在一個理想的世界中，自動駕駛汽車將全知全能。車輛將有能力進行觀察、通信和計算，并最終準確判斷道路上的任何危險，并及時采取措施避免所有風險發生。然而，在理想世界成為現實之前，自動駕駛開發商、監管者以及普通民眾均必須面對一個亟待回答的問題：要多安全，才夠安全？
截至目前，盡管人們已經在自動駕駛研發上投入了大約 1000 億美元，但這個問題仍沒人能夠自信回答。相關安全標準和度量指標尚未建立，世界領先的機器人學家對此只能撓頭，監管機構在很大程度上也無所適從。如果無法回答這個近乎抽象的問題，自動駕駛汽車的所有潛力都只是鏡花水月，減少事故、挽救生命、節省時間并最終實現交通民主化的承諾也只是美夢一場。
TechCrunch Mobility2019 大會期間，“業內領先的一些公司已經進入驗證和測試的階段了。我們也充分意識到安全問題是我們的發展道路上無法規避的重要環節。”一級技術供應商 Aptiv 公司的自動駕駛總裁 Karl Iagnemma 在接受采訪時斷言：“這是當今業界最亟待解決的問題。”
Aptiv 公司在 2018 年推出了全球首個自動駕駛“招車”服務。該試點的大本營位于美國拉斯維加斯，主要使用 Lyft 的車輛。此外，Aptiv 公司也在新加坡、波士頓和匹茲堡等地投放了自動駕駛汽車。
盡管，自動駕駛汽車的安全問題仍然難以回答，但萬變不離其宗，大概也脫不開業界熱議的三個字母：ODD。ODD 的全稱為Operational Design Domain（即運行設計域），主要詳列自動駕駛汽車可能遇到的所有重疊條件、用例、限制和場景，哪怕是最不可思議的邊緣案例也必須明列其中。
卡內基梅隆大學電氣和計算機工程副教授 Phil Koopman 博士早在十到二十年前就已認識到了 ODD 的重要性。
Koopman 教授表示，他從 1995 年起就意識到必須明確規定在哪些情景中自動駕駛汽車可以或不可以安全駕駛。當時，多位來自卡內基梅隆大學的機器人專家乘坐裝一輛裝備了攝像頭、個人計算機和 GPS 接收器的 Pontiac 小貨車，完成了一次橫跨美國的“自動駕駛”行程。去年秋天，Koopman 教授在芬蘭參加某個安全會議時與 SAE《無人駕駛汽車工程》雜志通話表示，“我們當時 98% 的行程均是無人駕駛完成的，此后的 20 年中，我們一直在努力解決最后 2％的問題。”
常見的 ODD 因素主要包括光照、天氣、地形和道路類型等，但要列舉所有的ODD 因素可能三天三夜也說不完。
2019 年 1 月，Koopman（同時也是 EdgeCase Research 公司的聯合創始人）與Edge Case Research 公司的首席工程師 Frank Fratrik 共同發表論文《運營設計域、對象和事件有多少？》（How many Operational Design Domains, Objects, and Events），其中詳細列舉了四頁有關 ODD 目標檢測、故障和操作的因素。
該論文列舉了一輛自動駕駛汽車可能面臨的各種非常規情況，包括眩光、社會規范、過時的地圖信息、收費站、水洼、低垂的植物、倒下的電線、道路結冰、不合作的人、掉落的物體、快遞機器人和一些常見的人類違規行為。
Koopman 教授告誡稱，絕不能過分簡單化 ODD。
“如果您只著眼于某一個街區，然后總結出一套 ODD，那這套 ODD 一定不會提供您應該了解的全部內容。”Koopman 教授表示，“即使您反復在這個街區驗證了 3 個月也無濟于事，您在一條街上是無法觀察到所有可能性的。”他還補充說，哪怕是一條最冷清的街道，其變數也常常遠超大多數人的想象。
Koopman 教授表示，“即使您天天去這條街上報道，但假設就10 月 31 日一天沒有去，那我可以保證這條街已經和您最后一次去哪兒的時候不一樣了，至少美國的情況是這樣。”他說，人類可以即刻識別眼睛觀察到的目標，比如一位穿著亮黃色制服的建筑工人，但即使最好的自動駕駛系統有時也會錯判這些“明顯”信號。
AAA 北加州、內華達州和猶他州公司的自動駕駛汽車政策經理 Xantha Bruso 已經充分意識到建立一套基于 ODD的自動駕駛安全標準的復雜性。不過，她認為，提升公共安全勢在必行，自己對此并不感到畏懼。“開始真的不難，目前我們幾乎沒有任何與性能有關的標準，”她說，“你總得從什么地方開始。”
在 AAA 位于美國加里福尼亞州伯克利市的北加州創新實驗室中，Bruso 回答了一些關鍵問題，比如“自動駕駛的運行條件是什么？如果環境變了，車輛無法繼續安全運行了該怎么辦？車輛如何感知自己已經馬上逼近 ODD 邊緣了？快到邊緣了又該怎么辦呢？自動駕駛汽車該如何制定安全案例？又該如何與監管機構的安全定義相吻合？”
正是在背景下，AAA 北加州分部決心開發業內極缺也急需的自動駕駛汽車安全指標。為了更好地實現這一目標，AAA 選擇與“保護美國未來能源組織”（Securing America’s Future Energy，即 SAFE 組織）和 RAND 公司合作。“認真研究了這個問題后，我們意識到我們本末倒置了。”Bruso 介紹說，“首先，我們需要安全運行環境的根本定義，有哪些條件？”
對此，AAA的項目團隊決定調整思路，首先為公司位于灣區的 2100 英畝自動駕駛測試場地GoMentumStation 站點開發一套 ODD。Bruso 表示，“我們從GoMentum Station 開始，把這里當作整個行業測試環境的一個代表，提取可定義且可重復的運行條件。”Bruso 的計劃是發布和推廣這套 ODD，并希望其他測試站點也沿用相同的定義，或至少是相同的概念框架。長遠來看，目標則是建立一套統一測試協議，可以把全球各地的自動駕駛系統放在統一的框架下，使用同一套標準進行比較。
Bruso解釋說，現在，你無法用同一套標準比較不同的自動駕駛系統。“一輛位于舊金山的Cruise 測試車需要面臨的ODD 條件比一輛位于鳳凰城的 Waymo 測試車更復雜。”她說，“因此，你需要一套統一的衡量標準，這樣才可以從統一的經緯度評判這些車輛。”
在創建ODD的過程中，保證靈活性至關重要。首先，從高速公路上的長途卡車到郊區公路上的低速貨車，自動駕駛系統供應商需要面臨多種多樣的商業場景。其次，ODD 還必須獨立于自動駕駛技術，無論公司采用哪種傳感器都必須達到同等級的安全性能。最后，由于各類利益相關者都在試圖建立更有利于自身的標準，這使得統一標準的實現變得更加艱難。
Bruso表示，“接下來，我們計劃呼吁整個行業，尋求最佳的合作方式。”
Koopman 教授認為，ODD 清單要寫完長度可能超過一英里，因此我們必須為其尋找一個更高度、更廣泛的目標。他說，“安全問題歸根結底總是工程嚴謹與否的問題。”有時候，這意味著我們必須精益求精，力求完美。正如十八世紀的意大利格言所說，“完美不是優秀的敵人。”
對于 Aptiv 和其他領先的自動駕駛汽車公司而言，這是一種平衡的藝術。如今，自動駕駛汽車上路的呼聲愈發強烈，人們迫切希望自動駕駛汽車可以兌現增加收益和提高安全性的承諾。“實際上，這意味著我們將首先在更簡單的駕駛環境中部署我們的技術。”Aptiv 公司的 Iagnemma 表示，“而后再逐步推廣至更加復雜的場景。”
Koopman教授表示，目前仍在開發中的UL 4600 標準明確指出，自動駕駛制造商不需要完美。“您必須拿出良好的經驗測試數據，證明您的系統不會帶來不適當的風險。”他說，“但您永遠不能阻止系統的運行條件發生改變。”換句話說，您的 ODD將永遠無法窮盡所有場景、用例和道路條件；自動駕駛系統必須有能力理解未知，并在事故發生后快速做出修復措施。
本文獲得了來自 AAA 北加州、猶他州和內華達州分部的支持。
作者：Bradley Berman
本文原發表于SAE《自動駕駛車輛工程》雜志
In a perfect world, an automated vehicle (AV) would be all-knowing. Its sensors, communication systems and computing power could predict every road hazard and avoid all risks. But until a wholly omniscient self-driving vehicle is a reality, there will be one burning question for AV developers and regulators – and the public: How safe is safe enough?
Despite about $100 billion of investment in AVs to this point, nobody has an adequate answer. Safety standards and metrics have not yet been established. The world’s leading roboticists are scratching their heads. Regulators are largely perplexed. Until there’s an answer to this almost abstract question, the great promise of AVs to reduce accidents and save lives, free up our time and democratize mobility will remain beyond our grasp.
“The leading players reached a point where we’re going through validation and testing. And we realized that the safety question is in our critical path,” said Karl Iagnemma, president of autonomous mobility at Tier-1 tech supplier Aptiv, in an interview at the TechCrunch Mobility 2019 conference. “It’s the biggest unanswered question in the industry today,” he asserted.
Aptiv launched the world’s first commercial AV ride-hailing service in 2018. That pilot project, using Lyft vehicles, is based in Las Vegas. Aptiv also deployed AVs on the streets of Singapore, Boston and Pittsburgh.
While easy answers to the AV safety question are elusive, the path forward could come down to the industry’s widely and often-debated three-letter acronym: ODD, or Operational Design Domain. The term defines all conceivable overlapping conditions, use cases, restrictions and scenarios that an AV might encounter – even the most esoteric edge cases.
Dr. Phil Koopman, associate professor of electrical and computer engineers at Carnegie Mellon University, is a decade or two ahead of the pack in realizing the critical importance of ODD.
Koopman said that since 1995, he’s known about the importance of establishing the scenarios in which AVs can and cannot remain safe. That’s when a team of Carnegie Mellon roboticists traveled coast-to-coast in a Pontiac minivan decked out with a video camera, personal computer and a GPS receiver. “We had our hands off the wheel for 98 percent of the trip,” he told SAE’s Autonomous Vehicle Engineering via phone last fall while attending a safety conference in Finland. “And for the last 20 years, we’ve been working on the last two percent. ”
Common ODD factors include time of day, weather, terrain and road features. But the list gets very long, very fast.
In January 2019, Koopman, a co-founder of Edge Case Research, co-authored a white paper, “How many Operational Design Domains, Objects, and Events” (co-author was Frank Fratrik, lead engineer at Edge Case Research. )The paper essentially is four pages worth of bullet points of factors related to ODD object detection, faults and maneuvers.
The paper’s laundry list of ODD oddities – impactful factors that an AV might encounter – includes glare, social norms, outdated mapping detail, tollbooths, water-filled potholes, overhanging vegetation, downed power lines, icing, uncooperative people, falling objects, delivery robots and common human rule-breaking.
Koopman cautions against overly simplistic approaches to ODD.
“If you take a city block and say that’s my ODD, it doesn’t tell you what you need to know,” he said. “It just limits the possibilities even if you’ve driven along that street for three months. ”Koopman added that even a simple street has way more variability than most people appreciate.
“If you never drove on that street on October 31, I will guarantee you things change on that day, at least in the United States. ”He said that humans can immediately recognize things – construction workers wearing yellow high-visibility uniforms, for instance – that are sometimes missed by even the best AV systems.
Xantha Bruso, manager of autonomous-vehicle policy at AAA Northern California, Nevada & Utah, fully recognizes the complexity of establishing ODD-based AV safety standards. But seeing the public-safety imperative, she’s undaunted. “The bar is really low. There are currently no performance-based standards,” she said. “You have to start somewhere. ”
In a conference room at AAA Northern California’s innovation lab in Berkeley, Calif. , Bruso rattled off the key questions. “What conditions can the AV operate in? What happens when something changes in the environment that prohibits it from operating safely?How can it sense that it’s getting close to the edge of the ODD? What happens then? How does an AV company make its safety case? How does all this mesh with how regulators are defining safety?”
These questions and others informed AAA Northern California’s work to develop AV safety metrics sorely lacking in the industry. For the project, the organization partnered with Securing America’s Future Energy (SAFE) and RAND Corporation. “When we gave it a careful look, we realized that we were putting the cart before the horse,” Bruso said. “First, we need the foundational definitions for where it’s safe to operate. What are those conditions?”
So the project team turned its attention to developing an ODD for GoMentum Station, the Bay Area’s 2,100-acre AV testing facility owned by AAA Northern California. “We’re starting there,” said Bruso. “We’re using GoMentum Station as a proxy for an industry-wide test environment. We can make those conditions defined and repeatable. ”Bruso’s plan is to publish and promote its ODD with the hope of having other test tracks use its definitions – or at the least, the same conceptual framework. The long-term vision is to establish a testing protocol for apples-to-apples comparisons of AV systems throughout the world.
Bruso explained that those comparisons currently are not possible. “A Cruise vehicle testing in San Francisco has a more-complicated ODD than a Waymo in Phoenix,” she said. “You need a baseline of conditions to evaluate these vehicles on an equal footing.”
Flexibility will be crucial. Industry players follow a wide array of business cases, from long-haul trucking on highways to low-speed deliveries in the suburbs. The ODDs also need to be agnostic to technology, ignoring which sensors a company uses to achieve safety-performance benchmarks. The quest for equal footing becomes still more challenging given the diverse set of stakeholders all trying to establish standards.
“Our next step is to call out to the whole industry,” said Bruso. “How can we come together?”
Koopman believes the mile-long list of ODD factors must be put to a higher, broader purpose. “Safety is always about engineering rigor,” he said. Sometimes that means making sure that “perfect is not the enemy of the good,” as the 18th-century Italian aphorism states.
For Aptiv and other leading AV companies, it’s a balancing act. There’s a strong impulse to get selfdriving vehicles on the road, earning revenue and delivering on the promise for greater safety. “What that means in practice is that we are going to deploy our technology initially in easier driving environments,” said Aptiv’s Iagnemma. “And over time, we will deploy in increasingly complex locations.”
Koopman said that the UL 4600 standard, still in development, explicitly allows AV makers not to be perfect. “You need good empirical test data to say that you’re not presenting an undue risk,” he said. “But you can’t stop conditions from changing. ”In other words, you’ll never develop an ODD that takes every scenario, use case and road condition into consideration; AVs need to know what they don’t know – and then respond with a fix as fast as possible after an incident.
This article was sponsored by AAA Northern California, Utah & Nevada.
Author: Bradley Berman
Source: SAE Automotive Engineering Magazine
Hologram 全息圖是一款來自 Edge Case Research 公司的仿真工具，可識別其他測試工具難以發現的ODD (運行設計域）風險。
Aptiv 公司已經在拉斯維加斯、波士頓、匹茲堡和新加坡等地投放了自動駕駛汽車。也就是說，公司的自動駕駛系統需要在不同地點處理非常不同的駕駛場景。
AAA 計劃以旗下GoMentum 自動駕駛測試站點為代表，創建一套適用于全行業的 ODD 標準。
