From "Collision Between a Sport Utility Vehicle Operating With Partial Driving Automation and a Crash Attenuator Mountain View, California March 23, 2018" Accident Report NTSB/HAR-20/01, PB2020-100112, Published on March 19, 2020: 2.3.2 Risk Assessment Pertaining to Operational Design Domain
SAE J3016 discusses the need for manufacturers to accurately describe ADAS features and clearly define the level of driving automation and its capabilities, but also its operational design domain (ODD)?the conditions in which the driving automation system is intended to operate.73 Examples of such conditions include roadway type, geographic location, clear roadway markings, weather conditions, speed range, lighting conditions, and other manufacturer-defined system performance criteria or constraints. As shown in appendix C and summarized below, Tesla has outlined many operating conditions and limitations based on the Autopilot system design:
• • Designed for use on highways with a center divider,
• • Designed for areas with no cross-traffic and clear lane markings,
• • Not for use on city streets or where traffic conditions are constantly changing,
• • Not for use on winding roads with sharp curves, and
• • Not for use in inclement weather conditions with poor visibility.
Despite communicating these operating conditions and limitations to owners and drivers, Tesla Autopilot firmware does not restrict the system’s use based on functional road classification. The system can essentially be used on any roads where it can detect lane markings, which allows drivers to activate driving automation systems at locations and under circumstances for which their use is not appropriate or safe, such as on roadways with cross traffic or in areas that do not consistently meet the ODD, such as roadways with inconsistent lane markings. The Mountain View crash occurred in a challenging multi-lane operational environment with exit ramps on both sides of the highway and faded roadway lane markings. To characterize and evaluate the performance of Level 2 systems on public highways and in naturalistic environments, the American Automobile Association (AAA) conducted testing, which found that Level 2 systems performed best on open freeways but were challenged on freeways with moderate traffic and in areas of transitions (AAA 2018).74 Most Level 2 systems were incapable of staying in their lane on curved portions of freeways, including in freeway transition areas.
SAE J3016 considers the ODD for Level 2 systems to be limited (see table 1). Today’s Level 2 systems can assess a vehicle’s location and the current roadway type/classification and determine whether the roadway is appropriate for the system’s ODD. Despite this capability, Tesla has chosen to permit operation of Autopilot under conditions that do not meet its ODD. Tesla has informed the NTSB that its “operational design domain limits are not applicable for Level 2 driver assist systems, such as Autopilot, because the driver determines the acceptable operating environment.” Moreover, Tesla has advised the NTSB that “Autopilot can be safely used on divided and undivided roads as long as the driver remains attentive and ready to take control.”
The Williston, Florida, crash involved a 2015 Tesla Model S that collided with a tractor trailer combination crossing an uncontrolled intersection on a nonlimited-access highway.75 Partial automated vehicle operation on nonlimited-access highways presents challenges in detecting cross-path intrusions, pedestrian and bicycle traffic, and signage at intersections. Additionally, cross-path collisions are challenging for collision avoidance systems. The NTSB concluded in the investigation of the Williston crash that if automated vehicle control systems do not automatically restrict their own operation to those conditions for which they were designed and are appropriate, the risk of driver misuse remains. The NTSB recommended that Tesla and other manufacturers of Level 2 automation take the following action:
Incorporate system safeguards that limit the use of automated vehicle control systems to those conditions for which they were designed.
Five automobile manufacturers responded to this recommendation with steps they were taking to address the issue. Tesla, however, has not responded. As mentioned previously, Tesla has stated that it does not believe ODD limits are applicable to the Autopilot system as long as the driver remains attentive. During the Mountain View investigation, Tesla was queried regarding plans to implement ODD restrictions and indicated that the driver was solely responsible for choosing when to use the SAE Level 2 system. However, Tesla vehicles continue to be involved in crashes where Autopilot is activated and operating outside the intended geographic ODD. In March 2019, in Delray Beach, Florida, a fatal crash involving a 2018 Tesla Model 3 occurred under circumstances very similar to the Williston crash. In the Delray Beach crash, a truck-tractor in combination with a semitrailer was traveling eastbound in a private driveway belonging to an agricultural facility on the west side of US-441. The combination vehicle entered the highway without stopping and was subsequently struck by the southbound Tesla. At the time of the crash, the Autopilot system was active, and the Tesla was traveling at 68 mph in a 55-mph posted speed limit area. The Autopilot system and collision avoidance systems did not classify the crossing truck as a hazard, did not attempt to slow the vehicle, and did not provide a warning to the driver of the approaching crossing truck. Further, the driver did not take evasive action in response to the crossing truck. At the crash location, the highway was not limited-access and had more than 34 roadways and private driveways intersecting US-441 within the immediate 5-mile area.
The Delray Beach highway operating environment, like the cross-traffic conditions in Williston, was clearly outside the Tesla Autopilot system’s ODD. Tesla, however, fails to provide system safeguards to limit the use of Autopilot for the operating conditions for which it was designed. By placing full reliance on the success of its partial automation system on the premise that drivers will be attentive at all times and will be sufficiently knowledgeable to make proper decisions regarding where to operate the system, Tesla has created a system designed to fail because of the foreseeable misuse of the system. The NTSB concludes that if Tesla Inc. does not incorporate system safeguards that limit the use of the Autopilot system to those conditions for which it was designed, continued use of the system beyond its ODD is foreseeable and the risk for future crashes will remain. Therefore, the NTSB reiterates Safety Recommendation H-17-41 to Tesla and reclassifies the recommendation from “Open-Await Response” to OPEN--UNACCEPTABLE RESPONSE.
Without more rigorous standards or guidelines to manufacturers regarding Level 2 emerging automation technology, safeguards will be insufficient to prevent use of Level 2 systems in nondesigned ways. After the Williston crash, the NTSB recommended that NHTSA address this vital safety concern, as follows:
Develop a method to verify that manufacturers of vehicles equipped with Level 2 vehicle automation systems incorporate system safeguards that limit the use of automated vehicle control systems to those conditions for which they were designed.
In response to Safety Recommendation H-17-38, NHTSA stated the following:
The agency has no current plans to develop a specific method to verify manufacturers of vehicles equipped with Level 2 systems incorporate safeguards limiting the use of automated vehicle control systems to those conditions for which they were designed. Instead, if NHTSA identifies a safety-related defect trend in design or performance of a system, or identifies through its research or other