The contents of the following chapter were already published within “European Transport Research Review” (Winkle T, Erbsmehl C, Bengler K, Area-wide real-world test scenarios of poor visibility for safe development of automated vehicles, 2018).

With regard to requirements for system validation and testing of automated vehicles for successful development, market launch and social acceptance, the available information content of all daily traffic accidents has not yet been fully exploited. It goes without saying that automated series production vehicles have to be safe under all conceivable real-world traffic situations. This also applies under all weather conditions or in the case of micro accidents with the slightest damage similar to a near-accidents. In order to develop and validate such vehicles with reasonable expenditure, a first area-wide analysis based on 1.28 million police accident reports was conducted including all police reports in Saxony from 2004 until 2014 concerning bad weather conditions (German traffic accident report: forms and subject areas; see Annex Fig. A.1).

Based on this large database, 374 accidents were found with regard to perception limitations for the detailed investigation. These traffic scenarios are relevant for automated driving. They will form a key aspect for future development, validation and testing of machine perception within automated driving functions.

This first area-wide analysis does not only rely on random checks as in current in-depth analyses but provides real-world traffic scenarios knowing the place, time and context of each and every accident over the whole investigated area.

3.1 Motivation

Automated research vehicles increasingly show higher levels of automation than present series production vehicles. Even when using highly automated functions, the driver is temporarily only limited to control the vehicle having a safe and collision-free journey (Gasser T, et. al. 2012; Society of Automotive Engineers SAE international 2014; National Highway Traffic Safety Administration NHTSA, 2013).

Despite numerous unknown accident avoidances, the safety significance is evident since the example of a first fatal crash while driving with the so-called “Autopilot” vehicle in Florida 2016 on May 7. According to the accident report, the driver of a passenger car died in this collision with a tractor trailer:

“Vehicle 01 (V01) was traveling westbound on US-27… proceeded to make a left turn … V02’s roof struck the underside of V01’s trailer … Driver 02 … was pronounced deceased …” (Fulton, D. M, 2016)

Tesla Motors, the manufacturer of the car, subsequently acknowledged that the car was in “Autopilot” mode. The system failed to recognize a white object against a brightly lit sky as a tractor trailer and therefore did not activate an emergency braking. Meanwhile the driver was watching a film.

Measures to reduce such risks and guarantee the functional safety of electrical and/or electronic systems are thus of prime importance. Automobile manufacturers have to consider limitations how machines perceive, process and react adequately to their surroundings so that automated vehicles will conduct a conflict and collision-free journey (Matthaei R, Reschka A, Rieken J, Dierkes F, Ulbrich S, Winkle T, Maurer M, 2015). In addition, extended concepts for human machine interaction of highly automated functions are arising at takeover situations (Bengler K, Flemisch F, 2011; Bengler et. al. 2018). A prerequisite for this is further technological development of assistance systems with more capable sensor and information technologies, allowing for a steady automation of driving tasks in vehicle control, right up to self-driving vehicles (Bengler K, Dietmayer K, Färber B, Maurer M, Stiller C, Winner H, 2014). Vehicles supported by partly or fully automated systems, must – at the very minimum – match the driving skills of an attentive human driver, before considering series development. The measures necessary for ensuring a correspondingly high functional reliability extend from the development stage to the entire life cycle of automated vehicles, and especially its electronic components.

For a safe development through minimizing risks, manufacturers carry out risk management (Donner E, Schollinski H-L, Winkle T, et. al. 2004). Amongst other measures (see Fig. 4.9) risk management takes real-world scenarios based on accident data into account. However, until now mainly random samples of traffic accident research have been carried out by various organizations. Their research encompasses the subfields of accident surveys/statistics, accident reconstruction, and accident analysis (Chiellino U, Winkle T, Graab B, Ernstberger A, Donner E, Nerlich M, 2010).

The currently best-known method for the evaluation of active safety systems and automated systems is dynamic forward calculation based on real pre-crash scenarios of traffic accidents (Erbsmehl C, 2009). It is carried out by means of various tools, for example rateEFFECT (Lutz L S, Tang T, Lienkamp M, 2012) or (PreScan Tass International, 2016). One of the biggest simulation databases, the pre-crash matrix of Traffic Accident Research Institute of TU Dresden GmbH (VUFO GmbH), was first introduced in 2013 and offers a range of about 5,000 pre-crash scenarios based on the GIDAS database, which can be used for simulations (GIDAS – German In-Depth Accident Study). Furthermore, other institutions such as the Hannover Medical School, as well as vehicle manufacturers and the German insurance industry, all carry out their own accident research. Central to this is investigating accidents directly at the scene, statistically recording and analyzing them according to certain characteristics, and, where needed, using this to further develop effectiveness of future vehicle automation (Langwieder K, Bengler K, Maier F, 2012).

Accident databases can be divided into two different kinds: the so-called in-depth databases such as GIDAS (Germany), INTACT (Sweden), iGLAD (EU), NASS-CDS (US National Automotive Sampling System, Crashworthiness Data System) or CIREN (US Crash Injury Research and Engineering Network, and secondly national statistics (e. g. Destatis).

In-depth databases normally contain fewer accidents with many detailed variables (GIDAS in Germany contains around 2,000 accidents per year with up to 3,000 variables). Conversely national statistics cover the huge amount of all recorded accidents (e.g. 2.4 million registered accidents in Germany) but only give limited information about these collisions.

In contrast to the two above, the scenarios in this publication provide both: a large database and more extensive information from police recording with regard to standardized validation and testing. For the following analysis 1.28 million area-wide police accident data between 2004 and 2014 from the Saxony State Interior Ministry (Sächsisches Ministerium des Inneren SMI) were used. The database covers all traffic accidents on the entire road network of Saxony. Exclusive access to the corresponding database was provided by Fraunhofer Institute for Transportation and Infrastructure Systems (IVI). The process of this evaluation in cooperation with Fraunhofer IVI is based on 297 standardized types of accidents.

The following questions will be discussed, using the database provided by the SMI:

  • Which factors support a safe development, validation and ethical testing?

  • What is the significance of bad weather conditions, based on a first area-wide analysis of traffic accidents in Saxony, regarding the introduction of automated vehicles?

  • Which real-world scenarios are relevant for the development, evaluation and testing of automated vehicles?

3.2 Safe Development, Validation and Testing

3.2.1 Return of Feedback from Lifecycle of Automated Vehicles

A safe development for safe automated vehicles is a key requirement. It also relates to the interaction between the vehicle and its environment. Using the support of systems with lower automation degrees requires a save driver interaction including safe take-over procedures (Matthaei R, Reschka A, Rieken J, Dierkes F, Ulbrich S, Winkle T, Maurer M, 2015; Bengler K, Zimmermann M, Bortot D, Kienle M, Damböck D, 2012). Development with regard to safe usage of driverless vehicles must ensure ability to recognize the criticality of a situation, decide on suitable measures for averting danger (e.g. degradation, driving maneuver) that lead back to a safe state, and then carry out these measures.

To fulfill the required safety confirmation, Fig. 4.14 recommends a circuit of working methods from the development team which can be supported by additional experts, confirmation tests using relevant test scenarios and monitoring automated vehicles after market introduction up to decommissioning. In the final stages of developing an automated vehicle, the development team has to verify that a vehicle reacts as previously predicted or in other ways appropriate to the situation.

There are three valid methodologies to prove the safety confirmation. A direct sign-off will be carried out through an experience-based recommendation of the automated vehicle development team itself. In addition, final evidence of safety can be passed after corresponding reconfirmation via an interdisciplinary forum of internal and external experts or an objective proof. Evidence of functional safety is possible via means of a confirmation test with relevant traffic scenarios. They are based on real-world scenarios with weather data (see Ch. 3), vehicle operation data, or other verifiable samples from monitoring of operation and service until decommissioning.

This book provides selected traffic scenarios to configure and perform confirmation tests for example virtual-, trial area- or field tests of automated vehicles. Starting from chapter 3, relevant real-world scenarios with reduced visibility for human and machine perception were considered. The scenarios were analyzed from traffic accident police reports with difficult weather conditions.

3.2.2 Requirements for Automated Driving to Minimize Risk

The selected scenarios from chapter 3 also support the fulfillment of requirements for automated vehicles. A minimum requirement any vehicle must meet—in order to be marketed by a manufacturer – is compliance with directives and regulations.

For safe automated driving functions, interdisciplinary coordinated development and approval processes are required, which permanently have to be adopted for new technologies. Standards and technical specifications with regard to automated or assisted vehicle functions have been growing steadily over the last years. As a part of the obligation to ensure traffic safety, new requirements for designing automated vehicles will be developed incrementally and previous approaches will be adapted. In particular minimizing risks, hazards or damage can prevent technical failures. Examples of requirements in the European Union or the United States can be divided in two categories (see Fig. 3.1): Type approval (grey) and duty of care (blue).

Fig. 3.1
figure 1

Requirements for Type Approval and Duty of Care to minimize risk, hazards and possible damage of automated driving [3], [16], [18]

Full size image

3.2.2.1 Requirements for Duty of Care

To demonstrate Duty of Care, ISO standards from the International Organization for Standardization (ISO) have to be proved as a state-of-the-art requirement. Over the years, many ISO standards elaborate for new automated vehicle functions (see examples in Fig. 3.1). They include: ACC Adaptive Cruise Control (ISO 15622), APS Assisted Parking System (ISO 16787), CSWS Curve Speed Warning System (ISO 11067), ERBA Extended Range Backing Aid (ISO 22840), FVCWS Forward Vehicle Collision Warning System (ISO 15623), FVCMS Forward Vehicle Collision Mitigation System (ISO 22839), Automotive Cybersecurity (ISO 21434) and ISO TR 4804 following by ISO TS 5083 Safety and cybersecurity for automated driving systems.

The design of automated systems from an ergonomic point of view is a key issue as well. Examples for standards based on ergonomic aspects of transport information and control systems are: Calibration tasks for methods which assess driver demand due to the use of in-vehicle systems (ISO 14198), specifications and test procedures for in-vehicle visual presentation (ISO 15008) or a simulated lane change test to assess in-vehicle secondary task demand (ISO 26022). Central requirements for safe development are considered in standards such as the ADAS Code of Practice definition for Level 0–2 Systems (Knapp A, Neumann M, Brockmann M, Walz R, Winkle T, 2009), Code of Practice for Automated Driving for Level 3–4 Systems (Annex Fig. A.8), ISO 22737 Intelligent transport systems – Low-speed automated driving (LSAD) systems for predefined routes – Performance requirements, system requirements and performance test procedures, ISO 26262 functional safety (ISO 26262-3, 2018) or ISO 21448 (Publicy Available Specification PAS) (ISO/PAS 21448, 2019). Overall, the 2009 SOTIF ISO standard supports the SOTIF Safety Of The Intended Functionality, a part of technical safety that deals with the hazards of technical systems. At the heart of SOTIF is the uncertain question of how to specify, develop, verify and validate an intended function so that it can be considered reasonably safe. Accordingly, the following questions must be considered when designing a driver assistance system with regard to SOTIF:

What are the limitations of the sensors you use?

How do the actuator limits affect the intended function?

How can the driver incorrectly use an assistance system?

Which verification and validation measures have to be taken to test the intended function?

Ergonomically the demands for automated driving systems can be assigned to all three levels of tasks while driving:

Primary tasks include everything that is directly involved in the driving task, such as longitudinal and lateral guidance. Secondary tasks support safe driving, including activating the windshield wipers or headlamps, which today are usually automatically operated by assistance systems. Tertiary tasks to control infotainment systems in the vehicle, such as radio, navigation system, telephone or other information from the internet are increasingly requested. To this day, due to safety reasons the primary driving task should always be at the center of the attentive driver.

The focus of the following schematic representation is on the capabilities of sensor technology and data processing particularly with regard to those functions that relate to the primary driving task (navigation, maneuvering and stabilization). Especially by supporting the maneuvering task, driving in the corresponding driving sections has changed significantly compared to previous driving habits (Bubb H, Bengler K, Grünen R-E, Vollrath M, 2015).

While ISO standards in the EU tend to have more of a minimum requirement character, safety standards set by SAE International in US and Canada are seen as legally binding. SAE International was initially established as the Society of Automotive Engineers (SAE) and coordinates the development of technical standards for engineering professionals in various industries. Currently several SAE Standards for several functions, including Adaptive Cruise Control (ACC) and Pedestrian Collision Mitigation System (PCMS) exist (see Fig. 2.5).

3.2.2.2 Requirements for Type Approval

In order to introduce an automated vehicle with all its components into the international market, it is necessary to comply with the required market-specific type approval regulations.

  • EU market:

    For the EU member states and other contractual partners, harmonized regulations apply. To receive type approval of motor vehicles especially provisions for braking and steering set by the Economic Commission for Europe of the United Nations (UN/ECE) must be fulfilled. Each country that joined the 1958 Agreement or the 1998 Agreement on Global Technical Regulations (GTRs) has the authority to test and approve manufacturer's designs. The Harmonization of Vehicle Regulations starts with exemplary requirements such as ECE R 1 (headlights) and goes up to ECE regulation number R 13 with uniform provisions concerning the approval for braking comply with automated driving systems. In contrast, ECE R 79 (revision 2, chapter 5) construction provisions with regard to steering equipment already have limitations for “low speed maneuvering or parking operations”. Other relevant examples are constantly expanding: ECE R 130 and ECE R 152 (Lane Departure Warning System LDWS), ECE R 131 (Advanced Emergency Braking Systems AEBS), ECE R 151 (Blind Spot Information System for the Detection of Bicycles), ECE R 155 (Cyber Security), ECE R 156 (Software Updates) or specifically the ECE R 157 (Automated Lane Keeping Systems ALKS). The UN ECE regulation R 157 allows temporary hands-free driving when a belted driver is available on motorway-like roads under suitable environmental and infrastructure conditions with a maximum speed of up to 60 km/h:

“Automated Lane Keeping System (ALKS) for low speed application is a system which is activated by the driver and which keeps the vehicle within its lane for travelling speed of 60 km/h or less by controlling the lateral and longitudinal movements of the vehicle for extended periods without the need for further driver input.”

The Vienna Convention on Road Traffic is designed to facilitate international road traffic and to increase road safety by establishing standard traffic rules among the contracting parties. The convention was agreed upon at the United Nations Economic and Social Council's Conference on Road Traffic in 1968. It stipulates that the driver has to control the vehicle under all circumstances.

In 2014, the Convention was supplemented by a paragraph in Article 8:

„Vehicle systems which influence the way vehicles are driven shall be deemed to be in conformity with paragraph 5 of this Article and with paragraph 1 of Article 13, when they are in conformity with the conditions of construction, fitting and utilization according to international legal instruments concerning wheeled vehicles, equipment and parts which can be fitted and/or be used on wheeled vehicles” …

“Vehicle systems which influence the way vehicles are driven and are not in conformity with the aforementioned conditions of construction, fitting and utilization, shall be deemed to be in conformity with paragraph 5 of this Article and with paragraph 1 of Article 13, when such systems can be overridden or switched off by the driver …”

This means that new systems are also considered to be consistent if they comply with the approval regulations, in essence the ECE directives. If they do not comply with the regulations, they should be considered to be in accordance if they can be overridden or switched off by the driver.

A future goal for fully automated vehicles is the modification that they will be treated like human drivers (United Nations Economic and Social Council's Conference on Road Traffic in 1968).

  • US market:

In order to sell a motor vehicle in the North American market, a vehicle manufacturer must certify that the vehicle meets performance requirements specified in the Federal Motor Vehicle Safety Standards (FMVSS). US and Canadian vehicle safety regulations operate on the principle of self-certification. The manufacturer or importer of a vehicle or item of motor vehicle equipment certifies, asserts and promises that the vehicle or equipment complies with the safety standards.

The FMVSS encompass 73 separate standards that generally focus on crash avoidance, crashworthiness, and post-crash survivability. First introduced through the National Traffic and Motor Vehicle Safety Act of 1966, these standards have been developed with the assumption that vehicles are driven by a human driver. However, a review in 2016 revealed that there are few barriers for automated vehicles to comply with FMVSS, as long as the vehicle does not substantially deviate from a conventional vehicle design. Two standards (theft protection and rollaway prevention FMVSS 114 and light vehicle brake systems FMVSS 135) were identified to be updated for automated vehicles with conventional designs (Kim A, Perlman D, Bogard D, Harrington R, 2016).

3.3 Real-World Scenarios for Development and Testing

3.3.1 Machine versus Human Perception Limits with Consequences for Testing

To illustrate the challenge of human perception and furthermore the limited performance of machine perception with Artificial Intelligence under difficult weather conditions, one example has been demonstrated previously. This example results from the comprehensive accident analysis of accidents with restricted visibility described in detail later in this chapter. The real-world situation below (Fig. 3.2) considers the single fatal pedestrian accident which was found in this analysis. The translated police accident report describes the circumstances as follows:

  • … The pedestrian 01 walked along State Road S 227. He was on the left side of the road. Approximately 100 meters after a branch a collision with the oncoming car 02 occurred. The pedestrian was under the influence of alcohol …

Fig. 3.2 represents the real accident scene before collision including a simplified model of currently available sensor technologies with image recognition and Artificial Intelligence. To be able to collect information about its environment, a vehicle needs sensors, which are classifiable according to their physical measuring principle. The automobile sector mainly uses Radar, Lidar, near and far infrared, ultrasonic sensors, and cameras. Camera sensors have limited perceptual performance in the dark. Lidar and radar sensors are even active sensors. They actively emit laser pulses in the infrared range or radar radiation and measure the distance to objects, their relative speed and their size on the basis of reflections. These sensor principles work quite reliably in clear visibility and darkness without additional weather restrictions like snow in this example.

The upper and center images of Fig. 3.2 show what humans might perceive among difficult light- and weather conditions (rain, snow, backlight, wet road surface, spray/splashing water, icing/contamination of windshield/sensors, road markings only partially visible). In addition, the center and lower images, simplified and color-coded, depict limited machine perception and interpretation of individual measuring principles. The center image superimposes human- and machine perception. Using all these above-named measurements it is revealed in this scenario that the left-hand radar reflection point (blue) is a false detection, caused by a reflection in the opposite lane. The challenge of exclusively limited machine perception and interpretation is demonstrated by the lower image.

Fig. 3.2
figure 2

Challenge of human and machine perception with image recognition and Artificial Intelligence of a pedestrian. Left side: Pedestrian is visible in the light beam and closer than the oncoming vehicle. Right side: Pedestrian is invisible out of the light beam for human perception when distance is greater than oncoming vehicle lights (upper images: driving scene with human perception, center images: overlay human with machine perception Radar in blue with Lidar in yellow, camera-image processing in green and red, lower images: driving scene with machine perception and interpretation using image recognition and Artificial Intelligence)

Example of fatal pedestrian accident in Saxony.

Full size image

Difficult lighting- and weather conditions challenge human and machine perception in real traffic situations. Furthermore, machine interpretation of complex traffic situations continues to present development engineers with considerable technical challenges. These include detecting static and dynamic objects, physically measuring them as accurately as possible, and allocating the correct semantic meaning to the detected objects.

To analyze scenarios considering reduced visibility due to fog, rain, snow, darkness and glare from sun or headlights, a first of its kind area-wide accident study with support from Daimler Research, the Daimler and Benz Foundation and the Fraunhofer IVI for Transportation and Infrastructure Systems in Dresden was carried out. This area-wide accident data analysis is able to indicate temporally and geographically related accident black spots.

3.3.2 Relevant Real-World Scenarios for Development and Testing

Figure 3.3 shows that the current possibilities of such area-wide traffic scenario investigation for developmental requirements offer further insights, for example also with regard to nearly-missing accidents.

Area 1, shown as a globe on the left in Figure 3.3, stands for day-to-day safe traffic scenarios that do not lead to collisions. Most of these scenarios are not known to us.

The small grey area 2 contains the traffic scenarios that have been investigated in-depth, but only partially researched today. Among them are findings from field studies and investigations of traffic accident research, which usually analyze the “worst case”. German accident statistics in 2020 show that a fatal traffic accident occurred only every 270 billion kilometers driven. (see Annex Fig. A.13). Restricted accident recording criteria, for example those of OEMs or GIDAS, often limit the number of accidents to either certain locations, times, special collision conditions such as airbag deployment, involvement of injured persons, special pedestrian accidents, vehicle types or other general conditions, and must therefore first be weighted for statistical relevance.

Area 3 contains all previously unknown and unresearched traffic scenarios.

The hatched red overlap as area 4 between areas 2 and 3 represents traffic accidents with fatalities or injuries that are only investigated to some extent or are accessible, for example, via accident type catalogues.

Fig. 3.3
figure 3

(Source: Winkle T.)

Accident investigations offer further insights, for nearly missing accidents (see also Fig. 3.5).

Full size image

The aim up to sign-off and SOP in the right-hand grey area 2 illustration is to extend selectively investigated traffic situations to cover area-wide all traffic accidents, including the smallest accidents (micro-accidents) with minor touching and traffic violations without damage. This allows conclusions to be drawn about nearly-missing accidents. Also included are accidents only resulting in injuries and only material damage, which account for a significant proportion. In 2020, 327,550 people were injured in road traffic and at the same time less than 2 million traffic accidents with material damage were documented (see Annex Fig. A.14 and A.15). All these scenarios are all described electronically in police databases with the exact location.

As a result, this increases area 2 on the right-hand, while at the same time reducing all limited or unresearched scenarios, as illustrated by the now smaller areas 3 and 4.

In this research, area 2.x is representative for the federal state of Saxony and is recommended as a further piece of the puzzle for the extension of the selectively researched restricted visibility scenarios in area 2. The analysis of poor visibility real-world test scenarios is also generally mentioned in the ISO standard 21448 published in 2019 (ISO/PAS 21448, 2019). According to the standard, each scenario starts with a starting scene. Within these, actions, events, goals and values can be defined in order to describe the chronological sequence within a scenario. In comparison to a scene, a scenario extends over a certain period of time. The official statistics collect more than 100,000 accidents in Saxony annually. This analysis is based on all 1,286,109 police-recorded accidents over ten years starting from the year 2004. Figure 3.4 shows the number of these accidents from 2004 to 2015 and their consequences with regard to personal injury or property damage.

Fig. 3.4
figure 4

Area-wide analysis based on 1.286.109 police accidents recorded in Saxony from 2004–2014

Full size image

The analysis of area-wide traffic accidents with difficult weather conditions and reduced visibility for human and machine perception produces the results below. Through the analysis of all 1.286.109 police reports from the years 2004 to 2014 in Saxony, 374 accidents with the above-mentioned criteria were found.

Fig. 3.5 presents all geographically assigned accident sites with relevant scenarios due to limited visibility. The accident severity ranges from the slightest damage, such as a scratch (similar to a near-miss), to the dramatic fatal pedestrian accident mentioned above.

The knowledge of all area-wide collisions over the complete range of unusual collisions, from micro accidents to the most serious crash, with knowledge of the exact geographical location of the accident, forms the basis for the in-depth accident analysis concerning virtual, trial and field tests of automated vehicles.

Fig. 3.5
figure 5

(Geographical data © state-owned enterprise geo basic information and measurement Saxony 2015)

Area-wide geographically related traffic accidents with difficult weather conditions and reduced visibility for human and machine perception.

Full size image

For a deeper insight into the subject, the author conducted a case-by-case analysis of all information given in the police accident reports with the following findings:

3.3.2.1 Categories of Accident Causes With Reduced Visibility

A total of 374 area-wide traffic accidents with 417 accident causes can be subdivided into seven main categories of difficult weather conditions (see Fig. 3.6). They include 237 collisions (by far the largest part) due to reduced visibility by fog. In addition, there were 61 cases with glare or blinding from the sun, 60 cases due to rain, 22 cases due to snow and eight cases due to blinding of headlights forced by oncoming traffic. Only four cases were primarily connected to visual obstructions.

Fig. 3.6
figure 6

Distribution of 374 accidents with fog, glare, rain and snow in Saxony

Full size image
$$p = \frac{{\text{Number of all area wide accidents}}}{{\text{Number of accidents connected to associated visual obstruction}}}$$
(3.1)

The four accidents provoked by visual obstructions through parking vehicles (pedestrian accident), a garbage can and snow piles are described as follows:

  • … In height of position … Mrs. … crossed the lane on foot. Thereby she walked from between parking cars right after a passenger car into the driving lane… Because of the rain, she was holding an umbrella in front of her …

  • … Due to poor visibility (snow piles) and traffic caused, driver 01 had to move further on in … street …

  • … Driver 01’s view of the access road was restricted by a garbage can …

  • … According to statements by driver 01, the view was restricted by snow piles with regard to 02 …

3.3.2.2 Injuries Caused by Accidents With Reduced Visibility

In the 374 relevant accidents, 760 people were involved. The majority of these collisions resulted only in property damage. In total, 609 people remained uninjured. 99 people were slightly injured, 51 were badly injured and one person killed (Fig. 3.7).

Fig. 3.7
figure 7

Injuries from 374 accidents with difficult weather conditions and 749 participants

Full size image

3.3.2.3 Accident Types in Connection With Reduced Visibility

Furthermore, the conflict situations were categorized in accident types. In the context of the cause of the accident that led to the conflict, the accident type (UTYP) describes the initial phase before the damage occurs. On the main level seven types of accidents can be distinguished, which can be further subdivided into a second or third level. The main levels are (Accident Research Department of the German Insurance Association 2003):

  • UTYP 1xx: dynamic accidents (driver lost control over the vehicle, such as inappropriate speed, incorrect assessment of road course or road condition)

  • UTYP 2xx: accidents during turning

  • UTYP 3xx: turning at/crossing intersections

  • UTYP 4xx: pedestrian accidents

  • UTYP 5xx: stationary traffic

  • UTYP 6xx: parallel traffic

  • UTYP 7xx: other accidents

As a result, Fig. 3.8 shows that the majority of 71 accidents are related to several accident types in longitudinal traffic (UTYP 199). Furthermore 45 right turn collisions (UTYP 102) occurred. Another 26 collisions were related to bends in the roadway (UTYP 139) and 20 to left turn collisions (UTYP 101).

Further on, 44 wildlife accidents (UTYP 751), 26 collisions with vehicles turning left with oncoming traffic (UTYP 211) and 17 other collisions in oncoming traffic occurred.

Fig. 3.8
figure 8

Main areas of accident types (UTYP 101–799) with difficult weather conditions

Full size image

The large proportion of dynamic accidents (UTYP 1: 101–199) with 49 percent reflects that drivers often lose control over their vehicles under difficult weather conditions (Fig. 3.9).

Fig. 3.9
figure 9

Distribution of accident types (UTYP 1xx–7xx) with difficult weather conditions

Full size image

3.3.2.4 Evasive Maneuvers to Avoid Accidents

In connection with automated driving systems, evasive driving maneuvers are often discussed from an ethical point of view.

Therefore, this case-by-case real-world analysis provides insights:

The descriptions in this case-by-case analysis point out five collisions, where the drivers were able to reduce the consequences of an accident by evasive maneuvers. Another 13 drivers (4%) tried to prevent the collision but failed with their evasive maneuvers. A major proportion of 356 accidents (95%) confirms no indications of evasive actions (see Fig. 3.10).

Fig. 3.10
figure 10

Main areas of accident types with difficult weather conditions

Full size image

Out of all 374 accidents, some evasive maneuvers are clearly not relevant to avoid collisions in the following cases: 127 accidents caused by lane departure and accidents with moving objects (e.g. 43 animals caused collisions) are difficult to avoid, because it is unknown if the animal will continue running, stop or reverse.

$$\begin{aligned} n\left({\textit {relevant evasive maneuvers to avoid collisions}} \right) = \\ n\left( {gesamt} \right) - n\left( {lanedeparture} \right) - n\left( {movingobjects} \right) = 347 - 127 - 43 = 177 \\ \end{aligned}$$
(3.2)

3.3.2.5 Examples for Minor and No Damage to Property

Two cases of the data set describe only minor damage to the involved vehicles and no injuries. The translated parts of the police accident reports below show two cases with no damage and one with slight scratches:

… 01 parked his car backwards in a parking slot. Because of his limited view, darkness and rain, he slightly touched the parked car at the back … He could not find any damage on either vehicle …

… Driver 02 rule-consistently stopped at the parking lot … to let passengers get off the car. 01 rear-ended 02. The reason for this was snow on the roof which slips on the windshield when braking. Snow blocked the view and 01 reacted too late … There were no obvious damages to determine at car 01. Slight scratches were visible on passenger car 02 …

3.3.3 Integration of Relevant Test Scenarios for Safe Automated Vehicles

For a complete overall evaluation of highly and fully automated vehicles’ functional safety, area-wide real-world accident scenarios with no harm to people, near collisions, traffic simulations and weather data as well as analysis provide the best basis. Knowing all relevant factors that may lead to a collision, virtual simulations can be performed based on detailed and quantitative models. Therefore, this first-time comprehensive area-wide study based on all police reports was carried out (Winkle T, 2015a).

The findings can be completed with information from hospitals, insurance companies and models of human behavior. Especially takeover situations between driver and machine involve new challenges for design and validation of human-machine interaction. Initial tests at the Chair of Ergonomics at the Technical University of Munich (TUM) demonstrate relevant ergonomic design requirements which will be continued (Bengler K, 2015).

3.3.4 Test Scenarios and Requirements in Relation to Legal and Ethical Aspects

The analyzed test scenarios and requirements also provide information about “allowed” risks and risks accepted by society. Using vehicles with automated functions, unforeseeable reactions have to be expected, which in the worst cases may even cause injuries and fatalities. Due to the growing complexity, highly or fully automated vehicles currently involve risks which are difficult to assess. In addition, there are new liability questions and limited tolerance for technical failure. While over 1.2 million traffic fatalities currently seem to be acceptable to society all over the world, there is likely to be zero tolerance for any fatal accident involving presumable technical failures.

On the other hand, automated driving systems promise considerable potential safety benefits.

So far, many questions remain unanswered such as:

  • What confidence is required for particular traffic scenarios?

  • How can duty of care be fulfilled?

  • What changes legally when a machine detects and drives instead of a driver?

Test scenarios and design requirements will support a safe development and support fulfillment for duty of care. However, in general, creation of risks results in duty of care requirements but not every generation of hazards is forbidden. This occurs if automated functions cause significant social benefits. Risks have to be reduced to a minimal level. Which risks the user reasonably will expect has to be negotiated by society. Levels of acceptable risks will be discussed by the media, society, during development of standards and at court. The question which risks a society is willing to accept should be differentiated from the question how critical traffic scenarios have to be assessed during development. It should be assumed that the developers and programmers are not liable to prosecution for negligence if they act within the permitted risk. In the foreseeable future the driver remains liable.

Dilemma situations will occur until the machine perception or prediction can reliably distinguish for example between old man and young lady or if cyclists wear a helmet. The aim is to reduce risks. Shifting of risks is forbidden (Di Fabio U et. al., 2017).

3.4 Conclusion and Outlook

Perceiving and interpreting complex traffic situations with difficult weather conditions, development engineers are faced with considerable technical challenges. Therefore, the provided scenarios include representative situations for the transfer to worldwide similar road networks. They will be considered in development standards, both for early simulations as well as for the subsequent real test.

The considered 1,286,109 police-recorded accidents in the exemplary state Saxony over ten years starting from the year 2004 are reduced to 374 real-world scenarios for bad weather condition. A distribution of accident types under these circumstances shows 49 percent of collisions where the driver lost control of his or her vehicle. The cause is presumed to be the reduced friction values on slippery road surfaces. In particular left turn, right turn maneuvers or bends in roadways occur more frequently and have to be considered for testing (see Fig. 3.8).

Finally, the case-by-case analysis points out only five collisions, where the drivers tried to reduce the consequences of an accident by evasive maneuvers. Only 177 cases are relevant due to the general conditions to be considered for evasive maneuvers to prevent or mitigate collisions. These accidents could possibly be prevented by future automation systems. Additional measurements and traffic simulations of the well-known accident locations – which were not examined in this analysis – will support for a deeper understanding.

In summary, the following issues will have an impact for testing:

  • Starting from the level highly automated and beyond, accident participants – at least temporarily – have no responsibility for the controllability of the vehicle. The consideration of relevant scenarios for risk reduction and ensuring the functional safety of electrical and/or electronic systems is therefore of significant importance.

  • Area-wide accident analyses covering all reported accidents provide relevant scenarios for testing and verification of automated vehicles including virtual simulation methods.

  • To obtain further findings for the development and design of safe automated vehicles, existing in-depth surveys of severe road accidents involving personal injury (e.g. GIDAS) should be combined with available area-wide accident collision data, digital geographic mappings, weather data and virtual traffic simulations.

  • Furthermore, beyond accidents also critical incidents with successful evasive behavior have to be analyzed based on road, traffic conditions and NDS data.

It is recommended to comprehensively link geographically defined road-accident data and the accompanying high-definition geographic digital mapping data (e.g. Google Maps, Nokia HERE, TomTom, OpenStreetMap) with traffic-flow data from different sources (e.g. cars, mobile phones, road traffic devices). In the future, vehicle operation data and traffic simulations could be included as well.

Based on these relevant real-world scenarios the author recommends further development of internationally valid guidelines – such as the ADAS Code of Practice definition, ISO 26262 functional safety or ISO PAS 21448 to support safety of the intended functionality (SOTIF) – with virtual simulation methods for verification of automated vehicles and final testing of the overall system limits in a real environment. Error processes and stochastic models have to be analyzed (in combination with virtual tests in laboratories and driving simulators) to control critical driving situations. This includes interaction tests with control algorithms and performance verification of real sensors in real traffic situations, particularly at the time just before a collision (Schöner H-P, Hurich W, Luther J, Herrtwich R G, 2011; Schöner H-P 2015).

In general, it is recommended to identify worldwide networks, collaborate with affected partners, engage government representatives, local non-governmental organizations (NGOs) and promote road safety awareness (Feese J, 2016). Many governments and authorities encourage the deployment of new technologies with the potential to save lives. They work with industry, governmental partners, and other stakeholders to develop new technologies and accelerate their adoption in type approval regulations and standards.