3.1 Approach for analyzing the police traffic accident database
For the general visual demonstration Fig. 4 shows the locations of area-wide police recorded accidents in Saxony from 2010 to 2016. During this period, 1227 road users were killed (black), continuing with 24,451 seriously injured (red), 68.748 slightly injured (yellow) and 685.353 cases with property damage (green).
To create real-world scenarios for development and testing in this analysis, 1,286,109 traffic accident reports in Saxony were analyzed using a textual analysis that focused on such phrases as “difficult weather conditions”. In a second step, 374 of these accidents that include such terms as “fog”, “glare”/“blinding”, “rain”, “snow” and “visual obstruction” were analyzed in detail using an in-depth, case-by-case analysis.
New police reports are constantly being added to the database because the police must prepare a road accident report for each traffic accident. The legal basis for the database in Germany is the Road Accident Statistics Act (StVUnfStatG). With the entry into force of these guidelines, the police basically record every traffic accident to which they are called or of which they otherwise become aware. A road accident investigation and an accident report must be carried out if, according to the findings of the police, it is a traffic accident with personal injury or also property damage. Furthermore, traffic accidents must always be geocoded. This made it possible to investigate all traffic accidents which occurred in Saxony between 2004 and 2014 in the analysis below. The official statistics collect more than 100,000 accidents in Saxony annually.
If a traffic accident happens and a road accident report is to be made, all evidence and indications relevant to the accident that may be relevant for criminal proceedings or fines must be saved as far as possible for reconstruction. Of particular importance are the type and severity of injuries, the position of injured persons and their ability to drive or deceased persons. In addition, the vehicle’s condition, damage to property, ascertained accident marks, road condition, light and weather conditions and the current traffic regulations must be recorded or secured. Furthermore, it must be checked whether defects in the traffic area or special weather or lighting conditions contributed to the accident.
The contents of the police accident report are divided into: General identification features (date, time, municipality key), accident characteristics; characteristics for each participant involved in the accident, vehicle technical data and characteristics regarding the passengers involved in the accident (see Fig. 5).
Fraunhofer IVI for Transportation and Infrastructure Systems in Dresden obtained the exclusive special permit to use anonymized police accident records for research. Together with Fraunhofer IVI, 1,286,109 electronic traffic accident reports were evaluated using special software. This software is able to quantitatively and qualitatively assess police records for these in-depth accident analyses that focus on accident data related to visibility limitations.
3.2 Machine- and human perception restrictions with relevance for testing
The real-world situation below (Fig. 6) considers the only fatal pedestrian accident which was found in this analysis. This example was used earlier as an example to explain the challenges facing human perception and the limited performance of machine perception under difficult weather conditions. The police accident report describes the circumstances as follows:
… Pedestrian 01 was walking along State Road S 227. He was on the left side of the road. Approximately 100 m after a confluence into a side street, a collision with the oncoming car 02 occurred. The pedestrian was under the influence of alcohol….
Figure 6 represents the real accident scene before the collision occurred and also shows including a model of available sensor technologies. A vehicle needs sensors to receive information about the surroundings. Vehicle manufacturers commonly use Lidar, Radar, far and near infrared, ultrasonic sensors, and video cameras.
The top image and the image in the middle of Fig. 6 show what humans perceive when faced within limited light- and weather conditions (rain, snow, wet road surface, backlight, icing/contamination of windshield or sensors, spray or splashing water, invisible road markings). In addition, the center and lower image depict restricted machine perception and measuring interpretation. The center image overlaps human- and machine perception. Using all these measurements reveal in this scenario that the left-hand radar detection point (blue) is a reflection from the other lane.
The essential insight of this scenario is that machine perception would have recognized the pedestrian as an object in spite of glare from oncoming vehicles (see illustrations right side – blue radar detection point).
Poor lighting conditions and weather situations challenge humans and machines to properly detect objects/persons in various traffic situations. Therefore a first area-wide accident analysis with support from Daimler Research, the Daimler and Benz Foundation and the Fraunhofer IVI for Transportation and Infrastructure Systems in Dresden was carried out to receive relevant scenarios having regard to limited visibility due to “rain”, “fog”, “snow”, “glare” from sun or headlights and darkness.
3.3 Relevant real-world scenarios for development and testing
This analysis is based on all 1,286,109 police-recorded accidents from Saxony spanning a ten year period starting in 2004. Figure 7 shows the number of these accidents from 2004 to 2015 and their consequences.
The analysis of area-wide traffic accidents that occurred during challenging weather conditions that limited perception for machines and humans results in the following numbers: 374 out of a total 1,286,109 accidents met the above-mentioned criteria after all of the police traffic accident reports that were documented between 2004 and 2014 in Saxony were analyzed.
Figure 8 presents geographically related accident scenes that had limited visibility. It is evident that traffic accidents that occur due to limited visibility frequently occur in urban areas and at frequent traffic locations. Knowing the exact geographical accident site forms the basis for creating relevant proofing ground-, virtual-, and field tests to develop automated functions.
To gain deeper insight into the subject, the authors conducted a case-by-case analysis of all the information given in the police accident reports and came up with the following findings:
3.3.1 Categories of accident causes involving reduced visibility
A total of 374 area-wide traffic accidents with 417 accident causes can be subdivided into seven main categories of difficult weather conditions (see Fig. 9). Among them are 237 collisions (by far the largest number) involving reduced visibility due to fog.
In addition, there were 61 cases that involved glare or blinding from the sun, 60 cases involving rainy conditions, 22 cases involving snowfall and eight cases involving blinding from oncoming headlights. Only four cases were primarily connected to visual obstructions.
Another 25 cases are mentioned that involve snow-covered roads, where the surface (lane markings, optical lane boundary) was not visible. It can be assumed that the reduced friction coefficient played a large role in the accident causes. In particular, these limited visibility conditions on the roadway must be taken into account for automated vehicles.
$$ p=\frac{\mathrm{Number}\ \mathrm{of}\ \mathrm{all}\ \mathrm{area}\ \mathrm{wide}\ \mathrm{accidents}}{\mathrm{Number}\ \mathrm{of}\ \mathrm{accidents}\ \mathrm{connected}\ \mathrm{to}\ \mathrm{associated}\ \mathrm{visual}\ \mathrm{obstruction}} $$
(7)
The four accidents provoked by visual obstructions through parked vehicles (pedestrian accident), a garbage can and snow piles are described as follows:
-
→ … In this position … Mrs. … crossed the lane on foot. In doing so she walked into the driving lane from between parked cars right in front of a passenger car … Because of the rain, she was holding an umbrella in front of her …
-
→ ... Due to poor visibility (snow piles) and traffic, driver 01 had to move further on in … street …
-
→ … Driver 01’s view of the access road was blocked by a garbage can …
-
→ … According to statements by driver 01, the view was blocked by snow piles with regard to 02 …
3.3.2 Injuries caused by accidents with reduced visibility
A total of 749 people were involved in the 374 relevant accidents. The majority of these collisions resulted only in property damage. In total, 598 people remained uninjured. 99 people were slightly injured, 51 were badly injured and one person killed (Fig. 10).
3.3.3 Accident types in connection with reduced visibility
Furthermore the conflict situations were categorized into accident types, such as accident type (UTYP), which describes the initial phase before the damage occurs. The main level distinguishes among seven types of accidents, which can be further subdivided into a second or third level. The main levels are [25]:
-
UTYP 1xx: “dynamic” accidents: They were initiated by loss of control of the vehicle (due to inappropriate speed or incorrect estimation of the course of the road, road condition, etc.), without other road users having contributed to it. However, uncontrolled vehicle movements may have caused a collision with other road users.
-
UTYP 2xx: accidents during turning
-
UTYP 3xx: turning at/crossing intersections
-
UTYP 4xx: pedestrian accidents
-
UTYP 5xx: stationary traffic
-
UTYP 6xx: “longitudinal/parallel” traffic: Accidents caused by a conflict between road users moving in the same or opposite direction, provided that this conflict does not correspond to another type of accident.
-
UTYP 7xx: other accidents
As a result, Fig. 11 shows that the majority of 71 accidents are related to several unspecified types of dynamic accidents (UTYP 199). Furthermore 44 right turn collisions (UTYP 102) occurred. Another 26 collisions were related to bends in the roadway (UTYP 139) and 20 accidents were attributed to left-turn collisions (UTYP 101).
In addition, 45 accidents involving collisions with animals (UTYP 751, 752), 26 collisions involving vehicles turning left across oncoming traffic (UTYP 211) and 17 other collisions in two-way traffic situations (UTYP 682, 689) also occurred.
The large percentage of dynamic accidents (UTYP 1: 101–199) at 49% reflects that drivers often lose control over their vehicles under difficult weather conditions (Fig. 12). Among other things, this loss of control is due to the fact that the friction coefficient is reduced in wet and snow-covered roads.
3.3.4 Evasive maneuvers implemented to avoid accidents
In connection with automated driving, evasive driving maneuvers are often discussed from an ethical point of view. Therefore this case-by-case real world analysis provides the following insights:
The descriptions in this case-by-case analysis discuss five collisions, where the drivers were able to mitigate the severity of an accident via evasive maneuvers. Another 13 drivers (4%) tried to prevent the collision but their evasive maneuvers failed. The major percentage of accidents – 356 of them at 95% – confirms no indications of evasive actions taken (see Fig. 13).
Out of the 374 accidents, some evasive maneuvers are clearly not relevant to avoiding collisions in the following cases: 127 accidents which were caused by lane departure and accidents involving moving objects (43 animal-caused collisions) are challenging to avoid, because it is unknown whether the animal will continue running, stop or reverse its direction.
$$ n\ \left( relevant\ evasive\ maneuvers\ to\ avoid\ collisions\right)=n(total)-n\left( lane\ departure\right)-n\ \left( moving\ objects\right)=347-127-43=177 $$
(8)
3.3.5 Examples for minor and no damage to property
Two cases in the data set describe only minor damage to the involved vehicles and no injuries. The translated parts of the police accident reports below show one case with no damage and one with minor scratches:
… 01 parked his car backward in a parking space. Because of his limited view, darkness and rain, he slightly touched the parked car at the back of his car… He (01) could not find any damage on either vehicle ….
… Driver 02 stopped at the parking lot … to let passengers get out of the car. 01 rear-ended 02. The reason for this was that snow on the roof which slips on the windshield when braking. Snow blocked the view and 01 reacted too late … There was no obvious damage to determine on car 01. Minor scratches were visible on passenger car 02 ….
3.4 Integrating relevant test scenarios for safe automated driving functions
Area-wide real-world accident scenarios provide a basis for evaluating functional safety for highly- or fully automated vehicles, [4]. Furthermore takeover situations and interaction from machine to driver challenge new concepts for partial automation, but are not considered here [26].
3.4.1 Integrating requirements in the development process
All the requirements involved in designing automated functions must be integrated into the generic development process. Apart from the development stages for high automation, the process (see Fig. 14) depicts logical steps.
During many years of consulting on development processes at vehicle manufacturers the main author of this paper often discovered that perfectionism or miscommunication among the experts and team members causes delay or disruption. In the chapter, “The Future of Teamwork” the book, “The Power of Being” points out that perfectionism or miscommunication may well be about different energetic competencies. The book’s author suggests that humans are normally truly efficient in only one of three phases. Either we are good starters, executors or terminators (finishers) [27]. This means that if an employee would for example be an efficient executor, he is likely to spend a disproportionate time and effort in the final validation or sign-off phase. The conclusion is that it pays to look beyond the purely technical competencies when putting together efficient teams. An ideal team within all stages of the development process should not only contain good starters and executors, but also excellent finishers, in order to progress more efficiently.
Figure 14 shows the generic development process as a V-Model with elements of functional safety including support from real-world scenarios. Findings from real-world scenarios support the entire development process, particularly with regard to requirements and the functional description in the definition phase. They provide important information about the conditions that the sensor system and system configuration are confronted with during vehicle operation. For example, depending on the sensor technology, a sensor heater is required to prevent the sensors from freezing over. According to the real-world scenarios, a safe shutdown strategy with appropriate warnings must be designed that takes the operating conditions into account. Based on these findings, the development for automated vehicle functions as a V-Model focuses on the efficient exchange of expert knowledge and the safety process, which are depicted in the diagram [17].
3.4.2 Test scenarios and requirements in relation to legal and ethical aspects
The analyzed test scenarios and requirements also provide information about “allowed” risks and risks accepted by society. Unforeseeable responses that can possibly cause injuries or fatalities must be expected when using vehicles with automated functions.
Because of increasing complexity, highly or fully automated vehicles currently involve risks. New liability topics and acceptance issues have to be discussed. Whereas over 1.2 million traffic fatalities, i.e. the ones we have been discussing that occurred in Saxony, seem to be accepted by society in general, there seems to be no tolerance for a single fatal accident due to technical failures. Several product liability cases and recall actions back up this social expectation [17]. On the other hand, automated driving promises several safety benefits [4].
So far, many questions such as the following have to be answered:
-
Is the automated function safe enough?
-
Is the duty of care fulfilled?
-
What will change legally if a machine drives instead of a driver?
Test scenarios and design requirements will support a safe development and support fulfillment for duty of care. However, in general, creation of risks results in duty of care requirements but not every generation of hazards is forbidden. This occurs if automated functions cause significant social benefits. Risks have to be reduced to a minimal level. Which risks the user reasonably will expect has to be negotiated by society. Levels of acceptable risks will be discussed by the media, society, during development of standards and at court. The question which risks a society is willing to accept should be differentiated from the question how critical traffic scenarios have to be assessed during development. It should be assumed that the developers and programmers are not liable to prosecution for negligence if they act within the permitted risk.
The discussion about dilemma situations regarding a decision on the life or death of other road users depending on an evasive maneuver is not due until the machine perception or prediction can reliably distinguish between an old man and a young lady or if cyclists wear a helmet. The aim is to reduce risks. To shift risks on to someone or something is prohibited.