在一個(gè)理想的世界中，自動(dòng)駕駛汽車將全知全能。車輛將有能力進(jìn)行觀察、通信和計(jì)算，并最終準(zhǔn)確判斷道路上的任何危險(xiǎn)，并及時(shí)采取措施避免所有風(fēng)險(xiǎn)發(fā)生。然而，在理想世界成為現(xiàn)實(shí)之前，自動(dòng)駕駛開發(fā)商、監(jiān)管者以及普通民眾均必須面對(duì)一個(gè)亟待回答的問(wèn)題：要多安全，才夠安全？
截至目前，盡管人們已經(jīng)在自動(dòng)駕駛研發(fā)上投入了大約 1000 億美元，但這個(gè)問(wèn)題仍沒(méi)人能夠自信回答。相關(guān)安全標(biāo)準(zhǔn)和度量指標(biāo)尚未建立，世界領(lǐng)先的機(jī)器人學(xué)家對(duì)此只能撓頭，監(jiān)管機(jī)構(gòu)在很大程度上也無(wú)所適從。如果無(wú)法回答這個(gè)近乎抽象的問(wèn)題，自動(dòng)駕駛汽車的所有潛力都只是鏡花水月，減少事故、挽救生命、節(jié)省時(shí)間并最終實(shí)現(xiàn)交通民主化的承諾也只是美夢(mèng)一場(chǎng)。
TechCrunch Mobility2019 大會(huì)期間，“業(yè)內(nèi)領(lǐng)先的一些公司已經(jīng)進(jìn)入驗(yàn)證和測(cè)試的階段了。我們也充分意識(shí)到安全問(wèn)題是我們的發(fā)展道路上無(wú)法規(guī)避的重要環(huán)節(jié)。”一級(jí)技術(shù)供應(yīng)商 Aptiv 公司的自動(dòng)駕駛總裁 Karl Iagnemma 在接受采訪時(shí)斷言：“這是當(dāng)今業(yè)界最亟待解決的問(wèn)題。”
Aptiv 公司在 2018 年推出了全球首個(gè)自動(dòng)駕駛“招車”服務(wù)。該試點(diǎn)的大本營(yíng)位于美國(guó)拉斯維加斯，主要使用 Lyft 的車輛。此外，Aptiv 公司也在新加坡、波士頓和匹茲堡等地投放了自動(dòng)駕駛汽車。
盡管，自動(dòng)駕駛汽車的安全問(wèn)題仍然難以回答，但萬(wàn)變不離其宗，大概也脫不開業(yè)界熱議的三個(gè)字母：ODD。ODD 的全稱為Operational Design Domain（即運(yùn)行設(shè)計(jì)域），主要詳列自動(dòng)駕駛汽車可能遇到的所有重疊條件、用例、限制和場(chǎng)景，哪怕是最不可思議的邊緣案例也必須明列其中。
卡內(nèi)基梅隆大學(xué)電氣和計(jì)算機(jī)工程副教授 Phil Koopman 博士早在十到二十年前就已認(rèn)識(shí)到了 ODD 的重要性。
Koopman 教授表示，他從 1995 年起就意識(shí)到必須明確規(guī)定在哪些情景中自動(dòng)駕駛汽車可以或不可以安全駕駛。當(dāng)時(shí)，多位來(lái)自卡內(nèi)基梅隆大學(xué)的機(jī)器人專家乘坐裝一輛裝備了攝像頭、個(gè)人計(jì)算機(jī)和 GPS 接收器的 Pontiac 小貨車，完成了一次橫跨美國(guó)的“自動(dòng)駕駛”行程。去年秋天，Koopman 教授在芬蘭參加某個(gè)安全會(huì)議時(shí)與 SAE《無(wú)人駕駛汽車工程》雜志通話表示，“我們當(dāng)時(shí) 98% 的行程均是無(wú)人駕駛完成的，此后的 20 年中，我們一直在努力解決最后 2％的問(wèn)題。”
常見的 ODD 因素主要包括光照、天氣、地形和道路類型等，但要列舉所有的ODD 因素可能三天三夜也說(shuō)不完。
2019 年 1 月，Koopman（同時(shí)也是 EdgeCase Research 公司的聯(lián)合創(chuàng)始人）與Edge Case Research 公司的首席工程師 Frank Fratrik 共同發(fā)表論文《運(yùn)營(yíng)設(shè)計(jì)域、對(duì)象和事件有多少？》（How many Operational Design Domains, Objects, and Events），其中詳細(xì)列舉了四頁(yè)有關(guān) ODD 目標(biāo)檢測(cè)、故障和操作的因素。
該論文列舉了一輛自動(dòng)駕駛汽車可能面臨的各種非常規(guī)情況，包括眩光、社會(huì)規(guī)范、過(guò)時(shí)的地圖信息、收費(fèi)站、水洼、低垂的植物、倒下的電線、道路結(jié)冰、不合作的人、掉落的物體、快遞機(jī)器人和一些常見的人類違規(guī)行為。
Koopman 教授告誡稱，絕不能過(guò)分簡(jiǎn)單化 ODD。
“如果您只著眼于某一個(gè)街區(qū)，然后總結(jié)出一套 ODD，那這套 ODD 一定不會(huì)提供您應(yīng)該了解的全部?jī)?nèi)容。”Koopman 教授表示，“即使您反復(fù)在這個(gè)街區(qū)驗(yàn)證了 3 個(gè)月也無(wú)濟(jì)于事，您在一條街上是無(wú)法觀察到所有可能性的。”他還補(bǔ)充說(shuō)，哪怕是一條最冷清的街道，其變數(shù)也常常遠(yuǎn)超大多數(shù)人的想象。
Koopman 教授表示，“即使您天天去這條街上報(bào)道，但假設(shè)就10 月 31 日一天沒(méi)有去，那我可以保證這條街已經(jīng)和您最后一次去哪兒的時(shí)候不一樣了，至少美國(guó)的情況是這樣。”他說(shuō)，人類可以即刻識(shí)別眼睛觀察到的目標(biāo)，比如一位穿著亮黃色制服的建筑工人，但即使最好的自動(dòng)駕駛系統(tǒng)有時(shí)也會(huì)錯(cuò)判這些“明顯”信號(hào)。
AAA 北加州、內(nèi)華達(dá)州和猶他州公司的自動(dòng)駕駛汽車政策經(jīng)理 Xantha Bruso 已經(jīng)充分意識(shí)到建立一套基于 ODD的自動(dòng)駕駛安全標(biāo)準(zhǔn)的復(fù)雜性。不過(guò)，她認(rèn)為，提升公共安全勢(shì)在必行，自己對(duì)此并不感到畏懼。“開始真的不難，目前我們幾乎沒(méi)有任何與性能有關(guān)的標(biāo)準(zhǔn)，”她說(shuō)，“你總得從什么地方開始。”
在 AAA 位于美國(guó)加里福尼亞州伯克利市的北加州創(chuàng)新實(shí)驗(yàn)室中，Bruso 回答了一些關(guān)鍵問(wèn)題，比如“自動(dòng)駕駛的運(yùn)行條件是什么？如果環(huán)境變了，車輛無(wú)法繼續(xù)安全運(yùn)行了該怎么辦？車輛如何感知自己已經(jīng)馬上逼近 ODD 邊緣了？快到邊緣了又該怎么辦呢？自動(dòng)駕駛汽車該如何制定安全案例？又該如何與監(jiān)管機(jī)構(gòu)的安全定義相吻合？”
正是在背景下，AAA 北加州分部決心開發(fā)業(yè)內(nèi)極缺也急需的自動(dòng)駕駛汽車安全指標(biāo)。為了更好地實(shí)現(xiàn)這一目標(biāo)，AAA 選擇與“保護(hù)美國(guó)未來(lái)能源組織”（Securing America’s Future Energy，即 SAFE 組織）和 RAND 公司合作。“認(rèn)真研究了這個(gè)問(wèn)題后，我們意識(shí)到我們本末倒置了。”Bruso 介紹說(shuō)，“首先，我們需要安全運(yùn)行環(huán)境的根本定義，有哪些條件？”
對(duì)此，AAA的項(xiàng)目團(tuán)隊(duì)決定調(diào)整思路，首先為公司位于灣區(qū)的 2100 英畝自動(dòng)駕駛測(cè)試場(chǎng)地GoMentumStation 站點(diǎn)開發(fā)一套 ODD。Bruso 表示，“我們從GoMentum Station 開始，把這里當(dāng)作整個(gè)行業(yè)測(cè)試環(huán)境的一個(gè)代表，提取可定義且可重復(fù)的運(yùn)行條件。”Bruso 的計(jì)劃是發(fā)布和推廣這套 ODD，并希望其他測(cè)試站點(diǎn)也沿用相同的定義，或至少是相同的概念框架。長(zhǎng)遠(yuǎn)來(lái)看，目標(biāo)則是建立一套統(tǒng)一測(cè)試協(xié)議，可以把全球各地的自動(dòng)駕駛系統(tǒng)放在統(tǒng)一的框架下，使用同一套標(biāo)準(zhǔn)進(jìn)行比較。
Bruso解釋說(shuō)，現(xiàn)在，你無(wú)法用同一套標(biāo)準(zhǔn)比較不同的自動(dòng)駕駛系統(tǒng)。“一輛位于舊金山的Cruise 測(cè)試車需要面臨的ODD 條件比一輛位于鳳凰城的 Waymo 測(cè)試車更復(fù)雜。”她說(shuō)，“因此，你需要一套統(tǒng)一的衡量標(biāo)準(zhǔn)，這樣才可以從統(tǒng)一的經(jīng)緯度評(píng)判這些車輛。”
在創(chuàng)建ODD的過(guò)程中，保證靈活性至關(guān)重要。首先，從高速公路上的長(zhǎng)途卡車到郊區(qū)公路上的低速貨車，自動(dòng)駕駛系統(tǒng)供應(yīng)商需要面臨多種多樣的商業(yè)場(chǎng)景。其次，ODD 還必須獨(dú)立于自動(dòng)駕駛技術(shù)，無(wú)論公司采用哪種傳感器都必須達(dá)到同等級(jí)的安全性能。最后，由于各類利益相關(guān)者都在試圖建立更有利于自身的標(biāo)準(zhǔn)，這使得統(tǒng)一標(biāo)準(zhǔn)的實(shí)現(xiàn)變得更加艱難。
Bruso表示，“接下來(lái)，我們計(jì)劃呼吁整個(gè)行業(yè)，尋求最佳的合作方式。”
Koopman 教授認(rèn)為，ODD 清單要寫完長(zhǎng)度可能超過(guò)一英里，因此我們必須為其尋找一個(gè)更高度、更廣泛的目標(biāo)。他說(shuō)，“安全問(wèn)題歸根結(jié)底總是工程嚴(yán)謹(jǐn)與否的問(wèn)題。”有時(shí)候，這意味著我們必須精益求精，力求完美。正如十八世紀(jì)的意大利格言所說(shuō)，“完美不是優(yōu)秀的敵人。”
對(duì)于 Aptiv 和其他領(lǐng)先的自動(dòng)駕駛汽車公司而言，這是一種平衡的藝術(shù)。如今，自動(dòng)駕駛汽車上路的呼聲愈發(fā)強(qiáng)烈，人們迫切希望自動(dòng)駕駛汽車可以兌現(xiàn)增加收益和提高安全性的承諾。“實(shí)際上，這意味著我們將首先在更簡(jiǎn)單的駕駛環(huán)境中部署我們的技術(shù)。”Aptiv 公司的 Iagnemma 表示，“而后再逐步推廣至更加復(fù)雜的場(chǎng)景。”
Koopman教授表示，目前仍在開發(fā)中的UL 4600 標(biāo)準(zhǔn)明確指出，自動(dòng)駕駛制造商不需要完美。“您必須拿出良好的經(jīng)驗(yàn)測(cè)試數(shù)據(jù)，證明您的系統(tǒng)不會(huì)帶來(lái)不適當(dāng)?shù)娘L(fēng)險(xiǎn)。”他說(shuō)，“但您永遠(yuǎn)不能阻止系統(tǒng)的運(yùn)行條件發(fā)生改變。”換句話說(shuō)，您的 ODD將永遠(yuǎn)無(wú)法窮盡所有場(chǎng)景、用例和道路條件；自動(dòng)駕駛系統(tǒng)必須有能力理解未知，并在事故發(fā)生后快速做出修復(fù)措施。
本文獲得了來(lái)自 AAA 北加州、猶他州和內(nèi)華達(dá)州分部的支持。
作者：Bradley Berman
本文原發(fā)表于SAE《自動(dòng)駕駛車輛工程》雜志
In a perfect world, an automated vehicle (AV) would be all-knowing. Its sensors, communication systems and computing power could predict every road hazard and avoid all risks. But until a wholly omniscient self-driving vehicle is a reality, there will be one burning question for AV developers and regulators – and the public: How safe is safe enough?
Despite about $100 billion of investment in AVs to this point, nobody has an adequate answer. Safety standards and metrics have not yet been established. The world’s leading roboticists are scratching their heads. Regulators are largely perplexed. Until there’s an answer to this almost abstract question, the great promise of AVs to reduce accidents and save lives, free up our time and democratize mobility will remain beyond our grasp.
“The leading players reached a point where we’re going through validation and testing. And we realized that the safety question is in our critical path,” said Karl Iagnemma, president of autonomous mobility at Tier-1 tech supplier Aptiv, in an interview at the TechCrunch Mobility 2019 conference. “It’s the biggest unanswered question in the industry today,” he asserted.
Aptiv launched the world’s first commercial AV ride-hailing service in 2018. That pilot project, using Lyft vehicles, is based in Las Vegas. Aptiv also deployed AVs on the streets of Singapore, Boston and Pittsburgh.
While easy answers to the AV safety question are elusive, the path forward could come down to the industry’s widely and often-debated three-letter acronym: ODD, or Operational Design Domain. The term defines all conceivable overlapping conditions, use cases, restrictions and scenarios that an AV might encounter – even the most esoteric edge cases.
Dr. Phil Koopman, associate professor of electrical and computer engineers at Carnegie Mellon University, is a decade or two ahead of the pack in realizing the critical importance of ODD.
Koopman said that since 1995, he’s known about the importance of establishing the scenarios in which AVs can and cannot remain safe. That’s when a team of Carnegie Mellon roboticists traveled coast-to-coast in a Pontiac minivan decked out with a video camera, personal computer and a GPS receiver. “We had our hands off the wheel for 98 percent of the trip,” he told SAE’s Autonomous Vehicle Engineering via phone last fall while attending a safety conference in Finland. “And for the last 20 years, we’ve been working on the last two percent. ”
Common ODD factors include time of day, weather, terrain and road features. But the list gets very long, very fast.
In January 2019, Koopman, a co-founder of Edge Case Research, co-authored a white paper, “How many Operational Design Domains, Objects, and Events” (co-author was Frank Fratrik, lead engineer at Edge Case Research. )The paper essentially is four pages worth of bullet points of factors related to ODD object detection, faults and maneuvers.
The paper’s laundry list of ODD oddities – impactful factors that an AV might encounter – includes glare, social norms, outdated mapping detail, tollbooths, water-filled potholes, overhanging vegetation, downed power lines, icing, uncooperative people, falling objects, delivery robots and common human rule-breaking.
Koopman cautions against overly simplistic approaches to ODD.
“If you take a city block and say that’s my ODD, it doesn’t tell you what you need to know,” he said. “It just limits the possibilities even if you’ve driven along that street for three months. ”Koopman added that even a simple street has way more variability than most people appreciate.
“If you never drove on that street on October 31, I will guarantee you things change on that day, at least in the United States. ”He said that humans can immediately recognize things – construction workers wearing yellow high-visibility uniforms, for instance – that are sometimes missed by even the best AV systems.
Xantha Bruso, manager of autonomous-vehicle policy at AAA Northern California, Nevada & Utah, fully recognizes the complexity of establishing ODD-based AV safety standards. But seeing the public-safety imperative, she’s undaunted. “The bar is really low. There are currently no performance-based standards,” she said. “You have to start somewhere. ”
In a conference room at AAA Northern California’s innovation lab in Berkeley, Calif. , Bruso rattled off the key questions. “What conditions can the AV operate in? What happens when something changes in the environment that prohibits it from operating safely?How can it sense that it’s getting close to the edge of the ODD? What happens then? How does an AV company make its safety case? How does all this mesh with how regulators are defining safety?”
These questions and others informed AAA Northern California’s work to develop AV safety metrics sorely lacking in the industry. For the project, the organization partnered with Securing America’s Future Energy (SAFE) and RAND Corporation. “When we gave it a careful look, we realized that we were putting the cart before the horse,” Bruso said. “First, we need the foundational definitions for where it’s safe to operate. What are those conditions?”
So the project team turned its attention to developing an ODD for GoMentum Station, the Bay Area’s 2,100-acre AV testing facility owned by AAA Northern California. “We’re starting there,” said Bruso. “We’re using GoMentum Station as a proxy for an industry-wide test environment. We can make those conditions defined and repeatable. ”Bruso’s plan is to publish and promote its ODD with the hope of having other test tracks use its definitions – or at the least, the same conceptual framework. The long-term vision is to establish a testing protocol for apples-to-apples comparisons of AV systems throughout the world.
Bruso explained that those comparisons currently are not possible. “A Cruise vehicle testing in San Francisco has a more-complicated ODD than a Waymo in Phoenix,” she said. “You need a baseline of conditions to evaluate these vehicles on an equal footing.”
Flexibility will be crucial. Industry players follow a wide array of business cases, from long-haul trucking on highways to low-speed deliveries in the suburbs. The ODDs also need to be agnostic to technology, ignoring which sensors a company uses to achieve safety-performance benchmarks. The quest for equal footing becomes still more challenging given the diverse set of stakeholders all trying to establish standards.
“Our next step is to call out to the whole industry,” said Bruso. “How can we come together?”
Koopman believes the mile-long list of ODD factors must be put to a higher, broader purpose. “Safety is always about engineering rigor,” he said. Sometimes that means making sure that “perfect is not the enemy of the good,” as the 18th-century Italian aphorism states.
For Aptiv and other leading AV companies, it’s a balancing act. There’s a strong impulse to get selfdriving vehicles on the road, earning revenue and delivering on the promise for greater safety. “What that means in practice is that we are going to deploy our technology initially in easier driving environments,” said Aptiv’s Iagnemma. “And over time, we will deploy in increasingly complex locations.”
Koopman said that the UL 4600 standard, still in development, explicitly allows AV makers not to be perfect. “You need good empirical test data to say that you’re not presenting an undue risk,” he said. “But you can’t stop conditions from changing. ”In other words, you’ll never develop an ODD that takes every scenario, use case and road condition into consideration; AVs need to know what they don’t know – and then respond with a fix as fast as possible after an incident.
This article was sponsored by AAA Northern California, Utah & Nevada.
Author: Bradley Berman
Source: SAE Automotive Engineering Magazine
Hologram 全息圖是一款來(lái)自 Edge Case Research 公司的仿真工具，可識(shí)別其他測(cè)試工具難以發(fā)現(xiàn)的ODD (運(yùn)行設(shè)計(jì)域）風(fēng)險(xiǎn)。
Aptiv 公司已經(jīng)在拉斯維加斯、波士頓、匹茲堡和新加坡等地投放了自動(dòng)駕駛汽車。也就是說(shuō)，公司的自動(dòng)駕駛系統(tǒng)需要在不同地點(diǎn)處理非常不同的駕駛場(chǎng)景。
AAA 計(jì)劃以旗下GoMentum 自動(dòng)駕駛測(cè)試站點(diǎn)為代表，創(chuàng)建一套適用于全行業(yè)的 ODD 標(biāo)準(zhǔn)。