (e.g. stepping in front of a vehicle). It must be ensured that all persons involved are familiar with the characteristics and risks of the transportation system but that these persons also behave in the way a real user would, in that they request vehicles and set destinations realistically. One possibility here is to have persons who interact with the vehicle sign a release form, which states that they are acquainted with the system's characteristics and limitations and they will adapt their behavior accordingly.

The operating area is thus heavily limited initially and may, for the reasons described previously, need to be fenced in and made accessible only with special permission. Moving forward, operation should then be expanded to an area that is monitored but also public so that a large number of real users are targeted. This involves bringing in users who have no prior understanding of the system and who do not sign a special release form —instead they should seek to use the vehicles as they would a taxi or bus. For this purpose, it is important that the operating area features users with mobility needs that can be solved by the vehicles in question, as relates to distance, speed and transport capacity.

A university such as Stanford is capable of implementing such a system and fulfilling the envisioned requirements. The university campus has grounds large enough to accommodate the Navia. Demand for passenger and goods transportation is high. Also, traffic issues are dealt with as effectively as possible by the responsible university department (Parking and Transportation Services). This allows for a suitable area for the introductory evaluation phase to which only test participants have access. In the following phase, pedestrian zones and streets can be incorporated. In all cases, the necessary communication systems for personnel monitoring must be in place, with personnel access to the vehicles where necessary.

After it became know that Navia vehicles were being used at Stanford University, a string of university departments registered their interest in using the transportation system. One query came from the operator of the local bus service, which was looking for a flexible expansion of its services at certain points. Another interested party was the university's utilities and repairs departments, which was looking for a flexible and unmanned system to transport items around the campus. An additional research facility also voiced its interest in establishing a passenger transportation system on its research campus.

Taking into account the enquiries that were received and the system's capabilities, operation began on an access-controlled parking lot, with a range of operating scenarios simulated. A subsequent more realistic trial is planned to take place on the grounds of the separate research facility, where both a large number of real users are expected and full monitoring of operations can be ensured.

To begin the evaluation phase, a set of special scenarios must be created that allow for risk assessment and related safety tests. Here, vehicles can be confronted with obstacles and other objects. These should be genuine, safety-relevant scenarios in which vehicles behave in the desired manner, without faults that could lead to critical operating conditions. The objects that stand in the vehicles' way are pedestrians, cyclists, vehicles of all kinds, animals and everyday objects that can be found in a normal operating area, such as trash bins, packages, cartons, working materials, plants, buildings, etc.

Here, a distinction must be made between stationary and movable objects, since the former can be clearly defined in the digital map of the environment, which allows for the course of the vehicles to be determined accordingly. Movable objects—in this case objects that are seldom moved and only as a result of outside interference (e.g. a debris container) —must be fully captured by the environmental sensors in order to avoid a collision. Depending on the type of object, operating scenarios should be drawn up along with a corresponding mode of behavior for the purposes of risk assessments and safety tests: Persons and vehicles should be able to move in front of the vehicle suddenly—trash bins and packages should of course, be somewhat slower. When these objects emerge, vehicle behavior should be designed in such way that it is prompt and reliable enough—on the basis of its detection processes—to avoid a collision.

#### 14.4.6 Setting up the Transportation System and Certification of Personnel

The vehicle manufacturer specifies how the transportation system and its automated vehicles should be implemented. The first step is to establish the route. This route is then traveled by one of the vehicles in a special operating mode, which allows for a digital map of the operating area to be created. The operating data is then edited so that stationary and moving obstacles can be categorized. Finally, the manufacturer creates a document detailing the mode of use and the operating area. This should detail parameters and zonal limits, thereby specifying what is permissible within a certain type of operation, taking into account potential legal liability issues. These guidelines are then documented in a certificate produced by the manufacturer.

For the purposes of issuing operating personnel with certification, the manufacturer provides training pertaining to operating requirements, functional characteristics, operating modes, technical details, limitations, risks, etc. Personnel should acquire an understanding of the system based on practical interaction and this understanding should be tested. The manufacturer documents this certification process, thereby certifying those persons who have successfully completed their training with a detailed knowledge of the system. There are also three task levels: "supervisor", "operator" and "technician" which designate whether operating staff are to only monitor, generally operate, or carry out maintenance on or modifications to the system.

The vehicle manufacturer must first define these processes and task scopes, since the manufacturer is the party with the best knowledge of the system and the risks associated with the vehicles. So as to be able to incorporate potential peculiarities of the operating environment into the organization, the operator of the system (which is to say, not the manufacturer but the responsible monitoring person, either on-site or connected via radio) should make changes or upgrades in terms of system testing, maintenance and certification, since it is here that unique situations become most evident. As time progresses, similar AMOD systems will be the subject of further upgrades and greater expansion, providing legislators with more experiential data. This means that, ultimately, the relevant processes and scopes for the certification of vehicles and personnel will likely be created either by legislative authorities or from commissioned institutions.

#### 14.4.7 System Start-up and Operational Monitoring

For live vehicle operation, the manufacturer specifies a system start-up and a corresponding system inspection. This involves a check of the vehicle and environmental parameters before approval can be granted for live operation. This process represents a good compromise between detailed precision and manageability, so that before the initiation of each operating period there is total certainty that both the transportation system and the operational environment meet safety and functional requirements in accordance with the standards for certified operation.

For vehicle operation with radio monitoring (which involves no operating personnel in the vicinity of the vehicle) the manufacturer provides a communication system. This involves the implementation of two independent, wireless communication systems, for example a cellular and WiFi link or two independent cellular networks. The operating personnel can use this systems to access vehicle data and, if necessary, execute an emergency stop or communicate with the passengers in the vehicle. The exact scope of monitoring, e.g. vehicle position, speed, direction of travel, passenger numbers and door locking, in addition to full video surveillance of the environment, will be established on an individual basis and is currently (as of June 2014) not specified.

Up to now, the vehicles at Stanford University have only been run with operating personnel in or in the direct vicinity of the vehicle with direct access to an emergency stop switch. For this reason there is currently no further experiential data available on operation with a radio monitoring connection. Nevertheless, it has been established, from this limited experience, that it is more likely that collisions can be traced back to other road users (pedestrians, cyclists, other vehicles) than to the automated vehicle itself. The combination of environment perception, object classification and route planning is adequate—particularly given the minimal vehicle speed and the familiar and limited operation area—to allow the vehicle to be operated safely and without disruptions.

For future operation with radio monitoring there will need to be an assessment of the response time necessary for operating personnel to arrive at the location of the disruption. For example, road construction or illegally parked vehicles could block the route. In such situations, vehicles would automatically interrupt their journey and inform the operating station of the disturbance. Then, depending on the working location of local operating personnel, a time period will elapse that could amount to minutes or considerably longer, before personnel are on location to solve the fault. The frame of reference here is elevator support, whereby activating an emergency button also initiates immediate contact to an operations center although it can take substantial time until staff reaches the site. It is then a task within public operation to ascertain how passengers in AMOD systems deal with such a scenario and whether the waiting time represents a problem for them. It should be noted that, in contrast to an elevator system, the passengers of this transportation system have direct contact to the outside environment at all times, thanks to the open structure of the system (see Fig. 14.2) and they can, in an emergency, leave the vehicle relatively easily.

#### 14.4.8 Information for Users and Pedestrians

Due to the fact that this AMOD system constitutes a new innovation in the field of personal mobility, users must be informed of the risks and possibilities associated with it. To begin with, the particulars of normal operation need to be made clear: This means, the actual control process itself should be explained. This requires a minimum of detail since this transportation system will allow for usage similar to a taxi or bus service—and those services are already completely familiar to future users. Instead, the risks and special attributes of test operation should be the subject of focus. This includes an explanation of the system's limitations and dangers, for example the risk that it does not recognize an obstacle fast enough or, in some case, vehicle behavior that may be out of the ordinary.

The users for the evaluation and test operation phases are provided with written information on vehicle characteristics and associated risks. This includes information explaining whom users should turn to as the person legally liable in the event of damage. Similarly, once in public operation, users should have the option of giving feedback and forwarding queries to the operator of the system. And because this is a new transportation system, user evaluations are of great importance. Therefore it is important that users know who they can contact to voice their opinions.

Just as with the users of the automated system, it is important that pedestrians and other road users are provided with information on the operation of the vehicles. Thereby, it is not absolutely essential to provide them with knowledge on vehicle usage itself. However, given the level of interaction between vehicles and other road users, the latter must be informed about the associated eventualities and risks. This particularly includes right-of-way regulations and other special provisions. Pedestrians and other road users should know how they could in case of an emergency stop a vehicle from outside using the emergency stop function. Pedestrians should also be aware of the identity of the official system operator, who they can turn to and provide feedback or make queries.

#### 14.4.9 Public Response

Even if, up to now, the AMOD system has only been witnessed in public operation on a confined scale at Stanford University (and this was only the case when the vehicle was transferred, controlled by operating personnel, from one operating area to another), one can still make several assertions about the reaction of the public. These observations are derived from the aforementioned transfers and from visits during the evaluation phase. Observations could also be made at the vehicle's depot location. It is important to emphasize here that the following descriptions do not constitute a methodical study, but rather incidental observations that aim to provide an impetus for future study. As a general rule, the public—which is to say, those persons who were exposed to but not involved in the project—reacted very positively to the vehicle. There are two probable reasons for this:

Firstly, non-participating pedestrians and observers generally seemed to be very interested and curious in relation to automated vehicles as a concept. This may be because such technologies are currently a major theme in both general media and popular science as well as in scientific publications. It is above all the general media that frequently reports, in positive, sometimes even euphoric terms, about "autonomous" vehicles in which drivers hand over total control to a computer so that they are free to perform other tasks during their journey. When people encounter this type of vehicle for the first time after being exposed to such media coverage, curiosity, receptiveness and a level of trust are likely responses.

Secondly, the characteristics of the vehicle in question haven been seen to bring about spontaneous and positive reactions from pedestrians and observers. The open structure (see Fig. 14.2) is one of the influencing factors: The vehicle has open, only low-rise side panels and an open railing system instead of a closed door. Thanks to this structure, the vehicle's passengers are clearly visible to passers-by and this open visibility makes a positive impression. More specifically, this means that the visual impression left by the vehicle is very different to that of a vehicle e.g. with tinted windows and closed doors, in which case passers-by have no idea who is in the vehicle. This would be comparable to the differing impressions one would have, in normal public traffic, from a limousine with tinted windows on the one hand, or an open convertible on the other. In addition, the vehicle described here features a design concept taken from the boating industry, whereby epoxy is used for the body, the passenger seats are covered in beige leather, the floor is bright teak and the roof is sail-like in shape. Comments from the public ranged from "land yacht" to "a whirlpool on wheels"—all positive associations that form an initial impression of the technology.

In addition, the vehicle is comparatively slow and operates at a speed that is barely above walking pace. This gives passers-by the impression of safety. Pedestrians feel that they can quickly move to the side if need be. Drivers of automobiles at the same time likely feel "superior" to the vehicle, which may also be due to the fact that the visible structure is largely plastic. As a result of these characteristics—which is to say the open and positive appearance, in addition to the slow speed—observers seem to attribute an almost personal character to the vehicle, similar to the characters in motion pictures such as "Short Circuit", "The Matrix" or "Star Wars". These movies show that robots are assigned different characters depending on their appearance, performance and aggressiveness. These characteristics and mechanisms should be carefully considered when an automated vehicle is put into public operation. It seems that the "character" of a vehicle is an important factor in provoking a positive public reaction towards vehicle automation. That is to say that an automated vehicle, using a certain mechanism, can be seen either as a "subordinate servant" or a "ruthless mercenary" (see also the article by Kröger in this volume Chap. 3).

These interactions with pedestrians and observers have produced a host of questions about the AMOD system. The most common question is when and where these vehicles will be useful in the public realm. Other pertinent questions relate to the technical specifications of the vehicles. Among these issues is the question of if and how vehicles will react to objects, very specifically pedestrians, pets, and stationary objects. Questions relating to monitoring and legal liability for vehicles have also been raised. These questions illustrate the general level of public interest in the vehicles and that the public has put much thought into the issues surrounding the operation and limitations of automated vehicles. This also underlines the importance of public awareness and information both before and during system operation.

#### 14.5 Summary and Outlook

This article describes the first steps in implementing an automated mobility-on-demand, or AMOD, system. This transportation system comprises vehicles that can be summoned via smartphone app. They serve the purpose of transporting persons within a specified area, for example a downtown city area, without either the possibility of directly intervening in the vehicle's operation and with no rails or tracks. This mobility concept is operated at Stanford University for the purposes of a scientific study in the field of innovative mobility solutions using automated transportation systems, with a view to examining the initial suitability of the vehicles for this purpose.

The first stages of the project involved risk assessment and legal classification processes. The system operating area and a range of operating scenarios were then established. The results showed that the system can be built on the basis of existing regulations and provisions but that, because of its automated nature, the system entails a number of requirements that clearly also exceed existing parameters. As such, it is expedient for the vehicles to drive slowly (a 20 km/h limit) and within a limited operating area.

In addition, operating personnel should be either in the vehicle, directly outside the vehicle, or remotely connected to the vehicle via radio, so as to facilitate a smooth first implementation of the system. In the context of the necessary internal coordination requirements and the necessary regulations, it has proved extremely important to demonstrate the system in real operation to the concerned parties and decision makers, so as to be able to realistically evaluate the level of operating risk and vehicle capabilities and limitations. The open and appealing appearance of the vehicles, combined with a great level of public interest and curiosity, mean that they provoke a positive response among the public. Consumers also expect that automated vehicles, at some point in the near future, will relieve them of the often burdensome task of driving in the city.

There are, however, a number of uncertainties surrounding the implementation of automated vehicles. These include associated infrastructural, economic and business-strategic variables but also an applicable legal framework. In the example detailed here, the implementation of the transportation system at Stanford University (which represents a legislative area within the US State of California), or more specifically, on the university's own grounds, has proven advantageous, as the university itself can directly stipulate regulations. California legislation is currently being processed for the operation of automated vehicles, which would then provide legislative boundaries for system operation in thoroughfares on the periphery of the campus. One will soon see how legislation for automated vehicles is to be handled and the system's operation and design will need to be structured accordingly.

In conclusion, the current outlook is very much positive on the basis of these initial system trials and the positive public stance on the implementation of automated vehicles, which is being promoted and encouraged. It is important to note, however, that these initial impressions do not constitute a representative study—further efforts are required for implementing and promoting acceptance of automated vehicles. But in summary, there is hope that automated mobility-on-demand systems will make an important contribution to the improvement of urban mobility for individuals.

Open Access This chapter is distributed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, duplication, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, a link is provided to the Creative Commons license and any changes made are indicated.

The images or other third party material in this chapter are included in the work's Creative Commons license, unless indicated otherwise in the credit line; if such material is not included in the work's Creative Commons license and the respective action is not permitted by statutory regulation, users will need to obtain permission from the license holder to duplicate, adapt or reproduce the material.

#### References


# Part III Traffic

## Bernhard Friedrich

There is no doubt that road traffic is the most important mode in terms of transport and haulage capacity for society and the economy. Upgrading the infrastructure at bottlenecks on the road network, however, cannot keep pace with the demands for a compatible and environmentally friendly implementation, neither regarding demand for capacity nor the required qualities. In light of the limited budgets for building and upgrading transport infrastructure, only measures with disproportionately high economic benefits for any implementation will be looked at here. Proposals will thus only be urgently pursued when their benefits exceed the costs threefold, for example in federal road planning (Bundesverkehrswegeplanung).

Besides tight budgets, the boundary conditions of urban construction and regional planning are limiting factors for the further upgrading of transport infrastructure. An extension to the areas used for stationary and flowing traffic proportional to the increasing population densities resulting from the reurbanization that has been recently observed is neither conceivable nor desirable. This also goes for the highly overloaded long-distance road network, for which there is barely any room left for expansion precisely in the conurbations with the largest capacity deficits.

In light of this, it remains a primary goal of the whole of society to safeguard and improve the mobility of persons and goods. This is done by reducing traffic volume by structural changes (prevention), spreading transport demand across various modes (displacement), and efficiently using existing infrastructure.

Besides the prospect of greater "participation in social life" travel for those groups of people whose mobility is currently limited, autonomous driving offers an outlook of significantly improved options for using current infrastructures. Moreover, there is also the chance here of reclaiming for other uses urban space now devoted to road traffic.

The articles in "Traffic" approach these prospects from various angles, see how they hold up under examination, and demonstrate options for rolling out autonomous driving from an infrastructure and traffic-management perspective. Since road safety is an essential precondition for introducing autonomous driving, light will also be shed on opportunities for increasing safety and the safety risks linked to autonomous driving.

The chapter Traffic Control and Traffic Management in a Transportation System with Autonomous Vehicles by Peter Wagner describes how mixed traffic composed of autonomous and conventional vehicles can be modeled in its interaction. The aim of such modeling is to recognize systemic effects that may arise. The simulations of motorized road traffic in cities carried out on the basis of this modeling permit an assessment of the potential effects on traffic of autonomous driving in an urban context.

In the chapter The Effect of Autonomous Vehicles on Traffic by Bernhard Friedrich, the impact of autonomous vehicles on the capacities of free stretches of highways and of intersections with traffic lights is deduced using traffic-flow theory. It may be the case that the effects of autonomous vehicles on the connection qualities of journeys running over different infrastructure elements cannot yet be extensively described with these deliberations. However, the considerations still provide an estimate of what potential for optimizing traffic-flow efficiency might be linked with autonomous vehicles.

Based on existing accident-research analysis, Thomas Winkle's meta-analysis Safety Benefits of Automated Vehicles: Extended Findings from Accident Research for Development, Validation and Testing begins by documenting examples of the potential benefits of safety-enhancing systems with low degrees of automation. Robust studies on driverless vehicles with a range of functions close to mass-production levels, on the other hand, are still lacking. It thus remains for forecasts to estimate the theoretical potential safety benefits. Such estimates rest on, among other things, the fact that over 90 % of today's road accidents are attributable to human error. In light of this, the vision of widespread use of driverless vehicles in road traffic promises a societal benefit well worth striving for, even if driverless-vehicle technology does not achieve absolute perfection.

The application of autonomous vehicles in the area of road freight transport is sketched out in Heike Flämig's chapter Autonomous Vehicles and Autonomous Driving in Freight Transport. Taking as its starting point an analysis of a logistics chain, the changes resulting from autonomous driving for businesses and society are critically discussed, as are the necessary preconditions for its implementation. The author finds that opportunities for better use of the infrastructure and optimizing logistics processes can be expected to arise from the deployment of driverless vehicles. The reorganization of processes in many supply chains within the overall logistics system will be a prerequisite for this, however.

Vehicle-on-Demand (VoD) systems are the most far-reaching application of autonomous vehicles. The impact on transport is described in the chapter Autonomous Mobility-on-Demand Systems for Future Urban Mobility by Marco Pavone. The author's deliberations make it clear that a new organization of urban traffic using VoD is fundamentally possible and would bring with it many benefits. The communal use of VoD means far fewer vehicles would be required for equally good mobility provision. Autonomous vehicles' ability to easily relocate themselves allows for supply to be adjusted to demand in a time-dependent manner, thus avoiding waiting times. The modeling calculations show that only 70 % of the vehicles in use today would be needed to provide New York with the same level of taxi provision it currently enjoys. Further calculation shows that for a city such as Singapore to maintain comparable levels of supply, only a third of the current vehicle stock level would be required.

Even though it has not been possible to satisfactorily answer questions on traffic-related aspects of autonomous driving regarding mixed traffic with normal vehicles, and especially with pedestrians and cyclists, the individual chapters anticipate an essentially improved utilization of the available infrastructure and a stabilization of traffic flow. This will involve multifarious opportunities for enhanced mobility of persons and goods, accompanied by a reduction in environmental impact and a clawing back of public space for urban living. The conception of robust migration paths for the development of transport systems with due consideration of the infrastructure will be essential for a successful roll out of autonomous vehicles. In these paths, increasing automation as well as its increasing permeation of the whole system must be able to be flexibly mapped. Corresponding concepts will be formed for allocation of spaces for autonomous, normal, and mixed traffic, and for specific rules for speed, in order to guarantee a high level of road safety.

# 15 Traffic Control and Traffic Management in a Transportation System with Autonomous Vehicles

Peter Wagner

#### 15.1 Motivation

This paper aims to quantify the effects of autonomous driving on the traffic management level. This involves developing a model of autonomous driving that makes it possible to use human-controlled and autonomous vehicles with only minor modifications. This is important with regard to defining how the instruments of traffic management need to be developed in the future to enable them to handle autonomous vehicles in the transportation system. Of particular interest in this context is mixed traffic, in which normal and autonomously driving vehicles interact with each other. This will presumably be the normal state of affairs on roads for quite some time even after the introduction of autonomous vehicles; it is, therefore, of great practical significance to gain a good understanding of precisely this situation to predict and prevent any systemic effects that may occur.

Since such vehicles do not yet exist, portions of the following observations must be regarded as an initial appraisal of possible developments presented as a scenario. However, modeling of human drivers is likewise far from complete, so the focus in this paper will be on establishing consistent modeling. The objective of the modeling presented here is to describe, as far as possible, human and autonomous vehicles with the same model, distinguished only by the different parameters used. A good example of this is the distance to the vehicle ahead expressed in terms of the time gap: an autonomous vehicle can achieve times of 0.3…0.5 s [1], whereas vehicles driven by humans are legally required to maintain a distance of at least 0.9 s (in Germany). The legal recommendation is actually 2.0 s, but this is seldom maintained except when traffic volumes are low. In heavy traffic, the value is often significantly lower; the figure for heavily traveled autobahns that occurs

P. Wagner (&)

Institute of Transportation Systems, German Aerospace Centre (DLR), 12489 Berlin, Germany e-mail: Peter.wagner@dlr.de

most often is 1.1 s (see Fig. 15.3), with an average value of 1.4 s. If drivers complied with the legally stipulated specifications, traffic on many roads would come to a standstill much earlier than is currently the case.

This paper builds on the papers by Friedrich [2] and Pavone [3] in this book. While [2] describes the general effects of autonomous vehicles on the transportation system, this paper addresses the modeling of autonomous and human-driven vehicles as well as the effects of autonomous vehicles on traffic management. Paper [3], by contrast, largely ignores questions of traffic flow and traffic control and focuses primarily on the optimal allocation of supply in relation to demand based on the premise that vehicles can be shared. We can quite rightly conclude at this point that a combination of these approaches, together with a correct description of the share of travelers who would opt for transportation via a robotic "mobility-on-demand" system, allows the best possible appraisal of the potential of autonomous vehicles.

The paper also does not consider effects that would result from a fundamentally different organization of transportation. One example of this would be the EU's CityMobil project, in which such scenarios are discussed and examined in greater detail [4].

This paper will examine how autonomous vehicles affect typical traffic management applications by looking at a few examples which have not been developed in all specifics. These examples, in order of increasing complexity, are the simulation of a single traffic signal system (Sect. 15.4), simulation of an intersection controlled by an adaptive traffic signal system (Sect. 15.5), simulation of a green wave (Sect. 15.6) and the simulation of an entire city (Sect. 15.7).

Some of the questions to be considered here can draw on the effects of the introduction of intelligent speed control (autonomous intelligent speed control—AIC) on traffic flow on highways in particular [5]. There is a great deal of literature on this subject; the dissertation [5] and parts of the book [10] provide a more in-depth overview than is possible in this chapter.

One such AIC scenario is highly similar to Use Case #1 "Interstate Pilot Using Driver for Extended Availability", which in turn (from a traffic-flow standpoint) is a special variant of Use Case #3, "Full Automation Using Driver for Extended Availability". This is also the use case that plays the most important role in this chapter, notwithstanding the fact that it is rather irrelevant from the traffic-flow standpoint whether the driver is available or not. The availability of the driver could be important if the impact of failures on traffic flow was being examined, but this topic will not be addressed in this book. This would require detailed statistics regarding how frequently something of this sort occurs and under what circumstances—information which is not available at the current stage of technology of autonomous vehicles. The Use Cases #2 (Autonomous Valet Parking) and #4 (Vehicle on Demand) play only a minor role in this chapter, although Use Case #4 should be treated like Use Case #3 from a traffic-flow standpoint. Use Case #2 would be interesting because it has an influence on parking search traffic and thus indirectly on traffic demand and thereby also traffic control, but on the traffic management level it would require a significantly more complex approach than can be achieved here—it would require, for example, a precise quantification of the parking search traffic in a city. Even the simulation of the city of Braunschweig described in Sect. 15.7 assumes that vehicles that have reached their destinations always immediately find a parking spot.

#### 15.2 A Model of Driving

Models that describe how a human drives a vehicle have been around for a long time [6]. Very many of these models (for an overview see [7–10])—since 1950 more than 100 models have been described solely for the process of following a vehicle driving ahead can also without further ado be applied as models for autonomous vehicles, albeit with differing parameters for humans and machines as mentioned in Sect. 15.1. It is thus conceptually quite simple to model mixed traffic and quantify its effects on the transportation system as a whole.

In the following, the focus will be on the process of following a vehicle, which is the most important, but not the only relevant process that determines the development of traffic flow on roads.

Every vehicle is described by its position x(t), which depends on the time t and is defined in relation to some reference (e.g. the beginning of the current section of road), by its velocity v(t) and its acceleration a(t); see also Fig. 15.1. In multi-lane traffic, the lane in which the vehicle is driving—the lateral coordinate, or distance of the vehicle from the edge of the road—comes in as a variable as well. Ideally each vehicle should also be indexed; this is circumvented in the following by describing the vehicle driving ahead with uppercase letters X tð Þ; V tð Þ; A tð Þ. With the additional variables gap g tðÞ¼ X tðÞ- x tðÞ- ' and difference in velocity Dv tðÞ¼ V tðÞ v tð Þ (see also Fig. 15.1), the reaction of the following vehicle can then be defined as the acceleration that the vehicle applies in a particular situation:

$$a = \frac{\mathbf{d}}{\mathbf{d}t}\mathbf{v} = \dot{\mathbf{v}} = f(\mathbf{v}, \mathbf{g}, \Delta \mathbf{v})\tag{15.1}$$

This abstract Eq. (15.1) could be abstracted even further; lacking, for example, are models for driver errors and fluctuations as well as the modeling of a reaction time. A corresponding error model is introduced in Sect. 15.3, although reaction time, a notoriously thorny construct, is excluded entirely. While measurement data does very

Fig. 15.1 Visualization of the applied dynamic variables using a SUMO [19] screenshot. The traffic direction is from right to left. Image rights: copyright resides with author

frequently show that the acceleration of a following vehicle lags approximately 2 s behind the acceleration of the vehicle driving ahead, there are also cases in which the following vehicle starts braking approximately 1 s before the leading vehicle—for example when approaching a traffic signal (traffic light). In the following, we will examine the abstract Eq. (15.1) with greater specificity. For example, one important question for the following observations is how precisely an autonomous vehicle moves. Surprisingly, many of the current adaptive cruise control systems and also published control algorithms work for automatic vehicles [11–13] as linear control systems:

$$
\dot{\nu} = \mathfrak{a}(\mathfrak{g} - \mathfrak{g}^\*(\nu)) + \beta \Delta \nu \tag{15.2}
$$

Typical parameters for the two time constants are represented by <sup>a</sup> <sup>¼</sup> <sup>1</sup>=<sup>20</sup> 1/s<sup>2</sup> and <sup>b</sup> <sup>¼</sup> <sup>1</sup>=1:<sup>5</sup> 1/s; with these values, cruise control systems are configured in a way that is perceived by drivers as agreeable and natural [14]. For the preferred gap <sup>g</sup>ð Þ¼ <sup>v</sup> <sup>v</sup>s, as a rule the legal regulation is applied, albeit with a somewhat smaller value for the preferred time gap <sup>s</sup>, e.g. <sup>s</sup> <sup>¼</sup> <sup>1</sup>:<sup>5</sup> s, which is also used in the rest of this chapter. The model in Eq. (15.2) was originally introduced in Helly 1959 [15] as a model describing a human driver. This underscores the assertion that many driver models and the models for autonomous driving are mathematically very similar. Where they differ will be discussed in greater detail in Sect. 15.3.

The model in Eq. (15.2) has limits. For example, it is crash-free only for particular parameters <sup>ð</sup>a; <sup>b</sup>Þ, and is only string stable for a small subset of parameters. String stability is the ability of a chain of vehicles driving behind each other not to succumb to the "slinky effect" and jam up: for instance, when minor braking by the first vehicle in the chain leads to an amplified effect along the chain, in extreme cases actually causing a vehicle in the chain to come to a standstill. Or causing a traffic accident. To date, this behavior has only been found in very specific situations (see [21] for an example)—it does not appear to be the normal case.

However, the parameters with string stability are not perceived as very agreeable by human drivers, so AIC systems generally apply a compromise solution that results in a weak string instability [14].

For that reason, this paper looks at a different approach in the tradition of the models in [16–18]. A first step considers that an important condition for safe driving is fulfilled when the following applies:

$$d(\nu) + \nu \tau \le D(V) + g.$$

In this equation, D Vð Þ; d vð Þ are the braking distances of the leading and following vehicles. Obviously this model is predicated on the following driver having an idea of whether and how the leading vehicle will drive or brake. That is certainly not entirely adequate; and yet driving does work in many cases on the assumption that the other drivers will behave more or less as one does oneself.

However, that also means that the approach flowing from this and the following equation can be tricked by "strange" behavior on the part of the leading vehicle. If the leading vehicle has an autonomous emergency braking system that allows deceleration values of up to 12 m/s<sup>2</sup> , it violates the assumption of similar behavior to the following vehicle—typical deceleration values for a human driver are in the range of up to max. 4 m/s<sup>2</sup> —leading to a much shorter braking distance. This can be compensated for to some extent, as the following simulation results also show, because the equations resulting from this approach in the case of strong braking by the leading vehicle can exceed their own deceleration. At the same time, this approach is one that could find further application in the development of driver models for traffic safety.

The above model can be developed further by stipulating that the safety condition be fulfilled not at the current time t, but also for a certain time t + T in the future. The time T is the anticipation time, i.e. the length of the planning horizon of the driver. With the notation x′ as a short-hand for the value of the variable x at the time t + T, the safety equation becomes:

$$d(\nu') + \nu' \mathfrak{r} \le D(V') + \mathfrak{g}'.$$

But this equation can now be reformulated according to acceleration <sup>a</sup>. Thus <sup>x</sup><sup>0</sup> <sup>¼</sup> <sup>x</sup> <sup>þ</sup> vT <sup>þ</sup> aT<sup>2</sup>=<sup>2</sup> and together with an approach for the braking distances <sup>d</sup>ðvÞ ¼ <sup>v</sup><sup>2</sup>=ð2bÞ, the safety equation can be solved for a. There are various approaches for this; here primarily the following exact approach is pursued:

$$\dot{\nu} = \frac{1}{T} \left( -b(\tau + T/2) + \sqrt{b^2(\tau + T)^2 + V^2 + 2b\nu T + 2b(g + \Delta\nu T)} - \nu \right). \tag{15.3}$$

Interestingly, this approach for T ! 0 leads back to the one used in SUMO [19].

Another possibility, following [17], is a Taylor expansion of dðv<sup>0</sup> Þ ¼ dðv þ aTÞ dðvÞ þ aTv=bðvÞ, which, interestingly, leads to a linear equation for a which is simpler to solve and numerically less complex:

$$a = \frac{V^2 - \nu^2 + 2b(T\Delta\nu + g - \nu\tau)}{T(2b\tau + bT + 2\nu)}.$$

Although these equations look complicated, and it is rather unlikely that people can actually extract a root from a complex expression while driving, graphically it does strongly resemble the Helly model. This is interesting because it is indeed quite easy to imagine that a human driver is capable of carrying out a linear consideration along the lines of "I'm moving somewhat faster than the person in front of me, but the gap is large, so there is no immediate need to change anything." An idea of how this acceleration function looks for realistically selected parameters is provided by Fig. 15.2.

Fig. 15.2 Representation of the acceleration functions. Rather than drawing the entire function here, only the area delimited by two lines in the ð Þ Dv; g range is represented, in which the acceleration of both models is small. To the left of the lines, the vehicle is braking, to the right it is accelerating. The figure on the left is the model from Eq. (15.3), the one on the right the Helly model (15.2). The selected parameters are V = 20, τ = 1.5, b = 4, T = 2. Image rights: copyright resides with author

In this context it is also interesting to know whether this approach is indeed free of collisions. The simple answer is no. Under some circumstances, the dynamic that follows from Eq. (15.3) can indeed be fooled. This can be demonstrated by a chain of vehicles following a leading vehicle that is driving according to a specific protocol <sup>a</sup>0ð Þ<sup>t</sup> . The salient parameters in the dynamics of the leading vehicle are primarily the maximum accelerations. Of particular interest here are the maximum decelerations and the question as to whether it is possible to produce a collision with the model.

Of course, no procedure can really test all eventualities. But the following approach does at least allow an estimation of how secure the models are. In a simulation, n = 50 vehicles follow a leading vehicle that selects its acceleration according to a specific protocol. Among other things, it repeatedly decelerates to a standstill, in some cases with decelerations at the limits of current driving dynamics capabilities. Studies on this set-up very quickly revealed that collisions can only be avoided in the models when the anticipation time T during braking is set to a lower value. In the following the models are always operated with T = 2 s in normal driving, and with T = 0.5 s when braking.

The respective simulations then show that, under these conditions, no accidents occur with the model in Eq. (15.3), at least not with the selected protocol a0ð Þt . The Helly model, however, is not so tolerant with the selected parameters and occasionally produces rear-end collisions.

#### 15.3 Man Versus Machine

At this point the question arises as to what actually distinguishes a human driver from an autonomous vehicle. Heretofore just one significant difference has been established, and that is the time gap s with which the two drive. Humans should not drive with a gap of less than <sup>s</sup> <sup>¼</sup> <sup>0</sup>:9 s, and the legal recommendation is actually <sup>s</sup> <sup>¼</sup> 2 s; in principle, a machine can drive with a <sup>s</sup> <sup>¼</sup> <sup>0</sup>:3...0:5 s gap [1]. An example analysis of the actually maintained gaps (see Fig. 15.3) on a German autobahn (with speed around 100 km/h, where the greatest traffic volumes are achieved) shows that (very) few human drivers approach this "ideal", whereas the overwhelming majority demonstrates legally compliant behavior.

Figure 15.3 also shows that human behavior covers a broad spectrum which stands in contrast to autonomous vehicles: they would all drive with a small and very similar value of s. This spectrum can be characterized [20] and quantified in greater detail. In general it can be said that s not only varies between different drivers, but indeed is not even consistent for the same driver. Unfortunately s is not precisely observable, in particular when the leading vehicle itself constantly changes speed, so it is only possible to posit assumptions as to how s varies over time. This then leads to 2D models [20, 21], in which s varies in each time step. A simple scenario that leads to such a dynamic is the driver misjudging the gap. However, this error is time-correlated, i.e. when the estimated gap at a certain point in time is smaller than the actual gap, this will continue to be the case for a certain period thereafter as well. And there is a reasonable probability that the error will be asymmetrical: Gaps are frequently estimated to be significantly smaller than they actually are. Such a modeling approach does in any case lead to a very broad spectrum of s values, just as is observed empirically.

A second point in which a human differs from a machine is what is known as the action point mechanism [22]. Strictly speaking, a human driver cannot be described by a differential Eq. (15.1). Rather, a vehicle is controlled through correction of the acceleration (accelerator-pedal position) at irregular time intervals, as shown in the example Fig. 15.4.

Fig. 15.3 Gap behavior in the left lane of the A3. Displayed is the density of the respective time gap. The maximum of the function is more or less precisely 1.1 s, while the average is 1.4 s. Some dangerously short time gaps are observed, too. Image rights: copyright resides with author

Fig. 15.4 Acceleration as a function of time with a human driver. It can be seen that the acceleration changes erratically at the action points. Between the action points, it remains nearly constant. The data was recorded in a "drive" by the author with a driving simulator; similar images can be found in all data records with sufficiently accurate measurement of the acceleration or accelerator and brake pedal. Image rights: copyright resides with author

The time gaps between successive action points also demonstrate a very broad distribution, with values between 0.5 and 1.5 s. Here there is evidently another modeling approach for traffic safety questions—if the time between two action points becomes very long, a critical situation can arise. In normal cases that does not occur, however, and there are only minor variances between a model based on Eq. (15.1) and a model in which the action points are explicitly used [23]. In particular, the action point mechanism alone does not lead to a wide distribution of gaps between the vehicles.

This too is demonstrated in the example used in Sect. 15.2 of the chain of vehicles following a leading vehicle. An evaluation of the gap measured (in the simulation), here as a function of the number of the following vehicle, shows that in most cases an autonomous vehicle follows the leading vehicle with significantly less variance—in spite of the sometimes extremely volatile behavior. A representation of this is found in Fig. 15.5.

Fig. 15.5 Gap size behavior for human and autonomous vehicles. The graphic shows the average gap and the 25th and 75th percentiles, in each case as a function of the position in the chain. The upper curve is for the model of the human driver and the lower one models a chain of autonomous vehicles. Image rights: copyright resides with author

Thus the models used in this chapter have been specified, and the difference between the human and the autonomous driving style has been characterized. The rest of this chapter will utilize various applications to illustrate what that means for typical traffic management applications.

#### 15.4 Approaching a Traffic Signal

This process is one of the candidates in which autonomous vehicles promise significant benefits. In an approach to a traffic signal, the following examines the delay d per vehicle for a random combination of normal and autonomous vehicles. Here, g describes the share of autonomously driving vehicles, whereas <sup>s</sup> <sup>¼</sup> <sup>0</sup>:5 s is assumed for autonomous and <sup>s</sup> <sup>¼</sup> <sup>1</sup>:5 s for normal vehicles. The simulation results are also supported by a theoretical consideration. There is a theory for the described situation which was developed in [24]. Interestingly, the theory can be applied to a situation with a mix of autonomous and normal vehicles. Then the respective expression is:

$$d(q, \eta) = \frac{c}{2} \frac{(1 - \lambda)^2}{1 - \mathbf{y}} + \frac{1}{2} \frac{\mathbf{x}^2}{q(1 - \mathbf{x})}, \ \lambda = \frac{\mathbf{g}}{c}, \ \mathbf{y} = \frac{q}{\mathbf{s}}, \mathbf{x} = \frac{\mathbf{y}}{\lambda}, \mathbf{s} = \mathbf{s}\_0(1 - \eta) + \mathbf{s}\_1 \eta \quad (15.4)$$

In Eq. (15.4), q is the demand, s<sup>0</sup> the capacity of a flow of human-guided vehicles, s<sup>1</sup> the capacity of a flow of automated vehicles, g the green time and c the cycle time of the traffic signal. The cycle time is the time it takes for the traffic signal to regain the same state it had at the beginning. The simulation results for selected variations in demand (q) and the share of autonomous vehicles η is shown in Fig. 15.6.

The curves in Fig. 15.6 were recorded by simulating various values of demand q (varying from 18 to 1800 veh./h) for 5 h each. The demand itself is a stochastic variable

Fig. 15.6 Delay at a traffic signal as a function of the demand and for different equipment rates η = 0, 20, 40, 60, 80 and 100 % (from left to right). The dotted lines were calculated from Eq. (15.4), albeit with a capacity, which was measured directly in the simulation. Image rights: copyright resides with author

(approximately Poisson-distributed), i.e. in each observed time interval, there is always a different number of vehicles and only the average over many such time intervals leads to the correct demand.

The delay was recorded for each simulated vehicle and the values used to calculate the average entered in Fig. 15.6. In principle, the entire distribution of delays can be used to characterize the results, which for reasons of space is omitted here, although it would be interesting. The fluctuations in the delays are a measure of the reliability of such a system. However, the example presented here shows that the delay fluctuations are only very weakly correlated with the proportion of autonomously guided vehicles; the major source of stochasticity in this system is generated by the demand and not the dynamics of the vehicles.

Two results in Fig. 15.6 stand out. For one thing, the description from the theory does not always correspond to the simulation results. A considerable amount of research is still needed here, because it's not at all simple to translate the assumptions on which the theory is based into the simulated reality. This will undoubtedly be even more difficult in comparison with real measured values. To achieve agreement, the values for the saturation-traffic volume determined in the simulation had to be used—with the theoretical values, i.e. the τ values defined in Sect. 15.3, the agreement is not compelling.

Second, autonomous vehicles "only" change the capacity; otherwise there are no or only very small gains. As long as the demand stays away from the respective capacity, there are only minor differences between the various scenarios, at least on the level of the description selected here.

A change in the capacity does have one very positive effect, however: it means that the required green times at a traffic signal can be shorter, leaving more time for other modes of transport.

#### 15.5 Adaptive Traffic Signals

Section 15.4 looked at a traffic signal with a fixed-time control system. Many modern systems, however, utilize an adaptive control system. That means that the traffic signal attempts to coordinate its green times with the current demand. When demand is low, the

Fig. 15.7 Green times (left) and delays (right) in a simulated adaptive system, displayed as a function of the time and for different proportions of autonomous vehicles η = 0, 25, 50, 75, 100 %. The demand parameter was set to q<sup>0</sup> = 180 veh./h and q<sup>1</sup> = 720 veh./h. Image rights: copyright resides with author

green times are short, and when demand is high, the system responds with long green times. The details are somewhat more complex, because the delay regarded as a function of the demand has a minimum with a certain optimal cycle time. An adaptive system is able to choose the optimal cycle time for itself, and makes very clever use of the fluctuations that occur in the traffic flow.

In this case as well, the aim is to examine how such an adaptive system handles a mix of autonomous and normal vehicles. To this purpose, simulation of a two-armed intersection controlled with an adaptive method was set up [27]. The two arms are 600 m long, and the delay per vehicle at intersection is measured. In contrast to Sect. 15.4, however, a demand was selected that depends on the time and thus replicates a peak hour group in which at the time of maximum demand the system is saturated in spite of its adaptivity. The demand function selected here is:

$$q(t) = q\_0 + q\_1 \sin\left(\frac{\pi t}{T}\right),$$

where q<sup>0</sup> is a basic load, q<sup>1</sup> is the amplitude of the demand fluctuation and T is the entire time period of the simulation. Both arms are subjected to the same demand, which represents a relatively unfavorable case.

Beyond the delays, in this case it is primarily the green times that are of interest. Since the system adapts the times to the demand, they fluctuate within typical ranges. In many countries, the green time cannot fluctuate freely: for instance, the green time for a normal traffic signal cannot sink below 5 s, and in the following simulations, the maximum green time is set to 40 s.

Such a simulation is also an interesting case in the evaluation of the simulation data. A single simulation of such a peak hour shows major fluctuations in terms of delays as well as green time and cycle times. Although the delays were averaged over a cycle of the system, that in itself is not sufficient because the cycles are themselves stochastic variables

Fig. 15.8 Delay as a function of the offset time for a simple green wave. Depicted here is a simulation with human drivers (gold) and one only with autonomous vehicles (blue). Shown here is the best result achieved between the first and second intersection. Image rights: copyright resides with author

whose average values and statistics can only be determined through a sufficient number of repetitions of the same scenario with slightly different details—just as in reality when successive days are examined. To obtain statistically valid results, in this case the peak hour was repeated 50 times. At 5-min intervals, the averages of the delays over the last cycle and the corresponding green times set by the system were collected. The results in Fig. 15.7 were composed from this data.

With maximum demand, the system extends the green times up to the limit of 40 s and thereby demonstrates that it has reached its saturation level. However, this only applies for a flow of normal vehicles. As soon as autonomous vehicles are added to the mix, the top delay value for sinks and with an equipment rate of 50 %, the maximum green time is not even reached. This lines up with the observation in Sect. 15.4 that autonomous vehicles not only increase the capacity, but also contribute to a reduction in green times—an effect that is rather clear in this example, namely that even a small proportion of autonomously guided vehicles can make a noticeable impact.

#### 15.6 Green Wave with Autonomous Vehicles

The previous scenarios examined a single intersection. Much more interesting is the case of a stretch of road with multiple intersections in succession which are all controlled by a traffic signal system. In this case the coordination between the traffic signals, known

Fig. 15.9 Excerpt of the simulation network for Braunschweig. The land use data comes from the openstreetmap dataset [26]. Image rights: copyright resides with author

colloquially as the green wave, plays an important role. Here again, a simulation is used to investigate how great an impact the introduction of autonomous vehicles has. Analogous to the procedure in [28], a section of road with 10 intersections is simulated with varying coordination configurations. The demand, which is constant, the green times and the cycle times remain unchanged. The only change is to the offset, i.e. the point in time at which the traffic signal turns green for the vehicle flow in a particular direction. If this offset between two signals is precisely equal to the travel time between the two signals, the system is in its optimal state: the delay for the vehicles at the downstream signal is exactly zero when the green times are equal. In that case, just as many vehicles can cross the intersection as left the upstream traffic signal.

The expectation is clear: In this case, no improvements will be achieved with an autonomous vehicle; and that is precisely what the simulation results in Fig. 15.8 demonstrate. However, autonomous vehicles do indeed improve the delay times in the case of sub-optimal coordination. The reason is that the bunch of vehicles that leaves a traffic signal is more compressed than with human drivers.

#### 15.7 Simulation of a City

This final section will examine how the introduction of autonomous vehicles might impact an entire city. To this purpose, an existing SUMO simulation [19 25] of the city of Braunschweig is used to simulate the impact of autonomous vehicles on the traffic flow of a transportation system.

However, the model introduced in Sect. 15.2 is not implemented in SUMO, so the simulation has to be carried out with the models that are available in SUMO. The simulation therefore uses the standard model integrated in SUMO, which in terms of describing the fluctuations of the drivers is not as refined as the model introduced here.

Fig. 15.10 Comparison of the delays for a simulation with human drivers (gold, upper curve) and a simulation in which the passenger vehicles drive autonomously (blue, lower curve). Each data point is a floating average value from the 8 adjacent one-minute values. The dispersion of the values of the two curves is not very different and is therefore not displayed. Image rights: copyright resides with author

To set up the model, a modified network by the NavTeq company is used; an extract of the transportation network is seen in Fig. 15.9. The full simulation comprises the entire area of the city of Braunschweig, including the autobahns in the area. The simulation network comprises approximately 129,000 edges.

The required traffic demand comes from a start/destination matrix from the PTV company, which is available for different days of the week in 24 time slices of one hour each for each of those days. This demand was used to calculate a user equilibrium, which in this case required some 100 iteration steps. At the end of this process, for each vehicle simulated in SUMO there is an optimal route in the sense that every other route through the network would take longer. A total of 647,000 vehicles were simulated. Initial comparisons with real data from Braunschweig suggest that the matrix significantly underestimates the demand. This undoubtedly affects the results discussed here, but it was not possible to carry out such corrections in the context of this project.

To simulate autonomous vehicles, a new vehicle type is introduced which has similar parameters to the models in Sect. 15.2: the autonomous vehicles in SUMO drive with τ = 0.5 s, all others with τ = 1 and σ = 0.5. σ is the noise parameter in SUMO, i.e. it indicates by how much a vehicle deviates from the optimal driving style. The selection of τ = 0.5 s means that the time-step size in SUMO also has to be set to 0.5 s to ensure that the vehicles can continue to drive without colliding. This extends the simulation time from around 50 min to 90 min for the simulation of an entire day in Braunschweig.

Only the passenger vehicles were simulated as autonomous vehicles; the approximately 44,000 trucks remained unchanged. The traffic signals were likewise not entirely correctly represented in the simulation. It may therefore be assumed that on this end as well, further corrections to the simulation results below can be expected.

Nevertheless, this simulation delivers significant preliminary results, as seen in Fig. 15.10. Even without further measures, the autonomous system is more efficient in the sense that it reduces delays between 5 and 80 %, with an average value of around 40 %. With the selected parameters, however, the variance in travel times changes relatively little; the system, in other words, becomes faster, but not necessarily more reliable. That could change if the traffic management system were also realistically simulated. Such studies are currently in the works.

#### 15.8 Conclusion

This paper presents some initial considerations regarding how traffic management needs to respond to the opportunities presented by autonomous driving. The case studies presented here demonstrate that, depending on the scenario, very different improvements can be achieved in the flow of traffic through the introduction of autonomous vehicles.

Unfortunately, the improvements that could be achieved are difficult to summarize with a single number. It was demonstrated in Sect. 15.4, for example, that the capacity of a traffic signal can certainly be doubled. If the demand is low at the corresponding signal, this doubling is scarcely noticeable. But if the signal is working at the limits of its capacity, by contrast, even a minor increase in its capacity can lead to a dramatic improvement.

This can be observed quite clearly in the scenario in Sect. 15.5: here the demand runs the values from very low to (temporary) over-saturation. Although the introduction of autonomous vehicles has little impact on green times and delays when demand is low, it yields major improvements when the system is operating beyond capacity. Nevertheless, the magnitude of these improvements does depend on the details of the scenario being examined. If the peak value for demand were just a bit lower, the benefit would also be significantly diminished.

That notwithstanding, it may be asserted with confidence that at least in the urban context, the introduction of autonomous vehicles has the potential to generate substantial time gains at traffic signals which would then be available for other road users—if the introduction of these vehicles does not lead to an increase in demand for automotive transportation.

Open Access This chapter is distributed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, duplication, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, a link is provided to the Creative Commons license and any changes made are indicated.

The images or other third party material in this chapter are included in the work's Creative Commons license, unless indicated otherwise in the credit line; if such material is not included in the work's Creative Commons license and the respective action is not permitted by statutory regulation, users will need to obtain permission from the license holder to duplicate, adapt or reproduce the material.

#### References


# 16 The Effect of Autonomous Vehicles on Traffic

Bernhard Friedrich

#### 16.1 Introduction

#### Objective

Autonomous vehicles maneuver in traffic through road networks without requiring humans as supervisors or decision makers. Autonomous vehicles increase comfort for their passengers by removing the need for them to perform driving tasks. Autonomous vehicles provide new mobility opportunities for groups of people that thus far have been partially or entirely excluded from participation in public life due to mobility restrictions.

In addition to the benefits that autonomous vehicles potentially provide their users, the social benefits that would come with their proliferation are of interest. For it is clear that autonomous driving does not lead to a loss of safety or efficiency of road transport but rather improves them. This paper considers the traffic impact of autonomous vehicles, looking specifically at the efficiency of using the existing infrastructure.

The efficiency of the transport infrastructure is determined by its capacity. On highways, the capacity is dependent to a large degree on the maximum possible flow of traffic on the road sections as well as the capacity of entry, merging and exit lanes at grade-separated traffic intersections. In the city road network, and on country roads with through-roads, the capacities at the intersections are the crucial factor and therefore mostly dependent on traffic signaling. While the capacity at traffic lights is determined by the amount of time required by individual vehicles in the departing lane to pass the node, the capacity of highway sections is determined by the instability that occurs at high traffic volumes and leads to congestion.

B. Friedrich (&)

Institute of Transportation and Urban Engineering,

Technische Universität Braunschweig, 38092 Braunschweig, Germany e-mail: friedrich@tu-braunschweig.de

In order to understand the various factors that determine the effect of traffic on autonomous vehicles, the key characteristics of traffic flow and their interdependent elements are the initial focus of this paper. Building on these foundations, we will derive the impact of autonomous vehicles on the capacity of highway segments as well as on intersections with traffic signals. The impact of autonomous vehicles on the connection quality of journeys covering different infrastructure elements cannot be adequately described in this model. Nevertheless, these considerations provide a preliminary assessment of the potential for optimizing the efficiency of traffic flow that potentially includes autonomous vehicles.

#### 16.2 Characteristics of Traffic Flow

#### 16.2.1 Parameters of Traffic Flow

In order to develop a mathematical model of traffic flow, we use an abstraction of the road network, the vehicles, the drivers and their behavior. Certain simplifying assumptions are therefore made.

The road network is divided, for example, into road segments and intersections. We investigate here, therefore, either road segments or intersections where consistent conditions, i.e., flatness, sufficient visibility, dry surface, etc. are assumed. With regard to drivers and vehicles, it is expected, among other things, that properties such as reaction time, willingness to engage in risks and technical proficiency follow an empirically proven statistical distribution.

A distinction is to be made between several ways of describing traffic flow. The microscopic model describes the relevant characteristics of a single vehicle i:


The macroscopic descriptive model takes into consideration many vehicles and the relevant properties of a traffic flow:


The traffic flow can be recorded by measuring the parameters of a particular cross-section over a time interval dt by means of so-called local observations or measurements at a given time over a path interval dx, which are so-called momentary observations (Fig. 16.1).

Fig. 16.1 A system of local and momentary measurements. Different traffic speeds occur for the individual speeds recorded locally or momentarily

#### 16.2.2 Traffic Flow Theory

Neither the macroscopic parameters v, q, and k, nor the corresponding microscopic values, define in themselves a traffic state. In order to define a traffic state, knowledge of their interdependencies is a prerequisite. The three macroscopic quantities, traffic volume, traffic density and momentary speed, are dependent on one another according to the equation

$$q = k \cdot v(k)$$

Measurements of traffic volume and mean speed resulted in a detectable decrease in speed when traffic volume increases, i.e., with increasing mutual influence of vehicles.

One of the first models to describe traffic flow on an open stretch road came from observations made by Greenshields [1], who researched the relationship between the speed v and the traffic density k. With the help of regression analysis, he established a linear relationship for v ¼ v kð Þ

$$\nu(k) = \nu\_{\rm f} - \nu\_{\rm f}\%\_{\rm max} \cdot k = \nu\_{\rm f} \cdot \left(1 - \%\_{\rm k\_{\rm max}}\right)^{\varepsilon}$$

where v<sup>f</sup> represents the free flow speed and kmax the maximum traffic density.

Inserted into the equation q ¼ v k, this results in a parabolic relationship between traffic volume and traffic density in the form:

$$q(k) = v\_{\rm f} \cdot \left(k - {}^{k^2}/{k\_{\rm max}}\right)^2$$

Equations with these parameters are referred to as equations of state and their graphical representations are called fundamental diagrams of traffic flow.

#### 16.2.3 Model for Stationary Traffic Conditions—Fundamental Diagram

The fundamental diagram is a graphical illustration of the equation of state for traffic, i.e., the functional relationship between the parameters of traffic volume q, traffic density k, and the mean momentary, i.e., section-related speed v, and represents a curve in three-dimensional space. The orthogonal projections of the curve onto the planes, each spanned by two parameters, result in the familiar fundamental diagram shown in Fig. 16.2. The resulting three diagrams enable a variety of information about the characteristics of traffic flow over a cross section to be depicted and are referred to as the qv diagram, the q-k diagram, and the k-v diagram.

The fundamental diagram shows that, for the same traffic volume ql, two different qualities of traffic flow can occur. The threshold qmax separates for qi\qmax the range of high speeds at low traffic densities, i.e., the free and stable flow of traffic, from the range with relatively low speeds and high traffic densities, i.e., the range of unstable and interrupted traffic flow. Empirical studies reveal that the transition between a stable and an unstable traffic state does not run continuously as shown in Fig. 16.2 in idealized form. Rather, in case of high traffic load and triggered by disturbances a transition from the stable to the unstable range takes place. This transition is associated with a significant drop in the traffic volume (Fig. 16.3). In light of these considerations, May and Keller [2] characterized three forms of traffic that occur:


Fig. 16.2 Views of the fundamental diagram according to [3]. Source Handbuch für die Bemessung von Straßenverkehrsanlagen (HBS), S. 3–19, FGSV 2001

#### 16.2.4 Capacity and Stability

The efficiency of the traffic system depends on the capacity of the traffic infrastructure. This capacity is defined as the "largest volume of traffic that a traffic flow can reach at a given distance and traffic conditions at the cross-section determined for this flow" [3]. The capacity is determined by the density of the platoon of vehicles and the speed with which the platoon passes through the cross-section.

Traffic density is determined by the distances between vehicles. The rule of thumb is that the safe distance in meters before the vehicle ahead that a driver should adhere to is half the value of the current speed in kilometers per hour. This well-known rule of "half speedometer distance" is based on a reaction time of less than 1.8 s, since at this value and constant speed, precisely the distance to the preceding vehicle is travelled. This minimum distance is also usually required by law (see, e.g., [4]). For trucks, road regulations explicitly stipulate that, at speeds above 50 km/h, a minimum travel distance of 50 m must be maintained, which requires a time interval of 2.25 s at the maximum speed limit permissible for vehicles over 7.5 tons on highways.

Assuming a reaction time of 1.8 s, the capacity of a lane can be estimated, in a simplified model, at about 2000 vehicles per hour. This applies equally to city streets as to country roads and highways. However, empirical studies show that the headways are on average significantly shorter than 1.8 s and especially at high traffic volumes amount to 1.0 s. The 15 % percentile of the distribution in these cases is even below 0.5 s (see also Fig. 15.3 in the chapter by Peter Wagner in this book [5]). This means that 15 % of the vehicles follow a preceding vehicle with a headway of less than 0.5 s. Figure 16.4 shows the corresponding headway distributions for different traffic volume ranges and different speed limits.

Due to the short following distances at relatively high speeds, empirical studies also investigate capacities that may be significantly higher than the stated 2000 veh./h. Furthermore, these studies indicate that there is no exact value where traffic flow stops being stable and breaks down if this value is exceeded. Rather, it can be observed that the capacity is a random parameter that can be represented by a distribution (Fig. 16.5). Investigations of many sections of road [6] show that the capacity of highways are typically Weibull-distributed and, for example for 3-lane highways, show a standard deviation of about 600 veh./h (measured in 5-min intervals) and thus an unexpectedly wide variability.

The expected value of the capacity corresponds in this stochastic depiction to a nominal capacity and represents the 50th percentile of that traffic volume amount that was the starting point of a breakdown in traffic flow. The closer the traffic load is to, or the further it lies above, this nominal capacity, the higher the probability of traffic breakdown and traffic congestion.

Traffic breakdown results in all cases, passing through a transient state of synchronized traffic flow to congested traffic. Traffic recovery occurs also via a transient state of synchronized traffic flow, back to a steady flow of traffic with higher speeds (Fig. 16.6).

Fig. 16.4 Distribution functions of the time gap distribution for different traffic loads and speed restrictions [7]

Fig. 16.5 Values for 5-min intervals in the qv graph and the related capacity distribution for a cross section of a two-lane highway, according to [6]

The traffic volume also decreases in the transitions to synchronized or to congested traffic and a smaller recovery takes place. This effect of a "capacity drop" is caused by the fact that drivers, in keeping a greater distance when leaving the downstream traffic-jam front,

Fig. 16.6 Pattern of traffic dynamics with the transitions from the state of stable traffic into the states of synchronized and congested traffic. The values were measured on a three-lane highway in 5-min intervals, according to [6]

maintain a greater distance than before in flowing traffic before the breakdown in traffic flow.

According to [8], this capacity drop is 5–6 %; studies on German highways reported values between 4 and 12 % [6].

#### 16.3 The Effect of Autonomous Vehicles on Traffic

The efficiency of the transport system depends on the capacity of a transport infrastructure. When a transport infrastructure is used by autonomously driving vehicles, the capacity will differ from that of a transport infrastructure used by human drivers. Either the capacity of the route sections of the intersections or define the traffic flow. While the capacities of the intersections and the traffic signals are relevant to the performance of urban road networks, on highways the capacities of open stretches of road are of principal importance. For this reason, the following analysis considers the capacity for both cases, taking into account that a yet-unknown proportion of vehicles drives autonomously.

#### 16.3.1 Sections of Highways

#### 16.3.1.1 Capacity

The capacity of a traffic lane is determined by the maximum number of vehicles that can pass through a cross section per unit of time. It is determined by the density of the vehicle platoon and the speed with which the platoon passes through the cross-section. The equation of state that describes the relationship between these fundamental characteristics of traffic flow is:

$$q = k \cdot v(k)$$

In a homogeneous traffic flow, the density is easily determined and results from the reciprocal of the footprint of a vehicle [9]:

$$k = \frac{1}{\nu T\_h + L}.$$

In this context, Th is the temporal distance (time gap) to the preceding vehicle and L is the length of a vehicle. Since the capacity represents the maximum traffic volume qmax, this is consequently a function of v; Th, and L. If only human drivers control the vehicle, the capacity Ch results, with:

$$C\_h = q\_{\text{max}} = \frac{\nu}{\nu T\_h + L}.$$

Analogously, the capacity Ca is described in a traffic flow that purely consists of autonomous vehicles by the following function, where Ta represents the time gap preferred by autonomous vehicles.

$$C\_a = \frac{\nu}{\nu T\_a + L}.$$

The ratio of the two capacity values and hence the change in the capacity is determined by the relation

$$C\_{q} \vert\_{C\_{h}} = (\upsilon T\_{h} + L) / (\upsilon T\_{a} + L) \vert\_{\upsilon}$$

In order to evaluate the effect of autonomous vehicles on capacity values, values are used for the parameters of the capacity formula that are empirically demonstrated for today's conditions. So it seems reasonable to assume as the mean speed at which the capacity is reached the value <sup>v</sup> <sup>¼</sup> 80 km=h 22 ð Þ :2 m=<sup>s</sup> . For the footprint of an average passenger car, the broadly accepted mean vehicle length is 4.5 m and the minimum safety distance to the vehicle ahead is 3.0 m, thus Lcar ¼ 7:5 m is used. The mean length of a truck is estimated to be 18 m, which is the weighted average of the lengths of a truck (18.75 m) and of a semi-trailer (16.50 m). For the footprint of a truck, assuming that a 3.0 m distance is kept before the vehicle ahead, Ltruck ¼ 21 m. As a reasonable value for the mean following distance at high traffic volumes, the empirical studies provide a value of Th ¼ 1:15 s.

For the change in capacity for autonomous driving, the changed time gap Ta for the following vehicle is the deciding factor. A technically feasible and, at the same time,

Fig. 16.7 Capacity increase that, depending on the speed, would result in an exclusively autonomous vehicle fleet (only passenger cars)

acceptable value from the perspective of road users appears to be Ta ¼ 0:5 s. Depending on the traffic conditions, this very short following distance already occurs in up to 20 % of all following distances. This distance therefore seems acceptable provided that safety is ensured from a technical perspective.

For the assumed values, the capacity and thus the maximum flow rate in the case of purely autonomous traffic would significantly increase using the formulas derived above (factor 1.78) (Fig. 16.7).

Compared to today's observed capacity values of a lane of 2200 veh./h, an increase of traffic volume to about 3900 veh./h would thus be possible with purely autonomous traffic.

If heavy traffic is included in the traffic flow, the mean footprint of the vehicles can be deduced from a sum that is weighted with the proportion of heavy traffic ω. The traffic density is obtained in turn from the reciprocal of the mean footprint of a vehicle with

$$k = \frac{1}{(1 - \alpha)(\nu T\_h + L\_{\text{Pkw}}) + \alpha(\nu T\_h + L\_{\text{Lkw}})}.$$

For this capacity, the following correlation arises

$$\mathbf{C} = \frac{\nu}{(1 - \alpha)(\nu T\_a + L\_{\rm Pkw}) + \alpha(\nu T\_a + L\_{\rm Lkw})}.$$

If one assumes a moderate speed of 80 km/h for autonomous traffic on German motorways, we obtain the functional relationship shown in the following Fig. 16.8. If trucks make up 15 % of traffic, which is typical on German motorways, a capacity of about 3877 veh./h would be achieved, which is almost twice the value compared to today's empirically proven capacity. If, for the sake of a plausibility check and with otherwise unchanged parameters, one inserts Ta ¼ 1:15 s into the capacity formula, this

Fig. 16.8 Capacity of a lane in purely autonomous traffic in relation to the share of trucks

results in a capacity of about 2280 veh./h for a heavy traffic share of 15 %. This value corresponds to the measured capacity at present conditions and confirms the right choice of the computational approach as well as the parameters.

In mixed traffic, where autonomous vehicles are represented by a share of g in the total volume, the capacity Cm is additionally dependent on percentage g:

$$\mathbf{C}\_{m} = \frac{\nu}{\eta \nu T\_{a} + (1 - \eta) \nu T\_{h} + L\_{\text{Pkw}}}.$$

If one inserts realistic values into the equation here, again with v ¼ 80 km=h and Lcar ¼ 7:5 m, the correlation shown in the following graph results (Fig. 16.9). From the graph, it is clear that the capacity increases more slowly at lower numbers of autonomous vehicles. At <sup>g</sup> <sup>¼</sup> <sup>0</sup>:<sup>5</sup> capacity only reaches a value of about 3100 cars=h, and thus 36 % of the increase that would be possible if all vehicles were autonomous.

Fig. 16.9 Capacity of a lane in proportion to the share of autonomous vehicles for pure passenger car traffic

If one also takes into account that autonomous vehicles should allow an additional distance to a vehicle steered by a human driver so as not to harass these drivers, it is slightly more complicated to determine the capacity. In this analysis, the combinations of successive vehicles (a-a, a-h, h-a, and h-h) and the corresponding time gaps (Taa; Tah; Thx) must be considered in order to arrive at a modified capacity equation:

$$C\_m = \frac{\nu}{\eta^2 \nu T\_{aa} + \eta (1 - \eta) \nu T\_{ah} + (1 - \eta) \nu T\_{h\nu} + L}.$$

As realistic values for the headways, the values Taa ¼ 0:5 s; Tah ¼ 0:9 s; Thx ¼ 1:15 s can be used. In this analysis, the capacity increases in proportion to the share of autonomous vehicles a little more slowly in the lower range and reaches for <sup>g</sup> <sup>¼</sup> <sup>0</sup>:<sup>5</sup> a value of 2850 veh./h on the way to achieving a capacity value of almost 4300 veh./h where 100 % of vehicles are autonomous (Fig. 16.10).

The same procedure can be used to estimate the capacity for pure heavy-vehicle traffic that could be organized on a single lane of a highway. Not changing our assumptions for the required time gaps, a required space of L ¼ 21 m is again assumed. For purely autonomous driving, these input values result in a capacity value of 2420 trucks=h, compared to a capacity value of 1720 trucks=h as achievable for human drivers.

#### 16.3.1.2 Stability

Besides the capacity that equates to the greatest traffic volume that a traffic flow at given road and traffic conditions at a cross-section can achieve, the stability of the traffic flow is an important factor in its efficiency. This becomes clear when the capacity is considered as a stochastic variable that represents the probability of traffic breakdown as a function of traffic intensity. The greater the standard deviation of the probability distribution, the greater is the likelihood of traffic breakdown at lower traffic volumes and thus instability.

Fig. 16.10 Capacity of a lane in relation to the share of autonomous vehicles for pure car traffic, taking into account larger time gaps for autonomous vehicles following vehicles driven by people

If breakdown occurs, capacity is reduced by the effect of "capacity drop" noticeable at the magnitude given in the above literature—by about 10 %. Given the same number of lanes and same traffic framework conditions (traffic volume, proportion of heavy traffic), different spatial and temporal factors result in different capacity distribution functions. The key factors in this regard are the speed and the time gap distributions. The smaller the standard deviation, the more stable the flow of traffic will be, and the fewer breakdowns to be expected at high traffic volumes.

Especially when autonomous vehicles are able to anticipate the actions of preceding vehicles through communication, they can contribute to a stabilization of traffic flow and thus to stability. In purely autonomous traffic, it is to be assumed that full stability will be achieved and a capacity drop avoided.

#### 16.3.2 Intersections with Traffic Lights

Since intersections as part of streets with high traffic are usually controlled using traffic signals, the following considerations relate to the capacity of intersections with traffic signal control.

At high traffic loads at intersections with traffic lights, constant queues of traffic occur independently of the coordination of the traffic signals. This is why it is usually the case that the waiting queue of vehicles, once permitted by the green light to move, starts moving from standstill. When the first vehicle has departed at a green light, the next follows once a certain time interval has lapsed. This time interval is represented by the value of the time variable, which for standard conditions (no slope, traffic travels in a straight line, lane width is adequate) and pure passenger car traffic amounts to tb <sup>¼</sup> <sup>1</sup>:8 s [10]. This corresponds to a saturation flow of q<sup>s</sup> ¼ 2000 cars=h. The value for trucks and buses is tb ¼ 3:15 s, and tb ¼ 4:5 s for semi-trailer truck.

At the start of the column of traffic, the time at which departure occurs can be anticipated from the movement of vehicles ahead. Thus the response time to the departure of the driver directly in front is reduced and can be assumed to be Th ¼ 0:6 s. At a vehicle length of 4.5 m and a distance of 3.0 m from bumper to bumper, an average footprint of a car in the traffic backlog in front of a traffic light may be assumed to be 7.5 m, and plausible values for the average speed at the stop line of the traffic signal to be <sup>v</sup> <sup>¼</sup> <sup>22</sup>:5 km=h. One can thus confirm the required time interval via the relation tb ¼ Th þ L=v ¼ 1:8 s. This applies equally to the amount of time required by trucks and semi-trailer trucks with lengths of 12 and 18 m respectively. Consequently, the saturation flow of a lane at a traffic signal can be given by the equation of state:

$$q\_{\rm s} = \frac{\nu}{\nu T\_h + L} \cdot \frac{\nu}{\cdot}$$

To analyze the saturation volumes of purely autonomous and mixed traffic, the correlations used here are those derived for the capacity of road sections with assumed values for queues starting at traffic signals of <sup>22</sup>:5 km=<sup>h</sup> <sup>¼</sup> <sup>6</sup>:25 m=s, Th <sup>¼</sup> <sup>0</sup>:6 s. For autonomous driving, it is assumed that the reaction time or the safety margin, even in dense and slow urban traffic, should not fall below Ta <sup>¼</sup> <sup>0</sup>:3 s, Taa <sup>¼</sup> <sup>0</sup>:3 s; Tah <sup>¼</sup> <sup>0</sup>:6 s; Thx <sup>¼</sup> <sup>0</sup>:6 s.

The capacity of a lane at intersections with traffic lights is, on the one hand, determined by saturation traffic volumes and, on the other hand, by green intervals. Green intervals that are allocated to different traffic streams over the period of one hour are themselves affected by the cycle times and the clearance intervals. During rush hours, a cycle time of 90 s is usually chosen, meaning that there are forty clearance intervals within an hour. For a typical road junction situated on an urban main street, a three-phase signal program is normally used. The clearance intervals used for the main traffic direction in the three phase-transitions typically add up to around 20 s and are essentially dependent on the clearance times of crossing pedestrians. With a cycle time of 90, 70 s remain for the green light intervals of the various traffic flows. If one assumes that, from the remaining green interval, 50 % of the time is available for the traffic flows in the main direction, within one hour a release time of 1400 s and a release time share of pF ¼ 38:89 % results, i.e., a share of approximately 40 %.

In conflict-free signaling (i.e., there are no conditional compatibilities, e.g., with pedestrians crossing parallel to the main traffic), the capacity of mixed traffic flows is determined using the above approach.

$$C\_{\rm LSA} = q\_s \cdot p\_F = \frac{\nu \cdot p\_F}{\nu T\_h + L}.$$

In current traffic conditions where vehicles are exclusively controlled by humans, when using the above values a capacity of about 800 cars=h per lane results. In purely autonomous traffic with Ta <sup>¼</sup> <sup>0</sup>:3 s, the capacity would increase to about 1120 cars=<sup>h</sup> and thus increase by about 40 %. For a mixed composition of traffic flows, the efficiency gains are between these stated values and can be determined with the formulas introduced above.

The formula also makes it clear that, in addition to the duration of the time delays of following cars, it is especially speed that determines capacity (Fig. 16.11). With increasing clearance speeds, capacity grows with autonomous traffic at a higher rate than that of traffic with human drivers. If it is possible, therefore, to achieve faster departure times and clearance with autonomous driving, as well as shorter time delays, then a significantly higher capacity gain than the 40 % named above can be expected.

#### 16.3.3 Assessing the Efficiency Gains from Autonomous Driving

Estimates of the effect of autonomous vehicles on capacity as a measure of the efficiency of transport systems show significant potential for increasing traffic flow, both on some sections of highways and intersections of major urban roads.

In city traffic, a capacity increase of about 40 % could be achieved with purely autonomous traffic, while capacities could be increased on highway sections by about 80 %. The significant difference in the growth potential is due to the average speed at which vehicles drive when using the traffic infrastructure. This is clear from Fig. 16.7, which shows a disproportionate increase in capacity in the range of lower speeds and a flattening-out towards higher speeds.When capacity is reached, the speeds on highways are about 80 km/ h. On urban main roads, the platoon starting at green, which determines capacity at signal lights, moves at an average of 20 km/h. Because of this difference in speeds, autonomous vehicles have a very different impact on the capacity of transportation infrastructure elements.

In addition to the capacity level achievable by including autonomous vehicles, the stability of the traffic flow at high traffic volumes is important. In city traffic at a capacity utilization of 70–80 %, there is admittedly a constant traffic backlog before the relevant traffic signal, which is why it is no longer possible to drive through without stopping (green wave) at high traffic loads. Nevertheless, there will be a drop in capacity, as is the case in extra-urban traffic, especially on highways. To this extent, the stability of traffic flow is not compromised on the urban road network until it reaches full capacity—and only then when an overload causes blockages at the intersections.

#### 16.4 Conclusion and Outlook

#### 16.4.1 Traffic

This analysis, with the help of the macroscopic traffic flow models, shows that, in principle, a significant increase in capacity can be expected from using autonomous vehicles and that this would also enable a more efficient use of the existing transport infrastructure. Along with the expected increase in capacity for existing traffic infrastructure, traffic jams and lost time are reduced, which in turn improve the quality of traffic flow. In particular, two factors are responsible for the increase in capacity:


#### 16.4.2 Infrastructure

The models developed for traffic flow and capacity, assuming a given share of autonomous vehicles, show that capacity increases disproportionately highly as the share of autonomous vehicles increases. It should be noted that the shortening of the time gaps comes into effect as early as the first autonomous vehicle; the speed increase at high densities, however, will only be possible for purely autonomous traffic. The introduction of autonomous vehicles will succeed, in the opinion of the author, only in their ability to move safely in mixed traffic, as reserved transit areas would not be socially or economically acceptable, particularly with a low share of autonomous traffic.

However, once a sufficient number of vehicles with autonomous capabilities are participating in traffic, it will be very beneficial to the transport efficiency to create reserved lanes for autonomous driving. The benefits of autonomous vehicles can be maximized by separation due to the nonlinear course of the capacity once nonautonomous vehicles are added to autonomous traffic. In conjunction with specially dedicated lanes, the column speed could also be increased even when traffic demand is higher, which would lead to further significant capacity gains. This is not possible in mixed traffic, since even in traffic with only a few human-driven vehicles, these would dictate the speed.

In an initial analysis of this far-reaching subject, this article has solely focused on the traffic effects of autonomous vehicles on sections of motorways and, with an eye to urban traffic, at intersections with traffic lights. These two driving situations to a large extent determine the quality of the traffic flow. However, there are a number of other relevant driving situations that may have a significant influence on the capacity of the overall system:

(a) Outside of urban areas, these are the entry, merging and exit maneuvers at the intersections of major roads. Firstly, we can look forward here to further developing already-emerging technical solutions with assistance functions, such as the merging assistant, particularly in regard to the possibilities of machine cooperation. Secondly, solutions for structural and regulatory adjustments to transportation facilities are still to be developed. For example, one interesting scenario is where autonomous traffic is directed onto separate lanes between motorway intersections. This separation is then removed in intersection areas. In an intersection area, autonomous and human-controlled vehicles thus drive in all lanes and each may perform all maneuvers (autonomous, highly assisted or human-driven) at a perhaps predetermined low speed.

(b) Within urban areas, there are still issues regarding the impact of the so-called conditional compatibility that have to be clarified. Conditional compatibility occurs when different traffic flows crossing at traffic signals are given the green light, requiring rules of right of way to be adhered to. This, for example, is the case in traffic flows turning right or left, which must grant right of way to pedestrians and cyclists travelling parallel to the traffic. Various approaches could beinteresting for this purpose and should be subjected to closer scrutiny. Thus, one could give the green light to all lanes of autonomous vehicles simultaneously in a separate phase—the maneuvers of the conflicting flows in the intersection area would be negotiated independently by the autonomous vehicles. All other road users would be controlled by the existing signaling. Another possible solution would be to consider cyclists and pedestrians in a separate phase with "all green", thus maximizing vehicle-flow compatibility by using an appropriate phase structure.

#### 16.4.3 Cooperation

For scenarios such as this last, where traffic at intersections is self-organizing, autonomous vehicles need to be able to communicate among themselves and with the infrastructure. Anticipating the maneuvers of moving vehicles ahead, and the reactions in the next column that depend on this, results in a comfortable and thus acceptable rate of acceleration, also ensuring the experience of travelling in the vehicle is pleasant. For this reason, currently existing technologies for communication and cooperation will play an important role in the development of autonomous driving.

Open Access This chapter is distributed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, duplication, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, a link is provided to the Creative Commons license and any changes made are indicated.

The images or other third party material in this chapter are included in the work's Creative Commons license, unless indicated otherwise in the credit line; if such material is not included in the work's Creative Commons license and the respective action is not permitted by statutory regulation, users will need to obtain permission from the license holder to duplicate, adapt or reproduce the material.

#### References


# 17 Safety Benefits of Automated Vehicles: Extended Findings from Accident Research for Development, Validation and Testing

Thomas Winkle

#### 17.1 Introduction

Advancing vehicle automation promises new opportunities to better meet society's future mobility demands. New, extended concepts for interaction with machines are arising in certain areas [1]. A prerequisite for this is further technological development of assistance systems with more capable sensor and information technologies, allowing for a steady automation of driving tasks in vehicle control, right up to self-driving vehicles [2].

Initially the following meta-analysis documents exemplary investigation of potential safety-enhancing vehicle systems with low degrees of automation. However, a safety prognosis of highly or fully automated vehicles depends on assumptions, as so far no series applications of such features exist. For testing methods in order to develop and validate safe automated vehicles with reasonable expenditure, the author recommends combining area-wide traffic, accident, weather, and vehicle operation data as well as traffic simulations. Based on these findings, a realistic evaluation of internationally and statistically relevant real world traffic scenarios as well as error processes and stochastic models can be analyzed (in combination with virtual tests in laboratories and driving simulators) to control critical driving situations in the future.

T. Winkle (&)

Department of Mechanical Engineering, Institute of Ergonomics, Technische Universität München – TUM, 85747 Garching, Germany e-mail: winkle@carforensic.com

© The Author(s) 2016 M. Maurer et al. (eds.), Autonomous Driving, DOI 10.1007/978-3-662-48847-8\_17

#### 17.1.1 Motivation

In terms of advancing automation, automobile manufacturers have been offering active steering-assistance systems (Lane Keeping Assistance Systems—LKAS) in combination with adaptive cruise control for series production vehicles since as far back as the turn of the millenium. The combined functionality was available on the Japanese market for right-hand drive vehicles such as the Nissan Cima (2001) and the Honda Inspire (2003). When using both assistance systems, short-term, partially automated driving (see Sect. 17.1.2) of up to 20 seconds was possible under the supervision of the driver (author's test drives in 2003). Since 2008, German manufacturers, starting with the VW Passat CC, have also been selling active steering systems optionally in selected models [3]. Opportunities for greater traffic safety increase with rising vehicle automation. Further market penetration of standard equipped safety-enhancing driver-assist systems will lead to a further reduction in road accidents (see p. 344, Sect. 17.4.1).

According to figures from the Federal Statistical Office of Germany, 3475 people were killed in road accidents in Germany in 2015 [4]. On average around nine people a day lose their lives in this way on German roads alone. Among these accidents are some that can be prevented by automated vehicles in future. A potential safety benefit can be determined on the basis of accident data. The examples given in this article demonstrate the possibilities and limits of analyzing this data. What is meant here by potential safety benefits is the predicted fall in accident-related damage. Prerequisites in order to determine specific potential safety benefits are basic assumptions about the overall traffic situation and about the proportion of automated driven mileage with its corresponding functional limits.

Traffic accident research is carried out worldwide by various organizations. Their research encompasses the subfields of accident surveys/-statistics, accident reconstruction, and accident analysis [5]. Accident investigation, carried out by the police in all federal states, forms the basis for accident research in Germany. Furthermore, other institutions such as the Traffic Accident Research Institute of TU Dresden GmbH (Verkehrsunfallforschung, or VUFO) and the Hannover Medical School, as well as vehicle manufacturers and the German insurance industry, all carry out their own accident research. Central to this is investigating accidents directly at the scene, statistically recording and analyzing them according to certain characteristics, and, where needed, using this to further develop future vehicle automation. Regarding automated vehicles' potential safety benefits, the following elaboration exemplarily demonstrates potentials, limits of findings and predictions given by accident-data collections.

The following questions will be discussed, using specific examples from accident research:


#### 17.1.2 Categorizing the Levels of Driving Automation

Three categories for levels of driving automation (concerning the degree of vehicle guidance) are outlined briefly below, and will later be used as examples to illustrate the potentials and limits of accident data analysis. For use in subsequent sections here the categorization of the previous BASt-project group "Legal consequences of an increase in vehicle automation" [6] published in 2012 is sufficient. These five degrees of automation begin with the original conventional vehicle guidance, termed "driver only", where the driver is permanently responsible for the vehicle's longitudinal and lateral motion. The gradations continue with driver assistance ("assisted") and partial automation ("partially automated"), with constant driver supervision at all times. Lastly, the levels of high automation ("highly automated") and full automation ("fully automated") permit humans to stay out of the vehicle-guidance process some or all of the time [6].

Another five levels were also defined by the American NHTSA agency [7]. Subsequently the SAE International, formerly the Society of Automotive Engineers, developed further six distinctions, as described in its J 3016 informational report. They are being increasingly used in today's research projects. These levels correspond precisely to the BASt levels published previously in 2012, with two key differences. First, the names are different. Second, SAE adds level 5 (full automation), at which the automated driving system performs the entire dynamic driving task under all conditions that can be managed by a human driver [8] (see below Fig. 17.1).

#### 17.2 Accident Data Collections to Demonstrate Potential Safety Benefits

According to accident statistics, a fatal road accident occurs on average:


Since the early 1970s, measures taken in road building, legislation, the rescue chain, emergency medicine, and passive and active vehicle safety have lowered the numbers of

Fig. 17.1 Levels of automation according to BASt, NHTSA and SAE. Image rights: Author

injuries and fatalities in road accidents considerably in Western countries. This finding is based on large-scale worldwide collected surveys and analyzes of road accidents with various orientations, amount of data and from surveys of varying depth. Selected accident-data collections that exemplify on automated vehicles' potential safety benefits will now be introduced, along with their respective pros and cons.

#### 17.2.1 Federal Road-Traffic Accident Statistics in Germany

In accordance with Section 1 of the StVUnfStatG (§1, German law on statistics of road traffic accidents) from 1990, the Federal Statistical Office of Germany in Wiesbaden publishes monthly federal statistics on fatalities, injuries, and property damage. All police stations are obliged to submit defined records of reported accidents, and to pass on information from traffic accident reports to state-level statistics offices [4].

The nationwide statistical data is published regularly on the Internet. The cause of accident determined by police investigation, which essentially evaluates drivers' driving errors, shows the potential for automated driving (see p. 344, Sect. 17.4.1.1; p. 351, Sect. 17.4.3.2). All documented information is subdivided into clear categories, e.g. type of road, age of all parties including the people causing the accident, and type of transport means. There is no specific documentation on accident reconstruction, injuries or vehicle details available.

#### 17.2.2 German In-depth Accident Study (GIDAS)

Extensive data is required for the detailed and statistically reliable analysis of road-accident scenarios. In Germany, the database of GIDAS (German In-Depth Accident Study) is qualified for many of these purposes. Nationally and internationally recognized, it is considered one of the most comprehensive and significant accident databases in the world [5, 11]. In-depth analysis at the accident location follows an incidence of personal injury involving any type of vehicle, and has been supported in Germany by the Federal Highway Research Institute (BASt) since 1973 and the Research Association of Automotive Technology (FAT) since 1999. Today, the GIDAS project anonymizes and places in a separate database some 2000 accidents annually, with up to 3000 coded parameters, from the survey areas of Hannover (since 1973) and Dresden (since 1999). Each documented accident contains information on the environment (e.g. weather, road type, road condition, environment), the situation (e.g. traffic situation, conflict situation, and type and manner of accident), the vehicles (type, safety equipment), and personal and injury data including a sketch of the accident with reconstruction and image data [5, 11, 12].

The benefits of the GIDAS data are based on in-depth analyses with several types of vehicles causing injury to persons, the related accident site, and the field of medicine. To aid further analysis, many cases are reconstructed and simulated electronically to a high level of detail with the PC-Crash simulation software from the Austrian company DSD-Datentechnik www.dsd.at [13]. One disadvantage lies in the fact that data access is limited to car manufacturers and component suppliers taking part in the project. The investigation criteria only include accidents involving injuries. Although only the Hannover and Dresden areas are surveyed, the results are transferable to the whole of Germany via extrapolation (in technical terms: weighting and comparison with official accident statistics, see Sect. 17.2.1).

#### 17.2.3 Road-Traffic Accident Statistics in the USA

In the USA, the National Highway Traffic Safety Administration (NHTSA) has been consistently documenting every fatal road accident since 1975 using the Fatality Analysis Reporting System (FARS) [9]. Furthermore, the National Automotive Sample System— Crashworthiness Data System (Nass-CDS) has existed in the USA since 1979 [14]. The program analyzes road accidents involving personal injury or severe property damage using interdisciplinary teams, similarly to the German GIDAS project.

In-depth data collections for extended accident analysis can also be found in the USA, although, unlike GIDAS, they offer no reliable accident reconstruction. For example, it is not possible to assess emergency braking functions [11]. Accident risks in the USA differ, e.g. due to the longer distances driven. The drop in US traffic accident fatalities since 1970 is lower, at around 16 %, than in Germany, at around 60 % [4, 9].

#### 17.2.4 Road-Accident Data in Asia, Taking the Examples of China and India

Traffic accident data collection in Asia is still in its initial stages. Analysis is superficial and permits no reliable reconstruction. While initial approaches to reliable data collection have been made in China, the number of traffic accident fatalities is not even recorded in India [11].

#### 17.2.5 International Road-Accident Data Collections

The International Road Traffic and Accident Database (IRTAD) consists of a collection of various national official accident statistics. It includes road accidents involving personal injury generally as well as fatalities—distinguished by age, location and type of road use—and is maintained by the Organisation for Economic Co-operation and Development (OECD) in Paris. Besides the countries bordering Germany, it contains data from: Australia, Canada, Finland, Greece, Hungary, Iceland, Ireland, Israel, Italy, Japan, Luxembourg, New Zealand, Norway, Portugal, Slovenia, South Korea, Spain, Sweden, the UK and the USA [10].

The data is publicly accessible on the Internet and especially suited to comparing the data between countries included. It is possible to study the impact of various regulations and collective driving behavior (north vs. south, for instance). In-depth information on the details as to how the accident occurred is still lacking, however. Moreover, survey methods and data volumes vary from country to country.

Another initiating action for harmonisation of global in-depth traffic accident data is the Initiative for the Global Harmonisation of Accident Data (IGLAD). IGLAD was initiated in 2010 by European car manufacturers to improve road and vehicle safety. The database contains accident data according to a standardised data scheme. This should enable comparison between datasets from different countries. The first phase of the project was funded by the European Automobile Manufacturer's Association (ACEA). The growing data set of the second phase, which started 2014, contains 93 variables regarding the accidents, roads, participants, occupants and safety systems. Limited data (between 50 and 200 cases, data years 2007–2012) from each of 11 countries (Australia, Austria, China, Czech Republic, France, Germany, India, Italy, Spain, Sweden and USA) are available for research.

#### 17.2.6 Accident-Data Collections of Auto Manufacturers

In order to collect findings on accidents involving current vehicles, and to fulfill product monitoring obligations, interdisciplinary expert teams from car manufacturers and component suppliers today carry out accident analysis at the scene together with hospitals and the police. The results primarily serve continuing improvements in the effectiveness of vehicle safety systems currently in use.

Moreover, the analysis of accident incidents by the manufacturer serves in complying with mandatory duty of care and observing potential product dangers that may arise during use. According to Section 823 of the German code of civil law (BGB), an auto manufacturer is liable for errors of its products' consequential damages arising from intended or foreseeable use by the driver or other persons. A car manufacturer must therefore collect and analyze information on vehicle use and innovative systems. The more dangerous a product is, the greater the obligation to protect and monitor a product's safety in and after the development process [15], (see Chaps. 21, 23 and 28).

Among the car manufacturers Mercedes-Benz (now: Daimler AG) began investigating road accidents involving its Mercedes vehicles together with the police of the district of Böblingen as far back as the late 1960s. Two years later, Mercedes' accident research had, with ministerial permission, access to regular telephonic information and insight into the accident files of the police in Baden-Württemberg. Since at least the 1970s, other manufacturers such as BMW have been studying and recording collisions involving their own vehicles on a larger scale. Volkswagen began cooperating with the insurers association Haftpflicht-, Unfall-, Kraftversicherer-Verband (HUK-Verband) in the late 1960s and with the Hannover Medical School MHH (the predecessor of GIDAS) starting from 1985. Volkswagen has been recording its own data since 1995 [11].

In-depth, interdisciplinary analysis of accidents by car manufacturers involving new types of vehicles with the latest safety technology and especially involving function developers enable clear insights into the potential benefits of driver-assistance systems. However, around a few hundred cases per year exclusively involving a brand's own vehicles are not comparable with GIDAS data in terms of their statistical validity.

#### 17.2.7 Accident Data of the German Insurance Association

The German Insurance Association (Gesamtverband der Deutschen Versicherungswirtschaft—GDV), the successor organization of the HUK-Verband, has at its disposal documented information on incidences of damage from motor claims of German insurers where compensations for damages based on contracts were paid. These data benefit the GDV for example in grading insurance contracts, or in determining the potential safety benefits of driver-assistance systems [16].

Accident research by insurers has access to all cases of motor-vehicle liability losses reported with the GDV. Unfortunately, the data are not open to the public. Accident analysis does not take place at the scene and the accident-recording criteria are not comprehensive. Moreover, the insurer's interest in the particularities of a case ends as soon as it sees liability to pay. This therefore means that there is only little detailed information on the cause of undisputed cases. In single-vehicle accidents with only one party involved, such as so-called driving accidents, when a driver loses control of the vehicle, there is mostly no data available on the cause [11].

#### 17.2.8 Accident-Data Collections of Consumer Associations (ADAC)

ADAC (the German automobile club) has been carrying out accident research since 2005. It is a cooperation project between ADAC air rescue and the ADAC technology center. From rescue flights, information on around 2500 severe accidents nationally is collected in the ADAC database annually. The accident data is sourced from the police, doctors, fire service, and motor-vehicle assessors [17].

The ADAC accident data contains information on road accidents with seriously injured persons. They include aerial pictures with a vehicle's final position and a detailed medical diagnosis. Supplementary individual assessment is possible using the files, although the data is not publicly accessible. There is no concluding interdisciplinary reflection with the respective persons investigating the accident.

#### 17.3 The Fundamentals of Accident-Data Analysis

#### 17.3.1 Level of Data Collection Versus Number of Cases

The validity of accident data regarding potential safety benefits varies considerably depending on the collection method. In-depth surveys are mostly carried out in cooperation with qualified interdisciplinary teams. Particularly well-founded results are achievable when function developers, accident analysis experts, doctors, and traffic psychologists work together on analyzing individual cases. But this level of data collection is usually restricted to a low number of cases, hampering its statistical validity.

Evaluations from accident databases indicate which measures are needed to increase traffic safety. A detailed accident analysis including an accident reconstruction encompasses a retrograde calculation of speeds from traces of the accident, an investigation into how the accident arose, a check for accident fraud, consideration of how avoidable it was, and biomechanics. An evaluation of future systems' potential benefits based on this requires extensive knowledge of the given conditions and framework.

Until now, forward-thinking ideas on improving vehicle safety have primarily come from combining accident analysis, existing experience and extensive research work. Accident research is one way to determine the efficiency of existing automated vehicle functions and the need for new safety-enhancing ones. In what follows, basic terms of accident-data evaluation are explained.

#### 17.3.2 The Validity of Areas of Action Compared to Areas of Efficiency

When comparing various accident-data analyses, both the way in which data is collected and the way it is processed must be distinguished. Frequently, areas of action adopted under optimal conditions are confused with areas of efficiency under real conditions.

An area of action covers the accidents that a system can influence. The area of action can vary depending on how precise a system's specification is defined. As a result it is an initial estimation for the maximum achievable potential of the regarded level of automation. The actual resulting efficiency of a function, on the other hand, is usually significantly lower. Efficiency here is the effect that a specified system actually has. It is either proved in the occurrence of accidents (a posteriori) or predicted by a simulation (a priori).

Determining an area of efficiency thus demands precise knowledge of two factors:


The degree of efficiency describes a function's relative efficiency as a percentage and is always dependent on the unspecified term of the area of action [18]:

$$\text{degree of efficiency} = \frac{\text{area of efficiency}}{\text{area of action}} = \ge \lceil \% \rceil \tag{17.1}$$

#### 17.3.3 Potential Safety Benefits Depending on the Level of Automation and Degree of Efficiency

Some analyses of potential safety impacts using accident databases examine the maximum assumed area of action described above. In contrast, analyzing the degree of efficiency comes closer to reality by assessing an area of efficiency for its actual benefit [18]. The resulting safety benefits of automated vehicles only arise, though, after all risks have been taken into consideration. The benefit complies with the reduction of accident frequency and severity. New risks exist in terms of as-yet nonexistent accidents that may arise with increasing automation.

The theory of inventive problem solving (TRIZ) defines the requirements of an ideal machine by the formula of an ideal final result with an unlimited benefit without costs and damages [19]:

$$\text{ideal final result} = \frac{\sum \text{benefit}}{(\sum \text{costs} + \sum \text{damages})} = \frac{\infty}{(0+0)} = \infty \tag{17.2}$$

On the one hand, when looking at the actual total consumer-relevant potential as regards the safety benefit of automated vehicles, this increases in accordance with the degree of efficiency up to the maximum area of efficiency (proof by accident data analysis and knowledge of functions). On the other hand, the risks may increase in line with the level of automation ("Driver" vs. "Robot"). These in turn reduce the actual safety benefit (see Fig. 17.2). To minimize potential risks, manufacturers carry out risk management (see Chap. 28) that takes accident data into account.

Fig. 17.2 Consumers evaluate the potential safety benefits subjectively by weighting up the perceived risks and benefits in the relevant contexts. Risks depend on the level of automation, benefits on the degree of efficiency. Accident-data analysis and risk management (see Chap. 28) allow for objectivation (see Chap. 30) and optimization. Image rights: Author

#### 17.4 Significance of Possible Predictions Based on Accident Data

Using examples, the following meta-analysis shows what is and is not possible when drawing conclusions about potential benefits on the basis of various accident data. As there is no existing experience of analyzing highly and fully automated vehicles, systems without automation ("driver only"/"no automation") or with low levels of automation referring to the main driving task ("assisted"/"partially automated") are considered first, divided into a-posteriori- and a-priori-analyzes.

Section 17.4.1 describes examples of a-posteriori-statements on accident data collected so far. In the definition used here, figures "gained from experience" [20] can be used directly for interpretations. In contrast, the a-priori-forecasts defined in Sect. 17.4.2 are based on accident-data collections to assess the potential benefits of future levels of automation, exclusively using assumptions "obtained by logical reasoning" [20].

#### 17.4.1 A-Posteriori-Analyzes of Accident Data for "Driver Only"/ "No Automation"

Past and present a-posteriori-analyzes of accident-data collections with conventionally (human-) driven vehicles form the basis for direct insights into accident black spots and changes in real-life traffic accidents. In this "driver-only"/ "no-automation" category, there are neither warnings nor interventions in longitudinal and lateral guidance on the basis of environmental sensors.

To illustrate this, the change in the numbers of accident deaths serves as one example (see Sect. 17.4.1.1), the impact of Electric Stability Control, or ESC, is another (see Sect. 17.4.1.2).

#### 17.4.1.1 Traffic Statistics: Accident Fatalities Versus Registered Motor Vehicles

One example of what currently available accident data can show is the relationship of traffic accident deaths to vehicles registered, taken from data of the German Federal Statistics Office. This demonstrates that numbers have been dropping in Germany since the dramatic figure of 21,332 traffic accident fatalities in 1970 [4].

In short, the accident data shows that the number of traffic fatalities dropped from over 21,000 in 1970 to almost 3000 per year—at the same time as increases in registered vehicles occurred. The multifarious causes of this lie in the area of various legislative, technological, medical, and infrastructural measures (see Fig. 17.3). The overlapping of all safety measures makes it difficult to prove the effectiveness of any single potential safety benefit.

Fig. 17.3 Reduction of traffic fatalities due to safety enhancements despite increase of registered motor vehicles in Germany. Image rights: Author

#### 17.4.1.2 Studies on the Effect of "Driver-Only"/"No-Automation" Systems

Electronic Stability Control, or ESC, introduced in 1995, is technically built up on anti-lock braking, or ABS, introduced in 1978. It uses that system's wheel speed sensors together with additional sensors for yaw rate, steering wheel angle, and lateral acceleration. Using the information from these sensors, ESC tries to stabilize the vehicle in case of a recognized skid by independently braking individual wheels. With this braking intervention, ESC can convert a lateral collision into a less vulnerable frontal crash. In 2001, Daimler accident research assumed that 21 % of skid accidents resulted in injuries and 43 % in fatalities [21]. The findings of accident-research experts investigating individual cases on behalf of vehicle manufacturers diverged greatly at that time. Later predictions of potential benefits based on larger amounts of data also differ. Areas of action from the year 2000, for instance, show a positive impact of up to 67 % for severe accidents due to skidding [22]. Other studies found that ESC provides the second-most effective increase in safety in the "driver-only" category, after the introduction of safety belts as a passive safety system [2]. The proportion of accidents caused by driver-error and skidding, for example, fell after the introduction of ESC as a standard in all Mercedes-Benz cars from about 2.8 involved cars (per 1000 registered in Germany) in 1998/1999 to 2.21 involved in 2000/2001. ESC's high effectiveness could also be verified in other car brands such as Volkswagen, where accident statistics show lower accident frequency and prevention of especially critical accident types [22].

In summary, safety benefits can already be proven today for safety-enhancing "driver-only" functions with quick market penetration depending on various data sources and suppositions. Particularly for ESC, safety impacts can be well-founded scientifically verified.

#### 17.4.2 A-Priori-Forecasts for Assisted and Partially Automated Driving

A-priori-forecasts are tied to hypotheses and inferences. Assisted and partially automated driving functions, for example, can save the driver from imminent danger via optic, acoustic or haptic warnings or short braking or steering interventions with a warning character. A prerequisite for successfully averting danger, however, is the assumption that the driver will react in time and appropriately to the traffic situation.

From a technical point of view, these advanced levels of automation—with extended computer and sensor technology for environmental perception—allow for increasingly capable assistance systems. Some safety-enhancing driver assistance systems on the market today give warnings when there is recognized danger in parallel and crossing traffic. These include collision warning systems as EBA—Electronic Brake Assist, ACC with FCWS—Adaptive Cruise Control with Forward Collision Warning System, LCA— Lane Keep Assist, LDW—Lane Departure Warning, NV—Night Vision or intersection assistance. Other systems intervene in the longitudinal and lateral vehicle dynamics, such as Electronic Brake Assist (EBA) or Autonomous Emergency Brake (AEB), (see Fig. 17.3).

#### 17.4.2.1 Study on the Potential of Lane Departure Warning

One approach to analyzing road accidents together with doctors, psychologists and development engineers was introduced in 2006, using the example of a Lane Departure Warning (LDW) system [24]. The results, achieved with the participation of the author of this paper, a psychologist, and a function developer, were based on an interdisciplinary research community between a car manufacturer, a university hospital, and the police, with support from the Bavarian Ministry of the Interior, Building and Transport (BStMI).

Such interdisciplinary analyzes of accident causes and consequences include examining the technical, medical, and psychological details by experts from each field, then integrating all results collectively. Today, for instance, driving-related psychological data is increasingly collected to analyze a road accident. Using standardized interviews, the experience of a collision is recorded and evaluated from the driver's point of view. Technical reconstruction of the accident is supplemented by a traffic-related psychological perspective.

In coordination between the professional teams, taking the example of Lane Departure Warning, it was explained what specifications of the system design had to be met. Specific focused questions from the technological development allow the selected accidents to be filtered further. This gives insight into the accident-avoidance potential of the systems under development. For this purpose, knowledge of the system's specific technical limits is crucial. Recommendations for further functional system enhancements are also possible [24].

In conclusion, these detailed accident analyzes show the benefit of comprehensive accident-data collection. Within this study, experts on technology, medicine, and psychology were closely interconnected. The interdisciplinary approach delivers numerous additional references in terms of vehicle details, accident scenes, parties involved in accident, injury patterns and witness statements. This extra information provides insight into active steering corrections, interventions of the brakes and reactions immediately preceding a collision, as human errors such as fatigue, inattentiveness or distraction are the main causes of lane departure. Various directions from which an interdisciplinary team analyzes the accident allow the computer-aided reconstruction and simulation of an incident to be highly realistic. To determine representative findings from this, however, it is necessary to validate it with larger accident-data collections.

#### 17.4.2.2 Interdisciplinary Degree of Efficiency Analysis Based on Current Driver Assistance Systems

Building on the advantages of interdisciplinary analysis of the effectiveness of Lane Departure Warning, a further interdisciplinary degree-of-efficiency analysis was carried out four years later. The objective was to compare available safety-enhancing driver-assistance systems which were available on the market. This study used a sample of reconstructed accidents (n = 100) in close consultation with the respective function developers. Therefore an interdisciplinary accident-data evaluation was carried out by the author together with a psychologist. Regarding accident causes, the driver assistance systems' effectiveness at avoiding accidents depending on the situation was analyzed [25]. The range of systems available for study in early 2010 included Night Vision, Lane Departure Warning, Lane Change Assistant and Adaptive Cruise Control. To establish the degree of efficiency, accident research data, weighted according to accident statistics for Bavaria, was analyzed. In the process, real-life accidents were compared with the reconstructed accident scene, and the accident cause was assessed in terms of human-machine interaction. This was done in line with the human-machine interactions described in the ADAS Code of Practice for the development of Advanced Driver Assistance Systems (ADAS) with active longitudinal- and lateral guidance [26]. After many years of preparation [27, 28] it was published by the European Automobile Manufacturer's Association (Association des Constructeurs Européens d'Automobiles— ACEA) in 2009 [29]. The potential for preventing accidents was only deemed to be positive if every development expert for the relevant system agreed. The results showed that the examined systems could significantly contribute to reducing the severity of accidents.

Overall, the study predicts that the investigated driver assistance systems would positively impact accident prevention, with a 27 % drop in the total number of injured persons. The number of injured would thus be reduced from 126 drivers and 49 passengers to 94 and 33 respectively. It should be kept in mind that the results assume optimal reactions in terms of human-machine-interactions. This would need to be verified by studies with test persons before drawing final conclusions. Further, 100 % distribution of the systems, operating error-free within the system limits, would have to be assured.

The injury grading adopted was based on the Abbreviated Injury Scale (AIS) [30], as also used in ISO 26262 for functional safety [31]. The AIS codes every injury to the human body with a numerical value between 1 (light injuries) and 6 (extremely critical or fatal injuries). The most severe injury of all individual injuries of one person is thus defined as MAIS (Maximum AIS). An uninjured person is classified with MAIS 0.

Analyzing accident causes further revealed that more than 60 % of them involved so-called information errors—malfunctions of information access and information reception. This explains the correspondingly high effectiveness of warning assistance systems [25].

In summary, currently available driver assistance systems were compared in an interdisciplinary study, with the respective developers taking part in the analysis. Each individual developer knows the specific relevant function parameters of his system, thus allowing for more accurate assessments of potential benefits. It has to be noted that the sample of 100 cases in the area-of-action study, weighted in comparison with representative accident data from Bavaria, is too small to provide statistically reliable statements based on the results obtained. However, it is possible to derive a tendency where these driver assistance systems contribute substantially to road safety.

Attention should be drawn to the fact that there are further options for obtaining statistical evidence to the forecast safety gains of braking assistance and automatic emergency braking functions. In addition, there are assessment methods for forecasting safety benefits based on simulations using software-based accident reconstructions [32].

#### 17.4.2.3 GIDAS Database Analysis for Potential Safety Benefits of Connected Vehicles

Based on a larger data volume, the following analysis of the German In-Depth Accident Study (GIDAS) database shows the complexity and variety of several assumptions. Together with a team of experts, the author carried out this analysis with a more significant sample in 2009 as part of the Safe and Intelligent Mobility—Test Field Germany (Sichere Intelligente Mobilität: Testfeld Deutschland—simTD) research project. The objective of the analysis was to assess the potential benefit of future safety-relevant vehicle communications systems. Functions for connected systems with a direct safety impact on road traffic were considered. The underlying data encompassed 13,821 accidents involving personal injury documented by GIDAS from 2001 to 2008 in the areas of Dresden, Hannover, and their surroundings [12]. To extrapolate this for the whole of Germany, the data acquired in the statistical sampling scheme was weighted using accident statistics from the German Federal Statistical Office. These official statistics contain all accidents involving personal injury registered in Germany over the calendar year. In 2007, for instance, there were 335,845 road accidents involving personal injury [4].

The variables needed for the analysis were precisely defined in several consultations with the simTD function developers and accident experts from Audi, BMW, Bosch, Daimler and Volkswagen. All project participants agreed to begin by analyzing 13 safety-related warning functions. The participants jointly decided to look at relevant vehicles such as cars, trucks, buses, agricultural tractors, rail vehicles (including trams and city railways, but no Deutsche Bahn trains) and motorbikes (motorized two-wheelers, three-wheelers, quad bikes from 125 cc) in the course of several workshops. This was followed by very intensive work to determine the areas of action using the extensive GIDAS data. This selection was initially made by taking the variables from all accidents relevant to each system relating to the complete accident occurrence. It showed that the areas of action for each individually examined function varied in a wide range between 0.2 and 24.9 %. Areas of action can thus only give an estimation of the maximum effectiveness that cannot be exceeded with great certainty. It should also be noted that it is not possible to add up individual areas of action, due to their overlapping between functions.

In a subsequent degree of efficiency analysis, three assumed function types (electronic brake light, cross-traffic assist, traffic-sign assist for stop signs) from the GIDAS area of action analysis described above were selected. The corresponding degrees of efficiency were adopted by using a reduced sample of driving simulator investigations.

For accidents avoided by the driver with cross-traffic assist (see [33]), for example, there was a sizeable range, from 9.9 to 73.3 %. This results from both varying driver reaction times and different braking intensity upon warnings. Therefore, three reaction times (0.54, 0.72 and 1.06 s) and the respective probabilities of their occurrence were determined. Furthermore, in the cases of unsuccessful reactions, weak braking of 50 % of maximum braking pressure was assumed and 100 % for successful reactions [12].

In summary, this sophisticated approach to analyzing degrees of efficiency was aimed at determining and evaluating with statistical relevance the potential of future, connected, safety-enhancing driver-assist functions. The range between 10 % and 70 % that was found, however, diminishes the validity and thus only permits tendencies and outlooks concerning accidents avoided. This wide scattering is rooted in the sensitivity of the parameters descried above and the warning algorithm in question, as drivers' reaction times and braking intensities differ greatly in practice.

#### 17.4.3 Potential Safety Benefits and Test Scenarios for Development of Highly and Fully Automated Driving

#### 17.4.3.1 GIDAS Databased Expert Estimates until 2070

From a technical point of view, automated vehicles today can already autonomously take over many driving tasks in moving traffic under favorable conditions. While driver assistance systems support the driver, the advanced systems like highly and fully automated driving temporarily or permanently take over the driving tasks.

Among others highly and, particularly, fully automated driving is designed to approach "Vision Zero". The aim is to travel as accident-free and effectively as possible. Roads and means of transportation should be designed in such a way that no person is killed or severely injured. The vision of being accident-free has its origins in occupational safety and was first applied to road traffic in Sweden in the 1990s. The EU has supported projects for automated vehicles such as the "Highly Automated VEhicles for intelligent transport" (HAVEit) research project, which was sponsored by the EU with 17 million Euros. Car manufacturers such as BMW, Daimler and Volkswagen/Audi are also working on visions of accident-free driving. Prof. Dr. Thomas Weber, member of the Board of Management of Daimler AG for research and development, explains in an interview:

Unser Weg zum unfallfreien Fahren treibt uns an, die Mobilität auch in Zukunft für alle Verkehrsteilnehmer so sicher wie möglich zu gestalten. [21]

(Our 'path to accident-free driving' also drives us to design mobility as safely as possible for all road users in the future.)

The number of road accidents involving personal injury with a car as the main cause fell in Germany in the first decade of this century, from 266,885 in 2001 to 198,175 in 2010. According to the Federal Statistical Office (2010), cars are the main cause of road accidents, at 68.7 %. The accident types mainly break down into the following categories: Turning at/Crossing intersections (58,725), Parallel traffic (44,812), Turning (33,649) and 30,737 Dynamic accidents [4] (see Fig. 17.4).

Until now, there has been no empirical proof of the overall safety gains of fully automated driving functions. One of the first comprehensive forecasting models in vehicle-safety and accident research was published by Daimler. It investigated automated vehicles' potential for accident prevention by means of assumed deployment and market penetration scenarios. These were based on expert estimates, third-party forecasts and GIDAS data. The forecast, which is able to provide an initial rough estimate, is based on a total of 198,175 preventable collisions caused by cars in 2010 (see Fig. 17.4). The assumptions involve changes within each accident type (Parallel traffic, Stationary traffic, Pedestrians, Turning at/Crossing intersections, Turning, Dynamic accidents). It can be seen, for example, that accidents involving a car losing control or in parallel traffic will fall by around 15 % by 2060 with increasing automation, while accidents when turning at or crossing intersections will proportionately increase by around 10 % [34].

Fig. 17.4 Passenger cars as main cause of road accidents and distribution of accident types. Source Federal statistical office—DESTATIS, GIDAS. Image rights: Author

According to these estimates for increased automation, an overall reduction of 10 % of accidents would be achievable by 2020. In years thereafter, reductions would be achievable of 19 % by 2030, 23 % by 2040, 50 % by 2050, 71 % by 2060 and almost total prevention by 2070 [34]. The forecast thus indicates that a car in 2070 will cause almost no accidents, but will be able to sustain serious collisions. It can certainly be assumed that an automated vehicle will be able to avoid some collisions that a third party would have caused. It has to be kept in mind, however, that this study does not consider accidents caused by other road users. Potential technical failures (see Fig. 17.6) are also not included. In addition, the data used from the German Federal Statistical Office, and above all the validity of GIDAS, mainly centers around crash and post-crash statements with injured people (see [35]).

#### 17.4.3.2 Global Accident Data Evaluation for Relevant Traffic Test Scenarions

For a complete overall evaluation of highly- and fully automated vehicles' active safety, the author would also recommend incorporating findings concerning worldwide accident data collections as well as analysis with no harm to people, near collisions, traffic simulations and weather data. Therefore a first-time comprehensive area-wide study based on all police reports was carried out (see Fig. 17.7). The findings can be completed with information from hospitals, insurance companies and models of human behaviour. Knowing all relevant factors that may lead to a collision, virtual simulations can be performed based on detailed and quantitative models. Possible system responses can be classified in true positive (or negative) and false positive (or negative). The evaluation of automated safety functions has to consider all possible system responses [36].

The purpose is to comprehensively link up all international known collisions using geographically defined road-accident data and the accompanying high-definition geographic digital mapping data (e.g. Google Maps, Nokia HERE, TomTom, Open-StreetMap) with traffic data from different sources (e.g. cars, mobile phones, road traffic devices). Localized accident data in the states of the USA, for example, exist via www. saferoadmaps.org. Similarly, the British government publishes details on www.data.gov. uk; these are in turn located on the UK Road Accident Map. Regional accident data in Germany (updated monthly) can be gathered from police software-supported IT applications—in some federal states from the Geographic Positioning, Analysis, Representation and Information System (Geografisches Lage-, Analyse-, Darstellungs und Informationssystem—GLADIS), the Road-Accident Location Map and Analysis Network (Verkehrs-Unfall-Lage-Karten und Analyse-Netzwerk—VULKAN), the Brandenburg Expert System for the Analysis and Documentation of Accident-Heavy Route Sections (Brandenburgisches Expertensystem für die Analyse und Dokumentation von unfallauffälligen Streckenabschnitten—BASTa), the Geographic Police Information System for Road accidents (Geografisches Polizeiliches Informationssystem für Verkehrsunfälle— GEOPOLIS V) or the widely distributed Topographical Electronic Accident-Type Map (Elektronische Unfalltypensteckkarte—EUSka) [37].

In summary, neither reliable specifications for OEM (Original Equipment Manufacturers) mass production solutions ready for market nor concrete information on the functional limits of highly and fully automated driving are currently available. To date, therefore, numerous assumptions have had to be made in forecasting potential safety benefits. Reliable data is also lacking on market launch and penetration. Thus today's projections of potential safety benefits, based on accident data, only have limited validity. It is hence recommended to combine in-depth accident data collections (e.g. GIDAS) with all worldwide available accident data collections and analyzes, traffic simulations, related weather information and vehicle operation data (see Fig. 17.5).

The learning curve in Fig. 17.6 shows the increase of available real world data before and after market launch of automated vehicle functions. To identify relevant critical scenarios the author recommends monitoring and analyzing all available data of automated functions regularly. These provide knowledge for sensor simulation, classifications and decision strategies of future automated vehicles.

Fig. 17.5 Recommended procedure with worldwide relevant test scenarios from around the world based on comprehensively linked-up geographically defined accident, traffic, weather- and vehicle operation data collections pertaining to human and machine perception (see Fig. 17.8). Image rights: Author

Fig. 17.6 Learning curve increase of available real world data before and after market launch of automated vehicle functions to identify relevant critical scenarios for sensor simulation, classifications and decision strategies (see Fig. 17.8). Image rights: Author

#### 17.5 Potential Safety Benefits / Risks and Impacts on Testing

#### 17.5.1 Human Error and Technical Failure in Full Automation

Presuming that most accidents are caused by human error (see Sect. 17.5.2.2) it would then be almost possible to realize "Vision Zero", given fault-free fully automated vehicles. However, technical failure and technical limits are still to be expected—especially in fully automated self-driving vehicles.

The left side of Fig. 17.7 shows the statistical cause-of-accident distribution, based on the GIDAS accident database. This accident data show that "human error", at 93.5 %, is the main risk of road accidents. The impact of factors involving driving conditions or the environment—road surface quality or weather, for instance—is relatively low according to the statistics, at 4.6 %, as is technical failure at 0.7 % [38].

During fully automated driving sections, the number of accidents caused by driver error is ruled out completely. The "technical failure" category could become proportionally larger, with the new technical risks of fully automated driving. This will lead to the public giving it greater attention (see Fig. 17.7).

Fig. 17.7 Today 93.5 % of accidents results from human error. With full automation, there would be no more human error. However, the proportion of technical faults may be perceived considerably enlarged in future. Source GIDAS. Image rights: Author

Further assessment and overcoming of human failure-processes in real traffic situations in addition to worldwide relevant test scenarios based on comprehensively linked up geographically defined accident, traffic, weather, and vehicle operation data collections (see Sect. 17.4.3, Figs. 17.5 and 17.6)—will support virtually traffic simulations for safe development, tests and validation of automated vehicles in the future [39].

#### 17.5.2 Potential Safety Benefits–Human and Machine Performance

Vehicles' road safety today essentially depends on the performance of humans supported by safety-enhancing systems. Fully automated vehicles will only rely on the capabilities of machines. Depending on the degree of automation, technical systems will replace humans' perceptions, experience, judgment and capacity to react. Both the potential safety benefits and risks of increasingly automated vehicle guidance result from the various strengths and weaknesses of humans and machines.

Machines, for example, cannot react to unknown situations or interpret the movements of children (see Chap. 20). In comparison, humans can be inattentive, judge distances and speeds badly and their eyes only see a restricted field of vision [29].

#### 17.5.2.1 Machine Versus Human Perception Limits and Consequences for Testing

To illustrate the limited performance of technological perception compared to that of humans, a heavily simplified model of currently used sensor technologies is described below. Sensors are needed for a vehicle to be able to collect information about its environment, and are classifiable according to their physical measuring principle. The automobile sector mainly uses radar, lidar, near and far infrared, ultrasound sensors, and cameras. The upper and center image of Fig. 17.8 show simplified and color-coded the limited machine perception of individual measuring principles. Compared with this, the lower image superimposes all these above-named measurements onto what humans perceive among difficult light- and weather conditions (sun, backlight, wet road surface, spray/splashing water, icing/contamination of windshield/sensors, road markings only partially visible). Close investigation reveals that the lefthand radar reflection point (blue) is a false detection, caused by a reflection in the opposite lane (see [40, 41]).

Figure 17.8 illustrates that the outcome of machine perception and interpretation of complex traffic situations continues to present development engineers with considerable technical challenges. These include detecting static and dynamic objects, physically

Fig. 17.8 Machine versus human perception (upper image radar in blue with lidar in yellow, center image addition with camera-image processing in green and red, lower image overlay machine with human perception). Image rights: Author

measuring them as accurately as possible, and allocating the correct semantic meaning to the detected objects (see Chap. 20).

Difficult light- and weather conditions challenge human and machine perception in real traffic situations. For this purpose area-wide accident data analyzes (see Sect. 17.4.3.2) are able to indicate temporally and geographically related accident black spots. To analyze scenarios considering reduced visibility due to fog, rain, snow, darkness and glare from sun or headlights, the author carried out a fist-of-its-kind area-wide accident study in cooperation with Christian Erbsmehl from Fraunhofer Institute for Traffic and Infrastructure Systems (IVI) in Dresden. One finding of the case-by-case analysis was that in 95 % of all cases no evasive actions to avoid accidents were documented. Only in 1 % of the cases drivers were able to reduce the consequences of a collision by evasive maneuvers. Other evasive maneuvers failed (4 %). Figure 17.9 presents results of this study with relevant geographical accident scenes for virtual, proofing ground, and field tests of automated vehicles covering all police reports in Saxony from the years 2006 to 2014.

Fig. 17.9 Area-wide geographically related traffic accident scenes with difficult weather conditions and reduced visibility for human and machine perception (Geographical data © state-owned enterprise geo basic information and measurement Saxony 2015). Image rights: Author

#### 17.5.2.2 Human Error Versus Machine Incertitudes

Advancing vehicle automation of the main driver tasks result in new research questions. Attentive and vigilant drivers have substantial skills to deescalate dangerous traffic situations. Human's capabilities provide significant input for traffic safety today. Differentiated potential-benefit estimates would need to compare the performance of humans and machines. Especially take-over situations between driver and machine involve new challenges for design and validation of human-machine interaction. Initial tests at the professorial chair of Klaus Bengler, professor for ergonomics at the Technical University of Munich (TUM) demonstrate relevant ergonomic design requirements which will be continued [42].

Fundamental correlations between automation and human performance can be evaluated by many methods. It is possible to identify the probability of a road accident by the use of a fault tree. Amongst others the probability includes human failure, inappropriate behavior and the existence of a conflicting object [43]. The choice of actions to avoid a collision is greater if the potential road accident is less imminent.

The evaluation of driver behavior requires observations for a longer period. Regarding human failures analyzing the perception process chain provides in-depth knowledge. Such analyzes draw on evaluations of psychological data from road accidents [44]. In terms of interdisciplinary accident analyzes, an error classification of five categories has been approved by practical experience in accident research. This five-steps method is a further development of ACASS (Accident Causation Analysis with Seven Steps). It was developed jointly with GIDAS along the lines of the seven-step principle by Jens Rasmussen, former system safety and human factors professor in Denmark, a highly influential expert within the field of safety science, human error, risk management and accident research [45]. Using the five-steps method it is possible to identify human errors, define the time during the perception process from accessing the information to operation, and to evaluate the particular type of error (see Fig. 17.10). The associated questions concern: Information Access (was the relevant information of the traffic-situation objectively accessible to the driver? Was the field of vision clear?), Information Reception (did the driver observe the traffic situation properly and perceive/detect the relevant information subjectively?), Data Processing (did the driver correctly interpret the traffic situation according to the available information?), Objective Target (did the driver make a decision appropriate to the traffic situation?), and Operation (did the driver carry out his or her decision into operation properly?).

Using this classification, the accident analysis shows that the predominant sources of human error lie in Information Access and Reception (see Fig. 17.10, [25, 46]).

For machine perception, Klaus Dietmayer, professor in Ulm at the Institute of Measurement, Control, and Microtechnology, Expert for Information fusion, Classification, Multi-Object Tracking, Signal processing and Identification (see Chap. 20) names three essential domains of incertitudes corresponding to human Information Access as well as Data Processing. These three are: firstly State-, secondly Existence-, and thirdly Class uncertainty. All three have a direct impact on machine performance. If the uncertainties in

Fig. 17.10 Distribution of human error in road traffic (see [25, 46]). Image rights: Author

these areas increase beyond a yet to be defined "tolerable limit", errors in the automatic vehicle guidance can be expected. In terms of making forecasts, currently only an indication of trends is possible.

While the currently known methods for estimating state and existence uncertainties do not enable a current estimation of the capability of the machine perception, in principle it is not possible to predict degeneration in the capability of individual sensors or even a failure of components. (see Chap. 20)

#### 17.5.3 Potential Safety Benefits of Fully Automatied Vehicles in Inevitable Incidents

When analyzing the potential safety benefits of fully automated vehicles, it is also important to consider persistent risks in the area of complex traffic situations and today's known inevitable incidents. These include accidents at poorly visible and unclear intersections or behind visual obstructions. In a study of individual cases as part of a doctoral thesis at the University of Regensburg, visual obstruction was identified as a contributory cause in 19 % of all cases [44]. Examples include trees, bushes, hedges, and high grass. Obstructions for instance may also be the cause of an accident if a child is running out suddenly and unexpectedly in front of a car from between parked vehicles or a yard entrance.

This especially includes errors in the sequences of the perception process, in the accessing and reaches its limits.

Due to the large number of possible and non-predictable events, especially the reactive actions of other road users, the uncertainties increase so strongly after around 2 s–3 s that reliable trajectory planning is no longer possible on this basis. (see Chap. 20)

Therefore experience-based, internationally valid guidelines with virtual simulation methods for testing and verification of automated vehicles and final testing of the overall system limits in a real environment are recommended. This includes interaction tests with control algorithms and performance verification of real sensors in real traffic situations, particularly at the time just before a collision [47, 48].

#### 17.6 Conclusion and Outlook

The findings from road accident research confirm: human failure is the main cause of road accidents. This especially includes errors in the sequences of the perception process, in the accessing and reception of information.

In order to estimate the potential safety benefits of highly and fully automated vehicles from accident data, a sophisticated comparison of the overall performance of humans and machines is required. This, however, will only be possible when precise knowledge is available concerning the functional characteristics and technical limits of developments planned for mass production.

Statistically verified expert assessments have already proven the potential benefits of future safety-supporting vehicle- and driver assistance systems. Even before development has started, for instance, potential benefits can be estimated, and car manufacturers, due to the analysis and evaluation of road accidents, can also fulfill their product monitoring obligations.

Overall, the results of road-accident analyzes today verifiably show that automating driving tasks from the "driver only", "assisted", up to "partially automated" driving categories are key technologies in contributing to minimizing the consequences of human failure.

Forecasts for highly and fully automated vehicles, generated using traffic accident data, only give results based on numerous assumptions. A forecast of fully automated vehicles' potential safety benefits came from a first Daimler accident-research appraisal that is based on several expert assumptions. According to Daimler's estimates, practically complete elimination of accidents is possible by 2070—assuming successful market penetration. However, only accidents triggered by cars were looked at, and no consideration was given to physical limits and potential technical defects. This appraisal is thus based on some assumptions still to be refined and validated in a more detailed fashion in the future.

Above all, current forecasting is still made difficult by technical challenges. Perceiving and interpreting complex traffic situations, in particular, faces considerable technical challenges for development engineers. Furthermore, human performance is often underestimated. Assistance and partly automated systems essentially are able to compensate for weaknesses in human capacities according to findings from road-accident analyzes. They can increase safety in routine human driving situations with supervision, warnings and lateral or longitudinal support. To further reduce the numbers of road accidents, driverless vehicles, on the other hand, at least must first match the driving skills of an attentive human driver, supported by assistance and partly automated systems, considering a series development. Only when these technical barriers have been overcome, can a large-scale rollout of marketable fully automated vehicles be expected.

In summary, the following issues limit the validity of the potential safety benefit forecasts from "driver-only" to fully automated vehicles and will have impact for testing:


rule-consistent way of driving. This applies, for instance, to physical driving limits or time-critical situations, such as a child running suddenly in front of a vehicle.

– Area-wide accident analyzes provide relevant scenarios for testing and verification of automated vehicles including virtual simulation methods, but final testing of the overall system limits in a real environment will not be completely eliminated.

The potential safety benefits of fully automated vehicles are finally also based on the assumption that over 90 % of today's road accidents can be put down to human error. Even if the technology of driverless cars never reaches 100 % perfection, and a few as yet unknown accident scenarios arise as a result, the vision of area-wide driverless-vehicle use in road traffic appears to promise a socially desirable benefit. Research activities that make use of interdisciplinary experts working on vehicle automation should therefore be promoted and strengthened. It is recommended to combine in-depth accident data with all worldwide geographically defined accident data collections, related weather, traffic, and vehicle operation data information taking into account data protection measures. This will lead to actual safety benefits and statistically relevant scenarios for development including validation or testing of automated driving pertaining to machine versus human perception.

Open Access This chapter is distributed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, duplication, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, a link is provided to the Creative Commons license and any changes made are indicated.

The images or other third party material in this chapter are included in the work's Creative Commons license, unless indicated otherwise in the credit line; if such material is not included in the work's Creative Commons license and the respective action is not permitted by statutory regulation, users will need to obtain permission from the license holder to duplicate, adapt or reproduce the material.

#### References


# 18 Autonomous Vehicles and Autonomous Driving in Freight Transport

Heike Flämig

#### 18.1 Introduction

The degree of vehicle automation is continuously rising in all modes of transport both on public traffic infrastructure and in-house transport within company grounds, in order to improve the productivity, reliability, and flexibility of transport. Due to the growing information density and the complexity of the geographic division of labor, the idea of autonomous, decentralized local units is gaining in significance. By focusing on private passenger vehicles, however, public and scientific debate has until now neglected around one third of traffic on public roads, i.e. commercial traffic. Thereof, around one third is goods transportation, because the location of raw material or final goods production seldom coincides with the place of goods demand. Transport itself adds no value to the product. For this reason, applications where transport could take place without a driver were developed for in-house logistics as early as in the 1950s. The so-called driving robot was primarily developed for taking over special missions in dangerous or practically inaccessible situations. Automated, driverless and partially autonomous vehicles have therefore been in operation for transporting goods in production and logistics systems for a long time.

In essence, the question can be asked to what extent fully automated vehicles can also be meaningfully used in road freight transport on public infrastructure. This is connected to further questions such as how much sense it makes to bring in such technology, what are the necessary technological, organizational and legal conditions, but also how logistics, supply chains and freight transport may change as a result.

H. Flämig (&)

Technische Universität Hamburg-Harburg—TUHH, Institute for Transport Planning and Logistics, 21071 Hamburg, Germany e-mail: flaemig@tu-harburg.de

This chapter firstly approaches these questions from the historical perspective of in-house logistics, as this provides a clear understanding of companies' motivations for implementing driverless transport systems and the individual experience of company decision-makers'. Using case studies from the field of logistics and freight transport, this chapter will examine current fields of application and, wherever possible, the navigation and safety concept required for autonomous driving as well as control. Moreover, it will outline specific use cases for freight transport based on the generic descriptions in Chap. 2. Other autonomous systems developing in parallel, such as drones, show that completely new business models are developing in the field of logistics. Expected changes in logistic processes and in human labor in the systems will be discussed using a generic supply chain approach. The chapter will conclude by making recommendations and suggestions for further research.

#### 18.2 Development History of Driverless and Autonomous Transport Systems

Automated guided transport (AGT) systems and automated guided vehicles (AGVs) were firstly used for commercial purposes in the early 1950s in the US and approximately ten years later in Germany [1]. The primary motivation was optimizing the flow of materials and reducing personnel, as a logical consequence of the ideas for raising productivity through improving work processes which had been spreading since the early 19th century (Frederick W. Taylor), from the timing of production processes (shaped in particular by Gilbreth's "system of predetermined times") to continuous assembly line production (Henry Ford). This development was driven by the mechanization of production due to an increasing focus on technology by management, to the point of envisioning complete automation (see the historical development in [1]). Beginning with the automation of transfers between production processes, the first AGT systems were used in production and warehouses. Compared to automated conveyance systems, such as conveyor belts, the investments are generally significantly lower and the flexibility with regard to changes in the material flow is considerably higher [2]. Transport is regarded as an unproductive activity, but must nevertheless demonstrate high reliability in production and warehouse systems.

#### 18.2.1 Driverless Indoor Transport Systems

Typical indoor applications of AGT systems connect production and assembly processes, incoming and outgoing goods areas as well as picking areas and warehouses. AGT systems and work robots, such as those for picking, palletizing, etc., are frequently combined in a single apparatus. In in-house logistics, the encounter between humans and AGT/AGV systems was therefore always envisioned since AGT/AGV systems generally perform other functions as well, for example supporting the picking process. Early personal safety concepts worked with tactile, mechanical bars or bumpers [2]. Today, laser scanners are more widely used which, depending on the driving speed, can cover up to 7m[2] and are frequently combined with other sensor technologies. The stabilization level plays a relatively minor role in in-house transport as the company itself maintains the floor surface in a drivable state.

In early systems, the guidance level in the indoor component of in-house transports was generally implemented with electrical conductors embedded in the floors. Today the following different types for position recognition and positioning can be distinguished [3]: On the one hand, this includes the physical guide, implemented either as an active inductive guide path, as a magnetic tape or optical guide path. On the other hand, technologies for free navigation which utilize floor markings (metal, magnets, transponders) or laser technology in which position-determination functions something like in maritime transport (cross bearing) can be found. Newer technologies combine laser scanners and camera systems with digital-environment maps and enable navigation by characteristics of the environment.

Data transmission between the stationary and mobile units of an AGT system was previously conducted using inductive or infrared data transmission. Today, narrowband and increasingly broadband transmission (WLAN) are predominant. Radio direction finding enables localization via indoor GPS (Global Positioning System) with an accuracy up to 0.5 m, with outdoor GPS precise to within 10 m, dGPS (Differential GPS) accurate up to 1 m and dGPS with phase evaluation precise to within 0.1 m.

Vehicles are assigned to driving tasks and are coordinated [2]. The control concept consists of a control unit through which execution of the transport order, transport order processing, vehicle allocation and transport execution are managed centrally. The traffic control system is part of the vehicle job execution. Clearance for individual sections of the route is done similarly to the rail traffic system in block sections that can only be occupied by one vehicle at a time.

One such system was implemented in the distribution center of a logistics service provider in 2011 [3]. In the picking process, AGT systems are used in which the pickers are carried by the vehicle as well. The safety of the picker is ensured through various measures, as with the safety regulations for rail transport in which passengers are required to assume a particular position with their hands and feet. It is therefore not possible to carry out other activities while the vehicle is in motion. The operator safety concept relies on laser scanners. Navigation relies on a magnetic point sequence guide system, and the control system utilizes wireless-technology for data transmission.

The AGT/AGV control system is also handled centrally in the new systems. Expanding the systems is therefore always associated with major expenses, so research into autonomous, decentralized control solutions is afoot here as well.

One current example is the autonomous reach forklift truck developed in the "marion (mobile, autonomous, cooperative robots in complex value creation chains)" project, which in turn was developed as part of the "Autonomik" (autonomous and simulation-based systems for SMEs) technology program. The tasks of vehicles are assigned by a superordinate system. The forklift executes the task autonomously and calculates and determines the optimal route independently. It is equipped with a 3D-laser, laser scanner and cameras for 3D environment detection. Through sensors, the forklift can precisely assess the environment, the object dimensions and its spatial position.

One example of a decentralized control system has been developed in the project "decentralized, agent-based self-control of automated guided transport systems" [4]. In this system, various agents are modeled for each vehicle. Route planning and task assignment take place cooperatively. Simulations showed a reduction in the overall route distances of all AGVs, a roughly 8 % drop in the empty trip share, a 22 % decrease of lead times and a minor increase of the utilization rate of the AGVs [5]. At the Fraunhofer-Institute for Material Flow and Logistics (IML), a cellular transport system based on swarm intelligence was developed in the "Swarm Intelligence for Logistics" project. In this system, the swarm (the means of transport) receives the transport jobs, the nearest vehicle takes on the job and dynamically determines the shortest path.

#### 18.2.2 Outdoor Automated Guided Vehicles on Private Property

Outdoor applications for autonomous vehicles on private property are AGT systems for heavy transports or in-plant shuttle traffic are common, as the following examples demonstrate.

At a container terminal, automated guided vehicles move containers between the container cranes and the stacking area [6]. The objective is to shorten routes, reduce empty trips and achieve optimal utilization of all resources. Transponders installed in the ground are used for positioning. Route planning is done independently, as are battery changes. Coordinating control is conducted via radio data transmission.

In Germany, a major cooperation behind driverless trucks is a company that was originally active in the radio technology sector. In 2012, for example, this company implemented a driverless truck-shuttle between the production and logistics buildings on the factory grounds of a dairy company [7]. Loading and unloading of the pallets laden with fresh products and packaging materials are done automatically. The lane-guidance system utilizes transponders in the pathway. A sensor is installed beneath the towing vehicle that uses the markings on the floor for orientation and route determination. Aided by steering rear axles, the vehicles can drive small envelopes and achieve positioning precision to within 2 cm. Laser scanners scan the environment and together with contact switch strips and emergency stop buttons ensure the safety of people, goods and the vehicle itself.

The "Sichere autonome Logistik- und Transportfahrzeuge (SaLsA)" ["Safe autonomous logistics and transport vehicles"] project led to further developments that made the encounter between AGT systems, trucks and people in the outdoor environment safer [8]. In the outdoor environment, the safety concept consists of radar sensors, since laser scanners are not permitted there. The cooperative scanning of the environment through mobile and stationary sensors enables safe operation even at higher speeds (economic viability).

#### 18.2.3 Autonomous Vehicles for Road Freight Transport Outside of Plant Grounds

The development of autonomous vehicles for freight transport and logistics outside of plant grounds is primarily conducted on a problem-oriented basis. So called driving robots were developed for use in dangerous situations, e.g. for disarming munitions, or for use in difficult-to-access areas such as deep-sea exploration, work on mountain sides or in dense forests and remote areas such as for work in the mining sector.

Very large automated trucks with a maximum load capacity of 290 metric tons have been used at one of the world's largest iron-ore mines in Australia since the 1990s [9]. The reason for their development was primarily difficulties in staffing, the dangerous shift work in the outback and the demanding logistical requirements in terms of personnel planning and staff transfer.

Navigation is done via radar and lasers as well as through the use of waypoints for orientation. Monitoring and intervention options are possible via an operation center using wireless transmission. Control is carried out via GPS and dead reckoning, such as in ships or aircraft, through continuous position determination by means of measuring the course, speed and time.

#### 18.2.4 Development of Autonomous Driving and Autonomous Vehicles in Other Means of Transport

Other means of transport, in which technical systems for stabilization, navigation (e.g. digital maps) and environment cognition are used have also seen increasing degrees of automation.

Aircrafts have been equipped with stabilization systems since the early 20th century, autopilot functions are a long-established feature and the first drones in Germany are already in use in military, police and firefighting applications. Unmanned aerial systems or unmanned aerial vehicles (UAVs) are also used in civil applications in other countries, replacing for example ranchers and inspectors in remote areas. Drones monitor and seed fields and perform pest control functions. Small drones are already in use in Germany as well, for example for inspecting damage caused by storms or fires, in film productions and industrial inspections. Deutsche Bahn (the by far largest German railway company) is currently testing drones for monitoring vehicles and infrastructure. There are also pilot studies under way in the area of transporting commercial goods, in particular packages. With a carrying capacity of up to 2.5 kg and a range of approximately 15 km, current drones could for example be used to deliver food or medications. A drone that can be used to transport a defibrillator has also been tested. The use of drones for commercial purposes over 5 kg has been generally permitted in many federal states, albeit not in controlled airspace [10].

Initial studies about unmanned maritime transport are currently under way (see e.g. the European research project MUNIN). Unmanned submarines have been used for some time. Concepts for drone ships are developed by various actors. One concept resembles platooning (see Sect. 18.3.4) in road traffic [11]. Here, in contrast to air traffic, it is possible to have crews boarding vessels at any time for example in heavily traveled areas such as the approaches to ports. As a rule, these systems will not act entirely autonomously, even not in the future. Although evasive maneuvers can be carried out independently, it can be presumed that centralized monitoring and remote controlling will remain standard practice, though the two instances need not be one and the same.

Remote control of driverless railway systems has been in place for years. Autonomous driving would include free navigation and would only be useful for very small units. To date, attempts to introduce smaller freight transport units on railways such as the CargoSprinter have been unsuccessful. In part, this is due to the fact that there is no fast technology for train composition, thus separate power transmission is required for each carriage. This deficiency was addressed with the RailCab concept [12]. Here, autonomous, linear motor-driven vehicles use the wheel and track system. The train composition is carried out through an electronic drawbar. This is expensive and there are few suitable applications in which a truck could not perform the transport. On the main carriage routes, efficiency gains through economies of scale speak against non-prescheduled routing and variable convoy formation. But there could be economically viable applications on non-electrified branch lines. To date, however, there are no known studies comparing the environmental and economic implications under market conditions.

#### 18.2.5 Interim Conclusion

AGT systems consist of a guidance control system, in particular for order assignment and route planning, a communication system and the vehicles [4]. Automated guided transport systems and vehicles (AGTS/AGV) for in-house transport with low levels of automation have been in existence for a long time. The degree of automation has risen with advancements in technology, albeit in different ways than in public road transportation. For example, the applicable Machinery Directive for the design of such systems clearly defines the safety concepts. In the past it was sufficient for the AGTS/AGV in in-house logistics to be able to move in a forward direction, generally in sceneries in which people were accustomed to driverless vehicles. In some cases people and vehicles are physically separated. In sum, the safety concepts are restricted to a minimum as the AGT/AGV systems operate at low speeds and in known, clearly defined circumstances.

Technological advancements focused on the correct execution of transport tasks and associated other tasks such as loading and unloading the cargo. Nevertheless, it may be presumed that the requirements with regard to the flexibility of AGT/AGV systems will rise as production moves away from linear assembly lines and the production and picking systems themselves become more flexible. At present, autonomous systems based on the agent technology seem best suited for the processing of increased data volumes and rising complexity, due to the decentralization of data provision and decision-making processes.

Outdoor solutions for freight transport are based on conventional road vehicles and to date have only been in regular use on private company grounds. There are only few use cases to speak of to date. But similar developments to the indoor area are generally conceivable.

The question with AGT/AGV systems then is how the autonomy of the units will develop in the future. Automatic control and driverless movement have by definition always been elements of AGT/AGV systems. The degree of autonomy is defined as the number of degrees of freedom. This depends, for example, on the free selection of the route and speed to move independently to a destination even in changing environmental situations.

The use of mobile machines represents a point of contact between work robots and vehicles. Just as with in-house transport systems, the transport task is frequently combined with other "productive" tasks. These are mostly remotely operated systems. Thus, autonomous decision-making in terms of route determination is generally not the case. This also seems unlikely to generate added value in the majority of possible applications.

In the early stages, the conceptual outline for automation solutions depended very strongly on the use context. These historical system elements are generally also found in the newer conceptual approaches, in particular with regard to the vehicle and operator safety concepts. It was only with the advent of decentralized concepts utilizing the new information and communication technologies that these different system solutions have been able to converge. In particular in situations in which high flexibility and speed are demanded, the technological solutions are becoming increasingly similar. They do differ in terms of the degree of autonomy, though.

#### 18.3 Use Cases in the Field of Autonomous Freight Transport

Building on the experiences described here, the following will sketch potential applications for autonomous vehicles in the field of freight transport using the generic use cases described in Chap. 2. The focus is on the transport of a specific good in road freight traffic. Potential applications in further segments of commercial transportation such as passenger transportation and goods transport in the context of production (self-driving work machines) are not examined here.

Based on a conceptual description of the respective use case and in light of the specific features, an initial estimation of the benefits, opportunities and risks of introducing such a technology will be discussed. The examination will begin, however, with a consideration of the degrees of automation in driving for freight transport, in order to better distinguish the implications of the various use cases.

#### 18.3.1 Excursus: Degrees of Automation in Autonomous Freight Transport

To assess the necessity and benefits of a certain degree of automation in freight transport, first we will return to the definition of the driving task according to [13], whereby it is described as follows: The safe execution of the driving task requires information and knowledge regarding the traffic situation on the guidance level, the driving surface on the stabilization level, as well as the road network on the navigation level. Safe conduct of the vehicle requires steering, acceleration and braking as well as decisions regarding speed and course for longitudinal and lateral control of the vehicle. The decisions required for this are made on the basis of information regarding environmental conditions and the associated knowledge of the action to be taken.

The German Federal Highway Research Institute categorizes automated driving into four development levels [14]: assisted driving (1), partially automated driving (2), highly automated driving (3) and fully automated driving (4). In the first three levels, the system performs partial aspects of the driving task for a specific time and/or in specific situations. But the driver is available at least as a supervisory organ. For the last level of fully automated driving (4), [14] presumes that the vehicle is navigating freely and no driver is required as a fallback level.

In the area of freight transport, automated guided transport systems exist even on low automation levels. With an intermediate level between (3) and (4), another relevant variant in transport practice can be observed: The vehicle is highly automated and driverless, but free navigation does not occur. In many cases, the vehicle is controlled remotely by an operator via a control center.

#### 18.3.2 Use Cases for Autonomous Freight Transport

Assisted and partially automated systems are already common in series-production vehicles. They take over longitudinal and/or lateral control of the vehicle for a certain period of time and/or in specific situations. In the assisted systems, the driver is warned; in partially automated systems, the system assumes control. The impetus—for example braking—must still be provided by the driver. The most well-known driver assistance systems (DAS) are anti-lock brake systems (ABS) and electronic stability programs (ESP). Due to severe road accident, lane-change assistants, lane-departure warning systems and adaptive cruise control functions became mandatory for new vehicles ahead of schedule in 2013. Other systems are in development or are already ready for production, such as anti-rollover systems, cornering systems or parking systems. They are primarily focused on assisting the driver on the guidance and stabilization levels.

Highly and fully automated vehicles can also navigate freely; they are situation- and infrastructure-independent. Fully automated systems can function without a driver. Not only activities on the navigation level are assumed by the driving robot, but also the activities that are necessary to return the system to a minimal-risk state when components fail.

From the perspective of freight traffic and logistics, technological solutions for the stabilization and guidance levels are therefore not the primary focus. Of greater interest are the potential use cases with and without drivers and free navigation. A closer examination is conducted on the following distinctions in the use cases:


In the following, the use cases will be introduced and initial arguments for and against the respective degree of autonomy in logistics and freight transport are presented. In each case it will be assessed to what extent the use cases in the freight traffic system coincide with the "Use Cases of Autonomous Driving" (see Chap. 2) for private transportation, what differences exist and what the implications of such differences are for implementation.

#### 18.3.3 Interstate Pilot with Driver and Free Navigation

Interstate pilot describes the use case in which an autopilot function is used, but a driver is available at all times. The driver hands over the stabilization and guidance level (and thus also navigation) to the autopilot, ideally after specifying a destination address. The use of an interstate pilot is intended between entering and exiting the interstate. The driver assumes control when confronted with unclear driving situations (e.g. construction zones).

The posited benefits of the interstate pilot are provided by the reduction of accidents and an improved traffic flow. Particularly in traffic jams or stop-and-go traffic situations, but also on long, monotonous journeys, as well as due to the ever-increasing time-pressure of modern life, drivers are often close to their performance limits. In addition to unburden the driver from stressful driving situations, the interstate pilot also creates free time that can be used for other purposes. Here there are deliberations as to whether activities such as route planning and fleet management might not also be decentralized.

A first case of application has been already reported from as early as 1987, when the University of the Armed Forces in Munich, Germany, was experimenting with a lorry driving on a motorway [15]. In 2013, the vehicle-manufacturer Scania presented a truck that could "independently accelerate, brake and steer" up to a speed of 50 km/h [16]. In 2014, Daimler had a truck driving up to 85 km/h amid other vehicles on a closed section of interstate [17].

The envisioned interstate pilot is essentially enabling fully automated driving. Due to safety considerations, however, the concept still depends on an available driver, which in effect reduces the scenario to being only highly automated. The effective top speed and the higher maximum permissible mass together require different safety concepts than in private transportation.

Changes are expected primarily in terms of the job description of the driver. To date, drivers have been obliged to learn much about vehicle technology and securing loads. Would the driver continue to perform the technical inspection of the vehicle? What economic and environmental benefits would be associated with the concept?

#### 18.3.4 Vehicle on Demand Without a Driver and with Free Navigation

Vehicle on demand most closely resembles the use case, which, in the field of freight transport, is known as an autonomous, decentralized AGT/AGV system. A driver's seat is not envisioned. However, in the use case outlined in Chap. 2 the vehicle can operate at speeds of up to 120 km/h and in unknown scenarios.

There is some reason to believe that the "vehicle on demand" use case comes very close to the conception of autonomous vehicles in freight transport desired by companies in the industry: The local-language-speaking driver who is willing to undertake long interstate journeys with long periods of absence and irregular working hours for low pay is ever-more-difficult to find. Overtired truck drivers are the most common cause of severe accidents. Docking and maneuvering in tight delivery situations is always a tricky task for the driver.

The use of automation technology could therefore be of great benefit. However, the approval of all scenarios for heavy trucks will take time, in particular due to safety concerns and required changes in the supply chain (see Sect. 18.4).

More likely is the realization of the interstate pilot without a driver and with free navigation between rendezvous points in the medium term, for example between rest areas on highways or between well-connected commercial zones. The likelihood of implementation of this use case could be increased through the following enhancement concepts:

Safety concerns due to the lack of a driver on the fallback level could be mitigated by having separate highway entrances and exits for autonomous vehicles, as this would reduce encounters with other vehicles to a minimum. A dedicated lane for autonomous, coupled vehicles could probably avoid these concerns entirely. At the same time, such a dedicated lane could be the starting point for an extended concept with alternative drive technology, if the lane were, for example, outfitted with an overhead contact line for supplying electricity.

The coupling of vehicles (platooning) would combine the initial concept of having a driver available in the lead vehicle as a backup with the extended concept in which vehicles drive autonomously without drivers and utilize the benefits of each concept. The platooning vehicles would be connected via a software system. Implementing the so-called electronic drawbar at high speeds would enable not only improved utilization of the road infrastructure, but above all reduced fuel consumption and emissions due to reduced wind resistance.

Numerous tests have been carried out with the electronic drawbar since the mid-1990s [e.g. the European projects "CHAUFFEUR I and II", "Safe Road Trains for the Environment (SARTRE)", "Cooperative mobility solution for supervised platooning (COM-PANION)", the Californian "PATH Program", the German "KONVOI-Projekt: Entwicklung und Untersuchung des Einsatzes von elektrisch gekoppelten Lkw-Konvois auf Autobahnen", and the Japanese "ITS Project" by the New Energy and Industrial Technology Development Organization (NEDO)]. In these projects, multiple trucks or a convoy of lead trucks and following passenger cars safely drove at up to 90 km/h with a minimum gap of 4 m. The systems were based on surveillance by radar sensors, stereo cameras, three-dimensional maps and usually also data exchange with other vehicles. Previous trials were always conducted with a driver in the lead vehicle and with or without drivers for extended availability in the following vehicles. There are already ideas under consideration for a driverless lead vehicle.

As a rule these projects build on proven existing technology: adaptive cruise control systems integrated in series-production vehicles serve to maintain the gaps between the vehicles. Data transmission between the lead and following vehicle is frequently conducted via wireless-transmission or infrared technology.

The measured fuel savings and CO2-reduction potential differed depending on the selected vehicle-to-vehicle (V2V) communication (in "off-center" mode), the type and construction of the lead vehicle and following vehicles, the gap, the speed as well as the road and environmental conditions (surface, temperature, inclines, altitude). The difference was roughly 5 % for the lead truck and 10–15 % for the following passenger vehicles [18].

#### 18.3.5 Full Automation Using Driver for Extended Availability— Follow-Me Vehicle

In the use case presented in Chap. 2, the vehicle takes fully automated control whenever the situation is approved for that mode. The driver is at any time available and can resume vehicle control if necessary. In practice it is an extension of the interstate pilot in terms of approved situations and the permissible speed and is very similar to autonomous driving.

This use case is only interesting from an economic perspective if the accompanying driver can pursue value-creating activities during the drive. The next delivery could be prepared or processed from an administrative standpoint during the drive itself. Such vehicle concepts would also be conceivable for use in commercial passenger traffic, for example for activities in elderly care, the insurance industry, etc., which involve documentation and administrative work.

The "EmiL" concept study of a partially autonomous delivery vehicle in 2011 can be regarded as a sort of preliminary stage of development before full automation [19]. In this concept, the delivery person does not need to continually get in and out of the vehicle, but can instruct the vehicle via mobile phone to drive next to him at walking speed (follow-me function). For all unknown situations (e.g. merging situations, intersections), there is the additional DriveStick mode in which the vehicle can be driven at up to a speed of 6 km/h. The use of a local wireless-connection precludes signal interruptions that are feared and can indeed occur with GPS connections.

The research project determined a time-saving of about 40 min over a one-day delivery period. The typical injury risk of twisting or rolling an ankle when getting out of the vehicle is also reduced.

#### 18.3.6 Valet Parking—Valet Delivery

Valet parking refers to the use case in which the autopilot independently navigates the vehicle to a previously assigned parking spot. The concept presented in Chap. 2 assumes that this could be possible in the public sphere at speeds of up to 30 km/h. One example could be autonomous driving from a driver's place of residence to a defined parking spot. This use case is scarcely conceivable in the context of freight transport, however, as there are truck-parking locations rarely connected via the secondary road network.

Much more likely is a scenario in which the autopilot would take over in tight inner-city areas and industrial and retail delivery zones not designed for large trucks and park or dock the truck independently. This could prevent expensive car damages to occur. The driver would be relieved of stressful driving tasks, which would be particularly advantageous in light of the driver's remaining responsibility for long, exhausting highway drives. Valet delivery could also help drivers comply with legal rest times if the "last mile" could be conducted without their assistance.

Another potential use case could be delivery to construction sites. In major construction jobs, trucks are increasingly held in so-called waiting zones in the vicinity of the construction site. These processes could be optimized if drivers in large-scale concrete-pouring actions could concentrate on their runs and the wait times were eliminated. The autopilot would take over driving between the waiting point and the construction site.

From a legal standpoint, implementation would depend heavily on the distance between the waiting point and site as well as the concrete scenario. Otherwise implementation would seem to be more of a mental than a technical challenge. In particular from the driver's perspective, who would be confronted with scenarios in which it is essentially alleged that he or she does not handle their working tool with the required skills.

#### 18.4 Changes in the Supply Chain Resulting from a Higher Degree of Automation in Freight Transport

A systematic examination of the changes in the supply chain resulting from a higher degree of automation in freight transport can be seen in the generic supply chain depicted in Fig. 18.1. Every supply chain consists of a succession of the activities "raw material extraction", "processing/production", "trade", and the intermediate logistical processes "goods issue (handling)", "transport", and "goods receipt (handling)". Moreover, under the current conditions of production and retail logistics, it is equally interesting to consider the effects of a lacking driver since a lot of added-value-services are performed by the logistics providers in those scenarios.

Aside from driving itself, "transport" requires inspection of the vehicle, route planning as well as documentation and other administrative tasks (shipping documents) taken over by the driver. These activities are even more comprehensive in the case of cross-border traffic (customs). With highly automated, driverless or fully automated driving, the common problem of driving and rest-period violations would become obsolete and routes could be planned differently. If transports were conducted in a highly-automated manner, the driver would be expected to perform other tasks in this period, for example performing route planning, fleet management or simply resting [21].

In other words, it could lead to both a decentralization and parallelization of functions. The use of the transport time for other activities is not new, however. For example, postal shipments were previously handled in trains (postal trains), and the same phenomenon can be observed today, in mobile depots (e.g. repurposed double-decker buses, "floating warehouse systems").

The driver must always supervise the driving task and sometimes takes over personally. At the goods issue point, he or she is responsible for checking the shipping papers and securing the load. At the goods receipt point, he or she is responsible for demanding a receipt confirmation.

Fig. 18.1 Example of driver-relevant activities in a generic supply chain. Source Author, based on [20]

Today, in goods issue and receipt, in many supply chains the driver is responsible for loading and unloading the vehicle. The driver's responsibility frequently ends at the loading ramp, but in some cases only after placement of the goods in the receiving facility, or even after pre-sorting, internal transport and shelving of the material (in some cases in temporary storage locations). As in earlier times, for some parcel and letter delivery operations it is common for the driver to pick the orders himself.

In the field of production, conceivable applications would include own-account transport in which—similarly to the in-house segment—transport jobs are tendered and autonomous trucks could "apply" for and win the transport jobs based on predefined criteria. In this case neither a central control function nor route determination is required. Some gates already have freight locks, making workforce obsolete in place at the transfer of risk.

If the driver no longer "accompanies" the vehicle, his or her activities would have to be performed by others. Companies then would have once again to hire or train own staff for such activities. The logistics companies might also opt for a different business model to account for these changes. This could lead to a general revaluation of work and the creation of local jobs, particularly in urban areas. In other cases, however, a further increase in the degree of automation in goods receipt and issue departments could be envisioned.

Changes in the transport systems themselves can be expected primarily at the contact points between unmanned and manned driving as well as in the task profile of drivers. The changes to processes in rail and maritime traffic as well as in the spectrum of activities performed by humans do not seem overly serious. The driver is removed from the scenario and replaced by an autopilot. The remaining technology in trains and ships has heretofore been excluded from any proposed changes. Also, new job descriptions could emerge, for example if the aspect of security against pirates in sea transport were to be given greater weight than the navigation aspect.

#### 18.5 Initial Microeconomic Assessments of Automated Systems in the Freight Transport Chain

From a microeconomic perspective, a lack of driving personnel, an energy-saving driving style, high reliability and accident evasion are significant reasons to employ autonomous systems in the freight transport chain. In some industries, the material flow from goods receipt to the production lines and eventual goods issue are already highly automated and driverless, which eliminates interruptions and idle times. Loading and unloading from warehouses is also highly automated and driverless in some sectors. In some cases, the control of warehousing and production is coordinated and ranges from automated goods receipt to automated goods issue.

The development of radio frequency identification (RFID) technology and the rediscovery of Leonardo da Vinci's idea of learning from nature (bionics) inspired a debate on independent control and led to an intensive debate on the decentralization and decision-making autonomy of technical systems. Aided by technological developments in cost-effective sensors and internet-aided software systems, the degree of automation has risen continuously. The latest systems in production and warehouses have come to rely on independent control ("internet of things") of the vehicles and conveyor systems, which can react autonomously to changing requirements, states and environmental conditions.

Based on the extremely advanced degree of automation of in-house AGT/AGV systems in some industries, further shifts of the human role towards conceptual and supervisory activities can be expected. The use of driverless vehicles in the entire logistical system can be expected to lead to a reorganization of processes in many supply chains (see Sect. 18.4). However, automation will continue to grow only in particular industries as the relation between costs and benefits is not equally favorable in all sectors.

Within the transport system in the public space, the lack of a driver and/or the driver's changing role will lead to additional interfaces that need to be designed according to certain requirements. The driver getting in and out of the vehicle requires additional stops. In the in-house field, there is already substantial experience to draw upon, for example, with regard to picking. In the traffic systems, such experience is limited. In maritime shipping, for example, it is quite common that a port skipper is taking over active control of the ship when entering the port area. In the road freight traffic system, the predominant transshipment systems generally involve changing the trailer rather than the driver. These systems have many advantages such as quick transfer times for materials and goods, and results in increasing productive times of the vehicles. They also improve the working conditions for the drivers, who can return to their local branches daily. In practice, however, this only works in large networks or in partnership-type relationships with trustworthy and reliable partners. This applies not only to punctuality, but also with respect to the securing of the load. To date, the most widespread use of these systems has been with the large integrators and courier, express and parcel (CEP) service providers specialized on the transshipment of standardized packages.

For the implementation of driverless transport chains in road freight transport, then there are also questions of cost and liability in transport law that need to be clarified, going beyond questions of technical compatibility of the autonomous vehicles with the infrastructure and with other vehicles or platooning trucks.

If damages to the goods or vehicle occur due to system failure, product liability comes into play (for details, see Chap. 25). It follows that autopilots, consisting of hardware components (sensors, processors and actuators) and software components must be constructed in such ways that potential damages can be traced to the individual components and thus their producers.

#### 18.6 Initial Macroeconomic Assessments of Automated Systems in the Freight Transport Chain

Judging from a macroeconomic perspective as well, automated systems could provide an approach to resolve structural deficits in the current transport system. In times of tight public budgets, a significant expansion of the traffic infrastructure, and in particular rail and inland waterways, is not likely to occur in the near future.

Automated driving, with its minimal space requirements and rather equal speed levels, could at least double the existing average road infrastructure capacity. Moreover, it could contribute to achieving environmental policy goals, as automated driving reduces fuel consumption. Already today, driver assistance systems make a significant contribution to reducing traffic accidents. Such accidents could also be avoided by the use of highly and fully automated vehicles, as they can recognize the ends of traffic jams, avoid risky overtaking maneuvers and entirely eliminate wrong-way driving. However, the questions concerning legal liability in the event of an accident have not yet been exhaustively resolved.

In the case of platooning, a professional driver could be used in the lead vehicle, as is envisioned in most of the projects. This approach has the advantage of enabling even unpracticed long-haul drivers (beginners, the elderly) to join a convoy. This would also require that freight and passenger vehicles have the ability to communicate with each other.

However, it is not only technological determinism that offers strong arguments against automated road vehicles: Efficiency increases in road traffic also give rise to conflicts with mass transport systems. Automated platooning stands in direct competition with the railways, as did long trucks before them. Although at present there is a lack of professional truck drivers in Germany, the overall number of professional truck drivers would decrease, and in other countries with high unemployment, much-needed jobs would be lost.

Moreover, public acceptance of fully automated systems is limited—not least due to continuous reports of failures of mechanical or electronic components in vehicles, or the fear of unstable data connections. Autonomous vehicles therefore would also have to be equipped with reliable software (artificial intelligence) that can respond to all eventualities —in particular when humans and animals are present on the roads.

Also judging from a legal perspective, autopilots outside of factory grounds are a novelty. Previous AGT/AGV systems were handled according to the Machinery Directive, with stringent vehicle and operator safety concepts. An expansion of the sphere of action (private/public) and the operating speeds (walking speed to highway speeds) of the systems could necessitate new laws or adjustments to the existing legal framework.

The use of autonomous vehicles in road traffic would require abolishment of the legal restrictions set forth in the Vienna Convention on Road Traffic which stipulates that a driver must maintain control over the vehicle at all times. There have been recent developments in this regard in the United States, where the law has been adapted to permit deviation from the control requirement insofar as the system "can be overridden or switched off by the driver." If this legal stance were to be accepted in Europe as well, it would mean that there has to be a superordinate actor that can always intervene in controlling the vehicle. In the areas of rail, maritime and air traffic, the systems are already designed in this manner, and for rail and air traffic there are accepted superordinate actors. For road freight traffic, such an actor must still be created. Public acceptance is also yet to be ensured.

#### 18.7 Conclusion and Outlook

Since the 1960s, (driverless) automated guided transport (AGT) systems have been in use in in-house logistics in Germany. However, these systems have not received sufficient attention either in the media or in transport research. In in-house logistics, for example, transponders are used as waypoints that can also store information. If vehicles in the public space would always have to recognize all environmental features and special characteristics of every route, appropriate cost-intensive hardware and software systems would be required. This could be avoided if waypoints would provide certain information that could be read-out temporarily. In this context, extrapolated to the transport system, the question arises as to how the road infrastructure would have to be changed.

Fully automated driving creates the opportunity to steer vehicles between the departure point and the destination without human intervention. The autopilot performs not only the stabilization and guidance tasks, but also navigation, and thus is also responsible for ensuring accident-free driving.

The assessment of the current situation with respect to the development of autonomous road traffic systems made clear that passenger and freight traffic must be viewed in a much more integrated fashion. It would also be interesting to have a closer look at autonomous system development with regard to other means of transport. Autopilots in aircrafts have long been the norm. As early as the beginning of the twentieth century, stabilization systems were used in aviation. Drones are already being used. The first studies on the European level of unmanned maritime transport are under way. Remote control of trains has been in use for years as well. What is new is the quality of autonomous decision-making in the case of changing environmental situations and changing driving and transport orders. The expanding fields of application, for instance through drones in the aviation sector, highlight the importance of completely rethinking the distribution of transport jobs across the different means of transportation. More research is needed here.

Many exciting insights and new developments could be expected if the broad field of commercial passenger traffic would be studied in greater detail. Much alike in freight transport, it is concerned with mobility in exercising a profession. Since moving from one location to another is only a means to perform a service at the destination, in most cases mobility itself is regarded much more pragmatically, compared to individual mobility.

The combination of partial scenarios of individual, autonomous logistics processes to form a comprehensive autonomous supply chain from automated raw material extraction and all phases of production and logistics to product delivery to the end customer requires an integrated approach. Technologically speaking, tremendous progress has been realized in recent years. Research should therefore focus primarily on the (required) degree of automation for individual logistics processes as well as on elucidating the micro-and macroeconomic benefits and costs of those developments.

Due to the open legal questions and the lack of acceptance of both the general public and to some extent of corporate decision-makers for the use of autonomous systems in road freight transport (as well as to some extent in other transport systems), gradual, step-by-step introduction seems to be the only realistic approach. It will therefore depend on finding the right cascade approach and implementation strategy. To date, specific deliberations on the respective implementation aspects of the outlined use cases are missing.

On first glance, it appears reasonable to combine some of the solution approaches currently being discussed with regard to increasing the capacity of the infrastructure, economical use of resources and environmental protection. Starting to introduce autonomous driving in closed transport systems (e.g. transport in system cooperation) and manageable scenarios (e.g. interstate, airport grounds, ports) will help to overcome reluctance concerning the technologies as well as lacking standardization. The step-by-step implementation of platooning, starting with manned lead and following vehicles, could build the requisite acceptance among the general public. It must be examined whether the simultaneous introduction of overhead electricity-powered trucks and thus the creation of a dedicated lane would be sensible in view of capacity and safety requirements.

However, even platooning raises several follow-up questions, in particular regarding decision-making and the distribution of benefits: If the fuel savings depend on a vehicle's position in the convoy, who decides which position each vehicle has in the chain? If the convoy drove without drivers in the following vehicles, who would pay for the driver in the lead vehicle? Would the lead driver require more/special training than the other drivers? Prior to introduction, it would also be necessary to clarify how other platooning vehicles can be identified. A common standard would have to be developed to ensure that the other vehicles are also trustworthy. Here the need for further study and the recommendations for action are closely interrelated.

Changes in the supply chain and freight transport show a highly ambivalent picture that must be examined in greater detail. For the relating understanding, assessment and categorization, it must be clarified which technological changes and challenges will arise for the driving task itself. It is also essential to identify in greater detail the advantages and disadvantages of using automated vehicles compared to conventional vehicles as well as their integratability in the existing work environment, by analyzing different job profiles in the commercial environment. To date, the question of what can be transported autonomously and what degree of autonomy would be accepted from industry with regard to necessity, cost and flexibility remains unanswered.

At the same time, there are also additional opportunities for innovative business models, which, however, have yet to be developed and evaluated. Also alternative applications are conceivable whose challenges until today seemed unsurmountable. One example of this is the provision of supply and disposal services to inner-city locations ("city logistics"), which is characterized by conflicts and high costs. The use of autonomous road transport vehicles, together with other components (e.g. goods lock system) could for instance resolve temporal conflicts between freight and passenger traffic.

At the same time, the opportunities and risks associated with the rising automation of transport should be analyzed in greater detail from a macroeconomic, cross-border perspective. This includes not only legal matters and the need for standardization, but also the potential loss of low-level jobs. This must be analyzed in terms of alternative labour-market scenarios. Also, to date insufficient attention has been paid to the conflicts that could potentially arise between autonomous road freight transport (in convoys) and means of mass transportation. Finally, the discussion must be expanded thematically, in order to achieve the best comprehensive assessment of environmental and resource considerations.

Open Access This chapter is distributed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, duplication, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, a link is provided to the Creative Commons license and any changes made are indicated.

The images or other third party material in this chapter are included in the work's Creative Commons license, unless indicated otherwise in the credit line; if such material is not included in the work's Creative Commons license and the respective action is not permitted by statutory regulation, users will need to obtain permission from the license holder to duplicate, adapt or reproduce the material.

#### References


# 19 Autonomous Mobility-on-Demand Systems for Future Urban Mobility

Marco Pavone

#### Abstract

This chapter discusses the operational and economic aspects of autonomous mobility-on-demand (AMoD) systems, a transformative and rapidly developing mode of transportation wherein robotic, self-driving vehicles transport customers in a given environment. Specifically, AMoD systems are addressed along three dimensions: (1) modeling, that is analytical models capturing salient dynamic and stochastic features of customer demand, (2) control, that is coordination algorithms for the vehicles aimed at throughput maximization, and (3) economic, that is fleet sizing and financial analyses for case studies of New York City and Singapore. Collectively, the models and methods presented in this chapter enables a rigorous assessment of the value of AMoD systems. In particular, the case study of New York City shows that the current taxi demand in Manhattan can be met with about 8000 robotic vehicles (roughly 70 % of the size of the current taxi fleet), while the case study of Singapore suggests that an AMoD system can meet the personal mobility need of the entire population of Singapore with a number of robotic vehicles roughly equal to 1/3 of the current number of passenger vehicles. Directions for future research on AMoD systems are presented and discussed.

M. Pavone (&)

Department of Aeronautics and Astronautics, Stanford University, Stanford, CA 94305-4035, USA e-mail: pavone@stanford.edu

© The Author(s) 2016 M. Maurer et al. (eds.), Autonomous Driving, DOI 10.1007/978-3-662-48847-8\_19

#### 19.1 Introduction

#### 19.1.1 Personal Urban Mobility in the Twenty-First Century

In the past century, private automobiles have dramatically changed the paradigm of personal urban mobility by enabling fast and anytime point-to-point travel within cities. However, this paradigm is currently challenged due to a combination of factors such as dependency on oil, tailpipe production of greenhouse gases, reduced throughput caused by congestion, and ever-increasing demands on urban land for parking spaces [1]. In the US, urban vehicles consume more than half of the oil consumed by all sectors [2], and produce 20 % of the total carbon dioxide emissions [3, 4]. Congestion has soared dramatically in the recent past, due to the fact that construction of new roads has not kept up with increasing transportation demand [5]. In 2011, congestion in metropolitan areas increased urban Americans' travel times by 5.5 billion hours (causing a 1 % loss of US GDP [6]), and this figure is projected to increase by 50 % by 2020 [6]. Parking compounds the congestion problem, by causing additional congestion and by competing for urban land for other uses. The problem is even worse at a global scale, due the combined impact of rapid increases in urban population (to reach 5 billion, more than 60 % of the world population, by 2030 [7]), worldwide urban population density, and car ownership in developing countries [1]. As a result, private automobiles are widely recognized as an unsustainable solution for the future of personal urban mobility [1].

#### 19.1.2 The Rise of Mobility-on-Demand (MoD)

The challenge is to ensure the same benefits of privately-owned cars while removing dependency on non-renewable resources, minimizing pollution, and avoiding the need for additional roads and parking spaces. A lead to a solution for this problem comes from realizing that most of the vehicles used in urban environments are over-engineered and underutilized. For example, a typical automobile can attain speeds well over 100 miles per hour, whereas urban driving speeds are typically slow (in the 15- to 25-miles per hour range [5, 8]). Furthermore, private automobiles are parked more than 90 % of the time [5]. Within this context, one of the most promising strategies for future personal urban mobility is the concept of one-way vehicle sharing using small-sized, electric cars (referred to as MoD), which provides stacks and racks of light electric vehicles at closely spaced intervals throughout a city [1]: when a person wants to go somewhere, she/he simply walks to the nearest rack, swipes a card to pick up a vehicle, drives it to the rack nearest to the selected destination, and drops it off.

MoD systems with electric vehicles directly target the problems of oil dependency (assuming electricity is produced cleanly), pollution, and parking spaces via higher utilization rates. Furthermore, they ensure more flexibility with respect to two-way rental systems, and provide personal, anytime mobility, in contrast to traditional taxi systems or

Fig. 19.1 Left figure A Car2Go vehicle used in a traditional (i.e., non-robotic) MoD system. Right figure Self-driving vehicle that Google will use in a 100-vehicle AMoD pilot project within the next two years. Image credit: Car2Go and Google

alternative one-way ridesharing concepts such as carpooling, vanpooling, and buses. As such, MoD systems have been advocated as a key step toward sustainable personal urban mobility in the twenty first century [1], and the very recent success of Car2Go (a one-way rental company operating over 10,000 two-passenger vehicles in 26 cities worldwide [9]) seems to corroborate this statement (see Fig. 19.1, left).

MoD systems, however, present a number of limitations. For example, due to the spatio-temporal nature of urban mobility, trip origins and destination are unevenly distributed and as a consequence MoD systems inevitably tend to become unbalanced: Vehicles will build up in some parts of a city, and become depleted at others. Additionally, MoD systems do not directly contribute to a reduction of congestion, as the same number of vehicle miles would be traveled (indeed more, considering trips to rebalance the vehicles) with the same origin-destination distribution.

#### 19.1.3 Beyond MoD: Autonomous Mobility-on-Demand (AMoD)

The progress made in the field of autonomous driving in the past decade might offer a solution to these issues. Autonomous driving holds great promise for MoD systems because robotic vehicles can rebalance themselves (eliminating the rebalancing problem at its core), autonomously reach charging stations when needed, and enable system-wide coordination aimed at throughput optimization. Furthermore, they would free passengers from the task of driving, provide a personal mobility option to people unable or unwilling to drive, and potentially increase safety. These benefits have recently prompted a number of companies and traditional car manufacturers to aggressively pursue the "AMoD technology," with activities ranging from the design of vehicles specifically tailored to autonomous mobility-on-demand (AMoD) operations [10, 11], to the expected launch by Google of a 100-vehicle AMoD pilot project within the next two years [12] (see Fig. 19.1, right).

Rapid advances in vehicle automation technologies coupled with the increased economic and societal interest in MoD systems have fueled heated debates about the potential of AMoD systems and their economic and societal value. How many robotic vehicles would be needed to achieve a certain quality of service? What would be the cost for their operation? Would AMoD systems decrease congestion? In general, do AMoD systems represent an economically viable, sustainable, and societally-acceptable solution to the future of personal urban mobility?

#### 19.1.4 Chapter Contributions

To answer the above questions, one needs to first understand how to control AMoD systems, which entails optimally routing in real-time potentially hundreds of thousands of robotic vehicles. Such routing process must take into account the spatiotemporal variability of mobility demand, together with a number of constraints such as congestion and battery recharging. This represents a networked, heterogeneous, stochastic decision problem with uncertain information, hence complexity is at its heart. Within this context, the contribution of this chapter is threefold:


The chapter concludes with a discussion about future directions for research, with a preliminary discussion about the potential of AMoD systems to decrease congestion. The results presented in this chapter build upon a number of previous works by the author and his collaborators, namely [13] for the lumped approach, [14–17] for the spatial queueing-theoretical framework and the distributed approach, and [13, 18] for the case studies.

The rest of this chapter is structured as follows. Section 19.2 presents a spatial queueing model for AMoD systems and gives an overview of two complementary approaches to control AMoD systems, namely, the lumped approach and the distributed approach. Section 19.3 leverages analysis and control synthesis tools from Sect. 19.2 to provide an initial evaluation of AMoD systems for two case studies of New York City and Singapore. Section 19.4 outlines directions for future research, with a particular emphasis on (and some preliminary results for) congestion effects. Finally, Sect. 19.5 concludes the chapter.

#### 19.2 Modeling and Controlling AMoD Systems

#### 19.2.1 Spatial Queueing Model of AMoD Systems

At a high level, an AMoD system can be mathematically modeled as follows. Consider a given environment, where a fleet of self-driving vehicles fulfills transportation requests. Transportation requests arrive according to an exogenous dynamical process with associated origin and destination locations within the environment. The transportation request arrival process and the spatial distribution of the origin-destination pairs are modeled as stochastic processes, leading to a probabilistic analysis. Transportation requests queue up within the environment, which gives rise to a network of spatially-localized queues dynamically served by the self-driving vehicles. Such network is referred to as "spatial queueing system." Performance criteria include the availability of vehicles upon the request's arrival (i.e., the probability that at least one vehicle is available to provide immediate service) or average wait times to receive service. The model is portrayed in Fig. 19.2.

Controlling a spatial queueing system involves a joint task allocation and scheduling problem, whereby vehicle routes should be dynamically designed to allocate vehicles to transportation requests so as to minimize, for example, wait times. In such a dynamic and stochastic setup, one needs to design a closed-loop control policy, as opposed to

1 2 3 4 λ1 λ2 λ3 λ4 <sup>λ</sup><sup>1</sup> = Arrival rate of requests at queue 1 Recharging Fig. 19.2 A spatial queueing model of an AMoD system entails an exogenous dynamical process that generates "transportation requests" (yellow dots) at spatiallylocalized queues. Self-driving vehicles (represented by small car icons) travel among such locations according to a given network topology to transport customers

open-loop preplanned routes. The problem combines aspects of networked control, queueing theory, combinatorial optimization, and geometric probability (i.e., probabilistic analysis in a geometrical setting). This precludes the direct application of "traditional" queueing theory due to the complexity added by the spatial component (these complexities include, for example, congestion effects on network edges, energy constraints, and statistical couplings induced by the vehicles' motion [17, 19, 20]). It also precludes the direct application of combinatorial static optimization, as the dynamic aspect of the problem implies that the problem instance is incrementally revealed over time and static methods can no longer be applied. As a consequence, researchers have devised a number of alternative approaches, as detailed in the next section.

#### 19.2.2 Approaches for Controlling AMoD Systems

This section presents two recent, yet promising approaches for the control of spatial queueing systems as models for AMoD systems, namely the lumped approach and the distributed approach. Both approaches employ a number of relaxations and approximations to overcome the difficulties in directly applying results from queueing (network) theory to spatial queueing models. A remarkable feature of these approaches is that they yield formal performance bounds for the control policies (i.e., factor of sub-optimality) and scaling laws for the quality of service in terms of model data, which can provide useful guidelines for selecting system parameters (e.g., number of vehicles). These approaches take their origin from seminal works on hypercube models for spatial queues [19], on the Dynamic Traveling Repairman problem [20–23], and on the Dynamic Traffic Assignment problem [24, 25].

Alternative approaches could be developed by leveraging worst-case (as opposed to stochastic) techniques for dynamic vehicle routing, e.g., competitive (online) analysis [26–28]. This is an interesting direction for future research.

#### 19.2.2.1 Lumped Approach

Within the lumped approach [13], customers are assumed to arrive at a set of stations located within a given environment,1 similar to the hypercube model [19]. The arrival process at each station is Poisson with a rate λi, where i 2 {1, …, N} and N denotes the number of stations. (Reasonable deviations from the assumption of Poisson arrivals have been found not to substantially alter the predictive accuracy of these models [19].) Upon arrival, a customer at station i selects a destination j according to a probability mass

<sup>1</sup> Alternatively, to model an AMoD system where the vehicles directly pick up the customers, one would decompose a city into N disjoint regions Q1, Q2, …, QN. Such regions would replace the notion of stations. When a customer arrives in region Qi, destined for Qj, a free vehicle in Qi is sent to pick up and drop off the customer before parking at the median of Qj. The two models are then formally identical and follow the same mathematical treatment.

Fig. 19.3 Left figure In the lumped model, an AMoD system is modeled as a Jackson network, where stations are identified with single-server queues and roads are identified with infinite-server queues. (Customers are denoted with yellow dots and servicing vehicles are represented by small car icons.) Some vehicles travel without passengers to rebalance the fleet. Right figure In a distributed model of an AMoD system, a stochastic process with rate λ generates origin-destination pairs, distributed over a continuous domain Q

function {pij} (Fig. 19.3, left). If vehicles are parked at station i, the customer takes a vehicle and is driven to the intended destination, with a travel time modeled as a random variable Tij. However, if the station is empty of vehicles, the customer immediately leaves the system. Under the assumptions of Poisson arrivals and exponentially-distributed travel times, an AMoD system is then translated into a Jackson network model through an abstraction procedure [13, 29], whereby one identifies the stations with single-server queues and the roads with infinite-server queues. (Jackson networks are a class of queueing networks where the equilibrium distribution is particularly simple to compute as the network has a product-form solution [30, 31].) With this identification, an AMoD system becomes a closed Jackson network with respect to the vehicles, which is amenable to analytical treatment [13] (Fig. 19.3, left).

To control the network, for example, to (autonomously) rebalance the vehicles to ensure even vehicle availability, the strategy is to add virtual customer streams [13]. Specifically, one assumes that each station i generates "virtual customers" according to a Poisson process with rate ψi, and routes these virtual customers to station j with probability αij. The problem of controlling an AMoD system becomes one of optimizing over the rates {ψi} and probabilities {αij} which, by exploiting the theory of Jackson networks, can be cast as a linear program (hence, this approach extends well to large transportation networks). This method encourages coordination but does not enforce it, which is the key to maintaining tractability of the model [13]. The rates {ψi} and probabilities {αij} are then used as feedforward reference signals in a receding horizon control scheme to control in real-time an entire AMoD system [13], as done for case studies of New York City and Singapore presented in Sect. 19.3.

#### 19.2.2.2 Distributed Approach

The key idea behind the distributed approach [14–17] is that the number of stations represents a continuum (i.e., N → ∞), similar to the Dynamic Traveling Repairman problem [20–23]. In other words, customers arrive at any point in a given bounded environment [15, 16], or at any point along the segments of a road map [15]. In the simplest scenario, a dynamical process generates spatially localized origin-destination requests in a geographical region Q - R2 : The process that generates origin-destination requests is modeled as a spatiotemporal Poisson process, namely, (i) the time between consecutive generation instants has an exponential distribution with intensity λ, and (ii) origins and destination are random variables with probability density functions, respectively, u<sup>O</sup> and uD; supported over Q, see Fig. 19.3 (right). The objective is to design a routing policy that minimizes the average steady-state time delay between the generation of an origin-destination pair and the time the trip is completed. By removing the constraint that customers' origin-destination requests are localized at a finite set of points in an environment, one transforms the problem of controlling N different queues into one of controlling a single "spatially-averaged" queue. This considerably simplifies analysis and control, and allows one to derive analytical expressions for important design parameters. For example, one can show that a necessary and sufficient condition for stability is that the load factor

$$\rho := \lambda[\mathbb{E}\_{\phi\_{\rm O}\phi\_{\rm D}}[Y - X] + \text{EMD}(\varphi\_{\rm O}\varphi\_{\rm D})] (\nu m) \tag{19.1}$$

is strictly less than one, where m is the number of servicing vehicles, v is the average speed of the vehicles, <sup>E</sup><sup>u</sup>Ou<sup>D</sup> <sup>½</sup><sup>Y</sup> <sup>X</sup> is the expected distance between origin and destination locations, and EMDðuOuD<sup>Þ</sup> is the earth mover's distance between densities <sup>u</sup><sup>O</sup> and u<sup>D</sup> [32], representing the minimum distance, on average, a vehicle must travel to realign itself with an asymmetrical travel demand [16]. Intuitively, if distributions u<sup>O</sup> and u<sup>D</sup> are imagined as describing two piles each consisting of a unit of "dirt" (i.e., earth), then EMDðu<sup>O</sup> <sup>u</sup>D<sup>Þ</sup> can be thought of as the minimum work (dirt <sup>×</sup> distance) required to reshape u<sup>O</sup> into u<sup>D</sup> (see [32] for a formal definition). One can use the above formula to estimate the required fleet size to ensure stability—an example application to a case study of Singapore is presented in Sect. 19.3. With this approach, it is also possible to obtain formal performance bounds (i.e., factors of sub-optimality) for receding horizon control policies, in the asymptotic regimes ρ → 1<sup>−</sup> (heavy-load, system saturated) and ρ → 0<sup>+</sup> (light-load, system empty of customers) [17, 33].

#### 19.2.3 Comparison

The lumped approach and the distributed approach are complementary in a number of ways. Both models provide formal guarantees for stability and performance. The former is more realistic (a road topology can be readily mapped into this model) and provides a natural pathway to synthesize control policies. The latter provides significant mathematical simplifications (as one only needs to study a spatially-averaged queue) and enables the determination of analytic scaling laws that can be used to select system parameters (e.g., fleet sizing). In the next section we exploit the interplay between these two approaches to characterize AMoD systems for case studies of New York City and Singapore.

Both approaches appear to be promising tools to systematically tackle the problem of system-wide control of AMoD systems. Several research questions, however, still need to be addressed to fulfill this objective, particularly with respect to inclusion of congestion effects (in Sect. 19.2.2.1, roads are modeled as infinite server queues, so the travel time for each vehicle is independent of all other vehicles), predictive accuracy, and control synthesis for complex scenarios, as detailed in Sect. 19.4.

#### 19.3 Evaluating AMoD Systems

Leveraging models and methods from Sect. 19.2, this section studies hypothetical deployments of AMoD systems in two major cities, namely New York City and Singapore. Collectively, the results presented in this section provide a preliminary, yet rigorous evaluation of the benefits of AMoD systems based on real-world data. We mention that both case studies do not consider congestion effects—a preliminary discussion about these effects is presented in Sect. 19.4.

#### 19.3.1 Case Study I: AMoD in New York City

This case study applies the lumped approach to characterize how many self-driving vehicles in an AMoD system would be required to replace the current fleet of taxis in Manhattan while providing quality service at current customer demand levels [13]. In 2012, over 13,300 taxis in New York City made over 15 million trips a month or 500,000 trips a day, with around 85 % of trips within Manhattan. The study uses taxi trip data collected on March 1, 2012 (the data is courtesy of the New York City Taxi and Limousine Commission) consisting of 439,950 trips within Manhattan. First, trip origins and destinations are clustered into N = 100 stations, so that a demand is on average less than 300 m from the nearest station, or approximately a 3-min walk. The system parameters such as arrival rates {λi}, destination preferences {pij} and travel times {Tij} are estimated for each hour of the day using trip data between each pair of stations.

Vehicle availability (i.e., probability of finding a vehicle when walking to a station) is calculated for 3 cases peak demand (29,485 demands/h, 7–8 pm), low demand (1982 demands/h, 4–5 am), and average demand (16,930 demands/h, 4–5 pm). For each case, vehicle availability is calculated by solving the linear program discussed in Sect. 19.2.2.1 and then applying mean value analysis [29] techniques to recover vehicle availabilities.

Fig. 19.4 Case study of New York City. Left figure Vehicle availability as a function of system size for 100 stations in Manhattan. Availability is calculated for peak demand (7–8 pm), low demand (4–5 am), and average demand (4–5 pm). Right figure Average customer wait times over the course of a day, for systems of different sizes

(The interested reader is referred to [13] for further details.) The results are summarized in Fig. 19.4.

For high vehicle availability (say, 95 %), one would need around 8000 vehicles (\*70 % of the current fleet size operating in Manhattan, which, based on taxi trip data, we approximate as 85 % of the total taxi fleet) at peak demand and 6000 vehicles at average demand. This suggests that an AMoD system with 8000 vehicles would be able to meet 95 % of the taxi demand in Manhattan, assuming 5 % of passengers are impatient and are lost when a vehicle is not immediately available. However, in a real system, passengers would wait in line for the next vehicle rather than leave the system, thus it is important to determine how vehicle availability relates to customer waiting times. Customer waiting times are characterized through simulation, using the receding horizon control scheme mentioned in Sect. 19.2.2.1. The time-varying system parameters λi, pij, and average speed are piecewise constant, and change each hour based on values estimated from the taxi data. Travel times Tij are based on average speed and Manhattan distance between stations i and j, and self-driving vehicle rebalancing is performed every 15 min. Three sets of simulations are performed for 6000, 7000, and 8000 vehicles, and the resulting average waiting times are shown in Fig. 19.4 (right). Specifically, Fig. 19.4 (right) shows that for a 7000 vehicle fleet the peak averaged wait time is less than 5 min (9–10 am) and, for 8000 vehicles, the average wait time is only 2.5 min. The simulation results show that high availability (90–95 %) does indeed correspond to low customer wait time and that an AMoD system with 7000–8000 vehicles (roughly 70 % of the size of the current taxi fleet) can provide adequate service with current taxi demand levels in Manhattan.

#### 19.3.2 Case Study II: AMoD in Singapore

This case study discusses an hypothetical deployment of an AMoD system to meet the personal mobility need of the entire population of Singapore [18]. The study, which should be interpreted as a thought experiment to investigate the potential benefits of an AMoD solution, addresses three main dimensions (i) minimum fleet size to ensure system stability (i.e., uniform boundedness of the number of outstanding customers), (ii) fleet size to provide acceptable quality of service at current customer demand levels, and (iii) financial estimates to assess economic feasibility. To support the analysis, three complementary data sources are used, namely the 2008 Household Interview Travel Survey— HITS—(a comprehensive survey about transportation patterns conducted by the Land Transport Authority in 2008 [34]), the Singapore Taxi Data—STD—database (a database of taxi records collected over the course of a week in Singapore in 2012) and the Singapore Road Network—SRD—(a graph-based representation of Singapore's road network).

#### 19.3.2.1 Minimum Fleet Sizing

The minimum fleet size needed to ensure stability is computed by applying Eq. (19.1), which was derived within the distributed approach. The first step is to process the HITS, STD, and SRD data sources to estimate the arrival rate λ, the average origin-destination distance <sup>E</sup><sup>u</sup>Ou<sup>D</sup> <sup>½</sup><sup>Y</sup> <sup>X</sup>; the demand distributions <sup>u</sup><sup>O</sup> and <sup>u</sup>D; and the average velocity v. Given such quantities, Eq. (19.1) yields that at least 92,693 self-driving vehicles are required to ensure the transportation demand remains uniformly bounded. To gain an appreciation for the level of vehicle sharing possible in an AMoD system of this size, consider that at 1,144,400 households in Singapore, there would be roughly one shared car every 12.3 households. Note, however, that this should only be seen as a lower bound on the fleet size, since customer waiting times would be unacceptably high.

#### 19.3.2.2 Fleet Sizing for Acceptable Quality of Service

To ensure acceptable quality of service, one needs to increase the fleet size. To characterize such increase, we use the same techniques outlined in Sect. 19.3.1, which rely on the lumped approach. Vehicle availability is analyzed in two representative cases. The first is chosen as the 2–3 pm bin, since it is the one that is the closest to the "average" traffic condition. The second case considers the 7–8 am rush-hour peak. Results are summarized in Fig. 19.5 (left). With about 200,000 vehicles availability is about 90 % on average, but drops to about 50 % at peak times. With 300,000 vehicles in the fleet, availability is about 95 % on average and about 72 % at peak times. As in Sect. 19.3.1, waiting times are characterized through simulation. For 250,000 vehicles, the maximum wait times during peak hours is around 30 min, which is comparable with typical congestion delays during rush hour. With 300,000 vehicles, peak wait times are reduced to less than 15 min, see Fig. 19.5 (right). To put these numbers into perspective, in 2011 there were 779,890 passenger vehicles operating in Singapore [35]. Hence, this case study suggests that an

Fig. 19.5 Case study of Singapore. Left figure Performance curve with 100 regions, showing the availability of vehicles versus the size of the system for both average demand (2–3 pm) and peak demand (7–8 am). Right figure Average wait times over the course of a day, for systems of different sizes

AMoD system can meet the personal mobility need of the entire population of Singapore with a number of robotic vehicles roughly equal to 1/3 of the current number of passenger vehicles.

#### 19.3.2.3 Financial Analysis of AMoD Systems

This section provides a preliminary, yet rigorous economic evaluation of AMoD systems. Specifically, this section characterizes the total mobility cost (TMC) for users in two competing transportation models. In System 1 (referred to as traditional system), users access personal mobility by purchasing (or leasing) a private, human-driven vehicle. Conversely, in System 2 (the AMoD system), users access personal mobility by subscribing to a shared AMoD fleet of vehicles. For both systems, the analysis considers not only the explicit costs of access to mobility (referred to as cost of service—COS), but also hidden costs attributed to the time invested in various mobility-related activities (referred to as cost of time—COT). A subscript i = {1, 2} will denote the system under consideration (e.g., COS1 denotes the COS for System 1).

Cost of service: The cost of service is defined as the sum of all explicit costs associated with accessing mobility. For example, in System 1, COS1 reflects the costs to individually purchase, service, park, insure, and fuel a private, human-driven vehicle, which, for the case of Singapore, is estimated for a mid-size car at \$18,162/year. For System 2, one needs to make an educated guess for the cost incurred with retrofitting production vehicles with the sensors, actuators, and computational power required for automated driving. Based upon the author's and his collaborators' experience on self-driving vehicles, such cost (assuming some economies of scale for large fleets) is estimated as a one-time fee of \$15,000. From the fleet-sizing arguments of Sect. 19.3.2.2, one shared self-driving vehicle in System 2 can effectively serve the role of about 4 private, human-driven vehicles in System 1, which implies an estimate of 2.5 years for the average lifespan of a self-driving


Table 19.1 Summary of the financial analysis of mobility-related cost for traditional and AMoD systems for a case study of Singapore

vehicle. Tallying the aforementioned costs on a fleet-wide scale and distributing the sum evenly among the entire Singapore population gives a COS2 of \$12,563/year (see [18] for further details about the cost breakdown). According to COS values, it is more affordable to access mobility in System 2 than System 1.

Cost of time: To monetize the hidden costs attributed to the time invested in mobility-related activities, the analysis leverages the Value of Travel Time Savings (VTTS) numbers laid out by the Department of Transportation for performing a Cost Benefit Analysis of transportation scenarios in the US. Applying the appropriate VTTS values based on actual driving patterns gives COT1 = \$14,460/year (which considers an estimated 747 h/year spent by vehicle owners in Singapore in mobility-related activities, see [18]). To compute COT2, this analysis prices sitting comfortably in a shared self-driving vehicle while being able to work, read, or simply relax at 20 % of the median wage (as opposed to 50 % of the median wage which is the cost of time for driving in free-flowing traffic). Coupling this figure with the facts that a user would spend no time parking, limited time walking to and from the vehicles, and roughly 5 min for a requested vehicle to show up (see Sect. 19.3.2.2), the end result is a COT2 equal to \$4959/year.

Total mobility cost: A summary of the COS, COT, and TMC for the traditional and AMoD systems is provided in Table 19.1 (note that the average Singaporean drives 18,997 km in a year [18]). Remarkably, combining COS and COT figures, the TMC for AMoD systems is roughly half of that for traditional systems. To put this into perspective, these savings represent about one third of GDP per capita. Hence, this analysis suggests it is much more affordable to access mobility in an AMoD system compared to traditional mobility systems based on private vehicle ownership.

#### 19.4 Future Research Directions

This chapter provided an overview of modeling and control techniques for AMoD systems, and a preliminary evaluation of their financial benefits. Future research on this topic should proceed along two main dimensions: efficient control algorithms for increasingly more realistic models and eventually for real-world test beds, and financial analyses for a larger number of deployment options and accounting for positive externalities (e.g., increased safety) in the economic assessment. Such research directions are discussed in some details next, with a particular emphasis on the inclusion of congestion effects and some related preliminary results.

#### 19.4.1 Future Research on Modeling and Control

A key direction for future research is the inclusion of congestion effects. In AMoD systems, congestion manifests itself as constraints on the road capacity, which in turn affect travel times throughout the system. To include congestion effects, a promising strategy is to study a modified lumped model whereby the infinite-server road queues are changed to queues with a finite number of servers, where the number of servers on each road represents the capacity of that road. This approach is used in Fig. 19.6 on a simple 9-station road network, where the aim is to illustrate the impact of autonomously rebalancing vehicles on congestion. Specifically, the stations are placed on a square grid, and joined by 2-way road segments each of which is 0.5 km long. Each road consists of a single lane, with a critical density of 80 vehicles/km. Each vehicle travels at 30 km/h in free flow, which means the travel time along each road segment is 1 min in free flow. Figure 19.6 plots the vehicle and road utilization increases due to rebalancing for 500 randomly generated systems (where the arrival rates and routing distributions are randomly generated). The routing algorithm for the rebalancing vehicles is a simple

Fig. 19.6 Top left Layout of the 9-station road network. Each road segment has a capacity of 40 vehicles in each direction. Bottom left The first picture shows the 9-station road network without rebalancing. The color on each road segment indicates the level of congestion, where green is no congestion, and red is heavy congestion. The second picture is the same road network with rebalancing vehicles. Right The effects of rebalancing on congestion. The x-axis is the ratio of rebalancing vehicles to passenger vehicles on the road. The y-axis is the fractional increase in road utilization due to rebalancing

open-loop strategy based on the linear program discussed in Sect. 19.2.2.1. The x-axis shows the ratio of rebalancing vehicles to passenger vehicles on the road, which represents the inherent imbalance in the system. The red data points represent the increase in average road utilization due to rebalancing and the blue data points represent the utilization increase in the most congested road segment due to rebalancing. It is no surprise that the average road utilization rate is a linear function of the number of rebalancing vehicles. However, remarkably, the maximum congestion increases are much lower than the average, and are in most cases zero. This means that while rebalancing generally increases the number of vehicles on the road, rebalancing vehicles mostly travel along less congested routes and rarely increase the maximum congestion in the system. This can be seen in Fig. 19.6 bottom left, where rebalancing clearly increases the number of vehicles on many roads but not on the most congested road segment (from station 6 to station 5).

The simple setup in Fig. 19.6 suggests that AMoD systems would, in general, not lead to an increase in congestion. On the other end, a particularly interesting and intriguing research direction is to devise routing algorithms for AMoD systems that lead to a decrease in congestion with current demand levels (or even higher). A promising strategy relies on the idea that if AMoD systems are implemented such that passengers are given precise pickup times and trips are staggered to avoid too many trips at the same time, congestion may be reduced. Passengers may still spend the same amount of time between requesting a vehicle and arrival at their destination, but the time spent waiting for the vehicle could be used for productive work as opposed to being stuck in traffic. Specifically, for highly congested systems, vehicle departures can be staggered to avoid excessive congestion, and the routing problem is similar to the simultaneous departure and routing problem [36].

Besides congestion, several additional directions are open for future research. As far as modeling is concerned, those include (i) analysis in a time-varying setup (e.g., with periodically time-varying arrival rates), (ii) inclusion of mesoscopic and microscopic effects into the models (e.g., increased throughput due to platooning or automated intersections), and (iii) more complex models for the transportation demands (e.g., time windows or priorities). On the control side, those include (i) inclusion of recharging constraints in the routing process, (ii) control of AMoD systems as part of a multi-modal transportation network, which should address synergies between AMoD and alternative transportation modes and interactions with human-driven vehicles, and (iii) deployment of control algorithms on real-world test beds.

#### 19.4.2 Future Research on AMoD Evaluation

The AMoD evaluation presented in Sect. 19.3 already showed that AMoD systems might hold significant financial benefits. Remarkably, such financial benefits might be even larger when one also accounts for the positive externalities of an AMoD system, e.g., improved safety, freeing up urban land for other uses, and even creating a new economy based on infotainment systems onboard the self-driving vehicles. Such additional benefits, however, have not been thoroughly characterized yet and require additional analyses. Another research direction involves the evaluation of AMoD systems for more complex deployment options, e.g., as a last-mile solution within a multi-modal transportation system, or with a more sophisticated service structure, e.g., multiple priority classes.

#### 19.5 Conclusions

This chapter overviewed recent results regarding the modeling, control, and evaluation of AMoD systems. Case studies of New York City and Singapore suggest that it would be much more affordable (and more convenient) to access mobility in an AMoD system compared to traditional mobility systems based on private vehicle ownership. More studies are however needed to devise efficient, system-wide coordination algorithms for complex AMoD systems as part of a multi-modal transportation network, and to fully assess the related economic benefits.

Acknowledgments The author acknowledges the collaboration with Emilio Frazzoli (MIT), Rick Zhang (Stanford), Kyle Treleaven (MIT), Kevin Spieser (MIT) and Daniel Morton (SMART center) on the results presented in this chapter.

Open Access This chapter is distributed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, duplication, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, a link is provided to the Creative Commons license and any changes made are indicated.

The images or other third party material in this chapter are included in the work's Creative Commons license, unless indicated otherwise in the credit line; if such material is not included in the work's Creative Commons license and the respective action is not permitted by statutory regulation, users will need to obtain permission from the license holder to duplicate, adapt or reproduce the material.

#### References


# Part IV Safety and Security

## Hermann Winner and Markus Maurer

Autonomous driving must be safe—this demand's legitimacy is beyond dispute. But what needs to be considered for this desired state to be achieved? Entry into this topic is via machine perception, which is ultimately viewed as an enabling technology for autonomous driving. Naturally, only what is recognized as being certain can also be used in a decision on safe driving. Can it be ensured that machine perception exhibits the quality required for safety, and if so, how? What are the options for classifying perception performance onboard, what limits cannot be exceeded, and how are these to be evaluated for the development of autonomous driving? These are the core questions of Klaus Dietmayer's chapter, Possibility of Predicting Machine Perception for Automated Driving.

If the demands of autonomous vehicles have been successfully defined and implemented, there remains the challenge of verifying and validating whether these demands are really fulfilled in the present execution. Among the experts, there is unanimity that release for production cannot be given with today's testing and validation methods. In their chapter, The Release of Autonomous Vehicles, Walther Wachenfeld and Hermann Winner explain the challenges and outline approaches that could form components of new tool chains for validating safety.

At the beginning of their driving careers, even human beings' driving skills are far from what they will be later on. The accident frequency of young (male) drivers in particular is witness to that. With growing experience, the safety of drivers improves considerably. People learn to drive safely. Under the title Do Autonomous Vehicles Learn?, and based on an intensive study of the literature, Walther Wachenfeld and Hermann Winner discuss the extent to which machine learning can meet autonomous driving's safety requirements.

Taking the pivotal ISO 26262 standard as his starting point, Andreas Reschka examines when autonomous vehicles generally, and particularly in the use cases, are in a safe state; how degradations could be designed more safely; and what is required of a Safety Concept for Autonomous Vehicles.

In his article Opportunities and Risks Associated with Collecting and Making Usable Additional Data, Kai Rannenberg explains that, although open interfaces and communication with participants outside the vehicle may be helpful from the point of view of validating safety and functionality, they may be very questionable in terms of data protection and data integrity. He argues that machine autonomy may even be linked to a loss in privacy, though perhaps this need not be so.

# 20 Predicting of Machine Perception for Automated Driving

Klaus Dietmayer

#### 20.1 Introduction

In the case of highly-automated and fully-automated driving it is necessary for the vehicle itself to recognize the limitations of its machine perception, as well as the functional limitations of processing modules based on this perception to react adequately. While simulator studies of highly-automated driving have shown that realistic transfer times to the driver of between 5 and 10 s can be assumed [1, 2] before the driver can reliably take over the driving task again, with fully-automated driving a human would not provide any backup whatsoever. In the case of functional limitations, the vehicle would have to be able to achieve an intrinsically safe state completely by itself. However, potential transfer times of 5 s and more require extensive autonomy of the vehicle, if only for a limited time, in order to be able to bridge this time period reliably under all circumstances.

To be able to achieve this degree of autonomy, the vehicle must perceive its surroundings, interpret them appropriately and be able to derive and execute reliable actions continuously. Technically, this task is carried out by individual processing modules that build on each other. A simplified representation of the relationships is shown in Fig. 20.1.

The machine perception of the vehicle's surroundings is enabled by various sensors, such as cameras or radar sensors, incorporated into the vehicle. Further information about the static driving environment is usually added from very precise digital maps. However, this can only be used when the vehicle knows its exact position. Therefore, the vehicle also requires a self-localization functional module for the map matching. The result of the machine perception is a dynamic vehicle environment model in which the vehicle itself and all other road users are represented by individual dynamic motion models. This

K. Dietmayer (&)

Universität Ulm, Institute of Measurement, Control and Microtechnology, 89081 Ulm, Germany e-mail: klaus.dietmayer@uni-ulm.de

© The Author(s) 2016 M. Maurer et al. (eds.), Autonomous Driving, DOI 10.1007/978-3-662-48847-8\_20

should also contain all the relevant infrastructure elements such as traffic signs and traffic lights, as well as structuring elements such as traffic islands and curbstones, road markings for dividing traffic lanes, closed areas or pedestrian crossings.

Based on this vehicle environment model, during the situation recognition, all the individual components are set in relation to each other in order to generate a machine interpretation of the scene from the dependencies of the individual elements. In the situation prediction module based on this, various possible developments of the scene over time, also known as episodes, are calculated in advance and evaluated as to the probability of their occurrence. Therefore, in this document an episode refers to a possible specific development over time for a detected traffic scene, whereby the time horizon lies within the range of a few seconds. On the basis of this situational information, the module based on this determines the higher-level action planning. For example, it could stipulate driving around an obstacle or overtaking a slower vehicle. For the execution of the plans, possible trajectories of the vehicle are calculated with a typical time horizon of 3–5 s and are evaluated in terms of safety and comfort. The optimal trajectory based on the criteria that can be stipulated is executed by the vehicle control. The processing procedure described is repeated continuously, usually in line with the data capture of the sensors, so that the vehicle is able to react to the actions and reactions of other road users.

The description of this technical process chain clearly shows that a failure of the machine perception would immediately lead to uncertainties in the situation evaluation of such a magnitude that reliable safe action planning and action execution would no longer be possible. The degradation of the machine interpretation of the scene and the action planning and action execution based on this depends on the situation; however, reliable prediction would typically not be able to exceed 2–3 s. Therefore, it is evident that a minimum perception capability is required even for highly-automated driving due to the significantly greater transfer times to the driver. A complete failure of the machine perception must be avoided in all circumstances, though of course this also applies to the modules based on it and the vehicle control with its sensors and actuators, which are not within the focus of this document, however.

Therefore, the question is whether limitations in the operation of the machine perception can be detected or even predicted, and if they are, over what period of time. In this context, the following sections will discuss the state of the technology of known methodical approaches, and on this basis derive possible research questions.

#### 20.2 Machine Perception

#### 20.2.1 Scope and Characteristic

As described in the previous section, the task of machine perception is to reliably detect all the other road users relevant to the operation of the automated driving, and to assign them correctly to the traffic infrastructure. This is particularly necessary because, for example, a pedestrian at the side of the road presents a different potential risk than one who is using a separate pedestrian walkway running parallel to the road.

For the machine perception sensors based on camera and radar and/or lidar technology are used. More detailed information on the operation and design of these sensors can be found in [3], for example. Cameras provide a 2D representation of a 3D scene in the form of high-resolution gray-scale or colored images, from which image processing methods can be used to extract individual objects when there is sufficient contrast or differentiation in the texture. However, the object distance can only be determined with mono cameras based on assumptions that often lead to errors, such as a flat surface. Although stereo cameras also enable the object distance to be determined by means of the disparity image, the accuracy decreases quadratically as the distance increases. With the currently prevailing base distances for the stereo arrangements and the resolution of the cameras, measuring ranges of up to around 50 m are possible without the error margin increasing to such an extent that functions could no longer make any use of the data.

On the other hand, radar and also lidar sensors provide distance measuring data that is comparatively very accurate and also practically distance-independent in terms of the measuring error margin. However, due to their low angle resolution, they are less accurate in capturing the contours, i.e. the external dimensions of objects. This applies in particular to radar sensors. Additionally, radar and lidar sensors do not provide any texture information. Due to these different measuring properties, the different sensor types are generally used in combination to create the machine perception. This is referred to as sensor data fusion.

The combined sensor data enables moving and static objects, but also road surface markings, for example, to be categorically detected and physically measured. The possible measuring dimensions depend on the specific sensor set-up. Typical physical measured data that can be captured includes the dimensions of an object used for a box model with length, width and height, as well as its position absolutely in the world or relative to the vehicle. In the case of moving objects, the object speeds and object accelerations are added to this data. More difficult to determine, and generally very unreliably, from external sensor measurements is the yaw rate or yaw angle of other road users. Without vehicle-to-vehicle communication, these variables can only be determined reliably for one's own vehicle.

However, for the subsequent situation evaluation and situation prediction, not only the physical measurement of the objects is required, but also information about what class of object is involved. For example, a pedestrian and a motorcyclist differ in terms of their possible degrees of freedom of movement and also their possible movement dynamic. Also, depending on the context and constellation, road surface markings can have different meanings. Therefore, it is necessary also to determine the semantic meaning of the objects detected from the sensor data, or from other information sources such as a digital map. In the context of the machine perception, this operation is known as a classification step, but it is a component of the machine perception.

While humans are able to assign a semantic meaning to the visual perceptions very quickly and nearly without errors, this is still a comparatively difficult task for the machine perception with the current state of the technology. The known classification algorithms are always based on more or less complex models of expected object classes, which are either learned automatically from examples or are specified manually. These models then display, as discriminately as possible, characteristics that can be captured with the available sensors, so that a distinction can be made between the object classes that occur. However, it also becomes clear that object classes that are not trained in advance cannot be identified semantically with the methods known at present. Due to their significantly greater capabilities, learning classification algorithms have become widely accepted.

A machine perception with semantic information is only technically possible in the context of driver assistance systems and automated driving because the driving area is well structured and limited to a few object classes. Additionally, only a rough class differentiation is relevant for situation recognition and situation prediction. With the current state of the technology, it is sufficient to be able to distinguish between the pedestrian, cyclist, passenger car and truck or bus classes with respect to moving objects. Additionally, there are stationary obstacles, but these are usually assigned to a residue class along with the non-classifiable objects.

For the correct assignment of the classified objects to the traffic infrastructure, it is also necessary to be able to identify reliably, with the correct semantic meaning, road surface markings, blocked areas, stop lines, traffic light systems and traffic signs. As this complex classification task is not yet possible with the required degree of reliability, highly accurate and comprehensively attributed digital maps are used as a support, based on the state of the technology. Knowing its own position, the automated vehicle can use these maps to identify the stationary objects and markings expected in the sensors' field of vision, together with their semantic meaning. The sensors then only have to verify that the objects are present.

A disadvantage of this approach is that a highly accurate localization of the vehicle is required, for which a standard GPS localization is not sufficient, and the map must always be up to date. For this reason, the goal is to develop technical solutions in the future that will no longer require highly accurate, up-to-date maps.

#### 20.2.2 Characteristics of Environment Models

The machine perception is used to create a dynamic environment model. Two main representations are known: object-based and grid-based forms. Both forms of representation can also be combined.

An object-based vehicle environment model is a dynamic data structure in which all the relevant object and infrastructure elements in the vicinity of the vehicle are represented correctly in space and time. As explained above, the capturing and tracking over time of the objects and infrastructure elements is performed continuously by suitable, usually fused on-board sensors such as cameras, radars, lidars, and with the additional use of highly accurate digital maps. Figure 20.2 shows an example of components that incorporate an environment representation.

Which objects and structure elements are relevant for automated driving mainly depends on the driving task to be performed, the complexity of which increases starkly, starting from simple motorway scenarios via country roads to inner-city traffic. In the object-based representation, all the other road users relevant to the representation, the relevant infrastructure elements and one's own vehicle itself are described by means of a separate dynamic object model, usually a time-discrete state space model. The states of this model, such as position, speed or 2D/3D object dimensions, are continuously updated in line with the sensor measurements. Furthermore, there is continuous capturing of the road surface markings and traffic signs, as well as the status of the traffic light systems.

Fig. 20.2 Schematic diagram of the object-based vehicle environment representation. All the relevant objects are detected, classified and correctly assigned to the infrastructure. Image rights: Author has copyright

Fig. 20.3 Schematic diagram of the structure of a grid-based representation of the vehicle's surroundings. In the simplest case, this only contains static obstacles. Image rights: Author has copyright

A grid-based representation uses raster maps to divide the stationary environment into localized cells of equal size. The vehicle moves across this localized 2D or 3D grid and the on-board, the sensors then only supply information as to whether specific cells are free and thus can be driven on freely, or whether there is an obstacle in the respective cell. Additionally, the state in which no information on cells is available can also be modeled. This type of depiction is mainly suitable for representing static scenarios and static obstacles. It does not require any model hypotheses about the object classes to be expected and can therefore be categorized as very resistant to model errors. Figure 20.3 shows the basic procedure. Further information on grid-based representations can be found in [4–8].

#### 20.3 Methods for Dealing with Uncertainties of Machine Perception

#### 20.3.1 Uncertainty Domains

As described in Sect. 20.2, the machine perception is made up of different task scopes. These are, on the one hand, detecting static and dynamic objects and physically measuring them as precisely as possible, and on the other, assigning the correct semantic meanings to the detected objects. In the context of these tasks, the following three uncertainty domains exist for the machine perception:

1. State uncertainty

State uncertainty describes the uncertainty in the physical measured variables, such as size, position and speed, and is a direct consequence of measuring errors in the sensors and sensor signal processing that cannot always be avoided.

2. Existence uncertainty

Existence uncertainty describes the uncertainty as to whether an object detected by the sensors and transferred to the representation of the surroundings actually exists at all. Errors of this kind can occur due to deficiencies in the signal processing algorithms or incorrect measurements by the sensors themselves.

3. Class uncertainty

This refers to uncertainty with regard to the correct semantic assignment, which can be caused by deficiencies in the classification procedure or insufficiently accurate measured data.

In order to facilitate automated driving, it is necessary to reliably detect any uncertainties or errors in the various domains and, if possible, even to be able to predict them. In the current state of the technology, uncertainties are handled, almost without exception, using methods based on Bayes' theorem [9–11] or on the generalization of same, the Dempster-Shafer theory [12]. The advantage of these methods is that they allow the uncertainty domains to be handled using a totally probabilistic and therefore mainly heuristic-free approach.

In the narrow sense, the uncertainty domains named above only apply to the on-board sensors for now. However, errors in the information from a digital map or in the data obtained via Car2x communication can also be categorized. Car2x communication in particular can harbor additional sources of error due to possible variable latency times in the transfer of data and the possibility of imprecisely known uncertainty evaluations of the sending sources. However, the effects can still be assigned to the three uncertainty domains named, and therefore we will not go into further detail here.

#### 20.3.2 State Uncertainty

The state uncertainty of a detected object is described, in accordance with Bayes' theorem, by means of a probability density function which can be used to determine the most probable total and individual state and also, with a certain probability, possible variations from this. In the case of a multi-dimensional, normally distributed probability density function, the state uncertainty is completely represented by a covariance matrix.

In estimating static variables, such as the vehicle dimensions, their state uncertainty can be reduced progressively by means of repeated measurements. The estimated value based on the available measurements converges with the true values, as long as there is no systematic sensor error, e.g. in the form of an offset. For the estimation of dynamic, time-changeable states such as the object position or the object speed, due to the movement of the object between the measuring times, there is no convergence with a true value. Therefore, for the evaluation of the quality of the state estimation, it is stipulated that the mean error is zero and the uncertainty as low as possible.

The basic procedure for handling state uncertainties is the general Bayes filter [9]. With this, the estimated state of an object and the related uncertainty are represented by a multi-dimensional probability density function p (PDF):

$$p\_{k+1}(\mathbf{x}\_{k+1}|\mathbf{Z}\_{1:k+1})\dots$$

In general, it depends on all the measurements Z1:<sup>k</sup> <sup>þ</sup> <sup>1</sup> ¼ fz1; ...;zk <sup>þ</sup> <sup>1</sup>g available at time k + 1. This is expressed by means of the selected notation of a conditional probability, i.e. the probability for the state of system x is conditional upon measurements Z.

The motion model of an object captured by the sensors for the period between two consecutive measurements is described by a motion equation of the form

$$\mathbf{x}\_{k+1|k} = f(\mathbf{x}\_k) + \nu\_k$$

whereby vk represents an additive disturbance variable representing possible model errors. The motion equation expresses in which state, such as location, speed and direction of motion, the object will probably find itself at the next point in time. Alternatively, this motion equation can also be expressed by means of a Markov transition probability density:

$$f\_{k+1|k}(\mathbf{x}\_{k+1}|\mathbf{x}\_k) .$$

The Markov transition probability density is ultimately only another mathematical notation for the same model assumptions. To keep the equations practically calculable, it is common to presuppose a Markov property of the first order. This property expresses simplistically that the future state of a system only depends on the last known state and the current measurement, not on the entire history of measurements and states. Therefore, the Markov property of the first order is a presupposed system property. In our specific case, the predicted state xk+1 of the object before the new measurement is available only depends on the last determined state xk, as this implicitly comprises the entire measurement history Z<sup>1</sup>:<sup>k</sup> ¼ fz1; ...;zkg:

The prediction of the current object state xk to the next measuring time k + 1 is basically carried out based on the Chapman-Kolmogorov equation

$$p\_{k+1|k}(\mathbf{x}\_{k+1}|\mathbf{x}\_k) = \int f\_{k+1|k}(\mathbf{x}\_{k+1}|\mathbf{x}\_k) p\_k(\mathbf{x}\_k) d\mathbf{x}\_k.$$

This is denoted as a prediction step of the Bayes filter.

The measuring process of the sensors can generally be described as a measurement equation in the form

$$z\_{k+1|k} = h\_{k+1}(x\_{k+1}) + w\_{k+1}$$

The measurement function hð-Þ describes how measurements and state variables are related. For example, if a state variable can be measured directly, then hð-Þ is a 1:1 mapping. Here, the stochastic disturbance variable wk <sup>þ</sup> <sup>1</sup> represents a possible measuring error. An alternative mathematical representation of the measurement equation is the likelihood function

$$
\lg(z\_{k+1}|x\_{k+1}) \dots
$$

If the current measurements zk <sup>þ</sup> <sup>1</sup> are available, the probability density function of the object state is updated. The current estimate of the state is calculated using the Bayes formula

$$p\_{k+1}(\mathbf{x}\_{k+1}|\mathbf{z}\_{k+1}) = \frac{\mathbf{g}(\mathbf{z}\_{k+1}|\mathbf{x}\_{k+1})p\_{k+1|k}(\mathbf{x}\_{k+1}|\mathbf{x}\_k)}{\int \mathbf{g}(\mathbf{z}\_{k+1}|\mathbf{x}\_{k+1})p\_{k+1|k}(\mathbf{x}\_{k+1}|\mathbf{x}\_k)d\mathbf{x}}.$$

This second step to incorporate the current measurement is known as the innovation step.

The recursive estimation procedure briefly described by the prediction step and the innovation step is known as the general Bayes filter, and all the methods and implementations of the stochastic state estimation commonly used today are based on this. Along with the process and measurement equations, the procedure only requires an a priori PDF for object state p0ðx0Þ at time k ¼ 0: However, it is not efficient to implement the filter in this general form.

With the assumption of normally distributed measurement signals and linear models, the Kalman filter [13] enables a simple analytical implementation of the general Bayes filter. As a Gaussian distribution is completely described by its first two statistical moments, i.e. the mean value and the related covariance matrix, the temporal filtering of these two moments represents a mathematically exact solution. The Kalman filter can be applied to systems with non-linear process or measurement equations by using the Extended Kalman Filter (EKF) [11] or the Unscented Kalman Filter (UKF) [14]. While the EKF linearizes the system equations by using a Taylor series approximation, the objective of the UKF is a stochastic approximation by using what are known as sigma points [14].

Independently of the specific implementation, all the procedures based on the general Bayes filter have in common that they continuously supply a probabilistic measure for the uncertainty of the physical variables determined from the sensor data. This enables the reliable detection of sensor failures, but also of degeneration in the capabilities of individual sensors. For example, if the measured data of individual sensors deviates significantly, i.e. outside the variation range to be expected statistically, there is a corresponding reduction in capability.

However, it must be remembered that a reduction in the capability of a sensor can only be detected after it has occurred. Apart from trend indication in the case of slow degeneration, it is not possible to make any prediction of the future perception capability in relation to the state uncertainty.

#### 20.3.3 Existence Uncertainty

For the performance of automated driving, existence uncertainty is at least as relevant as state uncertainty. It expresses the probability that the object in the representation of the vehicle's surroundings actually corresponds to a real object. For example, emergency braking of an automated vehicle should only be triggered in the case of a very high existence probability for a detected obstacle.

While the estimation of state uncertainties using Bayes estimation methods is well founded in theory, the existence probability in today's systems is still mostly determined on the basis of a heuristic quality measure. An object is taken as confirmed if the quality measure exceeds a sensor- and application-dependent threshold. For example, the quality measures are based on the number of measurements that have confirmed the object, or simply the interval between the initialization of the object and the current point in time. Often the state uncertainty of the object (Sect. 20.3.2) is also used for the validation.

An approach with a better theoretical foundation is the estimation of a probability-based existence probability. This firstly requires a definition of the specific object existence. While in some applications, all real objects are taken to be existent, the object existence can also be limited to the objects that are relevant in the current application. Additionally, a limitation to the objects that can also be detected with the current sensor setup is also possible. In contrast to a threshold procedure, this determination of the existence probability enables a probability-based interpretation option. For example, an existence probability of 90 % means that there is a 90 % probability that the measurement history and the motion pattern of the object were created by a real object. Consequently, the action planning of the automated vehicle can use these probabilities when evaluating alternative actions.

A known algorithm for calculating an existence probability is the Joint Integrated Probabilistic Data Association (JIPDA) procedure, also based on the Bayes filter, which was first introduced in 2004 by Musicki and Evans [15]. This procedure additionally uses the detection and false alarm probabilities of the sensors, which are presumed to be known.

The calculation of the current object existence probability is performed similarly to state estimation in the Kalman filter in a prediction step and an innovation step. The existence prediction is performed using a Markov model of the first order. The predicted existence of an object is given by the Markov chain

$$p\_{k+1|k}(\exists \mathfrak{x}) = p\_S p\_k(\exists \mathfrak{x}) + p\_B p\_k(\exists \mathfrak{x})$$

whereby the probability ps represents the persistence probability of the object and pB the probability for the occurrence of an object in the sensor capture area. Consequently, the probability for the disappearance of an object is given by 1 pS: In the innovation step, the a posteriori existence probability pk <sup>þ</sup> <sup>1</sup>ð9xÞ is calculated. It essentially depends on the number of current measurements that confirm the existence of the object.

As the persistence probability of an object depends on the current object state and the posteriori existence probability in turn depends on the data associations, the JIPDA filter can be interpreted as the coupling of two Markov chains shown in Fig. 20.4. The upper Markov chain represents the state prediction and innovation known from the Kalman filter, while the lower Markov chain represents the prediction and innovation of the existence probability. For details on the JIPDA procedure and its specific formulation with regard to the applications in automotive applications, see [16] for example. Current multi-object tracking procedures only developed in the last few years also enable integrated object-specific existence estimation. For further information on this, see [9, 17, 18, 19–21].

With regard to the functional behavior of the existence estimation, the same limitations apply as with the state estimation. A probabilistic measure for the specific existence of the object is continuously supplied. Therefore, sensor failures during operation can also be detected reliably in this uncertainty domain. However, a prediction of future capability is not possible here either.

Fig. 20.4 Structure of a JIPDA filter as coupling of two Markov chains. Image rights: Author has copyright

#### 20.3.4 Class Uncertainty

Classification procedures for determining the object class, i.e. the determination of semantic information, are structured very sensor-specifically. Due to the significantly higher information content, image-based procedures are more common in the classification sector. A differentiation is made for learning procedures in which the classifier trains offline using positive and negative examples and then can recognize the trained object classes to a greater or lesser extent during online operation. The characteristics used in the training are either specified or are implicitly generated themselves in the learning process. Methodically, two basic approaches have established themselves in the learning procedures. On the one hand there are cascaded procedures based on Viola and Jones [22] or methods based on different neuronal networks [23, 24].

A more classical but also common approach is to specify from the sensor data as many deterministic characteristics as possible for the different classes, such as length, width or speed, and to determine for these the class-specific statistical variation areas. The mean value of the individual characteristics, including the variation range, is approximated by means of a normal distribution, for example. Following this, based on the current measured values and the known characteristic distributions, the most probable class from a Bayesian perspective is determined. If different sensors are to be used in combination which can each only capture individual characteristics of the total set, the Dempster-Shafer theory [12] can be used for the class determination, because it allows "non-knowledge" to be considered as well. However, these procedures are generally less powerful than learning procedures, and will presumably continue to diminish in importance as a result.

A disadvantage of all the classification procedures named is that no theoretically substantiated probabilities can be determined for the current quality of the classification. At present no comprehensive theoretical basis exists for this. The output of the classifiers is currently only an individual reliability measure that can be standardized to the value range of 0–1. It does not represent a probability in the narrower sense, and therefore different algorithms are not comparable in this regard. Image-based trained classifiers differ so greatly from characteristic-based procedures comprising lidar and radar sensors that standardized treatment of them will not be easy to achieve.

#### 20.3.5 Summary

The explanation in the previous sections make clear that the machine perception is made up of three fundamental uncertainty domains, namely the state uncertainty, the existence uncertainty and the class uncertainty. All domains have a direct influence on the capability of the machine perception. If the uncertainties are too great, whereby it must be defined which uncertainties are tolerable for specific functions, it is no longer possible to drive an automated vehicle reliably.


Table 20.1 Uncertainty domains of machine perception and their methodical handling

What is problematic is that a future higher uncertainty, and thus a greater error probability, cannot be predicted in time. While the currently known methods for estimating state and existence uncertainties do enable a current estimation of the capability of the machine perception, in principle it is not possible to predict degeneration in the capability of individual sensors or even a failure of components. Only a trend indication is possible. Table 20.1 summarizes the results once more.

#### 20.4 Implications for the Machine Perception Capability Prediction

As was explained and substantiated in the previous sections, the future development of the machine perception capability of an automated vehicle cannot be predicted with sufficient confidence. By no means can the perception capability for the period of 5–10 s required to transfer the driving duties to a human be reliably predicted under all circumstances, as is stipulated as a backup option in highly-automated driving. Moreover, a fully-automated vehicle would have to be able to achieve an intrinsically safe state autonomously, for which even a longer period of time would be required in some cases than for the case of a driver taking over. Although there are certainly a number of options for predicting the future limitation of the perception capability based on external conditions such as imminent camera glare due to the low position of the sun and sensor limitation due to the onset of rain, snow or fog banks, these are special scenarios that also require extremely reliable context information. Therefore, in principle, the prediction of the perception capability is not a general option for ensuring the necessary reliability for automated driving.

However, as described above, there already exist theoretically substantiated methods and procedures for continually monitoring the current machine perception capability and being able to detect system failures and the degradation of individual components reliably and quickly. Therefore, machine perception systems must be designed in such a way that sensor redundancy is provided which ensures that sufficient perception capability remains either until the transfer to the driver or, in the case of a fully-automated vehicle, until an intrinsically safe state is achieved if individual components break down. Thus, a complete failure of the machine perception must not occur.

Redundancies such as these are basically provided by multi-sensor systems that are used in parallel and combine information from various sensors and sensor principles. For example, if radar and lidar sensors are incorporated, they both supply distance measurement data, but of different quality and in a different sensor capture area. The weather dependencies of the sensor principles are also different. However, due to the similarity of the measured data, they can provide mutual support or also mutual compensation if a component breaks down, with a slight loss of measuring quality for the overall system. Additionally, only through this usage of independent sensor principles is it possible to achieve the highest safety level in accordance with ASIL D, which is required for the operational safety in automated driving.

A redundancy can also be planned and provided easily for cameras. For example, if a camera in a stereo camera system breaks down, the second camera of the stereo system remains available for the classification tasks and the detection of road markings. Only a distance estimate is then no longer available from stereo data and would have to be compensated be means of lidar or radar sensors, for example. Of course, a prerequisite for this redundancy is that the processing hardware and the underlying software of the individual cameras would have to be set up independently, i.e. redundantly. Alternatively, an additional mono camera could be incorporated, including its own processing hardware and software. Therefore, redundancy concepts such as these can enable a minimum perception capability to be always maintained in the automated vehicle, even if individual components break down.

Automated vehicle control is based on the current machine perception and on the prediction of the current traffic situation. With the state of the technology, the latter is essentially performed by means of a simple prediction of the current motion behavior of the objects into the future. Due to the large number of possible and non-predictable events, especially the reactive actions of other road users, the uncertainties increase so starkly after around 2–3 s that reliable trajectory planning is no longer possible on this basis. Therefore, the situation prediction cannot reliably bridge the period for transferring the vehicle control back to the driver in highly-automated driving, or for achieving an intrinsically safe state in fully-automated driving, if the machine perception no longer continuously updates the vehicle environment model.

However, due to his/her driving experience, a human is also only capable of anticipating the overall situation for around 2–3 s into the future with a degree of reliability [25]. But, because a human perceives and interprets his/her environment quasi-continuously, this brief prediction horizon is completely sufficient for reacting adequately and de-escalatory in practically all situations, and for avoiding accidents as a general rule. This should also be possible for automated vehicles, whereby here of course additional latencies and uncertainties in the perception must be considered. The prerequisite, as mentioned above, is a guaranteed minimum capability for the machine perception.

However, for the overall operation, it is essential that the automated vehicle does not put itself into a technically insolvable situation in the first place. The permissible criticality of the situation must always correspond to the current machine perception capability. What must be considered in particular here are suddenly occurring failures and the resulting spontaneous reduction in the machine perception capability. Within the relatively reliable prediction period for the situation development of 2–3 s, the automated vehicle must be able to adjust its driving behavior to the altered machine perception capability. A simple example would be driving on its own lane. If the sensor range is reduced by technical failures or weather factors, the vehicle must be able to adjust its speed to the current situation within the validity of the prediction, and this represents a reliably solvable technical problem.

While this simple situation is easy to describe and analyze, at present it is generally not known how critical situations arise, and what distinguishes these in terms of the capability of an automated vehicle. In any case, in establishing the reliability of automated vehicles, driving a predefined number of kilometers does not ensure that the resulting dataset contains all the possible critical situation developments (episodes). Consequently, it is not possible to ensure the operating reliability in this way, regardless of the fact the mileage required to statistically prove the very low error rates would be neither practically nor economically feasible.

Therefore, a possible research task in the future would be to find a suitable mathematical representation of random episodes that would then provide the range of all possible episodes. Based on this description, what are known as Monte Carlo simulations, for example, can be used to structure the entire episode range into critical and uncritical subareas, in order to draw a conclusion about required specific tests. A possible methodical approach for this would be rejection sampling, whereby every sample represents a complete episode. Starting from basic episodes, which are distinguished by different road types (1, 2, or 3 lanes per direction, oncoming traffic), for example, or by the number of vehicles in the near vicinity, similar situations are generated through the statistical variation of the episode parameters. When there are a sufficient number of samples, it is to be expected that the episode range has been completely covered. In the process, every episode used is tested for its physical feasibility, and irrelevant episodes are discarded. The remaining episodes are then tested as to whether, for example, critical time gaps or spaces arise between objects. The suitable criteria for this must also be defined. The identification and prioritizing of critical situations are carried out by means of subsequent clustering in the episode range.

The goal of such a procedure would be to use this hierarchical approach to determine a quantity of potentially critical episodes that is as complete as possible but still manageable. This would then be analyzed using simulated data as to its controllability by the highly-automated system at different levels of machine perception capability. For example, individual ranges, capture angles and detection rates could be modeled for a sensor setup in the vehicle in order to then systematically analyze the consequences for the behavior of the vehicle for critical episodes. This analysis can be carried out initially for a fully-functioning system, and then under the assumption of a failure of individual components.

Another research question that is open is the possibility of a more reliable situation prediction that would use context information and hypotheses about the future behavior of the road users to enable longer prediction periods. Such a procedure would be justified to the extent that our entire traffic system is based on the cooperation of the road users. Of course, a disadvantage of this would be that uncooperative behavior, or simply the errors of other road users, could not be expected nor included in the action planning of an automated vehicle. In this respect, such approaches do not enable a significant extension of the reliably predicted time period, but they can still support planning algorithms. Additionally, it should be noted that in many situations manual drivers do not have a chance to react appropriately when other drivers do not behave correctly or make unforeseen driving errors. Therefore, excessive demands should not be made of automated vehicles in this regard. However, naturally this is also a question of society's consensus with respect to the permissible potential risk involved in a new technology.

#### 20.5 Summary

The existing methods for the state and existence estimations are based on a closed, well-founded theory and enable in-line, reliable evaluation of the current quality of the machine perception capability. This makes it possible to detect complete failures of individual sensors as well as a gradual degeneration in the sensor technology and/or perception.

However, the procedures do not enable a prediction of the future perception capability, and only a linear extrapolation of detected trends is conceivable. The reliability and quality of the evaluation of the machine perception capability depends on the available sensor models, and error models in particular, which are sensor- and manufacturer-specific. The perception systems alone do not have a sufficient prediction capability that could reliably cover a time horizon of between 5 and 10 s, as is currently envisaged for returning the highly-automated system to the driver. However, this is probably not even necessary for the reliable behavior of an automated vehicle. What is decisive for the controllability of situations during automated driving is a sufficient number of physically implementable and reliable trajectories for the automated vehicle. These are essentially defined by the spatial proximity of limiting objects to one's vehicle and the available drivable free space. Therefore spatial proximity must be incorporated into key figures for evaluating criticality, while also taking into account uncertainties in the perception and the number of physically possible, reliable trajectories. The currently available machine perception capability must also be considered here. Such sufficiently coordinated and theoretically founded criticality measures do not exist at present.

A situation prediction into the future over a period of 2–3 s will not provide a conclusive result in purely model-based, probabilistic extrapolation, as every development of the situation becomes possible after this period. A possible approach, and a future research question, would be the context-related, hypothesis-based temporal extrapolation based of known and evaluated situations stored in a knowledge base. With an existing knowledge base, the current situation can then be evaluated continuously with regard to the assumed outcome. No reliable methods exist for this at present, and in some cases not even any ideas of how it could be implemented. However, this seems to be a path which can be taken.

The advances in situation prediction are extremely difficult to foresee. However, significantly more capable methods can presumably be expected only in a time horizon of 10 years or more.

Open Access This chapter is distributed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, duplication, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, a link is provided to the Creative Commons license and any changes made are indicated.

The images or other third party material in this chapter are included in the work's Creative Commons license, unless indicated otherwise in the credit line; if such material is not included in the work's Creative Commons license and the respective action is not permitted by statutory regulation, users will need to obtain permission from the license holder to duplicate, adapt or reproduce the material.

#### References


# 21 The Release of Autonomous Vehicles

Walther Wachenfeld and Hermann Winner

#### 21.1 Introduction

In the future, the functions of autonomous driving could fundamentally change all road traffic; to do so, it would have to be implemented on a large scale, in series production. In general, a technical system such as a car needs to be released for it to make the transition from the development phase to mass production [1]. According to the principles of project management, production release is only granted when the previously defined requirements have been fulfilled by this technical system. These requirements come from a wide range of sources, such as customers, standards or legislation. Various areas are addressed by the requirements: these include the requirements for the safety of the technical system for type approval<sup>1</sup> and product liability<sup>2</sup> reasons.

The safety of people in public road traffic is one of the oft-quoted motivations for vehicle automation, because the vast majority of present-day accidents are caused by human drivers. Based on this motivation is the requirement that substituting humans does

W. Wachenfeld (&) H. Winner

e-mail: wachenfeld@fzd.tu-darmstadt.de

H. Winner e-mail: winner@fzd.tu-darmstadt.de

<sup>1</sup> According to Directive 2007/46/EG [2], the expression "(…) 'type approval' describes the procedure whereby one Member State certifies that a type of a vehicle (…) satisfies the relevant administrative provisions and technical requirements".

<sup>2</sup> Reuter [3] states: "(Tortious) product liability serves to protect any person (product users as well as uninvolved third parties) from unsafe products. Product liability regulates the compensation of damage to health or property that has been caused by a product defect".

Institute of Automotive Engineering – FZD, Technische Universität Darmstadt, 64287 Darmstadt, Germany

Fig. 21.1 Theoretical potential for avoiding accidents with vehicle automation [4]. Image rights: Gasser

not reduce the safety of public road traffic. This should apply to both passengers and the entire traffic system in which the autonomous vehicle is in motion. What this requirement means, and whether it would actually be fulfilled upon the introduction of the autonomous vehicle, is the focus of the following discussion.

A starting point is provided by Gasser et al. [4]: The report from the German Federal Highway Research Institute considers the development of accident numbers upon the introduction of vehicle automation. Starting from the total number of accidents for conventional driving (see Fig. 21.1, blue and green field) it is assumed that accidents (green field) are avoided by means of vehicle automation. However, new accidents could also be caused by the risks of automation (yellow field).

This representation does not differentiate in terms of the severity of the accident, but the severity of the accident is also relevant when considering the impact on safety. Safety is generally described as the absence of unreasonable risks. This risk is defined as a product of the probability of an accident and the severity of that accident.

Figure 21.2 illustrates in a qualitative way this theoretical risk avoidance potential depending on the severity of the accident. Here Fig. 21.2 adheres to the findings of Heinrich [5] and Hydén [6] that accidents of decreasing severity occur in larger numbers. The scale of the related severity of the accident is ordinal, meaning that there is clearly an order between the different degrees of severity: For example, a fatality is weighted as graver than a serious injury. However, academics are divided on the relative weighting of these different degrees. While degrees of severity are compared in terms of costs, this is contentious and will not be discussed further in this work.

Fig. 21.2 Theoretical potential for avoiding accidents with vehicle automation with consideration of gravity of accident (similar to [4]). Image rights: Author has copyright

Considering the severity and the number of accidents shows that while risks are removed (Fig. 21.2 green area), there are risks remaining (Fig. 21.2 blue area) which are not addressed by vehicle automation. In addition, new risks are created by the substitution of humans and the automated execution of the driving. The human is no longer available as a backup in the case of a failure or a defect. The yellow area in Fig. 21.2 illustrates this additional risk. It is uncertain here whether the removal of risks and the creation of additional risks is uniform across the degrees of severity. It is possible that there is a greater reduction in serious accidents but an increase in less serious accidents. Figure 21.2 illustrates this idea via the deformation of the assumed triangle.

For the approval of fully-automated driving, this means that not only a reduction in the number of accidents must be proven, but rather an accepted ratio Vacc between avoided Ravo and additionally caused risks Radd.

$$V\_{\text{acc}} = \frac{R\_{\text{add}}}{R\_{\text{avo}}}$$

Contrary to many assertions, it has not yet been proven that a ratio of less than 1 is actually necessary for the approval. Will autonomous vehicles actually increase traffic safety? If the ratio were greater than 1, the system would reduce traffic safety. Examples exist today whereby corresponding added benefits create acceptance for additional risks: For example, for many motorcyclists the experience of freedom, driving pleasure, etc., balances out the considerable additional risk compared to other means of transport. In addition the apportionment of benefits and risks facilitates the acceptance of motorcycling. The added benefits and the additional risk mainly affect the person on the motorcycle. The risk for other road users created by a motorcycle lies between the risks created by a bicycle and a car, and therefore motorcycling is acceptable without added benefits for other road users.

In this document, no specific value is determined for the acceptable ratio for autonomous driving, because this value is the result of a complex discussion among those who would be affected by autonomous driving. This value varies depending on various factors such as societal, political and economic differences. A vivid example of this is the acceptance of the use of nuclear energy in Germany, the USA or Japan in the last years: On the one hand, the accepted ratio varies considerably between the countries, and on the other, this changes over time, so that for example in Germany in 2012, a nuclear phase-out was decided on.

The central component of this document is the evaluation of autonomous driving, i.e. the study of the methods that are to enable safety assessment of autonomous vehicles. Even though a large number of papers describe the potential of autonomous driving in theory, the authors are not aware of any document that has conducted this evaluation. In order to show why this is so, we will first describe the current release concepts in the automobile industry, and then show what the requirements are for test concepts. In the third section, we describe the special features of autonomous driving in relation to current systems. On the basis of this, the fourth section looks at the special challenge for the production release of autonomous vehicles. The approaches that address this challenge are discussed, and then a conclusion on the production release of autonomous vehicles is drawn in the final section.

#### 21.2 Current Test Concepts in the Automobile Industry

The safety validation concepts currently used in the automobile industry are for obtaining approval for four distinct automation levels. To illustrate the difference for the test of these systems compared to autonomous driving, these four systems will be explained briefly.

The first system in series is the driver-only vehicle without the automation of the driving task. For these systems, it can be seen that, on the one hand, the components used do not exceed maximum failure rates, and on the other, that the driver is able to maneuver the vehicle reliably in road traffic (controllability). Here the abilities of the driver are relied on, as the results of the conducted tests with test drivers are transferred to future users in the subsequent area of use. Over the last decades, this has shown itself to be successful in serving as proof of safety. Despite the increasing number of kilometers driven in road traffic, the number of accidents remains constant, and the number of fatalities has even fallen.

The second level of automation in series is the assisting system: For systems such as Adaptive Cruise Control (ACC) or Lane Keeping Assist (LKA), their functions have to be covered by the test in addition to the existing scope of testing. The option of a take-over by the driver and controllability must be provided in systems that actively support the driving task, increase comfort, and reduce the burden on the driver. The Code of Practice [7] thus assumes that, in this Advanced Driver Assistance System (ADAS), responsibility for vehicle behavior remains with the human driver. For these systems it also applies that the abilities of the driver are relied on, so that the results of the conducted tests with test drivers are transferred to future users in the subsequent area of use.

The first partly-automated systems have also been approved for use in series cars: Depending on the speed, ACC in combination with LKA takes over the lateral and longitudinal control for the driver. According to the definition, in the third category of systems, the driver is also responsible for the vehicle behavior. Therefore, this test also focuses on the possibility for the take-over and the controllability by the driver; and so the same principle applies as with the assisting system, which relies on the abilities of the vehicle driver to correct undesired automation behavior. This level of automation presents the special challenge for the safety validation that results from the conflict between relieving the driver and the necessary situation awareness of the supervisor of the lateral and longitudinal control. However, here too the driver is ultimately responsible.

Of particular interest for the test are emergency intervening systems, which automatically intervene in the vehicle control and thus in the vehicle dynamics. The goal of this fourth category of systems is to counter the driver's loss of control over the situation. For example, Electronic Stability Control (ESC) and Emergency Brake Assist (EBA) are components of mechatronic brake systems that apply additional or reduced braking force without any action on the part of the driver, thus actively intervening in the vehicle dynamics. This is performed during the driver's loss of control, when the vehicle, in combination with the driver, is at a higher level of risk. ESC is designed in such a way that an intervention is carried out when the driver clearly no longer has control over the vehicle in the current situation (e.g. in the case of extreme over- or understeering). In contrast, the EBA becomes active when the reaction time and the braking distance before a rear-end collision are no longer sufficient for a human to prevent this accident. The goal of validating the system regarding safety requirements is to show that emergency intervening systems should only become active (true-positive) when the loss of control becomes obvious and thus there is a severely increased risk. For this, it must be shown that the false-positive rate becomes as small as possible and/or the effects can be controlled by the driver; the false-positive and false-negative rates of the EBA mainly depend on the object detection. Figure 21.3 shows a Receiver Operating Characteristic curve (ROC curve), which describes this relationship for the object detection.

As these emergency intervening systems are systems with no guaranteed operation, an increase in safety can be achieved by reduced usage combined with a smaller false-positive rate. Additionally, these systems enable overriding. ESC and EBA employ the selective braking of wheels to intervene mainly in the braking system, and various strategies can be used to override them, by steering and/or accelerating.

As has been shown, the main focus in the development of the four system levels is controllability by the driver. The goal is either to enable controllability for the driver or to restore it for him/her (design for controllability). Therefore, the driver as a backup is the basis for validating current vehicles regarding safety and hence also for the production release.

The development and verification of this controllability for the driver is generally carried out in accordance with the procedure model in Fig. 21.4. This procedure based on the V-Model differentiates between the downward branch on the left—development and

Fig. 21.3 Representation of the principle of a receiver operating characteristic curve based on Spanfelner et al. [8]. Image rights: Author has copyright

Fig. 21.4 Safety evaluation methods in the development process (according to [9]). Image rights: Alexander Weitzel et al. Federal Highway Research Institute report: Absicherungsstrategien für Fahrerassistenzsysteme mit Umfeldwahrnehmung

design—and the upward branch on the right—verification and validation—as a means of quality assurance. A test concept is followed for the quality assurance.

As shown by Schuldt et al. [10] in Fig. 21.5, a test concept comprises the analysis of the test object (object under test—OUT), the test case generation, the test execution and the test evaluation.

The analysis of the test object and the test case generation should be performed during the development/design phase, so that the test cases to be carried out are already defined for the verification and validation (see Fig. 21.4 procedure model). According to Horstmann [11] and Weitzel [9], at present a distinction is made between three methods for the determination of test cases: One method is the test specification based on the specification sheet, whereby test cases are defined based on system specifications, which have been set down in specification sheets. The second method is the risk-based test specification, whereby risk considerations are used to determine the test cases. The third method is the interface-based test specification, whereby the test cases are selected in

order to cover the value ranges of the interfaces. For all these methods, the driver-vehicle system is the basis of the test case determination.

To start with the quality assurance as early as possible, tests are already carried out in virtual test environments before the first test vehicles are ready for testing. The test execution by means of model- and software-in-the-loop tests works based on simulation models of the vehicle, the human and the environment. The test cases previously identified are used here. The further the development progresses, the greater the number of real components available for testing. Test benches, driving simulators or testing grounds are used in these tests. The tests performed using hardware-in-the-loop, driver-in-the-loop or vehicle-in-the-loop provide information about the quality of the components and functions being tested. To check the actions and reactions of the driver-vehicle-environment system (to close the loop), simulation models are also needed in performing these tests. Therefore, simulation models will be required continuously for the test execution up to this development point in order to test the entire vehicle. Simulation models are mappings of reality in software and have per se the property of simplifying the real world.

As a result of this fact, there currently exists no safety-relevant function in a series vehicle that has not also been tested with real test vehicles. Thus, for testing current systems, the automotive industry always falls back on real vehicles, real humans and a real environment.

A result of the necessary use of real driving is, for example, that before the production release of the Mercedes Benz E-Class (W212), a total of 36 million test kilometers were completed [12].<sup>3</sup> According to Fach et al. [13], the safety validation of a current driver assistance system alone requires up to 2 million test kilometers. After 50,000 to 100,000 km were covered in these test drives between two interventions of the first level of the EBA, this high number of test kilometers becomes understandable. This does not even consider the fact that the more critical second level of the EBA was not triggered during these test kilometers (compare assertion in Fig. 21.3). This eight-figure total of test kilometers is accompanied by considerable costs for the vehicle prototypes, test drivers, test execution and the evaluation of same. While the time requirement can be reduced by means of parallel testing with multiple vehicles, additional costs are incurred for the vehicle prototypes.

This example shows that even for current driver assistance systems, validating safety based on real driving in road traffic represents an economic challenge for the OEM (Original Equipment Manufacturer). This challenge grows further against the background of the increasing number of functions and widening ranges of variants and versions for each vehicle model. For example, Burgdorf [14], deduces a number of 160 · 2<sup>70</sup> variants for the BMW 318i (E90) with components such as body form, engine, transmission, drive, color, A/C, infotainment.

<sup>3</sup> "(…) The [E-Class] arrived by way of comprehensive virtual tests with digital prototypes and a total of 36 million test kilometers (…)." (Retrieved 28/07/2014).

Therefore, there are already endeavors to use other test execution tools alongside real driving for final safety validation. The only example of this known to the authors is the homologation of ESC systems. According to ECE Regulation 13H for the EU [15], there is the option to perform some of these tests in the simulation:

When a vehicle has been tested physically in accordance with section 4, the compliance of other versions or variants of the same vehicle type can be proven by means of computer simulations that adhere to the test conditions of section 4 and the test procedures of section 5.9.

Note that this only applies to the ESC system. As an example, Baake et al. [16] describe the homologation of ESC systems for vans from Mercedes-Benz in collaboration with Bosch and IPG CarMaker: Using what are known as master cars, a vehicle model was created in CarMaker, and these master cars were used to collect reference data on the basis of which the simulation model was validated. This enabled the simulation-based recommendation for the approval of further vehicle variants with different settings. Baake et al. also report on the transfer of this procedure to the Cross Wind Assist (CWA) function, although this has not yet been done.

#### 21.3 Requirements for a Test Concept

In order to discuss in the following section why full automation poses a particular challenge for safety validation, we will first describe the requirements for test concepts to assess safety. These are divided into effectiveness and efficiency criteria.

#### 21.3.1 Effectiveness Criteria

# Representative—valid

The requirement for representativeness has two aspects: On the one hand, the test case generation must ensure that the test coverage required is achieved. For example, a vehicle should not only be tested at 20 °C and sunshine, as it will be exposed to snow, rain and temperatures under 0 °C in real situations. Additionally, vehicle limit samples (tolerances during production) should be considered in the test case generation. On the other hand, the test execution must encompass the minimum degree of reality required. This means that the simplification in the representation of reality must not influence the behavior of the OUT nor the behavior and properties of the environment with respect to real behavior.

Variable The test execution must provide the option to implement all the test cases defined by the test case generation.

Observable For the test evaluation in particular, it is necessary to observe parameters of the test execution. Only when the situation can also be described it is possible to make the statement test "passed" or "not passed".

#### 21.3.2 Efficiency Criteria

Economical There are two parts to the requirement for the economical test concept: On the one hand, the test execution should be prepared and carried out as quickly as possible in order to be able to provide the persons involved in the development with feedback on the test object immediately. On the other hand, it must be ensured that the test execution is prepared and carried out at the lowest cost possible.

Reproducible Reproducibility greatly reduces the work required for regression tests. For example, if an error has been detected and the test object modified accordingly, the goal is to subject the OUT to a test in the same scenario as before.

In good time The earlier in the development process that a product can be tested informatively, the fewer the development steps that need to be repeated in the case of an error.

Safe The test execution should not exceed the accepted risk for all participants. This must be considered in particular for real driving, whereby road users are participating in the test without their knowledge.

The requirements described are fulfilled sufficiently by the current test concepts, and therefore the four different automation levels presented are approved. However, the recalls of all the OEMs, which affect millions of vehicles, indicate that these test concepts certainly do not address everything. Are these concepts also suitable for validating the safety of new systems such as autonomous driving for public road traffic? Nothing changes about the requirements presented. However, as will be described in the following section, the OUT changes greatly.

#### 21.4 Special Features of Autonomous Driving

In the following section, the difference between fully-automated driving and current driving in road traffic is explained. After this, the differences between the traffic systems for air travel, rail travel and road traffic are present in compact form, so that only limited findings from these areas can be transferred.

#### 21.4.1 Comparison Between Current Automation and Full Automation of Road Vehicles

For the previously described safety validation of the four levels of automation available in series, the focus was on the vehicle, and in particular on its controllability by the driver. In the combined representation of the three-level model for human target-oriented behavior based on Rasmussen [17] and the three-level hierarchy of the driving task based on Donges [18] in Fig. 21.6, this validation corresponds to the elements with the green background. The vehicle and its behavior in the longitudinal and lateral directions are tested; in the process, the behavior or abilities of the future driver are not tested, but only the possibilities for the test driver to control the vehicle in the test cases by means of steering and acceleration control. Therefore, the green box only overlaps slightly with the area that stands for the driver.

For full automation, the abilities of the driver are now omitted and he/she also no longer functions as a backup. The driving task, i.e. navigation, guidance and stabilization/control, is taken over by the driving robot. This means that for autonomous

Fig. 21.6 Three-level model for human target-oriented behavior based on Rasmussen and the three-level hierarchy of the driving task based on Donges [18]. Image rights: Donges?—to be clarified

Ref.: Rasmussen, 1983 Ref.: Donges, 1982

driving, there is no test of the controllability, but only a test of the operation of a technical system. On the one hand, this makes the test easier, because the uncertainties due to the human and its individual differences no longer need to be covered by the test. On the other hand, there is no longer the option to use test cases and test drivers to draw conclusions about other use cases. The human, who generally acts based on skills, rules and knowledge, is omitted.

For the safety validation of current systems, safety must be proven that results from the driver and the vehicle in combination; however, for the production release of the vehicle, at present the focus is solely on the vehicle. Additionally assumed, but not tested, is the "reliability" of the driver. In assessing the autonomous system in terms of safety, the safety now results exclusively from the technical system of the driving robot and the vehicle (yellow field of Fig. 21.6), which must be proven.

Figure 21.6 shows on the one hand that here the quantity of tasks that must be tested increases: The driving robot is required for a wide variety of application areas (see Use Cases Chap. 2) such as navigation, guidance, stabilization/control. This task quantity presents a particular challenge in public spaces without access limitations. On the other hand, the task quality of the technical system changes. Current systems are merely executive or are continuously monitored by a human, while for the autonomous system the execution of a task must fulfill the requirements of the safety discussed at the beginning of this document.

#### 21.4.2 Comparison of the Stipulations in Air Travel, Road Traffic and Rail Travel

Along with road traffic, there are other traffic systems in which automation has established itself. However, the following section will discuss the extent to which the challenges and solutions from these areas are transferable to vehicle automation.

The automation in (civilian) air travel does not currently provide any examples of full automation. Even if pilots only very rarely actually perform flying tasks, they are still present in a supervising and operating capacity. Table 21.1 provides an overview of the differences in the traffic systems, which was taken from Weitzel et al. [9] and Ständer [19]. For the safety validation, the safety concept for the traffic flow is of particular interest here, as this shows the differences between air travel and road traffic. Air travel operates in a legally self-contained traffic space, a collision warning system is mandatory, and external monitoring of operations is provided by air traffic control.

The railway traffic system provides examples of full automation: For example, an automated underground railway is in operation in Nuremberg. However, according to Table 21.1, even in this traffic system the safety concept for the traffic flow in particular differentiates between road traffic and the railway. There is a legally self-contained traffic space for rail travel; in addition, logic-based systems and external monitoring are used to avoid a collision between two trains.


Table 21.1 Comparison of the conditions in the traffic systems, taken from Weitzel et al. [9] and based on Ständer [19]

As a mixed operation, road traffic does not fulfill the condition of a self-contained traffic space and external monitoring. The differences show why solutions for the production release cannot be transferred directly to autonomous driving.

This comparison should not exclude the possibility that all solutions from air travel and rail travel are of no interest for road traffic. Certainly similar problems exist, such as the reliability of safety-relevant components.

#### 21.5 The Challenge of Releasing Fully-Automated Vehicles for Production (the "Approval-Trap")

As has been shown, the functions of autonomous driving as an OUT differ fundamentally from current road vehicles, but also from means of transportation in air and rail travel. Therefore, we now want to determine how meaningful the current test concepts presented would be when transferred onto autonomous driving. We will also discuss what the effects would be of continuing with the current test concept.

#### 21.5.1 Validity of the Current Test Concept for Autonomous Driving

It has already been explained that a test concept consists of test case generation and test execution. Now we want to discuss how and whether both are transferable to autonomous driving.

Test case generation The three procedures for test case generation have already been explained briefly in Sect. 21.2; these procedures are based on the assumption of the driver's driving capability. The question of whether a random driver can control the test object is tied to the legally stipulated driver's license. According to the Road Traffic Act (§ 2 Abs. 2 StVG), this driver's license is only issued if, among other things:


And according to § 2 Abs. 4 StVG, suitable is taken to mean:

A person is suitable for driving motor vehicles if he/she fulfills the necessary physical and mental requirements and has not substantially or repeatedly contravened traffic regulations or criminal laws.

On the basis of this required driving capability on the part of the driver, the test case generation is limited to example situations: It is assumed that when the test driver has mastered these example situations, he/she and every other driver with a driver's license will also master the other relevant non-tested situations when driving. These include situations in which the driver is actively driving, but also those situations in which the driver is supervising the system and, if necessary, takes over control. Therefore, in combination with the driver's license test, these test cases provide a metric that allows a conclusion to be drawn about the safety of the driver-vehicle system. The way in which it would be possible to optimize the practical driver's license test as an evaluation basis for assessing the driving capability is discussed by Bahr [20].

In the absence of the driver, the currently accepted metric no longer applies, and therefore the reduction of the test cases is no longer admissible. The test case generation for autonomous driving must cover the driving capabilities in particular—a new quality of functions—which the human previously brought to the driver-vehicle system. The theoretical and practical tests of the driver's license test do not represent the difficulty here. However, the following paragraphs—§ 10 Minimum Age, § 11 Suitability and § 12 Visual Faculty of the Driver's License Regulation—present the challenge. Therefore, these paragraphs stand implicitly for comprehensive requirements for the properties of the humans who perform driving tasks. The human who fulfills these requirements has


The authors are not currently aware of any method for validly testing these functions for a technical system. Therefore, the accepted metric and the reduction of the test cases no longer apply if the human is removed from the responsibility of performing the driving task. The current test cases are not meaningful for releasing automated vehicles for production, and therefore the test case generation must be adapted to the new system.

Test execution As has already been shown, different methods ranging from HiL to SiL to real driving are used for the test execution. At present, real driving is the most important method for the approval; the reason for this, in particular, is the validity combined with the justifiable economic overhead. However, along with the economic overhead, autonomous driving also presents a systematic challenge for the known methods. At present, real driving stands for driving in public road traffic with test drivers. The task of the test driver is to drive or supervise the vehicle in every situation in accordance with the task of the vehicle user. Transferred to autonomous driving, the use of a test driver in the driver's seat would be non-real behavior of a user, as the user does not have to supervise the vehicle and the environment anymore and intervene. Additionally, the vehicle could also participate in the road traffic without passengers (depending on the use case), and therefore a test driver would represent a non-real component in the vehicle. As a result, there is a risk that the use of a test driver could influence the other road users and alter their behavior. Further reflections on this topic can be found in the Chap. 7.

Therefore, along with the test case generation, the current test execution is not directly transferable to autonomous driving.

#### 21.5.2 Millions of Kilometers on Public Roads Until the Production Release of Fully-Automated Vehicles

The following theoretical consideration will show what it means to retain the current test concept despite the differences shown. Let us assume that a reduction in the test cases is not possible for autonomous driving, because no method exists, as with the driver's license test for humans. The objective is still to draw a conclusion as to whether the risk is increased or not by the use of the autonomous vehicle:

$$V\_{\text{acc}} = \frac{R\_{\text{add}}}{R\_{\text{ave}}} < 1$$

Here we should note once again that this condition is in no way imperative. However, for the theoretical consideration, a condition of less than 1 is assumed to be the worst case scenario.

The only metric that the authors are aware of that can be used to determine such a relationship are the figures from the subsequent evaluation of traffic accidents. For Germany, these are the figures from the Federal Statistical Office. For example, for 2012 the Federal Statistical Office [21] cites 3375 fatal accidents recorded by the police in Germany. The figure for fatalities is used because this represents the worst case scenario for the verification required. With a total of 709 billion km driven in Germany, this figure represents an average of 210 million km between two fatal accidents. As these figures only represent an expected value, shorter or longer distances also exist between two accidents. To represent this distribution of the accident events, we use the Poisson distribution:

$$P\_{\dot{\lambda}}(k) = \frac{\dot{\lambda}^k}{k!}e^{-\dot{\lambda}}$$

Here it is assumed that the occurrence of an accident is an independent and non-exhaustive random process P<sup>k</sup>ðkÞ. In the equation, k corresponds to the number of accident events and k to the expected value with which this event occurs. The expected value k is defined by the quotient

$$
\lambda = \frac{s\_{\text{test}}}{s\_{\text{pert}}},
$$

Fig. 21.7 Poisson probability distribution for the number of accidents with different expected values. Image rights: Author has copyright

whereby stest stands for the observed test kilometers and sleist for the performance of the system. The performance stands for the expected number of kilometers between the accidents. The probability distributions for <sup>k</sup> ¼ ½12345 and <sup>k</sup> ¼ ½1 2 are shown in Fig. 21.7 as an example.

The figure clearly illustrates the problem of providing verification of a certain level of risk: Let us assume that the blue distribution stands for an autonomous vehicle and the red distribution for a driver-only vehicle. Both vehicles are driven the same number of test kilometers stest ¼ as s, with the distance factor as ¼ 2 and the average interval s between two fatal accidents. The performance sperf ¼ aperf s of the autonomous vehicle is greater than that of the driver-only vehicle by the performance factor aperf ¼ 2. Consequently, for the autonomous vehicle <sup>k</sup> <sup>¼</sup> <sup>1</sup>, and for the driver-only vehicle <sup>k</sup> <sup>¼</sup> <sup>2</sup>.

Even though the autonomous vehicle is characterized by double the performance of the driver-only vehicle according to the previous assumption, during the test the autonomous vehicle was involved in a fatal accident (probability <sup>P</sup>1ð1Þ ¼ <sup>1</sup> <sup>e</sup><sup>1</sup> <sup>0</sup>; <sup>37</sup>), but not the driver-only vehicle (probability <sup>P</sup>2ð0Þ ¼ <sup>1</sup> <sup>e</sup><sup>2</sup> <sup>0</sup>; <sup>14</sup>). Therefore, a conclusion that the autonomous vehicle is less safe than the driver-only vehicle must be called into question. In any case, this example shows that a distance factor as greater than 2 is necessary to be able to draw a conclusion with a sufficiently high significance about the performance of autonomous driving.

From a scientific point of view, for example, an error probability of 5 % must be assumed, and therefore the same significance level <sup>e</sup> <sup>¼</sup> <sup>5</sup> % must be used. A correspondingly large distance factor as must be selected, depending on the number of accidents, in order to have a probability of less than 5 % for a vehicle with a lower performance to achieve this low number of accidents. Figure 21.8 shows the result of this consideration and the numeric calculation of the values.

Fig. 21.8 Distance factor at significance level 5 %. Image rights: Author has copyright

The data point at zero fatal accidents means that, with a distance factor of as 3, the probability is less than 5 % that a worse vehicle than the comparison group is not involved in a fatal accident.

Unfortunately, the probability of success for this test is just as small. Because if the test vehicle is just as good as the comparison group, i.e. performance factor aperf ¼ 1 applies, it follows that the probability of success for this verification is also only 5 %. For the test to be successful, a greater probability of success is desirable. As an example, a probability of success of 50 % is now demanded; by which a test shows that the test vehicle is not worse than the comparison group. For this, the test vehicle must perform better than the test group. Figure 21.9 shows the result of this consideration.

The first point expresses the following: If the test vehicle is approx. 4.3 times better than the comparison group, the test is successful with a probability of 50 % that the test vehicle with an error probability of 5 % is better than the comparison group.

What this result now means for the test drive with the autonomous vehicle is demonstrated by the distance of 210 million km between two fatal accidents. The last point in Fig. 21.9 expresses the following: If the autonomous vehicle is approx. twice as good ðaperf 2Þ as the comparison system (current vehicles), a test distance of at least 2.1 billion km must be driven <sup>ð</sup>stest <sup>¼</sup> as 210 Mio kmÞ. In this case, the verification has been achieved with 50 % probability, but five accidents would also occur with the same probability.

Ironically, it follows from this consideration that the easier the vehicle driving is, the greater the number of test kilometers that must be driven, as the comparison value is correspondingly higher. For the interstate pilot, the current figures of the Federal Statistical Office indicate a comparison value of 662 million km between two fatal accidents. Accordingly, 6.62 billion test kilometers must be driven on the interstate in order to correspond to the presented conditions.

This theoretical excursion into statistics shows that production release can become a challenge, if not an actual trap, for autonomous driving. Hereby, a number of factors for determining the test kilometers have not been addressed yet; for example, a variation of the system would mean that the test kilometers would have to be driven again, or the test with and without passengers could use a factor of two in the calculation. The effect on the determined necessary kilometers of different parameters not considered here such as area of use, accident severity, accident cause and comparison vehicle, is derived in detail in Winner [22].

These considerations are theoretical observations with freely made assumptions. However, this approach is still suitable for illustrating the problems and challenges, and for motivating the approaches that follow here.

#### 21.6 Possible Approaches for Solving the Challenge of Testing

As has been shown, autonomous driving represents a new OUT which, due to its properties, calls the classic test concepts into question. New approaches are required to overcome the testing challenge described: Accordingly, the next section will discuss why reusing approved functions, and thus an evolutionary approach, seems necessary from the perspective of safety validation. After this, we will discuss existing approaches that could speed up testing.

#### 21.6.1 Reusing Approved Functions

The first and simplest possibility of obtaining the production release for a new system is in reusing functions already released. If a system is used in the same way as before, a release already issued can be taken over. However, if the scope of functions is expanded, this must be treated again; the smaller the new area involved is, the less work is required.

Based on this argument, an evolution across all dimensions would seem to be a possible approach for overcoming the testing challenge. Dimensions here refers, for example, to the speed, the area of use but also the degree of automation. A distinction can be made between two perspectives in selecting the evolution steps: From the perspective of a function developer, due to the reduced speed and the limited access to the scene, the interstate during a traffic jam is a suitable starting scenario. From the perspective of the previously presented statistical considerations, a meaningful starting scenario would be one in which the human as a comparison group would perform as badly as possible, i.e. making as many errors as possible. As many errors as possible means a short distance, making the verification of the performance easier.

The revolutionary step—an autonomous vehicle without evolutionary intermediate steps—contradicts this approach and seems unlikely.

#### 21.6.2 Speeding up the Testing

Despite the evolutionary approach, the safety of new functions still has to be validated. To speed this up, there are basically two adjustments that can be made: Firstly, the What can be changed, and secondly the How. What test cases need to be inspected, and how will these tests be performed? Schuldt et al. [10] call this the test case generation and the test execution.

#### 21.6.2.1 Test Case Generation

The test case generation defines the tests to be carried out. According to Schuldt et al. [10], the large number of influencing factors in the area of use and their value ranges result in a conspicuous number of test cases. As already described, the systems currently in use are based on the capability of humans and their options for controlling the vehicle. This results in a stark reduction in the test cases theoretically required. Therefore, a metric exists that enables a conclusion about the safety without testing all the situations. This reduction does not apply for the autonomous vehicle, and therefore new ways must be found of reducing the number of test cases for the autonomous vehicle. During the test case generation, the requirements for a test concept detailed in Sect. 21.3 must be considered. In particular, the representativeness is at risk when test cases are omitted.

Here the approaches from Glauner [23] and Eckstein [24] describe the identification of relevant or critical situations in public road traffic. Based on previously defined event classes, potential critical situations are identified during the test drives or large-scale field studies. These critical situations are incorporated into the test case generation, and less critical situations can be omitted as a result. This reduction is based on the assumption that situations that are less critical are covered by critical situations. A task that remains unsolved at present is the search for a valid measure of risk that enables an evaluation in the first step, and the selection of critical situations in the second step.

Another procedure for reducing test cases is provided by Schuldt et al. [10]: A generic test case generation is proposed to cover factors influencing the safety ensured by the system as sufficiently as possible. This should use black-box testing procedures and combinatorics, and also be low-redundancy and efficient. This approach is based on statistical considerations without knowledge and experience of the test object, but it still has the potential to reduce the test cases required.

The approach described by Tatar and Mauss [25] is also suitable for black-box testing: an optimization is used for the generation of test cases. Here the input variables of a XiL simulation are varied in such a way that the evaluation function to be defined for the test is optimized. Despite the challenge of the valid XiL simulation and the required evaluation function, this approach provides the option to focus the test cases on those evaluated as relevant.

A fourth theoretical approach is to use and test a safety concept using formal methods [26]. Similarly to the human assumed to be a monitor and a part of the safety concept of current vehicles, a verified reliable safety concept could make testing the overall functionality of the vehicle in its complete representativeness superfluous. This would make a reduction of the test cases possible.

#### 21.6.2.2 Test Execution/Test Tool

Along with the possibility of reducing the test cases during the test case generation, the test execution also has potential for speeding up the process. However, if we deviate from real driving and select another testing tool for the test execution, there is always an attendant simplification. This is described in more detail by means of Fig. 21.10.

Figure 21.10 divides the testing tools into nine classes which are differentiated based on how the vehicle and the environment are represented. The passenger is assigned to the vehicle in this representation, as he/she is situated in the vehicle and does not actively intervene in the autonomous driving.

Real driving represents both the environment and the vehicle in reality. Accordingly, during these tests there is the risk of real accidents and their consequences. The environment is not controlled, and this results in test situations based on the randomness of reality; accordingly, the reproducibility for complex situations with other road users is not a given. This testing tool can be used, at the earliest, with the first roadworthy prototypes, and therefore occurs at the end of the development process.

Fig. 21.10 Classification of testing tools for testing autonomous vehicles. Image rights: Author has copyright

An alternative is to test real vehicles in an artificial environment: This corresponds to driving on a test ground, as there situations are created artificially on the one hand, and on the other the "road users" are conscious of being involved in a test. Reality is simplified for the benefit of safety, variability, observability and reproducibility. From economic perspectives, while the test cases are tested specifically and do not have to be experienced randomly as in real driving, setting up the test field requires additional time and financial resources.

Additionally, an artificial vehicle could move within a real environment; in this case, artificial refers to equipping the autonomous vehicle with a supervisor, for example, that has the option to intervene in the driving task. This could be a test driver with a steering wheel and pedals, or alternatively a technical system that is superior to the series system due to its more powerful (additional) sensors. If components are represented artificially, the closeness to reality suffers, but gains are made in terms of safety, reproducibility and observability.

Along with the option of creating the environment and the vehicle artificially, there are tools that use a virtual representation in the form of computer simulations. Here the two fields that combine the real and the virtual have a gray background, because strictly speaking they do not exist, because the task of sensors and actuators is to switch between virtual and real signals. A real radar sensor cannot sense a virtual environment, and a virtual converter cannot create real voltage.

However, what are possible are combinations of artificial and virtual environments and vehicles. Examples of this are provided by different concepts of vehicle-in-the-loop (ViL). To close the loop made up of actions and reactions of the environment and the vehicle, real components are mapped in the simulation in the form of models. Here either the sensors or actuators mentioned are stimulated, i.e. artificially instigated (examples of this are simulation-based videos as stimulation for camera systems or dynamometers as stimulation for drive actuators), or the testing tools directly simulate the power signals, such as the electromagnetic wave, and try to represent real effects of sensors and actuators in the simulation with the aid of models. For more information on this, see Bock [27] or Hendricks [28]. The use of models described calls the meaningfulness of these testing tools into question. To get valid results using such models, it must be verified that these models do not contain any impermissible simplifications; here impermissible is to be seen in the context of the function, and means that deviations from reality are only permissible below the tolerances of the function. However, if this validity has been verified, the testing tool enables greater safety during the test execution, as parts of the environment and the vehicle only encounter each other in the virtual world. Due to the virtual components, these testing tools are distinguished by greater variability, observability and reproducibility. From an economic perspective, this testing tool has the advantage of varying the virtual environment easily or representing the vehicle in a wide range of variants. An economic disadvantage could be the validation of the models (see below). An advantage of this testing tool is the option, based on the simulated vehicle, of performing tests early on during the development.

The last level of abstraction represents the combination of a virtual vehicle and the virtual environment: The software-in-the-loop testing tool represents the closed control loop by modeling relevant components in the simulation. In contrast to the previous testing tools, the entire testing world is virtual. The tests are safe, variable, observable and reproducible; there is also the option of using this tool early on during the development. The economic advantage is provided by the hardware independence, as there is no connection to real time any more. The execution of the tests is only limited by the computer power; simulations can be run day and night, and also parallel on a large scale. On the other hand, there is the necessary closeness to reality of the virtual test world, and therefore of every individual model: Only when the validity of the models used can be verified are virtual tests sufficiently conclusive for a production release. Accordingly, for the economic consideration of simulation-based procedures, the validation of the models must be considered above all.

The same challenge exists for the use of formal methods. Mitsch [26] writes in this context: "We do (…) prove that collisions can never occur (as long as the robot system fits to the model)." This means that even for formal methods, the degree of reality of the models used determines the conclusiveness of the results. For example, a particular challenge that is therefore a focus of the research is the formalization of the uncertainties of sensors or the property of other road users.

The discussion relating to testing tools shows the potential to speed up the testing. With the aid of the artificially created environment and vehicle, test cases can be set up and executed specifically. Additionally, the virtual approach enables the tests to be speeded up and run in parallel, depending on the computer power used.

However, the discussion also shows that the validity of the tests, and therefore their conclusiveness, presents a challenge when artificial and virtual components are introduced.

#### 21.7 Conclusion

Autonomous driving is distinguished in particular by the omission of the human supervisor of assisted or partially-automated systems, and the supervisor's ability to correct these systems. The metric consisting of real driving and driver's license test that enables a conclusion about the safety of automation levels currently present in series production, is no longer valid for autonomous driving. The resulting loss of the reduction in the test cases means that current test concepts are not suitable for economically assessing the safety of a new system such as autonomous driving. Adhering to current test concepts would involve an economically unjustifiable overhead, and would result in an "approval-trap" for autonomous driving. However, the authors see three approaches for avoiding this "approval-trap".

Firstly, the evolutionary approach, or alternatively the transformation (see Chap. 10), seems necessary, as only the step-by-step introduction along the different dimensions of speed, scenery and degree of automation enables existing components to be taken over and reduces the range of tasks for the following releases. Secondly, the necessary test cases must be reduced based on field experience and statistical procedures. The challenge here is the metric that allows a conclusion to be drawn about the safety of the system based on the completed test cases. Thirdly, alternative testing tools must be used alongside real driving. Here it is not expected to be able to do without real driving completely, because a verification of validity is required to move test cases to ViL, SiL and procedures that formally prove safety.

Finally, it must be stated that the challenges presented should not only be solved internally by the automobile industry. Even if test concepts are optimized for autonomous driving, there will not be 100 % safety. Vision Zero remains a vision for now, particularly in mixed operation with additional road users. With the first accident caused by an autonomous vehicle, at the latest, the previously issued release will be put to the test. Accordingly, the basis for the production release should be discussed publicly by all concerned and be designed transparently.

Open Access This chapter is distributed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, duplication, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, a link is provided to the Creative Commons license and any changes made are indicated.

The images or other third party material in this chapter are included in the work's Creative Commons license, unless indicated otherwise in the credit line; if such material is not included in the work's Creative Commons license and the respective action is not permitted by statutory regulation, users will need to obtain permission from the license holder to duplicate, adapt or reproduce the material.

#### References


# 22 Do Autonomous Vehicles Learn?

Walther Wachenfeld and Hermann Winner

### 22.1 Introduction

With autonomous driving, a technological system will replace humans in driving automobiles. The car industry, universities, and large IT companies, are currently working on implementing functions permitting a technological system to take on vehicle operation. Their focus is on the tasks that are also done by humans: of perception, cognition, deciding how to act (planning) and carrying out this behavior (acting). In addition, humans possess further capabilities not directly connected to driving a vehicle. For example, learning directly changes people's capacity to tackle tasks. In the driver-vehicle-environment system, this human capability raises a question: Will the technological system that is to replace humans also exhibit a capacity to learn? In the most diverse fields, primarily IT-driven ones, there are learning and learned systems of the most varied kinds, which rival conventional analytical systems in their performance. What marks out vehicle automation, though, is firstly its relevance to safety; secondly, how cars as a product additionally differ from other IT-industry goods in their system life cycles. Both of these particularities, with their challenges and attempts at solutions, are the subject of this chapter. Attention is also given to collective learning in the context of autonomous driving, as directly exchanging with and copying from the learned is one of the particular advantages machine learning has over the human version.

Replicating human learning in machine learning occupies a whole area of research. It is expected that examining the processes of human learning will both provide a deeper

W. Wachenfeld (&)

Institute of Automotive Engineering, Technische Universität Darmstadt, 64287 Darmstadt, Germany

H. Winner Institute of Automotive Engineering, Technische Universität Darmstadt, FZD, 64287 Darmstadt, Germany

© The Author(s) 2016 M. Maurer et al. (eds.), Autonomous Driving, DOI 10.1007/978-3-662-48847-8\_22

understanding of this process and improve applied machine-learning methods. With reference to the currently understood difference between both forms of learning, machine learning is understood in this chapter as an algorithm generated by a human. The running of the software follows these algorithms, just as with all other software. Our objective is not to compare a learning human with a learning robot. Rather, it is to discuss why, whether, and with which challenges and approaches machine learning is possible in its current form in autonomous driving. This chapter portrays the view of vehicle technology in particular on this question, and is based on experience from the literature for the area of machine learning.

#### 22.2 Vehicle, Environment and Learning Drivers

When a driver drives a vehicle in any environment, it constitutes target-oriented behavior. According to Rasmussen [1, 2], people display behavior here that can be divided into three areas. They behave according to their skills, rules, and knowledge (see Fig. 21.6 in Chap. 21). Skill-based behavior is described by Rasmussen [1] as stimulus-response automatism, which people overcome in routine everyday situations without placing intensive demands on cognitive capacities.

Rule-based behavior proves to be more cognitively demanding. It requires associative classification in addition to perception and motor actions. People in this case match the recognized situation to a known rule and, based on this, select from a repertoire of behavioral rules. People have learned these rules purposely, or noticed ("saved") them in past situations and behavior. This gives people the ability to identify similar situations and transfer learned rules to them.

Should situations arise that are new for people, and for which they have no trained behavior, then their response will be knowledge-based. People try, based on their trained knowledge, to generate and evaluate the alternative ways to act that are available to them. The subjectively optimal alternative is selected and carried out.

Rasmussen's [1] understanding of target-oriented behavior makes clear what is meant by a learning driver. At the beginning of their "career," a driver builds up their basic knowledge of road traffic in theory courses at driving school. This is then tested. In the process, this knowledge builds on what has already been learned by living in society. In addition, rule-based behavior is trained via theory and practice lessons. Upon obtaining their driver's license, people can then drive on public roads without further supervision (exception: driving when accompanied with a license at 17 in Germany). However, drivers at this point in time have neither learned all the rules nor processed the knowledge needed for their future lives on the road. With each new piece of experience they gain, their behavior transforms from knowledge-based to rule-based, and from rule-based to skill-based. Training thus enables an increase in efficiency in human behavior [1].

If we consult the figures for car drivers involved in accidents per million passenger kilometers, then according to Oswald and Williams [3, 4] the risk falls with increasing human age, until it starts to rise again from 40 to 50. According to Burgard [5], experience gained with age is responsible for this, alongside character skills (personality) and mental and physical prerequisites. If we view the assimilation of experience as a learning process, then the capacity to learn contributes to improved driving skills [6].

If road traffic followed clear and known rules, people would not need to behave in the ways described above. Road traffic, however, is an open system consisting of static and dynamic objects, and a multitude of environmental factors such as light levels and rain. Even if only to a limited extent compared to beginner drivers, experienced road users continue to come across unknown situations that need dealing with. It is because people show just this knowledge-, rule- and skill-based behavior that today's road, with its efficiency, accuracy, and safety, is possible.

Further, this behavior leads to individually varied driving behavior. In one and the same situation, drivers act differently and have different preferences in selecting distances, speeds and acceleration.

It is precisely these capabilities enabled by skill-, rule-, and knowledge-based behavior that will be taken out of driving upon automation, and replaced with corresponding capabilities in driving robots.

#### 22.3 Learning Technical Systems

The term machine learning stands for a research area dealing with methods for designing algorithms. A particular feature of these algorithms is the automatic improvement of technical systems based on experience. In this, the automatic improvement follows rules and measures previously defined by the human developer. The hotly debated ideas of completely free and creatively acting machines, were they to exist at all, are not our focus here. In employing machine learning, a clearly defined task is needed, with accompanying assessment metrics and (training) data.

An oft-used quote for the definition of machine learning is from Mitchell [7]:

A computer program is said to learn from experience E with respect to some class of tasks T and performance measure P, if its performance at tasks in T, as measured by P, improves with experience E.

According to Mitchell [7], machine learning has proved itself in service particularly in the following circumstances:


How these definitions and their usage areas fit to autonomous driving is discussed in Sect. 22.4. First, however, we shall take a look at the processes of machine learning. With the aid of examples from various fields, we will explore the range of usage possibilities before examining the task of autonomous driving in particular.

#### 22.3.1 Overview of the Various Machine-Learning Processes

Breiman [8] noted the following in 2001:

In the past fifteen years, the growth in algorithmic modeling applications and methodology has been rapid. It has occurred largely outside statistics in a new community – often called machine learning.

In [9], the first machine-learning operations are traced back to McCulloch and Pitts in 1948, among others. The multiplicity of learning processes thus makes a detailed description of all of them impossible. Therefore, the following will describe categories of learning problems into which we may at least group the processes [10–12].

Supervised learning Supervised learning, or learning with a teacher, is characterized by pre-assessed training data (labeled data). This training data—the experience that machine learning builds on contains the input and output parameters of a learning problem. In the classification of whether airbags are deployed in an accident or not, for example, training data would consist of acceleration values and the corresponding assessments (deploy or not). These assessments must be made by an expert/teacher, for example, or by observation over time. The learning process then uses these empirical values to determine the output for newly observed input values. In the transfer of empirical values onto new input values, we can distinguish [10] between lazy (memory-based) learning and eager (model-based) learning.

In lazy learning, the training data are saved during the learning and a similarity measure is defined. This similarity measure can vary in its complexity, and ranges from the simple Euclidian distance to complex distances in case-based reasoning. When output values are sought for new input values, the most similar training data to the new case are determined and output values derived from them. This procedure corresponds to transductive inference [13]. In eager learning, in contrast, a global model based on training data is constructed during the training phase (induction). Output values for new cases are obtained by deduction from the model.

Unsupervised learning For unsupervised learning, or learning without a teacher, training data are also on hand, although in this case with no assessment or output values (unlabeled data). In this learning process, the aim is to find a structure in the data, and classify the data according to the structure. The training data are here used to reveal these structures and, based on this, to classify newly observed input values.

Reinforcement learning Reinforcement learning differs from both of the previous processes in that few or no training data are available to begin with. The training data required for a striven-for improvement are collected by an agent<sup>1</sup> itself by carrying out the task to be optimized according to a fixed scheme. An assessment of the execution of the task feeds back into the learning process, forming a training dataset of input and output values that are used for further optimization steps. The approaches of reinforcement learning are exposed to the so-called innovation dilemma, for "exploration" and "exploitation" contradict each other. March [15] describes it thus:

Exploration includes things captured by terms such as search, variation, risk taking, experimentation, play, flexibility, discovery, innovation. Exploitation includes such things as refinement, choice, production, efficiency, selection, implementation, execution.

Corresponding to the learning problem, a balance for both has to be found, as, on the one hand, an optimal execution is sought in a partly unknown search area, and, on the other, this search is limited by external conditions such as costs, safety and time.

Alongside the question of whether, and in what form, training data are available, the learning problem can also be distinguished based on the use of training data.

Batch learning In batch, or offline learning, a set of training data is applied at a time point to make use of the learning methods. If the learning method produces a model, for example, this model is not updated by further experience gained during its use.

Online learning Online learning is characterized by an iterative process, in which new experiences are incorporated into the learning process. The aim is to continually optimize how the task is tackled, in the process incorporating experience from the operation. This results in system behavior changing from experience and thus over time.

These different types of learning problems require the use of various methods of machine learning [12]. These range from decision trees, artificial neural networks, and genetic algorithms to support vector methods, instance-based learning, hidden Markov models, value iteration and Q-learning, etc. These methods have in common that how well they deal with a learning problem depends on three fundamental properties. Firstly, the methods are only in a position to optimally solve the learning problem if data (experience) relevant and representative to the operation are used in sufficient quantity for learning. Secondly, the same applies for the quality of training data, so that the handling of noisy, inaccurate or partial data is especially necessary for actual measured variables. Alongside the test data, the assessment of performance (P) represents a further challenge. The

<sup>1</sup> Russell [14] defines it thus: "An agent is anything that can be viewed as perceiving its environment through sensors and acting upon that environment through effectors.".

methods will also only correctly deal with the learning problem if the assessment is valid with real data for the whole operational area.

#### 22.3.2 Examples

The following examples serve as a small sample for areas that can be addressed with the processes of machine learning.

Airbag deployment [16, 17] The learning problem consists of classifying sensor values to order the deployment of a vehicle airbag. A classifier is learned for this, which puts accidents either in the class of "deploy" or that of "do not deploy." In this example, the dataset of an accident has 30 dimensions, and consists, for instance, of acceleration, pressure and impact-sound sensors at various positions in the vehicle. For 40 training datasets, in which the sensor values are recorded for representative accidents, it is annotated (labeled) whether an airbag deployment would be necessary or not.

# Vehicle-path control system with artificial neural network [18]

The ALVINN (Autonomous Land Vehicle In a Neural Network) project had the aim of positioning a vehicle on its optimal path within its lane. The training data consisted of the input parameters of the individual pixels of a camera image, and the associate output parameters of the steering angle. These are recorded during the journey of a human driver. An artificial neural network whose 960 input nodes receive the individual values of the 30 × 32 pixels of the camera image is learned. These input nodes are connected via 4 hidden nodes with the 30 output nodes, which each stand for a different curvature.

#### 22.4 Automation that Replaces the Learning Driver

For the car industry, machine learning and artificial intelligence are of interest not only for the automation of driving, but also in other fields such as design, production and after-sales management [19]. These areas, and that of infotainment, are not our concern, however. Our focus is on vehicle automation, which, as presently understood, consists of the following components in moving a vehicle on public roads:


These components give the properties that have, according to Mitchell (see Sect. 22.3), already led to successful machine-learning operations. Increasing perception of environmental and vehicle state variables gives an enormous amount of machine-readable information. Firstly, this is down to continued increases in sensor performance and signal processing power, so that a detailed picture of the world is available for machine processing. Secondly, the numbers of sensors and vehicles equipped with them are rising as we approach full automation. It follows from this that the quality and quantity of training data for machine learning is increasing. The second property especially applies for certain areas of cognition and behavior decisions, since work on the human processes that are to be replaced is largely theoretical at this stage (Sect. 22.2). Based on the EU-funded Human Brain Project and associated studies, it is evident that there are still many questions that remain unsolved, and that the knowledge needed for effective algorithms is lacking. The third property is generated by road traffic. As already described in Sect. 22.2, the world in which vehicles move requires adjustments to be made to changing environmental conditions. This is why machine learning in automation suggests itself to be implemented in such a way that it will be able to adjust to these changes.

Alongside these three motivators for employing machine learning, however, there are particular challenges opposed to it. What the four components needed for autonomous driving (perception, cognition, behavior planning, behavior execution) particularly have in common, as opposed to other machine-learning applications, is the intervention in the actual behavior of the vehicle. This means that, regardless of where undesired behavior appears in this chain, it may develop into a breakdown or an accident. In order to debate the deployment of machine-learning processes in vehicle automation, we will now classify safety-related systems and allocate vehicle automation to one of these classes.

#### 22.4.1 Safety Systems

According to ISO26262, safety is the "absence of unreasonable risk." The extent to which a system in a car (or also generally) impacts this safety can be determined in the following ways ([16] extended):

1. Not safety-relevant

Errors in these systems do not lead to any dangers for persons or the environment. Language recognition, where machine-learning processes are often employed on [20], is not safety-relevant, for example, when used in infotainment. Such systems are therefore already in use; although errors do regularly crop up to some extent, they do not negatively impact safety.

2. Safety-relevant

A system is deemed relevant to safety if an error in it may result in danger to persons or the environment.

a) Decision-making support systems

Here, the decision maker has the choice of whether to act on the system's suggestions or not. An anesthetist, for example, receives suggestions for dosages based on information on the patient, operation, and previous experience. A system error would endanger the patient, though only when the anesthetist follows the suggestion [21].

b) Systems for monitoring and diagnosis

A system error leads to a warning failing to appear and can, if the error is not otherwise spotted, become a danger to people and the environment. If a diagnostic system in industrial machinery fails, the absence of this diagnosis may be dangerous [22].

#### 3. Safety-critical

Systems where an error directly leads to persons or the environment being endangered.

	- If an action is carried out automatically without additional conformation, then a failure of an automatic system directly leads to a hazard for people or the environment. If the system is additionally supervised by a human, and if the possibility of correcting it is provided, then this hazard may be avoided. The person supervising brings the system back under control, so that human involvement creates fault-tolerance. It is to be kept in mind here that, particularly with increasing automation of processes and the further relieving of human tasks, people's capacities to supervise an automated process will decreases [23]. The so-called congestion assistant, as partially automated vehicle control, represents just such a safety-critical system, as faulty system behavior would pose a direct danger. This danger, however, is addressed by the driver's supervision, because the congestion assistant is developed in such a way that humans, by intervening, correct the faulty system behavior. The system is designed for controlability.

The most critical form of automation in terms of safety is that with no possibility of correction. Without supervision, a failure of the system leads to danger and, depending on the situation, damage to people or the environment. Fully automated driving falls in this category, as, by definition, the vehicle's occupants are no longer supervising it. Undesired behavior, or a failure or malfunction not addressed by the system, thus leads directly to people and the environment being put in danger and possibly harmed.

This categorization and the classification of autonomous driving in the unsupervised automation category shows why machine-learning processes as they currently stand cannot simply be carried over from the two levels less critical to safety (non-critical and relevant). Not without reason are the safety-critical examples from Sect. 22.3.2 reports on studies without reference to non-supervised application.

The application of machine-learning processes in unsupervised or non-correctable automation requires further differentiation, as different challenges arise depending on the point in the vehicle's system life cycle.

#### 22.4.2 Challenges and Problem-Solving Approaches in the Various Phases of the System Life Cycle

In this account, vehicle life cycles are broken up into five phases—research, development, operation, service and change of user/end of vehicle life—as various challenges await machine learning in each phase.

#### 22.4.2.1 Research

When machine learning is applied in the research phase, the aim is mainly to establish what its processes can do. The examples range from online, offline, supervised and unsupervised, to reinforcement learning. Exemplary training datasets are drawn on as databases. The same applies when assessing process performance and robustness. This is carried out under controlled and/or supervised conditions, based on exemplary test data or test runs. In particular, controlled conditions and/or deploying trained test drivers (Category 3a Sect. 22.4.1) make faults tolerable, so that there are a multitude of existing examples. Accordingly, proving its safety does not belong to the challenges of using machine learning. The challenge here lies in accessing representative data for its later area of application. The question thus arises of whether the research findings can be transferred to the development and operational phases of the system life cycle.

#### 22.4.2.2 Development

Learning during the development phase can be compared with offline learning. As many application-relevant training data as possible are selectively gathered, for example to learn a model during development.

The fulfilling of safety demands in the results is, as in all other safety-relevant vehicle components, verified and validated, so that the vehicle can be released for production and operation. Afterwards, neither the learned model nor the classification change further. The learning process does not work online and is not adaptive, and thus does not use further data gained in operation as training data to update the model or classification. During use, it thus constitutes a time-invariant system, where the known methods for verification and validation remain valid. But it should be borne in mind that the results of the various machine-learning processes can vary in their interpretability. For example, learned decision trees of limited extent, or a manageable set of learned rules, are easy to interpret [24] and thus permit the use of white–box test procedures [25]. Other methods such as random forests or sub-symbolic neural networks, on the other hand, are difficult for testers to interpret and thus represent a black–box.

For such complex components, proving safety poses a large challenge compared to analytical models. Because the brute force test,<sup>2</sup> as for most analytical models, is not

<sup>2</sup> The brute force approach stands for testing all possible combinations of the parameters influencing the object under test behavior.

suitable [26] for systems with high input dimensionality, the following four countermeasures from Otte [24] are often used as a result:


Each of these measures restricts the potential of machine learning in order to allow testing of the learned model.

#### 22.4.2.3 Operation

When the fully developed and manufactured vehicle is put into operation, data accrue on the real usage area, the static environment, other users and their behavior, and the vehicle user and occupants. In addition, the vehicle has data on its machine behavior over time. This directly available new information, which was previously inaccessible, encourages the use of online learning processes, and thus also adaptive systems. The vehicle thus becomes a time- or experience-variant system. This further degree of freedom in a changing system with no additional supervision results in a particular challenge in testing and safety validation, one that has not yet been solved for time-invariant autonomous systems, see Chap. 21. Basically, there are two options for how a system that changes during operation could be made safe. One option is to limit its adaptivity to a clearly defined enveloping area, such as the strategies of Adaptive Transmission Control [27]. Here, input, output and state spaces are restricted to a few parameters [28], so that, from where we stand, validation and verification during the development phase appears to be possible. Should this restriction contradict the purpose of machine learning during operation, then an online check of the changing, time-variant and complex system becomes necessary [29]. The following two approaches can in turn be applied here [29].

# Runtime verification and validation

In contrast to conventional procedures of verification and validation during the development process by the developer, the system applies verification and validation methods during operation [26, 29, 30]. In principle, the adaptation process is seen as a feedback loop. Figure 22.1 shows the four stages of observation, analysis, planning and execution, which, according to Tamura et al. [30], are necessary for a structured examination of the adaptation process. This picture can be directly transferred to online learning processes. If a system adaptation is detected in this process, this then needs checking with runtime verification and validation processes before being applied to the software running. These

checks include whether, due to the applied changes to the system, it stays within the viability zone. For autonomous driving, this means checking that any changes to the driving robot comply with safety regulations before implementing them.

The procedures applied here, such as model checking or theorem proving, reach their limits at this point, as described in Chap. 21. Using a software-in-the-loop procedure may also be possible, although it is questionable if there is sufficient processing power for such processes in production vehicles.

# Validation and verification via monitoring and fault tolerance

If a system safety check prior to updating the software is not possible, a fault may arise and lead to failure and thus also danger. To avoid this, the system is to be designed as fault tolerant. Such a fault-tolerant system fundamentally requires two components [31]. Firstly, monitoring of system states and behavior to decide, based on an analysis, whether there is a fault. Secondly, redundancy is required that can be transferred to in case of a fault. Figure 22.2 shows this set-up schematically. This principle corresponds to a human supervisor who takes over a part-automated vehicle control system when a fault occurs.

What this shows is that machine learning during operation poses a challenge, especially for validating safe behavior. Both procedures—runtime verification and validation and verification and validation through monitoring—need a way to measure safe driving. Approaches for such measurements are outlined in Sect. 22.4.3.

Another approach is supplied here by a comparison with human learning. Road users accept that humans, with no further screening, learn based on the measures they take while driving and adjust their behavior accordingly. Checking whether adjusted behavior complies with traffic regulations does not transpire directly but, rather, sporadically via

police speeding and traffic checks. In addition, other road users report highly erratic behavior, such as accidents, so that human drivers receive feedback in their learning process. Transferred to the technical system, this would mean that machine learning leads directly to an adjustment of behavior. The test or check of whether this adjustment was legitimate would follow in retrospect from other road users, the police or a special supervisory authority. This approach reduces the demands placed on online validation and verification, as the skills of other road users are incorporated. If this test does not take place until after the functions have been modified, and if there is also no other possibility of intervention (in the control system), operating the updated but untested functions would pose higher risks.

#### 22.4.2.4 Service

Alongside machine learning during development and operation, there is a further phase in the system life cycle where learning can take place. As part of servicing, training data gathered by the vehicle can be downloaded and the vehicle functions updated. This does not necessarily require the vehicle's physical presence [32]. This procedure opens up the feedback loop in Fig. 22.1. Corresponding to a further development stage, training data and planned adaptations can be tested, so that the software system can be updated later after safety has been assured. As these methods of machine learning can involve personal data leaving the vehicle, security as well as safety needs to be borne in mind. For a more in-depth look at this, see Chap. 24.

#### 22.4.2.5 Change of User/End of Vehicle Life

Should, as is hoped, a vehicle be able to personalize how it drives for a user, or optimize this for an area of operation, then, with a change of user or at the end of its life, these learned capabilities and knowledge should stay with the user and not the vehicle. This capacity then becomes of particular interest when, for example, ownership patterns change as in Vehicle on Demand (see Chap. 2) where the user does not purchase a car but only its mobility service. In principle, it is not difficult for a technical system to transfer knowledge. It is actually a strength of artificial systems that they can transfer this information without the long-winded learning process. This is examined in more depth in Sect. 22.5.

#### 22.4.3 Measures of Safe Driving

As described in the previous chapters, an evaluation of the vehicle's driving in safety terms is needed for both the machine-learning process in general and verification and validation during operation. In the first instance, it can of course be seen retrospectively if an accident has taken place, with what impact speed and energy, and how it came about. This measurement has the drawback that the accident should not, if possible, have taken place in the first place. It follows from this that, for a safe system, accidents will be an extremely rare event and thus hardly suitable for learning from.

What is needed is an evaluation that classifies a journey as unsafe before it exceeds physical driving limits. To this end, we shall differentiate between deterministic and stochastic procedures in hazard assessment, as found in [33, 34].

#### 22.4.3.1 Deterministic Procedures in Hazard Assessment

Following [35], we shall in addition distinguish between identifiers from driving dynamics and identifiers from distances. The easiest values to determine, though with limited informative value, are the limits for lateral and longitudinal acceleration and yaw rate. In the 100 Cars Study [33], longitudinal accelerations of greater that 0.7 g are used as triggers for detecting unsafe situations. Identifying critical situations with variables from the ego-vehicle is not adequate, as other road users can bring even stationary vehicles into dangerous situations. It is easy to see that a vehicle's safety is also influenced by other traffic in its immediate surroundings.

If the environment is at the beginning first reduced to parallel traffic on one lane in each direction, time-to-collision (TTC) or its reciprocal value give an indication of how safe a situation is. For example, in ISO 22839 (Forward vehicle collision mitigation systems),

$$\text{TTC} = \frac{\chi\_c}{\nu\_r}$$

defines the time that elapses until the ego-vehicle collides with an object at distance xc, assuming the relative speed vr ¼ vego vobj remains constant. This measure can be applied to both the preceding and the following vehicle. From the TTC, Chan [34] defines a criticality index for which it is assumed that the severity of an accident is proportional to the square of the speed:

$$\text{Criticality Index} = \frac{\nu^2}{\text{TTC}}$$

If the speed between the vehicles does not remain constant, the enhanced TTC is used. In ISO 22839, this is derived thus:

$$\text{ETTC} = \frac{\nu\_r - \sqrt{\nu\_r^2 - 2 \cdot a\_r \cdot x\_c}}{a\_r}.$$

This equation only applies so long as the relative acceleration ar ¼ ðaobj aegoÞ remains constant. If a vehicle comes to a stop, the equation needs adjusting, see Winner [35] on this. These values give an assessment of a state, equivalent to a situation analysis. To enable an assessment of driving safety for all situations, the following procedures from [36] are recommended:


The names of the procedures speak for themselves, so that we shall not dwell on them here, but rather refer the reader to [36, 37]. Further simple measure include time headway

$$t\_h = \frac{\chi\_c}{\nu\_{\rm ego}}$$

and the necessary delay areq to avoid a rear-end collision. Further approaches based on the foregoing can be found in [37–39].

When vehicles, objects and accelerations moving in a lateral direction are included, for example, when studying situations at junctions, the metrics for a safety assessment have to be expanded. Easily the simplest approach is Post-Encroachment Time (PET). This temporal variable is defined by [40] as "time between the moment that the first road user leaves the path of the second and the moment that the second road user reaches the path of the first."

When observing the lateral direction, there are more objects than just the two object-vehicles in relation to the ego-vehicle. These can influence the safety assessment statically, but also in principle dynamically from any direction on the vehicle plane. Tamke's [41] approach is, for example, to identify the distance, and the distance's time derivation, to all objects in the vicinity of the ego-vehicle using Euclidian norms. The TTC is determined based on these variables by ascertaining the time until contact with the vehicle's bodywork using predictions of behavior. This approach is still classified as a deterministic procedure at this point, as the behavior of the ego-vehicle and the dynamic objects follow the "constant turn and constant acceleration approach." The approach per se, however, also allows predictions to be made non-deterministically.

Deterministic procedures are suitable for ex-post safety assessments of a carried-out maneuver or situation. If an online assessment of situations as they happen and a prediction on a time horizon greater than 1 s is desired, however, then its application per se will be flawed as long as the situation contains uncertainties. Uncertainties here imply that the development of a situation over time not only has a potential deterministic procedure, as is often assumed in "constant turn and constant acceleration" models of simplicity, but rather that many different situations can occur. For example, in calculating the TTC, the car in front could, instead of slowing down, accelerate to alleviate a critical situation. In order to incorporate these uncertainties into the hazard assessment, we will now take a brief look at stochastic procedures.

#### 22.4.3.2 Stochastic Methods in Hazard Assessment

A hazard assessment of two vehicles simply passing each other, as shown in Fig. 22.3, clearly encourages the use of stochastic procedures. If deterministic behavior and an extrapolation of speed are assumed, passing like this would pose no danger, as the

trajectories and areas occupied by the vehicles do not cross. This looks different when uncertainties are taken into consideration. If a human-driven vehicle (Fig. 22.3 lower lane, black) does not stay in its lane, this can be hazardous for the autonomous vehicle (Fig. 22.3 upper lane, orange) and the immediate surroundings.

The associated risk results from the probability of an accident and its potential severity. Both values involve unknowns that need to be estimated as accurately as possible.

The principal approach here [42] for determining probability is to predict the trajectories of the ego-vehicle and objects in its vicinity, based on measured state variables. Due to the uncertainties involving human drivers, sensors and actuators mentioned above, as well as the interaction between the objects, there is not only one trajectory, but rather a probability distribution of the states of all objects over time. If the potential areas occupied by the objects overlap, an accident is probable. The possible states of the objects result from the dynamic models used and the defined limits for the dynamic variables. In [43], a single-track model for vehicles is used here to find a compromise between prediction accuracy and computing time. In addition, dynamic variables such as acceleration and steering rate are limited, according to the analysis of the author [43], to non-critical and typical values. In [43, 44] an overview of alternative methods can be found. All methods have in common that the dynamic simulation of a vehicle cannot proceed analytically [41], so that numerical methods with accompanying discretization and simplification are to be used.

Including severity in the hazard assessment is approximated in [45] by a relative assessment of each accident based on its inelastic collision. This corresponds to the approach based on the Potential Collision Energy (PCE) [36]. Further, however, no approach has been found that determines both severity and probability in combination. One reason for this is imprecise analytical regression methods [46], another is computing-intensive Finite Element Methods (FEM), which are currently used in other fields for determining accident severity [47]. Meier et al. [46] provides a new approach here based on symbolic regression. Using a crash-situation database (produced from FEM calculations), regression functions are learned which predict accident severity in a situation to a few milliseconds. This uses pre-crash information such as vehicle mass, speeds, collision point and collision angle. The downside of this approach is its limited interpretability, as the regression model does not include any physical variables. If this approach gave a valid prediction for severity, it would be possible to extend an assessment of risk into one of severity.

The above-mentioned procedures are not yet sufficient to assess adaptive automated driving's safety, for the following reasons. Firstly, all the approaches are based on a series of simplifications, such as leaving out weather conditions, simplifying the driving dynamics, or not including sensor uncertainties. Secondly, the procedures as they stand do not provide any validated and combined ascertainment of the probabilities and severity of accidents. A general definition and assessment of vehicle-driving safety therefore does not currently exist.

However, the ongoing progress in vehicle automation does provide enabling factors. These are, firstly, removing the uncertainty of the driver (ego-vehicle). Although human behavior continues to be present in the form of other road users, the trajectory of the ego-vehicle is known within its control performance. Moreover, current vehicles' sensor performance is rising, reducing uncertainties in the state of the object. Further, additional information on the surroundings is exchanged via V2X communication, thus improving the points of reference for hazard assessment in both quality and quantity.

#### 22.5 Automation as Part of a Learning Collective Group

In this chapter, our analysis of learning vehicles has so far restricted itself to the system life cycle of a particular vehicle. What vehicle automation implicitly brings with it, however, is the duplication of hardware and software across a whole group of vehicles in the aimed-for mass production. Vehicles operating in road traffic would consequently have the same capabilities. On the one hand, this has the drawback that driving errors, breakdowns and accident types would affect not only one vehicle but the whole group. On the other, it gives adaptive systems a further degree of freedom. The option of exchanging data makes collective learning during operation possible. Two approaches may in principle be distinguished here [48]: agent-based machine learning and machine learning with agents. In the former (also often called agent-based swarm intelligence), the learning collective system is made up of a multitude of networked agents with limited cognitive capacity. The behavior of animals such as ants or bees is often drawn on in this connection [49]. In contrast, though, machine learning with agents also consists of several agents, these employ the procedures described in Sect. 22.3. These two approaches differ in the fundamental stages of machine learning in terms of:


Essentially, the approaches can be applied as soon as data from real situations has been gathered. This raises questions: At which position of a group is relevant information gathered from the data and assessed in terms of the learning problem and performance measurements? Can learning methods be used that are based on this? Not least for reasons of limited data-transfer bandwidth, it will be necessary to transfer pre-processed data or even learned models and knowledge rather than raw sensor data. So long as the participating agents/vehicles belong to a series and software release, there will be challenges for the integrity of the transferred information, although not in compatibility and trustworthiness between agents. So-called homogeneous teams exist in which how and what is being learned is known among the group. If the aim, however, is to expand the database which learning methods are applied to, vehicles with different software or even of different manufacturers could also be networked to each other. This amounts to a collective of heterogeneous vehicles in which potentially different machine-learning procedures are used, and the knowledge representation is likewise heterogeneous. Reference [50] gives examples from other areas of how such collectives could in principle be handled. Essentially, as well as vehicle robots, there are other agents, such as smartphones or also, in future, service robots, which likewise gather data covering completely different areas to those accessible to the driving robot. The currently highest conceivable level of connectivity, and by some distance the largest database, is the internet. The autonomous vehicle as a web-enabled device permits a great number of applications and functions, for better or worse. Not least, IBM's Watson Project shows that part of the knowledge archived in the internet is also comprehensible to machines. Information made accessible on the internet by any authority would therefore not need to be learned through experience first to influence an autonomous vehicle's behavior. On the other hand, access to any (unauthorized or anonymous) source threatens to create problems in terms of both road traffic safety and data security (see Chap. 24).

#### 22.6 Conclusion

Machine learning is of great interest to current research, as the quality and quantity of available data is constantly increasing and, in addition, vehicle automation is throwing up questions that can only be partly solved with conventional analytical approaches. In carrying research findings over to the development of functions in the driving of autonomous vehicle, proving their safe use in unsupervised safety-critical systems with no possibility of correction poses the greatest challenge. Therefore, according to the authors' knowledge, learned models that do not change after testing and approval can already be found in current mass-production vehicles. Systems such as Adaptive Transmission Control are not the subject of our examination due to their negligible adaptive parameters in clearly defined limited value ranges. However, learning and adaptation while in operation is giving automation an extra degree of freedom.

Exploiting this degree of freedom is motivated by the possibility of optimizing autonomous journeys, compensating for the loss of people's capacity to adjust and learn, and individualizing vehicle-driving. This chapter has highlighted that applying machine learning in vehicle automation during operation requires greater attention in terms of both road safety and data security. There is currently no valid measure for assessing traffic safety in respect of risk. Therefore, it seems clear that the use of adaptive machine-learning processes while in operation first requires a fault-tolerant set-up with redundant conventional systems, with the latter serving to assess road safety. It is thus to be expected that machine learning while in operation (adaptive systems) will initially only optimize vehicle automation within the framework of the conventional system.

Due to the challenges highlighted with respect to proving the safe behavior of time-invariant adaptive systems, it appears necessary to do intensive further research on runtime verification and validation. The same holds for the above-mentioned applied non-adaptive systems and their demonstration of safety. Although there is copious literature on examples that have already been successfully introduced, these mostly come from other fields that do not place comparable demands on a product.

In this chapter, we have examined the question of data security only peripherally—for a more in-depth discussion, see Chap. 24. Learning approaches require data and hence information on occupants, the vehicle and the environment. Data protection is thus of the same relevance as road safety. It should be pointed out that the environment also contains people, which implies protecting their data. The quality and quantity of the sensors needed for vehicle automation is a boost for machine learning on the one hand, but on the other they are regarded with suspicion from a data protection point of view. One special property of vehicle sensors is, in addition, that they currently are to a great extent not physically covered when the vehicle or function is not active. With the application of machine learning, data security should also accordingly be addressed directly.

Nevertheless, the application of networked agents and learning systems has its advantages, whose effects are not to be underestimated. Collectively learning agents need not acquire available knowledge slowly. Instead, this information can be copied and pasted to the next vehicle or software generation. This, in combination with access to the large quantity of electronically recorded information, has the potential to change the driving of vehicles, road traffic and thus people's overall (mobility) behavior. This makes the findings gained for driving equally interesting to research into medical robots, and also domestic robots with human contact. Due to the similar conditions, the reverse also applies, which speaks for close cooperation between vehicle technology and robotics.

Open Access This chapter is distributed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, duplication, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, a link is provided to the Creative Commons license and any changes made are indicated.

The images or other third party material in this chapter are included in the work's Creative Commons license, unless indicated otherwise in the credit line; if such material is not included in the work's Creative Commons license and the respective action is not permitted by statutory regulation, users will need to obtain permission from the license holder to duplicate, adapt or reproduce the material.

#### References


# 23 Safety Concept for Autonomous Vehicles

## Andreas Reschka

The development of autonomous vehicles currently focuses on the functionality of vehicle guidance systems.<sup>1</sup> Numerous demonstrations of experimental vehicles have shown their impressive capabilities—listed here with the most recent named first. For example, the drive on the Bertha-Benz route undertaken by the Karlsruhe Institute for Technology and Daimler AG [69], the Stadtpilot project of the Technische Universität Braunschweig [41, 60], activities of Google Inc. [13, 59], the BRAiVE Research Institute and the VIAC Project of the VisLab Institute of the University of Parma [4, 8], the research activities of the Collaborative Research Centre 28 of the German Research Foundation (DFG) [31, 55, 57] and the results of the DARPA Urban Challenge [51–53]. If the experimental vehicles were driving in traffic on public roads, a safety driver<sup>2</sup> was always in the vehicle to monitor the technical system. This person had to intervene if a technical defect occurred meaning that the current situation was beyond the capabilities of the vehicle or if another

A. Reschka (&)

Technische Universität Braunschweig, Institute of Control Engineering, 38106 Braunschweig, Germany e-mail: reschka@ifr.ing.tu-bs.de

<sup>1</sup> <sup>A</sup> vehicle guidance system is a technical system that steers the vehicle without human intervention. Unlike driver assistance systems, no monitoring by a human driver is necessary. The system, consisting of the vehicle and vehicle guidance system, forms an "autonomous vehicle". The meaning of the term "driving robot" is very similar to that of the vehicle guidance system. However it is frequently understood as a mechatronic system, which operates a vehicle like a human (see http://www.uni-ulm.de/in/mrm/forschung/mechatronik/kognitiver-fahrroboter.html). To avoid confusing the two, the term "driving robot" will not be used in this article.

<sup>2</sup> The article will use the terms "driver" and "safety driver" to indicate human drivers and safety drivers.

event necessitated this. This necessary monitoring of the technical system means that the indicated test drives on public roads are classified as semi-automated according to [20]. However, the aim of future vehicle guidance systems with higher levels of automation is to operate the systems independently in all situations without human monitoring.

Therefore, in the development of vehicle guidance systems, a safety concept is required that covers the various steps of the development process, such as the specification, design, development and the functional tests. In addition safety functions that can attain or attempt to sustain a so-called safe state are required in the system.

#### 23.1 Safe State

The use of the term safe state is often ambiguous. Safety is a relative concept and depends on the individual perception of the observer. According to the ISO 26262 standard, an operating mode of a system or an arrangement of systems can be regarded as safe when there is no unreasonable risk (see "safe state", ISO 26262, Part I, 1.102 [30]). This means that a safe state is only present when the current and future risk is below a threshold accepted in society (see "unreasonable risk", ISO 26262, Part I, 1.136 [30]). This threshold is to be regarded as a value of what is not acceptable in a specific context according to social, moral or ethical considerations (see ISO 26262, Part I, 1.136 [30]). Risk is to be understood as a combination of the probability of occurrence and the severity of the personal injury (see "risk" and "harm", ISO 26262, Part I, 1.99 and 1.56).

This definition allows us to understand a safe state as a state where risk from the system is reasonable. The frequently used term risk-minimized condition (e.g. in [20]) can be misunderstood as this does not place the risk in relation to an accepted risk and does not specify whether the system that is being operated with minimum risk is also safe.

The essential challenge when using the term safe state, in the sense of a condition with an acceptable level of risk for passengers and other road users, is the identification of a threshold under which the risk level is acceptable. When operating an automated vehicle, the level of acceptable risk depends on the current situation of the vehicle. The situation includes the following, according to [21] and [43]:


Therefore, for an autonomous vehicle, the current risk must be continuously determined on the basis of the current situation and a comparison of the risk with the threshold value that is regarded as still just about acceptable. In the sense of the ISO 26262 standard, this means that the likelihood of personal injury and the severity of the injuries must be determined for every situation and all ways in which the situation can develop and the courses of action that present a reasonable and acceptable level of risk must be identified. The author is currently not aware of a technical solution for this problem.

#### 23.1.1 Safe State in Driver's Assistance Systems Used in Series-Production Vehicles

In the case of driver's assistance systems, the driver monitors the technical system and has to pay close attention to the traffic situation. The driver is supported when driving. The current Mercedes-Benz p Class models are available with a system called "DISTRONIC PLUS with Steering Assist and Stop&Go Pilot". This system supports the driver in guiding the vehicle both laterally as well as longitudinally [49]. The driver still needs to follow events on the road, and the steering assist system deactivates after a specified time if the driver takes his hands off the steering wheel:

If the Steering Assist with Stop&Go Pilot detects that the driver has taken his hands off the steering wheel during the journey, depending on the driving situation, the steering wheel inertia sensor, the environment detected and the speed, the driver is warned in the instrument cluster. If the driver does not respond, a warning tone is sounded and the steering assist is deactivated. (Translated [49])

For this reason, the system is to be regarded as semi-automated according to the standards laid out in [20] or as partial automation according to [48]. The longitudinal guidance can also switch off and cede control to the driver with a corresponding signal as soon as technical faults develop or—depending on the way the system is set—if specific threshold values such as a minimum speed are no longer met [62].

Hörwick and Siedersberger [25] presents a safety concept for semi-automated and highly automated driver assistance systems. However, the terms are again used differently here. In [25], fully automated DAS (FA-DAS) actually means semi-automated according to [20], as the driver has to monitor lateral and longitudinal motion. Autonomous DAS (A-DAS) in [25] has the same meaning as fully automated according to [20], as the driver does not need to constantly monitor the system and the system can attain a safe state on its own. According to [24], a safe state is attained by stopping at a nonhazardous location. As the focus is on a system for automated driving in traffic jams on the freeway up to 60 km/h (approx. 37 mph), stopping on a lane until a human takes over control appears as a safe state. The relative speeds are assumed to be low due to the traffic jam [24, 25].

A study on the potential of automated driving on freeways comes to the same conclusion [45]. This was drawn up as part of the development of an accident assistance system that can stop a vehicle (safe state) in the event of the driver losing consciousness or not being able to guide the vehicle for other reasons [32, 45]. Such a system is also presented in [37]. The safety requirements here are higher than those for a traffic jam assistance system, as the vehicle is not supposed to simply stop but leave flowing traffic and come to a standstill on the shoulder. In addition the system was designed for normal freeway traffic and not for traffic jams, meaning the very high relative speeds can come into play. This means that the requirements of the system are very high in terms of reliability and environment/situation recognition, as other drivers/vehicles must be observed when changing lanes onto the shoulder [45]. Redundant sensors that cover at least the areas in front, to the rear and in countries that drive on the right, to the right side of the vehicle are required here. The benefits of such emergency assistance systems are still present even if the system is not fully available due to technical defects. A vehicle that is out of control on the freeway is more dangerous than a vehicle moving slowly or at a standstill that is indicating in a suitable manner—even if switching lanes to the shoulder is not possible [32, 37].

In summary, it is possible to say that, if a driver is present in the vehicle, driver assistance systems can attain a safe state by handing control to the driver or by braking to a standstill. The emergency assistance systems mentioned here can attempt to reach the shoulder, however the requirements for this are relatively high. Even with systems with higher levels of automation, handing over control to a driver who may be in the vehicle and braking to a standstill comprise possible ways in which a safe state can be attained.

#### 23.1.2 Safe State in Experimental Autonomous Vehicles

The following projects focus on autonomous vehicles on all types of roads and in all environments. The developed systems should be able to take on the task of driving completely and no longer require humans for monitoring purposes. There are only a few publications on safety functions and safety concepts of the various projects. This could be because it is relatively simple to deploy a human to monitor the vehicle and therefore not to make use of comprehensive safety systems and also because the functional safety of the systems for autonomous operation has not yet received the attention this field deserves. The projects taken into consideration are listed chronologically and the levels of automation according to [20] and the safety mechanisms used are highlighted.

The projects from the 1950s to the 1990s focused solely on the functional aspects of automatic vehicle guidance, such as the first attempts to link infrastructure and the vehicle in the General Motors Research Labs. This project involved implanting magnets in the road surface that the vehicle could detect. The driver was required to maintain a constant vigilance over the road traffic and the system [17]. In the 1970s and '80s in Japan research was conducted in the field of vehicle automation with the recognition of driving lanes with imaging cameras. Again, the system was constantly monitored by the driver [58]. The same applies for the research conducted in the 90s, for example the experiment No hands across America 1995 of the Carnegie Mellon University [50, 56]. In this case only the lateral guidance of the vehicle was automated. In terms of research in Europe, a test drive conducted by the University of the Federal Armed Forces from Munich to Odense with the VaMoRs-P experimental vehicle (again in 1995) must be mentioned. During this trip, the lateral and longitudinal guidance was conducted automatically and supervised by the driver. In addition, the automatic lane changes were initiated by the driver [36]. The ARGO experimental vehicle of the VisLab Institute of the University of Parma achieved a long-distance record in 1998. The level of automation covered not only lateral and longitudinal guidance but also lane changes initiated by the monitoring driver [7]. All of the named projects are to be classified as semi-automated according to [20]. The safe state was achieved by handing vehicle control to a monitoring driver or restored by interventions by the monitoring driver. A comprehensive overview of the developments of the 1990s can be found in Dickmanns's work [14]. The focus here is on camera-based image processing.

The Autonomes Fahren (Autonomous Driving) project in Lower Saxony in 1998 also examined the development of autonomous vehicles. Binfet-Kull et al. [6] describes a safety concept that involves various methods that are feasible and logical parts of today's systems. Table 23.1 lists error codes, the meaning of which and resulting actions could be executed by the vehicle in order to attain a safe state. The selected categorization is also possible in terms of the definitions of [20]. A detailed discussion of the actions will be given in the context of the respective safe states for the use cases in Chap. 2.

In the DARPA Urban Challenge, all participating autonomous vehicles without drivers were operated on an enclosed military base. The safety concept was prescribed by DARPA and included an option for immediately stopping a vehicle via remote control and by means of an emergency switch on the outside of the vehicle [2]. The safety concept of the CarOLO team of the Technische Universität Braunschweig used the time after the emergency stop to conduct self-rectification actions [19, 22, 44]. This allowed the autonomous vehicle to restart faulty components of the vehicle guidance system [2]. The other teams also followed a similar approach in the final of the Urban Challenge [51–53].


Table 23.1 Error codes from [6]

Emergency stopping via remote control as a last resort to attain a safe state was only possible because the vehicles were driving in a secured area, followed by observation vehicles. The other road users were either vehicles driven by professional drivers or other autonomous vehicles. A test involving vehicles with the capabilities of the experimental vehicles involved on public roads would have been too dangerous.

The Stadtpilot project of the Technische Universität Braunschweig has demonstrated semi-autonomous vehicles on public roads since 2010 [41, 60]. The research of this project focuses on fully-automated operation of the experimental vehicle—Leonie. However, when driving on public roads a safety driver has to monitor traffic and intervene before dangerous situations can arise.

The vehicle guidance system transfers control of the vehicle to the safety driver if it reaches the limits of the system's abilities or if system faults occur. As no other safety actions may be performed on public roads, the safe state is to transfer control to the driver. As the system is partially capable of determining its own performance, for example the quality of localization, other actions are then also possible. For example stopping at the side of the road or even on the current driving lane is feasible, continuing travel with greater distances to the vehicles ahead and with reduced speed is also possible, however, this has only been tested on test tracks [46, 47].

Stanford University and the Volkswagen Electronic Research Lab 2010 demonstrated automated driving with the Junior 3 experimental vehicle [35, 54]. The design of the experimental vehicle is similar to that of Leonie from the Stadtpilot project. Automated driving functions are controlled by silver switches. These facilitate a connection between the vehicle guidance system and the actuators of the vehicle. In the fail-safe state, these switches are open and there is no connection between the vehicle guidance system and the vehicle. This means that control is in the hands of the necessary safety drivers. One special feature is the valet parking function of the vehicle that can be used without a safety driver in a closed-off area. For safety purposes the vehicle has a so-called e-stop function that was used in a similar way to the one in the DARPA Urban Challenge. The vehicle guidance system is monitored by a health monitor that detects malfunctions of software modules and triggers self-rectification functions. In addition the vehicle is capable of operating the brakes and stopping independently. The stationary vehicle thereby attains the safe state via the e-stop and the safety system.

In 2012, the VisLab Institute of the University of Parma demonstrated semi-automated driving on public roads in a partially closed-off area with the BRAiVE experimental vehicle. On parts of the circuit there were no drivers in the driver's seat and only the front passenger could intervene with an emergency stop button. An e-stop function was also integrated [8, 23].

After the DARPA Urban Challenge, work continued at Carnegie Mellon University on the BOSS experimental vehicle and an approach for monitoring and reconfiguration in real-time was developed and published [33]. This approach, called SAFER, uses redundant software components that are usually switched to stand-by in normal operation and they can be activated as required. This makes it possible to switch a defective component to a redundant solution within a very short time. As no hardware monitoring takes place, no sensors and actuators are monitored, which means the approach can be used to supplement hardware redundancy methods.

The last example of current autonomous vehicles development projects is the Self Driving Car project of Google Inc. As a first step of this project, vehicles approaching a stage in which they are ready for series production were equipped with sensors and operated on public roads in Nevada and California [13, 59]. Even though there is only sparse information on the technology used in vehicles, use without safety drivers does not seem possible at present. As described in [13], there are numerous situations that make too many demands on the performance of the system. The safe state of these vehicles also means the driver taking control. In 2014 a prototype was presented without operating elements for the driver and therefore can certainly be classified according to [20] as fully automated, as there are no possibilities for overriding the controls. However, this vehicle has not been used on public roads to date.

#### 23.1.3 Summary

As the projects described show, there is currently no comprehensive safety concept that covers all requirements of vehicles without safety drivers on public roads. However, some of the projects have demonstrated powerful safety functions that cover the different situations and events on the streets. If one assumes that in future the safe state is to attain the specifications of the "ADOPTED REGULATION OF THE DEPARTMENT OF MOTOR VEHICLES" section 16.2 (d) from Nevada, an autonomous vehicle must be capable of leaving the traffic flow at any time during the journey and stopping at the side of the road or on the shoulder [39]. This would require a lane change which in turn would depend on reliably functioning environment perception, decision-making and their implementation. Simply to stop as performed in some of the projects along with handing control of the vehicle to the safety driver, is not sufficient. The use of a combination of the preset vehicle safety function approaches seems therefore to be necessary—probably other safety measures need to be taken in order to attain a higher level of reliability [39].

#### 23.2 Safety Concepts in Use in Series-Production in Other Disciplines

In addition to autonomous vehicles and driver assistance systems, functional safety also plays an important role in other technological areas. The following section details safety concepts from other disciplines and examines their suitability for autonomous vehicles.

#### 23.2.1 Track Vehicles

Track vehicles have been operated automatically for several years already. On public transport vehicles, a train driver is present in most cases to monitor the function of the systems [66]. Unlike the autonomous vehicles under consideration here, safety functions are frequently integrated in the infrastructure, for example track usage is coordinated in centralized control centers and the monitoring components are integrated in the tracks. The control systems have the task of avoiding collisions by ensuring the track sections are only ever occupied by one train. This is implemented by sensors and systems (wayside centric), such as axle counters at the entrance and exit of a section of track [42]. If a section is occupied, the signals are switched accordingly to prevent another train entering. The avoidance of collisions is therefore primarily a logistical problem particular to traffic operation technology. The mechanical lateral guidance without any degree of freedom on rail vehicles reduces the complexity of the situations and the number of options for action. Put simply, it all comes down to trains driving along free sections of track at a suitable speed to avoid derailing. Monitoring the track in front of the train is not possible with surround sensors due to the long stopping distances. However trains and carriages have emergency stop functions that can be triggered by passengers and train drivers and even externally on driverless trains.

On driverless trains, the speed of the journey is regulated automatically and in addition to monitoring track occupancy by the infrastructure, the systems also have on-board mechanisms (vehicle-centric). Communication between the control center and the vehicle is performed via wireless technology in exactly the same way as communication between platforms and driverless underground trains. Here, a redundant door monitoring system on the platform and in the train can be used to prevent hazards arising from closing doors. The communication-based train control (CBTC) has become a standard that is used in numerous railway systems all over the world [42].

Such an automatic train driving system is used in the RUBIN underground system in Nuremberg. Traffic on the track is a mix of driverless trains and trains with drivers.3 An essential component of the safety concept is the monitoring of the doors [38]. Components of the automatic train protection systems (ATP) and automatic train operation (ATO) are used; these are divided between stationary and on-board components. With ATP the speed is kept below existing limits and safety stops and emergency stops are triggered. The system must therefore fulfill the requirements of safety integrity level 4 (highest safety level) according to the European standard IEC50128:2011 [29]. The necessary hardware and software is inexpensive in relation to the comparatively high costs of track vehicles compared with road vehicles.

<sup>3</sup> Information on the RUBIN project of Siemens AG: http://www.siemens.com/innovation/en/ publikationen/publications\_pof/pof\_spring\_2008/tailored\_solutions/fahrerlose\_ubahn.htm.

#### 23.2.2 Purely Electrical Control of Actuators (X-by-Wire)

On autonomous vehicles the actuators are triggered and controlled by means of electrical signals. Gas, brakes, steering and special functions are controlled by controllers. The X-by-Wire technology is not yet completely available in series-production vehicles. The electronic gas pedal, the electromechanical steering and the electrohydraulic brake system have been around for several years. However the steering and brakes still have a mechanical/hydraulic linkage that is mostly permanent and only available as a fallback in seldom cases if the electrical system fails.<sup>4</sup> The driver can thereby control the vehicle even without the electronic systems.

For autonomous vehicles, the actuators must therefore have several redundant control circuits, as is the case in airplanes, for example. Both communications systems between operating elements, control devices and actuators as well as operating elements, control devices and actuators (including the energy supply) are installed multiple times so that in the event of a fault, the redundant systems can be used [3]. In [67], a threefold redundant control system for a Boeing 777 passenger airplane is presented. Each safety-relevant component of the airplane control system is implemented in three different ways to implement a high level of availability of the controls to the pilots or the autopilot. Due to the criticality of vehicle piloting, in addition to the autopilots on passenger planes, it is mandatory to have two human pilots [15].

The architecture used in airplanes and also the hardware and software used for implementing this would appear to also be suitable for use in vehicles. In airplanes, the high costs of such redundant systems are not so significant when looked at in relation to the high overall costs of the vehicle. For road vehicles, an analogous use of three-fold redundant systems would entail three times the investment in development and three times the amount of hardware compared to today's systems in vehicles. It remains to be seen whether threefold redundancy of the systems is really necessary in vehicles.

In air traffic, the flight paths are assigned by a central air traffic control center and the autopilots keep to these prescribed routes. Therefore an autopilot in an airplane can be compared with a semi-automated driver's assistance system, as the pilots have the duty of monitoring the system. On unmanned airplanes, the monitoring by the pilot is omitted and the requirements of the airplane guidance systems are greater. Risks are reduced by using flight paths that only fly over sparsely populated areas. As there are no persons on board, crashing into an empty field is a possibility as nobody will be injured [34].

<sup>4</sup> In 2012, the vehicle manufacturer Nissan presented a steering system that created a mechanical connection via a coupling in the event of a fault: http://www.newsroom.nissan-europe.com/de/de-de/ Media/Media.aspx?mediaid=97910.

#### 23.2.3 Robotics

Mobile robots can pose a danger to themselves and their surroundings due to collisions with objects, persons and other living creatures and by overlooking ledges, ditches, steps, etc. [1, 10, 18]. Automated manipulators that are either used on stationary or mobile platforms can endanger people by moving their joints and colliding with the humans or by injuring them with the tools they are using. Therefore, for both the mobile robot and the manipulators, the safe state is the stopping of all manipulators in their current position or a standstill [5]. In most cases the following applies: the faster this happens, the lesser the danger that arises for the robot and its environment. Exceptions to this are tools and manipulators such as hands and grabbers that can apply pressure. Stopping the actuators could result in a pressure that can lead to injuries and damage. If a robot is used for complex activities, injuries and damage could occur that are not directly caused by the motion of the robot, but by the consequences of its actions. For example fires may be started if an ironing robot suddenly stopped moving or if hazardous goods were being transported by a mobile robot [64].

In [64, 65], a safety-orientated architecture for robot control systems is presented that contains a safety layer. This is intended to always transfer the robot to a safe state. The safe states depend on the functions the robots are to fulfill. These can vary greatly and therefore in [64, 65] safety policies are suggested that contain a hierarchical rule structure that enables the safe operation of a robot. It is conceivable that a robot can find an unexpected solution—depending on its degree of autonomy and its inherent capabilities and this can result in dangerous situations. As described in [9], this can occur with the frequently used subsumption architecture. In relation to autonomous vehicles, this means that driving decisions can be taken according to different criteria such as traffic law, efficient driving style and comfort, but a collision avoidance system that can take action as the higher level authority would have to be active at all times.

#### 23.2.4 Power Station Technology

Atomic power stations are largely regarded as a particular risk, as faults can lead to significant environmental damage. The control and regulation systems used there must therefore fulfill the highest safety requirements in order to enable operation even after natural catastrophes, terror attacks or internal technical faults. As immediate shut-down is not possible with atomic power stations, and the combustion elements remain active and require cooling even after their deployment in the reactor, many redundant systems are required, particularly for cooling.

The safety of an atomic power station largely depends on the complete and fault-free specification and development of the control and monitoring systems. Integrating the entirety of the possible situations and events plays an important role, as it is especially chain reactions and multiple faults that can lead to hazards. For example, the Fukushima Daiichi atomic power station in Fukushima, Japan was in a fail-safe condition after the earthquake and all safety systems were correctly automatically activated. However, after the tsunami wave hit, parts of the redundant safety systems were damaged, in particular the emergency power units. With hindsight, we can say that the error was not in the failure of the safety functions, but instead lay in the incorrect specifications [63].

Therefore, for autonomous vehicles it can be said that the numerous events and combinations of events and error sources must be taken into account in the specifications stage. Possibly this will require a standardization of the requirements, comparable with that for atomic power stations. When they are developed, safety plays an essential role in the design phase and is the focus of the development process (safety by design, [26]).

#### 23.3 Safe States in the Use Cases

One important criterion in the operation of an autonomous vehicle is whether there are passengers on board or not. For example, when choosing a parking space, it is not necessary to take the safe exit of passengers from the vehicle into account, however the safety of other road users cannot be forgotten. In addition comfort plays no role, meaning that a different driving style is possible in which comfort can be neglected. However, if passengers are on board, the vehicle guidance system must take over the tasks of a human driver. This also includes monitoring the passengers, for example if they are wearing their safety belts and are sitting on the passengers' seats or if they are acting in a dangerous manner. Collisions with other road users can occur at any time and therefore passive safety mechanisms such as safety belts and airbags are also necessary in autonomous vehicles. The same applies to the securing of loads, especially hazardous goods.

The following section will investigate the four use cases defined for the project and examine the respective properties of the safe states.

#### 23.3.1 Use Case 1: Interstate Pilot Using Driver for Extended Availability

By restricting use to freeways, the number of possible and probable situations is lower than compared to use in urban traffic. The safety driver is basically present as a fallback and is able to take control at any time and whenever he or she regards this as necessary. The vehicle is in a safe state in the following situations:

	- Lane on a freeway: Due to the presence of a safety driver, continuing the journey with manual control is very probably possible. If continuing the journey with manual control is no longer possible, a stationary vehicle on a lane on a freeway

can become a dangerous situation as defined in error codes F5 and F6 in [6] (see Table 23.1). On the one hand the vehicle could be overlooked or seen too late, on the other hand because the passengers may have to leave the vehicle. Another danger can arise if the automated vehicle blocks a path for emergency vehicles in a traffic jam. If driving under manual control is no longer possible, the safety driver is obliged to secure the vehicle in accordance with the pertinent legal requirements, e.g. according to §15 StVO (German highway code) [11].


#### 23.3.2 Use Case 2: Autonomous Valet Parking

In this use case the maximum speed of the vehicle is only low [approx. 30 km/h (approx. 19 mph)]. This means that the resulting energy that would be required to brake in the event of an emergency is considerably lower than the 50 km/h (approx. 31 mph) that is permitted in urban areas in Germany. Transferring control to a safety driver is not possible in this use case as the vehicle can be operated without a driver. The safety of passengers plays no role as no passengers are on board when the vehicle is driving. The intended route must be planned so that the vehicle does not drive on any roads that the vehicle does not have command of, for example streets with level crossings.

The vehicle is in a safe operational state in the following situations:

1. The vehicle is at a standstill: The location of the stopped vehicle is relevant as the vehicle could be a dangerous obstacle for other vehicles and block emergency vehicles and emergency escape paths. Securing the stopped vehicle is more difficult because no human is on board to take over this task. It would appear that only the lighting on the vehicle can be used to secure it. In many countries there are special regulations on securing broken-down vehicles, for example a warning triangle that has to be set up several meters behind the vehicle. It is hard to imagine that this could be performed by an autonomous vehicle. Therefore, one or more persons must be responsible for this. The vehicle must either be constantly monitored or request help independently in the event that it is forced to stop.


The greatest challenge is the lack of a safety driver. In the case of events that increase the risk, it is not possible to transfer control to a safety driver and a standstill can have hidden risks in many situations as the vehicle cannot be moved immediately under manual control. One solution could be the remote operator. This requires a communications channel to the vehicle for reporting problems and for the remote control of the vehicle. If stopping is required, this must be signaled accordingly to the other road users. Securing the vehicle by the safety driver is not possible in this case.

Blocking emergency vehicle access and emergency escape paths on single-lane roads and access points for emergency vehicles in front of buildings and other facilities is a special case. Blockages can mean the emergency rescue actions are delayed or complicated. On the one hand this is illegal, on the other it is a major ethical consideration. The author is not aware of any investigations that show the frequency that such situations occur. Therefore it is not possible to state whether this case needs to be explicitly taken into consideration or not. Non-automated vehicles can also break down, however it is simpler for the driver of the vehicle to drive or push the vehicle out of the way in a quick and uncomplicated manner.

#### 23.3.3 Use Case 3: Full Automation Using Driver for Extended Availability

The safety and risks of this use case are very similar to a combination of use cases 1 and 2. The presence of a safety driver means it is possible to hand over control. The driver can also secure the vehicle should it break down.

The necessary driving maneuvers and situations are the same as this in use cases 1 and 2. In addition, the vehicle is also used on interstate connections. The maximum speed in this use case is restricted to 240 km/h (approx. 149 mph). This means that practically every speed is feasible, however the maximum speed must always be selected so that it is within the performance capability of the vehicle guidance system and the risk is correspondingly reduced.

In terms of the safe state, the same conditions apply as in use cases 1 and 2.

#### 23.3.4 Use Case 4: Vehicle on Demand

In terms of (safety) technology, this use case is the most challenging. The vehicle must be capable of handling every situation that a human might have to handle. The risk has to lie below a threshold of risk that is reasonable for the passengers and other road users. Both driving maneuvers and the conditions for the safe state can be taken from use cases 1, 2 and 3, taking into account that there is no safety driver.

The vehicle is in a safe state in the following conditions:


Due to availability on demand and the universal usability, the vehicle on demand must be capable of handling all traffic situations. The safety-relevant events that require a reaction from the vehicle are examined in greater detail in the next section.

#### 23.3.5 Summary

Examining the four use cases has shown that the greatest challenges for the safe state are posed by high relative speeds, the lack of a safety driver and blocking of emergency vehicle access routes and emergency escape paths. Examining these aspects allows the safety requirements for the vehicle to be derived:

	- The relative speed to other road users is below a maximum still to be defined.
	- The stationary vehicle is not blocking emergency vehicle access routes or emergency escape paths.
	- A safety driver or remote operator can remove the vehicle from this location within a short time.
	- A safety driver can secure the vehicle.

#### 23.4 Safety-Relevant Events

Various events can occur in road traffic that affect the risk in the current situation and in the future development of the situation. On the one hand, technical defects and faults in the vehicle guidance system reduce its performance capacity and on the other hand changes to environmental conditions, situations that overtax the vehicle guidance system, incorrect behavior of other road users and acts of force majeure all increase the requirements of the vehicle guidance system. In particular a combination of reduced capabilities and the increased demands can lead to higher levels of risk.

Defects and technical faults on the vehicle and in the vehicle guidance system can occur suddenly and are therefore very difficult to foresee. In addition to mechanical defects on the vehicle, defects and development errors in the vehicle guidance system can result in a reduced performance capacity (see [16]). Adverse light and weather conditions increase the requirements of the durability of the sensors used to detect the surroundings. In addition, adverse weather conditions lead to worse road conditions. These directly affect driving dynamics. Due to the complexity of road traffic and the endless quantity of possible situations, it is probable that not all situations will be taken into account when developing a vehicle guidance system. If the vehicle encounters a situation that cannot be resolved with the existing software, this has a direct influence on the risk level.

Recognizing the ability of the vehicle and the limits of the system is a great challenge in such situations. The behavior of other road users does not always conform to the rules and it may occur that they behave in a dangerous manner. In some situations, operation of an automated vehicle can never be safe because other road users act in a dangerous manner. It is conceivable that this may even occur deliberately if an automated vehicle is recognized as such. Force majeure can also pose a higher risk to operation, for example due to earthquakes or flash flooding or solar bursts that result in interference to the systems used such as a global satellite navigation system or vehicle-to-vehicle communication [12]. Such events are not taken into consideration when developing driving assistance systems in accordance with ISO 26262 [30]. How they will be handled in autonomous vehicles remains open [61].

#### 23.5 Measures for Reducing Risk Levels

Assuming that an autonomous vehicle is always to be operated with an acceptable level of risk and at the same time should have as wide a functional scope as possible, actions are to be performed as a reaction to safety-relevant events that reduce the risk to an acceptable level or retain this level and simultaneously enable a higher scope of functionality. A reduction of driving speed, an increase in distance to the vehicles in the vicinity, safety-optimized planning of driving maneuvers, prohibition of certain driving maneuvers, and the execution of safety maneuvers are all possible. The underlying principle of graceful degradation comes from the field of biology and was presented in [40]. In [68], among other things, there is an overview of the applications of graceful degradation in aerospace technology, power station technology and other research areas. If errors occur in one system or if resources are limited, the vital processes are maintained and other less important processes are scaled back or ended. For example, if the field of vision is restricted, the speed of the vehicle can be reduced. However, in certain conditions, even the execution of these actions cannot reduce the risk to an acceptable level, meaning that stopping the vehicle becomes necessary [25, 46], or if this is too risky, leaving the traffic flow.

With graceful degradation, it is not only necessary to attain or maintain a safe state but also to improve performance by using mechanisms for self-repair and reconfiguration. In technical systems restarting components is a widely-used measure for restoring performance [22, 44]. Restarting needs time and, depending on the system structure, it can occur that restarting a component also means restarting or at least re-initialization of other components. Therefore safety-critical components often have (diverse) redundant designs (see [3, 28]).

In addition to redundancy there is also the possibility of restoring functionality for individual components. Sensors and actuators can be re-calibrated to improve their measured values or set-points can be implemented depending on the current situation. Reconfiguration mechanisms can be used for the overall system that enable safe operation even after risk-increasing events [33].

Recognizing risky situations is a challenge. External events must be detected and correctly interpreted by the environmental monitoring system. Technical faults on the vehicle and in the vehicle guidance system must also be detected. A driver uses his or her senses to observe warning and monitoring lamps and notices changes in the vehicle, for example due to technical defects. An autonomous vehicle must therefore integrate sensors and functions that detect faults and errors and determine the future performance level and possible scope of function on the basis of the severity of these faults and errors. The complexity to be expected of a vehicle with a vehicle guidance system will lead to a large number of measured values. As a result, a self-representation of the vehicle will be created that will be used to create an evaluation of the current risk that depends on the situation and the performance capability. The so-called safety actions are performed on the basis of this evaluation [46].

#### 23.6 Anticipation of Degradation Situations

Due to the highly dynamic nature of road traffic and the properties of electric and electronic systems, safety-relevant events can occur in a fraction of a second and therefore require a fast response from the system. However, it is better if situations in which high levels of risk are present can be foreseen or at least taken into consideration when planning driving maneuvers. Anticipatory driving by humans can be implemented in an even more wide-ranging manner in a vehicle guidance system as the monitoring and application of numerous measured values is performed directly from the vehicle.

All of the collected measured value data must be monitored and stored to predict how situations will develop. The broad scope of the data analysis could allow incipient errors to be detected. Even detecting difficulties a few tenths of a second before the event can lead to a safer reaction. A necessary braking maneuver that has been detected and triggered 0.3 s earlier can shorten the stopping distance by 4.2 m at a speed of 50 km/h (approx. 31 mph).

Communications with the infrastructure and other vehicles yields further potential for increasing safety. The sooner information on hazards is available, for example road surface damage, dirt and ice, traffic jams ahead or emergency brake maneuvers of vehicles ahead on the road, the sooner a response to these can be initiated.

#### 23.7 Dilemmas

In some cases, a chain of events can lead to a situation that cannot be resolved without personal injuries. When faced with a dilemma, an automated vehicle must select a possible course of action, which even though it will result in personal injuries, will cause the minimum amount of damage. Material damage and road traffic law infringements are also possible, however these have lower priority. The number of passengers on board and the type and dynamics of other road users must be taken into account in the evaluation of possible uncertainties. Communication with other road users is particularly important here and can help to resolve such situations with the minimum amount of personal injuries.<sup>5</sup>

<sup>55</sup> The DFG priority program "Kooperativ interagierende Fahrzeuge" [Cooperatively Interactive Vehicles] will research this field in the coming years: http://www.dfg.de/foerderung/info\_ wissenschaft/info\_wissenschaft\_14\_34/.

A detailed ethical discussion of dilemmas can be found in Chap. 4 of this book. Therefore, the following section will solely focus on the technical aspects of dilemma situations.

Figure 23.1 shows two situations. The first can be resolved without a collision. The second can lead to a dilemma. At the start of the first situation, the vehicle is driving on a road lane and other vehicles are parked by the side of the road. Unexpectedly a person, who is barely discernible, steps between the parked cars and onto the road. The vehicle can respond in several different ways to avoid a collision with the pedestrian. Option 1: The vehicle can brake and stop before hitting the pedestrian. Option 2: The vehicle can switch to the neighboring road lane and thus avoid a collision. However, this requires crossing a continuous line between the road lanes. This would infringe road traffic law.

Fig. 23.1 Example of two situations that could cause a dilemma. Image rights: Copyright off the Author

In the second situation a vehicle is driving in the oncoming direction on the second road lane. If one assumes that a braking maneuver will no longer prevent a collision with the pedestrian, the autonomous vehicle is facing a dilemma:

Colliding with the pedestrian could result in serious injuries to the pedestrian (option 2). Switching to the neighboring lane will result in a collision with the oncoming vehicle and possibly also result in injuries to the pedestrian (option 3). A collision with the parked vehicles to reduce the vehicle's own speed is also feasible (option 4), however it would remain highly uncertain as to whether the pedestrian would emerge uninjured from the situation. In such situations the decision-taking software within the vehicle guidance system will have to be programmed with ethical principles.

Vehicle-to-vehicle communication between the autonomous and oncoming vehicle could solve at least this problem. The two vehicles could find a solution together. The oncoming vehicle could switch to the edge of the lane so that the autonomous vehicle can pass between the oncoming vehicle and the pedestrian without a collision occurring (option 5). Both vehicles would infringe road traffic law in this situation as both must cross a continuous line.

However, operation without communications with other road users and the infrastructure must also be possible as it is unlikely that these communication options will be available everywhere and for all road users.

Vehicle guidance must therefore be possible with the on-board sensors. This on-board autonomous operation (see [36]) makes the highest requirements of the vehicle guidance system on the one hand and on the other hand is also currently the only possible option for use in road traffic. This restricts options, especially in situations involving danger and dilemmas and increases the uncertainty in perceiving situations. Signalization to other road users is only possible in an optical and acoustic manner.

#### 23.8 Summary

In the current state of development of driving assistance systems and related research and development areas, there are a wide variety of methods that could and possibly must be used in the development of autonomous vehicles. The wide range of technology means that these systems affect different areas of the development process and the system to be developed and also that they can contribute to the safety of autonomous vehicles.

First a metric must be found with which the operating risk of autonomous vehicles can be evaluated and then a generally acceptable risk threshold must be defined. The procedure used in power station development for determining the safety requirements and integrating functional safety in the overall system could be useful in this area.

In terms of the functional safety of the regulation of actuators, examples form aeronautics and aerospace and partially rail travel can be used in the current research and development of vehicle technology. Multiple, diverse redundancy is one of the most promising means. The same applies for software components for situation analysis, decision-making and motion planning. Until now only the field of robotics has been faced with similarly complex situations. However, the level of risk there is mostly lower.

One of the biggest challenges is the reliability and dependability of environment perception systems that also include self-perception and situation perception. Due to the infinite quantity of possible situations, as far as the author is aware, it has not yet been possible to implement complex applications—as described in the use cases—in a safe manner. This will also require hardware, software and functional redundancies, for example in the composition of the sensors for perceiving the immediate environment.

A safety driver is still required in research projects for autonomous vehicles. This person monitors the system and can either take action directly or use remote emergency stop functions or an emergency stop switch. The research projects considered currently focus heavily on functions and less on their functional safety.

The safety of autonomous vehicles is one of the basic challenges of future research. The development of the technology not only requires the resolution of technical problems, but also legal and social problems. A large proportion of these will be discussed and examined in the later chapters of this book.

Open Access This chapter is distributed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, duplication, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, a link is provided to the Creative Commons license and any changes made are indicated.

The images or other third party material in this chapter are included in the work's Creative Commons license, unless indicated otherwise in the credit line; if such material is not included in the work's Creative Commons license and the respective action is not permitted by statutory regulation, users will need to obtain permission from the license holder to duplicate, adapt or reproduce the material.

#### References


# 24 Opportunities and Risks Associated with Collecting and Making Usable Additional Data

Kai Rannenberg

#### Abstract

Cars have for a long time been a symbol for the freedom and autonomy of their users. Now autonomous driving raises the question how the data flows related to autonomous driving influence the privacy of these cars' users. Therefore this chapter discusses five guiding questions on autonomous driving, data flows, and the privacy impact of vehicles interacting with other entities: (1) Which "new" or additional data are being collected and processed due to autonomous driving and which consequences result from those "new" or additional data being collected and processed? (Sect. 24.2); (2) Are certain types of data special and do they cause special hindrances? (Sect. 24.3); (3) What is required from the perspective of privacy? (Sect. 24.4); (4) When building architectures, what needs to be kept in mind to avoid creating difficult or even unsolvable privacy problems? (Sect. 24.5); (5) What needs to be considered in the long term? (Sect. 24.6). The questions will be discussed relating as much as possible to the case studies that were introduced at the beginning of this book. Sect. 24.7 concludes this text including an analysis whether more autonomy of driving vehicles leads to more privacy problems.

K. Rannenberg (&)

Thanks go to Tim Schiller, Jetzabel Serna-Olvera, and Markus Tschersich for helpful hints and comments.

Deutsche Telekom Chair of Mobile Business and Multilateral Security, Goethe Universität Frankfurt, 60629 Frankfurt am Main, Germany e-mail: Kai.Rannenberg@m-chair.de

#### 24.1 Introduction: Cars, Freedom, and Privacy

Cars have for a long time been a symbol for the freedom and autonomy of their users, be it drivers or passengers: Car drivers can decide on their own, where to drive, which route to choose and often even how fast to travel (or at least when to take a break), and they don't need to report this to anybody. Many pieces of art reflect the opportunity for freedom and escape from (often undue) control that cars offer to their users. Some of the most impressive examples may be episodes 3, 4, 6, and 7 of the 1947 movie "In those days" [1], which describe the more or less successful car journeys of several people oppressed by the German Nazi regime between 1933 and 1945; other examples can be mentioned also (Chap. 3). At the same time, a car offers its driver and holder a protected sphere of privacy: People from outside usually don't hear what is communicated in a car and they cannot easily take a seat and join the conversation. "My car is my castle" is not as popular as "my home is my castle"; still many people see their car as the extension of their home; correspondingly many household goods and activities can be viewed in a car ([2], paragraph 2).

If one takes this perspective, autonomous cars could be just an extension of the traditional concepts of freedom, autonomy, and privacy for their drivers and users. However, "autonomous driving" in first instance makes the driving more autonomous from the drivers. At the same time, it relies much more on interaction with the outside world than a human-driven car. Autonomous cars sense their environment and often even communicate with that environment, e.g. cars nearby. Beyond that exchange with near-by entities, there are plans to control and synchronize cars with traffic centers to optimize their behavior, e.g. their choice of a route. Like any other centralized entity collecting data, this raises privacy concerns, and motivates an analysis of the data flows and the corresponding privacy impact. The situation is more critical if one considers that cars not only can collect a lot of data on their users and the environment, but also store them for a long time and then communicate them to other entities.

Therefore this chapter follows five guiding questions on autonomous driving, data flows, and the privacy impact of vehicles interacting with other entities:


The questions will be discussed relating as much as possible to the use cases that were introduced at the beginning of this book. Section 24.7 concludes this chapter.

#### 24.2 Additional Data Collected and Processed due to Autonomous Driving

To assess the opportunities and risks associated with collecting additional data and making it usable, it is useful to first try to identify those data. This will be done along the four use cases defined in Chap. 2, but first a short overview on data that is being collected or may be collected in a non-autonomous car will be given.

#### 24.2.1 Personal Data Collected and Potentially Transmitted in Today's Networked Cars

While the analysis in this chapter will concentrate on "new" or additional data, it should be mentioned here, that quite a few sensitive personal data are already collected in today's cars and sometimes even transmitted. Some examples are


what is happening in front of the car. Data from the environment may well be other people's personal data, e.g. number plates of other vehicles or faces of people.

This rough overview also raises the question: What kinds of data are actually personal? Some of the data listed may not seem to be "personal". However, experience over years of initiatives aimed at privacy protection has shown that there are no guarantees that data cannot be related to persons and cannot be misused. One consequence of this lesson is that "personally identifiable information (PII)" is nowadays not only the information that directly identifies a person, but "any information that (a) can be used to identify the PII principal to whom such information relates, or (b) is or might be directly or indirectly linked to a PII principal" ([8], clause 2.9).<sup>1</sup> The PII principal ([8], clause 2.11) is then the individual whose data are being processed. In our cases, PII principals may include drivers, passengers, or car owners, but also passersby who are sensed and can be identified in any way.

Still, the fact remains that the practical sensitivity of data at a certain point in time depends a lot on context, e.g. the location information of a car may be more sensitive if the car is parked near a red-light district. More examples will be seen in the discussion of the use cases of autonomous driving and the related interests of the parties involved. Moreover, analyzing the cases helps to illustrate new situations and the respective issues.

#### 24.2.2 Personal Data Collected in Autonomous Cars

This section discusses the data collection in autonomous cars along the four cases as introduced in the beginning of this book (Chap. 2).

#### 24.2.2.1 Use Case 1: Interstate Pilot Using Driver for Extended Availability

The driving robot takes over the driving task, but only on interstates or interstate-like expressways. During autonomous journeys, drivers become passengers who can take their hands off the steering wheel and feet off the pedals and pursue other activities. The driving robot coordinates a safe handover to the driver and may even stop the car at a safe place if needed.

<sup>1</sup> The relation between data and information is too subtle and too complex to be sufficiently explained within the limits of this chapter. All the same, considering data and information as roughly equivalent should suffice for the purpose of this chapter. Using only one term would put the paper at odds with some of the referenced literature.

The new and additional data the car can collect and learn in this case are data on:


Following the discussion on the legal and liability implications of autonomous driving (see the part of this book on law and liability (Part V) one can indeed assume that there will be an interest in collecting data to document potential accidents and investigate what behavior of the car, the robot, the driver, or other parties may have caused the accidents. This would accord with other cases of law enforcement agencies having a large "appetite" for data that may become available through the computerization of an activity, as computerized activities are usually easy to log in computerized logs.

#### 24.2.2.2 Use Case 2: Autonomous Valet Parking

The driving robot parks the vehicle at a nearby or remote location after the users have exited and cargo has been unloaded. The driving robot drives the vehicle from the parking location to a desired destination. The driving robot re-parks the vehicle. The driver saves the time of finding a parking spot as well as of walking to/from a remote parking spot. In addition, access to the vehicle is eased (spatially and temporally). Additional parking space is used more efficiently and search for parking is arranged more efficiently.

The new and additional data the car can collect and learn in this case are data on:


As there is no direct interaction between the driver and the car, no data on driving behavior are collected.

#### 24.2.2.3 Use Case 3: Full Automation Using Driver for Extended Availability

Use Case 3 is similar to Use Case 1, as in both cases the driving robot performs the driving task with drivers just being passengers who can take their hands off the steering wheel and their feet off the pedals and pursue other activities. However, in Use Case 3 the driver can delegate the driving task to the driving robot in many permitted areas, not just expressways. So the new and additional data the car can collect and learn are basically the same as in Use Case 1, but there may be more options for the driver to delegate and take back control. This can lead to more data being available on driver behavior, especially in circumstances where the driver delegates control and/or takes it back. Similarly to Use Case 2, the data on the environment may be richer and more sensitive than the data collected on a highway described in Use Case 1.

#### 24.2.2.4 Use Case 4: Vehicle on Demand

The driving robot drives the vehicle autonomously in all scenarios with occupants and/or cargo, but also completely without any payload. The driving robot makes the vehicle available at any requested location. Passengers use the travel time completely independently for activities other than performing the driving task. The cabin design is completely free of any requirements for any driver workplace whatsoever, but it may have a camera directed at the passenger space.

While this case is the most demanding from the perspective of autonomous driving, there may be less additional data collected than in Use Case 3. In particular, there is no additional data collected on driving behavior, as there is no driver in the loop anymore. The additional data collected are:


#### 24.2.3 Consequences for Control Over Data and Misuse Resulting from Data Storage

In principle, the storage of any kind of data opens possibilities for any kind of processing that would not exist without that storage. While this seems to be a theoretical triviality, the practical consequences of storing data are that they can be used and misused later, maybe under circumstances of which the user was not originally aware. This implies a longer-term responsibility for these data. The responsibility has to lie with the body that can control the data and make decisions about their usage.

If one can assume that the data stored in a car are under the sole control of the car's owner or driver, then determining responsibility for these data may be relatively easy. Otherwise, the responsibility for storage and any kind of misuse would expand to the body that controls the storage or transfer or both. This only applies, however, if the data can leave the car and the domain of its owner without the owner being in control of this data transfer.

There are at least two indications that powerful bodies will ask for data stored in a car to be transmitted out of the car:


Not everything that these powerful organizations have been asking for has happened, but the examples give an impression of the challenges accompanying data storage, even in a contained fashion.

#### 24.2.4 Consequences from Data Transfer to Third Parties

Data being transferred to entities outside of the domain of the car owner or driver (third parties) can enable those entities to pursue their interests. These interests may or may not conform to the interests of the parties identified by the data (also called data subjects), typically the driver or the owner of the car. This section will give examples of the following third parties: vehicle manufacturers, insurance services, fleet operators, government-authorized parties, peer ad-hoc networks, e.g. other traffic entities or other autonomous vehicles, and traffic centers. This sequence of sections follows the rising complexity in the setting of the third party entities.

#### 24.2.4.1 Vehicle Manufacturers

Vehicle manufacturers may be interested in documenting vehicle behavior, e.g. to learn about the vehicle's behavior in extreme situations and about the quality of their (often very complex) software, and to improve the systems. These data are similar to the kind of data that manufacturers and operators of telecommunication systems collect for quality assurance and maintenance purposes. At the same time, these data also deliver sensitive information about the driver, e.g. the typical driving speed and the number of emergency brakes or missed handovers from the driving robot in Use Cases 1 and 3.

#### 24.2.4.2 Insurance Services

Insurance services are often interested in more information about their customers to assess the level of risk associated with them or gain other customer insight. Depending on the type of insurance, different information can be of interest, e.g. the insurance risk for an accident can be derived from driving behavior (risk averse or less risk averse driving style), and from location information for theft insurance (regions with more or less theft risk for the specific vehicle). All cases offer rich data here, Use Cases 1 and 3 more on driver behavior, all cases on location information, Use Case 4 also on occupants' behavior and emergency calls. These assessments may be fairer to insurance customers, as they award cost-reducing behavior, but they put users under more surveillance without a clear description of the related risks and opportunities. Often insurance services make decisions based on scoring systems or details unknown to customers, as these details are considered "trade secrets" the insurance companies wish kept confidential to protect themselves in a competitive market. Customers may then be surprised about decisions, e.g. the denial of an upgraded contract or a fee raise.

#### 24.2.4.3 Fleet Operators

Fleet operators such as rental car companies are in a situation similar to that of insurance companies. To raise their commercial success, they try to assess the risk associated with handing out a car to a certain customer and to consider the results of their assessments for their pricing. Therefore the consequences for customers are also similar to those in the case of insurances, e.g. with regard to (non)-extensions of contracts or fee rises. Also for this scenario, all use cases offer data. A major difference to the case of insurance companies is the fact that fleet operators usually own the cars, so they have more control over the cars than an insurance company has over an insured car. This difference is important for any concept of a "private data vault" to store sensitive data of rental customers or drivers (see Sect. 24.5). In the fleet-operator scenario, such a "private data vault" would either need to be specially installed within the car to protect it from access by the fleet operator or it would need to be brought along by the rental customer or driver.

#### 24.2.4.4 Commercial Location-Based Services

Advertisers are interested in directing the right messages to their respective target groups. This may include placing advertisements at the right location, e.g. special offers of shops near the next exit, encouraging commuters in a traffic jam to leave the highway and go shopping. Also, travelers in a traffic jam on the way to a major airport can be targeted with offers from a smaller regional airport (as seen, for instance, on the highway north towards San Francisco airport, where flights starting from San Jose have been advertised). Advertisers are thus interested in traffic flows (and jams). Moreover, they always like to know more details about their target groups, so any kind of behavior that allows conclusions, e.g. on the type of traveler (business, commuting, leisure) will be welcome.

#### 24.2.4.5 Government-Authorized Parties

Government-authorized parties such as police forces or intelligence agencies can use the data for surveillance to detect behavior they want to sanction or prevent. In the case of the traffic police, this can be any kind of behavior deemed unsafe or in violation of traffic laws, e.g. difficulties or strange behavior in interaction with the driving robot. Polices forces investigating crimes or aiming to prevent crimes as well as intelligence agencies may be interested in analyzing navigation and movement data to learn about the social networks of travelers, e.g. who may meet whom where. There is also the strong potential that the interested government and intelligence agencies have their very own interpretation of what they are authorized to do beyond the assurances and guarantees of privacy laws and privacy protection. This may especially hold for data on the environment the car would be collecting. Having many or all cars collecting data from the environment can be considered a specific form of crowd-sourcing. Some municipalities are considering crowd-sourcing to collect pollution data. This may collect fewer or no personal data from the environment, but conceptually it is not too far from a car spying on its environment.

#### 24.2.4.6 Peer Ad-Hoc Networks

Peer ad-hoc networks (e.g. other traffic entities or other autonomous vehicles) can be interested in any kind of data used or analyzed by a specific car to optimize path tracking and stabilization or which results from the optimization process. This data may help the peer ad-hoc networks to assess the road conditions other vehicles are experiencing especially at locations that are touched by their own routes. If the data are anonymized and stay with the involved peers, the consequences are less severe than data transfer to (central) entities aggregating data like the other entities discussed in this chapter.

#### 24.2.4.7 Traffic Control Centers

Traffic control centers' interests depend a lot on the interests of their operators and owners. Control centers aiming for efficient traffic flows, and to mitigate the effects of accidents on traffic flows, are interested in any kind of data that help them to assess current and future traffic situations: Driving conditions can be derived from environmental information or from the assessments of driving behavior as delivered in all cases; potential congestion can be derived from travel plans and navigational data. The other aims of these centers may include collaborations with other entities to refinance their costs or even deliver a profit to their owners or operators. This is helped by the fact that the other entities discussed earlier in this section can make use of the data collected by traffic centers.

The degree to which traffic control centers would be interested in collaborating with other entities interested in their data, and offer some reimbursement, may well depend on their status and financial situation. A private for-profit control center would need to find funding; a public traffic center may be under less pressure here. However, for many recent major investments in public infrastructures, there were aims to operate them as public-private partnerships to mitigate the lack of public money for investments. This holds for toll-fee collection and was also the plan (though not a successful one) for the Galileo satellite network. Also, public broadcasting companies are becoming more and more dependent on private co-funding, e.g. from advertisements.

#### 24.3 Are Certain Types of Data Special and Do They Create Particular Obstacles?

It is extremely difficult to predict the potential use of data for legitimate or illegitimate purposes, and it has proven impossible to guarantee that no kind of data would be used or misused, even in the long run. One reason is that, with today's connectivity, combining data is easy. Data on the agility a driver shows when taking back control from a driving robot may look harmless, but if put in relation to the same data 10 years before or hence, they can give the impression of driving abilities tending to rise or fall. This may put the driver at an unfair disadvantage, e.g. when insurance fees are calculated. Similar scoring activities by credit rating agencies have shown to be often very wrong with regard to an individual, even if they may have a statistical value. Therefore there are no explicit rules to consider certain data special and have special hindrances for their usage. One can get the feeling that data allowing conclusions on to be drawn people's health and/or (political) views are especially sensitive, but there are no clear indications that these are always more sensitive than data on their financial situation, for example.

The legal consequence of this difficulty is the principle of asking for the processing of each and every piece of data to be authorized, instead of giving general clearances (see also the descriptions of "Purpose legitimacy and specification" and "Collection limitation" in Sect. 24.4.1). All data thus needs to be checked: Are they absolutely necessary to

#### 24.4 Requirements from the Perspective of Privacy

This section discusses the requirements from a privacy perspective, starting with an introduction of internationally established principles and their relation to the use cases (Sect. 24.4.1). Then additional surveillance measures for a "data-protected" usage of the additional data are discussed in Sect. 24.4.2, before Sect. 24.4.3 focuses on limiting access rights and on encryption.

#### 24.4.1 Principles

appropriate?

For any personal data collected and transmitted beyond the domain of the data subject, there must be a clear justification with regard to relevant privacy principles and related requirements. Privacy principles and requirements depend on the respective national, regional and sometimes sector-specific legislation, so a complete analysis would be impossible. Fortunately there is now the international standard ISO/IEC 29100 Privacy Framework that was completed in 2011 and lists eleven privacy principles [8]. These privacy principles were derived from existing principles developed by states, countries and international organizations, e.g. the OECD and the EU. The editors came from Germany and the USA, and experts from many countries participated intensively in the development. One focus of the ISO/IEC 29100 Privacy Framework is the implementation of the privacy principles in ICT (Information and Communications Technology) systems; another is on developing privacy management systems within organizations' ICT systems. The privacy principles aim at guiding the design, development, and implementation of privacy policies and privacy controls. A sketch of related requirements can also be found in a recent recommendation of the very influential "Deutscher Verkehrsgerichtstag," an annual conference of legal experts focused on traffic regulation [9]. The eleven principles are:


This section will concentrate on explaining the principles considered most important and give some examples from the use cases<sup>2</sup> :


<sup>2</sup> ISO/IEC 29100 has more extensive explanations of the principles.

wherever possible, not involve the identification of PII principals, reduce the observability of their behavior, and limit the linkability of the PII collected with other PII (and thereby also the traceability of the PII principal). Moreover, one should delete and dispose of PII whenever the purpose for PII processing has expired, there are no legal requirements to keep the PII, or whenever it is practical to do so. For all four use cases, this principle limits the transfer of any data to any central entities, such as traffic control centers: PII that is only needed to manage the situation in and around the vehicle shall not leave the vehicle without the PII principal's permission. Data minimization also demands the storage of sensed data to be limited, especially when the data can easily be recollected when needed again. Last but not least, limiting the linkability of the PII collected calls for anonymization and aggregation of any data that is not needed for individual cases.

• Information security: Information security refers to protecting PII with appropriate controls at operational, functional and strategic levels to ensure the integrity, confidentiality and availability of the PII, and protect it against risks such as unauthorized access, destruction, use, modification, disclosure or loss throughout the whole of its life cycle. Information security spans a wide spectrum from choosing an appropriate PII processor to limiting access to PII to those individuals who require such access to perform their duties. Sects. 24.4.2 and 24.4.3 describe related measures.

Data usage beyond that absolutely needed to provide the service for which the data was collected requires explicit consent. So for any PII collected and transferred beyond the domain of the PII principal, there must be a clear and convincing rationale with regard to relevant privacy principles. The rationale must be convincing for the PII principal in terms of what is gained and what is given up. The rationale must also be convincing for the regulator, who will check whether the PII principal is being misled, e.g. by stating a data processing necessity that does not exist when, following the data minimization principle, an alternative methodology or technology could be chosen. The regulator will also check, whether fundamental rights would be endangered by processing the data; fundamental rights cannot simply be given up by users through consent, as they may not understand the consequences. A related example would be asking users to store and process their voting behavior.

Any PII that may enable users to be discriminated against according to their beliefs, thoughts or actions (e.g. topics of interest and related locations and destinations (e.g. towards a political demonstration), also in relation to other people's locations and destinations of) is in many practical cases especially critical.

One example for a reasoning can be found in the landmark decision of the German Constitutional Court from 1983 [10], that established the fundamental right of "Informational Self-Determination" in Germany and asks to beware of a "chilling effect" on citizens' participation in democratic processes: A person who is uncertain as to whether unusual behavior is being taken note of, used, or transferred to others will attempt to avoid standing out through such behavior. Persons who assume, for example, that attendance of an assembly or participation in a citizens' interest group will be officially recorded, and that this could expose them to risks, will possibly waive the exercising of their corresponding fundamental rights. This would not only restrict the possibilities for personal development of those individuals but also be detrimental to the public good, as self-determination is an elementary prerequisite for the functioning of a free democratic society based on the freedom of action and participation of its citizens.

Similar considerations are especially relevant in countries with unstable political governance, where citizens have to fear that a future government may not tolerate behavior that would currently be perfectly legal. This may include travelling to a political meeting.

Moreover, the Snowden revelations [11] have shown that there are severe weaknesses to be considered in the data security governance of many entities storing PII, especially data attractive to intelligence agencies. These developments can be expected to be included in future risk analyses and considerations.

#### 24.4.2 Additional Surveillance Measures for "Data-Protected" Usage of Additional Data

Additional surveillance measures for a "data-protected" usage of the additional data can be foreseen. They are motivated, for example, by the ISO/IEC 29100 principle of accountability [8].

The accountability principle means that the processing of PII entails a duty of care and the adoption of concrete and practical measures for its protection. This will apply to any party processing PII. The measures are supposed to not only secure the proper processing, but also enable and ease supervision by regulatory authorities, e.g. data protection commissioners.

The information security principle (cf. also Sect. 24.4.1) calls, for example, for controls at operational, functional and strategic levels to ensure the integrity, confidentiality and availability of the PII, and protect it against risks such as unauthorized access, destruction, use, modification, disclosure or loss throughout the whole of its life cycle.

Typical issues of importance are to audit who had or has access to the PII and who worked or works with it in which way. Additional surveillance measures will therefore apply to any additional entity that may have access to the PII. Experience with auditing has shown that it can lead to additional privacy problems, as audit records on processing may be used in an even more discriminatory way than the data themselves. An example could be an entry in a traffic control center's audit log that PII on the reaction times of a certain driver's interaction with the driving robot were examined by a task force to analyze driving behavior.

Moreover, additional surveillance measures should not lead to oversurveillance of the individuals working with the system, at least in regions where privacy in the workplace is protected. So a fine balance has to be found depending on the relation between customer protection and employee protection.

#### 24.4.3 Limiting Access Rights and Encryption

Limiting access rights and encryption are typical instruments of information security. Limiting access rights is also mentioned under the "Information Security" principle of ISO/IEC 29100. It follows the concept of "need-to-know", limiting access to PII to those individuals who require such access to perform their duties, and limiting the access of those individuals to only that PII which they require to perform their duties. Access rights can be defined by defining exactly which entity can access which PII. This asks for a fine-grained specification of the system, and can best be achieved if privacy is already considered during the design phase, e.g. when designing which data are collected by the vehicle and for which application they are needed.

Another way to limit access rights is to define that only groups of entities can jointly access certain data, e.g. any kind of audit records. This four-eye principle (or n-eye principle) helps against unauthorized use of data and can especially apply to audit records of system behavior involving PII. One could specify, for example, that these kinds of data are only made available to address a defined system failure, and that both the PII principal and the interested party, e.g. an authorized repair shop, need to agree on the access. The n-eye principle can also be implemented by encryption if parts of keys are distributed among the respective stakeholders.

Encryption is not directly mentioned in ISO/IEC 29100 as its use is sometimes considered controversial in some ISO/IEC member states. However, encryption is mentioned as an example of a requirement for transmitting medical PII over a public network ([8], Clause 4.4.7). It is also being asked for more and more by Privacy Commissioners, who have understood its advantages, especially for creating virtual vaults or tunnels to protect PII even without the cooperation of the entity storing or transporting the PII. If encryption is used, it is important to define clearly who will be allowed to hold the keys for the respective encryption and decryption. PII providing clues to an individual's behavior and abilities may need to be protected by an asymmetric encryption system, and then by encrypting the PII with the public key of the respective individual. This would ensure that the PII can only be decrypted with the corresponding private key of the individual.

#### 24.5 Architectural Considerations

Any architectural considerations need to consider the interests of systems' stakeholders. PII stakeholders mentioned in this text so far include drivers, passengers and owners of cars. Other stakeholders may be individuals who need to work with the PII, perhaps also bystanders on the street or other traffic participants if they can be identified by the system.<sup>3</sup> It turns out to be useful to consider non-professional users of systems especially, as they usually have less opportunity to protect themselves [12]. They are usually also those entities that Privacy Commissioners are meant to look after.

In general, architecture characteristics can be derived from the principles discussed in Sect. 24.4.1. The principles of collection limitation, data minimization, and information security are especially relevant for architectural considerations. Any architecture that allows a service to be provided that collects, uses and spreads less PII not only reduces the damaging consequences of any misuse, but also eases the securing of information.

Three architecture characteristics and elements are especially recommendable:

	- If, in any of the cases, a situation can be resolved directly between two vehicles, this is better than involving a traffic control center or other external entity. Sometimes the issue of the trustworthiness of the information provided by other vehicles is brought up. A quick solution seems to be to identify the other vehicle individually and to check it against a central registration database, similarly to a police car checking registration plates of cars. This may be a nice sales scenario for selling directory services, but viewing it as a gain for privacy or security is short-sighted. It would transfer an exceptional police activity into a regular activity performed by perhaps every vehicle, and so establish a massive surveillance infrastructure. Moreover, being able to identify a car precisely does not give any guarantee for the information provided by that vehicle. This information may still be manipulated and misleading even if a valid identifier is sent by the vehicle originating the information.
	- The concept of a user-owned "Private Data Vault" (PDV) to store PII should be explored in more detail to enable the storage of sensitive data under the user's control. This PDV could store the PII of the respective individuals and protect it against unwanted access, so that access is not possible without those individuals' consent. Especially for drivers using cars used by several drivers, and for rental customers or drivers, this would be useful. A PDV could be installed within the vehicle (in the special case of vehicles used mainly by a single person) or would ideally be brought by the respective driver when using the car. The PDV should use appropriate hardware protection for storing the data, and can be the initialization of trustworthy data stores. A combination with other personal devices such as mobile phones might be possible in future, but first these devices need to become more secure and better able to protect themselves, especially against outside approaches

<sup>3</sup> This may be a motivation to design the system in such a way that it does not identify bystanders on the street or other traffic participants.

to read their data. Related concepts exist for road toll charging, see e.g. [13], and pay-as-you drive insurance, see e.g. [14].

	- Traffic and congestion analysis does not need to identify individual cars or even drivers.
	- Interaction with peers, e.g. exchanging data for traffic safety with other vehicles, does not require identification (see the discussion above under "Decentralized approaches").
	- Not even access control for cars (e.g. to decide access to parking spaces) needs to identify cars individually. The concepts of Partial Identities (ISO/IEC 24760-1, [15]) and Privacy-friendly Attribute Based Credentials [16] allow the limiting of information presented in such cases to what is really needed to gain access. For example, in Use Case 2 the certified information that a parking space was booked for the autonomous valet-parking of a vehicle does not need to identify the individual vehicle towards the access control system of the parking space. Transferring a presentation token that only identifies the vehicle if it is used twice (and is therefore misused) should suffice.

#### 24.6 Long-term Considerations

It seems likely that any infrastructures for autonomous driving will be large, and therefore that any planning for their introduction, use, and maintenance needs to be long-term. A few remarks about long-term experiences should, then, be useful:


#### 24.7 Concluding Considerations

One may think that a higher degree of autonomy in driving would lead to more data processing to enable the autonomous driving, and consequently to more surveillance. Actually, this is not necessarily the case. The two main factors leading to the collection and spreading of additional data through autonomous driving are:


An autonomously driving vehicle that drives sufficiently autonomously, that it does not need to interact with a driver, does not need to collect more data from a driver than any "conventional" car. Also, if the vehicle is able to autonomously navigate through traffic and reach its destination, it would not communicate more data than any other vehicle, and even less data, than a conventional car using a centralized navigation system and that is under surveillance, e.g. by a system that constantly collects the geo-coordinates of the car.

Of course, some of the close-to reality intermediate scenarios, e.g. a vehicle handing over to a driver in critical situations (see e.g. Use Case 1) combined with a centralized surveillance in critical situation can lead to more surveillance and consequently more privacy problems. So while, in theory, vehicles driving more autonomously does not necessarily lead to more privacy problems, there is a realistic threat that in practice this will happen if the design and architecture do not carefully avoid privacy problems.

Therefore, an approach of privacy-by-design for autonomous driving-scenarios is needed. At least for the following questions, one needs to perform a thorough check:


There is clearly a challenge to protect the freedom that has been associated with personal cars for a long time, and that is one of the reasons for their success. Perhaps a unique selling point for the established car industry, and especially premium manufacturers and brands, is to not simply follow the easy trend of Internet businesses in letting information flow everywhere unless they get stopped by legislation or customer outrage, but rather to facilitate proper protection for their customers. The car industry has shown in other areas, for instance in the reduction of energy consumption, that one does not need to accept primitive solutions, but can overcome adverse effects and reduce resource usage by careful planning and engineering. The triggers for this approach will come anyway.

Open Access This chapter is distributed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, duplication, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, a link is provided to the Creative Commons license and any changes made are indicated.

The images or other third party material in this chapter are included in the work's Creative Commons license, unless indicated otherwise in the credit line; if such material is not included in the work's Creative Commons license and the respective action is not permitted by statutory regulation, users will need to obtain permission from the license holder to duplicate, adapt or reproduce the material.

#### References


# Part V Law and Liability

## Tom Michael Gasser

The articles in the "Law and Liability" section examine, from a higher perspective, the respective significance of various legal systems for a social structure that allows for autonomous driving. The vantage point here is here primarily formed by, and partially limited to, the authors' knowledge of the American and German systems of law, as well as auto industry practices. For the most part, however, the focus is on matters of overriding importance within the respective legal systems, the fundamental values of social order, and the probable long-term legal institutions and interests. This allows conclusions to be drawn on the forward-looking topic. Given this abstract approach, it should also be said for this section that all stated legal views on these matters of the future are those of the authors and are no substitute for legal advice in individual cases.

To understand the challenges of the long-term objectives of autonomous driving, one must be aware that, so far, "autonomous machine activity" on public roads clearly accords with the day-to-day reality of very few legal systems. This also applies to individually proactive US states. Even if the trained eye of an expert is frequently required, today's prototypical systems involving high degrees of automation mostly still assume a human driver's presence as a supervisor for technical reasons. The greatest challenge from a legal standpoint lies in dispensing with this established and widely accepted driving activity of controlling the vehicle. The articles in this section lay out in detail the causes of the legal uncertainties brought about by this change. In part, it has been possible to identify questions for future research that may help to better understand any potential changes. But it has also been possible to derive strategies and recommendations that take these changes into account and may make adaptation easier.

In his article Fundamental and Specific Legal Questions Concerning Autonomous Vehicles, Tom Gasser provides an in-depth examination of today's road traffic and its dangers in light of the human right to life and physical integrity. Based on this, Gasser demonstrates that the basic change on the road to autonomous driving consists in transitioning from driver-controlled vehicles to autonomous machine activity in public space without being able to wholly rule out dangers in this process. The author deems this change significant in respect of constitutional law. This examination of the legal impact of autonomous driving then goes on to look closer into the risks resulting from automation and the hypothesis of the "dilemma situation." Fundamental design requirements for autonomous control functions to protect pedestrians and cyclists result from this, as well as further research questions to determine the causes of traffic accidents in today's road transport system. In the author's view, a deep understanding of these causal processes could lead to further insights into the safe design of autonomous driving. Alongside some more specific issues, the article details the communication between road users. Here lies a need for fundamentally new concepts in the long-term objective of autonomous vehicle operation.

Product liability in the United States is the focus of the article Product Liability Issues in the U.S. and Associated Risk Management by Stephen Wu. Risk management of product liability is a significant challenge that automobile industry and other firms in the sector have to face up to if their aim is to sell autonomous vehicles in the U.S. Autonomous-vehicle manufacturers may thereby be exposed to very considerable, possibly even existential risks. The abstract-seeming risk and its triggering factors are illustrated with lively accounts of product liability cases in the automobile sector over recent decades. This overview makes the risks tangible and clear. Against this backdrop of experience, recommendations are given for product liability law risk management in the development and safety validation process. The manufacturer can minimize risks through careful preparation for potential product liability cases.

Taking as its starting point an abstract analysis of the risks and uncertainties thrown up by both autonomous and today's vehicles, Bryant Walker Smith outlines the considerable challenge that regulation represents in practice. In the conclusion of his article Regulation and the Risk of Inaction, he arrives at a total of eight recommendations for guiding strategy—mainly concerning public bodies, but also private stakeholders affected by autonomous driving. These strategies tackle either the risks themselves or the negative consequences and effects of autonomous driving. The argument of this innovative approach rests on the opportunities offered by vehicle automation. One of Walker Smith's basic opening observations regarding regulation is on its necessity. If decisions in the areas that guide action are not taken by those responsible for an abstract decision, they will only be shifted to the next level in cases of materialized risk. This would lead, for example, to courts having to deal with the very same questions.

Thomas Winkle's article is on the Technical, Legal, and Economic Risks in the Development and Approval of Automated Vehicles. Based on many years' expertise, he traces the technical improvements in vehicle safety over recent decades. Greater vehicle safety and reliability are faced with higher consumer expectations. Using Federal Court of Justice rulings on product liability, the author also depicts and gives substance to the expectations and requirements placed on automobile manufacturers. Particular attention, however, is given to the indirect economic effects of product crises on vehicle manufacturers, of which customers' loss of trust can be the severest consequence. The article shows real opportunities for manufacturers to impact vehicle safety in development and approval. These include not only the development of new approaches for new safety and testing concepts, but also the recommendation of an internationally agreed Code of Practice based on the equivalent code for the safe design and evaluation of driver-assistance systems, which appears equally advisable for automated vehicles. With a historical glance back to the initial stages of the automobile, in the closing remarks it is argued how excessive perfectionism may hinder the introduction of an innovation. In conclusion, therefore, the conscientious and careful application of available expertise is proposed as an innovation-friendly approach to the development of automated vehicles.

# 25 Fundamental and Special Legal Questions for Autonomous Vehicles

Tom Michael Gasser

#### 25.1 Introduction

The "Autonomous driving on the roads of the future: Villa Ladenburg Project" by the Daimler und Benz-Stiftung looks at degrees of automation that will only become technically feasible in the distant future. The treatment of the legal questions in the present chapter therefore draws heavily on the description of the use cases (see Chap. 2), which begin to provide a concrete basis for evaluating individual issues. Uncertainties in predicting future technical developments can be expected and will have a commensurate impact on the assumptions and conclusions of this chapter. The resulting uncertainty is nevertheless unavoidable if one wants to press ahead with important interrelated issues. This chapter is therefore intended as a contribution to the debate on societal aspects of automated driving from a legal perspective and not as a legalistic evaluation of the subject. The consideration will largely focus on the situation within the context of current German law. The legal views expressed are those of the author and are based on nine years of experience in the field of driver assistance system research.

In terms of the underlying conception presented here, the societal dimension of autonomous vehicles addressed in the present project goes well beyond the adjustments to the legal framework currently being called for in Germany. The following will examine the question of "societal acceptance" in the context of the legal questions raised by autonomous vehicles. This line of investigation is not immediately obvious and covers only a segment of the more thoroughgoing focus of the project (see Chap. 29).

Autonomous vehicles will presumably only attain widespread success when their overall societal benefits exceed the damage associated with them [1]. This early hypothesis, asserted in regard to driver assistance systems, must be regarded in relation to

T.M. Gasser (&)

Federal Highway Research Institute (BASt), 51427 Bergisch Gladbach, Germany e-mail: gasser@bast.de

the supremely important matter of traffic safety. The requirement would be fulfilled if overall traffic safety were improved through advancements in the vehicle technology (which, however, would not necessarily result in societal acceptance (see Chap. 29)). Even today it may be surmised that autonomous vehicles which are controlled on the basis of automated perception of the environment will not be capable of completely flawless operation. It may therefore be concluded that even with autonomous vehicles, there will continue to be individual severe damage incidents, which in extreme cases will include multiple human deaths. The societal acceptance of autonomous vehicles therefore necessarily depends upon societal acceptance of the consequences of these developments. From a legal perspective, the fundamental issue at hand is understanding and accepting the "effect of autonomous vehicles" in the public space as an independent "action" by machine. This situation in road traffic would indeed be totally new (other forms of transportation such as automated, driverless trains generally strictly implement the concept of separation between automated control and public space through physical barriers; there are, apparently, very few exceptions,<sup>1</sup> which, however, seek to exclude any resulting dangers by means of exhaustive safety concepts nearly completely see [2]).

The novelty of autonomous vehicles as effective actors in the public space of road traffic from a legal standpoint can be demonstrated—as will be attempted in the following—in order to highlight that societal acceptance of such a substantial change must indeed begin to take root (see Chap. 30) before it can begin to have an impact on the adjustment of relevant regulations.

#### 25.2 Previous Work and Preliminary Considerations

To this author's knowledge, the question of societal acceptance of driver assistance systems with machine perception was first raised by Homann [1] in the context of a working conference in October 2002. The contents of that paper can be applied to the present examination of autonomous vehicles. In this regard, it can only be concluded that the societal acceptance issue that was discussed at the time with regard to "new generation driver assistance systems" has yet to become anchored in the public consciousness as a "problem," although the systems discussed back then have become available on the open market and sufficiently widespread to reveal the existence of any actual problems. This is presumably due to the fact that to date, spectacular negative effects resulting from such systems (as could be imagined in the case of emergency braking assistance, for example) have not been recorded. One reason for this could be that the systems do indeed function (almost) flawlessly. A more differentiated explanatory approach, however, is that any such interventions in the control of the vehicle

<sup>1</sup> RUBIN project for the automation of the U2 and U3 subway lines in Nuremberg: Provisional mixed operation of automated and conventionally controlled trains was implemented on a route section between Rathenauplatz and Rothenburger Strasse. Moreover, the concept does not employ a physical barrier along the platforms, but rather a sensor-based platform safety system.

only occur extremely briefly in very accident-proximate situations. This suggests the use of a technical variant that only intervenes when the evaluation of the environment recognition system determines a very high probability that an intervention is indeed necessary, thus reducing negative effects to a minimum. It must also be taken into account that the driver still has the duty to perform all requisite control functions. Thus the driver potentially remains available as a comprehensive fallback level in all cases of non-activation. The result of these considerations is the relatively minor significance of such functions not only in terms of their share of active time in the overall control of the vehicle but also with regard to the reliability expected of them. Such functions can therefore only be used in a very limited capacity in conjunction with independent or autonomous vehicle control systems: The subordinate significance and a tightly circumscribed "field of action" of a function lead to a strengthening of the driver's role. This is presumably an important reason why the discussion regarding societal acceptance has not taken place thus far.

There is little reason to believe, however, that societal acceptance will play an equally minor role in the case of autonomous vehicles: If one takes the representative use cases used as the basis for the current project as a baseline (see Chap. 2), it becomes clear that they demonstrate a very high degree of automation. The "automated driving capability" of these use cases as a reference value is defined in greater detail in terms of "capabilities of perception, cognition, behavioral decisions and behavior execution" (see underlying definitions in Chap. 2). A machine-based "autonomy" of the vehicle emerges which makes it possible to speak of "driving robots" "as a subject … analogous to the role of the driver in the vehicles of today" (see Chap. 2). At this point it becomes clear that we are speaking of a very fundamental shift that will be accompanied by the introduction of such automated decisions in the public space.

Not much can be said about the question of societal acceptance of autonomous automated driving capabilities from a legal standpoint. However, what legal regulations will presumably reflect to a high degree is what can be regarded as amenable to consensus on the societal level—an assumption which can be regarded as justified, at the very least where individual regulations are not discussed and scrutinized by a wide swath of the public. Comparing autonomous vehicles with current law shows that the spirit of current regulations does indeed not cover independent "performance" by machines in the public space (understood as behavioral decisions and behavior execution as a new sense of automated action; see above).

Laws should be abstractly/generally applicable to all life situations. This maxim also fundamentally applies to the stipulations of traffic law. But when changes to the realities of life emerge which cause previously fundamental presumptions to lose their validity, as would be the case in the eventuality of autonomous vehicles with decision-making capacities in the public space, this can only be represented through an application of the law. It is possible to precisely describe the emergent change and bring the overarching fundamental values of our society—such as basic rights—into the argument, which can provide a framework which will presumably outlive the changes and set the parameters for development.

#### 25.3 The Current Traffic Situation as a Starting Point

Fundamental state duties even with regard to road traffic accidents can be traced back to the constitution. In view of the hazards associated with road traffic, the basic rights relating to life and physical integrity [protected by article 2, paragraph 2, clause 1 of Germany's Fundamental Law (GG)] are paramount. The scope of protection afforded by the basic right to life includes protection for all (universal fundamental right) not only against targeted homicide, but also against behaviors that may unintentionally (unintended interventions such as the effects of accidents) cause death. The state's duty to provide protection is comprehensive and also affords protection against illicit interventions by third parties. This ultimately leads, where interventions cannot be justified, to a state duty to prohibit such interventions, for example by establishing rule of law [3].

Here a discrepancy between the realities of life in society and constitutionally grounded rights comes into focus. Notable in particular is the fact that "traffic safety [is barely discussed], although the still large number of traffic deaths and permanently severely injured accident victims provide ample reason to do just that" [3]. Indeed, in the media major traffic accidents are regularly treated as relatively insignificant matters of merely regional interest. The phenomenon that emerges from this view, namely that the dangers associated with the current traffic situation, excites so little interest and plays such a minor role in the socio-political discussion [4], which can at least be seen as an indicator of broad societal acceptance of this state of affairs.

At the same time, the duty to protect vis-à-vis the "risks of technology" is critically important with regard to road traffic as well. Statistics are recorded on (severe) road traffic accidents (as per section 5, paragraph 3 of the Law on the Statistics of Road Traffic Accidents (StVUnfStatG), with research conducted by the Federal Highway Research Institute), which enables precise monitoring of traffic safety trends and accident causes (bearing in mind that the number of road traffic deaths has shown an overall decline for many years). Yet the significance of traffic safety extends far beyond this as a critical factor in traffic policy overall, including in (but not limited to) the establishment and adaptation of traffic-related (driver permission, vehicle technology, behavioral and many other) legal regulations, but also in the design of roadways, road maintenance, road equipment, and so on. In spite of these various efforts and ongoing improvements, the status quo of 3339 deaths and 374,142 injuries (in Germany in 2013) remains a reality with which no one can truly be satisfied.

Finally, from a very fundamentally legal perspective, the question arises as to the constitutional rationale for these interventions in the fundamental rights to life and physical integrity. It can be argued on the basis of the mobility requirements of other fundamental rights-bearers associated with motor vehicle traffic and their willingness to subject themselves to the concomitant hazards of such traffic on account of the benefits associated with it. But even that is not universally valid, in particular if one considers that the dangers that flow from motor vehicles, in view of the considerable operational hazards in comparison to non-motorized traffic participants, does not allow for any utterly unambiguous argumentation: While with motorized traffic participants it can be argued that they are prepared to accept the increased danger associated with motor vehicles which they themselves create, this cannot be extended to pedestrians or bicyclists [3]. That said, pedestrians and bicyclists, with 557 and 354 deaths, and 30,897 and 71,066 injuries, respectively (for 2013) [5], represent a significant share of all road traffic accidents in Germany.

Nevertheless, it seems probable that across broad sections of the public, there will be a significant degree of consensus that the consequences of road traffic are acceptable in view of the mobility needs of society. If one were to venture the thought experiment of imagining significant limitations of motor vehicle traffic in the interest of improving traffic safety, this would at the same time mean failing to take account of some other important societal needs: Immediately effective (radical) changes would obviously be associated with substantial limitations on individual (motorized) mobility, as well as (and not only) the general freedom of action protected in the Basic Law under section 2, paragraph 1 GG). Because such an approach would be extreme, its proportionality comes under scrutiny: Identifying any such measures which would be suitable to the task in view of roadway driving of a total of 724 billion kilometers (in 2013 in Germany) [5] and yet not result in severe consequences for the economic development of the country, the ability of people to carry out their jobs, the provision of public services and much more, is virtually inconceivable. Against this backdrop, the probability of a majority being in favor of restrictions with regard to motor vehicle traffic is low. The currently practiced approach of continuous improvement of traffic safety thus emerges—as the positive development heretofore attests—as successful, realistic and exemplary. The aforementioned appeal from a constitutional standpoint for a more vigorous debate on traffic safety does not in itself call into question the existing legal situation with respect to road traffic, but instead highlights, at this stage, the importance of traffic safety efforts in this context.

But if one carries the pursuit of causes of the comparatively poor performance of road traffic compared to other forms of transportation, it is worthwhile to consider a fundamentally unique factor with regard to road traffic. With the legal definition of roads as "public goods in public use … [which] are made immediately available to the public for the established purpose without special permission", including recognition of roads as a "multi-purpose institution" [6], attention is rightly drawn to a characteristic in which road traffic as we know it today—including the associated accidents—is rooted. As public goods in public use, roads exist not only for the purpose of changing locations (traffic in the narrower sense), but also serve to enable commercial and communicative traffic (traffic in a broader sense) [7]. Ultimately this definition of the purpose of "roads" gives rise to a multiplicity of traffic situations understood in terms of diversity of traffic participants, traffic scenarios, sudden, unexpected events and conditions and developments between traffic participants on roads. A comparable variety of possible interactions in which nearly the entire population is involved in some form or another and which would be associated with a comparable risk of injury is not to be found in any other area of life. Roads therefore have a multifarious function which typically is not the case for the space occupied by other forms of transportation. This functional diversity has a significant impact with respect to the circumstances that must be considered in the context of vehicle control: The requirements for the safe conduct of the driving activity are complex and diverse in nature. The driver of a motor vehicle is called upon to perform comprehensive perception of the traffic situation, make decisions and execute appropriate actions on that basis, particularly with regard to hazard recognition. In terms of the legal framework, at present this task is primarily regulated through laws governing behavior and driving license requirements. Just what significance the diversity and complexity of the task when performed by an automated vehicle control apparatus will take on in terms of legal categories will be examined in the following sections.

#### 25.4 Assessing Autonomous Driving

Against this backdrop, this project on "autonomous driving" raises the fundamental and far-reaching legal question as to how autonomous vehicles could be integrated into this agglomeration of factors in legal terms. A starting point for answering this question—as mentioned above—would be to re-examine and describe the characteristic of such vehicles as "driving robots" or "subject" analogous to the driver (see Chap. 2) and lay out the associated consequences of such an approach for real-life situations.

#### 25.4.1 Current State of Driver Assistance Systems Available on the Market

To date, an action and decision quality exists only in the case of human action (which always exists at least in the sense of the driver's own perception and decisions—or at least in the sense of a continuous duty in this respect). In fact this is the still current minimum requirement in terms of driver participation in controlling the vehicle: Current driver assistance systems in a broader sense can only aid the driver in controlling the vehicle, not act as a replacement. At the present moment (August 2014), a division of labor between the driver and the driver assistance system would be possible involving active control of the longitudinal and lateral steering of the vehicle (on the basis of independent, automated environment perception). But this control system currently possesses no independent decision quality: Rather, it is predicated at all times on the driver's immediate intervention and resumption of control of the vehicle if required for whatever reason—for instance due to faulty perception of the environment by the system. Thus the driver maintains a superordinate role and responsibility, making the vehicle control by the system appear derivative and subordinate. From a technical view of this division of labor, this is currently absolutely necessary, as the driver assistance systems currently available on the market are not capable of independently recognizing that all system limits have been reached. One characteristic warning (of several) in the instructions for the "DISTRONIC PLUS" system (an adaptive cruise control and thus a longitudinal control system of Daimler Corp.) reads as follows (as of August 2014):

#### WARNING

DISTRONIC PLUS and the active blind-spot assistant are only aids designed to assist you while driving.

They cannot act as a replacement for your attention. Responsibility for regulating the distance to other vehicles, for the driving speed and timely braking rests with you. Always pay attention to the traffic situation and your environment. Otherwise you might recognize hazards too late, cause an accident and injure yourself and others. [8]

From this warning—which can be found in similar form with other currently available driver assistance systems—illustrates very clearly that the system can only assist the driver if the driver maintains uninterrupted attention to his/her own perception of the traffic situation. All of the control processes automated by the system must be checked by the driver and overridden as needed through appropriate control actions by the driver.

Driver assistance systems are therefore described from a control engineering perspective as a "redundant-parallel" form of the division of labor combined with the same tasks [9]. This description in terms of division of labor is indeed appropriate from a legal standpoint, but does not say anything about where decision-making authority lies in case of contradictory performance of the task. With current driver assistance systems, the authority to override the driver assistance system at any time always rests with the human driver. The proper use of the system that emerges from the operating instructions is always directed towards observing and assuring the proper performance of the system and making appropriate changes if the system is not acting as it should.

If the longitudinal and lateral control of a vehicle—i.e. the two fundamental aspects of the driving function in terms of control—are both automated at the same time, this division of labor is described as partially automated [10]. This does not change the fact, however, that such systems are not capable of recognizing system limits on their own and are thus necessarily subjugated to the redundant-parallel perception, decision-making and action of a human driver (understood as performance of authority in the spirit of "override in the case of any recognizable need"). Thus with respect to automation which is subject to monitoring by the driver, the aspect of "authority" attains the legally decisive significance.

The result, then, is that with regard to the driver assistance systems on the market to date, there is never an independent, but only a derivative action and decision quality residing in the vehicle control system, which only occurs under the complete authority of the driver, who continuously monitors it according to regulations.

#### 25.4.2 Autonomous Driving

The matter is fundamentally different in the case of autonomous driving, which is examined here by means of four representative use cases (see Chap. 2). All four use cases envision a driving robot that assumes the vehicle control function. Even the "Interstate Pilot Using Driver for Extended Availability" use case, which clearly recalls current driver assistance systems, does not indeed require that the "driver" actually perform any functions during automated driving that would correspond to our current definition of a "driver". This emerges in the clear formulation that the driver "becomes a simple passenger during automated driving".

Thus autonomous driving essentially envisions a situation in which the redundant-parallel performance of tasks by the driver and the system gives way to potentially temporally and spatially delimited—independent automated vehicle control by the system. The person now fittingly referred to merely as the "vehicle user" does still retain a "dominant" intervention capability in the aforementioned "Interstate Pilot" use case, which does not fundamentally differ from the "authority" in the case of driver assistance systems described in Sect. 25.4.1. However, the basis for performance is rather likely to be lacking: As soon as the role of the driver changes so dramatically that not only performance of the task but also observation of the traffic situation and the evaluation of the automated control decisions which are based on it are dropped, the significance of this "dominance" or "authority" is inevitably limited. Thus even where the vehicle user is paying attention to the situation, there is de facto no basis for performance of this "dominance" or "authority". In the case of the two use cases distinguished by the spatial absence of the vehicle user (see the "Autonomous Valet Parking" and "Vehicle on Demand" representative use cases in Chap. 2), the lack of a basis for actually exerting "dominance" or "authority" is even more evident.

The lack of a basis for immediate observation of the traffic situation as a starting point for vehicle control can only be interpreted as de facto independence or "autonomy" of the automated control system. The therefore decisive significance of the autonomy of the automated vehicle control system in the present context has naturally found its way into the name of the underlying project.

#### 25.5 Fundamental Legal Questions vis-à-vis Autonomous Driving

Legal questions related to autonomous driving cannot, as touched on in Sect. 25.2, adequately, let alone exhaustively, be addressed in terms of the current legal framework. The reason for this is that in their creation and ongoing development, the legal bases of road traffic law could only take account of considerations that were in need of regulation at a given time. In the field of public road traffic, the question of autonomous vehicles has not arisen thus far—including in the context of driver assistance systems currently available on the market (see Sect. 25.4.1): Heretofore it could always be assumed that a driver would execute vehicle control at least in the sense of redundant-parallel task performance. If one looks at autonomous driving, by contrast, there is a shift of fundamental significance towards independent automated vehicle control.

#### 25.5.1 Risks of Automation

For autonomous vehicles, it is assumed that "hardware failures and software failures … [can] also occur with autonomously driving vehicles," although such vehicles developed "with state-of-the-art technology" are classified as "at least as reliable and safe … as current conventional vehicles are." The following considerations also demonstrate, however, that there is a great deal of uncertainty in this regard since the "success rate" in terms of vehicle control is assumed to be "similar to the quality and success rate of human drivers", but at present this represents only a conservative expert opinion which can only serve as a basis for discussion for the present project (see Chap. 2). Thus the performance of automated vehicle control systems cannot be definitively assessed; it may be assumed, however, that the risk of automation will remain, but at the same time will not be higher than the risk resulting from human vehicle control.

#### 25.5.1.1 The Automation Risks Against the Backdrop of Fundamental Rights

If we now examine the aforementioned potential automation risk in light of the situation of today's road traffic as it pertains to the fundamental rights to life and physical integrity (see Sect. 25.3), it becomes clear that the shift from human control to automated vehicle control would presumably be regarded as "critical to the exercise of fundamental rights" [11]. Due to the significant intervention that any such new automation risk would mean with respect to the fundamental rights to life and physical integrity, it must be regarded as probable that a decision regarding the allowance of automated vehicles and thus of an automation risk flowing from automated control systems in road traffic would fall under the purview of the legislative authority. The lawmaking body would bear the duty of making key decisions itself, flowing from the democratic principle and the rule of law. The critical provisions for the protection of fundamental rights should therefore not be left in field of action or decision-making authority of the executive [12]. This argumentation places the focus squarely on the novelty of such an automation risk because it would revolutionize vehicle control in general. At the same time, it must be acknowledged that the most realistic scenario for the introduction of automated vehicle control is gradual, step-by-step implementation by means of continual improvement of driver assistance systems available today (see Chap. 2). This raises the question of whether the transition to automated vehicle control will still be regarded as "critical" at the time when the decision is actually made. The Federal Constitutional Court has traditionally been rather restrained with respect to the parliamentary prerogative regarding the fundamental rights to life and physical integrity and has been satisfied to let questionable types of risks to life be covered by the legislative will expressed in the atomic energy act (Atomgesetz) [3, 13] (more specifically the "breeder technology" in that case). It is also not necessary to explicitly name the risks and consequences of road traffic that impact the fundamental rights to life and physical integrity (so there is no unconstitutionality of the road traffic act (StVG) flowing from this alone in current practice) [13]. Thus the question remains whether the road traffic act in its present form can encompass the novel quality of automated control. At the time of this writing (August 2014), the novelty and independence of the automated decision quality raises considerable doubts.

Should the underlying assumptions and relationships prove correct, the question of allowing for an automated control risk in public road traffic would have to be regulated by formal law (the so-called proviso of formal law). The legislator would be free to permit risks that remain "below the danger threshold" and which can therefore be justified, also in the light of freedom on the part of the person who causes the risk. However, the legislator is not restricted to this and can also become active below the danger threshold as a means of minimizing risk, insofar as this is still considered proportionate under constitutional law [3]. In terms of the magnitude of a potential automation risk, then, it seems—not least in view of the indicative effect of the situation in current road traffic—realistic to presume a level of safety and thus also regulatory authority on the part of the legislator that remains within the scope of "at least as reliable and safe as current vehicles" (see Chap. 2).

#### 25.5.1.2 Liability of the Product Manufacturer for Autonomously Operating Vehicle Control?

Product liability on the part of the manufacturer with fully-automated systems (see Chap. 2 for classification of the present use cases as "fully automated") could be determined in large part through the intended use of the product as defined by the manufacturer. Insofar as system functions—as in the case of full automation—no longer envision a necessary role for the driver with regard to vehicle control, it could in turn be concluded that the acceptance of prima facie evidence in the event of accident damage is proper: If (accident) damage occurs in the course of automated driving, the question arises whether this can be attributed causally to an underlying product defect (insofar as the relevant cause is not due to an intervention by the driver in the form of an override action or exclusively the result of improper behavior on the part of another traffic participant—all within the context of the applicable burden of presentation/proof in civil suits) [10]. In the final result, the decisive question would be whether an incorrect automated control decision could ultimately be classified as a product defect and thus that in practically all cases of incorrect control, civil liability on the part of the manufacturer could be assumed.

In that case, the manufacturer—in addition to the vehicle owner (see also [10])—would (almost) always bear the liability risk with respect to civil law for the automation risk associated with the automated action. In view of the expanded possibilities for intervention of automated vehicle control (see Sect. 25.5.2 for more on this), the scope of application for control-relevant errors would actually even expand vis-à-vis the driver.

Whether this conclusion is appropriate, however, is another question: To a great extent, the argumentation follows the assumption that the cause of accidents today is regularly due to improper control decisions on the part of the driver. However, the (in future potentially automated) vehicle control may represent only one of multiple possible accident causes.

Current road traffic law still seems to be shaped by a different fundamental understanding. This becomes clear for instance in the current edition of the road traffic act, which presumes the existence of "unavoidable events" (which in section 17, paragraph 3 of the road traffic act (StVG) still play a role in assigning the respective shares of responsibility for damage between motor vehicles). It must be emphasized, however, that of the cases currently encompassed by this, from a purely scientific standpoint and in consideration of the current state of technical capabilities it may be presumed that only some of these incidents will in future be considered "unavoidable". Even so, to date the understanding of this legal term is only limited insofar as the "the greatest possible care" and the "behavior of an 'ideal driver'" in terms of average performance expectations (as opposed to an imputed "super-driver") are sufficient [14]. (There is evidently a different underlying idea here: the question as to responsibility for an accident, not scientific causality for its occurrence).

Consistent application of the question of scientific causality could mean that only a subsection of damages occurring during automated vehicle control would in fact be traceable to a defective control system (or some other product defect). This would ultimately fundamentally call into question the aforementioned inference of damage due to the existence of a product defect during automated control. The open question in this context is therefore to what extent the current "road traffic system" represents an independently relevant cause for accident damage (vis-à-vis control decisions that might be automated).

#### 25.5.2 "Dilemma Situations"

In the context of the legal discussion, the suggestive term "dilemma situation" encompasses two interconnected aspects which can pointedly describe the characteristic properties of automated action and illustrate the consequences of a worst-case scenario of such a transformation with exceptional clarity: first, the expansion of the scope of intervention in the control of the vehicle in time-critical situations and second, the question as to the implementation of an automated control decision within the scope of fundamental rights.

To begin with, we must fundamentally question the existence of "dilemma situations" in road traffic. It is particularly unclear whether the underlying thought model of unavoidability is compelling. In road traffic, individual cases provide diverse, discreet and strongly situation-dependent opportunities to intervene in vehicle control. Preceding alternative control decisions in road traffic thus offer—potentially, this would have to be examined in greater detail—the possibility of taking action to prevent the occurrence of an unavoidable situation in which damage was inevitable. It would seem, then, that the possibility of preventing unavoidable situations through anticipatory vehicle control behavior cannot be excluded. On the other hand, it could turn out that certain hazards in road traffic arise from its very nature and are indeed not avoidable (for example due to the plenitude of possible interactions of differently protected traffic participants). In exceptional cases, the potential coincidence of two possible damages would then need to be assumed realistic, requiring a consideration of "dilemma situations". In legal categories, the question as to relevant accident causes is thus brought up which is subject to scientific determination both in terms of internal (vehicle control-dependent) and external (traffic system-dependent) factors.

Irrespective of the result of this theoretical examination of vehicle control in road traffic, discussion-worthy aspects emerge from the consideration: Using "dilemma situations" makes it possible to delineate a framework with respect to fundamental rights for automated control decisions. If one presumes the existence of "dilemma situations", it also emerges that a limitation of the manufacturer's responsibility could be called for in these cases because damages due to control actions would then be just as unavoidable as they would be in the case of the existence of independent risks flowing from the "road traffic system" per se (see Sect. 25.5.1).

Finally, it should be noted that "dilemma situations" are also addressed in various forms in the discussion of ethical aspects, where they are likewise used as a means of illuminating and examining the overarching ethical considerations (see Chap. 4).

#### 25.5.2.1 Expansion of the Scope of Influence

The conceptual model of "dilemma situations" for autonomous vehicles is based on the working hypothesis that certain acutely accident-proximate situations could still be affected by the use of automated vehicle control: In many cases it could therefore be possible to "save" materially endangered legal interests literally at the last second. With the current state of technology (and exclusively human vehicle control), these situations always require consideration of the driver's reaction time [14]. The thus delayed control action can, depending on the case, influence the occurrence of an accident or its consequences. In fact this working hypothesis, taken in the context of a transition to automated control decisions, is by no means far-fetched. Further, it may also be assumed that another benefit could be achieved, namely that an automated control system could consider alternative control options, such as avoiding rather than braking for an acutely endangered pedestrian, which average drivers seldom succeed in doing [15]. One salient working hypothesis underlying the "dilemma situations" is therefore that automated vehicle control could lead to controlling traffic situations which were previously uncontrolled or only controlled after a delay.

#### 25.5.2.2 The Automated Control Decision

A further assumption in the "dilemma situation" conceptual model which builds on the preceding takes account of the novel automated "decision quality" of an autonomous vehicle control system. This point of view is explicitly expressed in the designation of the "driving robot" as a "subject" which is revealed—with all due care in this regard—in the underlying definitions of the current project (see Chap. 2). In order to highlight this effect and argue the ethical dimension of automated control decision-making, a decision dilemma is brought in to accentuate the underlying quandary. This amplification is not to be regarded as a completely unrealistic scenario and worthy of discussion per se because it deals with the societal acceptance of a wide-ranging decision-making quality which is hereby brought into focus. This automated decision-making quality can, in individual cases—as constructed in the "dilemma situations"—impact the right of the (acutely endangered) individual to life and physical integrity and is thus not fundamentally different than in the case of the hazards affecting fundamental rights in road traffic as it exists today (see also Sect. 25.3). The major difference lies only in the underlying automated control.

#### 25.5.2.3 Critical Analysis of the "Dilemma Situation"

In any theoretical analysis of the possible consequences of automated control decisions, it is only possible to do justice to the matter if it is made clear that the "dilemma situation" in the form of the "decision dilemma," insofar as it exists at all, represents an absolutely exceptional case. In the interest of proper assessment, it must therefore be stated at the outset that this could only be an exceedingly rare exception.

The assumption underlying the dilemma is that there is no alternative to damaging two essentially equivalent objects of legal protection in a concrete individual case although the automated vehicle control system has taken all alternative possible control decisions into account. But even if in the concrete situation—in consideration of the control behavior prior to the hazard becoming acute—there were no alternative to damage, relevant alternative causes to the control behavior in the antecedent causal chain could be considered. It therefore seems plausible to assume that dangers may not reside exclusively in the vehicle control, but indeed inhere in the nature of road traffic in itself and thus flow from the complexity and variety of possible situations in the "road traffic system" as described in Sect. 25.3. This seems particularly probable where one considers the influence of driving speed, for example, which in most cases presumably represents a necessary cause (in the scientific sense) in the occurrence of traffic accidents. But the "normal" driving speed is also simultaneously a component of the current understanding of the "road traffic system" and indeed largely defines it in some parts. The image of today's road appears decidedly risky in individual cases: It is therefore appropriate to question whether in individual situations—for example when driving past a pedestrian—a risk exists [16] that could be adapted to address existing accident risks in road traffic.

#### 25.5.2.4 "Dilemma Situations" Against the Backdrop of Fundamental Rights

The legal evaluation of "dilemma situations" should take its starting point in the overarching legal framework, the fundamental rights. In the area of fundamental right to life and physical integrity nothing of fundamental significance changes due to the transition from human vehicle control to automated agency. In particular, it does not give rise to a "targeted" intervention in life or physical integrity, which in light of the importance of these objects of legal protection as the highest value and their fundamental significance would be impossible to justify for all practical purposes [3]. While every control decision is predetermined under particular external conditions by the programming of the respective system and thus is not random, as will need to be discussed in the context of product liability as well, this does not in fact represent the specification of a particular course of action. Rather, the programming of an automated driving function (only) specifies which factors should be taken into account so that among multiple alternatives, the one which completely avoids damage, if possible, or causes the least damage, can be selected. It is particularly this situation-dependent consideration of alternative courses of action which represents the decisive added value of automated vehicle control, which was described as "Expansion of the scope of influence" through automated control in Sect. 25.5.2.1. Thus in the context of programming, no actual control decisions are made, but (only) abstract criteria for control decisions in individual cases specified. This illustrates that ultimately it is still an abstract risk that is posed by automated control in road traffic. In terms of the fundamental rights, automated control would therefore not be handled differently than human vehicle control, which poses the risks presented in Sect. 25.3. Thus the associated unintentional damages to objects of protection (see [3]) which are equally caused by accidents under automated control in road traffic where an automation risk is assumed (see Sect. 25.5.1) should not be evaluated any differently than current risks in road traffic from the standpoint of the fundamental right to life and physical integrity.

One aspect, however, should be given particular attention from a fundamental rights perspective: If it emerges that automated perception of the environment is sufficient to recognize non-motorized traffic participants (pedestrians and bicyclists) as such, their protection would have to be given particular weight in the action variants established to handle such situations (see the argumentation in Sect. 25.3).

The decision dilemma described by the term "dilemma situation" between two equivalent objects of legal protection cannot be resolved, however, against the backdrop of the fundamental right to life and physical integrity: any trade-off between two equivalent values or, with regard to life, "absolute" fundamental right of other fundamental rights-bearers in terms of constitutional protection [3] is absolutely impermissible. From a legal standpoint, therefore—if one assumes the actual existence of such "dilemma situations" in reality—there can be no contribution in the sense of a decision flowing from the current state of the fundamental rights dogma; rather, a novel question in need of an answer would be raised. It would therefore be of some importance to clarify the question of whether "dilemma situations" actually occur in this manner, and in particular whether the relevant cause of their occurrence can actually be traced back to the automated control decision and not to some inherent risk within the "road traffic system"—for example due to the driving speeds in certain situations (see also Sect. 25.5.2.3). If it emerged that "dilemma situations" exist and that their relevant cause resides in automated control, it would be essential to make this question transparent and—presuming societal acceptance of an automation risk—conduct a debate about it. It would presumably be necessary to create a catalog of recognized decision criteria for such situations.

In all of this it would be essential to bear in mind that the question only arises in the first place through the expansion of the scope of intervention (see Sect. 25.5.2.1), which in most cases without a "dilemma" would lead to an improvement over the current situation. The scientific comparison of the automated decision dilemma with the driver of today will in all likelihood demonstrate that in otherwise identical situations, the driver is not regarded as culpable, not least in consideration of the moment of shock accorded to the driver (see [14]). There is likewise no distinction between the scenarios with regard to "dilemma situations" in that damage occurs in either case. The reason for addressing the question would thus be due to the decidedly welcome development that technological advancements had made it possible to influence such situations and thus to save acutely endangered objects of legal protection. The weight of this argument will presumably carry the day in the end.

#### 25.5.3 Possibility of Override by Passengers

The question of an override possibility of vehicles results from past discussions on driver assistance systems, which in large part draws on the concrete formulations of the Vienna Convention on Road Traffic of 1968 [17], which is still valid as of this writing (August 2014). Although this was not specifically mentioned, the underlying thought is nevertheless related to the question as to the duties of the driver in case of fully-automated vehicle control, which with respect to the applicable law in Germany has been described as contradictory [10]. The context can be described in terms of the concept of "dominance" or "authority", which was taken as a basis in the "use cases" discussed in the present project (see Chap. 2). All four representative use cases envision a role for the driver or passenger in vehicle control, which diminishes as the scope of autonomy rises since other factors must be given precedence in the context of functional implementation. Even the representative use case examined here with the lowest degree of autonomy, the "Interstate Pilot Using Driver for Extended Availability" use case envisions that the driver "becomes a mere passenger during autonomous driving" such that he/she "[can] pursue another activity". Thus even here there is a complete lack of a basis for an override capability at any time, which from the outset has always been regarded as factually (and not just technically) necessary. The factual override possibility by the driver was a reformulation of the initially uncontroversial "final decision authority of the driver" in driver assistance systems. This represented the subordinate role of driver assistance systems vis-à-vis the driver in vehicle control, where the system was regarded as having only a derivative authority to act and take decisions (see Sect. 25.4.1). Autonomous vehicles call this entire situation into question, such that it seems inadvisable to derive interpretations for future application from regulations that assume a human driver is taking part in vehicle control. This fundamental shift to independent automated action is already described in Sect. 25.4.2.

With regard to fundamental rights, however, one aspect does bear a brief mention: The liberties of passengers of autonomous vehicles specified in art. 2 of the German Fundamental Law provide an overall framework which—to the extent relevant in the present case—applies in particular to the right to personal mobility and personal freedom (see [3]). The limitations on these liberties resulting from autonomous vehicles do not seem as of this writing to have been fundamentally called into question, as long as the passengers always have the possibility of causing the vehicle to stop at the nearest safe and appropriate location.

#### 25.5.4 Error Compensation Capability in Autonomous Driving

A "basic presumption" of the present project is that the use cases are deployed at the considered time in a mixed operation of transportation systems with different levels of automation ... ranging from "driver-only" to "assisted" to "fully automated" (see Chap. 2). This leads to the requirement that autonomous vehicles integrate in the existing traffic system.

In the case of conventional vehicle control, as in the case of currently available driver assistance systems (in the broadest sense), which never enjoy actual autonomy (see Sect. 25.4.1), the German road traffic regulations (StVO) are applicable without exception. Drivers thus find themselves confronted with conflicting priorities of the "principle of trust" and "defensive driving". The "Principle of Trust" means that properly behaving traffic participants under normal circumstances do not need to take all possible (rare) traffic violations by others into account as a preventive measure. The "Principle of Trust" is necessary to maintain traffic flow. At the same time, the driver is called upon to "drive defensively" (to contribute to traffic safety) and thus apply more than the prescribed care (which in fact means partially hedging one's trust in the proper traffic behavior of other drivers) without this "fundamentally" undermining the principle of legitimate expectation [14]. Just how these requirements are understood in individual cases, could be inferred from court rulings in Germany. However, the continental European norm of systematized statutory law can provide but a degree of orientation in this regard, but no precedence for individual cases, which ultimately means that the value of any such aggregation of rulings is limited.

It must therefore ultimately be required of "mixed operation" vehicles that they meet (at least) the same standards required of drivers in order to ensure that they do not, at the minimum, cause any new hazards. In a precise description of the requirements on an error compensation capability, it must be noted that a significant degree of imprecision remains. If one translates the current legal requirements in road traffic into a definition of the capabilities required of an autonomous control function, it can only be asserted with sufficient certainty that autonomous vehicles must absolutely have error compensation capabilities. Autonomous vehicles would have to be able to take clearly identifiable inappropriate behavior by other traffic participants into account and adapt the automated control accordingly. According to current law, how this is achieved is left up to the judgment of the driver in individual cases. Just implementing this requirement alone from a technical standpoint would require an extremely sophisticated environment recognition capability and extremely complex decision-making processes; but these are—including in the case of the driver—not specifically defined, but rather taken as given in the context of the requisite suitability and permission to drive [18]. This lack of specificity concerning the requirements could therefore prove too difficult for implementation in the form of an automated control system.

In light of the uncertainty resulting from the antagonistic demand of "defensive driving", the only remaining option at this point is the—potentially traffic-flow-compromising overfulfillment of the error compensation capability to the extent of total risk exclusion. This leaves the question, however, of whether a significant restriction of the traffic flow would indeed be expected: due to the aforementioned expanded scope of intervention of automated control (see Sect. 25.5.2), automated vehicle control could actually prove much more capable than a human driver. This advantage, which is presently unmeasurable, could compensate for deficits in terms of traffic flow (although the resulting scope is equally unknown).

In the question of the error compensation capabilities of autonomous automated control systems, it could prove beneficial to the cause of legal certainty to formulate uniform requirements targeted to specific objectives (comparable to brake effectiveness standards for vehicles, for example) that define and harmonize the state of the science and technology. Such a catalog of requirements would presumably bear fruit in the legal definition of realistic capability requirements for autonomous control systems.

#### 25.5.5 Communication in Road Traffic

As concerns communication, for road traffic the currently existing options can be assumed. The use of some vehicle-based light and audible signals—such as headlight flashers, turn signals and hazard warning lights—if present, is explicitly prescribed by the German Road Traffic regulations. For example, warning signals (use of the hazard warning light) are prescribed in the case of hazards with school buses, when passengers get in or out, or as a warning when approaching the end of a traffic jam, with stalled cars and cars being towed [see also sections 15, 15a, 16 of the road traffic regulations (StVO)]. Section 5 paragraphs 4a and 5 of the road traffic regulations (StVO) prescribe and allow the use of turn signals and headlight flashers, respectively, in the context of overtaking maneuvers. The use of turn signals is prescribed, if available on the vehicle, when turning [section 9 paragraph 1 of the road traffic regulations (StVO)] or starting up [section 10 of the road traffic regulations (StVO)]. Through this standardized, formalized communication, the road traffic regulations achieve simplified expectations among other traffic participants [19].

Alongside this, an informal (or not legally secured) use of (light) signals has established itself which, however, is not envisioned by the road traffic regulations (flashing the high beams, for instance, can also represent ceding the right of way to another driver in Germany). It should be noted, however, that such a use of the signals is no longer subject to the principle of legitimate expectation in road traffic because it cannot be regarded as "traffic-appropriate" behavior (and, incidentally, also represents a major risk for misinterpretation).

Immediate verbal communication from within closed vehicles in road traffic is rendered more difficult or even impossible due to the physical separation of the driver from the immediate environment and the noise level of the surroundings. Even informal communication through simple gestures is considerably compromised due to the reflective effects of today's typically tinted and angled vehicle windows. Nevertheless, even the road traffic regulations offer up an application in the case of "special traffic situations," which envisions unspecified informal communication [as a special legal variant of the duty of care and consideration in section 1 paragraph 1 of the road traffic regulations (StVO)]. For instance, if it is necessary to cede the right of way, this requires communication with the driver yielding the right of way as per section 11 paragraph 3 of the road traffic regulations (StVO), providing that this communication is conducted in an unambiguous manner—in exceptional circumstances, even flashing the high beams can thereby be used to further clarify intent [14].

In view of existing communication challenges (see also Chap. 7), beforehand action, in particular when expressed in the form of motion, can also represent an indication of the intended target actions [19], such that the road traffic behavior which can be perceived from the outside such as stopping, braking and starting up also attain major significance in the context of informal communication. Such conduct is also explicitly envisioned by section 8, paragraph 2 of the road traffic regulations (StVO), which specifies that in right-of-way situations, the party required to wait shall "indicate through driving behavior that he/she will wait."

Aside from the nonverbal nature and anonymity, the complexity of the situation is also singled out as a characteristic marginal condition for communication in road traffic. This complexity is particularly determined by the speed and fleeting nature of the communication in road traffic [20].

This enables us to identify some initial important conclusions for autonomous driving: While standardized, formal communication may represent merely a challenge for machine perception and interpretation and may indeed be possible to program automatically in the other direction, the question arises at this point already as to the degree to which other drivers can only recognize automated control or how this could be implemented. Consequently, in the "mixed" communication relationship with machines, the question further arises whether other drivers would trust the contents of formal communication. This would at least predicate knowledge of the respective capabilities of autonomous vehicles in order to allow communicative interaction to function. The case could even arise that other traffic participants feel a need to reproduce the content of automated communication (for example after an accident) in order to develop a willingness to trust in machine-generated communication content.

While the resulting challenges in the case of formal communication appear amenable to resolution, informal communication in mixed operation is characterized by much greater challenges [mixed operation is the basis of the present examination (see Chap. 2)]. In this area there is a need to find approaches which would establish a bridge between machine-controlled vehicles and other traffic participants. Ultimately this conflict flows from the cause already described in Sect. 25.5, namely that detailed situation-specific regulation of communication between human drivers in road traffic is not strictly necessary and that implementation can be left to the traffic participants according to situation. This informal communication between traffic participants may be subject to conflicts and in need of improvement [20], yet it can still be presumed that drivers are generally able to resolve this challenge in all situations—not least as this is necessary to guarantee the situation-specific adjustment that is required for road traffic in the first place. With the introduction of automated vehicle control, the machines would lack this human-specific capability of achieving understanding though such unspecified means; indeed, the machine may lack even the capability of recognizing that such communication is called for. The prerequisite for human communication is establishing a reflexive attentiveness to the communication partner and mutual perception [19]. This illustrates clearly that "mixed" communication still requires fundamental approaches for bridging this communication gap with machines. This would have to be a fundamental prerequisite in order for a mixed road traffic scenario including human drivers and machine-controlled vehicles to function.

At the same time, the importance of communication for the implementation of autonomous driving can be rated according to how important informal communication proves in a given situation—an apparently very challenging task from a technical standpoint. The abovementioned speed and fleeting character of communication in road traffic would presumably differ significantly based on the environmental conditions and driving speeds. Simply structured, extremely fleeting environmental conditions such as on a highway, where the driving speeds generally require formal communication, could substantially simplify the implementation of autonomous driving in that context and minimize the apparent necessity of adapting autonomous vehicles to the requirements of informal communication (in comparison to communication needed for an urban traffic environment).

It may also be assumed that the challenge posed by communication will only occur in mixed traffic because, particularly between autonomous machines, the problem seems eminently manageable from a technical standpoint (via cooperative systems). Moreover, for mixed traffic the significance of beforehand action expressed in motion, and how it can be used for future communication in road traffic, must also be examined. Of particular interest is the question which situations can be unambiguously resolved by it. At the same time, there is the risk that an automated driving system—with a set-up designed to take full account of the error compensation capabilities of other traffic participants (see Sect. 25.5.4)—could indirectly compromise traffic flow if its configuration were taken advantage of by other traffic participants.

Finally, it may be concluded with regard to communication in road traffic that here, too, a catalog of technically implementable communication strategies for autonomous vehicles in the form of a catalog of requirements would be advisable as soon as technical feasibility is foreseeable. This summarization of the technical features required of autonomous vehicles with regard to communication will be necessary over the long term, particularly in mixed traffic, and could substantially advance the discussion on possible communication concepts.

#### 25.5.6 Violations

Through section 24 of the Road Traffic Act as a blanket provision in conjunction with the regulatory offenses specified by the road traffic regulations (StVO, section 49), the vehicle registration regulations (FZV, section 48), the road traffic licensing regulations (StVZO, section 69a) and driver licensing regulations (FeV, section 75), violations of prohibitions, duties and orders are generally prosecuted against traffic participants and vehicle owners [14]. Punishable offenses also include road traffic-related violations from the 28th section of the criminal code (StGB) on offenses dangerous to public safety (noteworthy in the present context are external interventions in road traffic as per section 315b StGB and hazards in road traffic as per section 315c StGB). It is evident that the machine-controlled conduct of autonomous vehicles would obviate the application of these provisions: Regulatory offenses and criminal provisions are always linked to a human action, which is lacking in the autonomous scenario.

The existing regulations, which carry penalties under criminal law or as regulatory offenses, also have an indicative effect concerning what behavior in road traffic not only impacts public order, but may, in line with our focus here, especially compromise public safety. The traffic regulations are "to be handled and interpreted in an elastic (traffic-appropriate) manner and without pettiness;" this applies equally, in the case of special regulations, to those which may impede or endanger [14]. Moreover, section 16 of the law on regulatory offenses provides a standard for legitimate emergency, which permits actions contrary to the law, including traffic regulations, in cases of acute danger to life, limb, property or other objects under legal protection in order to prevent imminent harm. The dangers must be grave, however, and the defensive actions commensurate to the dangers. Although the respective cases must be handled in a restrictive manner, not least to prevent specious assertions, this is ultimately a normative instrument to enable an appropriate consideration of the interests of different objects of legal protection in individual cases in a consistent and thus constitutional manner. The violation itself is subject to the same standard, such that its most extreme limit for road traffic is ultimately defined by the "danger threshold" for other traffic participants (see [21] on the question of the consideration of traffic safety in the context of the defense of necessity as a justification as per section 16 of the law on regulatory offenses).

If the introduction of autonomous driving is taken into account against this backdrop, it may be assumed that the interests would remain unchanged—at least for the mixed traffic scenario of autonomous and driver-controlled vehicles on which this study is based (see Chap. 2). A change could occur if—due to a very high degree of automated-system mastery of the automated control risk associated with a violation—the described consideration finds that the violation does not result in an increased risk. This would, of course, call into question the very rationale for the rule itself: "Violation" of the rule would then not actually produce any disadvantage in the context of mixed traffic.

It is also conceivable, however, that autonomous driving will lead to a need for considerably more detailed traffic rules which are significantly less flexible (which would in turn raise the question of societal acceptance again). Such a restriction of the existing situation would in turn require a more detailed catalog of requirements in terms of the technical control capability of autonomous vehicles as soon as they become foreseeable from a technical standpoint. This would make it possible to identify consequences, including in the case of violations, in much greater detail than is currently possible.

#### 25.6 Special Legal Questions Related to Autonomous Driving

As regards the evaluation of fully-automated, driverless driving in terms of legal regulations and product as well as road traffic liability, the introductory passages on these issues can be referred to (see Sect. 25.4.2 as well as the introduction to Sect. 25.5). In summary, the principal conclusion we may draw in this regard is that the legal regulations and traffic law provisions [in particular the road traffic act (StVG), road traffic regulations (StVO), road traffic licensing regulations (FeV) and the regulations authorizing the use of vehicles for road traffic (StVZO)] at the time of their establishment could only consider as objects of regulation what was known in terms of the state of technology in road traffic. In all aspects of public road traffic, there is an underlying presumption that a driver will personally perform vehicle control. It is accordingly true of all available systems that they do not possess an independent decision-making quality (see Sect. 25.4.1), but indeed require that the driver be at least "an active monitor" at all times.

#### 25.6.1 Legal Assessment of Driverless Vehicles

If the legal assessment of fully-automated driving [10] is therefore further extended to completely unmanned vehicles and passengers who are not able to control the vehicles themselves, clearly there would initially be no change in the present incompatibility with current regulatory law, which does not take account of this technological development.

At the same time, it must be noted that driverless and completely autonomous vehicles (see the representative use cases "Autonomous Valet Parking" and "Vehicle on Demand" in Chap. 2) differ significantly in the requirements for the legal framework from those which call for an "available driver". With the continued option of vehicle control by the driver for certain sections of a trip or due to a desire on the driver's part to take control, the same fundamental requirements (suitability and competence to drive; see also [18]) must be fulfilled that are currently required of drivers—in the case of "Full Automation Using Driver for Extended Availability," at least when the driver intends to make use of the possibility of controlling the vehicle (i.e. perform an independent act of driving). As such, there is no need for a fundamentally different legal framework, but simply one augmented by necessary regulations governing autonomous vehicles and thus an independent, machine-based decision-making quality. With regard to this independent, machine-based decision-making quality, then, one arrives at the same result from a legal perspective for all of the use cases. The transformation resides primarily in enabling independent, automated agency and how that is shaped. The framework for automated vehicle control from a legal standpoint is currently unregulated, although regulation seems called for (at least in the spirit of road traffic regulations as technically effective regulation).

Insofar as a need for regulation of autonomous vehicles does not emerge naturally from the novel machine-based automation risk (see Sect. 25.5.1), it would seem that at least in terms of the use of suitable functions in mixed traffic relating to error compensation (see Sect. 25.5.4) and communication capabilities (see Sect. 25.5.5) of autonomous vehicles, a need for legal regulation seems evident. In the legal regulation of such interactive behavior, it must be examined precisely how far the role of the driver even extends in individual cases. If one considers the technical capabilities resulting from solely machine-based mobility in a given case (as described in the "Full Automation Using Driver for Extended Availability" and "Vehicle On Demand" use cases), the heretofore fundamental requirements of a driver's driving suitability and driving competence already appear superfluous. The manifold possibilities could therefore give rise to an unprecedented variety of regulatory duties for participation in road traffic with (autonomous) vehicles, which could be distinguished primarily by the reach of the automated control quality and to what extent it is intended to be used.

#### 25.6.2 Evaluation of Autonomous Driving According to Liability Law in Road Traffic

As concerns the shift towards automated agency which is associated with autonomous driving, it is likewise the case with road traffic liability law that the existing regulations do not take account of this change.

#### 25.6.2.1 Keeper Liability

Nevertheless there is in this area a fundamental German liability regulation for motor vehicles [section 7 of the road traffic act (StVG)] according to which the keeper of the vehicle, regardless of fault in the operation of the vehicle, is liable for compensation of all causally related damages which are not asset damages [where the only remaining reason for exclusion of liability is force majeure, section 7 paragraph 2 of the road traffic act (StVG)]. Thus even today, this restriction to operation of the vehicle as a liability-triggering legal definition does not make a distinction based on whether damage was caused by the driver's conduct or due to technical failure. Since automated control decisions which cause damage can without contradiction be classified as technical failures, there is no fundamental inconsistency in this regard.

The vehicle keeper is the person who uses the vehicle for his or her own account, in particular who draws the benefits and pays its expenses and thus also has the authority to decide regarding its use as a potential source of hazard [14]. If one assumes that driverless vehicles, too, can be assigned to a keeper, which would be possible without inconsistency according to current law, no incompatibility with current law would arise in this case. Autonomous driving would nevertheless change the matter of keeper responsibility however, the keeper responsibility for autonomous driving is already covered by the wording of the applicable regulation today: The vehicle control previously conducted by the driver is replaced by an automated vehicle control system (as far as the scope of application of the respective autonomous control reaches). Concerning the keeper responsibility, therefore, there would be no new duties, but rather a completely different control quality which triggers civil liability.

#### 25.6.2.2 Driver Liability and Accident Data Recording

Other regulations of the road traffic act which are relevant for civil liability do, however, clearly assume control by a driver, for example section 18 paragraph 1 of the road traffic act (StVG), according to which in cases of keeper liability a liability on the part of the driver is likewise presumed (see clause 2). Thus we see that section 18 of the German road traffic act (StVG) also merely assumes the heretofore always correct presumption that a driver is always responsible for the control behavior of the vehicle. Ultimately the assessment of driverless vehicles from a liability law perspective does not differ substantially from fully-automated [10] vehicles. The situation is similar with the heretofore applicable provisions of the German Civil Code (BGB) covering unlawful behavior by drivers (e.g. section 823 paragraph 1 BGB or section 823 paragraph 2 BGB in conjunction with violations of the road traffic regulations): These provisions can no longer cover the case of automated agency because they are linked to human action which is not applicable to autonomous vehicles.

In the autonomous vehicles which are the subject of this study, which in some cases do not even require the presence or occasional assumption of control by a driver, the question must be addressed to what extent it may be assumed in a typical case that vehicle passengers will be capable of describing the course of an accident. This illustrates that with respect to the question of compensation of accident damages occurring between two or more autonomous vehicles, the apportionment of damages according to applicable law and thus section 17 of the road traffic act (StVG) is confronted with the problem that the principally applied "degree of causation" [14] no longer—as is commonly the case today can at least be supported through hearing of the drivers (generally also parties to a civil case —as the case may be also witnesses). This is due primarily to the role change in which the driver becomes a "mere passenger" (see Chap. 2) and is therefore able to make statements regarding the course of an accident only in exceptional cases and only on the basis of chance observations. Thus a change is introduced which even with respect to liability law in road traffic would seem to require technical measures (such as crash data recording during automated vehicle control) as a basis for the corresponding damage apportionment, insofar as the desire exists to maintain this distribution principle according to shares of causation for autonomous driving as well (which does indeed seem possible).

#### 25.6.3 Evaluation with Respect to Product Liability Law

The field of product liability for automated control of autonomous vehicles was already discussed in Sect. 25.5.1. The salient question here is determination of the relevant cause of accident damage in individual cases in the sense of scientific causality.

#### 25.6.3.1 Significance of Accident Data Recordings in Autonomous Driving in Terms of Product Liability Law

Going further, for the cases of autonomous driving which require a "driver for extended availability" (see the use cases "Interstate Pilot Using Driver for Extended Availability" and "Full Automation Using Driver for Extended Availability" Chap. 2) there is another aspect which in turn stands in relation to the question of crash data recorders. Both in terms of product liability law (as well as with regard to violations of regulatory law subject to fines) it seems reasonable to assume that an active available driver could argue the exculpatory defense that he/she was not controlling the vehicle him/herself, but with the aid of the autonomous control system. If one wishes to preclude such assertions, it will be difficult to avoid considering the recording of vehicle control data—at least during autonomous control—in order both to protect the interests of the manufacturers in terms of product liability law and to secure evidence with respect to regulatory violations. This option does not seem excluded a priori from a data protection standpoint provided that the data remains in the vehicle, the transparency requirement is granted and data processing is conducted only to the extent necessary, or that data is, for example, only permanently stored in the event of accident damage. Moreover, a restriction of data recording to the period in which the vehicle was under automated control would have to be considered which would meet the principle of data minimization [section 3 of the German Data Protection Act (BDSG)], which incidentally would equally arise from the principle of proportionality with regard to data processing. This would also largely avoid the recording of behavior related data on the driver's control of the vehicle. Particular attention would also have to be given to the transitions between the respective periods in which the driver and the automated control system are driving. Data recording could be of particular importance in this transition period, although it would simultaneously deal with data clearly related to the driver. As such, it would be necessary to clarify in an initial step the extent of recording required for a driver-controlled drive to protect against subsequent exculpatory defenses.

#### 25.6.3.2 The State of Science and Technology in Autonomous Driving

From a product liability law perspective, the significant aspect for the layman would appear to be the question of exclusion of liability for errors in the context of automated vehicle control which the latest science and technology cannot identify at the time of introduction (development risk). In this context of product liability law, we must return to the question raised in Sect. 25.5.1 in which it appears possible in the context of road traffic that risks which manifest themselves in accidents could also be traced back to the current traffic system as a relevant cause (and not in all cases to the control behavior, whether by drivers or automated control systems). This question is fundamental and needs to be answered as a matter of priority in order to avoid erroneously inferring that (alleged) product defects are the relevant cause.

But as soon as the grounds for exemption from liability are affected in view of the state of science and technology, it must be taken into account that this exemption in practice is of decidedly minor significance. Whether a hazard was indeed recognizable according to the state of science and technology is to be tested in two steps: First, it must be established whether the error was recognizable for any scientist or engineer in the world. If that was the case, claiming the exemption is still not yet ruled out, because the decisive factor would be the objective accessibility of that knowledge for the manufacturer. It would also be necessary to take into consideration deviating opinions by individual scientists, provided that those opinions satisfy the minimum requirements for scientific work [22].

As such, it is equally critical to determine for autonomous vehicles whether the recognizability of an error could indeed be ruled out at the time of introduction (which indeed would also have to be provable in retrospect in the event of an accident according to the applicable standards of presentation and proof in civil suits). Only in this rare case would the manufacturer gain legal certainty through the use of these grounds for exemption of the development risk [and if not at fault, also according to section 823 paragraph 1 of the German Civil Code (BGB)]. In practice, this case will be of nearly no importance.

Cognizance of the fact that product defects cannot be entirely ruled out even according to the latest science and technology and the observance of all due care, i.e. that a "residual fault tolerance"—as the ISO 26262 standard words it—exists, must be regarded as a technical description of the development process which has no correlation in product liability law.

#### 25.6.4 Possible Differences of Legal Evaluation in the International Context

First, it must be noted that the present chapter from the outset only considers the situation from the perspective of German law and makes assertions on the basis of German law currently in force. Applicability to other countries must be considered limited. Transferability of the conclusions here will, aside from coincidental reasons, be most likely in the event of harmonization of laws due to international agreements (in the context of international law) or through regulations and directives issued in the context of EU law.

It is therefore salient to add that, as concerns the fundamental rights situation depicted here, there is a largely concordant standard of fundamental rights—for our present purposes in the context of the German fundamental rights to life and physical integrity recognized for example through the European Union's Charter of Fundamental Rights. It bears references to the European Convention on Human Rights and, with the exception of the United Kingdom and Poland, the EU fundamental rights charter was declared binding for the countries of the European Union through a provision in the Treaty of Lisbon. The rights to life and physical integrity are explicitly recognized therein—in particular through article 2 paragraph 1 and article 3 paragraph 1 of the Charter of Fundamental Rights of the European Union (see also [23]). This interpretation could be extended almost at will to the constitutions of other states; the chief conclusion, however, is that the fundamental rights framework can differ significantly in many individual areas. Such an examination is therefore the realm of specialists in the respective legal contexts.

This applies equally to the regulatory law of road traffic as well as to the liability law being applied which is relevant for autonomous driving. But as we have seen in Sects. 25.6.1 and 25.6.2, the legal situation according to German law is to a great extent only transferable to autonomous driving to a very limited degree. It seems quite possible that a comparable situation would subsist in other legal systems as well. This assumption is also supported by the fact that international road traffic accords such as the Vienna Convention on Road Traffic of 1968 and the Geneva Convention on Road Traffic of 1949 are based on a definition of the driver and continuous vehicle control which is highly comparable to that of the German road traffic regulations.

In the interest of greater comparability, the product liability law which was harmonized within the European Union through council directive 85/374/EEC of 25 July 1985 rates a mention. Here again, in addition to restrictions in terms of legal doctrine, uncertainties arise due to the fact that the directive's implementation is binding only with regard to the objective (a principle that existed even prior to the current situation and which finds expression today in article 288 paragraph of the Treaty on the Functioning of the European Union). Yet there is a comparable legal foundation for intra-state application which is not linked to culpability (so-called strict liability).

In sum, it can be concluded that in these areas, there are still significant differences which could impact the development of autonomous driving. Due to the national variations within the field of law, however, the impact cannot be predicted in detail and remains—as far as can be ascertained today—in need of further examination.

#### 25.6.5 Special Question: Supervisory Duty with Regard to the Passengers of Autonomous Vehicles

One of the benefits of autonomous driving is that the attention resources of the human occupant are no longer required for the task of driving. This could potentially call into question the necessity of the presence of the "driver," or indeed the person with a supervisory duty at all. Thus a significant benefit of autonomous driving could be that the mobility desires of children—without requiring a driver—could be fulfilled. It is therefore by no means impossible that dangers could arise from this if—as presumably would often be the case the driver is the person with a supervisory duty who is no longer present in the vehicle.

However, of the representative use cases examined here, only the "vehicle on demand" case would appear suitable for performing such a transport activity without the accompaniment of a person with a supervisory duty. Even the representative use case "Full Automation Using Driver for Extended Availability" calls for the presence of a driver to drive in zones or sections of roads not approved for autonomous driving (see Chap. 2). Since the "Vehicle on Demand" representative use case does not even have a driver's seat (but only a completely freely-usable interior space), dangers and effects flowing from use by persons requiring supervision would seem to be limited to the interior of the vehicle and not relevant for road traffic. Thus the question of the absence of the person with the supervisory duty would not be relevant for road traffic. It is, however, every bit as plausible that such autonomous vehicles would indeed have driving controls. In that case there would be the possibility of a significant negative influence over vehicle control by means of overriding the autonomous driving functions through the control elements.

It is clear, however, that the legal question of a duty to supervise does not depend on the introduction of autonomous driving. Indeed, even today independent compensation obligations can be triggered by violations of the duty to supervise [see section 832 of the German Civil Code (BGB)]. The law stipulates a parental duty to supervise children in the exercise of parental care, sections 1626 and following BGB. Thus it would be necessary to determine the intensity of supervision required in view of the predictability of damaging conduct in an individual case based on the age, maturity, character, knowledge and abilities of a child [24]. If the resulting duty is violated and damage occurs on account of it, an independent claim for damages (aside from any claims lodged against the child) could be leveled against the parents of the child as well. Thus the possibilities arising from the advent of autonomous vehicles could result in the correct fulfillment of supervisory duties in this context receiving a novel, heretofore completely unknown meaning. A need to alter the legal basis is not foreseeable, however.

#### 25.7 Conclusion

The examination of autonomous driving from a legal perspective undertaken in the present chapter reveals—in addition to the questions raised in the respective subsections—in particular a fundamental aspect which may take on greater prominence in the context of the transition from human to automated vehicle control than was previously the case. Even if we were to assume today that every accident involving motor vehicles were due to faults in the control of the vehicle, it must be examined scientifically to what extent the current traffic system, in view of the conditions under which it operates, does not itself represent a relevant cause for some portion of the accidents which take place today. The answer to the question is not to be regarded as an end in itself, but as a means of understanding whether, and if so, which changes in the vehicle control scenario are suitable under certain conditions to prevent accidents. This question is also decisive for the design of a safe product from the manufacturer's point of view in terms of developing appropriate autonomous machine-based control functions.

It would also appear that the description of an automated control quality in the sense of a definition of requirements will be an important milestone in the ongoing advancement of autonomous driving in terms of legal certainty both for the operator of the vehicles as well as their manufacturers. This could be the basis for an evaluation that determines precisely in which areas there is a need for further development such as the communication or error compensation capabilities of autonomous vehicles. On the other hand, it would allow for an assessment of how the corresponding legal framework must be designed in order to make a functioning "road traffic system" involving autonomous vehicles a reality.

Open Access This chapter is distributed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, duplication, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, a link is provided to the Creative Commons license and any changes made are indicated.

The images or other third party material in this chapter are included in the work's Creative Commons license, unless indicated otherwise in the credit line; if such material is not included in the work's Creative Commons license and the respective action is not permitted by statutory regulation, users will need to obtain permission from the license holder to duplicate, adapt or reproduce the material.

#### References


Markus; Ruth-Schumacher, Simone; Schwarz, Jürgen; Vogt, Wolfgang: Rechtsfolgen zunehmender Fahrzeugautomatisierung. Gemeinsamer Schlussbericht der BASt-Projektgruppe "Rechtsfolgen zunehmender Fahrzeugautomatisierung" Dokumentteil 1. Wirtschaftsverlag NW, Bergisch Gladbach, 2012 (Heft F 83)


# 26 Product Liability Issues in the U.S. and Associated Risk Management

Stephen S. Wu

#### 26.1 Introduction

Autonomous vehicles (AVs) hold the promise of saving tens of thousands of lives each year in the U.S., and many more worldwide, reducing traffic, saving energy, and providing mobility to those who cannot drive conventional cars. Nonetheless, AVs will inevitably have some accidents. On balance, AVs are likely to prevent many more accidents than they cause, but there will be at least some accidents involving AVs that would not have occurred with conventional vehicles.

Because of accidents involving AVs, some of which may be catastrophic, product liability litigation<sup>1</sup> is inevitable, especially in cases where conventional vehicles would not have crashed. The threat of massive product liability litigation involving AVs is widely perceived as one of the chief obstacles to AV development and sales, if not the number one threat [3].<sup>2</sup> Some believe that product liability suits are an existential threat to autonomous driving [33].<sup>3</sup> Crippling suits could force manufacturers to exit the market and may deter some manufacturers from entering the market because of a belief that the sales are not worth the risk. If these dire predictions come to pass, the U.S. and other parts

<sup>1</sup> This chapter focuses mainly on product liability litigation, although there are also requirements to compel vehicle manufacturers to recall their vehicles to fix defects. The management of liability and recall risks overlap and the risk management principles discussed in this chapter apply to both.

<sup>2</sup> "Some of the largest obstacles to autonomous consumer vehicles are the legalities [2]." Reports from Lloyd's of London and the University of Texas listed product liability as among the top obstacles for AVs [21, 30].

<sup>3</sup> "[T]he worst outcome would be that said liability isn't sorted out so that we never do get the mass manufacturing and adoption of driverless cars" [33].

S.S. Wu (&)

Business and Technology Law and Litigation, Los Altos 94022, CA, USA e-mail: ssw@svlg.com

of the world experiencing a flood of lawsuits may lose the use of a technology that would save many times more lives than it would endanger. If, however, the industry finds effective ways to manage the risk of product liability, it can bring to market a lifesaving technology while maintaining practices to minimize accidents and resulting liability, as well as the profitability needed to offer AVs in the market over time.

The purpose of this chapter is to identify product liability risks in the U.S. to manufacturers of AVs, the source of those risks, and how manufacturers can manage those risks. A focus on U.S. product liability is important from a worldwide manufacturer's perspective given the size of the U.S. market and the perception that the U.S. is a litigious country. Product liability is perceived as a greater threat in the U.S. than in any other country of the world. Section 26.2 discusses the circumstances giving rise to U.S. product liability litigation and the phenomenon of some U.S. cases resulting in huge awards to plaintiffs seeking compensation. It explains why these huge awards occur. Section 26.3 analyzes the human and financial impacts of more recent high profile product liability cases. Section 26.4 discusses U.S. product liability law, focusing on the types of claims and defenses arising in product liability cases. Section 26.5 covers design practices and procedures that manufacturers can use to reduce the risk of product liability. Section 26.6 examines insurance as a means of shifting and managing product liability risk. Finally, Section 26.7 explains other risk management techniques.

#### 26.2 Why Do Product Liability Suits Occur?

First and foremost, manufacturers face product liability suits, because their products are involved in accidents. From the early days in the development of Anglo-American tort<sup>4</sup> law, the road accident played a prominent role. A key British case in the development of U.S. tort law, Winterbottom v. Wright, <sup>5</sup> involved a mail coach driver who was thrown from his horse-drawn mail carriage after it broke down, allegedly due to the defendant contractor's failure to maintain the carriage in a safe condition [32].<sup>6</sup>

Starting in the 20th century, the car accident caused significant changes in U.S. product liability law. "Products liability, like America, grew up with the automobile. Prior to the entry of motorcars onto the nation's highways, 'there simply were not large numbers of product-related lawsuits.' Once America embraced the automobile, it inevitably embraced

<sup>4</sup> "Tort" means "wrong," and "tort law" provides a mechanism for a plaintiff to seek redress in a civil (i.e., non-criminal) case.

<sup>5</sup> It was common in the 19th century for American courts to cite contemporary British cases as precedents.

<sup>6</sup> In Winterbottom, the court denied relief to the injured coachman because of a lack of direct contractual relationship, called "privity," between the plaintiff coachman and the defendant contractor. The coachman was not a party the contract in which the defendant contractor promised to maintain the coach in good working order [32].

automotive products suits as well" [13]. Two of the most significant products liability cases in American history arose from auto accidents. In MacPherson v. Buick Motor Co., the famous American jurist Benjamin Cardozo writing for the New York Court of Appeals upheld a verdict for a car owner ejected from his Buick car after a defective wooden wheel on the car collapsed [22].<sup>7</sup> In Henningsen v. Bloomfield Motors, Inc. [17],<sup>8</sup> the New Jersey Supreme Court affirmed a jury verdict against Chrysler and a dealer after the wife of the purchaser had an accident. She testified that she felt something crack in the car, the steering wheel spun sharply, the car veered off the road, and the car struck a highway sign and brick wall.

The threadbare descriptions of the car accidents in these appellate courts' decisions, however, do not reflect the reality of the trial setting in which lawyers for the injured plaintiffs will describe what might be a catastrophic car accident in unvarnished and sometimes horrific terms. Consider a description of the famous Ford Pinto accident written in Mother Jones magazine. Although the description below comes from a writer,<sup>9</sup> it is similar in tone and impact to what a plaintiff's lawyer might say about his or her client in an opening statement. Here is how the writer describes the accident:

[A] woman, whom for legal reasons we will call Sandra Gillespie, pulled onto a Minneapolis highway in her new Ford Pinto. Riding with her was a young boy, whom we'll call Robbie Carlton. As she entered a merge lane, Sandra Gillespie's car stalled. Another car rear-ended hers at an impact speed of 28 miles per hour. The Pinto's gas tank ruptured. Vapors from it mixed quickly with the air in the passenger compartment. A spark ignited the mixture and the car exploded in a ball of fire. Sandra died in agony a few hours later in an emergency hospital. Her passenger, 13-year-old Robbie Carlton, is still alive; he has just come home from another futile operation aimed at grafting a new ear and nose from skin on the few unscarred portions of his badly burned body. [11]

In the courtroom, the young boy, so badly disfigured by the accident, would likely be sitting next to his attorney during the entire trial. The jury would be seated facing him, and watching him. The unspoken testimony of his catastrophic injuries would likely have at least an unconscious effect on the jurors watching him. Despite instructions from the judge not to permit sympathy, bias, or prejudice to sway their verdict, a car manufacturer defending this case would have an difficult time at trial. In the Ford Pinto case, the 13-year-old boy, whose real name was Richard Grimshaw, received a jury award in the amount of over \$2.5 million in compensatory damages and an award of punitive damages to punish and deter Ford in the amount of \$125 million [15]. Part of the motivation for the

<sup>7</sup> The plaintiff had bought the car from a retailer, but could still sue the manufacturer despite the lack of privity with the manufacturer [22]. The car was apparently going 8 miles per hour at the time of the accident [13].

<sup>8</sup> The court rejected privity, a warranty disclaimer, and limits of liability as defenses to the warranty claim of the wife driver of the car and her husband, the owner [17].

<sup>9</sup> The writer is using pseudonyms for the names of the crash victims, evidently before the names of the victims became public.

large verdict was evidence during the trial of Ford's apparently cold-hearted decision not to use fairly inexpensive parts in its cars that would have prevented the accident. Although the punitive damages award was later reduced in this case to \$3.5 million [15], the Ford Pinto case shows the kind of award that is possible in an automobile product liability case following a catastrophic accident.

At some future time when an AV manufacturer faces a product liability trial, we can expect to see accident victims seated in a courtroom with similar gruesome disfigurements and stories of out-of-control cars and tragic, frightful accidents. The defendant manufacturer's engineering and business practices will come under scrutiny. And a jury will likely decide whether or not the manufacturer should be held responsible for the accidents.

During an AV's design phase, its manufacturer's design team will have an opportunity to discuss and make engineering and business decisions about the design of its AVs. Team members will talk about safety efforts the manufacturer is willing to undertake. In these discussions, team members can think more clearly and assess risk more effectively by imagining themselves in a courtroom setting, defending their practices in litigation arising from a catastrophic accident.

Why are jurors willing to render these large verdicts against manufacturers? The short answer is juror anger. "Angry jurors mean high damages" [24]. More specifically, juries render large verdicts when they become angry at defendants' conduct. When juries become angry, the only way that they see they can redress the defendants' wrongs is to render very large verdicts against them in an effort to send a message that their conduct is unacceptable.

In the Ford Pinto case, the jury heard evidence that Ford had known about the problems with its fuel system. Ford had found the problem of rear-end crashes splitting open the Pinto's gas tank. In addition, Ford knew that a part costing \$11 could have prevented the accident. Nonetheless, Ford made a cost/benefit analysis comparing the overall cost of adding the safety part to the vehicle against the value of the lives lost from accidents involving the vulnerability. Ford assigned a value to each human life likely lost. And Ford decided that the overall cost of the part exceeded the overall value of the human lives that would be saved and determined that it therefore should not add the part to the Pinto's design.

Ford's cost/benefit calculation seemed odious to the jury because it placed a dollar value on human life. In addition, the jury knew that the extra part would only cost \$11. By not adding the part to the Pinto's design, the jury evidently concluded that Ford placed its profits ahead of human life. Ford's apparent callousness led to the jury anger [15].

In another famous product liability case, a Texas lawyer obtained a \$253.5 million verdict against pharmaceutical company Merck for Carol Ernst, the widow of Robert Ernst. Mr. Ernst died after having taken Merck's painkiller Vioxx for eight months [5]. The jury saw internal Merck documents showing that the company was aware of the heart attack risk to users before it started marketing the drug. The documents gave the jury the impression that the company cared more about profits than public safety. As a result, the jury tried, via the huge award, to send a message that it is wrong to hide information about a drug's danger [14]. Although an appellate court later overturned the jury's verdict, again the case underscores the risk of huge product liability verdicts [23].

#### 26.3 More Recent High-Profile Product Liability Litigation

As noted in the previous section, appellate courts provided some relief to Ford and overturned the verdict in the Vioxx case. Nonetheless, manufacturers should look to two more recent sets of cases in order to analyze the potential human and financial impact of product liability issues. Section 26.3.1 covers the so-called "sudden acceleration" phenomenon involving Toyota cars. Section 26.3.2 describes the fallout from the General Motors ignition switch defects. These two cases show how manufacturers may need to pay huge sums to resolve product liability legal proceedings, which are in addition to the human toll of deaths and injuries.

#### 26.3.1 "Sudden Acceleration" Litigation

Several years ago, news stories emerged concerning a phenomenon in which Toyota drivers reported that their cars accelerated without warning and were difficult to stop, resulting in accidents. One typical news report stated, "Nancy Bernstein feels lucky to be alive after her Toyota Prius kept accelerating, no matter how hard she hit the brakes. 'The car's going about 70 miles an hour, and I'm beginning to get scared because it's not slowing down,' Bernstein described" [26]. Lawsuits followed these accidents, and federal cases were transferred to the U.S. District Court for the Central District of California for coordinated or consolidated pretrial proceedings [27].

Some reports contend that the 89 people may have died from accidents involving the sudden acceleration of Toyota vehicles [10]. Governmental investigations, however, showed no evidence that design or implementation flaws in Toyotas caused unintended acceleration [25]. Accordingly, there was some controversy about whether Toyota or drivers were at fault in these accidents.

Later in the litigation, however, a report by expert witness Michael Barr following additional research opined that a software malfunction occurred in one of the cars and that the malfunction resulted in unintended acceleration [4]. Barr identified numerous alleged problems with the software, which according to Barr, Toyota's own engineers had trouble understanding and characterized as "spaghetti like" [4]. Barr testified about his findings in an Oklahoma state court case and, apparently based in part on these findings, the jury in the case awarded compensatory damages of \$1.5 million to the driver and \$1.5 million to the family of a passenger who died in the crash [35]. The parties in the case, Bookout v. Toyota Motor Corp. [7], settled the case right before a second phase of the trial to consider punitive damages against Toyota [18].

Despite the uncertainty about what really caused these accidents, Toyota started to settle the various legal actions against the company. The Oklahoma case may have been a motivating factor [28].<sup>10</sup> Toyota's settlement payments so far include:


These settlement payouts are in addition to the numerous product liability lawsuits that remain pending, the settlement of which presumably will cost a huge sum. If product liability settlement amounts exceed \$1 billion, then the total settlements may exceed \$4 billion. The cost of legal fees and other internal expenses related to investigation and remedial measures will add even more to the final cost for Toyota.

#### 26.3.2 General Motors Ignition Switch Issues and Recall

Another high-profile product liability issue arose from the recently uncovered problem with ignition switches in certain General Motors cars. In the late 1990s, GM started using new switches for small cars to make them work more smoothly. "But as it turns out, new switches in models such as the Chevrolet Cobalt and Saturn Ion can unexpectedly slip from 'run' to 'accessory,' causing engines to stall. That shuts off the power steering, making cars harder to control, and disables air bags in crashes [20]. The problem supposedly caused over 50 accidents. "GM says the problem has caused at least 13 deaths, but some members of Congress put the death toll near 100" [20].

Apparently, GM engineers were aware of the problem before the accidents, but decided not to replace the switches. An internal email uncovered in Congressional hearings discussed the fact that a more robust design would add 90 cents to the price of the switch, and would only save 10–15 cents in reduced warranty claims [16]. "The part costs less than \$10 wholesale. The fix takes less than an hour. A mechanic removes a few screws and connectors, takes off a plastic shroud, pops in the new switch, and the customer is back on the road" [12]. "[T]o many people familiar with the automaker," the reason GM did not recall the cars sooner "is a corporate culture reluctant to pass along bad news. When GM was struggling to cut costs and buff its image, a recall of its popular small cars would have been a terrible setback" [12]. "It's pretty clear that somebody somewhere was being penny-wise and pound-foolish,' said Marina Whitman, a professor at the University of Michigan and a former economist at GM" [12].

<sup>10</sup>"Legal analysts said that the verdict most likely spurred Toyota to pursue a broad settlement of its remaining cases" [28].

GM's decision not to recall the cars sooner is proving to be a costly one. Congress, safety regulators, the U.S. attorney in New York City, the SEC, Transport Canada, and 45 state attorneys general are conducting probes of GM. GM is undertaking a costly recall of the cars. Also, GM created a compensation fund for families of crash victims, which it expects will cost the company \$400–\$600 million [19].

In addition to the compensation fund, GM said that it will spend \$1.2 billion to repair the cars and trucks recalled during the second quarter, on top of the \$1.3 billion it identified for repair costs in the first three months of the year. In addition, the company set aside an additional \$874 million in the quarter for future recalls. [19]

The total expense for GM will be huge: "All told, GM's recalls have cost the automaker nearly \$4 billion this year" [19]. Presumably, GM will continue to pay more in future years as well. Moreover, GM will have to pay even more for legal fees and other internal expenses related to investigation and remedial measures.

#### 26.4 Claims and Defenses in Product Liability Cases

Having covered the phenomenon of product liability litigation, the human toll of accidents, and the large financial risks involved, this section covers what plaintiffs must prove in order to prevail in a suit based on an allegedly defective product, as well as what defendants must provide in order to assert certain defenses. Typical claims for plaintiffs seeking damages for bodily injury or property damage from an accident are "strict product liability," "negligence," and "breach of warranty." <sup>11</sup> Most of the law governing product liability in the U.S. is state law, as opposed to federal law, and laws diverge from state to state.

#### 26.4.1 Strict Product Liability Claims

The easiest type of claim for a plaintiff to prove is a so-called "strict product liability" claim. A plaintiff can include in the suit almost every business in the chain of distribution from raw materials or component part manufacturers to manufacturers of the finished product, distributors, and retailers [13]. Strict liability refers to liability for defective products without fault on the part of the manufacturer and regardless of whether or not there is a contractual relationship between the plaintiff and defendant. Laws vary significantly from state to state, and some states do not even recognize strict liability as a viable claim. Nonetheless, most states' statutory and common law strict liability laws are

<sup>11</sup>Another theory of recovery for plaintiffs is fraud, also known as "deceit" or "misrepresentation," and is based on false statements made by the seller about a product. Misrepresentations may be intentional, negligent (careless), or innocent. This type of claim, however, is the least used theory of recovery in the product liability context [13].

based on the formulation of strict liability under Section 402A of the Second Restatement of Torts [2].<sup>12</sup> As stated in the Restatement, in order to win a strict liability claim, the plaintiff must prove at trial:


The key issue for AV strict liability design defect claims will be whether the vehicle was "defective." A plaintiff may assert that the product was defective in its design, the product was defective in the way it was manufactured, and/or that the defendant failed to provide adequate warnings or instructions to the users of the product. Of greatest concern for AV litigation are design defect and failure to warn claims.

A plaintiff asserting a design defect would show the existence of a "defect" under the applicable state law test. Courts in the U.S. apply one of the following tests:


Frequently, a plaintiff asserting a design defect will use expert testimony to explain why the defendant's design is defective and will attempt to prove that an alternative design could have prevented the accident.

In addition to relying on design defects, a plaintiff may also assert a strict liability claim based on a "failure to warn" theory. Under this theory, the plaintiff could contend that an AV was defective because the defendant failed to provide adequate warnings or instructions about the vehicle. The plaintiff would need to prove that the warnings did not

<sup>12</sup>"More than three quarters of American jurisdictions incorporate all or part of this section in their own distinct brand of strict liability" [13]. Restatements of law summarize the law applicable field of law in the U.S., but do not themselves have the force of law.

adequately reduce risks associated with the product or that the instructions were inadequate to tell the user how to use the product.

#### 26.4.2 Negligence Claims

As an alternative claim, product liability plaintiffs often include a negligence claim in their complaints. The concept of "negligence" refers to careless conduct that falls below the standard of conduct to which a hypothetical "reasonable man" would adhere. As with strict liability, a plaintiff can assert a negligence claim based on the design of the product, the way in which the product was manufactured, or the failure to give adequate warnings or instructions. Negligence is a harder claim for a plaintiff than strict liability, because the plaintiff must show some degree of fault on the part of the defendant.

In order to prevail in a negligence claim, the plaintiff must prove:


#### 26.4.3 Breach of Warranty Claims

In most states in the U.S., a plaintiff may also include a breach of warranty claim in a product liability complaint. Warranties are affirmations or promises concerning a product or its performance, features, or characteristics, such as those concerning the safety of a product. The basis of a breach of warranty claim is that the seller's product does not perform as promised, or does not have the features or characteristics promised. Design defects, manufacturing defects, or failures to warn may all provide the basis for a warranty claim. As with strict liability, the question is whether or not the product adheres to the promises made, regardless of whether the seller is at fault for the failure to conform to the promise. Nonetheless, warranty claims are subject to defenses with various degrees of effectiveness, including the historical defense of "privity" (plaintiff's lack of contractual relationship with the defendant), the requirement that the plaintiff provide the seller notice of the breach, and the ability for sellers to disclaim warranties [31]. In most U.S. jurisdictions, purchasers of a product or their family members can sue companies in the chain of distribution under a warranty theory despite the lack of privity [31].

In order to assert a breach of warranty claim, a plaintiff must typically prove:


A warranty claim will typically allege one of three kinds of warranties. "Express warranties" are those actually stated by the seller, such as in a sales contract, warranty program documentation, advertisements, or sales collateral. They may be written or oral. In addition to the express warranties, the law will sometimes recognize two kinds of "implied warranties" regarding the sale of consumer products that arise by operation of law, as opposed to anything the seller actually said.

One kind of implied warranty is the "implied warranty of merchantability." This implied warranty requires the seller to make sure the product is fit for the ordinary purposes of such product. For instance, a consumer would expect that the head of a hammer would not fly off the first time it is used after purchase. This kind of implied warranty is the one most likely to be asserted against a seller of an AV in future cases. The second typical implied warranty is the "warranty of fitness for a particular purpose." Where the seller knows the particular purpose for which the consumer will use the product, and the buyer is relying on the skill and judgment of the seller to select and furnish suitable products, the law will recognize an implied warranty that the product will be fit for that purpose. For instance, if a truck buyer tells a dealer's sales representative that the buyer seeks a pickup that will be able to tow a trailer through mountainous off-road terrain, then the dealer is deemed to have warranted that the truck recommended by the sales representative can, in fact, tow the trailer off-road in the mountains.

#### 26.4.4 Claims Under Consumer Protection Laws

Plaintiffs sometimes assert product liability claims under various consumer protection laws. State laws vary, and some states do not permit these laws to be used for personal injuries [1]. They are commonly used when plaintiffs seek redress for alleged economic or financial losses, such as the diminution in the value of their products due to the alleged defect. Examples include California's Unfair Competition Law (UCL) [8], False Advertising Law (FAL) [8], and Consumer Legal Remedies Act (CLRA) [9], as well as equivalent laws in other states. Claims under these statutes typically require plaintiffs to prove:


For instance, the UCL prohibits unlawful, unfair, or fraudulent business acts or practices. The FAL bars untrue or misleading advertising practices. The CLRA prohibits a list of unfair business practices, such as misrepresenting the characteristics and qualities of a product.

#### 26.4.5 Types of Defects at Issue in Autonomous Vehicle Litigation

We do not yet have examples of cases filed against AV manufacturers to say what kinds of alleged defects will likely result in litigation. Nonetheless, the history of automotive litigation, discussions with those in the industry, and judgments about what is likely to come suggest that there will be many sources of potential defects that may give rise to product liability litigation. AVs will share some of these sources of defects with conventional vehicles, but some of them will be unique to AVs. The lists of potential defects in this section are not meant to be exclusive, and there are many possible sources of defects in conventional and autonomous vehicles.

Some possible design defects<sup>13</sup> that AVs will have in common with conventional vehicles include:


These defects will occur in both conventional and autonomous vehicles and thus existing law and litigation methods would apply to determine a manufacturer's liability.

Nonetheless, AVs may experience defects that conventional vehicles do not. Again, they may be mechanical, electronic, or software.


The most interesting and perhaps most concerning potential defects are those in the software used for autonomous driving. Some examples include:

<sup>13</sup>Another issue for manufacturers of finished products concerns their supply chains. Counterfeit or defective components may introduce manufacturing defects into AVs.

<sup>14</sup>For example, the author was involved in one case in which the plaintiff alleged that the metal in a car's tie rod was not strong enough, the metal fatigue experienced by ordinary wear of the car weakened the tie rod, and an accident occurred because metal fatigue caused the tie rod to break.

<sup>15</sup>The "software" involved may be in the form of code built into hardware or firmware.


Moreover, Chap. 4 discusses design decisions programmers must make when creating the logic for an AV to handle the situation of when a collision is imminent and unavoidable and there is a choice between striking and harming different persons. For instance, an AV may face the dilemma of striking a motorcycle rider wearing a helmet or one without a helmet, and a programmer might decide that it is better, if a collision is unavoidable, to strike one or the other. If the programmer makes such a decision and designs the software to implement that decision, this kind of design decision could be the subject of a product liability suit from the person struck by operation of the software.

#### 26.4.6 Defenses in Product Liability Cases

Defendants may assert a number of defenses against a product liability case. The most common types of defenses relate to the conduct of the plaintiff. In some cases, the defendant contends that the plaintiff's negligent conduct caused or contributed to an accident. The viability of a defense based on a plaintiff's own negligence depends on state law and the type of claim, but a defendant may also use it as evidence of a superseding cause of an accident. In addition, some accidents occur because a plaintiff misused or modified a product. In some cases, a plaintiff is said to have "assumed the risk" of an open, obvious hazard, such as the possibility of being struck by a golf ball on the links. Finally, a plaintiff may not be able to recover all damages if he or she failed in some way to mitigate the damages.

Many of these defenses may have limited application to persons driving AVs in autonomous mode. If the plaintiff was not in control of the vehicle at the time of the accident, the plaintiff could not have driven carelessly. Once AVs enter the mass market, a seller cannot realistically contend that the plaintiff assumed the risk of driving a vehicle using new and untested technology. Nonetheless, it is likely over time that some people will modify their AVs or try to abuse the sensors or control systems for fun. In these cases, if an accident occurs, the defendant may point to this conduct as a defense. Moreover, defenses based on a plaintiff's conduct could reduce or bar a plaintiff's recovery when the plaintiff was not a driver of the AV, such as a pedestrian carelessly (or intentionally) darting out in front of an AV faster than any human or machine could react.

The other key defense in AV litigation will likely be a "state of the art" defense to a design defect claim. The basis of this defense is that the manufacturer could not have produced a safer design at the time of sale because safer designs were not technologically feasible then. Such a defense is valid in some states while not in others [13].16

#### 26.5 Managing the Risk of Autonomous Vehicle Product Liability

Having covered the nature of product liability, the potentially huge exposure for losses, juror anger that leads to huge jury verdicts, and the nature of product liability, I now turn to the issue of how manufacturers can manage the risk of product liability litigation.<sup>17</sup> First and foremost, managing these risks requires a proactive approach. By planning today, manufacturers can be prepared for the inevitable suits later. First, planning can enable them to make safer products that are less likely to cause litigation-triggering accidents in the first place. Second, by planning ahead, manufacturers can increase their chances of winning the cases that accidents do trigger. A proactive approach to design safety with a comprehensive risk management program establishes upfront a manufacturer's commitment to safety. When the inevitable suit happens later, the manufacturer's counsel has a story to tell the jury as to why its products were safe and how the manufacturer cared about safety.

Second, manufacturers should consider the commitment they make to product safety using such a proactive approach. One commentator stated, "The most effective way for [counsel for] a corporate defendant to reduce anger toward his or her client is to show all the ways that the client went beyond what was required by the law or industry practice" [24]. Meeting minimum standards is insufficient because of juror skepticism about the rigor of standards set or influenced by industry and because jurors expect corporate clients to know more about product safety than a "reasonable person"—the standard for judging

<sup>16</sup>Another typical product liability-specific defense is the economic loss doctrine, which bars product liability tort claims where the claimed damages are financial and not for bodily injury or damage to property other than the product itself. Moreover, federal law may preempt some state law claims, because U.S. federal law trumps state laws inconsistent with it. Also, if a product is meant to be used by a "sophisticated user" or provided by a "sophisticated intermediary," the seller may have a defense under certain circumstances, although this defense is unlikely to apply to AVs. Finally, if a manufacturer creates a product pursuant to government specification, it may have a "government contractor defense."

<sup>17</sup>I speak here of product liability litigation, although the risk management techniques here also apply to preventing the need for costly product recalls.

the conduct of defendants under the law [24]. "A successful defense can also be supported by walking jurors through the relevant manufacturing or decision-making process, showing all of the testing, checking, and follow-up actions that were included. Jurors who have no familiarity with complex business processes are often impressed with all of the thought that went into the process and all of the precautions that were taken" [24]. Even though accidents do occur, and in any trial setting an accident or problem did occur, a defendant's proactive approach would show the jury that the manufacturer tried hard to do the right thing [24]. Consequently, efforts to go above and beyond the minimum standards would diffuse juror anger and mitigate the manufacturer's risk.

Third, manufacturers should recognize that risk management is a process that begins with a careful risk analysis looking at the types, likelihood, and impact of issues in the design of AVs. Once a risk assessment is complete, they can review the results and analyze changes in design and engineering practices to address these issues, prioritize risks and risk mitigation measures, and implement the prioritized risk mitigation measures [34]. In connection with the risk management process, manufacturers can obtain guidance from a number of standards bearing on risk management and safety:


While adherence to the principles of international standards does not guarantee that an AV manufacturer will avoid liability, adherence to standards bolsters the credibility of a manufacturer's risk management program. Moreover, the standards provide a framework by which manufacturers can build a set of controls for their risk management process. Consequently, an AV safety program built on international standards lays the foundation for a later defense of a manufacturer accused of building an unsafe AV.

Fourth, AV manufacturers should obtain insurance coverage to manage product liability risk. A robust insurance program will permit manufacturers to shift the risk of product liability to insurance carriers who will, under issued policies, defend and indemnify manufacturers for settlements and judgments paid to resolve third party claims. Currently, the insurance industry is just beginning to come to grips with the insurance implications of AVs [21]. We can expect to see the insurance industry provide third party coverage to manufacturers for accidents, and probably privacy and information security risks as well. While the industry has no historical data for an actuarial approach to underwriting AV risks, the industry will probably look by analogy to conventional vehicles and mobile devices for loss experiences [6]. AV manufacturers can find carriers willing to write bespoke policies tailor-made to their needs. Eventually other carriers will enter the market and offer more standardized polices, thereby reducing premium costs to manufacturers over the long run.

Fifth, manufacturers can work together on industry risk management initiatives, such as:


Sixth, manufacturers can manage the risk of huge jury awards by certain pre-litigation strategies. For instance, they may want to engage jury consultants that assist the defense of product liability cases to identify risk factors for the manufacturer and the types of conduct that trigger juror anger. In addition, manufacturers may want to identify and cultivate a group of defense experts they can use to educate jurors about various engineering, information technology, and safety considerations. Moreover, counsel for manufacturers may want to join specialty bars for defense counsel for purposes of sharing information, briefs, and other work product.

Finally, manufacturers can maximize their success in future product liability trials by focusing on effective records and information management (RIM). Effective RIM may win cases, while poor RIM may lose cases. Documents and records produced contemporaneously with the management of a safety program can corroborate the testimony of witnesses, provide a historical record documenting a manufacturer's safety efforts, and send the message that the manufacturer cares about safety.

#### 26.6 Conclusions

One of the top, if not the top, challenge autonomous vehicle manufacturers face is the risk of product liability suits and recalls in the wake of accidents resulting in deaths and catastrophic injuries. Lawsuits in which manufacturers appear callous, placing profits over safety, face the risk of huge liabilities. Recent reports about "sudden acceleration" in Toyota cars and problems with General Motors' ignition switches show that these companies are paying multiple billions of dollars to resolve legal claims. Plaintiffs have a number of claims they can assert against AV manufacturers, although manufacturers may have defenses as well. Various kinds of defects may crop up with AVs, although problems with software, logic, autonomous behavior, and programmer decisions on AV behavior in crashes are top concerns. Nonetheless, manufacturers can manage product liability risk through careful planning, a strong commitment to safety, an effective risk management process beginning with a thorough risk analysis, adherence to international standards, obtaining robust insurance coverage, collaboration with other manufacturers, pre-litigation legal strategies, and effective records and information management practices. In sum, the threat of crippling product liability litigation in the United States poses a profound concern for manufacturers of autonomous vehicles, but starting proactive engineering design strategies for safety risk management and legal strategies to anticipate future litigation now can place manufacturers in the best position to maximize product safety and minimize product liability in upcoming decades.

Open Access This chapter is distributed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, duplication, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, a link is provided to the Creative Commons license and any changes made are indicated.

The images or other third party material in this chapter are included in the work's Creative Commons license, unless indicated otherwise in the credit line; if such material is not included in the work's Creative Commons license and the respective action is not permitted by statutory regulation, users will need to obtain permission from the license holder to duplicate, adapt or reproduce the material.

#### References


# 27 Regulation and the Risk of Inaction

Bryant Walker Smith

#### Abstract

This chapter begins with two fundamental questions: How should risk be allocated in the face of significant uncertainty—and who should decide? Its focus on public actors reflects the significant role that legislatures, administrative agencies, and courts will play in answering these questions, whether through rules, investigations, verdicts, or other forms of public regulation. The eight strategies discussed in this chapter would in effect regulate that regulation. They seek to ensure that those who are injured can be compensated (by expanding public insurance and facilitating private insurance), that any prospective rules develop in tandem with the technologies to which they would apply (by privileging the concrete and delegating the safety case), that reasonable design choices receive sufficient legal support (by limiting the duration of risk and excluding the extreme), and that conventional driving is subject to as much scrutiny as automated driving (by rejecting the status quo and embracing enterprise liability).

## 27.1 Introduction

#### 27.1.1 In Context

Two complex and conflicting objectives shape altruistic regulation of human activity: maximizing net social good and mitigating incidental individual loss. Eminent domain provides a superficially simple example: To build a road that benefits ten thousand people, a government evicts—and compensates—the ten people whose homes are in the way. But

B.W. Smith (&)

University of South Carolina School of Law, Columbia, SC, USA e-mail: bryantws@civil.co.de

in many cases, individual loss is not fully compensable, most strikingly when that loss involves death: Whatever her actual detriment, a person who dies cannot be "made whole." And indeed, more than 30,000 people lose their lives on US roadways every year while more than 300 million obtain some direct or indirect benefit from motorized transport.

The promise that vehicle automation holds for highway safety raises difficult questions about regulation's social and individual objectives. Analyzing either objective requires topical and temporal definition of a manageable system in which costs and benefits can be identified, valued, and compared. With respect to net social good, what is the statistical value of a human life? Is a reduction in organ donations a "cost" of safer highways? Could aggressive deployment of particular technologies cause a backlash that ultimately undermines safety? Similarly, with respect to individual loss, how should injury or death be valued? Should culpability affect compensation? Who is entitled to it? The particular answers to these questions may depend on the domain—law, economics, ethics, the social sciences—from which they are drawn.

Vehicle automation exposes tension between the social and individual objectives. Externalities frequently accompany innovation: Inventors impose costs that they need not or cannot bear and create benefits that they cannot capture. Compensation of incidental injury may be one such cost, and socially desirable innovations like automation might be subsidized by shielding them from it. Calibrating net social good and individual loss can also create moral hazard: Safety might be discounted by innovators who are legally or effectively exempt from rules and immunized from lawsuits or by consumers who are assured of compensation for injury.

This tension exists against two related background conditions. The first is a preference for the status quo—a tendency that is reflected in administrative law, in tort law, and internationally in the precautionary principle. Many vehicle fatalities appear only in local obituaries, but a single automated vehicle fatality would end up on national front pages. The second is a failure by imperfectly probabilistic humans to accurately perceive risk. Drivers who speed around blind corners but fear traveling over bridges demonstrate this tendency to underestimate some risks and overestimate others.

This complex regulatory context leads to two fundamental questions: How should risk be allocated in the face of significant uncertainty—and who should decide? The range of actors includes the legislative, executive, and judicial branches of national and subnational governments, companies, standards organizations, consumers, and the public at large. Regulation can be prospective or retrospective, but it cannot be nonexistent: Administrative agencies that decline to establish safety requirements for automated vehicles merely leave this task to judges and juries after incidents have occurred.

The consequences of action or inaction are as stark as they are uncertain. Regulatory acts or omissions could cost lives in the near term by delaying or raising the price of automation technologies [1]. But they could also save lives in the longer term by protecting broad classes of innovation from the potential reputational damage that early tragedies or controversies could inflict. Charting the currents of abstract social gain and


#### Table 27.1 Potential regulatory strategies

concrete human loss from vehicle automation requires appreciating the risks that regulation presents as well as those that it addresses.

This chapter first considers the nature of risk, the nature of regulation, and the challenge of regulating—in a broad sense—the increasing automation of motor vehicles. It then introduces four pairs of potential strategies to respond to this challenge, as summarized in Table 27.1.

These strategies are not exhaustive. They may be unnecessary. And they may be insufficient. Some are obvious, some are unconventional, and some may well be both. Their purpose is to advance discussion of the proper role of the public sector—legislatures, administrative agencies, and courts—in addressing automation's challenges and opportunities.

#### 27.1.2 What Is Risk?

Risk can mean so many things that, without context, it means not much at all. Broadly, "[t]he risk of a particular harm is the product of the probability of that harm and the severity of that harm; the risk of an act or omission is the sum of the risks of the particular associated harms" [2]. This actual risk, however, is merely theoretical: No actor can comprehensively inventory all associated harms or accurately determine their probabilities and magnitudes.

In practice, actual risk is therefore simplified into assessed and perceived risk. Assessed risk reflects a methodical attempt to objectively describe all significant harms within a defined system; this system might contemplate a broad range of harms, as in the case of an environmental impact statement, or a more narrow range, as in the case of a functional safety standard focused on physical injury to humans [2]. In contrast, perceived risk reflects an individual's subjective judgment about particular dangers; it may differ considerably from the assessed risk.

An internalized risk is one that is borne by the actor who creates it, regardless of whether that actor has correctly assessed or perceived that risk. Internalization is central to tort law's regulatory role: By forcing actors to bear more of the costs of their unreasonably dangerous behavior, tort law seeks to deter that behavior.

The financial risks imposed on these actors, however, are categorically different from the physical risks that these actors impose on others. In obligating these actors to pay damages to those they have injured, tort law also plays a compensatory role. Nonetheless, even if those who are injured succeed in recovering damages, they will still have been injured [2].

Accordingly, it is important to distinguish between reducing physical risk (a regulatory function) and shifting financial risk (a compensatory function). Some of the regulatory strategies introduced below may achieve one of these two objectives at the expense of the other.

#### 27.1.3 What Is Regulation?

Regulation checks and changes behavior. In its narrowest sense, the term refers only to rules enacted by an administrative agency. A more useful conception, however, encompasses a broad range of actions, including those illustrated in Fig. 27.1 [3].

Regulation can be prospective (forward-looking) or retrospective (backward-looking). Prospective actions, shown on the left side, contemplate a generalized risk that has not manifested, as in the case of the federal performance requirements governing vehicle design. In contrast, retrospective actions, shown on the right side, respond to the realization of a risk, as in the case of a tort claim by a person injured in a crash. The possibility of retrospective regulation, particularly if it is foreseeable, can affect behavior even if the risk is never realized.

Regulation can also be pursued by a public actor or by a private actor. Public actions, shown on the top, include typical functions of the state: setting requirements and conducting investigations. In contrast, private actions, shown on the bottom, generally

Fig. 27.1 Quadrants of regulation

involve relationships among private parties: a consensus among market participants, a contract between an insurer and its insured, or the tort duties of a manufacturer to those who are injured by its products.

Although this chapter focuses on public actors, these private relationships remain an important tool of public policy. A statutory requirement that drivers obtain sufficient insurance, for example, delegates some regulatory power to the private-sector insurance companies that then decide, subject to additional public regulation, how much any particular driver should be charged.

#### 27.1.4 The Regulatory Challenge

For public regulators, the utilitarian challenge is to indirectly maximize net social good while indirectly mitigating incidental individual loss. With respect to vehicle automation, this means defining an appropriate system in which societal costs and benefits can be analyzed [2], checking that the incentives and disincentives for developers of automated systems are consistent with that system, reconciling these with the incentives and disincentives for other actors, and ensuring that those who are harmed have appropriate access to some means of compensation.

This chapter outlines four pairs of potential regulatory strategies that could advance these goals. Its focus on risk management by public actors complements earlier risk management proposals for private actors [4]. These strategies involve ensuring compensation by expanding public insurance and facilitating private insurance, forcing information-sharing by privileging the concrete and delegating the safety case, simplifying the problem by limiting the duration of risk and excluding the extreme, and raising the playing field by rejecting the status quo and embracing enterprise liability.

#### 27.2 Ensure Compensation

#### 27.2.1 Expand Public Insurance

Insurance can help reduce the financial burden placed on injured individuals and, potentially, the compensatory pressure placed on tort law. Ensuring that those who are physically injured by automated vehicles are able to recover for their injuries makes the occurrence of those injuries, at least from a public policy perspective, more justifiable. If the only avenue for that recovery, however, is litigation, product liability law may be forced to bend in ways that distort its regulatory function.

While an expansion of insurance has merit as a standalone initiative, it must be a condition of any reasonable proposal to subsidize vehicle automation by limiting tort remedies. Reducing a defendant's liability means reducing an injured individual's access to compensation. It also means depriving that individual of a sanctioned means of recourse: Suing a manufacturer, whatever its inefficiencies, is still preferable to sabotaging that company's products or undertaking other means of private retribution.

#### 27.2.2 Facilitate Private Insurance

While private insurers can also provide compensation, their potential role as regulators is particularly promising. A well-functioning insurance market can generate useful data and desirable incentives. It can reduce uncertainty for those who might be plaintiffs as well as for those who are regularly defendants. Take two distinct examples: vehicle insurance and product liability insurance.

In the United States, most drivers and vehicle owners are required to carry insurance for harms inflicted with their vehicles. The required coverage varies by state and is generally far less than would be necessary to compensate for a serious injury or death; California, for example, requires only \$15,000 in coverage for injury or death to one person and \$30,000 in coverage for injury or death to more than one person [5]. The companies that offer this insurance tend to be subject to complex regulatory regimes that also vary by state; California even prescribes the primary factors to be used in pricing such insurance [6].

An alternative regime could respond much more flexibly to vehicle automation. Increasing and then enforcing insurance requirements could help internalize more crash costs, compensate injury more fully, shift some recovery from manufacturers toward negligent drivers, and enable consolidation of some product liability claims through subrogation. Reducing consumer-facing restrictions on insurers could free these companies to better tailor their products to reflect the actual risk posed by particular drivers in particular vehicles in particular conditions. This could in turn advantage those automated vehicles that actually represent a safety improvement.

In contrast to drivers, companies are generally not required by law to maintain product liability insurance. Indeed, one of the purposes of the corporate form is to protect shareholders from liability. Requiring such coverage, however, could provide a check on safety by engaging a third-party insurer in a regulatory role: In order to obtain affordable coverage—or coverage at all—a manufacturer would need to persuade the insurer that its products do not pose unreasonable risk. This would be another way to "delegate the safety case," to quote the section of the same name below.

The regimes created by Nevada and California to regulate automated vehicles already require companies seeking to test their systems on public roads to demonstrate financial capacity beyond typical state insurance requirements. California, for example, requires \$5,000,000 in the form of a certificate of insurance, a certificate of self-insurance, or a surety bond [7]. While this approach is promising, these heightened insurance requirements should apply to all vehicles rather than merely to automated vehicles undergoing testing. As the section of the same name argues below, such regulation should "raise the playing field" for conventional as well as automated vehicles.

#### 27.3 Force Information-Sharing

#### 27.3.1 Privilege the Concrete

Product development requires understanding, and as necessary shaping, external forces like law. If specific legal obligations, restrictions, or liabilities are impeding automated vehicle technologies, then would-be developers of those technologies should challenge those constraints. In short, they should identify the specific legal changes that they or their products require—and support these arguments with concrete data and careful analysis. If they do not, policymakers should ask why.

Although concerns have been raised for decades about the product liability implications of increasing vehicle automation [8], automakers tend to refer only broadly, if at all, to this potential challenge even as they announce plans to deploy increasingly advanced automation features. This apparent disconnect suggests either that the technologies themselves are not as imminent as popularly believed [9] or that the companies pursuing those technologies are not as concerned about general product liability as is commonly suggested.

In contrast, automakers have acted to address a more narrow liability question related to the installation or modification of automation systems. Several state legislatures have now clarified that, to quote Michigan law [10], manufacturers and subcomponent producers are "not liable and shall be dismissed from any action for alleged damages resulting from" such third-party installations or conversions "unless the defect from which the damages resulted was present" at the time of manufacture. This provision is largely a restatement of common law [9] and, like common law, does not unambiguously contemplate every potential modification claim.1

Notwithstanding this uncertainty, this experience demonstrates that established automakers can recognize potential legal issues, propose specific legislative remedies, and —with the exception of California [11]—obtain their enactment. To the extent that automated vehicles depend on changes to vehicle codes [12], insurance requirements, or rules of liability, regulators should expect well-reasoned and well-supported arguments from their high-profile developers.

Relying exclusively on companies to advance specific legal changes, however, can tend to preserve the status quo. Unlike conventional cars, low-speed shuttles and delivery robots generally have neither existing markets nor established companies to advocate for them. As a result, these applications of automation have been largely ignored in recent legislative and regulatory initiatives [9]. Accordingly, governments should also consider whether a dearth of specific proposals or concrete data can be explained by an inability rather than a disinclination to participate in the regulatory process.

<sup>1</sup> Consider two examples. In the first, the manufacturer fails to warn against a foreseeable modification of its vehicle; might that failure to warn constitute a "defect from which the damages resulted"? In the second, the subcomponent producer designs a sensor that is highly vulnerable to hacking; might that security vulnerability constitute a "defect from which the damages resulted"?

In a sense, governments should approach policymaking with the same philosophy underlying public support of physical infrastructure and scientific research: Initiate what the private sector cannot or will not do. Broad mandates or basic conditions may be useful in driving or policing innovation, but attempts to closely tailor rules to products that do not yet exist could produce law that is premature and prejudicial.

#### 27.3.2 Delegate the Safety Case

Vehicle automation is putting state regulators in a difficult position. Prominent examples come from Nevada and California, the two states whose departments of motor vehicles were directed to quickly enact regulations governing automated vehicles and automated driving.<sup>2</sup> These regulations seek both to provide greater legal certainty to the developers of automated systems [13–15] and to restrict unreasonably dangerous products and practices [16].

Many states, however, already empower regulators to restrict the registration, modification, or operation of road vehicles on the basis of safety [12]. A New York statute, for example, permits the motor vehicle commissioner to "refuse to register any vehicle or class of vehicles for use on the public highways where he determines that the characteristics of such vehicle or class of vehicles make such vehicle or vehicles unsafe for highway operation" [17].

Alternative approaches to deploying automation systems, including pilot projects and aftermarket modifications, may implicate this authority more quickly than would traditional rollouts [9]. Long before the National Highway Traffic Safety Administration (NHTSA) promulgates rules for automated vehicles<sup>3</sup> or even conducts investigations into incidents involving them, state regulators may be facing—or at least actively ignoring the question of whether to revoke the registration of a vehicle retrofitted with a novel automation system.

Answering such a question will inevitably frustrate these regulators [15]. There is no consensus about how to define, or then how to demonstrate, the appropriate level of safety for an automated vehicle or for the human-machine system to which it may belong [18]. Moreover, the kind of regulation that is appropriate for an established automaker may differ considerably from the kind that is appropriate for a small startup or an individual tinkerer [9].

Although state vehicle agencies generally lack NHTSA's technical resources, they may have more regulatory flexibility. Federal motor vehicle safety standards (FMVSSs) are

<sup>2</sup> Other states have enacted automated driving statutes without expressly requiring this rulemaking. 3 NHTSA has historically promulgated performance standards only for safety technologies that have already been widely deployed, although the eventual regulation of vehicle-to-vehicle (V2V) communications systems is likely to be an exception.

restricted to objective measures and to tests "capable of producing identical results when test conditions are exactly duplicated" [19], quoted in [20].

In contrast, state agencies may be bound by less demanding requirements of administrative process, which may afford them the discretion needed to gradually develop consistent practice. Such flexibility could enable regulators to address specific technologies without entrenching rules that are likely to become anachronistic and irreconcilable with others.

To this end, "delegating the safety case" would mean requiring the developer of a vehicle automation system to publicly make and defend arguments about how well its system should perform and how well its system actually performs. In short:


This process draws on several existing models, including the type approval (or homologation) typical in the European Union and the self-certification prescribed by US law. It could accommodate the kind of process standards used in ISO 26262, the kind of alternatives discussion characteristic of environmental impact statements, and the kind of public dialogue foundational to notice-and-comment rulemaking.

By encouraging companies to disclose information necessary to their safety case, such an approach could help educate regulators and the broader public about the capabilities and limitations of these emerging technologies. Although disclosure could justifiably concern some developers, this process would not require the disclosure of all information, only that which is necessary to demonstrate a reasonable safety case. What is reasonable will likely evolve, and this approach could afford companies greater flexibility to make nontraditional arguments for the safety of their systems and regulators greater flexibility to adapt to changing capabilities.

Because flexibility can also mean uncertainty, early collaboration between regulators and developers may be necessary to avoid all-or-nothing approval decisions at the end of product development. Regardless, uncertainty is not a new concern: Whatever clarity that the current federal regime offers through self-certification to specific standards is diminished by the recalls and lawsuits that can arise years or even decades after a vehicle has been sold.

Indeed, unlike current federal motor vehicle safety standards, a safety case could contemplate the entire product lifecycle. A developer might describe not only the steps it had taken to ensure reasonable safety at the time of sale but also the steps it would continue to take as it learned more about performance in the field.

#### 27.4 Simplify the Problem

#### 27.4.1 Limit the Duration of Risk

The potential longevity of any motor vehicle—the "average" age of cars in the United States is more than eleven years [21]—can create uncertainty for its manufacturers [4] and safety concerns for the public [14]. In 2013, Chrysler reluctantly recalled some Jeeps that were twenty years old [22, 23]. More generally, newer vehicles tend to be safer than older vehicles; "improvements made after the model year 2000 fleet prevented the crashes of 700,000 vehicles; prevented or mitigated the injuries of 1 million occupants; and saved 2000 lives in the 2008 calendar year alone" [24].

This uncertainty may be particularly great in the case of automated vehicles [4]. Even extensive testing may not capture the full range of scenarios that these vehicles could face. Manufacturers may have difficulty predicting "the eventual response of judges, juries, regulators, consumers, and the public at large to incidents that will inevitably occur" [1]. Regulators may be "concerned that, first, isolated incidents involving these products will create feelings of helplessness and panic that unjustifiably stymie their wider adoption and that, second, these early products will still be around years later when they are much less safe than whatever has become state of the art" [14].

A promising response to these challenges is a lifecycle approach to vehicle design that seeks to limit the duration of risk. For the private sector, this could entail over-the-air updates, end-user license agreements, leasing arrangements, and a variety of other technical and legal tools to enable manufacturers to update or even forcibly retire systems in which they no longer have confidence [4]. For the public sector, this could mean requiring companies to document a strategy and a capacity for monitoring the long-term safety of their systems. Such documentation could be a key part of the safety case introduced above.

#### 27.4.2 Exclude the Extreme

The aphorism that "the perfect is the enemy of the good" [25] is instructive for vehicle automation. Demanding perfection may impede the development or deployment of systems that, while not perfect, nonetheless represent a significant improvement over conventional vehicles. Excessive design demands, for example, might preclude an automated vehicle that could avoid many of the common errors of human drivers but that could not avoid catastrophic multicar freeway pileups to the extent physically possible. In other words, it may be prudent to accept some failures in order to expedite larger successes.

Moreover, attempting to design an automated vehicle to handle every conceivable driving scenario may introduce complexity that is poorly understood, unmanageable, and ultimately detrimental to safety. Again, for example, designing an automated vehicle to rapidly accelerate through a pileup-in-progress might lead to programming oversights that could cause that same vehicle to errantly speed up after entering a closed construction zone. Here it may be prudent to accept some failures in order to prevent even more catastrophic failures.

For both of these reasons, early generations of automated vehicles may necessarily limit the technical challenges that they attempt to solve. These vehicles might be deployed into simplified environments at lower speeds [9]. Or they might continue to rely in part on human drivers [26], particularly if those humans are professionals who can be carefully trained, closely monitored, and sufficiently incentivized.

Sound engineering may demand additional limitations. For example, it may be prudent to program an automated vehicle to never speed, to always slow to a stop in the event of a detected failure, or to always permit human override within a set number of seconds. These stylized examples might mean that, in occasional cases, an automated vehicle will crash because it has failed to accelerate or because it has stopped or because its human driver has made poor decisions while panicking.

Although these should be primarily technical determinations, law may be able to play a supporting role. In some jurisdictions, for example, the plaintiff in a product liability case must demonstrate that an alternative product design was available and superior to the one alleged to have contributed to her injury. In such a case, it may be appropriate to give more weight to counterarguments about the complexity, uncertainty, and delay inherent in such designs.

There are, however, two important cautions. First, for those injuries that do occur, this strategy merely shifts more of the risk to those people who have been injured. This consequence highlights the need for a sufficient social safety net, whether provided through public insurance, private insurance, or another means. Second, codifying a ceiling on the performance required could mean calcifying the level of reasonable design for technologies that may quickly be capable of much more.

#### 27.5 Raise the Playing Field

#### 27.5.1 Reject the Status Quo

The reality that human drivers often violate rules of the road prompts speculation that programming automated vehicles to comply with these rules would reduce their appeal. Suggestions for addressing this perceived disadvantage have included expressly permitting automated vehicles to travel at or above the prevailing traffic speed and delegating decisions about speed or aggression to the human users of these vehicles.

Drivers, however, currently behave in ways that are neither lawful nor reasonable [2]. They drive too fast for conditions, they follow other vehicles too closely, and they fail to yield the right of way to pedestrians. They drive while intoxicated or distracted. They fail to properly maintain their vehicles' tires, brakes, and lights. These largely unlawful behaviors occasionally result in crashes, and those crashes occasionally result in serious injury. This tragic status quo suggests that the current approach to traffic enforcement should be reformed rather than transferred to automated vehicles.

At this early stage in automation, transportation authorities would do better to optimize and then enforce rules of the road for all motor vehicles. Increasing the expectations placed on human drivers—by cracking down on speeding, texting, drunk driving, and other dangerous activities—could increase the appeal of automated vehicles at least as much as allowing those automated vehicles to speed.

Automated enforcement could be a key tool for increasing compliance. Such enforcement currently relies both on roadway devices (including speed and red light cameras) and on in-vehicle devices (including alcohol locks, speed regulators, and proprietary data recorders). Private entities such as fleet managers and insurance companies already provide some of this enforcement indirectly through private incentives. The potential proliferation of outward-facing cameras on vehicles and drones in the air might also facilitate increased public and private enforcement of rules of the road.

Increased enforcement could, on one hand, address equity concerns of discretionary enforcement and, on the other hand, raise privacy and liberty concerns. While these are important questions, a status quo in which laws are openly flouted even by the officers enforcing them is one that begs for reform.

Indeed, more consistent and comprehensive enforcement could create pressure for a careful evaluation of existing law. Better access to and analysis of location-specific information about the driving environment (including roadway geometry, pavement, traffic, and weather) could enable the precise calibration of dynamic speed limits. These dynamic limits might then be communicated to drivers through variable message signs and, in the future, vehicle-to-infrastructure communication.

Because reasonable speed also depends on the driver and her vehicle, posted limits might nonetheless have only limited utility. Pursuant to the basic speed law [2], a human driver should account for each of these variables implicitly and adjust her speed accordingly. Automated vehicles, however, may account for more of these variables explicitly—and reasonably.

Consider, for example, the common requirement that the "driver of a vehicle shall yield the right-of-way to a pedestrian crossing the roadway within any marked crosswalk or … unmarked crosswalk at an intersection, except as otherwise provided" [27]. Although pedestrians may not create an "immediate hazard" by "suddenly" leaving the curb [27], the statutory obligation to yield does suggest one possible bound on vehicle speed.

Imagine a driver traveling down a typical neighborhood street with a parking lane that provides 3 m between her car and the curb, as shown in Fig. 27.2. Assuming that her view of the pedestrian is not blocked, what maximum speed will enable this driver to stop for any pedestrian who, at a walking speed of 1.4 m/s, steps from the curb into the street?

Although stopping sight distance depends on several vehicle, environment, and driver variables [28], this illustration simplifies these to consider only the driver's reaction time and the friction between the tires and the road surface. An average driver with good tires on a flat dry street might achieve a reaction time of 1 s and a subsequent deceleration rate

Fig. 27.2 Illustration of vehicle stopping

of 5 m/s<sup>2</sup> , which implies a maximum speed of 20 km/h (13 mph).<sup>4</sup> In contrast, a hypothetical automated vehicle reacting twice as fast and braking at 7 m/s<sup>2</sup> could reach a maximum speed of about 40 km/h (25 mph),<sup>5</sup> which is a typical residential speed limit today. In other words, if automated vehicles are traveling slowly on a road, perhaps conventional vehicles should be traveling even more slowly.

Reasonable speed is also an answer to some, though not all, of the ethical dilemmas popularly raised in the context of automated driving [29, 30]. Positing a choice between killing one group of pedestrians and another, for example, fails to account for the possibility of negating the dilemma simply by driving more slowly. Slower speeds can increase controllability as well as reduce the magnitude of harm.

Speed is not the only relevant driver action. Tire condition, for example, is an important consideration in stopping distance, is at least nominally regulated [31], and yet varies widely within the current vehicle fleet. If the hardware on automated vehicles is expected to be regularly inspected, so too should the hardware on conventional vehicles. Moreover, driving imposes environmental costs that are not internalized by vehicle owners and operators [32]. If automated driving proves to be more fuel efficient than human driving, a higher fuel tax would also incentivize automation.

In short, reform should seek to more closely align what is lawful with what is reasonable and to more closely align actual driver behavior with both [2]. The expectation that both automated vehicles and human drivers should behave reasonably is itself reasonable and ultimately advantageous to automated driving.

<sup>4</sup> Initial speed = rate of deceleration \* ((pedestrian speed/orthogonal distance from curb to car) − reaction time) = (0.5 \* 9.8 m/s<sup>2</sup> ) \* (((1.4 m/s)/3 m) − 1 s) = 6 m/s = 20 km/h = 13 mph. 5 Initial speed = rate of deceleration \* ((pedestrian speed/orthogonal distance from curb to car) − reaction time) = (0.7 \* 9.8 m/s2 ) \* (((1.4 m/s)/3 m) − 0.5 s) = 11 m/s = 41 km/h = 25 mph.

#### 27.5.2 Embrace Enterprise Liability

Although vehicle automation will change the way some cases are litigated and resolved, manufacturers are likely to continue to successfully manage their product liability [1]. Uncertainty about liability is probably more of an impediment to product deployment than actual exposure to liability—and there are strategies that companies can take to manage that uncertainty [4].

This confidence, however, is not universal [33]. A more skeptical view even has precedent: The National Childhood Vaccine Injury Act of 1986 was passed in response to similar concerns that traditional product liability had rendered some vaccines uneconomic for their would-be producers. The regime it created "combines procedural and substantive limitations on conventional tort remedies with an alternative compensation scheme for probable victims of covered vaccines" [4].

If product liability exposure does impede the deployment of automated vehicles, a similar regime might be an effective response. However, that is by no means the only conceivable alternative.

Rather than limiting liability for the manufacturers of automated systems, courts or legislatures could expand liability for everyone else. This is counterintuitive and, as a legislative proposal, unlikely to go anywhere. Nonetheless, consider the consequences of introducing a system of enterprise liability in which manufacturers are liable for all harm associated with their products. In other words, what would be different if automakers could be successfully sued for every crash involving their product rather than just the small fraction in which a vehicle defect contributed to the injury?

Some effects would be undesirable. Automakers might outright refuse to sell their vehicles in any jurisdiction with enterprise liability. Others would demand higher prices to cover their increased costs. This could in turn mean less access for consumers, particularly those with limited resources.

Other effects, however, might arguably be more desirable. No longer would dealers simply hand over car keys to new buyers. Instead, manufacturers might require these buyers to complete more thorough driver training customized for the particular vehicle. Technologies like alcohol-sensing ignition locks and speed regulators might become standard. Older vehicles might be promptly removed from roads as safer systems are introduced. A notable result could be safer roads.

Another result could be greater automation: Given the choice between paying for the mistakes of their own technologies and paying for the mistakes of their disparate customers, many companies would likely opt for their technology. Automation would become a solution to rather than merely a source of litigation.

Even if pure enterprise liability remains a thought experiment, its principles are evident in other areas relevant to automation. Fleet operators are an attractive market for automated vehicles in part because they are already liable for injuries caused by the negligence of their drivers. Automation may also offer near-term financial or market advantages to insurers, which similarly pay for injuries caused by their insured.

#### Table 27.2 Potential regulatory strategies


More broadly, as manufacturers gain and assert more control over the products they have sold through technology and contract, they may also incur greater legal obligations in tort [4]. These obligations, which might approach enterprise liability without actually reaching it, could have a similar effect on design decisions. Eventually, selling a vehicle that lacks safety-critical automation features might itself be unreasonable.

#### 27.6 Conclusion

This chapter began with two fundamental questions: How should risk be allocated in the face of significant uncertainty—and who should decide? Its focus on public actors reflects the significant role that legislatures, administrative agencies, and courts will play in answering these questions, whether through rules, investigations, verdicts, or other forms of public regulation.

The eight strategies discussed above would in effect regulate that regulation. They seek to ensure that those who are injured can be compensated, that any prospective rules develop in tandem with the technologies to which they would apply, that reasonable design choices receive sufficient legal support, and that conventional driving is subject to as much scrutiny as automated driving. Table 27.2 summarizes.

This focus on public actors does not diminish the important roles that private actors play in innovation and in regulation. Indeed, several of the strategies discussed above expressly embrace these roles. In this spirit, a challenge for—and to—developers of automated systems is to contribute fully and publicly to the broader discussions for which these strategies are intended.

Open Access This chapter is distributed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, duplication, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, a link is provided to the Creative Commons license and any changes made are indicated.

The images or other third party material in this chapter are included in the work's Creative Commons license, unless indicated otherwise in the credit line; if such material is not included in the work's Creative Commons license and the respective action is not permitted by statutory regulation, users will need to obtain permission from the license holder to duplicate, adapt or reproduce the material.

#### References


# 28 Development and Approval of Automated Vehicles: Considerations of Technical, Legal, and Economic Risks

Thomas Winkle

#### 28.1 Introduction

Sensor technology and data processing are constantly improving in their performance. This enables both: continuous further development of driver assistance systems and increasing automation of the driving task, right up to self-driving vehicles [1].

In the following chapter the author traces the technical improvements in vehicle safety over recent decades, factoring in growing consumer expectations. Considering Federal Court of Justice rulings on product liability and economic risks, he depicts requirements that car manufacturers must meet. For proceedings from the first idea until development to sign, he recommends interdisciplinary, harmonized safety and testing procedures. He argues for further development of current internationally agreed-upon standards including tools, methodological descriptions, simulations, and guiding principles with checklists. These will represent and document the practiced state of science and technology, which has to be implemented in a technically viable and economically reasonable way.

#### 28.1.1 Motivation

In the course of this development, technical, especially electrical/electronic systems and software are becoming far more complex in the future. Therefore, safety will be one of the key issues in future automobile development and this results in a number of major new challenges, especially for car manufacturers and their developers. In particular, changing vehicle guidance from being completely human-driven, as it has so far been, to being

Department of Mechanical Engineering, Institute of Ergonomics, Technische Universität München – TUM, 85747 Garching, Germany e-mail: winkle@carforensic.com

T. Winkle (&)

highly or fully automated, raises fundamental questions regarding responsibility and liability. This calls for new approaches—first and foremost new safety and testing concepts [2]. From the legal point of view, automated vehicles require protective safety measures in the development process [3]. The remaining risk must be accepted by users. According to a judgment by the German Federal Court of Justice (Bundesgerichtshof, or BGH), such vehicles must be possible to construct—within the limits of what is technically possible and economically reasonable—according to the respective current state-of-the-art, state-of-science, and must enter the market in a suitably sufficient form to prevent damage [4].

#### 28.1.2 Questions of Increased Automation's Product Safety

Media reports on car manufacturers, suppliers and IT companies' automated research vehicles have predicted for years the preparation for the development of self-driving vehicles, produced in series. Several things still need to be in place however, before these vehicles can be launched on the market. Increasing automation of vehicle guidance calls for cutting-edge, highly complex technology. Particularly with the use of electric/electronic hard- and software, unforeseeable reactions have to be expected, which in the worst cases may even be danger to life and limb. Due to the growing complexity, fully automating all driving tasks in driverless vehicles (see [3])—without a human driver as a backup—currently involves risks, which are difficult to assess. In addition, there are new liability questions and limited tolerance for technical failure. While over 3000 deaths in road traffic currently seem to be acceptable to society in Germany, there is likely to be zero tolerance for any fatal accident involving presumable technical failure. Although automation in driving promises considerable potential safety benefits, the comprehensive commercialization of driverless vehicles can only take place when questions surrounding who is liable and responsible for damage caused by technological systems have been clarified. Acceptance by society may only occur when amongst other things, the benefits perceived by the individual clearly exceed the experienced risks.

An in-depth analysis of automated vehicles' risks to be considered, based on many years' experience in research and product liability, will provide basics for preparing their future series development and commercialization. From this, recommendations for safety assessment will be concluded. To date, amongst others, the following questions remain unsolved:


#### 28.1.3 Technical Continued Development of Assistance Systems—New Opportunities and Risks

From a technical point of view, automated vehicles are presently already able to autonomously take-over all driving tasks in moving traffic. Current series-production vehicles with an optimized sensor, computer, and chassis technologies enable assistance systems with increasing greater performance. Some of the driver-assistance systems on the market today give warning when they recognize dangers in parallel or cross traffic (Lane Departure Warning, Collision-, Lane Change-, Night Vision- and Intersection-Assistance). Others intervene in the longitudinal and lateral dynamics (e.g. anti-lock braking—ABS, Electronic Stability Control—ESC, Adaptive Cruise Control—ACC). Active parking/steering assistance systems provide increased convenience by interventions of steering and braking at low speeds. These partially automated vehicle systems, with temporary longitudinal and lateral assistance, are currently offered for series-production vehicles, but exclusively on the basis of an attentive driver being able to control the vehicle. Supervision by a human driver is required. During normal operation at and beyond the system limits, the system limits or failures of these Advanced Driver Assistance Systems, or ADAS, are thus compensated by the proof of controllability due to the driver (see [5, 6]).

For fully automated driving on the other hand, the driver is no longer available as a backup for the technical limits and failures. This replacing of humans, acting by their own responsibility, with programmed machines goes along with technical and legal risks, as well as challenges for product safety. However, future expectations regarding driverless vehicles—even in a situation of possible radical change—can only be described as using previous experience. Analogies based on past and present expectations concerning vehicle safety will therefore be examined in the following section.

#### 28.2 Expectations Regarding Safety of Complex Vehicle Technology

#### 28.2.1 Rising Consumer Expectations for Vehicle Safety

Fully automated vehicles must be measured against today's globally high level of consumer awareness in vehicles' failures. Since 1965, critical awareness regarding the car industry has evolved more and more, strengthened by the book Unsafe at Any Speed—The Designed-In Dangers of the American Automobile [7, 8]. In this publication, the author Ralph Nader blamed car makers for cost savings and duty-of-care breaches at the expense of safe construction and production. With its presentation of safety and construction deficiencies at General Motors and other manufacturers, the book's content scared the public. Nader went on to found the Center for Study of Responsive Law, which launched campaigns against the "Big Three" automobile manufacturers in North America, Volkswagen and other car companies. Technical concepts were subsequently reworked and optimized. At the center of Nader's criticism was the Chevrolet Corvair. Amongst other things, Nader criticized the unsafe vehicle dynamics resulting from the rear-mounted engine and swing axle. Under compression or extension, it changed the camber (inclination from the vertical axis). By a design modification into an elastokinematic twist-beam or a multilink rear suspension, the inclination remains largely unchanged, which results in more stable driveability and handling. Later, the VW Beetle also came under fire for similar reasons due to its sensitivity to crosswinds. It was also designed with a rear-mounted engine and a swing axle. As a technical improvement VW therefore replaced the Beetle with the Golf, with a front engine, front-wheel drive and more stable handling (market introduction 1974).

Besides the development of new vehicles that were of better design and drove more safely, a further consequence of this criticism was the establishment of the US National Highway Traffic Safety Administration (NHTSA), located within the Department of Transportation. Based on the Highway Safety Act of 1970, it improves road traffic safety. It sees its task as protecting human life, preventing injury, and reducing accidents. Furthermore, it provides consumers with vehicle-specific safety information that had previously been inaccessible to the public. Moreover, the NHTSA accompanies numerous investigations of automobile safety systems to this day. Amongst other things, it has actively promoted the compulsory introduction of Electronic Stability Control (ESC). Parallel to NHTSA activities, statistics from the German Federal Motor Transport Authority (Kraftfahrt-Bundesamt, or KBA) also show increasingly sensitive ways in handling safety-related defects, by supporting and enforcing product recalls [9]. Furthermore, there are now extremely high expectations for vehicle safety. This also can be seen in the extensive safety equipment expected today in almost every series production vehicle across the globe. It includes anti-lock braking (ABS), airbags, and Electronic Stability Control (ESC). The frequency of product recalls has increased, despite passenger vehicles' general reliability and functional safety noticeably rising at the same time. Endurance tests in trade magazines such as Auto Motor und Sport show that a distance of 100,000 km can be obtained more often without any breakdowns, unscheduled time in the garage, or defective parts, and without any defect.

#### 28.2.2 Risks and Benefits of Automated Vehicles

Automated vehicles will arguably only gain acceptance within society when the perceived benefit (depending on the degree of efficiency: "driver" versus "robot") outweighs the expected risks (depending on the degree of automation: "area of action" versus "area of effectiveness"). In order to minimize the risks, manufacturers carry out accident-data analysis and corresponding risk management (see Fig. 28.1).

Fig. 28.1 Societal and individual user acceptance may occur contextually, while consumers weigh up the perceived beneficial options and fear for risks in the relevant contexts (see Chaps. 29, 30). Risks depend on the level of automation, benefits of the degree in efficiency. Risk management and accident data analysis (see Chap. 17) allow for objectivities (see Chap. 30) and optimization. Image rights: Autor

For car manufacturers and their suppliers, automated vehicles are an interesting product innovation with new marketing possibilities. Investment decisions and market launches however involve risks that are difficult to assess:


#### 28.3 Legal Requirements and Effects

Society's and individual expectations of technical perfection in vehicles are rising. Higher demands in vehicle quality and functions also call for corresponding safety measures when rolling out automated vehicles. This for example can be seen in the increase of recall campaigns despite increasing technical vehicle-reliability or additional requirements and standards. Applicable comprehensive safety campaigns, such as the Motor Vehicle Safety Defects and Recalls or new obligations for documentation by public authorities also indicate increasing requirements. One example of the latter is the Transportation Recall Enhancement, Accountability and Documentation (TREAD) Act in the USA [10], which introduced a series of new and extensive obligations for documentation and report-keeping for the National Highway Traffic Safety Administration (NHTSA). At the same time, human errors in road traffic are sanctioned individually, without bringing the whole road transport system itself into question.

Highly complex technologies and varying definitions slow down any launch of autonomous vehicles. In addition, the interdisciplinary context contains various technical guidelines. Developers used to be able to get their specifications with standards or guidelines such as "generally accepted good engineering practice", "generally recognized and legally binding codes of practice", "industry standards", or the "state of the art." With its decision of 06/16/2009, the German Federal Supreme Court of Justice (BGH) wanted to ramp up requirements for the automotive industry and surprisingly shaped the term "latest state of the art and science". This creates additional challenges for developers. Functions that are currently feasible in research vehicles for scientific purposes are under laboratory conditions far from fulfilling expectations for series production vehicles, e.g. protection from cold, heat, vibrations, water, or dirt.

From a developer's point of view, these legal requirements for a careful development of new complex systems can only be fulfilled after validation tests. These should ideally be internationally harmonized and standardized. The German BGH judgment from 2009 explained these development requirements—excluding economic and technical suitability for production—with "… all possible design precautions for safety …" based on "state-of-the-art and science" [4] on the basis of an expert opinion for the preservation of evidence. This opinion, however, requires ultrasound sensors as redundancy for recognition of critical objects to trigger airbags. It should be possible, "… to attach ultrasound sensors around the vehicle which sense contact with an object and are in addition verified by existing sensors before airbag deployment …" [4].

This expert opinion for the preservation of evidence however from an engineering point of view is more than questionable, as current sensor designs only permit a range of a few meters in series production vehicles. Subject to the current state of the art, the application of ultrasonic sensor systems is limited to detecting static surroundings at slow speeds in the scope of parking assistance. The sensors' high-frequency sound waves can be disturbed by other high frequency acoustic sources such as jackhammers or trucks and buses' pneumatic brakes, which can lead to false detections. Also poorly reflecting surfaces will not lead to a reflection of sound waves. Object recognition is then entirely excluded [11]. Furthermore, the lawsuit finally concluded that the sensor system concerned worked error-free according to the technical specification.

In addition, the previous fundamental BGH judgment requires that risks and benefits be assessed before market launch:

Safety measures are required which are feasible to design according to the state of the art and science at the time of placing the product on the market … and in a suitable and sufficient form to prevent damage. If certain risks associated with the use of the product cannot be avoided according to state of the art and science, then it must be verified - by weighing up the risks, the probability of realization, along with the product benefits connected – whether the dangerous product can be placed on the market at all. [4]

#### 28.3.1 Generally Accepted Rules of Technology

An interpretation of the term "generally accepted rules of technology" (allgemein anerkannte Regeln der Technik, or aaRdT) as a basic rule was shaped in a German Imperial Court of Justice (Reichsgericht) judgment from 1910 based on a decision from 1891 during criminal proceedings concerning Section 330 of the German Penal Code (§ 330 StGB) in the context of building law:

Generally accepted rules of technology are addressed as those, resulting from the sum of all experience in the technical field, which have been proven in use, and wherever correctness experts in the field are convinced.

In various legal areas, they have different meanings. In terms of product liability, generally accepted rules of technology concern minimum requirements. Noncompliance to the rules would indicate the required safety has not been reached. They are described in DIN-VDE regulations, DIN standards, accident prevention regulations, and VDI guidelines, amongst others [12].

#### 28.3.2 The Product Safety Law (ProdSG)

The German Product Safety Law (Produktsicherheitsgesetz, or ProdSG), in its revised version of 11/08/2011 establishes rules on safety requirements and consumer products. Its predecessor was the Equipment and Product Safety Law (Geräte- und Produktsicherheitsgesetz, or GPSG) of 01.05.2004, which in turn had replaced the Product Safety Law (Produktsicherheitsgesetz, or ProdSG) of 22.04.1997 and the Equipment Safety Law (Gerätesicherheitsgesetz, GSG) of 24.06.1968. Section 3 GSG it describes the general requirements for providing products on the market:

A product may … only be placed on the market if its intended or foreseeable use does not endanger the health and safety of persons. [13]

#### 28.3.3 The Product Liability Law (ProdHaftG)

Independent of its legal basis for a claim, the term "product liability" commonly refers to a manufacturer's legal liability for damages arising from a defective product. A manufacturer is whoever has produced a final product, a component product, a raw material, or has attached its name or brand name to a product. For product liability in Germany, there are two separate foundations for claims. The first basis is fault based liability, as found in Section 823 of the German Civil Code (BGB) [13]; the second is strict liability regardless of negligence or fault related to the tortfeasor, as contained in the Product Liability Law. Section 1 of the Product Liability Law (ProdHaftG—Law Concerning Liability for Defective Products) of 12/15/1989 describes the consequences of fault as:

If a person is killed or his or her body or health injured, or if property is damaged, due to a defect of a product, the manufacturer of the product is thus obliged to compensate the injured parties for any losses. [14]

Independently of whether the product defect is caused intentionally or through negligence, a defect is defined in Section 3 of ProdHaftG as follows:

A product is defective when it is lacking safety which the public at large is entitled to expect, taking into account the presentation of the product, the reasonably expected use of the product and the time when the product was put into circulation. [14]

Should damage arise from a defective product, the Product Liability Law regulates the liability of the manufacturer. Firstly, this entails potential claims of civil liability for property damage, financial losses, personal injury, or compensation for pain and suffering. Liability rests primarily with the manufacturer. In justified cases suppliers, importers, distributors, and vendors may also be made liable without limitation. Furthermore, in cases of legally founded criminal liability, there may also be particular consequences for top management or individual employees, if it is proven that risks were not minimized to an acceptable level (see Fig. 28.3). In cases of serious fault or depending on the offense as negligence, this may involve criminal personal proceedings against a developer.

Besides the potential legal consequences, manufacturers must also expect considerable negative economic effects. Negative headlines in the media can lead to substantial loss in profits or revenue, damage to image, loss in trust and consequently loss of market share. Therefore, when developing new systems, both consequences of potentially legal and economic risks must be considered. Figure 28.2 gives an overview of the potential effects of failures in automated vehicles.

Fig. 28.2 Potential effects of failures in automated vehicles. Image rights: Author

#### 28.4 Product Safety Enhancement in Automated Vehicles Based on Expert Knowledge from Liability and Warranty Claims

#### 28.4.1 Experience from Product Crises

In the future, safe automated vehicles will further depend on integrated quality management systems [15, 16] and safe interactions [17]. In the past, advanced and successful vehicles were frequently affected by product crises.

#### 28.4.1.1 Defective Supplier Parts and -Systems

The following examples document how supplier parts and -systems triggered extensive product crises.

The Ford Explorer was the worldwide best-selling sports utility vehicle. In the USA in May 2000, the NHTSA contacted both the Ford and Firestone companies due to a conspicuously high rate of tires failing with tread separation. Ford Explorers, Mercury Mountaineers, and Mazda Navajos were affected. All were factory-fitted with Firestone tires. At high speeds, tire failures led to vehicles skidding out of control and rollover crashes with fatal consequences. Firestone tires on Ford Explorers were linked to over 200 fatalities in the USA and more than 60 in Venezuela. Ford and Firestone paid 7.85 million dollars in court settlements. Overall compensation and penalties in total amounted to 369 million dollars. In addition to recalling several million tires at great expense, communication errors were made during the crisis: the managers responsible publicly blamed each other. This shattered friendly business relations between the two companies that dated back over 100 years. Harvey Firestone had sold Henry Ford tires for the production of his first car as long ago as 1895. As the crisis progressed it led to serious damage to the companies' images, with sales collapsing for both parties [18].

General Motors (GM) announced a further example of defective supplier parts in February 2014. As a consequence of the financial crisis, the car company had been on the brink of bankruptcy in 2009. It returned to profit for the first time, and won awards for its new models, after a government bailout. But the ignition switches on some models had seemingly been too weakly constructed since 2001, which meant the ignition key sometimes jumped back to the "Off" position while driving. When this happened, not only did the motor switch off, but the brake booster, power steering, and airbags also became deactivated. GM engineers were accused of having ignored the safety defect in spite of early warnings for more than ten years. The company has therefore already been fined 35 million dollars for a delayed recall and now faces billions of dollars of damages claims from accident victims and vehicle owners after mass product recalls [19].

Another huge airbag recall campaign by NHTSA involved 11 different vehicle manufacturers and more than 30 million vehicles only in the United States. Airbag Inflators supplied by Takata ignited with explosive force. The inflator housing in some cases under persistent high humidity as well as high temperature conditions could rupture with metal shards spraying throughout the passenger cabin and injured or killed car occupants. Several fatalities and more than 100 injuries have been linked to this case which imposed a record civil penalty of 200 million dollar. The airbags were installed worldwide in vehicles from model year 2002 through 2015. Despite these injury risks the Department of Transportation estimated that between 1987 and 2012 frontal airbags have saved 37,000 lives [20].

#### 28.4.1.2 Alleged Sudden Unintended Accelerating or Decelerating Vehicles

Vehicles that automatically intervene in longitudinal and lateral guidance hold considerable risks and provide a target for those who assert that vehicles steer, accelerate and decelerate in unintended, unexpected or uncontrolled ways. The accusation of unintended acceleration due to alleged technical defects has already found some car manufacturers in the media's crossfire. Mainly in the USA, vehicles with automatic transmission are said to have accelerated in an unintended manner by themselves, causing fatal accidents. Affected drivers have initiated waves of lawsuits lasting for decades.

One example of this were the accusations against Toyota, a globally successful company known for quality. Toyota came off very well in customer-satisfaction studies by the American market research firm J. D. Power and Associates in 2002, 2004, and 2005. In 2009, however, it faced accusations of alleged, unintended and sudden accelerating vehicles. These were initially triggered by single incidents of sliding floor mats, which had supposedly been responsible for gas pedals getting jammed. It was then argued that vehicles would have accelerated unintentionally while driving due to the mechanically jammed gas pedals. As Toyota had not responded to the allegations quickly enough in the eyes of the NHTSA, the company was accused of covering up safety problems linked with more than 50 deaths. As well as compensation payments, Toyota had to pay the authority penalties of 66.15 million dollars. This was followed by extensive product recalls, claims for damages and a record 1.2 billion dollar criminal penalty [21].

A further instance of a proven technical defect that led to unwanted accelerations can be seen in an NHTSA recall action in June 2014. The software problem occurred in some Chrysler Sport Utility Vehicles (SUV). When optional adaptive cruise control was activated and the driver temporarily pressed the accelerator pedal to increase (override) vehicle's set speed more than the cruise control system would on its own, the vehicle could continue to accelerate briefly after the accelerator pedal was released again. In this case and according to technical requirements the vehicle has to decelerate to the requested set speed. There were no accident victims to lament. The short-notice initiated recall was restricted to a mere 6042 vehicles [22].

Other great challenges already occurred because autonomous braking systems decelerated in some individual cases without a visible reason for the driver and put vehicles at risk of a rear-end collisions. However, automatic braking and collision warning systems have great potential in reducing road accidents and saving lives. After recognizing a relevant crash object they can automatically apply the brakes faster than humans, slowing the vehicle to reduce damage and injuries. Therefore these systems are recommended to be made standard equipment on all new cars and commercial trucks. Since November 2013 EU legislation has mandated Autonomous Emergency Braking Systems (AEBS) in different stages with respect to type-approval requirement levels for certain categories of motor vehicles to cover almost all new vehicles in the future [23].

According to NHTSA, the Japanese car manufacturer Honda Motor Company had to recall certain model year 2014–2015 Acura vehicles with Emergency Braking. The reason was that the Collision Mitigation Braking System (CMBS) may inappropriately interpret certain roadside infrastructure such as iron fences or metal guardrails as obstacles and unexpectedly apply the brakes [24]. Furthermore NHTSA investigated complaints alleging unexpected braking incidents of the autonomous braking system in Jeep Grand Cherokee vehicles with no visible objects on the road [25].

Another recall of Chrysler vehicles from 2015 July 24 was, in accordance with NHTSA the first, caused by a software hack. US researchers brought a moving Chrysler Jeep under their control from afar, which forced the company to recall and ensure cyber-security of their onboard software. The affected vehicles were equipped with Uconnect radio entertainment systems from Harman International Industries. Software vulnerabilities could allow third-party access to certain networked vehicle control systems via internet. Exploitation of the software vulnerability could result in unauthorized manipulation and remote control of certain safety related vehicle functions—such as engine, transmission, brakes and steering—resulting in the risk of a crash [26].

In addition to the increase of recall actions the costs for penalties have increased significantly. In 2014 alone, NHTSA issued more than 126 million dollars in civil penalties, exceeding the total amount collected by the agency during its forty-three year history.

Many new technological risks for automated functions in future may not be visible during development and testing. These issues arise in real-life traffic situations and developers have to make necessary changes to the technology ensuring real world traffic safety (see Sect. 28.4.7).

#### 28.4.2 Essential Questions from Previous Product Liability Cases

The author's own experience of previous product liability cases has shown that interdisciplinary structured development is a minimum requirement, especially for safe automated vehicles (see Sect. 28.4.6). In case of damage, the following questions are the key for avoiding civil and criminal claims:

– Before developing a new product, has it already been checked for potential faults under consideration of the risks, the likelihood of their occurrence, and the benefits whether the vehicle can be type-approved to be licensed for road traffic use in the intended technological specification?

Essentially, besides general type approval requirements, no globally agreed upon and harmonized methods for fully automated vehicles exist today. These can be generated using international legally binding development guidelines with checklists—similar to the RESPONSE 3—ADAS Code of Practice for the Design and Evaluation of Advanced Driver Assistance Systems ("ADAS with active support for lateral and/or longitudinal control") [5] linked to ISO 26262 [27] (Section 3, Concept phase, Page 24, Controllability):

– What measures beyond purely legal framework were taken to minimize risk, damage, and hazards?

Future guidelines will either be orientated towards today's requirements or to a large extend adopt them. The methods for evaluating risk during development (see Sect. 28.4.4) ensure that no unacceptable personal dangers are to be expected when using the vehicle. Therefore the general legally valid requirements, guidelines, standards and procedures during the development process must at the very least, take into consideration as a minimum requirement:

– Were generally accepted rules, standards, and technical regulations fulfilled?

Only complying with current guidelines is usually insufficient. Furthermore it raises the following questions:


Whether an automated vehicle has achieved the required level of safety or not can be seen at the end of the development process:

– Was a reasonable level of safety achieved with appropriate and sufficient measures in line with state of the art and science at the time it was placed on the market?

Even after a successful market introduction, monitoring of operation is absolutely necessary. This is still the case when all legal requirements, guidelines, and quality processes for potential malfunctions and safe use of the developed automated vehicle functions have been complied with. The duty to monitor is the result of the legal duty to maintain safety as found in Section 823 Paragraph 1 of the German Civil Code (BGB) [13], where breach of duty triggers liability for any defect that should have been recognized as such. This raises the concluding question for product liability cases:

– Was or is the automated vehicle being monitored during customer use?

#### 28.4.3 Potential Hazard Situations at the Beginning of Development

The day-to-day experience of our technologically advanced society shows: risks and risky behavior are an unavoidable part of life. Uncertainty and imponderables are no longer seen as fateful acceptable events but rather as more or less calculable uncertainties [28]. The result of this are higher demands referring to risk management for the producers of new technologies.

A structured analysis of the hazards in consideration of all possible circumstances can help to give an initial overview of potential dangers. Therefore, in the early development stages it makes sense to provide a complete specification of the automated vehicle, to ensure a logical hazard analysis and subsequent risk classification (see Sect. 28.4.4).

On this basis, it is possible for an interdisciplinary expert team (see Fig. 28.6) to draw up a list of well-known potentially dangerous situations at the start of a project. This usually leads to a large number of relevant situations. Due to practical considerations, scenarios for expert assessment and testing should later be restricted to the most relevant (e.g. worldwide relevant test scenarios based on comprehensively linked up geographically defined accident-, traffic-flow- and weather data collections, see Chap. 17).

According to the system definition, it is recommended to initially gather situations in a list or table. This should take the following into consideration:


Jointly drawing up a maximum number of dangerous situations relevant to the system makes it likely that no potential major hazard is omitted or forgotten. Summarizing the hazards with direct impact on safety is recommended as a next step. After cutting the situations down to those that are actually safety-relevant, will technical solutions then be developed.

#### 28.4.4 Methods for Assessing Risks During Development

In discussing phasing out nuclear energy, a German Federal Government publication states that German society—as a "community with a common destiny" and as part of the "global community of risk"—wishes for progress and prosperity, but only accompanied by controllable risks [29]. This is surely only partially transferable to road traffic, where risks of automated vehicles are limited—in contrast to nuclear energy - to a manageable group of people. However, the specific requirements for the methods used in analyzing and assessing risks are similar. Five common methods are outlined below.

#### 28.4.4.1 Hazard Analysis and Risk Assessment

The hazard-analysis and risk-assessment procedure (H&R) is described and annotated in ISO 26262 Part 3 for functional safety of complex electrical/electronic vehicle systems as well as in the related ADAS Code of Practice for the development of active longitudinal and lateral functions (referenced in ISO 26262-3, Concept phase) [5, 6]. Parts of the methods given as examples in the following section (HAZOP, FMEA, FTA, HIL) also point to the H&R. Aim of H&R is to identify the potential hazards of a considered unit, to classify them, and set targets. This will enable dangers to be avoided, thus achieving a generally acceptable level of risk. In addition, an "item" is judged on its impact on safety and categorized to an Automotive Safety Integrity Level (ASIL). An "item" is defined in ISO 26262 as a complex electrical/electronic system or a function that may contain mechanical components of various technologies. The ASIL is ascertained through a systematic analysis of possible hazardous situations and operating conditions. It also involves an assessment of accident severity levels via Abbreviated Injury Scale (AIS) [30] in connection with the probability of occurrence. A reduction to an assumed hardware mean safety failure rate, e.g. ASIL D: < 10−<sup>8</sup> h−<sup>1</sup> , for a social and individual accepted risk (see Fig. 28.3) is achieved with external measures [27].

Basically, risk R can be expressed for an analytical approach as function F of the frequency f with which a hazardous event occurs, and the potential severity of harm S of the resulting damage:

$$R = F(f, S) \tag{28.1}$$

Fig. 28.3 Measures to increase safety for social and individual accepted risks. Image rights: Author

The frequency f with which a hazardous event occurs is in turn influenced by various parameters. One essential factor to consider is how often or how long a person is in a situation where a hazard can occur (E = exposure). Another influence on whether a hazardous event occurs, is if individuals and road users involved in the accident can react with timely response, preventing potentially damaging effects (C = controllability). Controllability via the driver, however, is not present in case of driverless and fully automated vehicles participating in an accident. The product E × C is a measure of the probability that a defect has the potential in a certain situation to have a corresponding impact on the damage described.

A further factor (λ = failure rate) can be traced back to undetected random hardware failures of system components and dangerous systematic errors remaining in the system. It gives the frequency of occurrence with regard to E with which the automated vehicle can trigger a hazardous event itself. The product f thus describes the number of events to be expected during period E, e.g. kilometers driven or the number of times a vehicle is started.

$$f = E \times \lambda \tag{28.2}$$

Furthermore, ISO 26262 stipulates that the Failure in Time (FIT) of technical and electronic components must also be considered. The unit FIT gives the number of components that fail within 10<sup>9</sup> h.

$$1\,\text{FIT} = \frac{1\,\text{failure}}{10^9\,\text{hours}\,\text{of}\,\text{device operation}}\tag{28.3}$$

Probability of occurrence f and—where possible—controllability C give the Automotive Safety Integrity Levels: either ASIL rating into B, C (a recommended probability of occurrence lower than 10−<sup>7</sup> h−<sup>1</sup> , corresponding to a rate of 100 FIT) or D (required probability of occurrence smaller than 10−<sup>8</sup> h−<sup>1</sup> corresponding to a rate of 10 FIT). The highest requirements are thus for ASIL D. Besides normal vehicle operation, ISO 26262 also considers service requirements, up to decommissioning of the vehicle. In this regard, developers should take the consequences of aging into account when selecting components. Control units or sensors must be sufficiently protected by robust design in case they were fitted with age-sensitive electrolytic capacitors for energy reserves. A failure must not suspend any important functions [27].

#### 28.4.4.2 Hazard and Operability Study—HAZOP

A Hazard and Operability Study (HAZOP) is an early risk assessment, developed in the process industry. A HAZOP looks for every imaginable deviation from a process in normal operation and then analyzes the possible causes and consequences. Typically, a HAZOP search is carried out systematically by a specialist team from the involved development units. This is to reduce the likelihood of overlooking any important factors [5].

#### 28.4.4.3 Failure Mode and Effects Analysis—FMEA

Failure Mode and Effects Analysis (FMEA) and the integrated Failure Mode, Effects and Criticality Analysis (FMECA) are methods of analyzing reliability that identify failures with significant consequences for system performance in the application in question. FMEA is based on a defined system, module or component for which fundamental failure criteria (primary failure modes) are available. It is a technique for validating safety and estimating possible failure states in the specified design-review stage. It can be used from the first stage of an automation system design up to the completed vehicle. FMEA can be used in the design of all system levels [31, 32].

#### 28.4.4.4 Fault Tree Analysis (FTA)

Fault Tree Analysis (FTA) involves identifying and analyzing conditions and factors that promote the occurrence of a defined state of failure that noticeably impacts system performance, economic efficiency, safety, or other required properties. Fault trees are especially suitable for analyzing complex systems encompassing several functionally interdependent or independent subsystems with varying performance targets. This particularly applies to system designs needing cooperation between several specialized technical design groups. Examples of systems where Fault Tree Analysis is extensively used include nuclear power stations, aircraft, communication systems, chemical and other industrial processes.

The fault tree itself is an organized graphic representation of the conditions or other factors causing or contributing to a defined undesired incident, also known as the top event [5]. One possible approach is to demonstrate the probability of road accidents by the use of a fault tree which presumes both: inappropriate behavior and the existence of a conflicting object [33].

Figure 28.4 shows an example for a Fault Tree Analysis. A single failure does not necessarily have dangerous impact. This Fault Tree Analysis demonstrates that traffic accidents result by the coincidence of several causes. Series of unfortunate circumstances and inappropriate behavior of traffic participants can worsen the risk situation to be uncontrollable. Human traffic participants are the crucial link in the chain to prevent a car crash (see Chap. 17). Especially automated vehicles will require appropriate safety measures. Figure 28.4 demonstrates an excerpt of safety measures for a safe active steering as used in automated vehicles.

#### 28.4.4.5 Hardware-in-the-Loop (HIL) Tests

Increasing vehicle interconnection places particular demands on validating the safety of the entire Electronic Control Unit (ECU) network, e.g. onboard wiring systems safety, bus communication, vehicle-state management, diagnosis, and flash application's behavior. Hardware-in-the-Loop (HIL) tests can be used as soon as a hardware prototype of the system or part of it,—e.g. an electronic control unit in a vehicle—is available. As the Device under Test (DUT), the prototype is placed in a "loop," a software-simulated virtual

Fig. 28.4 Fault Tree Analysis (FTA): functional safety measures prevent traffic accidents caused by technical active steering failures with the risk of personal injury. Image rights: Author

environment. This is designed to resemble the real environment as closely as possible. The DUT is operated under real-time conditions [34].

#### 28.4.4.6 Software-in-the-Loop (SIL) Tests

The method Software-in-the-Loop (SIL) in contrast to HIL, does not use special hardware. The created model of the software is only converted to the code understandable for the target hardware. This code is performed on the development computer with the simulated model, instead of running as Hardware-in-the-Loop on the target hardware. SIL tests must be applied before the HIL.

#### 28.4.4.7 Virtual Assessment

Virtual assessment verifies prospective, quantitative traffic safety benefits and risks (see Sect. 28.1.2). They can be quantified using virtual simulation-based experimental techniques. For this purpose traffic scenarios can be modeled taking into account key safety-relevant processes and stochastic simulation using large representative virtual samples. Virtual representations of traffic scenarios are based on detailed, stochastic models of drivers, vehicles, traffic flow, and road environment, along with their interactions. The models include information from global accident data (see Chap. 17), Field Operation Tests (FOT), Natural Driving Studies (NDS), laboratory tests, driving simulator tests, and other sources. Wide ranging, extensive simulations help identifying and evaluating safety relevant situations of automated vehicles.

#### 28.4.4.8 Driving Simulator Tests

Driving simulator tests use models of vehicle dynamics and virtual driving scenarios. They allow artificial driving situations and repeatable tests with various subjects. Potentially hazardous traffic scenarios can also be tested because in contrast to real driving the virtual scenario is harmless. Different types of simulators, such as mock-up, fixed based simulator, or moving base simulator exist. Subjective and objective methods can be used to measure the performance of test subjects in the driving task. Depending on the kind of potentially hazardous situations, controllability can be tested by some of these methods. Typical situations for driving simulator tests are high risk situations, driver take-over reactions or interaction between automated driving system environment monitoring and manual human driver mode.

#### 28.4.4.9 Driving Tests and Car Clinics

Driving tests with different drivers provide useful feedback based on empirical data. Dynamic car clinics allow testing of driver behaviour and performance while driving the automated vehicle in defined situations within a realistic environment. In a first step the objective is to identify relevant scenarios and environments (see Chap. 17). This makes it possible to specify and implement virtual tests followed by confirmation via driving tests and car clinics on proving grounds. Finally, before sign-off and start of production (SOP), field tests confirm identified scenarios and environments if necessary.

#### 28.4.5 Approval Criteria from Expert Knowledge

During the approval process, test procedures must be provided. Approval criteria in terms of "passed" and "not passed" are thus recommended for the final safety verification of automated vehicles. Regardless of which methods were chosen for final sign-off confirmation, the experts should all agree on which test criteria suffice for the vehicle to cope successfully with specified situations during a system failure or malfunction. Generally accepted values for achieving the desired vehicle reactions should be used for such criteria. An evaluation can result by using established methods.

Taking the list of potentially hazardous situations as a basis (see Sect. 28.4.3), test criteria for safe vehicle behavior, and if possible also globally relevant test scenarios, are developed by internal and external experts. Of particular importance is a team of system engineers and accident researchers. The former group offers knowledge of the precise system functions, time factors, and experience of potential failures, while accident researchers bring with them practical knowledge of high-risk traffic situations (see Chap. 17). Every known risky situation that a vehicle can get into must be considered. At least one corrective action with regard to safety requirements should be specified by the developers for the risks identified. In terms of final sign-off confirmation, a test scenario has thus been "passed" when the automated vehicle reacts as expected or otherwise deals with the situation in a satisfactory accepted manner.

#### 28.4.6 Steps to Increase Product Safety of Automated Vehicles in the General Development Process

To guarantee the product safety of automated vehicles, a thorough development concept is needed that is at least in line with state of the art and science. To this end, a general development process is proposed below, as is principally in use amongst car manufacturers for the development of series production vehicles, partially with small adjustments. For highly automated vehicles the development refers to measures regarding the safety process, activities to ensure controllability and appropriate human machine interaction (see Fig. 28.5).

The generic development process for fully automated vehicle functions even more focuses on interdisciplinary networking expert knowledge, the safety process and is represented graphically as a V-Model (see Fig. 28.6). As well as the development stages for the

Fig. 28.5 Development process for automated vehicles from the idea until market introduction involving the safety process, activities regarding controllability and human machine interaction. Image rights: Author

Fig. 28.6 Development process for highly automated vehicles as a V-Model from the idea until market introduction involving recommended interdisciplinary networking experts and the elements of functional safety. Image rights: Author

high automation it depicts logical sequences of product development phases and selected milestones but not necessarily how long each stage lasts or the time between phases [5, 35].

The process thus forms a simplified representation in the form of a V-Model. This allows for iteration loops within the individual development phases involving all parties. Within this V-shaped process structure (see Fig. 28.6) elements of the safety process are taken into consideration. In addition, early and regular involvement of interdisciplinary expert groups is recommended. From the definition phase until validation, sign-off, and start of production—interdisciplinary networking experts from research, (pre-)development, functional safety, product analysis, legal services, traffic safety, technology ethics, ergonomics, production, and sales should participate in the development process.

In the development steps for advanced automated vehicles' product safety functional safety, stands out as a key requirement. It relates to the whole interaction between the vehicle and its environment. Safe driver interaction and take-over procedures [1, 36] should thus be considered when there is an interface necessary to the use case and functionality. Concerning product safety, fully automated vehicles essentially include the following five usage situations: Of prime importance is the functional safety of fully automated vehicles within, at and also beyond the performance limits. Furthermore, functional safety should be examined during and after system failures. Careful development with regard to a safe usage of driverless vehicles must ensure that they are able to recognize the criticality of a situation, decide on suitable measures for averting danger (e.g. degradation, driving maneuver) that lead back to a safe state, and then carry out these measures.

Figure 28.7 gives an overview of a possible workflow regarding final sign-off, up to decommissioning of a vehicle. In the final stages of developing an automated vehicle, the development team decides whether a final safety test for validation is required. This serves to confirm that a sufficient level of safety for production has been reached. For this, the development team verifies that a vehicle reacts as previously predicted or in other ways appropriate to the situation. The data used here may come from risk-assessment methods used during development, such as hazard and risk analysis. There are three equally valid paths for signing off vehicles. A direct sign-off will be carried out through an experience-based recommendation of the development team. In addition, final evidence of safety can be passed after corresponding reconfirmation via an interdisciplinary forum of internal and external experts or an objective proof. Evidence of functional safety is possible via means of a confirmation test with relevant traffic scenarios based on accident-,

Fig. 28.7 Recommended sign-off process for automated vehicles. Image rights: Author

traffic-flow-, weather- and vehicle operation data (see Chap. 17), or other verifiable samples (see Fig. 28.7).

The development team chooses an appropriate path for each individual scenario. A mixed approach is also possible. When the safety team has conclusively confirmed the safety of the system design functionality, the final sign-off can be given (see [5]).

#### 28.4.7 Product Monitoring After Market Launch

Subsequent to the careful development, a manufacturer is obliged to monitor automated vehicles after placing them on the market, in order to recognize previously unknown hazards and take necessary additional safety measures. If necessary, car manufacturers are urged to analyze potential dangers (that can also arise in unintended use or misuse) and react with appropriate measures, such as product recalls, redesign, or user information (see Fig. 28.7).

A judgment of the German Federal Court of Justice (BGH) is often quoted amongst product safety experts as a particular example of the product-monitoring duty for combination risks with third-party accessories. Model-specific motorbike handlebar cladding, from accessories that had first been passed by officially recognized experts from a testing organization in June 1977, were supposed to have been responsible for three spectacular accidents including one fatality. On the day before the fatal accident, the motorcycle manufacturer in question wrote personal letters to warn all the riders of the affected model it had on record. The victim, however, never received the letter. Although the motorbike manufacturer expressly warned of using the cladding, the company was ordered to pay damages. The BGH's judgment in the matter established a pioneering principle:

In future, companies will not only be required to monitor the reliability of their products in practice but, above all, to refer their customers to any hazards in daily operation – including those that arise from the application or installation of accessories of other manufacturers. [37]

#### 28.4.8 Steps for Internationally Agreed Best Practices

Due to their networking and complexity, it will be difficult to get a clear overview about all the risks of automated vehicles in series operation. Therefore the objective is establishing worldwide agreed best practices for legislation, liability, standards, risk assessment, ethics and tests.

The ADAS Code of Practice as a result of the Response 3 project was a fundamental step towards European agreed and legally binding guidelines for Advanced Driver Assistance Systems (ADAS). ADAS were characterized by all of the following properties: They support the driver in the primary driving task, provide active support for lateral and/or longitudinal control with or without warning, detect and evaluate the vehicle environment, use complex signal processing and interact direct between the driver and the system [5]. Primarily ADAS operate rule based at the maneuvering level (between about one and ten

Fig. 28.8 Worldwide agreed legislation, liability, standards, ethics and tests for high-/fully automated vehicles with integration of knowledge based navigation, skill based stabilization and rule based maneuvering levels (globe = outer circle). Further development of the Response 3 ADAS Code of Practice for active longitudinal and lateral support or intervention in dangerous situations (ADAS = blue circle). Image rights: Author

seconds) and furthermore within parts of the skill based stabilization level (time spans less than one second). High and fully automated vehicles will intervene in a knowledge-, skilland rule based manner for more than one second at all driving levels (see Fig. 28.8).

In general increasing sensitivity for defects is visible through a significant growth in product recalls worldwide. If unknown failures appear after vehicles have gone into production, appropriate measures have to be taken where necessary according to a risk assessment.

For analyzing and evaluating risks stemming from product defects after market launch in view of the necessity and urgency of product recalls—the EU and the German Federal Motor Transport Authority (Kraftfahrtbundesamt) uses tables from the rapid alert system RAPEX (Rapid Exchange of Information System) [38]. To classify risks, first accident


Fig. 28.9 Risk assessment and derivation of essential measures in accordance with RAPEX, ALARP and ISO 26262. Sources RAPEX, ADAS Code of Practice, ISO 26262, ALARP. Image rights: Author

severity (extend of damage S according to AIS, for example) and probability of harm are assessed—similarly to the ALARP principle (As Low As Reasonably Possible) [39], the ISO 26262 standard [27], and ADAS Code of Practice for active longitudinal and lateral support. The degree of risk is derived from this. Final assessment concerning the urgency of required measures looks at the risk of injury for those at particular risk of being injured (as influenced by age, state of health, etc.) and hazard for a mentally healthy adult, and the use of protective measures as appropriate warnings (see Fig. 28.9).

#### 28.5 Conclusion and Outlook

On the one hand, society's expectations are understandable as they increasingly require the highest, state-of-the-art levels of safety for new technologies. On the other hand, unrealistic demands for technical perfection and the striving for 100 % fault-free operation may hinder automated vehicles being launched on the market, and thus the chance of revolutionary potential benefits.

Many groundbreaking technologies would not be available to us today had caution and reservation gained the upper hand during their introduction. One example of courageous innovation is provided by the German engineer and car pioneer Carl Friedrich Benz. As early as 1885, he completed the first test drives with his prototype, the properly functioning Benz Patent-Motorwagen. In his book Lebensfahrt eines Erfinders, Benz remembers about his first trip:

Until that point, it had been at great preference to undertake my test drives far away from the city – on factory grounds or outside on the old, lonely ramparts (ring road), which at that time still went around the city of Mannheim and was hardly walked on –, I no longer shied away from people and their criticism from spring 1886 on. [40]

As the motorcar lay motionless with a breakdown, however, Benz attracted pity, scorn, and derision:

How can one sit in such an unreliable, squalid, ear-splitting mechanical box. (…) If I had such a stinking box, I would stay home. [40]

Despite all the denial and rejection with which his unceasing work through countless nights for his mission of life was received, Benz, with the support of his wife, held firm to his belief in the future of his Patent-Wagen. Thus he became a trailblazer for one of the most significant innovations of modern mobility.

The preparation of vehicles with advanced degrees of automation likewise requires a determined approach in the mold of Benz. The market launch of highly and fully automated vehicles has also had barriers placed in its path. The first vendors on the market the pioneers—therefore take on increased risks at the outset, so that the potential total benefit of these new technologies to society can only be achieved together with all interdisciplinary networking parties. Homann describes these decision conflicts during market launch by the decision-theory concept of the so-called "Prisoner's Dilemma". To overcome this dilemma as it pertains to highly and fully automated vehicles, the incalculable risks for manufacturers must be made assessable and determinable through new institutional arrangements [41]. Unconditional information and transparent policy encourage and accelerate public discourse across all disciplines.

Due to previous licensing requirements for series production vehicles, drivers almost always have to keep their hands on the steering wheel and permanently stay in control of the vehicle. Automated research vehicles and vehicle development from IT companies, car manufacturers, and component suppliers will also be required to have a human driver as a responsible backup level in complex traffic situations for the nearby future.

Driverless vehicles, on the other hand, signify the beginning of an utterly new dimension. New approaches and activities are essential [42]. It is required to orientate ourselves to the future potential of automated driving functions, to learn from previous patterns and within the bounds of what is technically and economically reasonable and adjust old methods to validly state of the art or state of science [43].

Besides generally clarifying who is responsible for accident and product risks, new accompanying measures depending on different automation and development levels (see Fig. 28.6) will also be of use for a successful market launch and safe operation. This includes identifying relevant scenarios, environments, system configurations and driver characteristics. Relevant maneuvers of driving robots have to be defined and assessed for example using accident data (see Chap. 17) and virtual methods. Further investigation of real driving situations in comparison with system specifications and additional tests on proving grounds, car clinics, field tests, human driver training or special vehicle studies are recommended. For the required exchange of information, storage of vehicle data (e.g. Event Data Recorder) and possible criminal attacks protective technical measures are necessary (see Chaps. 25, 30). Beside challenging and agreed data protection guidelines [44], experts in technology ethics will ensure compliance with ethical values (see Figs. 28.3, 28.6, 28.7). Within this, safety requirements have to be answered in terms of "How safe is safe enough?" Expert experience can also decisively contribute in increasing safety and meeting customer expectations for acceptable risks. In light of increasing consumer demands, such experience —particularly of previous product liability actions—makes a valuable contribution to improving product safety during development and approval stages.

Before highly complex automated vehicle technologies—which will additionally be applied in a multi-layered overall system—can go into mass commercialization, interdisciplinary concerted development and sign-off processes are required. A reliable evaluation for sustainable solutions ready for production demands new harmonized methods for comparable safety verification, e.g. by simulating relevant scenarios [45, 46] including the planning of field tests [47] from worldwide available and combined accident-, traffic-flow-, weather- and vehicle operation data (see Chap. 17). This also applies to fulfilling legal and licensing regulations, identifying new options for risk distribution (see [42]), and creating new compensation schemes. To verify the duty of care in existing quality management systems, it is recommended to further develop experience-based, internationally valid guidelines with checklists built on the previous ADAS Code of Practice [5, 48]. These standards will further embody and document state of the art and science within the bounds of technical suitability and economic feasibility. The former ADAS Code of Practice was developed to provide safe Advanced Driver Assistance Systems, with active support of the main driving task (lateral and/or longitudinal control, including automated emergency brake interventions—AEB), on the market and published 2009 by the European Automobile Manufacturers Association (ACEA). It corresponds with the ISO 26262 for requirements of electrical, electronic and software components. As a development guideline it contains recommendations for analysis and assessment of ADAS-Human-Machine-Interactions with occurrence during normal use and in case of failure [5, 6]. With increasing level of automation, upgrades of functional safety, controllability (ISO 26262, ADAS Code of Practice) and other standardized methods will be necessary such as virtual simulation [45, 46]. Today the standards do not cover functional disabilities for instance misinterpretation of objects, traffic situations and resulting false positive system interventions. An integral, scenario based approach is recommended because automated systems will be able to control scenarios. In the event of serious malfunctions that threaten severe damage, product experts from the development process should be involved in the study of the causes and be listened to. With regard to future court decisions, motor vehicle experts who are not directly involved in the development should acquire the expertise to be prepared for a specialist appraisal of new technologies.

In the development of automated driving, networked thinking covering all disciplines is required with a flexible, yet structured area for action. So far, the development has opened up an unknown world with many uncertainties that may cause reservation and resistance. For a successful launch of automated vehicles ready for production, insights collected in vivo from both the past as well as the present are essential prerequisites. Despite the technical, legal, and economic risks, production readiness will be of benefit to society in this way.

Open Access This chapter is distributed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, duplication, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, a link is provided to the Creative Commons license and any changes made are indicated.

The images or other third party material in this chapter are included in the work's Creative Commons license, unless indicated otherwise in the credit line; if such material is not included in the work's Creative Commons license and the respective action is not permitted by statutory regulation, users will need to obtain permission from the license holder to duplicate, adapt or reproduce the material.

#### References


# Part VI Acceptance

## Barbara Lenz and Eva Fraedrich

#### Foreword

Autonomous driving not only poses a challenge in terms of further technological development, but also for how the new technical possibilities are received. While media reports on autonomous driving have increased markedly in recent times, public debate on the resultant expectations—and fears—is still in its infancy. This chapter examines the questions and issues preoccupying people in connection with autonomous driving, and also the experience of introducing new technologies in the past—experience which must be borne in mind when bringing in autonomous driving. That this book closes with these questions is not by chance. Technologies are always embedded in a framework that determines how people use them, what significance they ascribe to them, and also what social functions they fulfill. This is also the underlying motivation for beginning this book with the topic of Human and Machine and ending it with that of Acceptance.

Societal and Individual Acceptance of Autonomous Driving is the subject of Eva Fraedrich and Barbara Lenz's article. The authors outline and discuss the multifaceted nature of acceptance, and attempt to furnish this frequently inflationary and sometimes imprecisely used term with better-founded understanding. What does it actually mean when people "accept" a new technology? Based on the analysis of reader comments in German and American media, they demonstrate what topics are currently driving discussion. This leads them to some striking findings.

Is the introduction of autonomous driving really comparable with introducing any major technology? And how do we then deal with the risks that stem, or appear to stem, from it? In his paper Societal Risk Constellations for Autonomous Driving. Analysis, Historical Context and Assessment, Armin Grunwald examines what risks combine in autonomous driving and what can be learned from previous experience in risk debates on technological progress when developing and using autonomous driving. Grunwald develops a series of recommendations relevant to autonomous driving's implementation, and at the same time stresses the necessity of an open and transparent exchange with the new technology's potential users and road users as a whole.

Autonomous driving should not be viewed as a wholly new technology appearing out of the blue, as it were. Rather, it always builds on what is already there, for example the current everyday practice of using (individual) vehicles. In light of this, Eva Fraedrich and Barbara Lenz tackle the topic of Taking a Drive, Hitching a Ride: Autonomous Driving and Car Usage. Based on an empirical examination of the needs, perceptions, and experiences of car users, they map out the complexity of attitudes towards automating driving. In particular, they place the reservations held on autonomous driving in context. They also demonstrate that the way autonomous driving is currently assessed depends fundamentally on two things: first, the social group addressed; second, the specific use case or scenario in question.

The acceptance or non-acceptance of autonomous driving will sooner or later manifest itself in the (private or commercial) purchase or non-purchase of an autonomous vehicle. How does this impact the significance of automobile brands, given the fact that the "new" car must be able to do more than simply drive? In his article What Drives Consumers' Purchase Intentions of Automated Driving Technologies? An Examination of Use Cases and Branding Strategies, David Woisetschläger examines the question of what—from the perspective of today's car users—the relevant acceptance criteria might be in future: the experience of the auto manufacturers or that of software producers. He shows that there currently is still little readiness to purchase autonomous vehicles, and that this is largely irrespective of which sector the vehicle has been developed in—it is more important that the brand which markets the vehicle is a highly trusted one. With his article on individual consumer acceptance, Woisetschläger concludes this last section of the book, which spans all aspects of acceptance from the general to the individual.

# 29 Societal and Individual Acceptance of Autonomous Driving

Eva Fraedrich and Barbara Lenz

A good science fiction story should be able to predict not the automobile but the traffic jam Frederik Pohl ([1]: 287).

#### 29.1 Introduction

What attitudes and expectations do (potential) future users, and the public at large, bring to the new technology of autonomous driving? Alongside the technical and legal areas of research, this question is moving into ever-greater focus. The emerging debates assume that a switch from conventional to autonomous driving might bring about clear changes for all road users. From these perspectives—individual users and society—the question of acceptance arises. To what extent are individuals ready to use fully-automated vehicles, and to what extent are we as a society prepared to accept a transport system with fully automated vehicles on the road?

Public interest in autonomous driving has grown appreciably of late—in surveys, a majority now speak of already having "heard of" autonomous driving (see [2]). In mass media news coverage, driving's automation is often portrayed as the solution to many of our automobile-related transport problems. It is further expected that it will bring about a revolution in car usage and ownership. The term "autonomous driving," however, is even

B. Lenz e-mail: barbara.lenz@dlr.de

B. Lenz German Aerospace Center (DLR), Institute of Transport Research, 12489 Berlin, Germany

© The Author(s) 2016 M. Maurer et al. (eds.), Autonomous Driving, DOI 10.1007/978-3-662-48847-8\_29

E. Fraedrich (&) B. Lenz

Geography Department, Humboldt-Universität zu Berlin, 10099 Berlin, Germany e-mail: eva.fraedrich@geo.hu-berlin.de

less clearly defined in the public discourse: sometimes the talk is of automated driving and self-driving or driverless cars, sometimes partly- or fully-automated driving. Frequently, it is not clear which of the potential transport options is being discussed, what concrete options, potential, and risks are involved, or what challenges still need to be overcome on the path to autonomous driving.

The perspectives of road users and potential future users are paid little attention in this, even if it is constantly stressed that a user- and usage-oriented view can make an essential contribution to acceptance, and thus also to autonomous vehicles' success (see [3, 4]). Acceptance must be brought into the discourse surrounding autonomous driving at an early stage, even if the realization of road traffic with fully automated vehicles is not currently conceivable at all. Introducing the technology will potentially bring changes across the entire sphere of mobility, impacting many levels of society. At the same time, it could trigger a fundamental transformation in the way we get around. In order to know in good time what the essential issues are, and to control the transformation where necessary, it is important to identify the significant influencing factors and understand their dynamics. One of these factors is the acceptance of technology.

This paper begins with a determination of what is to be understood by (technological) acceptance, and then discusses which main research areas are relevant in connection with autonomous driving. The empirical section begins with the results of current studies on autonomous driving's acceptance. It then introduces the outcome of our own investigation looking into the views of today's road users. This provides findings for future, more closely use-oriented empirical analysis on the acceptance of autonomous driving.

#### 29.2 Acceptance

When acceptance is talked of, what is meant in general terms is "agreeing, accepting, approving, acknowledging; to agree with someone or something" ([5]: 136, translation by the authors). This formulation encompasses a sense of "willingness for something," which bestows an active component on acceptance. This differentiates it from simple acquiescence and the absence of resistance, but also from tolerance. Acceptance takes place in the context of social and technological construction processes—that is, it is dependent on people, their attitudes, expectations, actions, environment, value- and norm-framing etc., but also on changes over time (see [6]). The processual and changeable character of acceptance makes it overall an "unstable construct" ([7]: 25, translation by the authors) one that depends on various specificities, types, and the subject, object and context of acceptance. Moreover, it can vary greatly in the course of time [8].

For the acceptance of a specific technology such as autonomous driving, this means that various usage options and fears of risk are woven together alongside the technical options, on both individual and societal levels. In this way, a technology can alter its "original purpose" over time before finally stabilizing, or even becoming institutionalized. The field of transport is especially ripe with such examples, starting with the railway originally being invented exclusively for goods transportation, right up to using cable cars as public transportation in densely populated inner cities. This progression from the genesis of a technology to its adoption poses great challenges for research into acceptance. At each stage of technology development, implementation and adoption, different stakeholders and stakeholder groups are variously relevant to acceptance. When viewing acceptance in the context of such a sociotechnical process of transformation (see [9]), the several stages of the process must be distinguished between, as their relevance to acceptance always differs.

#### 29.2.1 (Technology) Acceptance: Concepts, Research and Characteristics

The subject of technology acceptance is a decidedly inhomogeneous field; various scientific disciplines (e.g. psychology, sociology, economics, etc.) are related to and have mutual bonds with it. Overall, acceptance research is still a relatively young field. The topic first came to prominence in the 1970s with broad public opposition to nuclear energy. This was postulated—rather unjustly, as things have turned out—to indicate general hostility to technology among Germans (for more on this, see Chap. 30, on risk analysis and assessment) ([10, 11]: 45 ff).

The aims of acceptance research are, firstly, a better understanding of particular acceptance phenomena (social-science/empirical analysis). Secondly, it is to enable specific objects of acceptance, e.g. a specified technology, to be developed and designed in such a way that acceptance occurs (normative-ethical approaches). At research and policy levels in Germany, several institutions accompany the development of (new) technologies and debate surrounding them. They have emerged in parallel with the various research approaches to meet these requirements ([11]: 47 ff). All institutions share the basic assumption that technology cannot be viewed removed from its embedding in social, economic, and also usage-related contexts. In short, technology's embedment in its sociotechnical system must also be taken into consideration (see e.g. [11, 12]).

#### 29.2.1.1 Acceptance Subject, Object and Context

Acceptance always takes place within an interplay of subject, object and context (see [13]: 88 ff): "To be stated is not only what is accepted (or refused), but rather what, by whom, within which society, in what situation, at what time, and for what reason" ([13]: 90, translation by the authors). Figure 29.1 shows the relationship between the subject, object, and context of acceptance.

#### Acceptance subject

An acceptance subject has attitudes, or develops attitudes, in relation to the object of acceptance, and also links them, where appropriate, with corresponding actions (see [12, 13]). The term "subject" refers here not only to individuals, however, but also groups, institutions or society as a whole.

The acceptance subject of autonomous driving can currently be approximated, for example, by taking transport system users who will either passively or actively come up against autonomous driving in future. This covers all of those using the current road system, be it as car drivers, cyclists or pedestrians. Further relevant acceptance subjects include developers and engineers, politicians and businesspeople, or even public research institutes.

#### Acceptance object

Acceptance object does not necessarily imply a physical object as such, but rather refers to the adoption of something "on offer, available, or proposed" ([13]: 89, translation by the authors). This may be engineering or technology, but it could also be artifacts of any type, or people, attitudes, opinions, arguments, actions, or even the values and norms behind such things. In turn, such an object acquires its significance only from what individuals or society ascribe to it—there is therefore no such thing as autonomous driving per se. Rather, the question is what specific functions autonomous driving can fulfill, and what significance individual people and society at large place in the technology. Behind this is the assumption that engineering and technology have no significance in and of themselves; instead, this is only attained by the fulfilling of social functions, human actions, and their embedding into social structures (see [9]).

#### Acceptance context

The acceptance context refers to the environment in which an acceptance subject relates to an acceptance object—and thus can only be viewed in relation to both. For example, the context of autonomous driving is determined by the current individual and social significance of car usage: Why do people use cars? What attitudes, values, expectations, etc. inform (auto)mobile praxis? Does autonomous driving fit in here seamlessly—or will it change the meaning of (auto)mobility and its system of norms?

In the copious literature on acceptance and acceptance research, various dimensions and levels are identified where acceptance is visible and, above all, comprehensible. In the following, we shall take a closer look at the dimensions of attitudes, actions, and values.

#### 29.2.1.2 Dimensions of Acceptance

#### Attitudes dimension

Attitudes regarding acceptance that can be surveyed include mindsets, values, and judgments. These can be polled and interpreted on both individual and societal levels. Attitudes are significant for acceptance research, as it is assumed that they can be read as willingness and intent for concrete actions ([13]: 82 f). Nevertheless, questions on the genesis of technology, its specific usage, the associated challenges, and frameworks—all in their specific contexts—cannot be captured with such measuring of attitudes ([11]: 46).

A typical measuring instrument of the attitudes dimension of acceptance is the opinion poll—even though such surveys quickly lead "to a simplified picture of an opinionforming process based on the perceived properties of technology" ([14]: 35, translation by the authors). This is because they imply that technology sends out signals that spark off set reactions in the population or individuals. One-dimensional surveying of attitudes has been replaced in recent years, however, with greater insights into technology acceptance, and expanded into an analysis that incorporates attitudes' contexts in particular. In this way, the focus of acceptance research shifted from the "descriptive inventory of attitudes and actions" ([14]: 36, translation by the authors) to a more analytically aligned perspective. This takes greater account of the complexity in individuals' perceptions and evaluations, experts' subjectivity, and the significance of contextuality ([14]).

#### Actions dimension

The actions dimension of acceptance describes observable behavior, although acting in this sense may relate either to doing something or to refraining from it. Actions can manifest themselves in many ways, for instance in purchasing, using, and spreading (or the opposite, e.g. initiating protests), or in supporting other (decision-making and planning) activities.

The dimension of actions is often equated with that of acceptance, as found in Lucke, for example (see [13]: 82). On the other hand, other authors do not view action, or a concrete intention to act, as imperative for acceptance ([15]: 19, [16]: 11). Schweizer-Ries et al. ([16]: 11) have depicted this reciprocity between the dimensions of actions and attitudes in a two-dimensional model (Fig. 29.2).

#### Values dimension

In many approaches, the values dimension is not viewed as a separate level of acceptance, but combined with the attitudes dimension. Values and norms, according to this argument, are also the basis of attitudes and therefore can only be separated from them with difficulty. The dimension of values comes into its own, however, when acceptance is visible on the level of actions, for instance in the use of a specific product. These actions may only accord with subjective individual values slightly or not at all—a person can own and use a car while being strongly ecologically-minded. This, in turn, may show itself more

clearly in other areas of activity—for example, by mainly or only shopping in organic grocery stores. In the context of autonomous driving, ethical criteria and social standards, which (must) determine how it is viewed, are especially challenging—see Chaps. 4 and 5 in this volume. In general, an acceptance object is also always evaluated in relation to an existing system of norms and values (see [14]).

#### 29.2.1.3 Research on Acceptance

Acceptance takes place not only on various levels as described above, but is also the result of a complex individual and collective process of evaluation and negotiation, sometimes even of relatively unspecific "sensitivities" ([8]: 55, translation by the authors). This raises the question of how such a process can be made measurable and thus empirically accessible. For a relatively new technology such as autonomous driving, this means to examine in what way individual stakeholders (e.g. users), social groups, organizations, and institutions meet the challenges of technological and scientific progress as well as "to identify the potential for design to meet social challenges and to test technological options in view of their problem-solving capacity" ([12]: C, translation by the authors).

In summary, we may say that, for acceptance research, acceptance "is a complex, multilayered construct that is not directly measurable, and for which there are no "calibrated" measuring instruments" ([12]: 21, translation by the authors). Depending on the acceptance object in question, but also on the relevant dimensions, only indicators specific to each case may be operationalized and rendered measurable—which in turn excludes the use of others. This should also be reflected in the research process.

#### 29.3 Acceptance of Autonomous Driving: The Current State and Focus of Research

Autonomous driving can be placed alongside products of everyday technology. In contrast to working technologies and so-called external technologies, such as nuclear power or satellite technology, everyday technologies mainly involve products for individual consumers, and are controlled by the market. Nonetheless, they can have consequences for third parties ([14]: 31). Car usage and ownership are typical examples from this area. Acceptance of technology in this context primarily means purchase, but as a rule also includes use. Particularly at the beginning of autonomous driving's potential implementation, however, it may be assumed that not only the level of private or individual consumption plays a role, but also that the effects on various social spheres are publicly discussed and weighed up. This could include questions of whether we can permit vehicles in our transport system that will probably be involved in accidents just like conventional vehicles—but with the possible difference that the machine or driving robot causes the accident, not only endangering its own occupants but all road users. Recently there has also been the question of the common good (for more on this, see Chap. 30 on risk analysis and assessment Chap. 4 on the ethics of autonomous driving).

It is possible that autonomous driving may bring with it other social or economic risks and consequences that could be the subject of public debate. It will thus also be important, in empirical terms, to demarcate the border between these two spheres—the individual and the societal aspects of acceptance—as clearly as possible, and to establish "how technological attributions come about as internally or externally controlled" ([14]: 32, translation by the authors). In general, no hostility to technology is visible in Germany, and in the sphere of its individual use, the reverse is even true. To a great degree, many German households have, and constantly use, everyday technological products (see [10, 17]).

In summary, it is often said of autonomous driving that such vehicles will only be accepted if, on the one hand, they drive "better" than humans, and on the other, if the vehicle user can override the autonomous functions as a last line of control (see [4]: 2 ff). However, Grunwald reports elsewhere in this volume that risk perception is many times more complex than such statements would have us believe (see Chap. 30).

Analogies to other technologies from these areas, and thus their experience of acceptance, tend to be difficult to make. Although we already have many examples of automated transport systems today (for instance airplanes, ships, (metro) trains, and military vehicles), they all still have humans with authority to supervise or control them. We do not yet have a vehicle or mobility system without this human authority ([4]: 6). For this reason, autonomous driving could place unique demands on acceptance.

The question of which factors, characteristics, demands, expectations, value systems, of whom and to whom, and what, etc. is connected with autonomous driving's acceptance —all this has not yet been sufficiently empirically recorded. Some studies dealing with the topic from market and opinion research have found a general and also increasing openness to autonomous driving (see [2, 18, 19]). But these do not make clear what the respondents actually understand as "autonomous driving," in which context their perceptions and evaluations are embedded, and what challenges and obstacles, and also benefits, may be identified in relation to it.

On the user side, surveys directly testing judgments of autonomous driving are currently also subject to the problem that, to date, neither broad levels of knowledge, nor concrete experience may be assumed. Attitudes and assessments recorded as such are therefore possibly of only limited validity, for the object of the survey is not yet clearly defined, as people have hardly encountered it. In their study on acceptance and electric mobility, Peters and Dütschke suggest the following: "Surveys of potential users, for instance questionnaires as to whether or under which circumstances they would be prepared to buy an electric car, have the problem that judgments on the new, still littleknown system of electric mobility are difficult for consumers to make. As a rule, they rest on a comparison to conventional vehicles on the basis of previous mobility patterns" ([20]: 6, translation by the authors). A comparable assessment can be carried over to autonomous driving.

The few studies that have considered aspects of autonomous driving's acceptance give, in part, quite a heterogenous picture. In their study of active and passive safety systems, Frost and Sullivan show that the majority of car users to date resist the idea of giving up control of their vehicle to a machine or robot [21]. Other surveys, on the other hand, have demonstrated that young drivers between 19 and 31 in particular often find driving to be burdensome—specifically, driving can stop them addressing other, more important, meaningful or interesting activities: "Regulation keeps trying to say texting is distracting to driving but for the consumer it is really the driving that is distracting to texting" ([22]: 2). A poll of Europeans' desires for the car of the future also revealed that some two thirds of respondents are open-minded concerning autonomous driving [18]. Although an international survey of car drivers in Germany, China, the USA, and Japan found openness in principle, it also showed that a large number of those questioned in all countries currently (still) harbor doubts about the technology's safe operation [19] or are even rather scared of it [2].

#### 29.4 The Road-User Perspective

Despite the haziness in the empirical methods outlined above, the main questions when looking at autonomous driving's acceptance have to be: How is the acceptance object actually perceived? What acceptance-relevant issues, on either individual or social levels, are associated with the technology? The aim must be to obtain initial indications as to the dimensions of attitudes and values regarding acceptance, and to identify the concrete expectations, hopes, desires, even fears, linked with the development, use, and design of the technology (see [12]). Within the "Villa Ladenburg" project, the first work on individual and societal acceptance was therefore an exploratory study that took a broad look at the point of view of today's road users—who are also tomorrow's potential users of autonomous driving. In the process, essential issues of perceived use from a subjective perspective were considered. The survey also addressed discernible differences in different socio-cultural environments—in this case Germany and the USA. These are among the leading automobile nations, where wide-ranging debates on autonomous driving have already begun with media coverage of the topic having increased noticeably in the last two years. This indicates that autonomous driving is gradually gaining the public's attention.

#### 29.4.1 Methods

The study analyzed statements from comments on autonomous driving. The methodological approach took the form of an analysis of how online articles in widely distributed print media were received. This reception can be traced in the online comments by the users. In particular, this approach assumes that media discourse has a critical influence on individual and societal opinion forming (see [23]). One criterium in selecting articles was that the online news portals they were published in should give a representative picture of the German and US print media landscapes. This permits the assumption that the articles both reflect and help to form the current public discourse on autonomous driving. For Germany, the comments analyzed were on articles from Bild [24], Die Welt [25], Frankfurter Allgemeine Zeitung [26], Heise online [27], Spiegel Online [28–30], Süddeutsche.de [31] und Zeit Online [32]; for the USA, from the Los Angeles Times [33], NY Daily News [34], The New York Times [35], San Francisco Chronicle [36], The Wall Street Journal [37] und The Washington Post [38]. In total, 827 comments on 16 articles were evaluated. To ensure as great a combarability as possible, most articles concerned California's decision at the end of September 2012 to allow Google's driverless cars onto its roads. In terms of "conceptual representativeness;" a theoretical sampling was undertaken ([39]: 154 ff), i.e. in the course of the analysis, comments were analyzed in stages, which in the end led to three comparison groups: (1) comments from German mass media portals, (2) comments from US mass media portals and (3) comments from one technology-centred German portal (Heise online). The evaluation used a qualitative content analysis following Mayring [40] whose aim is to identify texts' meanings, particularly those not immediately apparent. This is done using a systematic and intersubjectively verifiable analysis that meets the linguistic material's interpretational requirements and wealth of meaning. The result of the (summary) contents analysis is an inductively developed category system ([40]: 67 ff). This reflects how the topic of autonomous driving is discussed and negotiated from the online commenters' point of view; which issues and features are perceived; and how these are assessed. To this end, all comments were coded—the smallest coding unit within a comment was one word. A total of 1,421 codings were made in this way, and in successive steps of reduction and abstraction, were condensed into the category system.

#### 29.4.2 Results

The category system, consisting of almost 60 categories and subcategories, is divided into two levels. First there is an object-related level, which is also the more objective of the two. This encompasses statements that contained (positively and negatively) perceived features of the technology, as well as connected topics concerning its general and specific potential for development, and also those on the legal framework, liability questions, etc. Such statements are above all oriented around the object of acceptance, and

Fig. 29.3 Two-level category system

simultaneously closely linked to the acceptance context. On the more emotional level, on the other hand, the question at hand is the subject of acceptance—statements mostly directly refer to the commenters themselves and contain attitudes, judgments and subjective motivations regarding autonomous driving. These are also essentially strongly linked to the context of acceptance, for example with the context of car usage and ownership. Around 15 % of all statements were not applicable to the research object and therefore were deemed to have no relevance. Figure 29.3 shows the category system and a reduced graphic overview and Table 29.1 has the percentages of statements on the two levels as well as the survey's general figures.



#### 29.4.2.1 Object-Related Level

#### Perceived features and consequences of autonomous driving

Distributed among the three comparison groups (German and US mass media; tech-savvy Heise online), between 43 and 47 % of all statements were attributable to the object-related level. Table 29.2 shows a selection of the categories and their percentage distribution. The comments give concrete expectations in relation to the features of autonomous driving, but also to the potential changes and consequences for transport and social systems, and in legal terms. At least two thirds of the anticipated features and consequences have clearly positive connotations, as many as 70 % in the German-media comments. These may, for example, refer to expected safety benefits of autonomous driving, which are expected to greatly reduce, if not completely prevent, road traffic accidents in future. One user puts it thus:


#### Table 29.2 Statement distribution of N = 647 on an objective/object-related level

"A car, though, should actually be much safer on the road than with a driver, as it will have a lot more sensors to see what's coming, be able to look in all directions at once, and have a reaction time close to zero." On the negative side, the main fears revolve around the social consequences, for instance job losses: "What they are working towards is the abolition of the German car industry. Nobody is going to buy a Porsche or a nice fat Benz if they will only get schlepped around like every other Tom, Dick or Harry. […] Losing the German car industry means ca. 25 % fewer of the most highly qualified jobs." Other issues associated with autonomous vehicles in the statements included—on the positive side—flexibility and comfort, transport optimization and efficiency, integrated transport use ("travelstrengthening" currently restricted transport users), general progress accompanying technology, and cost savings. On the negative side, a series of issues were mentioned beyond fears of social consequences: data misuse; deficiencies in the technical infrastructure, i.e. the assumption that such vehicles will not be safe (enough); increased costs; and relatively unspecific uncertainties surrounding the way these vehicles will function. Thus several of the positively perceived features find their negative counterparts here: safety vs deficiency thereof, cost savings vs increased costs, progress vs social consequences.

#### Liability, insurance, and law

According to our evaluation, liability, insurance, and law are topics of particular concern in Germany—expected modifications to the legal framework will also be accompanied by changes to the insurance set-up. This signals uncertainty for almost half the statements on this topic on German mass media portals. One user framed it this way: "This car is not a technological problem, but a legal one. Whose fault is it, then, if the car causes an accident? The driver's or Google's?" A country-specific problem also materialized in the US comments, however, albeit often in ironic fashion—the auto insurance and liability-centered legal profession, seen as being addicted to disputes and litigation, might stand in the way of a successful roll-out of autonomous vehicles: "Leave it to the trial lawyers to spoil the party!" was how one commenter summed up this view. Further discussion on this topic revolved around the necessary future legal changes and development of costs.

#### Development perspectives for autonomous driving

Particularly on the Heise website, many commenters address development perspectives in the context of autonomous driving which go far beyond features exclusively associated with technology (54 % of all object-related comments). Such statements may be about social development in a rather general sense, but also the future development of car usage and ownership, design and vehicle equipment, the interaction between humans and machines, and considerations on the future form of transport and urban space. One user, for instance, touches on the consequences of a changed legal framework: "The question is no longer 'who is liable when there are car accidents?' but rather 'who will still be allowed to drive manually?'"

#### 29.4.2.2 Subject-Related Level

#### Evaluative attitudes and expectations

As a rule, comments in online forums consist of several statements that can be categorized to several levels or (sub)-categories—statements on a more "objective" level are often linked with the more subjective/emotional one. When, for example, negative features are associated with autonomous driving, commenters likewise tend to take a dismissive stance to using the new technology, and vice versa: "I don't want to let the controls out of my hands! Certainly not to a computer that can be manipulated and hacked, just like PCs and cellphones!" This statement combines security fears (an autonomous vehicle, similarly to a computer, will not be entirely secure, data may be misused) with a subjective refusal. On the other hand, the expectation that autonomous vehicles are especially comfortable and flexible may accompany positive personal assessments of the technology: "Fully automated driving with no annoying passengers, no train cancellations and delays—that'd be really great." Statements are not always linked on the different levels, however. Judgments can also be made with no further justifications given, such as this one from US online portals: "Yes. Easiest question I've been asked all day!" or "Jerry, I support you, but not on this" ("Jerry" refers here to the Governor of California, Jerry Brown, who accorded Google driverless cars their street-legal status to media fanfare in the Google headquarters in 2012).

In general, although the technology is clearly positively perceived (see above—"Perceived features and consequences"), it is rather ambivalently-to-negatively assessed (more than two thirds of all statements in this category do not have positive connotations, see Table 29.3). Mistrust and skepticism is either related to the technical development, its whole rationale, or whether it will be possible to bring in the technology at all. The category of ambivalent statements largely concerns the prerequisites and consequences (on the technical, social or infrastructural side) deemed essential before assessing autonomous driving positively.

#### Car usage and ownership

The perception of autonomous driving is strongly bound up with subjective and personal motives of individual car use. Our analysis was able to identify two opposite poles in the assessment of autonomous driving. On one side, there are statements which stressed motivations for using cars due to their comfort and flexibility, and their "general" benefits. Such statements also generally contain a rather positive appraisal and assessment of autonomous driving: "Cars do have, above all, this almost ubiquitous character, because it is so practical. I would find it more practical if I could order such an auto-auto to my front door online and have it drop me off at any destination without me having to bother with parking. If this vision of the future becomes possible, then goodbye Porsche!" On the


Table 29.3 Statement distribution for N = 516 on an affective-subjective level

other side, there are statements highlighting issues of freedom, control and the fun of car driving; most of these are skeptical-to-dismissive of the new technology: "Without driving by myself, where's the fun in that? Technology or no technology: I want to give orders to my car myself, not any computer." Furthermore, some users discuss in very general terms which motives and attitudes underlie their car use, or raise the question of why anyone would (or would not) actually buy a car in a future with autonomous vehicles.

#### 29.4.2.3 Comparing the Groups: Germany, USA and Heise Online

Many perceptions, assessments, perspectives, and value systems showed up in similar measure in all three groups. However, there are some clear differences in some areas, which were either specific to the country or level of knowledge (for Heise online comments, it was safe to assume a far higher level of knowledge on autonomous driving, as well as understanding of technology and engineering in general). Alongside the group-specific topics of development perspectives and liability, insurance and law mentioned above, we also saw that US commenters look at autonomous driving in far more socio-political terms in comparison to their German counterparts (see Table 29.1). Furthermore, evaluating the topic of car use and ownership revealed that fun in driving, individual freedom, and control of the vehicle are the predominant motivations for car use among US comments. This is mostly accompanied by an attitude of refusal regarding autonomous driving (79 % in the USA compared to 43 % of German mass media comments and only 25 % of the tech-savvy posts).

The questions on liability were overall most controversially discussed on Heise online, while the few statements on this topic on US sites see liability as lying with manufacturers in future. In contrast, a majority of people (58 %) commenting on Spiegel and co.—that is, the German mass media—think that liability will also lie with the vehicle owner in future.

The general tone of German comments is overall somewhat more positive. On both the Heise website and those of the German mass media, positive features of autonomous driving were discussed more often than on US ones (70 and 71 % as opposed to 61 %). At the same time, less negative judgments were made (37 and 48 % as against 53 %).

#### 29.4.2.4 Summary

In both the US and German reader comments made on the mass media portals, statements predominate that are still currently focused on the expected features of autonomous driving. That is to say, the acceptance object is in fact the physical object—the car—and its individual use. This takes a different form on Heise online, where discussions already range far beyond familiarization with purely "technical" issues. Instead, they debate concrete user scenarios and see autonomous driving more strongly in the context of the overall socio-technological system of (auto)mobility. Most of those posting on the Heise portal clearly possess greater knowledge of the technology than "normal" media consumers. Public debate on autonomous driving has only just begun to pick up speed in the last two to three years. We may therefore assume that, as it progresses, topics covering not only the technology, but also its embedding in the system, will become of greater relevance.

Overall, our study spans the "scope of acceptance" for autonomous driving as it currently stands. This scope results from the topics setting the public agenda via the media at present; these topics are also linked to specific judgments. When considering the range of topics, it is apparent that some negative features accompany the mostly positive ones attributed to autonomous vehicles. Furthermore, a series of questions have been thrown up which still need clarifying from commenters' point of view. Depending on how they are answered, this will, in turn, have an impact on acceptance. The ambivalence that finds expression here is amplified when objective/object-related statements are supplemented by affective/subjective ones. Although autonomous vehicles as such are mainly adjudged positively, there are also responses to autonomous driving and the roll-out of autonomous vehicles in the transport system that range from distinct mistrust and clear skepticism to downright refusal. This attitude is especially often associated with fear of negative social consequences, and also loss of freedom.

Such an ambivalent stance vis-à-vis autonomous driving is, however, typical for attitudes to technology—and is mirrored in the findings of other technology-acceptance studies (in Germany) [14]. On the one hand, many benefits are associated with autonomous driving that may make life more comfortable and open up new possibilities. On the other, the expected changes are accompanied by fears of negative social consequences. These manifest themselves in "loss of control of one's own environment and one's own life" ([14]: 33, translation by the authors). At the bottom of this ambivalent response lies the desire "to bring one's personal environment and technology together in harmony and to preserve the social, economic and natural environment for future generations" ([14]: 33, translation by the authors). As our analysis has shown, the debate on autonomous driving not only revolves around making motorized personal transport safer, more comfortable, more flexible, more efficient, etc., but also highlights and reflects on the societal, social and economic effects that it will usher in.

#### 29.5 Outlook

Acceptance research, we have argued, must go beyond solely researching opinions and attitudes. It should rather, in terms of an anticipatory societal market research (cf. [12]: 3), identify requirements, ideas, desires, hopes, fears and anxieties, and classify these in the context of a socio-technical system—in this case the transport system as part of the overall social system—and its development. In this way, potential can be brought in line with concrete options (see [41]). A complex topic like autonomous driving touches on various aspects of our society, which is why interdisciplinary cooperation—such as the "Villa Ladenburg" project of the Daimler and Benz Foundation, which initiated and brought together the articles in the present volume—is indispensable.

Future studies on the acceptance of autonomous driving should place greater focus on both cultural-, type-, and milieu-specific differences in acceptance, and interdependencies between different aspects of the topic. The assessment of online comments has provided important initial insights here, and shows the way for future surveys. The ambivalent results concerning motivations for car usage must be given greater consideration. This will make it possible to categorize the individual and social significance of the way cars are used and owned; the symbolic, emotional, and instrumental features ascribed to autonomous vehicles; and the influence current car use and ownership patterns can be expected to have on the autonomous vehicles' acceptance. Chap. 31 focuses on these questions.

In public discourse at least, it is currently not at all clear what is actually meant when autonomous driving is under discussion—this is true of how the media both perceives and presents the technology. Are autonomous (private) vehicles being discussed where the driver can take the controls now and then? Or is it about driverless taxis that, "on command" as it were, can transport both people and goods anywhere, anytime? It can currently be assumed, as our analysis has also demonstrated, that many questions accompanying a potential future roll-out of autonomous vehicles in our transport system still need answering. This in turn means, however, that there is no clear answer to the question of the use of autonomous driving, on both individual and societal levels. At present, it can only be imagined which assigned values will assume the most important roles in autonomous driving. We have, though, been able to at least give an insight into the relevant topics associated with the technology: safety, comfort, cost savings, environmental impacts, time savings, equal opportunities etc.

Furthermore, the context of acceptance and autonomous driving described above is of central significance for future studies. This conclusion can also be taken from the results, among others, of US comments, with their marked socio-politically connoted statements. These show that, to the commenters, autonomous driving looks like it may collide with the prevailing system of norms and values of car usage. Future studies should therefore investigate the individual and societal significance of how cars are used today, and then enquire precisely into how this is embedded in the context of daily praxis and cultural- and milieu-specific frameworks (on this, see also Chap. 31). This will help to define which specific issues can be expected to have an effect on the acceptance of autonomous driving.

In terms of defining uses and assigning values more precisely, in future it will also be a question of allowing potential users and other persons affected to experience the technology. This will give them an idea about what to expect from it, but also let them know what it cannot do. To this effect, policy and public bodies especially could help in promoting acceptance, or at least access ([4]: 3), by shaping public debate more vigorously or initiating specific autonomous driving test and pilot projects: For the current efforts and endeavours being made on the policy side, see Chap. 8. In other areas of the project, it is already clear that specific use cases, as outlined in Chap. 2, each bring with them specific judgments, expectations, and assessments (see Chap. 31 on car usage and ownership in the context of autonomous driving and Chapters by 6, 12 and 32).

Open Access This chapter is distributed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, duplication, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, a link is provided to the Creative Commons license and any changes made are indicated.

The images or other third party material in this chapter are included in the work's Creative Commons license, unless indicated otherwise in the credit line; if such material is not included in the work's Creative Commons license and the respective action is not permitted by statutory regulation, users will need to obtain permission from the license holder to duplicate, adapt or reproduce the material.

#### References


# 30 Societal Risk Constellations for Autonomous Driving. Analysis, Historical Context and Assessment

Armin Grunwald

## 30.1 Introduction and Overview

Technological advancement is changing societal risk constellations. In many cases the result is significantly improved safety and accordingly positive results such as good health, longer life expectancies and greater prosperity. However, the novelty of technological innovations also frequently brings with it unintended and unforeseen consequences, including new risk types. The objective of technology assessment is not only to identify the potential of the innovation but also to examine potential risks at the earliest possible stage and thus contribute to a reasoned evaluation and sound decision-making [10].

In many respects, autonomous driving represents an attractive innovation for the future of mobility. Greater safety and convenience, use of the time otherwise required for driving for other purposes and efficiency gains on the system level are a few of the most commonly expected advantages [5]. At the same time, the systems and technologies for autonomous driving—like any technology—are susceptible to errors that can lead to accidents resulting in property damage or personal injuries. The central role of software can lead to systemic risks, as is well known from the internet and computer worlds. Economic risks—for example for the automotive industry—must also be considered, as well as social risks, such as privacy concerns. Early, comprehensive analysis and evaluation of the possible risks of autonomous driving are an indispensable part of a responsible research and innovation process and thus equally important preconditions for acceptance both on the individual and societal levels. Against this backdrop, this chapter will provide answers to the following questions as they apply specifically to technology assessment:

A. Grunwald (&)

Institute for Technology Assessment and Systems Analysis (ITAS), Karlsruhe Institute of Technology—KIT, Campus North, 76344 Eggenstein-Leopoldshafen, Germany e-mail: armin.grunwald@kit.edu


The answers to these questions are intended to draw attention to potentially problematic developments in order to take any such issues into account in design decisions and regulations and thus contribute to responsible and transparent organization of the societal risk.

#### 30.2 Risk Analysis and Ethics

We define risks as possible harm that can occur as the result of human action and decisions. Many times we are willing to accept some risk, for example because we regard the damage as very unlikely to occur or because we expect a benefit from the decision that outweighs the possible damage that could occur. In some cases, however, we are subjected to risks by the decisions of others, for example through the driving behavior of other drivers or political or regulatory decisions concerning business policy.

#### 30.2.1 Risk-Terminology Dimensions

Risks contain three central semantic elements: the moment of uncertainty, because the occurrence of possible damage is not certain; the moment of the undesired, because damage is never welcome; and the social moment, because both opportunities and risks are always distributed and are always opportunities and risks for particular individuals or groups.

The moment of uncertainty gets to the epistemological aspect of risk: What do we know about possible harms resulting from our actions and how reliable is this knowledge? This question comprises two subquestions: (1) What type and how severe is the harm that could occur as a result of the action and decision and (2) how plausible and probable is it that the harm will actually occur? For both questions, the spectrum of possible answers ranges from scientifically attested and statistically evaluable to mere assumptions and speculations. If the provability of occurrence and expected scale of the damage can be specified quantitatively, their product is frequently described as an 'objective risk' and used in the insurance industry, for example. Otherwise one speaks of 'subjectively' estimated risks, for example based on the perception of risk among certain groups of people. Between these poles there is a broad spectrum with many shades of gray with regard to plausibility considerations.

The moment of the undesired is, at least in the societal realm, semantically inseparable from the concept of risk: As representing possible harm, risks are undesirable in themselves.<sup>1</sup> Nevertheless, the evaluation of the possible consequences of actions as a risk or opportunity may be disputed [2]. One example is whether genetic modification of plants is perceived as a means of securing world nutrition or as a risk for humanity and the environment. The assessment depends on the expected or assumed degree of affectedness by the consequences, which in combination with the uncertainty of those consequences leaves some room for interpretation—and thus all but invites controversy.

Finally, risks also have a social dimension: They are always a risk for someone. Many times, opportunities and risks are distributed differently among different groups of people. In extreme cases, the beneficiaries are not affected by possible harms at all, while those who bear the risks have no part in the expected benefits. So in deliberations regarding opportunities and risks, it is not sufficient to simply apply some abstract method such as a cost-benefit analysis on the macroeconomic level; rather, it is crucial also to consider who is affected by the opportunities and risks in which ways and whether the distribution is fair (Chap. 27).

We accept risks as the unintended consequences of actions and decisions or we impose them on others [15], or expose objects to them (such as the natural elements). When we speak of a societal risk constellation, we are referring to the relationship between groups of people such as decision-makers, regulators, stakeholders, affected parties, advisors, politicians and beneficiaries in view of the frequently controversial diagnoses of expected benefits and feared risks. Describing the societal risk constellations for autonomous driving is the primary objective of this chapter. It is crucial to distinguish between active and passive confrontation with the risks of autonomous driving:


Between these extremes, the following risk levels can be distinguished analytically: (1) Risks that the individual can decide to take or not, such as riding a motorcycle, extreme sports or, in the future, perhaps a space voyage; (2) imposed risks that the individual can reasonably easily avoid, such as potential health risks due to food additives that can, given appropriate labeling, be avoided by purchasing other foods; (3) imposed

<sup>1</sup> In other areas, that is not always the case. For example, in some leadership positions a willingness to take risks is regarded as a strength, and in leisure activities such as computer games or sports, people often consciously seek risk.

risks that can only be avoided with considerable effort, e.g. in cases such as the decision of where to locate a waste incineration site, radioactive waste storage site or chemical factories—it is theoretically possible to move to another location, but only at great cost; and (4) imposed risks that cannot be avoided such as the hole in the ozone layer, gradual pollution of groundwater, soil degradation, accumulation of harmful substances in the food chain, noise, airborne particles, etc.

The central risk-related ethical question is under which conditions assuming risks (in the active case) or imposing them on others (in the passive case) can be justified [11]. In many cases there is a difference between the actual acceptance of risks and the normatively expected acceptance, i.e. the acceptability of the risks [8, 9]. While acceptance rests with the individual, acceptability raises a host of ethical questions: Why and under what conditions can one legitimately impose risks on other people (Chap. 4)? The question gains yet more urgency when the potentially affected are neither informed of the risks nor have the chance to give their consent, e.g. in the case of risks for future generations. The objective of the ethics of risk [11] is a normative evaluation of the acceptability and justifiability of risks in light of the empirical knowledge about the type and severity of the harm, the probability of its occurrence and resilience (capacity for resistance) and in relation to a specific risk constellation.<sup>2</sup>

#### 30.2.2 Constellation Analysis for Risks

Conventional questions as to the type and severity of the risk associated with particular measures or new technologies are therefore too general and obscure salient differentiations. An adequate and careful discussion of risks must be conducted in a context-based and differentiated manner and should, as far as possible, answer the following questions with regard to autonomous driving:


<sup>2</sup> The results of Fraedrich/Lenz [6, S. 50] show that potential beneficiaries consider not only individual but also societal risks.


In this way, 'the' abstract risk can be broken down into a number of clearly definable risks in precise constellations whose legitimation and justifiability can then be discussed individually in concrete terms. The societal risks of autonomous driving are made transparent—one could say that a 'map' of the risks emerges, representing an initial step towards understanding the overall risk situation in this field. Different constellations involve different legitimation expectations and different ethical issues, e.g. in terms of rights to information and co-determination [11, 15], but also different measures in the societal handling of these risks.

#### 30.3 Societal Risk Constellations for Autonomous Driving

Societal risk constellations for autonomous driving comprise various aspects of possible harms and disadvantages, different social dimensions and varying degrees of plausibility of the occurrence of possible harms.

#### 30.3.1 Accident Risk Constellation

One of the expected advantages of autonomous driving is a major reduction in the number of traffic accidents and thus less harm to life, health and valuables [5] (Chap. 17). This reduction is a major ethical matter [3]. Nevertheless, it cannot be ruled out that due to technological defects or in situations for which the technology is not prepared, accidents may occur which are specific to autonomous driving and which would be unlikely to occur with a human driver. One example of this could be unforeseen situations which are unmanageable for the automation in a parking assistant (Chap. 2). Even if only minor dents were the result here, it would have clear legal and financial repercussions that would have to be addressed. These would be all the more complex the greater the accident damage, e.g. in the case of a severe accident with a highway auto-pilot (Chap. 2).

We are very familiar with auto accidents after more than 100 years of established automotive traffic. They involve one or a few vehicles, result in damage for a limited number of people and have limited financial effects. For this risk type of small-scale accidents, an extensive and refined system of emergency services, trauma medicine, liability law and insurance is in place. Individual accidents caused by autonomous vehicles can in large part presumably be handled within the existing system. However, the necessary further development of the legal framework is no trivial matter (see [7]).

Accident risks of this type affect the users of autonomous vehicles as passengers. Users decide for themselves whether they wish to subject themselves to the risk by either using or not using an autonomous vehicle. But the accident risks of autonomous driving can also affect other road users, including, naturally, those who do not participate in autonomous driving. One can theoretically avoid these risks by not taking part in road traffic—but that would be associated with significant limitations. Thus dealing with the risks of autonomous driving is a complex question of negotiation and regulation (Chaps. 4 and 25), in which not only the market, i.e. buying behavior, is decisive, but in which questions of the common welfare such as the potential endangerment of others and their protection must also be considered. This will require democratic and legally established procedures (registration procedures, authorities, checks, traffic regulations, product liability, etc.).

These risks and also their complex distribution are not new; indeed they are omnipresent in the practice of everyday traffic and also societally accepted. This is manifest in the fact that the currently more than 3000 annual traffic deaths in Germany, for example, do not lead to protests, rejection of car transportation or massive pressure for change. The latter component was different in the 1970s, when in West Germany alone over 20,000 annual traffic deaths were recorded despite traffic volumes roughly a tenth of what they are today. Measures primarily aimed at improving passive safety were enacted, leading to a significant reduction in the death rates. Decisive for any societal risk comparison of the previous system with a future system including autonomous driving will be a substantial reduction in the total number of traffic accidents and the damage caused by them (Chaps. 17 and 21). The fact that autonomous driving will not suddenly replace the current system but will presumably be gradually integrated into the traffic system is, against this backdrop, a mixed blessing. On the one hand, mixed systems with human drivers and autonomously guided vehicles will presumably be of significantly greater complexity and unpredictability than a system completely switched-over to autonomous driving. On the other hand, gradual introduction into the transportation system will provide the chance to learn from damage incidents and make improvements. The monitoring of damage incidents and cause analysis will be of critical importance here (Chap. 21).

If the expectation is borne out that human-caused accidents drop substantially with the introduction of autonomous driving, liability law will gain additional significance as the share (albeit not necessarily the absolute number) of technology-caused accidents rises.<sup>3</sup> While today in most cases the cause of accidents is a human driver and therefore the liability insurance providers pay for damages, in accidents caused by an autonomous vehicle, the operator liability of the vehicle owner or the manufacturer's product liability would apply (Chap. 26; see also [4, 7]).

<sup>3</sup> This would, incidentally, also affect a major line of business in the insurance industry, third-party liability insurance.

#### 30.3.2 Transportation System Risk Constellation

On the system level, autonomous driving promises greater efficiency, reduced congestion and (albeit presumably only marginally; see [5, 13]) better environmental performance (Chap. 16). In the traditional transportation system, systemic effects and thus also potential risks arise primarily due to the available traffic infrastructure and its bottlenecks in conjunction with individual driver behavior and traffic volume. Individual situations such as severe accidents or construction zones can lead to systemic effects like traffic jams. Autonomous driving adds another possible cause of systemic effects to the existing ones: the underlying technology. The following will consider only autonomous vehicles relying on an internet connection (not on-board autonomous).

Through the control software and the reliance on the internet (e.g. as part of the "internet of things"), new effects could emerge (Chap. 24). While in the automotive world to date vehicles are operated more or less independently of one another and mass phenomena only occur through the unplanned interactions of the individually guided vehicles, autonomously guided traffic will to some extent be connected through control centers and networking, e.g. to direct traffic optimally using interconnected auto-pilots (Chap. 2). The control of a large number of vehicles will in all likelihood be conducted through software that is identical in its fundamental structure, as the complexity and concentration of companies will presumably strongly limit the number of providers. This could, in theory, lead to the simultaneous breakdown or malfunctioning of a large number of vehicles based on the same software problem. These problems would then no longer necessarily be on a manageable scale in terms of geography, duration and scale of the damage as in the aforementioned accident cases, but could take on economically significant proportions.

Insofar as autonomous vehicles are connected to each other in a network via internet or some other technology, the system of autonomous driving can be regarded as a coordinated mega-system. Its complexity would be extremely high, not least because it would also have to integrate human-guided traffic—the pattern constellation for systemic risks which are difficult or even impossible to foresee in which the risks of complex technology and software could combine with unanticipated human actions to create unexpected system problems [15].

A completely different type of system problem, in this case only for non-on-board autonomous systems but rather for networked vehicles, could be a sort of concealed centralization and an associated concentration of power. Since optimization on the system level can only be done through extra-regional control centers (Chap. 24), a certain degree of centralization—all decentralization on the user side notwithstanding—on the control and management level is indispensable. This could give rise to concerns that the necessities engendered by the technology could lead to problematic societal consequences: a centrally controlled traffic system as the precursor to a centralist society whose lifeblood was a 'mega-infrastructure' beyond the control of the democratic order. But this is not a foreseeable societal risk of autonomous driving and is not by any means a necessary development in this regard. Rather, this is more a concern of the type that should be borne in mind as a potentially problematic issue during the establishment of autonomous driving so that, in the event of its emergence, countermeasures can be taken.

In all of these fields, the decision-makers are a complex web of automotive companies, software producers, political regulators and agencies with different responsibilities. It is possible the new actors may also become involved whose roles cannot be foreseen today. Decision-makers and those affected are largely distinct groups. And since road users and other citizens would have practically no means of avoiding such risks, it is essential that an open, society-wide debate on these matters take place in order to observe and assess the development with due care and bring in any political or regulatory measures that may be appropriate.

#### 30.3.3 Investment Risk Constellation

Research and development of the technologies of autonomous driving are extremely elaborate and accordingly cost-intensive. Suppliers and automotive companies are already investing now, and considerable additional investments would be required before any introduction of autonomous driving. As with other investments, the business risk exists that the return on investment may not be on the expected scale or in the expected timeframe due to autonomous driving failing to catch on a large scale for whatever reason. If a company opts not to invest in the technology, by contrast, there is the risk that competitors will pursue autonomous driving and, if it succeeds, vastly increase their market share. Thus strategic business decisions have to be made in consideration of the different risks.

Upon first consideration this is a standard case of business management and a classic task for the management of a company. In view of the scale of the needed investments and the patience required for the development of autonomous driving, decisions made in this regard will have very long-term implications. Missteps would initially affect shareholders and employees of the respective companies, and if major crises were triggered by such failures the consequences could extend to the economy as a whole, for example in Germany with its heavy reliance on automotive companies. Although in principle a competitive situation, the scale of the economic challenge may speak in favor of forming strategic coalitions to design a joint standard base technology.

Even after a successful market launch, mishaps or even technology-related system effects (see above) can occur which could pose a major risk for the affected brands (Chaps. 21 and 28). One issue that merits special mention in this context is the risk factor posed by the complexity of the software required for autonomous driving. Complex software is impossible to test in its entirety, which means that in actual use unexpected problems can occur (see Chap. 21 on the testability and back-up of the system). In this sense, use is essentially another test phase, and the users are testers. This is already the case to some degree in the automotive world, with software problems a relatively frequent cause of breakdowns. Whether drivers will accept being used as 'test subjects' in a more expansive sense remains to be seen. Any such willingness would presumably be all but nonexistent in safety-related cases. When a computer crashes due to a software error, it is annoying. When an autonomous vehicle causes an accident due to a software error, it is unacceptable. In such cases—unlike with "normal" accidents—massive media attention could be expected.

In particular due to the power of images and their dissemination through the media, such incidents can still have a major impact even when the issues are easily correctable and the consequences minor. A good example of this is the notoriety of the "moose test", which came to public attention through publication of an incident on a test course. Another example is the story of the sustained damage to the reputation of Audi on the American market that resulted from a report in the US media in 1986 (Chap. 28). Irrespective of the severity of the mishap, such incidents threaten to damage the company's reputation and thus pose economic risks. Such risks are also present in the case of major recall actions, in which the substantial economic burden posed by the action itself is generally outweighed by the damage to the company's reputation. The probability of such developments rises with the complexity of the required software, which thus emerges as a central aspect of the risks associated with autonomous driving.

#### 30.3.4 Labor Market Risk Constellation

Technological and socio-technological transformation processes typically have labor market implications. Automation, in particular, is associated with concerns about the loss of jobs. The automation in production and manufacturing in the 1980s led to the loss of millions of jobs in Germany alone, primarily in the sectors dominated by simple manual tasks. A massive societal effort was required to prepare at least a portion of those affected by the job losses for new jobs through qualification and training. Today there are concerns that the next wave of automation could make even more sophisticated activities superfluous. On the upside, moves towards greater automation can lead to the emergence of new fields of activity and job opportunities, so the overall balance need not be negative. But these new fields of activity are generally only open to people with higher qualifications.

Comprehensive introduction of autonomous driving would undoubtedly affect the labor market. The primary losers would be drivers of vehicles which are currently manually operated: truck drivers, taxi drivers, employees of logistics and delivery companies, especially in the Vehicle-on-Demand' use case (Chap. 2). A mobility system completely converted to autonomous driving could in fact largely do without these jobs altogether. On the other side of the equation, new jobs in the control and monitoring of autonomous traffic could emerge, and highly qualified personnel would be needed in the development, testing and manufacture of the systems, particularly in the supplier industry.

Thus a similar scenario to the one described above for the previous waves of automation would emerge here as well: elimination of unskilled jobs and the creation of new, highly skilled positions. The net outcome in jobs is impossible to predict from this vantage point. What is clear is that the high number of potentially affected jobs makes it imperative to think about pro-active measures to deal with the development at an early stage, e.g. developing and providing qualification measures. As it may be presumed that the integration of autonomous driving into the current transportation system will occur gradually, and because there is a wealth of experience from previous automation processes, the prerequisites for an effective response should be in place. To identify developments that could be problematic for the labor market at an early stage, research and cooperation on the part of unions, employers and the employment agency to observe current develops is required.

#### 30.3.5 Accessibility Risk Constellation

Autonomous driving promises greater accessibility for people with reduced mobility, such as the elderly. While this is clearly on the plus side from an ethical standpoint, it could also have social justice implications which, as 'possible harms,' could be regarded as risks. This includes primarily the occasionally voiced concern regarding increased costs of individual mobility due to the costs of autonomous driving. In a mixed system this concern could be countered with the argument that the traditional alternative of driving oneself still exists and thus that no change for the worse would occur.

This scenario would beg the question, however, of who would actually profit from the benefits—primarily safety and convenience—of autonomous driving. If the sole effect of autonomous driving were simply to enable those who currently have the means to employ a chauffeur to dispense with their chauffeurs and even save money in the process in spite of the higher up-front and operating costs, this would certainly not promote greater accessibility to mobility in general. Indeed, it would be detrimental if a large share of those who currently drive themselves were unable to afford to participate in autonomous driving. When considering such problematic developments, it must be noted, first, that questions of distributive justice are not specific to autonomous driving; the just distribution of the benefits of new technologies is a fundamental question with regard to technological advancement. Second, these concerns remain speculative at present as no reliable cost information is available.

Social justice issues could arise in relation to the costs of any infrastructure to be established for autonomous driving [5, p. 12] [13]. If it were regarded, for example, as a public responsibility and were funded through tax moneys, non-users would also take part in financing autonomous driving. If the costs were borne by all drivers, non-users would also regard themselves as subsidizing autonomous driving. Depending on how high the infrastructure costs and thus the costs for individuals were, this could also give rise to social justice questions relating to the distribution of the costs.

#### 30.3.6 Privacy Risk Constellations

Even today modern automobiles provide a wealth of data and leave electronic trails, e.g. by using a navigation aid or through data transmitted to the manufacturer. If autonomous vehicles were not on-board autonomous but had to be connected at all times, the electronic trail would amount to a complete movement profile [13]. Of course the movement profiles of vehicles do not necessarily have to be identical to the movement profiles of their users. In the case of vehicles on demand (Chap. 2) it is of course possible to imagine that they could be used anonymously if ordering and payment were conducted anonymously which, however, seems rather inconsistent with the current development toward electronic booking and payment systems.

Movement profiles provide valuable information for intelligence services, which could for instance track the movements of regime opponents, but also for companies, which could use such information to create profiles for targeted advertising. In view of the increasing digitalization and connectedness of more and more areas of our social and personal lives, the specific additional digitalization in the field of autonomous driving would presumably represent just one element among many others. The problem—even today the end of privacy is declared with regularity—is immensely larger, as current debates about the NSA, industry 4.0 and Big Data show. The emergence of a converging mega-structure comprising the transportation system, supply of information, communication systems, energy systems and possibly other, currently independently functioning infrastructures, represents one of the biggest challenges of the coming years or even decades. The issue will be to re-define the boundaries between privacy and the public sphere and then actually implement those decisions. This must be done on the political level and is of fundamental significance for democracy as a concept, for absolute transparency is but the flip-side of a totalitarian system. Autonomous driving is presumably of only minor specific significance in this debate.

#### 30.3.7 Dependency Risk Constellation

Modern societies are increasingly dependent on the smooth functioning of technology. This begins with the dependency on personal computers and cars and extends to the complete dependency on a functioning energy supply and worldwide data communication networks and data processing capabilities as prerequisites for the global economy. Infrastructures that are becoming more complex, such as the electricity supply, which increasingly has to deal with a fluctuating supply due to renewable energy sources, now more frequently engender 'systemic risks' [15] in which small causes can lead to system instability through complex chain reactions and positive feedback. This increasingly frequently discussed susceptibility to technical failure and random events, but also terrorist attacks on the technological infrastructure of society (e.g. in the form of a cyber-terror attack on the information technology backbone of the globalized economy) represents an unintended and undesirable, yet ultimately unavoidable consequence of accelerated technological advancement [10]. At issue are risks that emerge more or less gradually, which in many cases are not consciously accepted in the context of an explicit consideration of risk versus opportunity but instead only come to public attention when the dependency becomes tangible, such as during a lengthy blackout, which would incapacitate practically every venue of public life [12].

In the case of a large-scale shift of mobility capacity to autonomous driving, a high proportion of society's mobility needs would naturally depend on the functioning of this system. A breakdown would be manageable as long as there were enough people who could still operate the vehicles manually. In a system that allowed passenger vehicle traffic to switch from autonomous to manual, for example, this would be no problem. But if a large share of the logistics and freight traffic were switched over to autonomous systems, it would be implausible, in the case of a longer-term total breakdown of the system, to maintain a sufficient pool of drivers, not to mention the fact that the vehicles would have to be equipped to enable manual operation in the first place. Even if significant logistics chains were to be interrupted for a lengthy period due to a system failure, bottlenecks could still quickly form, both in terms of supplying the population and maintaining production in the manufacturing industries [12]. This type of risk is nothing new: the massive dependence on a reliable energy supply that has been the object of much discussion since Germany's energy transformation policy came into effect, as well as the dependence of the global economy on the internet, are structurally very similar.

Another form of dependence can arise from autonomous driving on the individual level through the atrophying of skills. Large-scale use of autonomous vehicles would result in the loss of driving practice. If the vehicles are then operated manually, e.g. on weekends or on vacation, the reduced driving practice—a certain dependence on autonomously guided vehicles—could result in lower skill levels, such as the ability to master unexpected situations. In the case of a total breakdown of the system, there would suddenly be large numbers of manually operated vehicles on the roads, in which case the reduced skill of the drivers could once again prove problematic. Moreover, there would presumably be major bottlenecks and traffic jams if the expected efficiency gains on the system level (see above) were suddenly to disappear.

Finally, the further digitalization and transfer of autonomy to technical systems would increase society's vulnerability to intentional disruptions and external attacks. Autonomous driving could be affected by terrorists, psychopaths or indeed military scenarios (cyber warfare). Control centers could be hacked, malware installed, or even a system collapse triggered through malicious action. Defensive measures are of course necessary and technically feasible; but here we run into the notorious 'tortoise and hare' problem. But here again, this is not a problem specific to autonomous driving; it is known in the internet world and has arrived in the energy sector, for example, as well.

#### 30.3.8 On the Relationship Between Risk Constellation and Introduction Scenario

The risk constellations described here are based on qualitative and exploratory considerations from the current world of mobility. They therefore have a certain plausibility, but also contain speculative aspects. They should not be understood as predictions, but as guideposts that should be observed along the way to the research, development and introduction of autonomous driving. Indeed, they cannot be predictive because any future occurrence of particular risk constellations depends on the introduction scenario for autonomous driving and its specific characteristics, and both of these elements are unknown today. For example, the contours of the 'privacy' risk constellation will depend heavily on whether an on-board autonomous driving scenario is implemented or autonomous vehicles continuously need to be connected to the internet and control centers.

The public perception of the risk will depend largely on how autonomous driving is introduced. If it happens as part of a gradual automation of driving, the potential to learn gradually from the experiences gained along the way will greatly lessen the risk of a 'scandalization' of autonomous driving as a high-risk technology for passengers and bystanders. Steps on the way to further automation such as Traffic Jam Assist, Automated Valet Parking or Automated Highway Cruising (Chap. 2), the introduction of which seems likely in the coming years (Chap. 10), would presumably not lead to an increased perception of risk because they would seem a natural development along the incremental path of technological advancement.

Unlike switching on a nuclear reactor, for example, the process of increasing driver assistance towards greater automation has so far progressed gradually. The automatic transmission has been around for some decades, we are comfortable with ABS, ESP and parking assistants, and further steps towards a greater degree of driver assistance are in the works. Incremental introduction allows for a maximum degree of learning and would also enable gradual adaptation of the labor market, for example, or privacy concerns (see above).

In more revolutionary introduction scenarios (Chap. 10) other and likely more vexing challenges would present themselves for the prospective analysis and perception of risks. The public perception would then react especially sensitively to accidents or critical situations, the risk of 'scandalization' would be greater and the 'investment' risk constellation (see above) could develop into a real problem for individual suppliers or brands.

#### 30.4 Relationship to Previous Risk Debates

Germany and other industrialized countries have extensive experience with acceptance and risk debates over many decades. This section will seek to draw insights from these previous risk communications and apply them to autonomous driving—insofar as this is possible in light of the very different risk constellations.

#### 30.4.1 Experience from the Major Risk Debates

#### 30.4.1.1 Nuclear Power

The risk constellations for nuclear energy arose principally from the fact that one side was comprised of the decision-makers from politics and the business community, supported by experts from the associated natural science and engineering disciplines. On the other side were the affected parties, including in particular residents in the vicinity of the nuclear power plants, the reprocessing plant and the planned nuclear waste repository in Gorleben, but also growing numbers of the German populace.

Nuclear power is a typical technology that is far-removed form everyday experience. Although many people profit from the generated energy, the source of the energy is not visible, as evidenced by the old saying that "electricity comes from the electrical socket." The possibility of a worst-case scenario with catastrophic damage potential like in Chernobyl and Fukushima; the fact that on account of those incidents no insurance company was or is willing to insure nuclear power plants; the extremely long-term danger posed by radioactive waste; all of these factors demonstrate that the risk constellation in the case of nuclear power is completely different than the one for autonomous driving. Only one point was instructive:

The early nuclear power debate in Germany was characterized by the arrogance of the experts, who at that time were almost entirely in favor of nuclear power, in the face of criticism. Concerns among the public were not taken seriously, and critics were portrayed as irrational, behind the times or ignorant [14]. In this way, trust was squandered in several areas: Trust in the network of experts, politicians and business leaders behind nuclear energy; trust in the democratic process; and trust in technical experts regarding commercial technologies in general. The risk debate on nuclear energy illustrates the importance of trust in institutions and people and how quickly it can be lost.

#### 30.4.1.2 Green Biotechnology

The risk constellation in the debate over green biotechnology is interesting in a different way. In spite of a rhetorical focus on risks, for example through the release and uncontrolled spread of modified organisms, the actual topic here is less the concrete scale of the risk and more the distribution of risks and benefits. Unlike with red biotechnology, the end consumer in this case would have no apparent benefit from genetically modified food. In the best case, the genetically modified foods would not be worse than conventionally produced foods. The benefits would accrue primarily to the producing companies. In terms of potential health risks (e.g. allergies), however, the converse would be the case: they would affect users. That is naturally a bad trade-off for users: excluded from the benefits, but exposed to potential risks. This viewpoint could present a plausible explanation for the lack of acceptance and offer a lesson for autonomous driving, i.e. not to emphasize abstract benefits (e.g. for the economy or the environment) but to focus on the benefits to the 'end customer'.

A second insight also emerges. The attempt by agribusiness companies, and in particular Monsanto, to impose green biotechnology in Europe only intensified the mistrust and opposition. In sensitive areas such as food, pressure and lobbying raise consumer consciousness and lead to mistrust. Attempting to 'push through' new technologies in fields that are close to everyday experience, which driving undoubtedly is, therefore seems like an inherently risky strategy.

#### 30.4.1.3 Mobile Communication Technologies

Mobile technologies (mobile phones, mobile internet) are an interesting case of a technology introduction that is successful in spite of public risk discussions. Although there has been a lively risk discussion regarding electromagnetic radiation (EMF), this has had no adverse affect on acceptance on the individual level. Only locations with transmission towers are the focus of ongoing protests and opposition. There is practically no opposition whatsoever to the technology in itself. The most obvious explanation is that the benefit and not the benefit to the economy, but the individual benefit experienced by each user is simply too great.

Even the serious and publicly discussed risks to privacy that have come to light in recent years due to spying by companies and intelligence services have had barely any impact on consumer behavior. Mobile telephony, online banking, e-commerce and the perpetually-online lifestyle enable the creation of eerily accurate profiles, and yet this does not prevent users from continuing to use these technologies and continuously volunteer private information in the process. It is plainly the immediate benefit that moves us to accept these risks even when we know and criticize them.

#### 30.4.1.4 Nanotechnology

Ever since a risk debate about nanotechnology emerged some 15 years ago, the technology has been dogged by concerns that it could fall victim to a public perception disaster similar to the ones experienced by nuclear energy or genetically modified crops. The extremely wide-ranging, but entirely speculative concerns of the early days, which took the form of horror scenarios such as the loss of human control over the technology, have since disappeared from the debate without these effects coming into play. Through open debate, nanotechnology emerged from the speculative extremes between rapturous expectations and apocalyptic fears to become a 'normal' technology whose benefits reside primarily in new material characteristics achieved through the coating or incorporation of nanoparticles.

Here again there were fears of large-scale rejection of the technology. Calls by organizations such as the ETC-Group and BUND for a strict interpretation of the precautionary principle, for example in the form of a moratorium on the use of nanoparticles in consumer products such as cosmetics or foods, gave voice to such concerns. Yet a fundamentalist hardening of the fronts did not occur despite the evident potential. One reason is presumably that communication of the risk proceeded much differently in this case than with nuclear technology and genetic engineering. While in those cases experts initially failed to take concerns and misgivings seriously, dismissing them as irrational and conveying a message of "we have everything under control," the risk discussion concerning nanotechnology was and remains characterized by openness. Scientists and representatives of the business community have not denied that further research is still needed with regard to potential risks and that risks cannot be ruled out until the toxicology is more advanced. This helped build trust. The situation could be described somewhat paradoxically as follows: Because all sides have openly discussed the need for further research and potential risks, the debate has remained constructive. The gaps in the science regarding potential risks has been construed as a need for research rather than cause for demanding that products with nanomaterials be barred from the market. Rather than insisting on the absolute avoidance of risks (zero risk), trust that any risks will be dealt with responsibly has been fostered.

#### 30.4.2 Conclusions for Autonomous Driving

Autonomous driving will be an everyday technology that is as closely connected to people's lives as driving is today. That distinguishes it greatly from nuclear energy, while it shares this everyday-life quality with green biotechnology (through its use in food production) and mobile communication technology. From both risk debates we may extract the insight of how central the dimension of individual benefit is. While any such benefit from eating genetically modified food has scarcely even been advanced by its proponents, the individual benefits of mobile telephones and mobile internet access are readily evident. And as soon as this benefit is demonstrably large, people are prepared to assume possible risks. And this is absolutely rational from an action theory standpoint. What is irrational is to assume risks when the benefits are not evident or would only accrue to other actors (e.g. Monsanto in the green biotechnology debate). In such cases a risk debate can have dramatic consequences and obliterate any chance of acceptance.

Another such knock-out scenario is the possibility of a massive catastrophe such as the 'residual risk' of the meltdown of a nuclear power facility. This was decided on the political level, albeit with little chance of external influence. The situation was thus widely regarded as a passive risk situation in which people were exposed to potential harm by the decisions of others. Nothing can be gleaned directly from this scenario for autonomous driving as it would presumably be introduced in the familiar market context of conventional transportation and thus de facto depend on the acceptance of users from the outset. While it is possible to imagine other introduction scenarios (Chap. 10), state-mandated use of autonomous driving is all but unthinkable. The only indirect lesson from the history of nuclear energy is that expertocratic arrogance generates mistrust. An open discussion 'between equals'—a lesson from the nanotechnology debate as well—is a key precondition for a constructive debate on technology in an open society.

These examples also show that talk of a German aversion to technology is a myth born of the experiences with nuclear energy and genetic engineering. All empirical studies show that otherwise, acceptance is very high across a large spectrum of technology (digital technologies, entertainment technology, new automotive technologies, new materials, etc.) [1]. This also applies to some technologies for which intensive risk debates have taken place in the past or are still ongoing (e.g. mobile telephones). The fact that nowadays questions regarding risks are immediately posed does not indicate hostility to technology; rather, it is a reflection of the experience of the ambivalent character of technology and the desire to obtain as much information as possible. Much that is commonly taken as evidence of hostility to technology has little to do with technology. The Stuttgart21 protests were not about rejecting rail technology; protests against new runways at major airports are not about rejecting aviation technology; nor are protests against highways and bypasses about rejecting the technology of driving cars. Even the rejection of genetically modified crops and nuclear energy have much to do with non-technological factors: mistrust of multinational corporations like Monsanto and a lack of confidence in adequate control and monitoring (e.g. Tebco in Japan).

#### 30.5 Strategies of Responsible Risk Management

Risk management must be adapted to the respective risk constellations and be conducted on the appropriate levels (public debates, legal regulations, politically legitimated regulation, business decisions, etc.). It is based on the description of the risk constellation, in-depth risk analyses in the respective fields and a societal risk assessment.

#### 30.5.1 Risk Evaluation

The societal risk assessment is a complex process involving a variety of actors that can take on its own dynamics and lead to unforeseeable developments [15]. Starting with statements by especially visible actors (in the case of new technologies, frequently scientists and businesses on the one hand and pressure groups and environmental groups on the other) leads to a gradual concentration of positions and point-counterpoint situations in the mass media and the public debates represented by them. Individual incidents can tip public opinion or dramatically accelerate developments, as seen in the rapid shift of attitudes about nuclear energy following the reactor incidents in Chernobyl and Fukushima. That makes predictions extremely difficult. The following will venture a tentative statement on autonomous driving in consideration of the plausibility and the lessons drawn from the previous debates.

To begin with, it is important to note that comparisons are very important for risk assessments [8, 13, 15]. We evaluate new forms of risk by looking at them in relation to known forms of risk. Here we have a known risk constellation shared by autonomous driving and conventional driving that can and should be applied as a key benchmark for comparison (Chap. 28; see also Sect. 30.3 in this paper). If autonomous driving were to score significantly and unambiguously better in this comparison (i.e. greater safety, lower risk of accidents), this would be a very important factor in the societal risk assessment.

Moreover, the risks of autonomous driving appear to be relatively minor in many respects. Technology-related accidents would occur with a certain probability, which could be minimized, but not eliminated, in an intensive test phase. Unlike in the case of nuclear energy, for example, their consequences would be relatively minor in geographic and temporal terms (compare the half-lives of radioactive materials) as well as with respect to the number of involved people and the property damage. A worst-case scenario of catastrophic proportions does not apply.

Largely new is the digital networking potentially associated with the automation of driving, with all of its implications for possible systemic risks, vulnerabilities, privacy and surveillance. These will inevitably be major issues in any public debate on autonomous driving. But as these challenges are also present in a multitude of other fields (including, increasingly, non-autonomous driving), they would be unlikely to lead to risk concerns relating specifically to autonomous driving.

One special case is the business risk assessment by manufacturers (Sect. 3.3), both in terms of the return on investment and potential reputation problems due to accidents. Any such business assessment must work with extremely uncertain assumptions, for instance concerning the media's willingness to play up scandals as well as the effect of any such scandals in themselves. Here misperceptions can arise in both directions: exaggerated fears and naive optimism. It is to be expected, in any event, that from the public perspective, scandals would be specifically attributed to a particular brand rather than to autonomous driving as an abstract concept. That may hold no consolation for the affected brand; but it does indicate—at least insofar as the benefits of autonomous driving are undisputed—that this type of problem would impact the competition between the manufacturers, but not autonomous driving as a technology in itself. And that is already the case for other technologies today.

Overall, the public risk constellation tends towards being unproblematic. It cannot be compared with genetic engineering or nuclear technology: there is no catastrophic scenario, the benefit is readily apparent, the introduction proceeds through a market and not by decree 'from above'. And it would probably not occur overnight 'at the flip of a switch,' but gradually.

#### 30.5.2 Risk and Acceptance

Acceptance (Chap. 29) cannot be 'manufactured,' as is sometimes expected, but can only 'develop' (or not). This 'development' depends on many factors, some of which can certainly be influenced. In rough terms, public as well as individual acceptance depend largely on perceptions of the benefits and risks. It is crucial that the expected benefits not be couched exclusively in abstract macroeconomic terms, but actually comprise concrete benefits for those who would use the new technologies. Also critical is the ability to influence whether or not one is exposed to risks. Acceptance is generally much easier when the individuals can choose for themselves (e.g. to go skiing or not) than when people are exposed to risks by external entities and are thus effectively subjected to the control of others.

Another important factor with respect to risk concerns is a (relatively) just and comprehensible distribution of benefits and risks (this was the main problem in the genetic engineering debate; see above). And it is absolutely essential that the involved institutions (manufacturers, operators, regulators, monitoring and control authorities) enjoy public trust and that the impression does not arise that there is an effort to 'push the thing through' on the backs of the affected with their concerns. To achieve this, communication about possible risks must be conducted in an environment of openness—nothing is more suspect from a mass-media standpoint than to assert that there are no risks and that everything is under control. Concerns and questions must be taken seriously and must not be dismissed a priori as irrational. All of this requires early and open communication with relevant civil society groups as well as in the mass media sphere, and where appropriate in the spirit of 'participatory technology development.'

There is some reason to believe that for the acceptance of autonomous driving, expected benefits will outweigh concerns regarding risks. After all, conventional driving is an almost universally accepted technology in spite of over 3000 traffic deaths annually in Germany. In contrast with nuclear energy, for example, the scope of potential damage appears limited both geographically and in terms of time. Other societal risks (see above; e.g. surveillance) are more abstract in nature, while the expected benefits are, in part, very tangible. I would therefore turn the juxtaposition "abstract social gain - concrete human loss" (Chap. 27) on its head: abstract risks such as dependence on complex technologies or privacy problems versus concrete individual benefits in terms of safety and comfort. A focus on risks would therefore presumably miss the core of the challenge: the decisive factor seems to be the expected benefits.

That only applies, of course, because the risk assessment identified no dramatic results. Instead, the risk constellation for autonomous driving represents "business as usual" in the course of technological advancement—undoubtedly with its trade-offs and societal risks, but also with the opportunity to deal with them responsibly and civilly. In particular the presumably gradual introduction of autonomous driving and the resultant opportunity to learn and improve in conjunction with the absence of catastrophic-scale risks somewhat diminish the importance of risk questions in the further course of the debate on autonomous driving in relation to, say, labor market or social justice concerns. Rather than focusing on risk, it seems appropriate to regard the elements and options of autonomous driving as parts of an attractive mobility future with greater safety and efficiency, more social justice and more convenience/flexibility. Of course, there is no zero-risk scenario but that has not been the case with conventional driving either.

Two major acceptance risks remain. One is the possibility of scandalization of problems in test drives or technical failures, perhaps in the context of accidents, through media reporting (read moose test). The consequences would be difficult to predict. But here again it must be noted that the moose test did not give rise to rejection of the technology of driving in itself. The problem—presuming the correctness of the assumption that expected benefits are more important for acceptance than risk concerns—would be more that any reputational damage would affect the respective brands rather than the technology of autonomous driving in itself.

The second big unknown is human psychology. Whether and to what degree people will entrust their lives and health to autonomous driving is an open question. There are no known cases of acceptance problems for other autonomous transportation systems such as subways or shuttle services. But railway vehicles are perceived differently than cars; because in rail transport one is always driven rather than driving oneself; because the respective systems are controlled centrally by the control system; and because the complexity and possibility of unforeseen events in many situations is considerably greater in automobile traffic than in railway cars.

Another aspect with regard to acceptance is that in conventional automobile transportation a well-developed culture of damage adjustment is in place through the traffic courts, appraisers and insurance companies that has reached a high degree of precision and reliability. Autonomous driving, by contrast, would pose new challenges to the damage adjustment system as the question of "Who caused the damage, man or machine?" would have to be answered in an unambiguous and legally unassailable manner. Acceptance of autonomous driving will therefore largely depend on the development of answers to these questions that are equal to the precision of today's damage adjustment system (Chaps. 4 and 5).

#### 30.5.3 Elements of Societal Risk Management

This diagnosis of the risk constellation for autonomous driving from the societal perspective suggests, indeed demands, the following risk management measures:


Many of the challenges mentioned here are of a complex system type. In this respect, system research on various levels is especially important. Autonomous driving should not be regarded simply as a replacement of today's vehicles by autonomously guided ones, but as an expression of new mobility concepts in a changing society.

Open Access This chapter is distributed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, duplication, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, a link is provided to the Creative Commons license and any changes made are indicated.

The images or other third party material in this chapter are included in the work's Creative Commons license, unless indicated otherwise in the credit line; if such material is not included in the work's Creative Commons license and the respective action is not permitted by statutory regulation, users will need to obtain permission from the license holder to duplicate, adapt or reproduce the material.

#### References


# 31 Taking a Drive, Hitching a Ride: Autonomous Driving and Car Usage

Eva Fraedrich and Barbara Lenz

#### 31.1 Introduction

For over a century, the automobile has shaped our physical mobility like no other means of transport. For almost as long, however, it has also been the subject of criticism surrounding the ecological, social and health consequences of automobility.

Autonomous driving may bring with it upheaval in how individuals and society deal with the car, and thus also impact transport, mobility or urban structures. Recently, it has received much public attention—in the mass media it has become part of regular news reporting and is even taken up, discussed and shared on social platforms. There is public discussion of how technology is currently (perceived) to be developing, but also of the possible radical change in how cars will be used, which would be accompanied by altered attitudes to cars and driving. Expected changes, for instance, include a dramatic drop in the current rate of car ownership [1, 2], a reduction in the space currently needed for parking [3], and a transformation in car ownership and usage in favor of carsharing fleets [4].

The topic's growing prominence demonstrates that the debate surrounding autonomous driving and autonomous vehicles is evidently cropping up more and more in society. In any transition to a potential new era of car ownership and usage, it is important to ask early on what people associate with autonomous driving. How do they perceive the technology and the ensuing debate? In what contexts is such a debate embedded? What

B. Lenz e-mail: barbara.lenz@dlr.de

#### B. Lenz German Aerospace Center (DLR), Institute of Transport Research, Berlin 12489, Germany

© The Author(s) 2016 M. Maurer et al. (eds.), Autonomous Driving, DOI 10.1007/978-3-662-48847-8\_31

E. Fraedrich (&) B. Lenz

Geography Department, Humboldt-Universität zu Berlin, Berlin 10099, Germany e-mail: eva.fraedrich@geo.hu-berlin.de

are people's hopes, fears, and fantasies? Where is the technology viewed with optimism or skepticism, as being feasible or even as impossible?

An initial systematic in-depth structuring of the topic from road users' point of view has focused on the wealth of various topics, perceptions, and assessments presently associated with autonomous driving (for details of this exploratory study's survey and findings see Chap. 29). In this connection, it has become clear that autonomous driving is assessed strongly from a subjective usage context, and is also tightly bound up with the motives, value systems, and practices of using private cars. The choice of transport mode —the decision to use a particular transport means—is in turn a deeply rooted part of our everyday praxis, which can be expected to change little by little rather than by leaps and bounds (cf. [5, 6]). It is not currently clear what a future with autonomous vehicles might look like, and which areas of our daily lives, communal life, or mobility will be subject to change. Examining autonomous driving within the scope of everyday practices, of which car usage and ownership form part makes the context of the technology more conceivable.

This article first looks at the latest research on car use and ownership. Using selected findings from previous surveys, we then direct the focus to use-related perspectives on autonomous driving (these perspectives specifically refer to the use cases developed within the Villa Ladenburg project see Chap. 2). In this context, we will also examine the role of motivations for using and owning cars.

#### 31.2 We Drive … and Drive … and Drive …

The question of why people use cars has occupied scientists of various disciplines including psychology, sociology, transportation science, economics and social sciences in particular—for almost as long as the automobile has been in existence [7]. This debate has been a highly emotional one again and again (cf. [7, 8]); literature and studies on the individual and societal benefits of car usage are clearly in the minority (see [9, 10]). In light of the discussion of more sustainable ways of living, to which reducing motorized personal transport could significantly contribute, the search for the reasons behind car usage has intensified in recent years, which can be seen in the increasing numbers of both academic and popular-science papers and articles on the subject.

The automobile is part of a complex, non-linear system—the system of automobility which always reproduces the preconditions for its own expansion (which can be seen in potent and complex technical, political and social relationships between industry, suppliers, infrastructure, resource use, and urban and regional planning etc. [11]). This has led to the onset of path dependency and a "lock-in" effect which can hardly be reversed (see [11–13]). Stotz (2001) points out how the car as a technical artifact is actively integrated into social and societal (socialization) processes, and in this way acquires the status of subject rather than of an object (see [14]). Other authors have also remarked that the car itself has not appeared to be an external object for quite some time now, but rather seems to be a symbolic extension of the human body (see [15–17]). There are also a series of studies, however, that highlight the car's significance for physical and mental well-being, and even for higher life expectancy (see [18–20]).

The motivations that have been empirically uncovered for using or owning a car are manifold. In the following, we shall briefly outline the foremost and most up-to-date attempts at explanation.

#### 31.2.1 What Are the Reasons and Motives for Using Cars?

Instrumental motives For a long time, the motives for using and owning cars was explained by behavioral models mainly based on instrumental or utilitarian aspects (see [21]). In order to fulfill their everyday mobility needs—that is to say, to undertake various activities at various locations—people resort to several means of getting around (car, bike, train, etc.). The reasons for this, goes the assumption, are based on the specific benefits they bring with them, e.g. availability, speed, monetary costs, flexibility, safety, convenience, etc. Whoever, therefore, chooses the car to get around—when, for example, desiring to get from A to B more quickly, or setting off on holiday in as good-value and comfortable a way as possible, or getting to work when it is far from home—deems it more favorable than other transport means. Whether the advantages a car brings are objectively measurable is a secondary matter here; what is at issue is a subjectively perceived benefit, which need not correspond to any actual one (see [22]).

Urban development concepts such as "New Urbanism" or "Smart Growth" primarily involve the assumption that instrumental aspects are decisive in how transport modes are chosen. This then shapes infrastructural, transport-planning, and policy activities—areas with greater settlement density and mix of uses (residential, work, shopping, leisure) aim to shorten trip lengths and times, and should enable a reduction in motorized private transport (see [23–26]).

Affective motives Instrumental reasons alone, however, are not sufficient in themselves to fully explain decisions made when choosing transport modes [27, 28]. Furthermore, they cannot always be clearly distinguished from other motives. Independence and freedom, the dominant reasons for using cars, can both be interpreted as instrumental and affective aspects. The freedom—free from timetables, for example—to drive off at any moment can be a rational basis for taking the car. At the same time, this freedom can also give a feeling of autonomy and independence—an emotionally colored reason to drive (see [6, 29]).

Affective or emotional factors play a significant role in both everyday driving and journeys made for leisure. Transport means such as the car are tightly bound up with emotions and feelings that in turn exert considerable influence on what modes are, and are not, selected. This is the case even though car users are often inclined, in direct surveys, to rationalize their motives and motivations, and let emotional aspects 'go by the board' [28]. Driving can thus be accompanied by feelings of relaxation and pleasure, excitement and elation, the joy of driving or of speed, but also by stress and tension. As a rule, car driving is associated with positive feelings [30–32].

The car as status symbol, symbolic motives and cultural symbolic meaning Alongside instrumental and affective motives, symbolic motives also influence the choosing of cars (or transport modes in general). In doing so, they fulfill two functions: First, a personal value may be expressed by using or owning a specific vehicle. Second, this may then underscore a certain position in the social order. A car may, for instance, signify status and prestige, or perhaps a particular attitude to life [28–30, 33, 34].

Furthermore, cars also serve as a cultural symbol. They represent progress, freedom, individuality, and sophistication. They inspire music, art, literature, film, and advertising. They have an impact on family life, social interaction, and cultural rituals, and are an integral component of initiation rites in modern society (see [11, 35–37]).

Further approaches Beyond the not always clear-cut distinctions of instrumental, affective, and symbolic motives (for more on this, see [6, 38]), a number of recent studies and debates have placed cars and the reasons for using them more clearly in the context of a sociotechnical system. This research has thrown light on the way cars fulfill specific social functions: how, for instance, they perpetuate geographical inequalities and divisions, shape social constructions, or how they can fix national and cultural identities [14, 39–43].

A further important topic, in the context of our work on the interrelationship between car ownership and autonomous driving, is the car as "private space" (see [44, 45]). For some, the "cocoon" car, an "inhabited" space, can function as a refuge from what is felt to be stressful, hectic, loud, and overcrowded modern life. Moreover, it also holds special significance for social interaction. Laurier und Dant [46] have examined the significance of this "inhabited" space and the emergent increasing vehicle automation. They point out that liberation from the driving task fits in with cars' evolutionary development over recent decades. This trend is far less a matter of expressing identity (as also manifested in sports cars' loss of significance and the increase in closed vehicles with large interiors) than one of temporarily "inhabiting" a space that also enables social interaction. Such studies consistently stress that it is social factors, far more than individual ones, that can play a considerable role in the way cars are favored. Inside an automobile, people take on the same specific social roles that they assume in their other social interactions (being a parent, friend or worker, etc.) [42, 47].

In this context, newer studies on how people value their time spent travelling when using various transport modes could also be of use (see [27, 48]). For a long time, driving cars was viewed as unproductive, lost time—the frequently monotonous, unvarying way to work was a typical example of this burden [49]. That time spent in a car is certainly subjectively perceived as valuable, however, and may even be viewed as a "gift," has been recently demonstrated by Jain and Lyons [48] with their study on commuters. Travel times were here seen as time for relaxing from everyday hustle and bustle, a transition time between work and home. These findings are in line with an earlier work on commuting, in which Mokhtarian et al. (2001) were already able to show that time spent in a car is certainly not always seen as wasted [27].

#### 31.2.2 Summary

At present, car usage and ownership is approaching a saturation point in industrial nations, which is not to say that the car will fall from its dominant position so easily because of this [50]. For the vast majority of car users, it will far more likely retain its significance in fulfilling their daily needs ([51]: 114). What is of prime importance in the debate on the future uses of autonomous cars (and also their acceptance) is to take into consideration the complexity of instrumental, affective, and symbolic aspects. Technology's perceived functional qualities can, at first glance, appear to be an easily measurable "objective" benefit, but these functional aspects only reveal their significance in the context of the subjective motivations —affective and symbolic—that accompany autonomous driving. Furthermore, embedding instrumental motives for (autonomous) car usage in the context of everyday praxis, and also of the relevant sociotechnical system, plays a role too. The autonomous vehicle may be perceived as safe, flexible, and comfortable, but this will only lead to it actually being used if safety, flexibility or comfort have a specific significance in daily praxis [51].

#### 31.3 Multiple-Method Investigative Approaches for Autonomous Driving in the Context of Car Usage and Ownership

The insights from research into car usage and ownership, together with the indications from the first exploratory study on autonomous driving, have formed the conceptual basis for our follow-up empirical work. The objective of these ongoing studies is to survey, in a use-oriented fashion, the specific attributes that road users currently ascribe to autonomous cars and, in the "translation" of such attributes, to decipher instrumental, affective and symbolic motives. The questions guiding the research are thus: What characteristics and assessments do road users associate with autonomous driving and autonomous vehicles? What various motives are decisive in this? The context of what attributes are currently ascribed to autonomous driving is also to be analyzed and, where possible, linked to how people live their daily lives and get around. In this way, it will then be possible to determine which attitudes and judgments may be expected to have an effect on acceptance of the technology.

To this end, a multiple-method procedure was selected. To explore potential variations in people's perceptions and judgments, respondents were confronted with specific use cases of autonomous driving in a quantitative online survey. This survey also contained a free-text questionnaire—participants were thus able to ascribe autonomous driving with attributes in a completely individual way. A more in-depth analysis encompassing the context in which autonomous driving is presently perceived and viewed allowed for exploratory qualitative procedures to be pursued in parallel as part of group discussions. The focus here lay particularly on ambivalence in how technology is viewed (see Chap. 29), particularly in advance of potential implementation—with both fear and high expectations. Exploratory qualitative procedures appear to be especially apt for this still relatively young field of research. Until now, there has been barely any insight available into the attitudes and motives surrounding autonomous driving on the user side—the open character of such studies helps to decipher these motivations.

#### 31.3.1 Perception and Assessment of Autonomous Driving in Relation to Specific Use Cases

It may also be expected that each of the four use cases developed in the course of this project (Chap. 2) will be perceived and assessed differently in view of their acceptance-relevant aspects. This is because they not only differ in technical terms, but also in the specific implications, usage areas, and attributes they are associated with (for more on this see Chaps. 6, 11, 12, and 32). In a quasi-representative survey, we therefore recorded differentiated attitudes to autonomous driving with recourse to the use cases. A thousand people were surveyed, and represented the total German population regarding gender, age, income, and level of education. An in-depth discussion of the survey—which was developed and carried out in cooperation with several authors of the present volume —and sampling can be found in Chap. 6.

A total of 57 % of those surveyed declared they were generally interested in the topic of autonomous driving. However, 44 % stated they had no knowledge of the subject, and a mere 4 % termed themselves as being well informed or having specialist knowledge at all, let alone being an expert. 78 % obtain their information on the topic primarily from the mass media, 64 % go straight to experts, 56 % discuss it with friends or co-workers, and 40 % share and compare notes on social media.

Following a general section with questions on sociodemographics, mobility behavior, travel requirements, etc. the respondents were each randomly allocated one of four scenarios based on the use cases. Each scenario was introduced with a short description:

Scenario for Interstate Pilot Using Driver for Extended Availability: On freeways or similar roadways, the driver can hand over control to the vehicle. The driver does not have to pay attention to other traffic or the driving task in this time, and can pursue other activities.

Scenario for Autonomous Valet Parking: After all passengers have got out of the vehicle, it can drive itself to a pre-determined parking space and also from there to a pick-up address.

Scenario for Full Automation Using Driver for Extended Availability: Whenever and wherever desired or required, the driver can hand over control to the vehicle. The driver does not have to pay attention to other traffic or the driving task in this time, and can pursue other activities.

Scenario for Vehicle on Demand: A vehicle on demand drives its passengers without the presence of any human driver. People themselves can no longer drive in such vehicles – the vehicle's interior will thus also have neither steering wheel nor pedals.

A follow-up question to each use case as it was introduced enquired whether the respondents would essentially be prepared to replace their till-now preferred transport mode with an autonomous vehicle. This question has had already been put to them in the same form in the first, general part of the survey, but there it was relatively unspecifically termed "an autonomous vehicle" with no further explanation. Altogether the respondents had relatively little desire to replace their own vehicle (or "favorite mode of transport") with an autonomous vehicle—whether precisely specified or not. Only between 11 and 15 % agreed to this statement in large or full measure (see Fig. 31.1). However, 27 % said they could hardly imagine, or could not imagine at all, replacing their preferred mode with a (non-specified) autonomous vehicle. When, as in the survey, autonomous driving is proposed in relation to a specific use case, this degree of refusal increases sharply, to between 44 and 54 %. This means that refusal becomes stronger with more precise scenario descriptions. The lowest acceptance, incidentally, is for Vehicle on Demand— 54 % would not wish to replace their favored mode with it and only 11 % could envisage it at all.

To explore what the respondents currently associate with autonomous vehicles, they were asked to declare in their own words, in up to fifteen free-text boxes, what they understand by the term "autonomous vehicle." The short descriptions (see above) were also a basis here. The following analysis refers solely to the answers of those respondents

Fig. 31.1 Preparedness to replace the preferred means of transport with an autonomous vehicle

who had been allocated the "Full Automation Using Driver for Extended Availability" (referred to as "Fully automated vehicle" in the following) and "Vehicle on Demand" use cases.

The answers of the 250 respondents were summarized and categorized by hand, then allotted specific connotations (see below). For "Fully automated vehicle" there were a total of 3750 entries; of these, 2587 (69 %) were invalid for various reasons because it was not possible to make out a reference to the question, for example. For Vehicle on Demand, there were also 3750 entries overall, of which 2512 (67 %) were unusable. Figure 31.2 shows the distribution of statements with various connotations: positive, ambivalent, negative or without connotation—the invalid entries have already been taken out at this point, the percentages refer to the remaining mentions.

While the majority of descriptions of Fully automated vehicle are positive, the same can only be said of 38 % of definitions applied to Vehicle on Demand. For these two use cases, 36 and 40 % of the statements respectively had negative connotations. A small portion of the perceptions (5 and 4 % respectively) were ambivalent, i.e. they could not clearly be connoted as positive or negative.

Overall, the qualities that the respondents attributed, independently of one another, to each of the two scenarios turned out to be relatively similar. Many answer categories are both equivalent in meaning and similar in their percentage distribution. We shall turn next

to some of the notable differences. We shall also examine the attributes given, where possible, for what instrumental, emotional, and symbolic characteristics are ascribed to autonomous vehicles.

Full Automation Using Driver for Extended Availability In the "positive assessments" segment, 17 % of statements were in the category of "comfortable," followed by "good" (13 %), "safe" (11 %), "relaxing" (10 %), and "modern" (10 %)—these proportions are given in Table 31.1. Among the "ambivalent assessments," 8 % of the answers came in the "luxury" category, and 15 % of all

Table 31.1 Answers in the description field "Fully automated vehicleis…"—summarized and categorized




"negative assessments" were because they viewed the scenarios as "expensive." In this negative segment, only the answer category of "not for me" was more highly represented, at 16 %. "Luxury" was not once mentioned in connection with Vehicle on Demand, however, and, at 7 % of all statements, "expensive" only came in at seventh place.

In the positive assessments segment, Fully automated vehicle was mainly associated with functional or instrumental aspects—vehicles such as these are described as "comfortable," "safe," "practical," "efficient," "for the mobility-impaired," "helpful," "environmentally friendly," and "flexible." Vehicle on Demand was also deemed "useful," although no-one deemed it "helpful." Regarding Fully automated vehicle, only the positive attributes of "relaxing," "brilliant," and "exciting" could be termed as emotional or affective. The same applies for Vehicle on Demand, though the relatively weaker connotations of "great" and "good" categories were expressed instead of "brilliant." As for the negative assessments, on the other hand, the distribution of functionally versus emotionally connoted aspects is reversed. "Weird," "boring," "dangerous," and "terrible" are clearly affective categories (and are joined in the case of Vehicle on Demand by "scary"), while "expensive" and "insufficiently developed" denote more functional aspects. Answer categories that may be assumed to have a symbolic connotation are scarcely to be found among the statements. Statements in the "modern," "interesting" or "luxury" categories most likely indicate that such autonomous vehicles are perceived and assessed in terms of aspects concerning the status manifested in the vehicles themselves.

Vehicle on Demand The summarized and categorized attributes given for the Vehicle on Demand can be seen in percentage in Table 31.2. The top answer categories in the area of "positive assessments" hardly differ from those for Fully automated vehicle. Only in first place do we see a completely new category of "useful," with 15 % of all statements made in this segment. After this, the respondents go on to describe the vehicle as "comfortable" (14 %), "relaxing" (13 %), "modern" (12 %), and "safe" (10 %). Eighteen percent of statements made about Vehicle on Demand have no judgment attached to them. Half of these come under the "no idea" category—only 20 % of respondents, in comparison, declared they had "no idea" about Fully automated vehicle. Only 2 % of statements in the "no valuation" column were in the category of "similar to other transport modes," whereas this applied to 12 % of those made about Fully automated vehicle. This category included entries such as "Fully automated vehicle is 'like the railroad'" or "Vehicle on Demand is 'a taxi.'"

A quarter of all negative statements on Vehicle on Demand fall under the highly emotionally cast categories of "scary" (10 %), "dangerous" (7 %), "weird" (6 %), and "terrible" (2 %). In contrast, not a single respondent found Fully automated vehicle to be "scary," and only 15 % termed it "weird" (11 %), "dangerous" (11 %), or "terrible" (1 %).

#### 31.3.1.1 Summary

Overall the survey clearly demonstrates that Vehicle on Demand is the subject of the greatest number of negative and fewest positive assessments. Of the 250 respondents allocated to this use case, 54 % could not imagine replacing their currently preferred mode of transport with a Vehicle on Demand. In direct comparison with Full Automation Using Driver for Extended Availability, Vehicle on Demand is described with rather negative statements, with a quarter of all descriptions even viewing it as scary, dangerous, weird, or terrible. Clearly, this means that fewer respondents could imagine using a Vehicle on Demand than one they can still drive themselves, as is shown by the number of statements professing "no idea."





The answer categories of "expensive" and "luxury," which are either especially or exclusively attributed to Full Automation, indicate that such vehicles are still clearly linked with individual private ownership. Vehicle on Demand, on the other hand, is compared with other transport modes little or not at all.

Classifying the statements on autonomous driving in terms of their instrumental, affective or symbolic aspects revealed that instrumental attributes predominate among positively connoted assessments. Strongly emotional statements, on the other hand, form the majority of negative accounts. Descriptions foregrounding the status character of autonomous vehicles, in contrast, were scarcely to be found. In the qualitative survey described in the following section, we shall take a closer look at the perceived negative aspects of autonomous driving, and ask which sociodemographic contexts they are embedded in. Such hostile attributes, in particular, are evidently strongly aligned with subject-related and affective issues as well as the context of car use and ownership, as the exploratory study has already shown (Chap. 29).

#### 31.3.2 Autonomous Driving in the Future: "Do We Really Want to Live Like That?"<sup>1</sup>

The following findings are based on three group discussions in Berlin whose composition varied each time. All participants had a high level of education; some were in academia, studying or working at a university or other research institutes. The discussions involved five, six, and seven participants respectively. All those involved were living in Berlin, seven of them were women. The gap between oldest and youngest was greatest in the first discussion round, with the youngest 20 years of age, the oldest 50. All participants regularly used a car, though not all of them owned one. At the end of each discussion, data on sociodemographics, transport behavior, and car use and ownership were collected. All those taking part had already heard of autonomous driving before the discussion sessions.

At the beginning of the session, the participants were given an illustrated narrative scenario of autonomous driving in the form of an A4 flyer. There were two different scenarios—one on "Full Automation Using Driver for Extended Availability," the other on "Vehicle on Demand." Each group was introduced to one of the scenarios, which they then considered within group-based introspection. The aim of this introspection is to make explicit the processes of "inward observation", that is to say, to consciously direct concentration and attention towards interior processes ([52]: 493, translation by the authors). Under the guidance of a research person, a group's participants address the research object in question and document their own inner processes and experiences independently of one another. Finally, they share what they have found via self-observation with the group without commenting or passing judgment on each other's accounts. In a second stage, the

<sup>1</sup> This question stems from a comment in the discussions described in this section.

group members—keen explore the topic further from hearing others' experiences—add to their reports. Together with the scenario, the participants received the following instructions:

You have just received a short description of a scenario involving the cars of the future – a short story on what the driving of tomorrow might look like. Please read the story carefully. Try to imagine yourself in what you read and think about your feelings, fantasies, and sensations – be open for anything and everything that crops up as you think about the topic! Please make notes on where your thoughts lead you.

The participants then each read out their notes in turn, as a so-called "introspection report." The reports are later transcribed and evaluated by means of qualitative heuristics. Unlike everyday procedures of discovery, which are frequently made unconsciously, qualitative heuristics is "rule-directed and supplied with a methodology," and takes the form of systematized and intersubjectively traceable search-and-find procedures ([53]: 226, translation by the authors). The method is based on four rules:


Furthermore, qualitative heuristics uses the so-called dialogic principle: A question is asked of an object (in the study, the transcribed introspection reports) which gives "answers." New questions are then asked from another perspective, or a different angle, and so the process continues. The research object and research person are thus in close dialogic contact, which also serves to soften the strict division between (research) subject and (research) object.

After producing introspection reports, the groups started open discussions, which were aligned on the implicit behavioral patterns (see [54]) in car usage and ownership. In now giving our results, however, we shall focus on what the participants conveyed in their introspection reports.

#### 31.3.3 Results

The scenarios allocated to the group discussion participants stimulated great interest in the topic, but also critical questioning. In what follows, we shall describe some examples of topics that had already proved significant in the earlier, exploratory survey. The introspection reports show an ambivalent attitude to autonomous driving that is comparable to the results of the study given in Chap. 29.

In addition, however, it became clearer which specific fears and worries relate to autonomous driving, and what social context it is seen in. We shall take a closer look at the range of hostility towards autonomous driving below—the results stem from both groups who were given the "Full Automation Using Driver for Extended Availability" scenario.

#### 31.3.3.1 Skepticism About a Future with Autonomous Vehicles

For the sake of completeness, it should be mentioned at this point that, in the scenario stories provided to the participants, the protagonist "Yvonne" used the time made free to her from not having to drive herself to pursue work activities (e.g. email correspondence), among other things. Although other activities were also covered alongside this, the story did tend to focus more on typical organizational activities (taking the kids to school, doing the shopping, etc.) than on leisure and relaxation pursuits (looking out the window, watching movies, sleeping/relaxing, etc.). It is therefore possible that skeptical and hostile attitudes on the part of (especially younger) group members towards autonomous driving could be down to the fact that life in the future was so clearly depicted as being full of structured and optimized everyday tasks.

On the other hand, the qualities and attributes ascribed to autonomous driving by the participants can clearly be classified in terms of the earlier surveys, with the same ascriptions cropping up again and again in both the exploratory study and the quantitative questionnaire.

# The "accelerated service society"

That it will in future be possible to spend time on other activities in an autonomous vehicle was largely viewed negatively in the discussions. In their orally read-out introspection reports, the participants expressed concern about no longer needing to concentrate on the driving task in future. This, they thought, could lead to private, leisure, and work activities becoming too closely mixed up with one another. Ultimately, this line of thought runs, technology may further a trend that many people today already identify as alarming: a society ever-more oriented towards performance and efficiency:

Johanna<sup>2</sup> "And private life and working life are mixing more and more and you become a total workaholic." Timo "This strain of having to do more and more things in the same place at the same time is increasing."

The freedom and the opportunity to occupy oneself during the car journey in other ways may result in pressure to put this time in the service of efficiency. Having to concentrate while driving conventionally, on the other hand, was painted in a positive light:

Johanna "That's actually a nice thing about driving, that you have to concentrate on it in the moment and you also do something with your hands, and you precisely aren't already checking emails from work. That starts when you're sat at your desk."

<sup>2</sup> The names of the participants have been changed to protect their anonymity, and the quotes have been translated.

# "This dependency on technology"

One further consequence linked to autonomous driving is a future dependency on technology, which may also entail an accompanying large degree of loss of control, which is viewed negatively. Technology dependence and loss of control are also seen as problematic because there is skepticism as to the reliability of a technology over whose decisions one will no longer have any influence:


Evidently, behind such worries lies a fundamental skepticism regarding technology, all the more so when it greatly impinges on individual safety, as in the case of autonomous driving:

Julian "Not even my kettle gets my blind trust, why should I then blindly trust my car with my life? I somehow find that incredibly disconcerting."

# Life is being "de-funned" and "you'll get idle"

The abolition of the driving task in autonomous vehicles is viewed highly critically. The main idea here is that a vehicle in which one does not drive oneself would curtail fun, spontaneity, individuality, flexibility, and control (it is interesting to note here that the participants had actually been given the Full Automation with Driver for Extended Availability story, where—as is described in the scenario—the driver can certainly still drive themselves whenever they like):

Johanna "What is actually then the difference to public transportation? Because what I actually always appreciate about a car is that it is in my own hands—that I can judge for myself. And if I'm running a little late, then I can step on the gas a little."

The "de-funning" (Timo) comment refers on the one hand very specifically to losing the fun of driving, but also to the lifestyle that could have the fun removed from it by autonomous driving:

Bettina "You'll stop needing to move so much because you'll be able to get picked up by the car everywhere; you'll get lazy, you'll get idle, you'll only ever take the car, because it doesn't matter if you're feeling ill or how you are – you can take the car for every trip you make."

# Social isolation: "Nobody needs anybody anymore".

The consequence of such "de-funning" and idleness is, in the view of the group members, that humans in the end will be replaced. "Nobody needs anybody anymore" (Inga), there would then be a machine for everything and, in this way, even thinking would be done for you:

Inga "The car drives, you no longer have to drive yourself. Food is delivered in one way or another, you cower a touch autistically in your apartment and grow dull, you don't have to think anymore, you google or subject yourself to cat videos. So you basically become completely stupid."

# System weaknesses: How truly "autonomous" are autonomous cars?

Overall, trust in the safety of autonomous vehicles appears to still be on the low side. This leads the participants into wide-ranging speculation: "How predictable are these cars, then?" and, "What about when the system breaks down and there is no internet access?" (Nico), "Can they be driven remotely?" (Thorsten), "What happens when this system gets hacked?" and, "Can these autonomous cars really be autonomous?" (Bettina), "Just where, then, is the evidence that the whole thing is going to be safe?" (Herta).

Behind such questions and statements, there is great insecurity regarding the still-unknown technology, and the possibility that dangers may accompany it. At the same time, the participants currently appear to be completely unclear as to who is behind the development of this technology and who is responsible for the system's safety. Who would be liable in case of an accident? Who would accept the damages? And most important: Who would accept responsibility in the ethical sense?

# "Social and economic consequences"

The examination of autonomous driving also turns up the worry that the technology will lead to job losses in various sectors (the automotive industry, taxi and delivery services, etc.). This is connected to the idea that autonomous vehicles will result in less variety across the spectrum of automobiles: "If you only have this large one" (Bettina), autonomous driving would in the end be accompanied by "greater monopolization" (Eddie).

#### 31.3.4 Summary

The issues raised in the group discussions concerning autonomous driving are embedded in a sociotechnological context that simultaneously uncovers negative and problem-centered ideas of society in future. Overall, the participants tend to take a hostile position vis-à-vis autonomous driving. Although positive aspects are also perceived, these are neither embedded in a specific usage context nor associated with positive ideas of future society at least not to the same extent as the negative ones.

Fears expressed in connection to a future with autonomous driving concern social isolation, social and economic consequences, over-reliance on technology, increasing idleness, and the pressure to keep up in a primarily performance-oriented society.

#### 31.4 Conclusion

The results from the quantitative questionnaire challenge the currently widespread assumption that autonomous driving can expect general openness and a high degree of acceptance (see [55–57]). Such openness is to be found in our study, but only when the question of what an autonomous vehicle is left unspecified. When the respondents are introduced to concrete use cases of autonomous driving, however, their assessments turn out to be far more negative. Assessments of Vehicle on Demand in particular suggest that some forms of autonomous driving are still relatively far away from people's specific ideas of what a vehicle is, and also their ideas of how to get around. Among other things, the negative assessment arises from people feeling more "exposed" to potential risks and dangers that may arise in a Vehicle on Demand than they feel able to "control", as they will no longer be able to control the vehicle themselves at all. Overall, it is currently debatable whether most people have any picture of what "autonomous driving" might mean. In the quantitative survey, 44 % of respondents still indicated they knew nothing about the subject, which clearly shows that awareness of it is far from penetrating all corners of society. These findings may also be taken as a sign that further studies more closely focused on the uses and applications of autonomous driving are required.

Furthermore, the negative associations of autonomous driving and autonomous vehicles in particular indicate that a use-oriented examination must also address specific user groups. Scenarios to be worked with should, for instance, take even greater account of the different users' living environments and systems of relevance. In this connection, it is at least clear that the level of trust placed in the still relatively unknown technology is on the low side—it is doubted that autonomous vehicles can be safe at all. At the same time, people currently have neither any specific idea what the technology is capable of nor who is behind its development and, in case of doubt, would accept responsibility for any potential damage, for example.

The present remarks have primarily looked at people's "subjective understanding" and reflexive or theoretical knowledge ([58]: 10 ff., [54]: 40 ff.) of autonomous driving and car use in general. The aim here was to trace how those acting deal reflexively with the topic, and thus also trace their motives, and then to ask: How is car use understood from a subjective perspective? What do people think about while using one? What intentions inform their behavior? This level of meaning forms the "orientation scheme" of the action-guiding knowledge structure. In future empirical work, it will also be necessary to decipher the orientation frameworks, i.e. the structure of action, and to ask how the praxis of car usage is produced in milieu- and culture-specific terms.

Whether autonomous driving will provoke a fundamental transformation in the system of automobility can currently hardly be predicted—up to now there has been little sign that the hegemony of automobile usage is in serious danger. Nevertheless, in the end it may be precisely such a new technology as autonomous driving that sustainably and irreversibly transforms our transport system. As the sociologist John Urry puts it: "Just as the internet and the mobile phone came from 'nowhere', so the tipping point here will emerge unpredictably, probably from a set of technologies or firms or governments not currently a center of the mobility industry and culture" ([59]: 272).

Open Access This chapter is distributed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, duplication, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, a link is provided to the Creative Commons license and any changes made are indicated.

The images or other third party material in this chapter are included in the work's Creative Commons license, unless indicated otherwise in the credit line; if such material is not included in the work's Creative Commons license and the respective action is not permitted by statutory regulation, users will need to obtain permission from the license holder to duplicate, adapt or reproduce the material.

#### References


# 32 Consumer Perceptions of Automated Driving Technologies: An Examination of Use Cases and Branding Strategies

David M. Woisetschläger

#### 32.1 Introduction

The automated, self-driving vehicle is one of the automobile industry's major ventures in the 21st century, driven by rapid advances in information technology [10, 11]. Technological innovations in the field of automated driving promise to contribute positively to the financial bottom line of automobile manufacturers [46]. Their integration as supplementary equipment increases the contribution margin of each car sold. In addition, automated mobility functions lay the foundations for new business models such as elaborated navigation services. While industry experts expect that it will take until the middle of the 21st century until fully automated cars will be available to the mass market [42, 45], automobile manufacturers have already begun to introduce supportive functions such as lane assistants and collision avoidance systems to the market [43, 50, 64, 66]. The promising market predictions suggest a general openness of customers towards using self-driving cars [51]. Besides automobile manufacturers and suppliers, technology firms such as Google are pinning their hopes on the predicted potential of automated driving technology [36, 37, 43].

The emergence of technology firms as competitors poses a threat to the established car manufacturers [58], as automated driving functions may require different organizational capabilities such as information technology, and faster innovation cycles, which are typically strengths of technology firms such as Apple or Google. Recent industry reports suggest that Google, as the new market entrant, is by far the brand associated most with self-driving cars [37]. Moreover, cars not yet in existence from technological firms receive similar levels of consideration in consumer surveys to those of established car manufacturers [37]. Therefore, on the one hand, established car manufacturers are concerned about how their current market positions can be defended against potential new entrants.

D.M. Woisetschläger (&)

Institute of Automotive Management and Industrial Production, Technische Universität Braunschweig, 38106 Braunschweig, Germany

On the other hand, cooperation with technological firms could help car manufacturers to differentiate their brands from their competitors', especially if partnerships are selective or exclusive. Announcements of partnerships, such as the cooperation between Audi and Apple, point in this direction.

At the same time, the role of branding as a critical success factor has been questioned in many instances. More precisely, the generally high relevance of brands in the context of cars has been recently put into question. Several studies suggest the diminishing role of automobiles relative to other products such as smartphones, at least for young customer segments [12]. The emergence and increasing popularity of access-based mobility systems such as car-sharing implies a trend towards a more utilitarian perspective on automobiles [57]. In contrast, some factors contributing to the high relevance of automobile brands remain relevant, irrespective of potential shifts in the preference hierarchy of product categories over time. This is because the relevance of a brand as influencing variable in a purchasing situation is generally seen as high when the purchase or use is associated with high levels of risk, information asymmetry, and symbolic value [34].

Existing literature provides comprehensive models for consumer goods, allowing an assessment of the relative importance of brands as predictor of purchasing behavior. In the particular context of high technology products, understanding of the role of brand knowledge is limited. Similarly, extensive knowledge exists about the effects of alternative brand strategies such as brand extensions (e.g., new services) or brand alliances, e.g., [68], and how new product introductions influence the parent brand perception, e.g., [2]. However, an examination for high technology products such as automated driving technology does not exist.

Against this background, this article contributes to the literature by developing a conceptual framework depicting relevant drivers of consumer acceptance and consequences of branding in the context of automated cars. Second, this article examines the relative importance of automobile manufacturer and technology brands for the acceptance of automated driving technology and services based on these technologies. Third, effects of the introduction of these technologies in a brand alliance are assessed. Fourth, the article conceptualizes how differing use-cases are perceived by potential customers. Based on the results of these empirical studies, implications for theory and management practice are derived.

#### 32.2 Theoretical Background

#### 32.2.1 Technology-Mediated Services, Service Robots, and Consumer Acceptance

The emerging phenomenon of assisted and automated driving has been primarily studied from technological, legal, political, and ethical perspectives (e.g., [5, 7, 14, 26 –28, 30, 35, 41, 48, 52, 55, 62]). Automated driving is defined as the shift of vehicle control from the driver to the vehicle [63], while the extent of automation depends on the level of vehicle automation. The National Highway Traffic Safety Administration (NHTSA) has defined five levels of vehicle automation based on the proportion of driver vs. vehicle control. In its highest form, the vehicle performs all safety-critical driving functions and monitors roadway conditions for an entire trip, disengaging the driver from all duties [63]. The vision of fully automated driving in its highest form is seen as promising in terms of business potential, safety, and traffic management [21]. Consequently, automobile manufacturers and technological players such as Apple or Google are investing in the continuous progress of assisting and automated driving technologies. While this development seems to be promising from a consumer perspective on the one hand, literature also suggests that consumers hold strong objections against automated driving technology [25].

While relatively few research articles exist which explicitly focus on consumer perceptions of automated driving technologies (e.g., [51]), different contextual areas such as studies on self-service technologies, and service robots point at perceived benefits and problems that are associated with the shift of control from consumers to technology.

Research on consumer acceptance of technology innovations is based on the technology acceptance model and its subsequent modifications and generalizations [8, 15 – 17, 47, 60, 65, 67]. Four distinct factors are conceptualized as antecedents of consumer acceptance and their subsequent behavior. The first antecedent, performance expectancy, refers to the perceived value of the technology. The second variable, effort expectancy, is defined as the degree of ease associated with the use of the system [65]. Third, social influences affecting individuals' perceptions of subjective norms towards using the technology influence consumer acceptance and adoption of a new technology. Fourth, facilitating conditions such as infrastructure or support contribute to consumer acceptance. One of the most critical factors of consumer acceptance towards technology innovations and technology-mediated services is the perception of control. Even in smart-interactive or remote services which imply a limited and indirect human interaction, perceived loss of control has been found to be negatively related to consumer acceptance ([70, 71]). In addition, trust in technology-mediated services has been found to be critical, especially when the service is perceived as risky [69, 70]. To conclude, research on technology acceptance and technology-mediated services has identified the importance of perceived value, effort, social influences, facilitating conditions such as perceived behavioral control. Trust has been identified as a key prerequisite.

In contrast to research on general technology acceptance and technology-mediated services, research on consumer perceptions of service robots is still at an early stage. The studied contexts predominantly focus on robots in smart home environments (e.g. [31, 49]) and healthcare appliances (e.g., [38]). Their research suggests that people prefer robots to act as trustworthy and controllable facilitators with a focus on interaction and cooperation rather than autonomously acting performers [23]. In a similar vein, research on robot companions suggests that people primarily see robots as assistants and serving machines with only a minority of the studied sample indicating that they would see them as peers or friends [18]. Research on robot companions recommends that the robot's role, appearance and behavior should be better matched to human requirements [9]. These findings point to the question of how an automated driving robot should relate to its human counterpart [54].

One central aspect of human-machine interaction is the perceived autonomy of the consumer [4, 29]. While the role of consumer autonomy has been addressed directly or indirectly by some studies, its criticality for consumer acceptance of automated technologies might not be fully captured in the contexts studied. Restricting or removing the autonomy of individuals could cause reactance, i.e., negative psychological and contrary behavioral responses of consumers as reactions to a perceived restriction of their personal freedoms [6, 44]. Automated driving systems could be perceived as a threat to drivers' autonomy, and reactance could arise in terms of consumer boycott intentions or low adoption rates. Presently, it is unclear if consumers are willing to accept a loss in control [56].

In the next section, findings of consumer-based studies on automated driving technology will be briefly summarized.

#### 32.2.2 Research on Consumer Acceptance of Automated Driving Technology

Only relatively few domain-specific studies exist which explicitly focus on consumer perceptions of automated driving systems. Because consumer knowledge of automated driving technology is sparse, a recent study analyzes reader comments to 15 distinct newspaper articles on automated driving in Germany and the US [25]. Their results provide evidence for the implied value propositions of flexibility and comfort, and comments relating to the safety and reliability of automated driving technology. The US comments in particular show negative responses relating to the restriction of freedom, pointing at the high relevance of consumer autonomy.

A second study that focuses on the contexts of automated medical diagnosis systems and automated driving provides descriptive evidence for the important role of prominent brands as risk-reducing mechanism [13]. Four distinct scenarios of future mobility are developed in a study using a set of experts from car manufacturers, public authorities, scientists, and environmental groups [19]. Two of the four scenarios relate to automated driving and distinguish between privately owned and access-based ("shared") automated vehicles. Both scenarios perform worse on the individualistic performance relative to the status quo, while performance advantages are seen on the systemic dimension.

A first study quantifying the effects of psychological antecedents on usage and purchase intentions finds generally positive values for usage intentions among a sample of 421 French consumers [51]. Their findings suggest significant positive influences of the general attitude towards automated driving, acceptability, and sensation (i.e., novelty) seeking on usage intentions. In addition, they find a gender effect revealing higher usage intentions for males. The latter effect is in line with existing literature on technology adoption, which generally finds male consumers to be more likely to be early adopters.

ances, and different use cases on purchase intention are discussed.

The present study attempts to build on these findings and conceptualizes a model which considers the key variables discussed in this section, the role of branding, and different use cases of automated driving. In the next chapter, the effects of brand equity, brand alli-

#### 32.3 Conceptual Model

#### 32.3.1 Brand Equity, Acceptance Drivers and Purchase Intention of Automated Cars

Brand equity (BE), defined as the added value endowed by the brand to the product [20], is regarded as an important concept for both business practice and academic research. Companies can gain competitive advantage through successful brands because they offer opportunity for differentiation, increased customer loyalty, and the possibility for charging price premiums [39]. Strong brands are characterized by measurable differences of what consumers know about these brands. According to Keller [33], consumer-based brand-knowledge consists of two dimensions, brand awareness and brand image. Brand awareness refers to the strength of a brand in memory, and the likelihood and ease with which the brand will be recognized or recalled under various conditions [59]. Brand image is defined as the perception of a brand as reflected by the brand associations held in consumer memory [33]. The favorability, strength, and uniqueness of brand image permit the brand to be strategically differentiated and positioned in the consumer's mind.

Brand equity has been found to be positively related to customer loyalty and willingness to pay. While strong brands are generally helpful for the marketing of products and services, the importance of brands has been found to vary across industry sectors, with a high relevance for the marketing of automobiles [22]. The relevance of branding strongly depends on the function of the brand as risk reducing factor, its function to enhance information efficiency, and its symbolic value. Since the purchase of a new car is an extensive decision involving comparably high expenditures and the collection of extensive information, strong brands can promote the purchasing process.

Besides the sparse empirical evidence for the risk-reducing effects of strong brands in the context of automated driving [13], the aforementioned brand functions should be positively related to consumer acceptance of automated driving systems. Knowledge and experience of consumers with automated driving technology is marginal. In combination with additional cost for automated driving abilities, consumers are likely to evaluate a purchase decision as risky. Strong brands can effectively help to reduce perceptions of risk.

In addition to a distinction between strong and weak automobile and tech-brands, introducing the respective automated driving system, several additional antecedents are considered in accordance to the aforementioned literature. More precisely, functional trust, the perceived convenience of the system, the price-value ratio, and the symbolic value of the system explain why consumers feature high/low levels of purchase intentions. These factors are likely to be influenced by the consumers' perceptions of safety and security of the system, the perceived autonomy, their privacy concerns [3], and brand attitude.

To control for differences on a consumer level which are independent from the presented scenario, the affinity of individuals towards adopting innovations, autonomy preference, and brand possession are considered below.

#### 32.3.2 Brand Alliances and Purchase Intention of Automated Cars

Besides introducing automated driving systems under the brand of a single automobile manufacturer or tech-firm alone, brand alliances are another option to consider. Brand alliances have become more frequent in a wide variety of industries [40]. One of the most significant findings in brand alliance research is that an unknown or unfavorable brand can benefit from joining an alliance with a known and favorable brand [53, 61]. Brand alliances consist of at least two brand entities. Horizontal and vertical brand alliances can be distinguished [1]. Vertical brand allies play different roles in the value chain (e.g. Intel as the supplier and Dell as the manufacturer), whereas horizontal brand allies belong to the same industry or similar product category (e.g. Häagen-Dazs and Baileys). For the present study, a vertical brand alliance between, e.g., an automobile brand and a tech-company is proposed to be a realistic scenario, as more and more alliances between car manufacturers and tech-companies have been announced in the media [32, 37]. Differences in purchase intentions depending on the presence/absence of a brand alliance of a strong/weak automobile manufacturer brand with a strong tech-brand will be assessed.

#### 32.3.3 Use Cases of Automated Driving and Their Effects on Purchase Intention

As mentioned above, the National Highway Traffic Safety Administration (NHTSA) distinguishes five levels of vehicle automation based on the proportion of driver vs. vehicle control [63]. To assess potential differences in purchase intention, different use cases which are comparable to automated driving on the fourth level of full self-driving automation are considered. In detail, the first study exposes the subjects to Interstate Pilot with Extended Availability Through Driver. While the second study extends Study 1 by considering brand alliances, two additional use cases are introduced in Study 3. The second use case is Automated Valet Parking and reflects comparably lower levels of personal physical risk and lower levels of personal autonomy loss. The third use case is on the fifth level of the NHTSA typology and suspends the driver from driving. The vehicle is a Vehicle on Demand. It is expected that the third use case is evaluated most critically, as it could involve higher levels of personal physical risk and a restraint of personal autonomy.

#### 32.4 Sample Description

The proposed model is split into a series of three studies and tested via an online consumer survey among members of an online panel provider. The sample was selected based on the requirements of holding a valid driver license, possession of a car, and comparability in terms of gender and age according to the German population between 18 and 70. Prior to the manipulation, respondents were asked to name the brand and model of the car that they would use primarily. In addition, they were questioned about their involvement in cars in general and had to indicate their familiarity with and attitude towards the brand(s) used in the respective scenario. Each subject was then randomly assigned and confronted with only one scenario. An Interstate Pilot was featured as automated driving system in the first two studies. Study three explicitly examines how consumers perceive alternative use cases (Automated Valet Parking, Vehicle on Demand). After exposure to one of the scenarios, respondents were asked to indicate their purchase intention for the optional automated driving system. Next they were asked to rate several factors that were hypothesized to be either positively or negatively related to their intention to consider the Interstate Pilot on offer. The survey concluded with manipulation checks, a self-assessment of the respondents driving capabilities, stress perception, subjective feelings about safety in traffic, and socio-economic characteristics of the respondents. The final sample contains 545 responses. 55.2 % of the respondents are male, the average age of the respondents is 42.83 (standard deviation (SD) = 12.62).

#### 32.5 Study 1

#### 32.5.1 Study Design, Data Collection, and Measures

The first study attempts to test the effects of brand equity on consumer acceptance using a laboratory experimental design, in which we asked respondents to read a fictitious press release indicating the announcement of Interstate Pilot Using Driver for Extended Availability. In order to isolate potential effects of brand equity differences (i.e., strong vs. weak brands) and potential differences in credibility of the actors (i.e., automobile firms vs. new market entrants), different press releases for different players were designed. A 2 × 2 between-subjects experimental design was constructed in which the different scenarios only differ in terms of the selected brand, while everything else is held constant. Figure 32.1 shows the press release used in the first study.

In total, 239 respondents took part in Survey 1. The participants are roughly equally distributed across the two additional scenarios. Cell-sizes ranged from 49 to 65 respondents and no differences in age and gender distribution were found across cells. To test if the manipulations of different levels of brand equity and competence of the industry actors were perceived differently by the respondents, manipulation checks were conducted. To examine if the respondents perceived the brands differently, brand attitude was measured as

Fig. 32.1 Fictitious press release used in Study 1. Image rights belong to the author

the manipulation check variable. Brand attitude reflects the favorability and strength of brand associations, one of the two dimensions of brand equity. As automobile brands generally perform well in brand awareness (recall or recognition) scores, brand attitude is a more reliable variable to measure differences in brand equity. Brand attitude was measured with three items, capturing the favorability, likability, and performance of the brand. Results reveal significant differences between the strong (mean value (MV) = 5.40; SD = 1.44) and weak (MV = 4.55; SD = 1.55) car manufacturer brands (p < 0.05) and the strong (MV = 5.54; SD = 0.99) and weak (MV = 3.75; SD = 1.79) technology brands (p < 0.01). In addition to the manipulations, brand possession and differences in individual innovativeness were included as co-variables. The dependent variable purchase intention was measured with three items indicating each individual's likelihood to purchase/consider a car with the particular brand and Interstate Pilot (for the indicated price of €3500). The price was set in analogy to current prices for combined systems for assisted driving. The scale displays excellent reliability (Cronbach's α = 0.94).

To explain the reasons for varying levels of purchase intentions, several proposed drivers and barriers were measured on a perceptual level. Respondents were asked to evaluate the proposed value of the system (i.e., convenience). In addition, functional trust, price/value ratio, and prestige were included as mediators. These mediators are influenced by autonomy perceptions, autonomy preference, privacy concerns, safety and security perceptions, and brand attitude. The model also controls for brand possession and if respondents considered themselves to be early or late adopters of innovations. The results of the confirmatory factor analyses (CFA) suggest valid and reliable scales. In addition, the discriminant validity of the constructs was assessed [24]. The average variance extracted (AVE) for each construct exceeds the shared variance with all other constructs. Hence, we conclude sufficient reliability and validity for the measures in this study. The measurement properties and scale items are available upon request.

#### 32.5.2 Results

On average, intentions to purchase the optional Interstate Pilot Using Driver for Extended Availability are evaluated to be modest (MV = 3.30; SD = 1.81), a finding which in line with generally high skepticism towards the adoption of innovations. From the 239 respondents who were confronted with one of the four scenarios, a total of 17.2 % indicates high or very high intentions to purchase the featured automated driving system. However, more than a third of the respondents (39.1 %) of the sample replied that they would be (highly) unlikely to adopt this system in the near future. These findings indicate that there is a significantly sized market segment of early adopters but reveals acceptance problems at the same time. Therefore, the next step assesses whether these findings differ depending on the provider's brand equity and industry sector.

An analysis of variance (ANOVA) was conducted to test the hypothesized effects. The ANOVA results show a significant main effect for brand equity (p < 0.01), and non-significant effects for the industry sector of the firm (i.e., automobile manufacturer vs. tech company) and the interaction term. In addition, differences in individuals' general innovation affinity and car possession significantly explain differences in the observed levels of purchase intention. The effects of the manipulations on purchase intention are displayed in Fig. 32.2.

The findings indicate that purchase intention is influenced by brand equity, irrespective of the affiliation of the respective company to the sector of automobile manufacturers or tech-companies. The values for the strong automobile brand (MV = 3.67; SD = 1.91) and the strong tech-brand (MV = 3.63; SD = 1.70) are on a similar level. In a similar vein, the difference in purchase intentions for the comparably weaker automobile brand (MV = 3.01; SD = 1.81) and the weaker tech brand (MV = 2.88; SD = 1.82) is insignificant as well.

To shed light on the relative impact of antecedents of purchase intention, a structural equation model was estimated. The results reveal that functional trust is the most relevant driver of purchase intention (ß = 0.432; p < 0.01), followed by the perceived convenience of the described interstate pilot (ß = 0.237, p < 0.01). The other mediators are significant, but less important (price-value ratio ß = 0.124, p < 0.05; symbolic value ß = 0.117, p < 0.05; and general innovation affinity ß = 0.169, p < 0.01). In total 67.9 % in variance of purchase intention are explained.

Functional trust is significantly and positively influenced by safety and security perceptions (ß = 0.383, p < 0.01), perceived autonomy (ß = 0.327, p < 0.01), general innovation affinity (ß = 0.163, p < 0.01), and brand attitude (ß = 0.130, p < 0.01).

Fig. 32.2 Purchase intention for Interstate Pilot offered by different brands. Bildrechte: Urheberrecht beim Autor

Autonomy preference is significantly negatively related to purchase intention (ß = −0.138, p < 0.01). Contrary to expectations, differences in privacy concerns are not significantly related to purchase intention (ß = 0.012, p > 0.1). These factors explain a total of 71.8 % in variance of functional trust. The key value proposition of Interstate Pilot is positively affected by respondents' perceptions of autonomy (ß = 0.598, p < 0.01), and negatively by autonomy preference (ß = −0.298, p < 0.01). Brand attitude (ß = 0.238, p < 0.01) is positively related to convenience perception, while all other factors remain insignificant. The antecedents explain 63.3 % in variance of convenience. Similarly, the price-value ratio is strongly affected by autonomy (ß = 0.450, p < 0.01) and autonomy preference (ß = −0.122, p < 0.05). Moreover, innovation-oriented consumers evaluate the price-value ratio more favorably (ß = 0.241, p < 0.01). Brand attitude is also positively related to price-value perceptions (ß = 0.131, p < 0.05). A total of 42.8 % in variance of price-value ratio are explained by the model. Symbolic value is significantly affected by differences in brand attitude (ß = 0.575, p < 0.01), explaining a total of 33.1 % in variance.

The results of the first study offer relevant insights into the drivers of purchase intention of Interstate Pilot Using Driver for Extended Availability. Prior to convenience, functional trust is seen as the most critical factor affecting consideration of the system. Besides promoting the central value proposition (i.e., convenience value), marketing managers should emphasize the perceptions of safety, security, and autonomy, since these variables are indirectly related to the key outcome variable, purchase intention. Strong brands can promote the adoption of automated driving on highways, as differences in brand attitude are positively related to symbolic value, price-value perceptions, convenience, and functional trust. As shown above, the respondents were not found to distinguish between automobile and tech-brands in general, but rather between strong and weak brands. Hence, strong tech-brands like Apple or Google can significantly endanger the position of established manufacturers, especially those with weak brands. Therefore, Study 2 analyzes if a weak (strong) automobile brand can benefit from joining a brand alliance with a strong tech brand.

#### 32.6 Study 2

#### 32.6.1 Study Design, Data Collection, and Measures

The second study attempts to test if consumer acceptance is different when the automated driving system on offer is branded by the OEM and a technology partner, constituting a brand-alliance. The brand alliance settings are compared to the results of the single-brand strategies documented in Study 1. Similarly to Study 1, each respondent was exposed to one of the two additional scenarios, in which we asked respondents to read a fictitious press release indicating the announcement of an Interstate Pilot Using Driver for Extended Availability. The press release was modified by adding the second brand name into the header and by integrating both brand names into the text.

The proposed model was tested via an online consumer survey among members of an online panel provider. The same sample selection criteria were used as documented in Study 1 above and the survey had the identical structure.

In addition to the participants in the first study, 92 respondents took part in the survey for Study 2. The participants were distributed roughly equally across the two additional scenarios. Cell-sizes ranged from 45 to 47 respondents and no differences in age and gender distribution were found across cells. Manipulation checks of brand attitude reveal significant differences (p < 0.01) between the strong automobile brand (MV = 5.35; SD = 1.62) and the weak automobile brand (MV = 4.74; SD = 1.49). In addition, the tech brand used in the brand-alliance scenarios is evaluated significantly better than the weak automobile brand, whereas the difference to the strong automobile brand is insignificant (MV = 5.50; SD = 1.01).

Similarly to Study 1, purchase intention was measured with three items and the same co-variables were included. The structural model was also replicated in order to identify possible explanatory variables for the observed differences in purchase intention. The measurement properties suggest valid and reliable scales.

#### 32.6.2 Results

An analysis of variance (ANOVA) was conducted to test the hypothesized effects. The ANOVA results show a significant main effect for co-branding (p < 0.01), and a significant effect of innovation affinity on purchase intention. The results show a significant negative effect of co-branding on purchase intention. The dependent variable drops from 3.67 to 2.67 (SD = 1.93) for the strong car brand, and from 3.01 to 2.78 (SD = 1.80) for the weak car brand. With regard to the results of the manipulation check, these findings are against expectations. At least for the weak car-brand, positive supporting effects of being linked to a more attractive tech-brand would have been plausible. To analyze potential explanations for the observed effects, a structural equation model was estimated. The results exhibit significant differences to the model reported in Study 1. In detail, functional trust plays an even more important role for purchase intention in the case of a brand alliance between an automobile brand and a tech brand (ß = 0.747, p < 0.01). Price-value ratio also shows a significant effect on purchase intention (ß = 0.180, p < 0.01), while all other remaining direct effects are insignificant. In addition, the impact of safety and security perceptions on functional trust is larger in the brand-alliance setting (ß = 0.550, p < 0.01). Autonomy perceptions also have a significant but comparably smaller effect on functional trust (ß = 0.208, p < 0.05).

These findings suggest that consumers' evaluations of the automated driving system are not improved by a co-branding strategy with a tech brand, which is evaluated similarly or better relatively to the automobile brand. Rather, consumers form their purchase intention based on the trustworthiness of the system, which is mainly influenced by their safety and security concerns and the perception of autonomy. In the case of the strong car brand, the safety and security of the automated driving system are evaluated significantly more negatively (p < 0.05) in a brand alliance with a tech brand (MV = 4.15; SD = 1.82) relative to a single-brand strategy (MV = 4.94; SD = 1.65). For the weak car brand, this effect is insignificant. Overall, the findings of Study 2 indicate that automobile manufacturers and technology firms such as Apple or Google need to emphasize the specific benefits of potential brand alliances. Consumers perceive such partnerships as riskier and functional trust becomes a prerequisite of the adoption of automated driving systems.

In order to test the generalizability of these findings, Study 3 replicates Study 2 using two alternative use cases of automated driving.

#### 32.7 Study 3

#### 32.7.1 Study Design, Data Collection, and Measures

The third study attempts to measure differential effects of alternative scenarios of automated driving, each branded with a weak or strong brand. In addition to the Interstate Pilot Using Driver for Extended Availability used as stimulus in the first and second study, two scenarios reflecting low personal risk (Autonomous Valet Parking) and high personal risk (Vehicle on Demand) were designed. Table 32.1 shows the press releases used in the third study.

A strong and a weak OEM-brand were both used as single brands, constituting two scenarios for each additional use-case. Similarly to studies 1 and 2, each respondent was Table 32.1 Use case descriptions utilized in Study 3

Use case 2: fully automated vehicle, low personal risk (Autonomous Valet Parking)

# [Brand] presents fully automated parking—

market launch by the middle of 2015 Berlin (dpa). As [brand] announced today, an optional module named APT ("Automated Parking Technology") will be offered in the course of the yearly car updates by the middle of 2015. The module will be offered for all car models of [brand] and allows fully automated parking

The driver can simply leave the car at the target destination and activate the APT system via smartphone. APT will independently search for a parking space at no charge within a radius of 5 km. All driving functions will be taken over by APT at a manually adjustable speed of up to 30 km/h. "Drivers can directly reach their targets in city centers, the car takes care of the parking task," said Herbert Mueller, chairman of [brand]. After a business appointment or a visit to a theater, the car can be activated and ordered to any location via smartphone. The car remains locked for third parties throughout the process, with the exemption of the Police

APT will be available by the middle of 2015 as an optional component for all car models of [brand] for a price of €3500. "By introducing fully automated parking, [brand] provides a valuable contribution to stress reduction when searching for scarce parking spaces," the car manager pointed out

Use case 3: fully automated vehicle, high personal risk (Vehicle on Demand)

#### [Brand] presents fully automated driving market launch by the middle of 2015 Berlin (dpa). As [brand] announced today, an optional module named ADR ("Automated Driving Robot") will be offered in the course of the yearly car updates by the middle of 2015. The module will be offered for all car

models of [brand] and allows fully automated

driving on all German streets The communication between passenger and car is realized by the navigation system. After entering the target destination, the car is moved automatically by the system, allowing no steering actions by the passenger. Only the target destination can be modified and an emergency stop function allows a safe stop and exit. All driving functions will be taken over by ADX at a manually adjustable speed of up to 160 km/h. "The driver becomes a passenger and can use the time to relax or for work," said Herbert Mueller, chairman of [brand]. "Our research has shown that driving robots react more reliably in dangerous situations than human drivers," Müller continued. Especially after a period of inactivity, the danger of overreacting passengers would be high, therefore [brand] would consequently rely on fully automated driving. Nevertheless, the engineers of [brand] have also thought about emergency situations. Passengers can intervene at any time. The ADR will then approach a secure stopping point

ADR will be available by the middle of 2015 as an optional component for all car models of [brand] for a price of €3500. "By introducing fully automated driving, [brand] provides a valuable contribution to the increase of safety on German streets," the car manager pointed out

exposed to one of the four additional scenarios, in which the respondents were asked to read a fictitious press release indicating the announcement of Autonomous Valet Parking or Vehicle on Demand.

The proposed model was tested via an online consumer survey among members of an online panel provider. The same sample selection criteria were used as documented in Studies 1 and 2 and the survey had the identical structure.

In total, 342 respondents constitute the sample for the third study. The participants are roughly equally distributed across the six scenarios (three use cases \* strong/weak brand). Cell-sizes ranged from 49 to 65 respondents and no differences in age and gender distribution were found across cells. In accordance to the prior studies, purchase intention was measured with three items and the same co-variables were included. The structural model was also replicated in order to identify possible explanatory variables for the observed differences in purchase intention. The measurement properties suggest valid and reliable scales.

#### 32.7.2 Results

The two additional use cases are perceived slightly differently relative to the Interstate Pilot Using Driver for Extended Availability used in the studies 1 and 2. On average, the intention to purchase a fully automated parking assistant is about similar (MV = 3.59; SD = 1.93), whereas the fully automated driving robot receives significantly lower evaluations (MV = 2.97; SD = 1.83). A share of 18.6 % of the 113 respondents who were asked to evaluate the fully automated parking assistant indicates very high or high intentions to purchase the system. This is slightly higher than the 17.2 % of the respondents which indicated a (very) high likelihood to purchase Interstate Pilot as featured in Study 1. The share of 38.9 % of the respondents stating that they are (very) likely to refuse to buy the featured automated parking assistant is on the same level as the share of skeptics in Study 1. As the comparison of the mean values of purchase intentions already suggests, the share of respondents with (very) high intentions to purchase a fully automated driving robot is much lower (10.9 %). Nearly half of the sample of 101 respondents stated that they are (highly) unlikely to purchase the featured system in the near future. These findings point to differences in purchase intentions caused by the different use cases. In a next step, the effects of the use case and of brand equity are assessed in an ANOVA. The results reveal a significant main effect of use case (p < 0.05), while the main effects of brand equity and the interaction term remain insignificant.

To analyze potential explanations for the observed differences, a multi-group structural equation model was estimated. The results exhibit significant differences of the model depending on the respective use case. More specifically, the relative importance of functional trust (ß = 0.170, p < 0.1) and prestige (ß = 0.08, p > 0.1) are much lower or insignificant in case of a fully automated parking assistant. The effect of price-value ratio is slightly higher (ß = 0.146, p < 0.1) and innovation affinity is much less relevant (ß = 0.122, p < 0.1). The most relevant driver of purchase intention is perceived convenience (ß = 0.445, p < 0.01). The formation of functional trust, however, depends more strongly on the evaluation of safety and security (ß = 0.469, p < 0.01) and autonomy preference (ß = −0.165, p < 0.1), whereas all other antecedents remain at comparable effect sizes. In addition, the evaluation of convenience as a central value proposition depends more strongly on whether respondents value the autonomy obtained from automated parking (ß = 0.640, p < 0.01) and if their general autonomy preference is high (ß = −0.436, p < 0.01). In sum, the successful introduction of a fully automated parking assistant primarily depends on a suitable communication of its convenience value. In comparison to the other use cases, functional concerns play a less important role.

The intention to buy a fully automated driving robot depends strongly on functional trust (ß = 0.477, p < 0.01). Furthermore, the perceived symbolic value is a more relevant antecedent of purchase intention (ß = 0.254, p < 0.05), relative to the other two use cases. The perception of convenience and the remaining antecedents are less relevant. The evaluation of functional trust is formed differently than in the other two use cases. While safety and security concerns show a weaker influence on functional trust (ß = 0.256, p < 0.05), perceptions of autonomy (ß = 0.447, p < 0.01) and autonomy preference (ß = −0.260, p < 0.01) reveal strong effects. The formation of convenience perceptions is by far less dependent on the perception of autonomy (ß = 0.380, p < 0.01), but relies significantly more on autonomy preferences (ß = −0.394, p < 0.01). The results indicate strong self-selection effects, as consumers preferring high degrees of autonomy will refrain from purchasing a fully automated driving robot. In light of the low level of purchase intention, this scenario appears to be unattractive for most respondents.

#### 32.8 Discussion and Future Research

The results obtained from the three experimental studies offer valuable insights into drivers of individuals' purchase intention of automated cars. In contrast to the generally positive values for usage intentions reported in a French study [51], the present analysis reveals that Germans are—on average—quite skeptical towards automated driving technologies. As the two studies differ considerably in terms of the methodology applied and the amount of information given to the respondents, an interpretation of differences on a national level is not possible. However, every sixth respondent indicates very high or high intentions to purchase Interstate Pilot or Autonomous Valet Parking, irrespective of the limited information available. Every tenth person even considers high purchase intentions for fully automated driving robots (vehicle on Demand) which were said to exclude the passenger from any driving operations. These figures are comparable to other consumer studies measuring consideration values for technology innovations before market introduction. If the described systems are perceived as useful and reliable after their introduction, acceptance figures are expected to rise over time.

Irrespective of the psychological value dimensions influencing purchase consideration levels, differences in the general innovation affinity partially explain why consumers consider purchasing the featured automated driving systems. In addition, respondents with high levels of autonomy preference react more negatively towards this technology. Besides autonomy preference, differences in autonomy perception resulting from the use cases also account for the observed variance in purchase intention. Providers of automated cars must therefore carefully segment their target markets and keep non-automated car offers for the conservative segments.

The remaining findings of the three studies and the resulting conclusions are summarized in Table 32.2.

The present study also has several limitations, which can be seen as a venue for future research. First, the empirical study was conducted based on a representative sample of the German population according to age and gender distribution. However, respondents were asked to indicate their purchase intention not relating to their currently owned car brand. Instead, they were asked to state their purchase intention towards a specific offer of a brand. Potential differences caused by brand possession and brand attitude were controlled in the model. Nevertheless, future research should attempt to focus on specific car segments with the corresponding target group to obtain more realistic results. Second, the nature of the laboratory experiment implies high levels of internal validity, but limited external validity. Future studies should strive towards a more realistic and vivid communication of the nature of automated driving, e.g., by using video stimuli rather than press releases employed in the present article. Third, future research should study how critical incidents resulting from automated driving are perceived by consumers and how their perceptions interrelate with the involved brand. Fourth, the study should be replicated in other settings (i.e., countries) to explore its boundary conditions.



Open Access This chapter is distributed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits use, duplication, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, a link is provided to the Creative Commons license and any changes made are indicated.

The images or other third party material in this chapter are included in the work's Creative Commons license, unless indicated otherwise in the credit line; if such material is not included in the work's Creative Commons license and the respective action is not permitted by statutory regulation, users will need to obtain permission from the license holder to duplicate, adapt or reproduce the material.

#### References

