The RESPONSE 3 subproject is elaborating a European Code of Practice for the development and validation for an accelerated market introduction of ADAS. This implies the establishment of "principles" for the development and evaluation of ADAS on a voluntary basis, as a result of a common agreement between all involved partners and stakeholders. The Code of Practice will help manufacturers to "safely" introduce new safety applications through an integrated perspective on human, system and legal aspects. RESPONSE 3 started in October 2004.
RESPONSE will develop a widely acceptable Code of Practice for "safe" ADAS development and testing to help mitigate liability risks when introducing new preventive safety applications on the market. A prerequisite of building and implementing a Code of Practice is a broad consensus between the automotive industry itself, as well as between industry and authorities. Obtaining the agreement on these development guidelines between all stakeholders is an important further objective, as it forms the basis for the acceptance and internal translation to the system design and validation processes.
What is the legal basis on which an application in the field of active and preventive safety is considered? The advanced driver assistance system (ADAS) can have a major influence on the driver-vehicle-system - a revolutionary change to the driver-vehicle-systems currently available in state-of-the-art vehicles. Today, driver-vehicle-systems are solely based on driver reactions in critical situations.
What are the requirements for ADAS which could assist in normal driving tasks or help and intervene in critical traffic situations? With respect to liability issues, vehicle manufacturers have already had experience with the introduction of passive safety systems, which led to an increase in product liability claims regarding for example the ignition of airbags (too early, too late, should not have in a specific situation, should have in a specific situation...). In many cases, customer complaints have been impossible to validate.
Compared with ADAS applications, passive safety systems are relatively easy to describe in their function and do not have any direct interaction with the driving task.
The ADAS applications vary greatly with respect to their level of assistance - from pure information and warning to assistance and intervention in critical situations. This also implies different risk levels for each type of application. In general, there is no risk scale for possible malfunctions which can be regarded by an OEM as an accepted level. Moreover, there is no related table for the OEM that shows the implications for the development and validation process. If a specific risk has been identified for a specific application, the OEM does not have any approved guidelines to deal with this situation.
In particular, all ADAS applications that have an interaction with the driver and driver tasks are difficult to assess with respect to their safe function in each and every driving situation. When proving the robustness of the realised Human Machine Interaction-concept of an ADAS application, it is necessary to look at which properties of the least informed consumer have to be taken in to account as well as what must be considered as customer expectation and the foreseeable misuse that could have a major impact on all possible liability claims. The possible misunderstanding of preventive safety applications might also lead to an increased risk of product recall campaigns.
Having the driver in the loop makes it very difficult to give absolute design guidelines, i.e. it is not possible at the moment to define comparable guidelines on driver behaviour that would be valid for the entire variety of possible PREVENTIVE SAFETY systems. There is no validated model to which an OEM can refer that answers the question “What is the behaviour of a representative driver?”. There are still no guidelines to assist the OEM in deciding what is an acceptable risk of a particular application. It has become clear that conventional design standards are not an adequate answer to the complexity of advanced driver assistance systems. Therefore, guidelines must be introduced which define the duty of care necessary for the development of a reasonably safe product.
Financial risk, liability risks and risks related with brand image are preventing a successful market introduction of preventive and active safety systems. RESPONSE 3 - as a continuation of the European initiatives RESPONSE 1 and 2 - intends to provide tools and common understanding for the vehicle industry to overcome and manage these risks. It is important that a clear understanding of the concepts of "reasonable safety" and "duty of care" is translated into robust guidelines to develop and test ADAS with respect to their technological safety and safety of usage.
The European research project Response 1 (1998-2000) carried out detailed analyses of “non-technical” questions regarding market introduction. An important conclusion of Response 1 was that ADAS systems remain “unproblematic” from the legal and the users point of view if they can be controlled and/or overruled by the driver at any time. This understanding has lead to the wide dissemination of the "driver in the loop"' concept of Advanced Driver Assistance systems.
In RESPONSE 1, two other main topics were looked at: the "reasonable safety" of the product (the requirements of a safely designed ADAS) and the "duty of care" of the development process (the necessary elements of the underlying development process). To meet the requirements of a "reasonable safe" product and a corresponding process, it is intended to compose a Code of Practice of a "safe" ADAS development and evaluation.
On a generic level, the Code of Practice will contain descriptions of procedures and processes for analysis of user requirements, definition of systems according to these requirements, and validation procedures showing that these safety-related customer requirements are fulfilled. The CoP will have a special focus on an integrated “system safety - human factors” approach and provide the basis for future standardisation efforts. It will also give advice on the legal questions regarding product liability, driver responsibility, and manufacturer’s liability.
Regarding further development of safety systems (based on environmental sensors such as radar, lidar, video etc.), different safety issues for the development and validation of relevant systems become evident. These considerations lead to a wider interpretation of the term “Acceptability” of ADAS. The main topics are:
- Technical acceptability (making complex technology safe, limits of sensor technology, system safety)
- Safety of usage (fuzzy logic of human factors)
- Reliability (as a function of safety / customer benefit / cost)
- Driving at the limits - Overridability - Responsibility? Legal view; shift of liability to the manufacturer?
- Risk Acceptance - Public Opinion – Does one exist?
- Safety (Risk) Evaluation - How safe is safe enough?
With the Code of Practice for ADAS, RESPONSE 3 aims to overcome the reservations of the OEMs regarding the evaluation of the safety issues of preventive safety applications. The responsibility of the OEM to the public and the authorities must be fulfilled by the overall safety benefits of ADAS.
Events and Milestones
M34: Code of Practice for development and validation of ADAS
With the wide acceptance of the Code of Practice, RESPONSE 3 will contribute to an accelerated market introduction of Advanced Driver Assistance Systems whic includes preventive safety applications. It will be a key instrument to help the engineers develop safe products, industry to control their risks, and the authorities to understand and follow the development and testing processes.
Dr Juergen Schwarz
e-mail: [email protected]
ADAC, Autocruise, BASt, Continental, Jaguar, Thomas Miller & Co LTD, NavTech, Opel, Siemens VDO, TÜV,
JARI (Japanese Automotive Research Institute)
AHSRA (Advanced cruise-assist Highway Systems Research Association), Japan