Amending the Automated-Driving ‘Constitution’

SAE Committee chair Barbara Wendling addresses the fine points behind the industry-defining – and controversial – classification for automated-driving.

Revisions to SAE Levels of Driving Automation standard include clearer distinctions between Level 3 and Level 4 automation. (Continental)

In May, SAE International and the International Organization for Standardization (ISO) jointly released a significant update to SAE’s J3016 Recommended Practice: Taxonomy and Definitions for Terms Related to Driving Automation Systems for On-Road Motor Vehicles  , commonly referenced as the SAE Levels of Driving Automation. Chief among the revisions to the J3016 Standard was language further clarifying the distinction between SAE Level 3 and Level 4 automation, terms to address and define remote-support functionality and other new definitions and descriptions for driving-automation operability. This latest version of the J3016 Standard can be downloaded free of charge here  .

Barbara Wendling, SAE J3016 Standard committee chairperson. (Barbara Wendling)

SAE Mobility Media editor-in-chief Lindsay Brooke and editorial director Bill Visnic spoke with Barbara Wendling, chairperson SAE J3016 Technical Standards Committee and a senior researcher at Quantitative Scientific Solutions, about the critical points of the Standard’s latest revisions and how they impact the autonomous-vehicle (AV) engineering community and the industry at large.

This update of J3016 was a collaboration between SAE and ISO. What prompted the two standards organizations to collaborate on this?

Three or four years ago, SAE and ISO reestablished a desire to put out joint standards. The first one they did was a Cybersecurity engineering standard [ISO/SAE 21434, in 2020]. Around the same time, we also started a collaboration with ISO, in this case TC204, the ITS side of ISO, again to produce a joint standard of J3016.

I believe this was driven by ISO’s desire to harmonize with SAE on these Levels of Driving Automation so the industry can finally get on the same page and be referencing the same terms, definitions and framework. The point being that when we’re doing important documents like regulations, standards or guidance documents, it’s important that people use precise terms and definitions.

Were there some sticking points or misalignment between the North American vehicle development community and others – globally – that prompted the J3016 update?

The short answer is yes. There was a fair amount of North American jargon in the previous version of J3016 which is simply a function of Americans being the primary authors of that document. We did take care of a lot of that. In addition, we wanted to provide guidance and advice on things like logical groupings of terms – in some places we have ‘superterms’ and ‘subterms’ that relate to the superterm. We’ve done a better job with that.

J3016 has not been without controversy since its debut in 2014, some would say because of a lack of clarity.

You’re right, it has been fairly controversial from the start. Everybody has an opinion when it comes to language! The point I try to make, and that people have criticized, is J3016 is a convention. It could be other than it is, but at least it’s comprehensive and internally coherent. I no longer refrain from pointing out, when people argue about J3016, that we couldn’t even be having these arguments without this framework and language at this point!

Is part of the issue with clarity, and public understanding of the SAE Levels, due to the proliferation of terms and acronyms in this space? For example, ADAS [Advanced Driver-Assistance System] and ADS [Automated Driving System] represent the same thing. There is ‘automated driver-assist system’ and ‘driver-support system.’ OEMs and suppliers have their own terminologies because they’re trying to create a market advantage for themselves. And recently, the unofficial ‘Level 2-Plus’ has emerged to describe enhanced L2 capabilities between SAE L2 and L3.

Yes, I hear you. The proliferation of acronyms is pretty hard to avoid in any industry because there are so many clunky terms. Acronyms simplify things dramatically. What I’ll say on a base level is J3016 is an engineering standard; it’s not really aimed at the general public. We did come out with a public-facing version of the taxonomy itself, so at least the levels could be clarified for laypersons. I think that simplified taxonomy does a pretty good job – and we have not received many complaints about it.

As far as the engineering document, I would expect suppliers and such to read and comprehend the document. It is internally clear and consistent if you take the time to read it. If you work in this industry and you’re involved with driving-automation technology, you need to do that.

It must be a challenge to put a “live’ document like J3016 together at a time of such dynamism and competition in the technology – in sensors, processors, electrification. In many ways, you’re trying to hit a moving target.

The way we’re handling this inside of SAE: J3016 is sort of the ‘Constitution,’ if you will, of driving-automation definitions. There are other documents that have plenty of definitions – for example, J3131 that will be published shortly provides definitions and taxonomy for [automated driving] architecture. There is a taxonomy and definitions document coming out of the SAE Verification and Validations committee; there’s J3164 coming out of the Maneuvers and Behaviors committee that has new definitions. There are a lot of expansions going on in terms and definitions, to help nail down scenarios and situations.

So, we’re trying to keep J3016 at its current high ‘Constitution’ level and allow the other SAE task forces that are going into specific, deeper areas to formulate their own definitions consistent with J3016. So far, it seems to be working out fairly well. The nice thing about this latest SAE-ISO version of J3016 (also called ISO-PAS 22736), is it tells the world that we’re harmonized on the fundamentals. It’s how we’re going to characterize this technology.

Perhaps the collaboration between the two global standards groups will help mitigate some of the early criticisms of J3016.

I hope so.

In the SAE press release related to Levels 4 and 5, there was mention of ‘remote assistance’ and ‘remote driving,’ which seem to be a bit over the horizon from where industry developments are now. What are these terms?

That was one of the more important changes we made in this version, and it was one of the thorniest issues that we tackled with the ISO-SAE group. It was particularly important for companies working on ADS-dedicated vehicles operating in geofenced urban areas to distinguish between remote driving and remote assistance. Consider the need for an ADS-dedicated vehicle to, for example, pass a double-parked vehicle that is blocking its lane, where passing it requires crossing a double-yellow line to enter a lane of opposing traffic: the vehicle would signal a person in the fleet operations center of its predicament and that person will either remotely drive the vehicle using, for example, the vehicle’s cameras and a joy-stick apparatus wirelessly linked to the vehicle’s steering and braking controls to accomplish the passing maneuver. Or, remotely assist the vehicle by sending it instructions to accomplish the passing maneuver in its own. The first example constitutes remote-driving and means that the ADS-dedicated vehicle in question is Level 3, while the second example constitutes remote assistance and means that the ADS-dedicated vehicle in question is Level 4.

The SAE press release also notes that the update does not include driver warning and momentary driver-intervention systems in the classification of these levels. For some, this may relate to the recent Tesla crash in Texas that prompted policymakers to call for driver monitoring even in the lower SAE levels.

Actually, J3016 clarifies that stand-alone crash avoidance features equipped on conventional vehicles without ADS, such as automatic emergency braking, electronic stability control, and blind spot intervention, are subsumed by an ADS whenever one is engaged. Tesla’s Autopilot, however, is not an ADS, but a Level 2 driver support feature. And the preliminary NTSB investigation apparently proved that Autopilot was not engaged during the crash in question, although adaptive cruise control was.

Regarding driver monitoring systems, Tesla has been using a steering wheel-based system that looks for hand contact and wheel torque as an indication of driver engagement in the driving task. This DMS, however, proved easy to defeat using a counterweight hung on the steering wheel, and otherwise allowed a driver to rely on Autopilot’s ability to maintain lane position – and to even leave the driver’s seat, as some users did. However, in late May, Tesla announced that it will start using an already-equipped interior driver-facing camera on the Model 3 and Model Y to monitor driver compliance with Autopilot’s requirement that the driver remain seated in the driver’s seat, and that they maintain attention to the roadway while Autopilot is engaged.

As your committee hears calls for driving-monitoring systems across the board, what’s the reaction? Is it needed?

Just to be clear, this J3016 document lives under the On-Road Automated Driving Committee. There’s a Safety and Human Factors Steering Committee that also has a Driving Automation committee that’s working on the HMI aspects of driving automation, and that group already has published a J3114 document with definitions; it’s doing an update of that document as well as coming out with a new document, J3196, that will address certain guidance aspects of driver monitoring for driving-automation features. There are no Level 2 systems on the road that do not have some form of driver-monitoring system. The steering-wheel-based system that senses both torque and is touch-sensitive is the most common of these.

The other type of driver-monitoring system that’s favored by the NTSB is a camera-based system that detects the driver’s face position, and in some cases, eye position. That system is featured on the Cadillac [GM] Super Cruise which is designed to be hands-free.

Also in the SAE release on the J3016 update is the term ‘dual-mode vehicle;’ what is that?

That’s still a hypothetical vehicle. Nobody has designed one yet, but it’s theoretically possible – it’s a Level 5 vehicle owned by a private person. It can be operated by the ADS or by a human. The vehicle could be dispatched in driverless operation to, for example, pick up someone from the airport, or it could be driven as a conventional vehicle. It’s dual-mode in that sense. Theoretically, it’s also capable of Level 4, but the utility of a geofenced, dual-mode Level 4 vehicle might not support a business case. So it’s being thought of more as a Level 5 vehicle that also is operable by a human.

And the terms “conventional vehicle” vs. “ADS-dedicated vehicle,” what is that distinction?

An ADS-dedicated vehicle is one that is designed under normal conditions to be operable exclusively by an ADS and never by a human driver. It is unlikely to have human driver controls, like steer wheel and pedals.

A conventional vehicle is one that is designed to be operated by a human driver, but may have one or more ADS sub-trip features that engage under specific operating conditions. For example, a vehicle may have a Level 3 ADS sub-trip feature that operates the vehicle on fully access-controlled freeways within its mapped routes. In that case, the driver drives the vehicle to its ODD [“operational design domain,” namely, a fully access-controlled freeway]. When it’s time to exit, the driver again takes over driving when the vehicle exits reh freeway. The ADS feature only functions for part of given trip; the vehicle is otherwise conventional, so you always know that you have a person capable of driving in the driver’s seat. Another example of an ADS sub-trip feature for a conventional vehicle would be a Level 4 parking valet feature, which operates a vehicle short distances on-road for purposes of parking and retrieval from parking structures.

It looks like you’re now using the term “driver-support systems” as a counterpoint to “automated driving systems.”

That’s right.

By using that term, it appears you’re taking the emphasis off of automation. While I realize this is an engineering document, I’m curious as to why you didn’t choose “driver assist” rather than “driver support?” Was there discussion on that?

It just came out that way. We were already using ‘assist’ and ‘assistance’ in other parts of the document’s definitions. And ‘driver support’ is a pretty well-known term in the human-factors realm. Again, we were trying to draw a very bright line between Levels 0, 1 and 2, and Levels 3, 4 and 5, where the ADS performs the complete DDT [dynamic driving task] while it’s engaged to free up the person in the driver’s seat – if there is a person involved – to do other things.

This reminds me of something I didn’t answer earlier: Level 2-Plus: There is no such thing as Level 2-Plus or Level 3- or 4-Plus; we tried to make that very clear. There are no in-betweens! Either the person in the driver’s seat is a fallback-ready user or a passenger, or it’s a Level 0, 1 or 2-equipped vehicle. You can’t say that the vehicle performs the complete DDT under nominal conditions –except sometimes it screws up, so you have to continue paying attention, because that’s not an ADS.

That leads to the mention of the “fallback-ready user” and also “automated fallback.” What does “automated fallback” mean?

At Level 3, the fallback-ready user is responsible for performing the fallback. Realistically, and the German government has already implemented this in law, you cannot turn over the DDT to the fallback-ready user in safety- and time-critical situations. That doesn’t make sense. Basically, the vehicle has to be able to manage all safety- and time-critical situations, and then turn over control to the fallback-ready user to either manually drive the vehicle (if it can still be driven) or get it off the road, if possible. That’s Level 3. In Level 4, the ADS must perform the fallback automatically.

What we said is that at Level 3, the vehicle may, sometimes, perform the fallback. It may sense a system failure and pull over to the shoulder, if one happens to be available. But it can’t guarantee that it will always do that – for example if the failure occurs on a bridge without any road shoulders – which is what makes it still a Level 3 and not a Level 4. It may have some automated fallback capability, but can’t guarantee it will always achieve a minimal-risk condition on its own.

So, if Super Cruise – widely considered the most-sophisticated system that’s currently available – experiences a situation where it’s in the correct ODD but for some reason recognizes that it can’t handle the situation, the fallback-ready user is the driver, correct?

Actually, the person in the driver’s seat is only called a “fallback-ready user” if the feature in question is Level 3. Super Cruise is Level 2. Super Cruise does not guarantee that it will always give provide a warning when something goes wrong, which is why Super Cruise enforces driver attention using the face camera. It will turn itself off it the driver isn’t paying sufficient attention.

Looking at the revised Levels of Automation graphic, it shows the first indicator for SAE Level 3: ‘You are not driving when these automated-driving features are engaged even if you are seated in the driver’s seat.’ That’s where it seems lot of confusion comes in: there’s a driver, but the vehicle is handling lateral and longitudinal control.

It’s not doing the complete OEDR, the Object and Event Detection and Response. That’s the part of the DDT that it’s not doing completely. So, you are driving when you’re Super Cruise feature is engaged, because you must continue to monitor the driving environment and be prepared to take over with or without notice at any time – for example, if somebody cuts in front of you, or something falls off the truck ahead of you. That’s the difference: the person sitting in the driver’s seat of a Super Cruise- or Autopilot-engaged vehicle must pay attention at all times. They’re not freed up to play with infotainment systems or anything else.

Is this where we get into the murky business of ‘Level 2-Plus?’ Several suppliers are using that term these days and believe they’re working on technology that bridges the two [L2-L3] levels.

The newest graphic representation of SAE’s J3016 Standard for Levels of Driving Automation. (SAE International)

Of course, marketing people will play games with names. But technical people know the difference. If you promise that you’re feature is Level 3 and that when engaged the user does not have to pay attention to the driving task, but in reality, your feature is only Level 2 and it alert the driver when they aren’t paying attention for more than two seconds at a time, not only are you subject to serious liability, but your competitors are also likely to call you out.

OK, that’s good clarification. It underscores your earlier assertion that J3016 is an engineering document not necessarily aimed at lay people.

Yeah, the levels can be explained in layman’s terms, and they are. But when it comes to the internal definitions and how they hang together and are consistent, you sort of have to be a geek.

A lot of the public controversy with J3016 stems from the graphic, which has been modified two or three times since the standard deployed. Do you see a need to tweak or upgrade the graphic?

If you in the technical media see a need to change the graphic, please let us know. We’re not trying to confuse people; on the contrary. I hear that feedback, as you obviously do, too.

If the industry’s intent is to ultimately show a vehicle’s driving-automation capability on the Monroney [new-vehicle window sticker], will you be able to develop a graphic to portray the level of capability in an easy-to-understand fashion?

I think it will end up becoming a recognized icon. We worked very hard in trying to come up with a graphical version of this. We had some high-powered people working on this. Andy Christensen from Nissan did all the graphics for J3016; he’s quite good at that. Plus, we had SAE’s professional graphics staff.

In the end we couldn’t do it; there’s no way to correctly graphically represent the OEDR part of the DDT. And that’s the tough part of this technical challenge; we can do longitudinal and lateral control – but we can’t do it with complete OEDR yet. If anyone has a thought about how to correctly depict OEDR, we’re all for it! But I honestly think it’s going to end up being some kind of icon by the time it makes it to a Monroney label.