The Key to Autonomous Vehicle Safety Is ODD
Truly safe automated driving will depend on defining the exhaustive list of overlapping conditions an AV might encounter, what's called the operational design domain.
In a perfect world, an automated vehicle (AV) would be all-knowing. Its sensors, communication systems and computing power could predict every road hazard and avoid all risks. But until a wholly omniscient self-driving vehicle is a reality, there will be one burning question for AV developers, regulators and the public: How safe is safe enough?
Despite about $100 billion of investment in AVs to this point, nobody has an adequate answer. Safety standards and metrics have not yet been established. The world’s leading roboticists are scratching their heads. Regulators are largely perplexed. Until there’s an answer to this almost abstract question, the great promise of AVs to reduce accidents and save lives, free up our time and democratize mobility will remain beyond our grasp.
“The leading players reached a point where we’re going through validation and testing. And we realized that the safety question is in our critical path,” said Karl Iagnemma, president of autonomous mobility at Tier 1 automotive technology supplier Aptiv, in an interview at the TechCrunch Mobility 2019 conference earlier this year. “It’s the biggest unanswered question in the industry today,” he asserted. Aptiv launched the world’s first commercial AV ride-hailing service in 2018. That pilot project, using Lyft vehicles, is based in Las Vegas. Aptiv also deployed AVs on the streets of Singapore, Boston and Pittsburgh.
While easy answers to the AV safety question are elusive, the path forward could come down to the industry’s widely and often-debated three-letter acronym: ODD, or Operational Design Domain. The term defines all conceivable overlapping conditions, use cases, restrictions and scenarios that an AV might encounter, even the most esoteric edge cases.
Working on the last 2%
Dr. Phil Koopman, associate professor of electrical and computer engineering at Carnegie Mellon University, is a decade or two ahead of the pack in realizing the critical importance of ODD. Koopman said that since about 1995, he’s known about the importance of establishing the scenarios in which AVs can and cannot remain safe.
That’s when a team of Carnegie Mellon roboticists traveled coast-to-coast in a Pontiac minivan decked out with a video camera, personal computer and a GPS receiver. “We had our hands off the wheel for 98 percent of the trip,” he said via phone while attending a September safety conference in Finland. “And for the last 20 years, we’ve been working on the last two percent.”
Common ODD factors are time of day, weather, terrain and road features. But the list gets very long, very fast. In January 2019, Koopman, a co-founder of Edge Case Research, co-authored a white paper, “How many Operational Design Domains, Objects, and Events” (co-author was Frank Fratrik, lead engineer at Edge Case Research). The paper essentially is four pages worth of bullet points of factors related to ODD object detection, faults and maneuvers.
The paper’s laundry list of ODD oddities – impactful factors that an AV might encounter – includes glare, social norms, outdated mapping detail, toll booths, water-filled potholes, overhanging vegetation, downed power lines, icing, uncooperative people, falling objects, delivery robots and common human rule-breaking.
Koopman cautions against overly simplistic approaches to ODD. “If you take a city block and say that’s my ODD, it doesn’t tell you what you need to know,” he said. “It just limits the possibilities even if you’ve driven along that street for three months.” Koopman added that even a simple street has way more variability than most people appreciate. “If you never drove on that street on October 31, I will guarantee you things change on that day, at least in the United States.” He said that humans can immediately recognize things – construction workers wearing yellow high-visibility uniforms, for instance – that are sometimes missed by even the best AV systems.
Start at the beginning
Xantha Bruso, manager of autonomous-vehicle policy at AAA Northern California, Nevada & Utah, fully recognizes the complexity of establishing ODD-based AV safety standards. But seeing the public-safety imperative, she’s undaunted. “The bar is really low. There are currently no performance-based standards,” she said. “You have to start somewhere.”
In a conference room at AAA Northern California’s innovation lab in Berkeley, Calif., Bruso rattled off the key questions. “What conditions can the AV operate in? What happens when something changes in the environment that prohibits it from operating safely? How can it sense that it’s getting close to the edge of the ODD? What happens then? How does an AV company make its safety case? How does all this mesh with how regulators are defining safety?”
These questions and others informed AAA Northern California’s work to develop AV safety metrics sorely lacking in the industry. For the project, AAA Northern California partnered with Securing America’s Future Energy (SAFE) and RAND Corporation. “When we gave it a careful look, we realized that we were putting the cart before the horse,” Bruso said. “First, we need the foundational definitions for where it’s safe to operate. What are those conditions?”
So the project team turned its attention to developing an ODD for GoMentum Station , the Bay Area’s 2,100-acre AV testing facility owned by AAA Northern California. “We’re starting there,” Bruso said. “We’re using GoMentum Station as a proxy for an industry-wide test environment. We can make those conditions defined and repeatable.” Bruso’s plan is to publish and promote its ODD with the hope of having other test tracks use its definitions, or at the least,the same conceptual framework.
The long-term vision is to establish a testing protocol for apples-to-apples comparisons of AV systems throughout the world. Bruso explained that those comparisons currently are not possible. “A Cruise vehicle testing in San Francisco has a more-complicated ODD than a Waymo in Phoenix,” she said. “You need a baseline of conditions to evaluate these vehicles on an equal footing.”
One ODD at a time
Flexibility will be crucial. Industry players follow a wide array of business cases, from long-haul trucking on highways to low-speed deliveries in the suburbs. The ODDs also need to be agnostic to technology, ignoring which sensors a company uses to achieve safety-performance benchmarks. The quest for equal footing becomes still more challenging given the diverse set of stakeholders all trying to establish standards. “Our next step is to call out to the whole industry,” Bruso said. “How can we come together?”
Koopman said he believes the mile-long list of ODD factors must be put to a higher, broader purpose. “Safety is always about engineering rigor,” he said. Sometimes that means making sure that “perfect is not the enemy of the good,” as the 18th-century Italian aphorism states.
For Aptiv and other leading AV companies it’s a balancing act. There’s a strong impulse for companies to get self-driving vehicles on the road, making money and delivering on the promise for greater safety. “What that means in practice is that we are going to deploy our technology initially in easier driving environments,” said Aptiv’s Iagnemma. “And over time, we will deploy in increasingly complex locations.”
Koopman said that the UL 4600 standard, still in development, explicitly allows AV makers not to be perfect. “You need good empirical test data to say that you’re not presenting an undue risk,” he said. “But you can’t stop conditions from changing.” In other words, you’ll never develop an ODD that takes every scenario, use case and road condition into consideration. AVs need to know what they don’t know and then respond with a fix as fast as possible after an incident.
This article was sponsored by AAA Northern California, Utah & Nevada.