1、THE AUTOX PUBLISHED 2018 SAFETY FACTOR Democratizing Autonomy Bringing Self-driving Technologies to Everyday Life The AutoX Safety Factor3 Cars play a central role in our lives. Each year, we spend an increasing number of hours behind the wheel, a trend that may continue unless drastic changes are m

2、ade. Yet when we consider how much time is spent driving to meet our needs, an unmistakable pattern emerges: driving is rarely more than just a means to an end. In the world that AutoX envisions, autonomous vehicles connect us by allowing us to transport physical items to and from one place to anoth

3、er. Even today, lending a friend a salad bowl, a socket wrench, or an Xbox controller still means a visit to the purgatory of traffic. By handling the less pleasant part of the process, AutoXs autonomous vehicles can make the thought of sending a gift basket to your friend the warm, happy one that i

4、t always intended to be. Communities are strengthened by passionate people who strive to share their works of love with others. The local artisanal baker who has been exploring new recipes will be overjoyed to send their regulars samples via autonomous vehicles as soon as the first batch is out of t

5、he oven. Florists, coffee shops, restaurants, and nearly every other business will benefit from our ability to share their products and creations with their communities in a safe, affordable, and pain- free way - and so will the communities that they serve. With AutoX providing the means, the ends a

6、re truly limitless. On average, every cubic meter of goods travels 2.1 miles to be delivered in the traditional B2B model1. 2.1 Miles In New York City, drivers on average spend 107 hours per year searching for parking spots2. 107 Hours The average person spends 60 hours per year shopping in grocery

7、stores3. 60 Hours SERVING OUR COMMUNITY WITH AUTONOMOUS DELIVERY AutoX envisions a world where self-driving cars take care of the means, freeing you up to enjoy the ends. The AutoX Safety Factor4 Not long after the first motorcar was invented, human beings began to consider the possibility of making

8、 them autonomous. In 1925, inventor Francis P. Houdina publicly demonstrated his radio-controlled driverless car, American Wonder, in the streets of New York City, traveling up Broadway and down Fifth Avenue through heavy traffic4. This marked the beginning of humankinds aspiration for driverless ve

9、hicles. Since 2013, more and more pioneers have spearheaded the efforts of making self-driving cars a reality. Level 2 and Level 3 assistive-driving vehicles5 are now being driven on the road. It seems inevitable that manual driving will someday be a thing of the past. Rather than driving to get the

10、 things we need, we have them come to us autonomously. The next few decades will represent a transition period where humans and fully autonomous A.I. drivers are THE WORLD IN TRANSITION First Self-driving Car System on the Road (Dean Pomerleau and Todd Jochem) All Human DriversHuman Drivers and A.I.

11、 Drivers All A.I. Drivers Big Manufacturers Dive In We are here Fully Autonomous Vehicles and Smart Traffic Network 1995 20132018Future driving together, co-existing and sharing the road. The U.S. Department of Transportation has decreed that the freedom of the open road will be protected and enhanc

12、ed. This includes the freedom for everyone to drive their own vehicles6. The unprecedented sharing of our roads between humans and computers is the reason AutoX is pushing the limits of cutting-edge A.I. technologies to ensure the safety of everyone involved. We have developed a smart hybrid system,

13、 which introduces a vital human element into the autonomous driving technology, so that we may better serve our community. Autonomous driving technology, like most life-changing innovations, unleashes limitless possibilitites for the future. AutoX is pushing hard to build safe self-driving cars that

14、 will share the road with everyone. The AutoX Safety Factor5 We composed this voluntary safety self-assessment report to share our approach to achieving safe autonomous vehicle testing and future deployment based on the voluntary guidance of A Vision for Safety, Automated Driving System 2.0 and Prep

15、aring for the Future of Transportation, Automated Vehicles 3.0. We open with a general introduction to AutoXs approach to building a safe and reliable self-driving delivery platform. Next, we highlight our redundancy- based system design for ensuring safety. Then, we introduce our testing and valida

16、tion methods as well as our safety process and policy. Finally, we address considerations in public safety on the road, including our designed post-crash behavior and our engagement plan for first responders. THE VOLUNTARY SAFETY SELF-ASSESSMENT REPORT 1. Statista. 2. Drivers spend an average of 17

17、hours a year searching for parking spots. money/2017/07/12/parking-pain-causes-financial-and-personal-strain/467637001/ 3. Who Does the Grocery Shopping, and When Do They Do It. Jack Goodman. The Time Use Institute. http:/ www.timeuseinstitute.org/Grocery16paper.pdf 4. Time Magazine. Science: Radio

18、Auto. Aug 10, 1925. Retrieved 29 September 2013. 5. SAE autonomy scale. Level 2: Driver-assist systems that control both steering and acceleration/deceleration. These systems shift some of the workload away from the human driver, but still require that person to be attentive at all times. Level 3: V

19、ehicles that can drive themselves in certain situations, such as in traffic on divided highways. When in autonomous mode, human intervention is not needed. But a human driver must be ready to take over when the vehicle encounters a situation that exceeds its limits. 6. U.S. Department of Transportat

20、ion, Preparing for the Future of Transportation, Automated Vehicles 3.0 The AutoX Safety Factor6 System Safety The key to achieving system safety is to establish a robust design process and follow a strict validation process. We are setting the highest standards in building our self- driving cars wi

21、th design redundancies and safety strategies to handle autonomous driving system malfunctions and errors. AutoXs entire system features these strategies. In the How Our Self-driving Car “Sees“ section, we share our methodology for designing and building our sensors and other equipment that enable ou

22、r self-driving cars to “see”. In the Full Stack Redundancy chapter, we discuss our design principle of providing redundancy for the entire self- driving system, from hardware to software to operations. In the Testing and Validation section, we share our data- driven development methods and our rigor

23、ous testing and validation process. Operational Design Domain A closed set of operational criteria and constraints, such as geographic area, weather condition, time of a day, etc., are defined as the Operational Design Domain (ODD). The ODD is extensively tested so that we are certain that our auton

24、omous driving system is able to operate safety within it. Different testing or deployment stages have different ODDs. In the Operational Design Domain section, we define the ODD for our self-driving fleet. Object and Event Detection and Response Object and event detection and response refers to the

25、detection by the autonomous driving system of circumstances that are relevant to the immediate driving task, as well as the implementation of the appropriate system response. In the Algorithm Redundancy and A.I. Redundancy sections, we introduce our unique way of safely handling and responding to im

26、mediate driving tasks. In the The Brain of Our Cars section, we present selected highlights of our A.I. technology that build a better and safer self-driving platform. Fallback (Minimal Risk Condition) Fallback is the transition to the minimal risk condition when a problem is encountered. In the Fal

27、lback (Minimal Risk Condition) section, we discuss our implementation of the minimal risk condition transition process. Human Machine Interface Human Machine Interface (HMI) describes a series of software and hardware user interfaces that help first responders, customers, and other road users to obt

28、ain necessary information about our self-driving car, as well as a way for them to safely engage with it. We address this topic in depth in the Human Machine Interface (HMI) section. The HMI also covers the interaction between the vehicle and the remote operator, and is extensively covered in the Hu

29、man Remote Operator section. Cybersecurity AutoX has followed a thorough process to minimize the risks of cybersecurity threats. This is especially important since AutoX has built a teleoperation system which allows human operators to control the vehicles remotely. In the Cybersecurity section, we h

30、ave introduced our methods to ensure the cybersecurity of the vehicle and the remote command center. In the guidance document Automated Driving Systems 2.0: A Vision for Safety, the National Highway Traffic Safety Administration (NHTSA) has outlined 12 topics that the self-driving system manufacture

31、r should pay attention to for achieving safety. Below, we outline the sections in our report in which each of these topics is addressed. Safety Elements The AutoX Safety Factor7 Crashworthiness Crashworthiness is the consideration and practice of how to best protect vehicle occupants in a collision.

32、 AutoX integrates its self-driving technology with Lincoln MKZs and Chrysler Pacificas, which meet applicable requirements of the Federal Motor Vehicle Safety Standards (FMVSS) as issued by the National Highway Traffic Safety Administration (NHTSA). Post-Crash ADS Behavior A well-designed post-crash

33、 behavior ensures that the autonomous driving system returns to a safe state immediately after being involved in a crash. AutoX has standardized the behavior of the vehicle after a crash, which minimizes the risk to first responders and other road users. In the Post Crash Behavior section, we provid

34、e a brief introduction to the desired post-crash behavior of our self-driving cars. Data Recording Learning from crash data is a central component to the safety potential of the autonomous driving system. In the Data Recording section, we present our strategies to ensure the recording, security, and

35、 proper usages of testing data from crashes. Customer Education and Training Education and training are imperative for increased safety during the deployment of the autonomous driving system. It is beneficial to develop, document, and maintain employee and customer education and training to address

36、the anticipated differences in the use and operation of the autonomous driving system from those of the conventional vehicles that the public owns and operates today. In the Public Engagement section, we take a deeper dive into our practices of conducting customer education and training for safe sel

37、f-driving testing and future self- driving deliveries. Federal, State, and Local Laws AutoX ensures that our autonomous driving system adheres to all applicable Federal, State, and local laws. We will promptly update our system to reflect changes to the laws. We discuss this in the Federal, State, a

38、nd Local Laws section. OUR SELF-DRIVING TECHNOLOGY9 18 26 35 39 How Our Self-driving Car “Sees“ The Brain of Our Cars Fallback (Minimal Risk Condition) Data Recording Cybersecurity 10-11 12-15 16 17 17 19 20 21 22 22 23-25 27-28 29-33 34 34 36 36 37 37 38 Sensor Redundancy Algorithm Redundancy A.I.

39、Redundancy System Redundancy Hardware Redundancy Human Remote Operator Operational Design Domain Testing and Validation Safety Driver and Remote Operator Training Federal, State, and Local Laws Human Machine Interface (HMI) Showing the Driving Status of the Vehicle Forced A.I. and Forced Drive-by-wi

40、re Disengagement Post Crash Behavior Public Engagement FULL STACK REDUNDANCY TESTING the map will otherwise contain an error. Weve been tirelessly working to solve such technical challenges. Over the past two years, weve built an automated loop closure system that is more robust and efficient for la

41、rge scale HD map building. Sensor FusionLarge-scale High Definition 3D Maps Camera + LiDAR fused image AutoX team built the HD 3D map for North San Jose near our home The AutoX Safety Factor16 AutoXs autonomous driving system has a fallback strategy that is triggered if the testing vehicle is operat

42、ing outside the operational design domain (ODD). A series of reacting plans will be executed when such situations are detected. AutoXs system features a reliable out-of-ODD detection and is designed to ensure that the minimal risk fallback is always enabled. FALLBACK (MINIMAL RISK CONDITION) There a

43、re two aspects of the out-of-ODD detection in AutoXs system. First, our team has developed a comprehensive vehicle health monitor that runs alongside the A.I. software. The health monitor is able to detect errors in the message flow amongst the various software and hardware modules of the autonomous

44、 vehicle system. If errors are detected, the health monitor will notify the A.I. system and provide an audible notification to the safety driver or a remote takeover request to the remote operator. Second, every AutoX testing vehicle is constantly alerted of the change of environment by the A.I., a

45、safety driver, or a trained remote control operator. If any environmental condition changes are detected (e.g. a sudden heavy rain), the safety driver and/or remote operator will be able to take over the testing vehicle or activate a pre-programmed automatic minimal risk condition fallback. AutoXs m

46、inimal risk condition fallback strategy consists of three parts: autonomously attempting to pull the vehicle over, notifying the safety driver and/ or remote operator, which allows vehicle takeover. When an out-of-ODD situation is detected or an out-of-ODD status is received by a remote operator, th

47、e minimal risk condition fallback process will be activated, commencing the process of autonomously pulling the vehicle over. This relies on minimal sensors and software components to come to a safe stop, and should therefore be operational even if some part of the A.I. system is not functional. Aut

48、oXs system will then notify the safety driver or the remote operator immediately when beginning the process of pulling over. The safety driver or the remote operator can take over the testing vehicle at any time. Out-of-Operational- Design-Domain Detection Minimal Risk Condition Fallback The AutoX S

49、afety Factor17 AutoX has developed a powerful black box system for data recording during autonomous vehicle testing. The black box system is able to generate detailed datasets of a whole test drive, or span three minutes before and after triggering events. The black box system can be triggered manually by a safety driver or automatically by the A.I. system. The data recorded by the black box