Bob Gourley - Preliminary Statement of Policy Concerning Automated Vehicles lyrics

America is at a historic turning point for automotive travel. Motor vehicles and drivers' relationships with them are likely to change significantly in the next ten to twenty years, perhaps more than they have changed in the last one hundred years. Recent and continuing advances in automotive technology and current research on and testing of exciting vehicle innovations have created completely new possibilities for improving highway safety, increasing environmental benefits, expanding mobility, and creating new economic opportunities for jobs and investment. The United States is on the threshold of a period of dramatic change in the capabilities of, and expectations for, the vehicles we drive. In fact, many are inspired by the vision that the vehicles will do the driving for us. Although this Statement focuses on the enormous safety potential of these new technologies, they offer an even wider range of possible benefits. Vehicle control systems that automatically accelerate and brake with the flow of traffic can conserve fuel more efficiently than the average driver. By eliminating a large number of vehicle crashes, highly effective crash avoidance technologies can reduce fuel consumption by also eliminating the traffic congestion that crashes cause every day on our roads. Reductions in fuel consumption, of course, yield corresponding reductions in greenhouse gas emissions. To the extent vehicles can communicate with each other and with the highway infrastructure, the potential for safer and more efficient driving will be increased even more. Drivers—or vehicles themselves—will be able to make more intelligent route selections based on weather and traffic data received by the vehicle in real time. Mobility for those with a range of disabilities will be greatly enhanced if the basic driving functions can be safely performed by the vehicle itself, opening new windows for millions of people. Preventing significant numbers of crashes will, in addition to relieving the enormous emotional toll on families, also greatly reduce the enormous related societal costs—lives lost, hospital stays, days of work missed, and property damage—that total in the hundreds of billions of dollars each year. Moreover, these dramatic changes will offer significant new opportunities for investments in the underlying technologies and employment in the various industries that develop, manufacture, and maintain them. To help ensure that these economic, environmental, mobility, and safety benefits are more likely to emerge from the current streams of innovation, all interested parties need to work cooperatively. The National Highway Safety Administration (NHTSA) looks forward to working with other stakeholders to engender that cooperation and chart a steady course forward. This statement, however, focuses on the related safety issues that NHTSA is responsible for addressing. We are issuing this statement to help states implement this technology safely so that its full benefits can be realized. Articulating our views on these safety issues now is, we believe, a very important element of charting that course, for confusion or disarray on the safety issues would be a significant impediment to the development of these technologies. Moreover, as several states step forward to become test beds for some of the most innovative automotive technologies, they, as well as companies seeking to develop the technologies, have asked NHTSA to provide recommendations on how to safely conduct such testing on public highways. Accordingly, while the larger dialogue with the many stakeholders progresses and takes further shape, we present here our views on the major safety issues related to the development of vehicle automation. A. NHTSA's Safety Role and the Purposes of this Statement NHTSA is responsible for developing, setting, and enforcing Federal motor vehicle safety standards (FMVSSs) and regulations for motor vehicles and motor vehicle equipment. NHTSA also is responsible for issuing and enforcing motor vehicle fuel economy standards and in exercising that authority works closely with the Environmental Protection Agency, which has parallel authority with regard to greenhouse gas emissions from vehicles. The purpose of the agency's safety programs is to reduce or mitigate motor vehicle crashes and their attendant d**hs and injuries. NHTSA is encouraged by the new automated vehicle technologies being developed and implemented by automakers and others. These technologies have the potential to reduce significantly the many thousands of fatalities and injuries that occur each year as a result of motor vehicle crashes. As NHTSA's research and experience develop, NHTSA will determine whether it should encourage and/or require application of the most promising crash avoidance technologies through regulation. This document: • Provides a description of developments in automated driving and explains the levels of automation defined by NHTSA. • Provides an overview of NHTSA's automated research program. • Provides recommended principles that States may wish to apply as part of their considerations for driverless vehicle operation, especially with respect to testing and licensing. NHTSA intends to regularly review and update this document as necessary to provide additional clarity, reflect new findings, and outline any regulatory activity that the agency may pursue with respect to automated vehicles. As discussed above, we look forward to working with stakeholders on these issues. Recently, research activities by several companies to develop “autonomous” (self-driving) vehicles that can perform certain driving functions automatically have captured the nation's attention. Several states have acted to encourage development of self-driving vehicles by enacting legislation that expressly permits their operation under certain conditions and a significant number of additional states are considering similar legislation. At the same time, vehicle manufacturers have begun to offer or announced plans to offer in the next several model years certain types of automated crash avoidance safety systems as features on new vehicles. NHTSA has been actively involved in researching these advanced technologies, which rely on in-vehicle sensors and cameras to obtain safety-critical data. For example, NHTSA is engaged in research to evaluate the effectiveness of currently available automated braking systems in avoiding or mitigating crashes. As part of this research, the agency is developing test procedures to evaluate the technologies and methods to a**ess their safety benefits. Also, NHTSA and other Department of Transportation agencies, in conjunction with the auto industry, have been conducting in-depth research and demonstration of vehicle-to-vehicle (V2V) communications technology, which offers substantial crash avoidance possibilities, particularly when linked to active in-vehicle crash avoidance systems. Accordingly, three distinct but related streams of technological change and development are occurring simultaneously: (1) in-vehicle crash avoidance systems that provide warnings and/or limited automated control of safety functions; (2) V2V communications that support various crash avoidance applications; and (3) self-driving vehicles. Given the confluence of these three streams of innovation, a fair amount of confusion has developed in making distinctions between different concepts and in finding commonly understood descriptions of categories. NHTSA finds that it is helpful to think of these emerging technologies as part of a continuum of vehicle control automation. The continuum, discussed below, runs from vehicles with no active control systems all the way to full automation and self- driving. While the agency is conducting research along the entire automation continuum, our emphasis initially is on determining whether those crash avoidance and mitigation technologies that are currently available (or soon to be available) are not only safe, but effective. However, because these same technologies are the building blocks for what may one day lead to a driverless vehicle, we have also begun research focused on safety principles that may apply to even higher levels of automation, such as driver behavior in the context of highly automated vehicle safety systems. At this point, it is too soon to reach conclusions about the feasibility of producing a vehicle that can safely operate in a fully automated (or “driverless”) mode in all driving environments and traffic scenarios. However, by ensuring that our research plan includes the entire automation continuum, the agency strives to remain knowledgeable about the full range of potential benefits and risks of increasing vehicle automation. B. Automation Overview Automated vehicles are those in which at least some aspects of a safety-critical control function (e.g., steering, throttle, or braking) occur without direct driver input. Vehicles that provide safety warnings to drivers (forward crash warning, for example) but do not perform a control function are, in this context, not considered automated, even though the technology necessary to provide that warning involves varying degrees of automation (e.g., the necessary data are received and processed, and the warning is given, without driver input). Automated vehicles may use on- board sensors, cameras, GPS, and telecommunications to obtain information in order to make their own judgments regarding safety-critical situations and act appropriately by effectuating control at some level. Accordingly, for purposes of this discussion, vehicles equipped with V2V technology that provide only safety warnings are not automated vehicles, even though such warnings by themselves can have significant safety benefits and can provide very valuable information to augment active on-board safety control technologies. In fact, the realization of the full potential benefits and broad-scale implementation of the highest level of automation may conceivably rely on V2V technology as an important input to ensure that the vehicle has full awareness of its surroundings. Definitions – Levels of Vehicle Automation The definitions below cover the complete range of vehicle automation, ranging from vehicles that do not have any of their control systems automated (level 0) through fully automated vehicles (level 4). The agency has segmented vehicle automation into these five levels to allow for clarity in discussing this topic with other stakeholders and to clarify the level(s) of automation on which the agency is currently focusing its efforts. • Level 0 – No-Automation. The driver is in complete and sole control of the primary vehicle controls (brake, steering, throttle, and motive power) at all times, and is solely responsible for monitoring the roadway and for safe operation of all vehicle controls. Vehicles that have certain driver support/convenience systems but do not have control authority over steering, braking, or throttle would still be considered “level 0” vehicles. Examples include systems that provide only warnings (e.g., forward collision warning, lane departure warning, blind spot monitoring) as well as systems providing automated secondary controls such as wipers, headlights, turn signals, hazard lights, etc. Although a vehicle with V2V warning technology alone would be at this level, that technology could significantly augment, and could be necessary to fully implement, many of the technologies described below, and is capable of providing warnings in several scenarios where sensors and cameras cannot (e.g., vehicles approaching each other at intersections). • Level 1 – Function-specific Automation: Automation at this level involves one or more specific control functions; if multiple functions are automated, they operate independently from each other. The driver has overall control, and is solely responsible for safe operation, but can choose to cede limited authority over a primary control (as in adaptive cruise control), the vehicle can automatically a**ume limited authority over a primary control (as in electronic stability control), or the automated system can provide added control to aid the driver in certain normal driving or crash-imminent situations (e.g., dynamic brake support in emergencies). The vehicle may have multiple capabilities combining individual driver support and crash avoidance technologies, but does not replace driver vigilance and does not a**ume driving responsibility from the driver. The vehicle's automated system may a**ist or augment the driver in operating one of the primary controls – either steering or braking/throttle controls (but not both). As a result, there is no combination of vehicle control systems working in unison that enables the driver to be disengaged from physically operating the vehicle by having his or her hands off the steering wheel AND feet off the pedals at the same time. Examples of function- specific automation systems include: cruise control, automatic braking, and lane keeping. • Level 2 - Combined Function Automation: This level involves automation of at least two primary control functions designed to work in unison to relieve the driver of control of those functions. Vehicles at this level of automation can utilize shared authority when the driver cedes active primary control in certain limited driving situations. The driver is still responsible for monitoring the roadway and safe operation and is expected to be available for control at all times and on short notice. The system can relinquish control with no advance warning and the driver must be ready to control the vehicle safely. An example of combined functions enabling a Level 2 system is adaptive cruise control in combination with lane centering. The major distinction between level 1 and level 2 is that, at level 2 in the specific operating conditions for which the system is designed, an automated operating mode is enabled such that the driver is disengaged from physically operating the vehicle by having his or her hands off the steering wheel AND foot off pedal at the same time. • Level 3 - Limited Self-Driving Automation: Vehicles at this level of automation enable the driver to cede full control of all safety-critical functions under certain traffic or environmental conditions and in those conditions to rely heavily on the vehicle to monitor for changes in those conditions requiring transition back to driver control. The driver is expected to be available for occasional control, but with sufficiently comfortable transition time. The vehicle is designed to ensure safe operation during the automated driving mode. An example would be an automated or self-driving car that can determine when the system is no longer able to support automation, such as from an oncoming construction area, and then signals to the driver to reengage in the driving task, providing the driver with an appropriate amount of transition time to safely regain manual control. The major distinction between level 2 and level 3 is that at level 3, the vehicle is designed so that the driver is not expected to constantly monitor the roadway while driving. • Level 4 - Full Self-Driving Automation (Level 4): The vehicle is designed to perform all safety-critical driving functions and monitor roadway conditions for an entire trip. Such a design anticipates that the driver1 will provide destination or navigation input, but is not expected to be available for control at any time during the trip. This includes both occupied and unoccupied vehicles. By design, safe operation rests solely on the automated vehicle system. C. NHTSA's Research Plan for Automated Vehicles NHTSA has been conducting research on vehicle automation for many years, and this research has already led to regulatory and other policy developments. Our work on electronic stability control (ESC), for example, led us to develop and issue a standard that made that Level 1 technology mandatory on all new light vehicles since MY 2011. More recently, we issued a proposal that would require ESC on heavy vehicles. We have done significant work on a range of crash avoidance technologies such as lane departure warning and forward collision warning (FCW). Along with ESC, we have included these two technologies as crash avoidance features that are noted on equipped models in our New Car Assessment Program (NCAP) to encourage consumers to consider choosing models with those technologies. We are currently engaged in extensive research on automatic braking technologies (dynamic brake support and crash imminent braking),2 which can be considered Level 1 technologies. Within the next year, the agency will make a determination on whether either or both of these two automatic braking technologies should be considered for rulemaking or for inclusion within the NCAP program. Our current work involves development of test procedures and a**essment of benefits for these Level 1 technologies. Of course, we are also working very hard on V2V communications technology, which may offer significant crash reduction benefits on its own or when coupled with on-board warning and automated control systems. As we continue our work on Level 1 automation and our efforts to calculate the safety benefits that those single-function systems may offer in the near term, we have begun or are planning research on Levels 2 through 4 automation as well. NHTSA is working cooperatively with other DOT agencies on this research, given its relevance to the intermodal intelligent transportation systems program. Initially, the agency has identified three key areas where it has begun or plans to conduct research for these more advanced automated vehicle systems. These areas are human factors research, development of system performance requirements, and addressing electronic control system safety. NHTSA's research will inform agency policy decisions, a**ist in developing an overall set of requirements and standards for automated vehicles, identify any additional areas that require examination, and build a comprehensive knowledge base for the agency as automated system technologies progress. (1) Human Factors Research: This area of research will focus on human factors with the goal of developing requirements for the driver-vehicle interface (DVI) such that drivers can safely transition between automated and non-automated vehicle operation and that any additional information relevant to the safe operation of the vehicle is effectively communicated to the driver. The research will primarily focus on level 2 and 3 systems. In addition, with new automated driving concepts emerging in which the driver is interacting in potentially much different ways than is typical with current vehicles, driver training needs will be evaluated. Main topics to be addressed as part of human factors research include: • Driver/vehicle interaction – Evaluating communication methods between driver and vehicle to ensure safe vehicle operation • Ensuring proper allocation of vehicle control functions between the driver and the vehicle o Division of labor and control authority – a**uring that either the driver and/or vehicle are in control all the time o Transitions – investigating appropriate means of transferring control from driver to vehicle and vice versa o Override - evaluating override requirements such that the driver can always or when appropriate override the automated system and regain control • Driver acceptance – Factors leading to driver acceptance (false alarm rates, nuisance warnings, automation system availability and reliability) • Driver training – Evaluating training requirements that may be needed for level 2 and 3 systems • Developing human factors research tools – Developing the appropriate test and evaluation tools (e.g. simulators, test vehicles, etc.) to evaluate driver and system performance for various automated vehicle concepts As a first step toward completing research on these issues, the agency has initiated an evaluation of emerging level 2 and level 3 system concepts to answer fundamental human factors questions. The evaluation will examine how drivers react and perform in these types of automated vehicles. In addition, it will consider DVI concepts that may be needed to ensure that drivers safely transition between automated driving and manual operation of the vehicle. The initial research should address the following human factors questions: • What is the driver performance profile over time in sustained (longer term) and short-cycle (shorter term) automation? • What are the risks from interrupting the driver's involvement with secondary tasks when operating a Level 3 type automated vehicle? • What are the most effective hand-off strategies between the system and the driver including response to faults and failures? • What are the most effective human-machine interface concepts, guided by human factors best practices, which optimize the safe operation? One of the main end products of this initial research program would be recommendations for what requirements are needed for the driver-vehicle interface to allow safe operation and transition between automated and non-automated vehicle operation. We plan to complete the first phase of this research in the next two years. (2) Electronic Control Systems Safety: A common element in all levels of automation is safety-critical electronic control systems. While NHTSA generally regulates by developing performance standards for specific vehicle systems or sub-systems to address a specific type of safety risk (e.g., frontal collision), the centrality of electronic systems to nearly all vehicle controls may require the agency to develop some type of requirements for electronic control systems more generally to ensure their reliability and security. NHTSA is well aware of relevant voluntary industry standards such as ISO 26262 (which establishes uniform practices for achieving specific levels of safety integrity in complex embedded control systems) and their importance in developing safety-critical systems. Specifically, the agency's work will focus on developing functional safety requirements as well as potential reliability requirements in the areas of diagnostics, prognostics, and failure response (fail safe) mechanisms. In addition, NHTSA has initiated research on vehicle cybersecurity, with the goal of developing an initial baseline set of requirements. The first phase of this work, as funds permit, will take three to four years. At that time, NHTSA expects to be in a position to determine the need for standards for these safety- critical electronic control systems. This work will complement and support the agency research to develop appropriate safety performance requirements for automated vehicles. Within the areas of safe reliability and cybersecurity of control systems, the following topics will need to be addressed: Safe Reliability • Functional safety - Defining functional safety requirements for electronic control systems • Failure modes – Evaluating failure modes and a**ociated severities • Failure probability – Evaluating the likelihood of a failure to occur • Diagnostics/prognostics – Evaluating the need and feasibility of enhanced capabilities that can self-detect or predict failures and investigating how to communicate potential system degradation to the driver • Redundancy – Investigating what additional hardware, software, data communications, infrastructure, etc. may be needed to ensure the safety of highly automated vehicles • Availability (of the automated system) – Ability to perform even at a degraded level in case of failure • Certification – Requirements and processes to validate that the system is safe at deployment and remains safe in operation, including vehicle software Cybersecurity • Security – Capability of system to resist cyber attacks • Risks – Potential gaps in the system that can be compromised by cyber attacks • Performance – Effectiveness of security systems • Unintended consequences – Impact of cybersecurity on performance of the system • Certification – Method to a**ure that critical vehicle subsystems such as communications are secure (3) Develop System Performance Requirements: Research will be performed to support the development of any potential technical requirements for automated vehicle systems. This effort is expected to involve an an*lysis of the levels described above (levels 2-4) to develop functional descriptions for automation systems that map to each of these levels. Based on these functional descriptions, research to develop requirements will focus on identifying applicable scenarios (use cases) for the automated system levels 2-4. Based on a detailed an*lysis of the use cases, appropriate safety performance requirements would be developed to ensure a minimum safe level of performance. As funding permits, we would like to complete the first phase of this research in the next four years. In that period, the aim is to develop basic safety requirements that we could consider for adoption as standards applicable to any such systems that would be available for sale to the public at that time. This research is complicated by the fact that only a few level 2 systems currently exist, even fewer level 3 systems exist and their technical details are constantly in flux, and no level 4 systems are known to exist at this time. It is expected that this area of research will leverage the results from both the human factors and electronic control systems programs outlined above. The main topics that will need to be addressed include: • Developing detailed functional descriptions for emerging level 2 and 3 operational concepts. • Data an*lysis - Evaluate naturalistic data and crash data to determine the array of real-world scenarios (use cases) that match to the functional descriptions of emerging level 2 and 3 automated vehicle systems. • Evaluate constraints on level 2 and 3 system performance - Based on the functional descriptions of emerging system concepts and the data an*lysis results, evaluate the constraints on level 2 and 3 system performance that will result from various operating scenarios (traffic dynamics), driver capabilities, environmental variations (rain, snow, etc.), and roadway types/configurations. This work will leverage results from the human factors research area particularly with respect to evaluating driver capabilities and the resulting constraints that may impose on level 2 and 3 systems. • Development of test and evaluation methods - Based on the real world scenarios (use cases) that map to the functional description of the automated system, develop test track tests and/or simulation approaches that can evaluate the performance of the level 2 or level 3 systems relative to these use cases. • Determine the performance and operating envelope for emerging level 2 and 3 systems: Based on testing and/or simulation efforts, characterize the performance envelope (i.e., appropriate operating boundaries) for each level 2 or 3 system. This will include items like testing to determine maximum deceleration authority, maximum lateral velocity, maximum yaw moment, and other vehicle dynamic properties that are actively controlled by the automated system. This will help determine the level of autonomous authority that the vehicle is capable of achieving. • Leverage results from the electronic control systems research: o Understand system failure modes for each automated system including active safety technologies installed on the vehicle. o Identify points of failure for each automated system (braking, steering, etc.) installed on the vehicle and determine how the systems react in both static and dynamic situations. • Develop objective performance tests and a**ociated pa**/fail criteria. This research will inform the development of preliminary requirements for level 2 automation and potentially for level 3 systems as well to the extent these systems are available. It will also provide the basic groundwork for understanding any additional level 3 and level 4 systems that may be developed, since these will likely be based on level 2 technologies but be more highly integrated and involve greatly advanced sensing capabilities. As level 3 and 4 systems become available, similar research steps would be performed. We note that this research program is not as yet separately funded and its full implementation will depend on using available research funds unless additional funding is granted in accordance with the administration's budget request. D. Recommendations Concerning State Activities Related to Self-Driving Vehicles Several states have enacted legislation expressly authorizing operation of “autonomous” vehicles within their borders under certain conditions. Generally, these laws seem to contemplate vehicle automation at Levels 3 and 4, as discussed above, i.e., some form of self-driving operation. Accordingly, these recommendations are tailored to Levels 3 and 4 automation. Further research is needed to fully understand the technical and human factors issues implicated by self-driving vehicles. This guidance is therefore provisional and subject to reconsideration and revision as appropriate, especially before any potential regulatory action – which must appropriately balance the need to ensure motor vehicle safety with the flexibility to innovate. We offer these recommendations to state drafters of legislation and regulations governing the licensing, testing, and operation of self-driving vehicles on public roads in order to encourage the safe development and implementation of automated vehicle technology, which holds the potential for significant long-term safety benefits. In general, we believe that states are well suited to address issues such as licensing, driver training, and conditions for operation related to specific types of vehicles. NHTSA has considerable concerns however about detailed state regulation on safety of self-driving vehicles, and does not recommend at this time that states permit operation of self-driving vehicles for purposes other than testing. Thus, the below recommendations all a**ume that the human driver of the vehicle will be employed by, or otherwise the agent of, a business or some other institution engaged in testing and will only be using the self-driving vehicle in that capacity. The agency is not aware of any systems intended for wide scale deployment currently under development for use in motor vehicles that are capable of Level 4 automation. As we stated previously, very few Level 3 automated systems exist and the systems that do exist are still at the earlier stages of testing/development. Because Level 4 automated systems are not yet in existence and the technical specifications for Level 3 automated systems are still in flux, the agency believes that regulation of the technical performance of automated vehicles is premature at this time. While NHTSA's authority, expertise, and mandate is to establish uniform, national standards needed for vehicle safety, the agency recognizes that premature regulation can run the risk of putting the brakes on the evolution toward increasingly better vehicle safety technologies. While the agency does not believe that self-driving vehicles are currently ready to be driven on public roads for purposes other than testing, the agency would like to emphasize that it is encouraged by innovations in automated driving and their potential to transform our roadways. The agency is confident that the development and testing of Level 3 automated systems will provide answers to many of the technical and human factors questions presented by the technology. NHTSA has decades of experience in matters of highway safety and vehicle safety, including issues related to driver licensing and vehicle safety standards. NHTSA also has extensively studied and exercised its regulatory authority over various aspects of vehicle automation and has closely observed recent developments in self-driving technologies, including in-depth discussions with developers of those technologies and direct experience with several of the vehicles under development. Based on all of this, and knowing that some states are anxious for guidance on how to proceed with regard to self-driving vehicles, NHTSA offers the recommendations below. I—Recommendations for Licensing Drivers to Operate Self-Driving Vehicles for Testing A--Ensure that the Driver Understands How to Operate a Self-Driving Vehicle Safely • A driver licensing program should provide for driver's license endorsements (or separate driver's licenses) that authorize the operation of self-driving vehicles. • The issuance of a driver's license endorsement (or separate driver's license) to a person should be conditioned upon certain prerequisites, such as that person's pa**age of a test concerning the safe operation of a self-driving vehicle and presentation of a certification by a manufacturer of self-driving vehicles (or the manufacturer's designated representative) that the person has successfully completed a training course provided by that manufacturer (or representative), or a certification by that manufacturer (or representative) that the person has operated a self-driving vehicle for a certain minimum number of hours. As used here, “manufacturer” includes a company that alters a vehicle manufactured originally by another company in order to give it self-driving capability. • The training course should be submitted to the state agency that issues driving licenses for approval prior to the taking of that course by any person seeking a driver's license endorsement certification. The course should include providing an understanding of the basic operation and limits of self-driving vehicles, and knowledge of how to resume control of such a vehicle in the event that it cannot continue to operate automatically. II—Recommendations for State Regulations Governing Testing of Self-Driving Vehicles A--Ensure that On-road Testing of Self-driving Vehicles Minimizes Risks to Other Road Users • Any state establishing regulations for self-driving vehicle testing should include provisions to ensure that businesses testing such vehicles conduct their testing in a way that minimizes risks to other road users, including provisions such as: o Requiring businesses to certify that the vehicle has already operated for a certain number of miles in self-driving mode without incident before businesses seeking the license can test the vehicle on public roads. o Requiring these businesses to submit data from previous testing involving the technology. o Requiring businesses to submit a plan to the state regulatory body describing how the business plans to minimize safety risks to other road users. The plan could include training for test drivers employed by the business seeking to conduct the testing, fail safes in the design of the prototype automated vehicle, and/or aspects of the testing plan designed to ensure that risks to other road users are minimized. • NHTSA strongly recommends that states require that a properly licensed driver be seated in the driver's seat and ready to take control of the vehicle while the vehicle is operating in self-driving mode on public roads. B--Limit Testing Operations to Roadway, Traffic and Environmental Conditions Suitable for the Capabilities of the Tested Self-Driving Vehicles • States should require that, as part of their testing plan, self-driving vehicle manufacturers inform the state of the operating conditions in which they wish to test. Manufacturers wishing to test self-driving vehicles should be required to supply states with test data or other information to demonstrate that their self-driving vehicles are capable of operating in these conditions with limited driver intervention. • States are encouraged to consider appropriate limitations on the conditions in which a vehicle may be operated in self-driving mode. States are encouraged to tailor their regulations governing self-driving vehicle testing to limit the use of the self-driving mode to conditions conducive to safe operation in that mode. • Regulations governing self-driving vehicle testing could limit testing to the operating conditions for which the self-driving system is specifically designed such as driving on a limited access highway. Likewise, depending on the self-driving vehicle, regulations could limit testing of the self-driving vehicle to roads in only certain geographical locations, e.g., those known for having light traffic or for having heavy traffic at low travel speeds. C--Establish Reporting Requirements to Monitor the Performance of Self-Driving Technology during Testing • To expand the body of data and support research concerning self-driving vehicles, states are encouraged to require businesses testing self-driving vehicles to submit to the state certain information, including: o instances in which a self-driving vehicle, while operating in or transitioning out of self-driving mode, is involved in a crash or near crash; and o incidents in which the driver of one of their self-driving vehicles is prompted by the vehicle to take control of the vehicle while it is operating in the self-driving mode because of a failure of the automated system or the inability of the automated system to function in certain conditions. III—Recommended Basic Principles for Testing of Self-Driving Vehicles NHTSA does not recommend that states attempt to establish safety standards for self-driving vehicle technologies, which are in the early stages of development. We believe there are a number of technological issues as well as human performance issues that must be addressed for self-driving vehicles. Particularly in light of the rapid evolution and wide variations in self- driving technologies, we do not believe that detailed regulation of these technologies is feasible at this time at the federal or state level. However, until such time as NHTSA has developed vehicle safety standards pertinent to self-driving technologies, states may want to ensure that self-driving test vehicles in their states adhere to certain basic principles. A--Ensure that the Process for Transitioning from Self-Driving Mode to Driver Control is Safe, Simple, and Timely • During the testing phase of the development of self-driving vehicles, a driver familiar with the particular vehicle's automated systems is necessary to ensure that a failure of the automated system or the occurrence of conditions in which the automated system is not intended to operate does not put other road users at risk. The driver must be able to quickly and easily retake control of the vehicle from the automated system. • A regulation may require that the driver be able to retake control of the test vehicle by an immediately over-riding, relatively simple, and non-distracting method such as pressing a bu*ton located within the driver's reach. • Further, the automated functions of a test vehicle should defer to the driver's input by allowing the driver to retake control by using the brakes, the accelerator pedal, or the steering wheel. • The self-driving vehicle should alert the driver when the driver must take control of the vehicle because the automated system cannot operate due to road conditions, environmental conditions, a malfunction, or any other condition or circumstance that would require manual driving for safe operation. B—Self-Driving Test Vehicles Should Have the Capability of Detecting, Recording, and Informing the Driver that the System of Automated Technologies has Malfunctioned • Self-driving test vehicles operating on the road should have the capability of detecting that their automated vehicle technologies have malfunctioned or are operating in a degraded state, and informing the driver in a way that enables the driver to regain proper control of the vehicle. • Self-driving test vehicles should have the capability of recording the occurrence of such malfunctions, degradations, or failures in a way that can be used to establish the cause of any such malfunction, degradation and control failure. C--Ensure that Installation and Operation of any Self-Driving Vehicle Technologies Does not Disable any Federally Required Safety Features or Systems • Any regulation that allows for the operation of self-driving vehicles on public roads should ensure that entities installing automated technology in vehicles do not disable federally required safety systems. • Federal law prohibits manufacturers of motor vehicles, dealers and motor vehicle repair businesses from making inoperative any federally required safety system. • The installation of self-driving technologies should not degrade the performance of any of those federally required systems or the overall safety of the vehicle. • States should consider requiring businesses offering self-driving vehicles for operation within their states to certify that they have not made any federally-required safety devices inoperative. D--Ensure that Self-Driving Test Vehicles Record Information about the Status of the Automated Control Technologies in the Event of a Crash or Loss of Vehicle Control • Self-driving test vehicles should record data from the vehicle's sensors, including sensors monitoring and diagnosing the performance of the automated vehicle technologies, in the event of a crash, or other significant loss of vehicle control. In addition to recording all the information from the sensors for the vehicle's automated technologies, the recording should note whether the automated technology system was in control of the vehicle at the time of the crash. • Any regulation that allows for the operation of self-driving vehicles for testing purposes should also consider ensuring that the vehicle owner make available to the state all data recorded by the vehicle's event data recorder in the event of a crash. IV--Regulations Governing the Operation of Self-Driving Vehicles for Purposes Other than Testing NHTSA does not recommend that states authorize the operation of self-driving vehicles for purposes other than testing at this time. We believe there are a number of technological issues as well as human performance issues that must be addressed before self-driving vehicles can be made widely available. Self-driving vehicle technology is not yet at the stage of sophistication or demonstrated safety capability that it should be authorized for use by members of the public for general driving purposes. Should a state nevertheless decide to permit such non-testing operation of self-driving vehicles, at a minimum the state should require that a properly licensed driver (i.e., one licensed to drive self-driving vehicles) be seated in the driver's seat and be available at all times in order to operate the vehicle in situations in which the automated technology is not able to safely control the vehicle. As innovation in this area continues and the maturity of self-driving technology increases, we will reconsider our present position on this issue.