How safe is testing of autonomous cars on public roads?

Later this year, a Nissan Leaf will travel from Cranfield University to Sunderland, a distance of 230 miles. It will navigate roundabouts, A-roads and motorways, all through live traffic. Nothing unusual about that except that the Leaf will be driving itself.

The journey, called the 'Grand Drive', is billed as the most complex autonomously controlled journey yet attempted in the UK. It will be the culmination of a 30-month development project that boasts heavyweight partners including Nissan and Hitachi.

The project is called 'HumanDrive' since one of its goals is to develop a vehicle control system that emulates a natural human driving style using machine learning and artificial intelligence. To assist engineers, a detailed visualisation of the environment the autonomous test cars have been developed in has been created. “The visualisation is rendered by a powerful games engine and derived from a detailed scan of the environment,” says Edward Mayo, programme manager at Catapult, the organisation managing HumanDrive. “We use tools that extract data from the real world; for example, the exact position of centre lines, road edges and potholes, as well as the precise angles of road signs.”

As the autonomous car, with a safety driver on board, is driven through the real test environment, it generates a stack of performance data. This is used to recreate its trajectory and behaviour in the digital visualisation.

A car driven by a human then repeats the journey. The resulting data allows development engineers to visualise and compare the performance of the two cars.

“We’ve found that one of the key challenges with an autonomous car is encountering cyclists and safely overtaking them,” says Mayo.

He calls it a challenge, but for one pedestrian who, in March 2018, was pushing her bicycle across a road, an encounter with an autonomous test car, unrelated to HumanDrive, proved to be fatal. Elaine Herzberg was wheeling the cycle, laden with shopping bags, across a four-lane highway in Tempe, Arizona, when she was struck by an Uber test vehicle.

HumanDrive project has spanned 30 months

An investigation showed that the car had misidentified Herzberg and her bicycle, leading it to make false assumptions. Video footage from inside it showed that the safety driver had only seen Herzberg when it was too late.

Simulation is best
Herzberg was the first pedestrian to be killed by an autonomous car, but Michael DeKort, a US-based former systems engineer with long experience of defence and flight simulation, and a member of the Society of Automotive Engineers’ task force responsible for autonomous vehicles, believes she won’t be the last.

“The processes most automakers are using to create autonomous vehicles will never save most of the lives they want to and instead take thousands of lives needlessly in a fatally flawed effort trying,” he says.

The processes DeKort refers to are the practice of using public roads to develop autonomous cars, the method by which the vehicle cedes control to the on-board, human safety driver – called the handover – and the type of games-derived simulation technology he claims they use for development.

According to DeKort, using public roads for testing will never expose an autonomous car’s control systems to enough scenarios to make the vehicle safe – a state which, he says, it can only achieve by experiencing multiple accidents. Also, he says, tests have shown that vehicle handover is unsafe since the human driver has insufficient time to acquire the necessary situational awareness. “Driving around on public roads with a safety driver and stumbling on stuff is not the way to go,” says DeKort. “We’ve not had the death of a child or a family yet but already people have been killed in or by autonomous cars.”

Simulation expert Michael DeKort argues that high-quality renders are the way forward

He’s speaking to me on the telephone from his office at Dactle, the company he recently founded in the US. According to its website, its purpose is to enable the safe, ethical and efficient development and verification of autonomous vehicles through the use of aerospace and military simulation technology.

Such technology, it claims, will avoid the financial, safety and time impacts of public safety driving.

Given his business, it would be easy to dismiss DeKort’s criticisms of rival approaches except that in 2008 he was the recipient of public service awards for his efforts to expose what he claims were serious flaws in the equipment his then-employer, Lockheed Martin, was installing in US coast guard vessels.

He shoots from the hip, at one point describing Cranfield University, and others who test autonomous cars on public roads, of being “reckless”.

“They’re waiting for a crash,” he says. “The industry must stop what it’s doing and use more simulation.”

Modern simulations are incredibly detailed, but may still pale against real-world driving

But not, he says, games-derived simulation that has major real-time and model fidelity issues concerning variables such as vehicle specifics, tyre and road surface condition, sensor capability and environment.

“Using this type of simulation will lead to false confidence and real-world tragedies while delaying for decades the introduction of safe, level four and five autonomy,” says DeKort. “Only aerospace-derived simulation has the test and verification capability to deliver full autonomy, safely.”

Next, DeKort turns his fire on the limitations of autonomous sensors. He says: “Sensors face multiple challenges including identifying complex objects such as, for example, Herzberg’s bicycle laden with shopping bags or interpreting different fabric weaves and patterns.

“Imagine a UK tourist visiting Arizona wearing an item of clothing with an unrecognisable weave. The sensor would be confused. It needs to be exposed to thousands of different textures and weaves at different times of day and in different weather conditions to be sufficiently well ‘educated’.

“Don’t waste time on shadow driving to develop sensors. Instead, spend it on proper simulation, based on data from the real world that has been identified, categorised and degraded, and whose results are verifiable.”

It won’t be cheap. DeKort says hundreds of people will be required to run the necessary number of simulations using simulators like his that cost up to £2 million each.

“There is no choice,” he says. “Without doing this, full autonomy will be a dream.”

Autonomy can be safe
In response, Dr Stefano Longo, a senior lecturer at Cranfield and a member of Multi-User Environment for Autonomous Vehicle Innovation (MUEAVI), where much of HumanDrive’s research work is being conducted, says: “I’m not sure Michael is [doing anything] different from the way I’m working.”

Longo, who is also employed by Embotech, a leading developer of decision-making software for autonomous technologies, says: “At Cranfield, we’re learning that real-world scenarios are infinite and to test them we’re doing more simulation. We need to be able to predict 99.9 percent of hazards or people won’t trust the technology and I reckon that, at the moment, we’re at 80 percent. The final 10 percent will be the hardest.

“There was a lot of hype around the industry at the beginning, but now it’s becoming clearer exactly what the challenges are. For example, people thought vehicle handover was sorted but it isn’t. It’s not a good solution and has been proven not to be safe. A few seconds’ notice is not enough; ideally, you need a few miles.

“But an autonomous car can be safe. For now, one solution is to limit the scope of its application to environments where pedestrians and vehicles are kept apart. Full, level five autonomy is 50 years away.”

Source