在一个理想的世界中，自动驾驶汽车将全知全能。车辆将有能力进行观察、通信和计算，并最终准确判断道路上的任何危险，并及时采取措施避免所有风险发生。然而，在理想世界成为现实之前，自动驾驶开发商、监管者以及普通民众均必须面对一个亟待回答的问题：要多安全，才够安全？
截至目前，尽管人们已经在自动驾驶研发上投入了大约 1000 亿美元，但这个问题仍没人能够自信回答。相关安全标准和度量指标尚未建立，世界领先的机器人学家对此只能挠头，监管机构在很大程度上也无所适从。如果无法回答这个近乎抽象的问题，自动驾驶汽车的所有潜力都只是镜花水月，减少事故、挽救生命、节省时间并最终实现交通民主化的承诺也只是美梦一场。
TechCrunch Mobility2019 大会期间，“业内领先的一些公司已经进入验证和测试的阶段了。我们也充分意识到安全问题是我们的发展道路上无法规避的重要环节。”一级技术供应商 Aptiv 公司的自动驾驶总裁 Karl Iagnemma 在接受采访时断言：“这是当今业界最亟待解决的问题。”
Aptiv 公司在 2018 年推出了全球首个自动驾驶“招车”服务。该试点的大本营位于美国拉斯维加斯，主要使用 Lyft 的车辆。此外，Aptiv 公司也在新加坡、波士顿和匹兹堡等地投放了自动驾驶汽车。
尽管，自动驾驶汽车的安全问题仍然难以回答，但万变不离其宗，大概也脱不开业界热议的三个字母：ODD。ODD 的全称为Operational Design Domain（即运行设计域），主要详列自动驾驶汽车可能遇到的所有重叠条件、用例、限制和场景，哪怕是最不可思议的边缘案例也必须明列其中。
卡内基梅隆大学电气和计算机工程副教授 Phil Koopman 博士早在十到二十年前就已认识到了 ODD 的重要性。
Koopman 教授表示，他从 1995 年起就意识到必须明确规定在哪些情景中自动驾驶汽车可以或不可以安全驾驶。当时，多位来自卡内基梅隆大学的机器人专家乘坐装一辆装备了摄像头、个人计算机和 GPS 接收器的 Pontiac 小货车，完成了一次横跨美国的“自动驾驶”行程。去年秋天，Koopman 教授在芬兰参加某个安全会议时与 SAE《无人驾驶汽车工程》杂志通话表示，“我们当时 98% 的行程均是无人驾驶完成的，此后的 20 年中，我们一直在努力解决最后 2％的问题。”
常见的 ODD 因素主要包括光照、天气、地形和道路类型等，但要列举所有的ODD 因素可能三天三夜也说不完。
2019 年 1 月，Koopman（同时也是 EdgeCase Research 公司的联合创始人）与Edge Case Research 公司的首席工程师 Frank Fratrik 共同发表论文《运营设计域、对象和事件有多少？》（How many Operational Design Domains, Objects, and Events），其中详细列举了四页有关 ODD 目标检测、故障和操作的因素。
该论文列举了一辆自动驾驶汽车可能面临的各种非常规情况，包括眩光、社会规范、过时的地图信息、收费站、水洼、低垂的植物、倒下的电线、道路结冰、不合作的人、掉落的物体、快递机器人和一些常见的人类违规行为。
Koopman 教授告诫称，绝不能过分简单化 ODD。
“如果您只着眼于某一个街区，然后总结出一套 ODD，那这套 ODD 一定不会提供您应该了解的全部内容。”Koopman 教授表示，“即使您反复在这个街区验证了 3 个月也无济于事，您在一条街上是无法观察到所有可能性的。”他还补充说，哪怕是一条最冷清的街道，其变数也常常远超大多数人的想象。
Koopman 教授表示，“即使您天天去这条街上报道，但假设就10 月 31 日一天没有去，那我可以保证这条街已经和您最后一次去哪儿的时候不一样了，至少美国的情况是这样。”他说，人类可以即刻识别眼睛观察到的目标，比如一位穿着亮黄色制服的建筑工人，但即使最好的自动驾驶系统有时也会错判这些“明显”信号。
AAA 北加州、内华达州和犹他州公司的自动驾驶汽车政策经理 Xantha Bruso 已经充分意识到建立一套基于 ODD的自动驾驶安全标准的复杂性。不过，她认为，提升公共安全势在必行，自己对此并不感到畏惧。“开始真的不难，目前我们几乎没有任何与性能有关的标准，”她说，“你总得从什么地方开始。”
在 AAA 位于美国加里福尼亚州伯克利市的北加州创新实验室中，Bruso 回答了一些关键问题，比如“自动驾驶的运行条件是什么？如果环境变了，车辆无法继续安全运行了该怎么办？车辆如何感知自己已经马上逼近 ODD 边缘了？快到边缘了又该怎么办呢？自动驾驶汽车该如何制定安全案例？又该如何与监管机构的安全定义相吻合？”
正是在背景下，AAA 北加州分部决心开发业内极缺也急需的自动驾驶汽车安全指标。为了更好地实现这一目标，AAA 选择与“保护美国未来能源组织”（Securing America’s Future Energy，即 SAFE 组织）和 RAND 公司合作。“认真研究了这个问题后，我们意识到我们本末倒置了。”Bruso 介绍说，“首先，我们需要安全运行环境的根本定义，有哪些条件？”
对此，AAA的项目团队决定调整思路，首先为公司位于湾区的 2100 英亩自动驾驶测试场地GoMentumStation 站点开发一套 ODD。Bruso 表示，“我们从GoMentum Station 开始，把这里当作整个行业测试环境的一个代表，提取可定义且可重复的运行条件。”Bruso 的计划是发布和推广这套 ODD，并希望其他测试站点也沿用相同的定义，或至少是相同的概念框架。长远来看，目标则是建立一套统一测试协议，可以把全球各地的自动驾驶系统放在统一的框架下，使用同一套标准进行比较。
Bruso解释说，现在，你无法用同一套标准比较不同的自动驾驶系统。“一辆位于旧金山的Cruise 测试车需要面临的ODD 条件比一辆位于凤凰城的 Waymo 测试车更复杂。”她说，“因此，你需要一套统一的衡量标准，这样才可以从统一的经纬度评判这些车辆。”
在创建ODD的过程中，保证灵活性至关重要。首先，从高速公路上的长途卡车到郊区公路上的低速货车，自动驾驶系统供应商需要面临多种多样的商业场景。其次，ODD 还必须独立于自动驾驶技术，无论公司采用哪种传感器都必须达到同等级的安全性能。最后，由于各类利益相关者都在试图建立更有利于自身的标准，这使得统一标准的实现变得更加艰难。
Bruso表示，“接下来，我们计划呼吁整个行业，寻求最佳的合作方式。”
Koopman 教授认为，ODD 清单要写完长度可能超过一英里，因此我们必须为其寻找一个更高度、更广泛的目标。他说，“安全问题归根结底总是工程严谨与否的问题。”有时候，这意味着我们必须精益求精，力求完美。正如十八世纪的意大利格言所说，“完美不是优秀的敌人。”
对于 Aptiv 和其他领先的自动驾驶汽车公司而言，这是一种平衡的艺术。如今，自动驾驶汽车上路的呼声愈发强烈，人们迫切希望自动驾驶汽车可以兑现增加收益和提高安全性的承诺。“实际上，这意味着我们将首先在更简单的驾驶环境中部署我们的技术。”Aptiv 公司的 Iagnemma 表示，“而后再逐步推广至更加复杂的场景。”
Koopman教授表示，目前仍在开发中的UL 4600 标准明确指出，自动驾驶制造商不需要完美。“您必须拿出良好的经验测试数据，证明您的系统不会带来不适当的风险。”他说，“但您永远不能阻止系统的运行条件发生改变。”换句话说，您的 ODD将永远无法穷尽所有场景、用例和道路条件；自动驾驶系统必须有能力理解未知，并在事故发生后快速做出修复措施。
本文获得了来自 AAA 北加州、犹他州和内华达州分部的支持。
作者：Bradley Berman
本文原发表于SAE《自动驾驶车辆工程》杂志
In a perfect world, an automated vehicle (AV) would be all-knowing. Its sensors, communication systems and computing power could predict every road hazard and avoid all risks. But until a wholly omniscient self-driving vehicle is a reality, there will be one burning question for AV developers and regulators – and the public: How safe is safe enough?
Despite about $100 billion of investment in AVs to this point, nobody has an adequate answer. Safety standards and metrics have not yet been established. The world’s leading roboticists are scratching their heads. Regulators are largely perplexed. Until there’s an answer to this almost abstract question, the great promise of AVs to reduce accidents and save lives, free up our time and democratize mobility will remain beyond our grasp.
“The leading players reached a point where we’re going through validation and testing. And we realized that the safety question is in our critical path,” said Karl Iagnemma, president of autonomous mobility at Tier-1 tech supplier Aptiv, in an interview at the TechCrunch Mobility 2019 conference. “It’s the biggest unanswered question in the industry today,” he asserted.
Aptiv launched the world’s first commercial AV ride-hailing service in 2018. That pilot project, using Lyft vehicles, is based in Las Vegas. Aptiv also deployed AVs on the streets of Singapore, Boston and Pittsburgh.
While easy answers to the AV safety question are elusive, the path forward could come down to the industry’s widely and often-debated three-letter acronym: ODD, or Operational Design Domain. The term defines all conceivable overlapping conditions, use cases, restrictions and scenarios that an AV might encounter – even the most esoteric edge cases.
Dr. Phil Koopman, associate professor of electrical and computer engineers at Carnegie Mellon University, is a decade or two ahead of the pack in realizing the critical importance of ODD.
Koopman said that since 1995, he’s known about the importance of establishing the scenarios in which AVs can and cannot remain safe. That’s when a team of Carnegie Mellon roboticists traveled coast-to-coast in a Pontiac minivan decked out with a video camera, personal computer and a GPS receiver. “We had our hands off the wheel for 98 percent of the trip,” he told SAE’s Autonomous Vehicle Engineering via phone last fall while attending a safety conference in Finland. “And for the last 20 years, we’ve been working on the last two percent. ”
Common ODD factors include time of day, weather, terrain and road features. But the list gets very long, very fast.
In January 2019, Koopman, a co-founder of Edge Case Research, co-authored a white paper, “How many Operational Design Domains, Objects, and Events” (co-author was Frank Fratrik, lead engineer at Edge Case Research. )The paper essentially is four pages worth of bullet points of factors related to ODD object detection, faults and maneuvers.
The paper’s laundry list of ODD oddities – impactful factors that an AV might encounter – includes glare, social norms, outdated mapping detail, tollbooths, water-filled potholes, overhanging vegetation, downed power lines, icing, uncooperative people, falling objects, delivery robots and common human rule-breaking.
Koopman cautions against overly simplistic approaches to ODD.
“If you take a city block and say that’s my ODD, it doesn’t tell you what you need to know,” he said. “It just limits the possibilities even if you’ve driven along that street for three months. ”Koopman added that even a simple street has way more variability than most people appreciate.
“If you never drove on that street on October 31, I will guarantee you things change on that day, at least in the United States. ”He said that humans can immediately recognize things – construction workers wearing yellow high-visibility uniforms, for instance – that are sometimes missed by even the best AV systems.
Xantha Bruso, manager of autonomous-vehicle policy at AAA Northern California, Nevada & Utah, fully recognizes the complexity of establishing ODD-based AV safety standards. But seeing the public-safety imperative, she’s undaunted. “The bar is really low. There are currently no performance-based standards,” she said. “You have to start somewhere. ”
In a conference room at AAA Northern California’s innovation lab in Berkeley, Calif. , Bruso rattled off the key questions. “What conditions can the AV operate in? What happens when something changes in the environment that prohibits it from operating safely?How can it sense that it’s getting close to the edge of the ODD? What happens then? How does an AV company make its safety case? How does all this mesh with how regulators are defining safety?”
These questions and others informed AAA Northern California’s work to develop AV safety metrics sorely lacking in the industry. For the project, the organization partnered with Securing America’s Future Energy (SAFE) and RAND Corporation. “When we gave it a careful look, we realized that we were putting the cart before the horse,” Bruso said. “First, we need the foundational definitions for where it’s safe to operate. What are those conditions?”
So the project team turned its attention to developing an ODD for GoMentum Station, the Bay Area’s 2,100-acre AV testing facility owned by AAA Northern California. “We’re starting there,” said Bruso. “We’re using GoMentum Station as a proxy for an industry-wide test environment. We can make those conditions defined and repeatable. ”Bruso’s plan is to publish and promote its ODD with the hope of having other test tracks use its definitions – or at the least, the same conceptual framework. The long-term vision is to establish a testing protocol for apples-to-apples comparisons of AV systems throughout the world.
Bruso explained that those comparisons currently are not possible. “A Cruise vehicle testing in San Francisco has a more-complicated ODD than a Waymo in Phoenix,” she said. “You need a baseline of conditions to evaluate these vehicles on an equal footing.”
Flexibility will be crucial. Industry players follow a wide array of business cases, from long-haul trucking on highways to low-speed deliveries in the suburbs. The ODDs also need to be agnostic to technology, ignoring which sensors a company uses to achieve safety-performance benchmarks. The quest for equal footing becomes still more challenging given the diverse set of stakeholders all trying to establish standards.
“Our next step is to call out to the whole industry,” said Bruso. “How can we come together?”
Koopman believes the mile-long list of ODD factors must be put to a higher, broader purpose. “Safety is always about engineering rigor,” he said. Sometimes that means making sure that “perfect is not the enemy of the good,” as the 18th-century Italian aphorism states.
For Aptiv and other leading AV companies, it’s a balancing act. There’s a strong impulse to get selfdriving vehicles on the road, earning revenue and delivering on the promise for greater safety. “What that means in practice is that we are going to deploy our technology initially in easier driving environments,” said Aptiv’s Iagnemma. “And over time, we will deploy in increasingly complex locations.”
Koopman said that the UL 4600 standard, still in development, explicitly allows AV makers not to be perfect. “You need good empirical test data to say that you’re not presenting an undue risk,” he said. “But you can’t stop conditions from changing. ”In other words, you’ll never develop an ODD that takes every scenario, use case and road condition into consideration; AVs need to know what they don’t know – and then respond with a fix as fast as possible after an incident.
This article was sponsored by AAA Northern California, Utah & Nevada.
Author: Bradley Berman
Source: SAE Automotive Engineering Magazine
Hologram 全息图是一款来自 Edge Case Research 公司的仿真工具，可识别其他测试工具难以发现的ODD (运行设计域）风险。
Aptiv 公司已经在拉斯维加斯、波士顿、匹兹堡和新加坡等地投放了自动驾驶汽车。也就是说，公司的自动驾驶系统需要在不同地点处理非常不同的驾驶场景。
AAA 计划以旗下GoMentum 自动驾驶测试站点为代表，创建一套适用于全行业的 ODD 标准。