Safety Recommendation H-17-042
Details
Synopsis: At 4:36 p.m. eastern daylight time on Saturday, May 7, 2016, a 2015 Tesla Model S 70D car, traveling eastbound on US Highway 27A (US-27A) west of Williston, Florida, struck a semitrailer powered by a 2014 Freightliner Cascadia truck tractor. At the time of the collision, the truck was making a left turn from westbound US 27A across the two eastbound travel lanes onto NE 140th Court, a local paved road. The car struck the right side of the semitrailer, crossed underneath it, and then went off the right roadside at a shallow angle. Impact with the underside of the semitrailer sheared off the roof of the car. After leaving the roadway, the car continued through a drainage culvert and two wire fences. It then struck and broke a utility pole, rotated counterclockwise, and came to rest perpendicular to the highway in the front yard of a private residence. Meanwhile, the truck continued across the intersection and came to a stop on NE 140th Court, south of a retail business located on the intersection corner. The driver and sole occupant of the car died in the crash; the commercial truck driver was not injured.
Recommendation: TO THE MANUFACTURERS OF VEHICLES EQUIPPED WITH LEVEL 2 VEHICLE AUTOMATION SYSTEMS (VOLKSWAGEN GROUP OF AMERICA, BMW OF NORTH AMERICA, NISSAN GROUP OF NORTH AMERICA, MERCEDES-BENZ USA, TESLA INC., AND VOLVO GROUP NORTH AMERICA): Develop applications to more effectively sense the driver’s level of engagement and alert the driver when engagement is lacking while automated vehicle control systems are in use.
Original recommendation transmittal letter: PDF
Overall Status: Open - Acceptable Response
Mode: Highway
Location: Williston, FL, USA
Is Reiterated: Yes
Is Hazmat: No
Is NPRM: No
Accident #: HWY16FH018
Accident Reports:
Report #: HAR-17-02
Accident Date: 5/7/2016
Issue Date: 9/28/2017
Date Closed:
Addressee(s) and Addressee Status: BMW North America LLC (Open - Acceptable Response)
Mercedes-Benz USA LLC (Open - Acceptable Response)
Nissan Group of North America, Inc. (Open - Acceptable Response)
Tesla Motors (Open - Unacceptable Response)
Volkswagen Group of America, Inc. (Open - Acceptable Response)
Volvo Cars of North America, Inc. (Open - Acceptable Response)
Keyword(s):

Safety Recommendation History
From: NTSB
To: Volkswagen Group of America, Inc.
Date: 2/1/2021
Response: The National Transportation Safety Board (NTSB) has reviewed the National Highway Traffic Safety Administration (NHTSA) advance notice of proposed rulemaking (ANPRM) titled “Framework for Automated Driving System Safety,” published at 85 Federal Register 78058 on December 3, 2020. In its notice, NHTSA requests comments on the development of a framework for automated driving system (ADS) safety. ADS, as defined by SAE International and as used in the ANPRM, refers to driving automation levels 3, 4, and 5. An ADS is the hardware and software that are, collectively, capable of performing the entire dynamic driving task on a sustained basis, regardless of whether it is limited to a specific operational design domain. Specifically, the agency seeks input on its role in facilitating ADS risk management through guidance, regulation, or both. NHTSA also requests guidance on how it should select and design the structure of a safety framework and the appropriate administrative mechanisms for improving safety, mitigating risk, and enabling the development and introduction of innovative safety technology. This recommendation was listed in the related safety recommendations list attached to this NPRM response.
From: NTSB
To: Volkswagen Group of America, Inc.
Date: 5/29/2018
Response: We recognize that our Williston investigation involved a Level-2 system vehicle, and that manufacturers’ development work is now focused on more advanced functionality. We also recognize that the upcoming vehicles with higher levels of automation are likely to retain the functionality of a Level-2 automated system. However, until Level-5 automation systems are fully developed, humans will need to assume multiple roles, either as active drivers, passive monitors of automated driving systems, or available drivers prepared to intervene when requested by the automation. Our intent in issuing these recommendations is to make you aware of the evidence we found that a driver is willing to engage automated systems in situations beyond their design envelope. We appreciate your detailed description of the Volkswagen Group’s automation features that constrain driver operations and monitor driver engagement. As you move forward in developing your automated vehicles, we encourage you to address an important issue that we found in our Williston investigation by limiting the use of automated vehicle control systems to only those conditions for which they were designed, which are defined by you, the manufacturer. Examples of such conditions include roadway type, geographic location, clear roadway markings, weather conditions, speed range, lighting condition, and other manufacturer-defined system performance criteria or constraints. Further, we encourage you to explore driver monitoring systems beyond those measuring steering wheel torque to capture where a driver is focusing his or her attention, or, if relying solely on torque, to describe how this method provides the appropriate level of driver engagement. We look forward to receiving periodic updates from you on your efforts to incorporate these safeguards into your automated systems. Until such actions are complete, Safety Recommendations H-17-41 and -42 are classified OPEN--ACCEPTABLE RESPONSE. Thank you for your ongoing efforts to improve vehicle safety.
From: Volkswagen Group of America, Inc.
To: NTSB
Date: 12/18/2017
Response: -From Thomas Zorn, Senior Director, Safety Affairs and Advanced Research: Currently Volkswagen Group of America offers Level 2 Partially automated systems in select Audi models. These models offer a system called Audi Traffic Jam Assist (TJA). TJA assists the driver by providing lateral and longitudinal controls in certain congested environments below 40 mph. In addition to the TJA, these vehicles have two separate Level 1 systems that, when used in combination with each other, also constitute as a level 2 system; Audi Active Lane Assist (AALA) and Adaptive Cruise Control (ACC). Provided that lane markings are visible and detected by the system AALA works by supporting the driver in keeping their lane by providing torque input into the steering wheel as the vehicle approaches the edges of the lane. AALA can also assist the driver by actively centering the vehicle in the current lane. ACC maintains the set cruise speed, applies the brakes to preserve a predetermined following distance when approaching a slower-moving vehicle, and accelerates to the set cruising speed when the area in front of the vehicle is no longer obstructed by other vehicles. ACC and AALA combined operate between 40 mph and 95 mph. TJA, ACC and AALA are not hands free systems or replacement systems for the driver and require driver engagement at all times. We have taken numerous steps to ensure that the driver does not become reliant on the system, complacent while utilizing the system and confused about its capabilities. First, TJA is specifically named as an Assist system and not a Pilot system. Second, the TJA capabilities and limitations are specifically noted in advertisements as well as owner manuals. Third, TJA system currently considers multiple factors to determine driver engagement: 1. One way in which driver attention is measured is by the torque sensor in the electric power steering. Simply touching the steering wheel is not sufficient for driver recognition; there must be a steering “effort” by the driver (approximately 0.4 Nm). 2. Warning strategies messaging and timing of TJA: A take-over request is issued by the system if no steering input is detected for approximately 10 to 15 seconds. If the driver ignores the visual and audible warnings, the system will bring the vehicle to a controlled stop. The 10 to 15 seconds hands-off time limit is in line with the United Nations Economic Commission for Europe regulation regarding lane-keeping systems slated to go into effect in 2018. a. If AALA is being used outside of the TJA mode, it similarly has a 10 to 15 second handsoff time limit. If the driver ignores the AALA warning outside of the TJA mode, the AALA function will simply immediately disengage but not slow down the vehicle. 3. The driver seatbelt buckle is monitored. If the driver seatbelt is not buckled, the TJA function is deactivated. These driver monitoring methods coupled with the TJA functionality engagement criteria provides assurance that the driver will not become complacent and/or too reliant on the system. Given that the definition of level 2 systems require the driver to supervise the driving task at all times, the above measures ensure that the driver is supervising the performance of the driving task when the system is active. We believe that the TJA design significantly reduces the possibility of driver complacency and overreliance on the assistance systems or otherwise preoccupied from monitoring the performance of the driving task. It is important to note that as systems evolve and as new Level 2 functions are developed to accommodate new use cases, additional safeguards will be considered to ensure proper utilization of the systems by the human driver. Regulations, guidelines and best practices might also play a similar role for future system requirements and deployment.
From: NTSB
To: Volkswagen Group of America, Inc.
Date: 9/28/2017
Response: The National Transportation Safety Board (NTSB) is an independent federal agency charged by Congress with investigating every civil aviation accident in the United States and significant accidents in other modes of transportation—railroad, highway, marine, and pipeline. We determine the probable cause of the accidents and issue safety recommendations aimed at preventing future accidents. In addition, we carry out special studies concerning transportation safety and coordinate the resources of the federal government and other organizations to provide assistance to victims and their family members affected by major transportation disasters. On September 12, 2017, the NTSB adopted its report Collision Between a Car Operating With Automated Vehicle Control Systems and a Tractor-Semitrailer Truck Near Williston, Florida, May 7, 2016, NTSB/HAR-17/02. The details of this accident investigation and the resulting safety recommendations may be found in the attached report, which can also be accessed at http://www.ntsb.gov. Among the Safety Recommendations are two issued to Volkswagen Group of America, which can be found on page 43 of the report. The NTSB is vitally interested in these recommendations because they are designed to prevent accidents and save lives. We would appreciate a response within 90 days, detailing the actions you have taken or intend to take to implement these recommendations. When replying, please refer to the safety recommendations by number.
From: NTSB
To: BMW North America LLC
Date: 2/1/2021
Response: The National Transportation Safety Board (NTSB) has reviewed the National Highway Traffic Safety Administration (NHTSA) advance notice of proposed rulemaking (ANPRM) titled “Framework for Automated Driving System Safety,” published at 85 Federal Register 78058 on December 3, 2020. In its notice, NHTSA requests comments on the development of a framework for automated driving system (ADS) safety. ADS, as defined by SAE International and as used in the ANPRM, refers to driving automation levels 3, 4, and 5. An ADS is the hardware and software that are, collectively, capable of performing the entire dynamic driving task on a sustained basis, regardless of whether it is limited to a specific operational design domain. Specifically, the agency seeks input on its role in facilitating ADS risk management through guidance, regulation, or both. NHTSA also requests guidance on how it should select and design the structure of a safety framework and the appropriate administrative mechanisms for improving safety, mitigating risk, and enabling the development and introduction of innovative safety technology. This recommendation was listed in the related safety recommendations list attached to this NPRM response.
From: NTSB
To: BMW North America LLC
Date: 5/15/2018
Response: We recognize that our Williston investigation involved a Level-2 system vehicle, and that manufacturers’ development work is now focused on more advanced functionality. We also recognize that the upcoming vehicles with higher levels of automation are likely to retain the functionality of a Level-2 automated system. However, until Level-5 automation systems are fully developed, humans will need to assume multiple roles, either as active drivers, passive monitors of automated driving systems, or available drivers prepared to intervene when requested by the automation. Our intent in issuing these recommendations is to make you aware of the evidence we found that a driver is willing to engage automated systems in situations beyond their design envelope. We appreciate your detailed description of the BMW Group’s automation features that constrain driver operatons and monitor driver engagement. As you move forward in developing your automated vehicles, we encourage you to address an important issue that we found in our Williston investigation by limiting the use of automated vehicle control systems to only those conditions for which they were designed, which are defined by you, the manufacturer. Examples of such conditions include roadway type, geographic location, clear roadway markings, weather conditions, speed range, lighting condition, and other manufacturer-defined system performance criteria or constraints. Further, we encourage you to explore driver monitoring systems beyond those measuring steering wheel torque to capture where a driver is focusing his or her attention, or, if relying solely on torque, to describe why this method provides the appropriate level of driver engagement. We look forward to receiving periodic updates from you on your efforts to incorporate these safeguards into your automated systems. Until such actions are complete, Safety Recommendations H-17-41 and -42 are classified OPEN-ACCEPTABLE RESPONSE. Thank you for your ongoing efforts to improve vehicle safety.
From: BMW North America LLC
To: NTSB
Date: 12/19/2017
Response: -From Samuel Campbell, Department Head for Safety Engineering and ITS, BMW Group: BMW's Level 2 system is designed to communicate to the driver both the limitations of the automated driving system and the responsibilities of the driver while the automated driving system is active. To transparently communicate the driver's responsibility, BMW implemented measures such as soft lateral support, limited torque input to the steering system, and cooperative steering to reduce misuse of the system and to keep the driver engaged. Cooperative steering combines steering inputs of the system and the driver to encourage mutual vehicle guidance. This effectively reminds the driver to remain involved in the driving task and it precludes misinterpretations of the system's capability. As a supplemental measure, BMW incorporates a hands on detection (HOD) system that is based on measuring capacitance via a capacitive sensor mat fitted on the steering wheel collar. This system functions by measuring and evaluating the change in capacitance of the sensor mat which is caused by touching the steering wheel. Above walking speeds, the system tolerates a brief period of significantly less than a minute if the driver takes his/her hands off the steering wheel. After this brief period, if the system detects the driver's hands are not on the steering wheel, the system will initiate a visual Hands-On Request (HOR) in the instrument cluster. If the driver does not respond to the HOR, a Take-Over Request (TOR) will be initiated with an audible warning and a visual warning in the instrument cluster. If the driver continues not to respond, the system will deactivate. Future considerations are to use enhanced driver monitoring techniques (such as biometrics) to assess the driver's engagement. Nonetheless, some studies have shown that it is more effective to actively engage the driver than to monitor and discipline misuse of the system. Hopefully the information provided addresses the concerns in your safety recommendations regarding safety in automated vehicles.
From: NTSB
To: BMW North America LLC
Date: 9/28/2017
Response: The National Transportation Safety Board (NTSB) is an independent federal agency charged by Congress with investigating every civil aviation accident in the United States and significant accidents in other modes of transportation—railroad, highway, marine, and pipeline. We determine the probable cause of the accidents and issue safety recommendations aimed at preventing future accidents. In addition, we carry out special studies concerning transportation safety and coordinate the resources of the federal government and other organizations to provide assistance to victims and their family members affected by major transportation disasters. On September 12, 2017, the NTSB adopted its report Collision Between a Car Operating With Automated Vehicle Control Systems and a Tractor-Semitrailer Truck Near Williston, Florida, May 7, 2016, NTSB/HAR-17/02. The details of this accident investigation and the resulting safety recommendations may be found in the attached report, which can also be accessed at http://www.ntsb.gov. Among the Safety Recommendations are two issued to BMW of North America, which can be found on page 43 of the report. The NTSB is vitally interested in these recommendations because they are designed to prevent accidents and save lives. We would appreciate a response within 90 days, detailing the actions you have taken or intend to take to implement these recommendations. When replying, please refer to the safety recommendations by number.
From: NTSB
To: Nissan Group of North America, Inc.
Date: 2/1/2021
Response: The National Transportation Safety Board (NTSB) has reviewed the National Highway Traffic Safety Administration (NHTSA) advance notice of proposed rulemaking (ANPRM) titled “Framework for Automated Driving System Safety,” published at 85 Federal Register 78058 on December 3, 2020. In its notice, NHTSA requests comments on the development of a framework for automated driving system (ADS) safety. ADS, as defined by SAE International and as used in the ANPRM, refers to driving automation levels 3, 4, and 5. An ADS is the hardware and software that are, collectively, capable of performing the entire dynamic driving task on a sustained basis, regardless of whether it is limited to a specific operational design domain. Specifically, the agency seeks input on its role in facilitating ADS risk management through guidance, regulation, or both. NHTSA also requests guidance on how it should select and design the structure of a safety framework and the appropriate administrative mechanisms for improving safety, mitigating risk, and enabling the development and introduction of innovative safety technology. This recommendation was listed in the related safety recommendations list attached to this NPRM response.
From: NTSB
To: Nissan Group of North America, Inc.
Date: 8/22/2018
Response: We recognize that our Williston investigation involved a Level-2 system vehicle, and that manufacturers’ development work is now focused on more advanced functionality. We also recognize that the upcoming vehicles with higher levels of automation are likely to retain the functionality of a Level-2 automated system. However, until Level-5 automation systems are fully developed, humans will need to assume multiple roles, either as active drivers, passive monitors of automated driving systems, or available drivers prepared to intervene when requested by the automation. Our intent in issuing these recommendations is to make you aware of the evidence we found that a driver is willing to engage automated systems in situations beyond their design envelope. We appreciate your detailed description of Nissan’s automation features that constrain driver operations and monitor driver engagement. As you move forward in developing your automated vehicles, we encourage you to address an important issue that we found in our Williston investigation by limiting the use of automated vehicle control systems to only those conditions for which they were designed, which are defined by you, the manufacturer. Examples of such conditions include roadway type, geographic location, clear roadway markings, weather conditions, speed range, lighting condition, and other manufacturer-defined system performance criteria or constraints. Further, we encourage you to explore driver monitoring systems beyond those measuring steering wheel torque to capture where a driver is focusing his or her attention, or, if relying solely on torque, to describe why this method provides the appropriate level of driver engagement. We look forward to receiving periodic updates from you on your efforts to incorporate these safeguards into your automated systems. Until such actions are complete, Safety Recommendations H-17-41 and -42 are classified OPEN--ACCEPTABLE RESPONSE. Thank you for your ongoing efforts to improve vehicle safety.
From: Nissan Group of North America, Inc.
To: NTSB
Date: 6/1/2018
Response: -From Selim Hammoud, Director, NNA Safety Officer, Product Safety, Environmental, FQA, Nissan North America, Inc.: On behalf of Nissan Group of North America, Inc. and Nissan Motor Company, Ltd., of Yokohama, Japan, (Nissan), I am responding to recommendations H-17-41 and H-17-42 (recommendations) to manufacturers of vehicles equipped with SAE Level 2 driving automation systems (Level 2 driving automation). We note that the recommendations were issued before Nissan began offering Level 2 driving automation systems for sale in the United States.1 However, since that time Nissan introduced Level 2 driving automation technology called ProPILOT Assist as an optional feature for the 2018 Nissan Rogue, 2018 Nissan LEAF, and the 2019 Infiniti QX50. Nissan recently announced that ProPILOT Assist will also be available on the 2019 Nissan Altima. ProPILOT Assist combines a steering assist function with intelligent cruise control to help drivers stay centered in the lane, navigate stop-and-go traffic, maintain a set vehicle speed and maintain a set distance to the vehicle ahead. The system is designed to help ease driver workload by reducing the amount of driver acceleration, steering and braking input under certain driving conditions. Throughout its operation, the system gives priority to the driver’s control input. The system uses a front camera installed behind the windshield and a radar sensor located on the front of the vehicle to measure the distance to the vehicle ahead in the same lane and to monitor the lane markers. If the vehicle detects a slower moving vehicle ahead, the system can reduce the vehicle speed so that the vehicle follows the vehicle in front at the selected distance. The system will also help keep the vehicle centered in the traveling lane when clear lane markings are detected. Importantly, ProPILOT Assist is a strictly hands-on-the-wheel technology and Nissan very clearly communicates this to our customers through responsible communications, through training of dealership sales personnel, and clear Owner’s Manual instructions. In fact, Nissan was very deliberate in including the word “Assist” in naming this technology, and always includes the word “Assist” when referring to the feature; Nissan believes this helps customers better appreciate its intended function whenever they see the technology mentioned. ProPILOT Assist also utilizes a robust hands-on detection system described in greater detail in our responses to the recommendations. The ProPILOT Assist hands-on detection system uses a torque sensor to detect the small amount of resistance from the driver holding the steering wheel as the system is making steering adjustments. If the steering wheel is not operated or the driver takes his/her hands off the steering wheel, a visual warning is typically 3 provided within 5-10 seconds. If the driver does not operate the steering wheel after the warning has been displayed, an audible alert sounds and a warning flashes in the vehicle information display, followed by a haptic alert in the form of a quick application of the brakes to request the driver to take control of the vehicle. If the driver still does not respond, ProPILOT Assist slows the vehicle to a complete stop and activates the hazard lights. The driver can cancel the deceleration at any time by steering, braking, accelerating, or operating the ProPILOT Assist switch. In addition to hands-on detection safeguards, Nissan continues to research opportunities to enhance the performance of our advanced driving technologies, including ProPILOT Assist, and the experience of our customers. Nissan is engaging not only in our own research, but also with other partners such as academic institutions and government stakeholders. In conclusion, Nissan is committed to the safe and responsible deployment of autonomous driving technologies. We would be happy to meet with the NTSB to discuss ProPILOT Assist in more detail.
From: NTSB
To: Nissan Group of North America, Inc.
Date: 9/28/2017
Response: The National Transportation Safety Board (NTSB) is an independent federal agency charged by Congress with investigating every civil aviation accident in the United States and significant accidents in other modes of transportation—railroad, highway, marine, and pipeline. We determine the probable cause of the accidents and issue safety recommendations aimed at preventing future accidents. In addition, we carry out special studies concerning transportation safety and coordinate the resources of the federal government and other organizations to provide assistance to victims and their family members affected by major transportation disasters. On September 12, 2017, the NTSB adopted its report Collision Between a Car Operating With Automated Vehicle Control Systems and a Tractor-Semitrailer Truck Near Williston, Florida, May 7, 2016, NTSB/HAR-17/02. The details of this accident investigation and the resulting safety recommendations may be found in the attached report, which can also be accessed at http://www.ntsb.gov. Among the Safety Recommendations are two issued to Nissan Group of North America, which can be found on page 43 of the report. The NTSB is vitally interested in these recommendations because they are designed to prevent accidents and save lives. We would appreciate a response within 90 days, detailing the actions you have taken or intend to take to implement these recommendations. When replying, please refer to the safety recommendations by number.
From: NTSB
To: Mercedes-Benz USA LLC
Date: 2/1/2021
Response: The National Transportation Safety Board (NTSB) has reviewed the National Highway Traffic Safety Administration (NHTSA) advance notice of proposed rulemaking (ANPRM) titled “Framework for Automated Driving System Safety,” published at 85 Federal Register 78058 on December 3, 2020. In its notice, NHTSA requests comments on the development of a framework for automated driving system (ADS) safety. ADS, as defined by SAE International and as used in the ANPRM, refers to driving automation levels 3, 4, and 5. An ADS is the hardware and software that are, collectively, capable of performing the entire dynamic driving task on a sustained basis, regardless of whether it is limited to a specific operational design domain. Specifically, the agency seeks input on its role in facilitating ADS risk management through guidance, regulation, or both. NHTSA also requests guidance on how it should select and design the structure of a safety framework and the appropriate administrative mechanisms for improving safety, mitigating risk, and enabling the development and introduction of innovative safety technology. This recommendation was listed in the related safety recommendations list attached to this NPRM response.
From: NTSB
To: Mercedes-Benz USA LLC
Date: 3/8/2018
Response: We recognize that our Williston investigation involved a Level-2 system vehicle, and that manufacturers’ development work is now focused on more advanced functionality. We also recognize that the upcoming vehicles with higher levels of automation are likely to retain the functionality of a Level-2 automated system. However, until Level-5 automation systems are fully developed, humans will need to assume multiple roles, either as active drivers, passive monitors of automated driving systems, or available drivers prepared to intervene when requested by the automation. Our intent in issuing these recommendations is to make you aware of the evidence we found that a driver is willing to engage automated systems in situations beyond their design envelope. We believe that these recommendations will remain relevant even as we move beyond Level 2 automated systems. We appreciate your description of MBUSA’s automation features that monitor driver engagement. As you move forward in developing your automated vehicles, we encourage you to include control systems that automatically restrict automated operations to the conditions for which they were designed. Further, we encourage you to explore monitoring systems beyond those measuring steering wheel torque to capture where a driver is focusing his or her attention. We look forward to receiving periodic updates from you on your efforts to incorporate these safeguards into your automated systems. Until such actions are complete, Safety Recommendations H-17-41 and -42 are classified OPEN--ACCEPTABLE RESPONSE.
From: Mercedes-Benz USA LLC
To: NTSB
Date: 12/8/2017
Response: -From David S. Tait, General Manager, Engineering Services, Mercedes-Benz, USA, LLC: MBUSA Level 2 driving automatic in features monitor driver engagement by assessing steering torque input and operation of the buttons mounted on the steering wheel, including touch control. If the steering wheel torque is too small and there is no detected operation of the steering wheel buttons or touch control, an escalating cascade of visual and audible warnings is initiated, culminating in full deceleration as described above if the driver fails to resume steering. MB USA believes in continually improving vehicle safety, and our Advanced Driver Assistance Systems are no exception. We continue to study the most effective ways of monitoring driver engagement with the goal of delivering safe, usable technological advancements. We would be happy to make ourselves available for a more in-depth discussion on any of these topics. In the meantime, should you have any questions or require further information, please feel free to contact R. Thomas Brunner, of my staff.
From: NTSB
To: Mercedes-Benz USA LLC
Date: 9/28/2017
Response: The National Transportation Safety Board (NTSB) is an independent federal agency charged by Congress with investigating every civil aviation accident in the United States and significant accidents in other modes of transportation—railroad, highway, marine, and pipeline. We determine the probable cause of the accidents and issue safety recommendations aimed at preventing future accidents. In addition, we carry out special studies concerning transportation safety and coordinate the resources of the federal government and other organizations to provide assistance to victims and their family members affected by major transportation disasters. On September 12, 2017, the NTSB adopted its report Collision Between a Car Operating With Automated Vehicle Control Systems and a Tractor-Semitrailer Truck Near Williston, Florida, May 7, 2016, NTSB/HAR-17/02. The details of this accident investigation and the resulting safety recommendations may be found in the attached report, which can also be accessed at http://www.ntsb.gov. Among the Safety Recommendations are two issued to Mercedes-Benz USA, which can be found on page 43 of the report. The NTSB is vitally interested in these recommendations because they are designed to prevent accidents and save lives. We would appreciate a response within 90 days, detailing the actions you have taken or intend to take to implement these recommendations. When replying, please refer to the safety recommendations by number.
From: NTSB
To: Tesla Motors
Date: 10/25/2021
Response: The National Transportation Safety Board (NTSB) appreciates the productive and professional cooperation extended by Tesla’s technical staff to our investigators over the course of our various crash and incident investigations, such as our recent work in Spring, Texas, and Coral Gables, Florida. I am deeply concerned, however, that Tesla’s action—or rather, inaction—to implement critical NTSB safety recommendations has not demonstrated the same productivity or professionalism. Four years ago, on September 28, 2017, we issued Safety Recommendations H 17 41 and -42 to Tesla based on our investigation of the 2016 collision between a Tesla Model S operating with an engaged Level 2 automation system and a tractor semitrailer truck in Williston, Florida. H-17-41 Incorporate system safeguards that limit the use of automated vehicle control systems to those conditions for which they were designed. H-17-42 Develop applications to more effectively sense the driver’s level of engagement and alert the driver when engagement is lacking while automated vehicle control systems are in use. Our investigation of the Williston crash found that the driver used the Autopilot system outside of its operational design domain (ODD)—on roadways for which it was neither designed nor safe—and went extended periods of time without hands-on driving. We also found other indications of the driver’s lack of engagement and awareness before the crash, and, accordingly, determined that Tesla’s Autopilot system did not effectively monitor and respond to the driver’s interaction with the steering wheel to ensure driver engagement. The NTSB issued Safety Recommendation H-17-42 to Tesla and five other manufacturers of vehicles equipped with SAE Level 2 driving automation systems. The other five manufacturers responded to us, describing the actions they planned to take, or were taking, to better monitor a driver’s level of engagement. Tesla is the only manufacturer that did not officially respond to us about the recommendation. While we were awaiting a response from Tesla, in 2019, a crash nearly identical to that in Williston occurred in Delray Beach, Florida. The Delray Beach highway operating environment, like the cross-traffic conditions in Williston, was clearly outside the Autopilot system’s ODD. The highway did not have limited access and had 34 intersecting roadways and private driveways in the 5-mile region encompassing the crash location. As we concluded after the Williston crash, if automated control systems are not automatically restricted to operating in those conditions for which they were designed and are appropriate, the risk of driver misuse remains. During our subsequent investigation of a fatal 2018 crash in Mountain View, California, Tesla stated the following: Under the SAE J3016, operational design domain limits are not applicable for Level 2 driver assist systems, such as Autopilot, because the driver determines the acceptable operating environment. Autopilot can be safely used on divided and undivided roads as long as the driver remains attentive and ready to take control. However, our crash investigations involving your company’s vehicles have clearly shown that the potential for misuse requires a system design change to ensure safety. In the Delray Beach crash, a contributing factor in the crash was the operational design of Tesla’s partial automation system, which permitted disengagement by the driver, and the company’s failure to limit the use of the system to the conditions for which it was designed. Our investigation of the Mountain View crash found tragically similar evidence of driver disengagement and ineffective driver monitoring, and our report stated the following: Despite communicating . . . operating conditions and limitations to owners and drivers, Tesla Autopilot firmware does not restrict the system’s use based on functional road classification. The system can essentially be used on any roads where it can detect lane markings, which allows drivers to activate driving automation systems at locations and under circumstances for which their use is not appropriate or safe, such as on roadways with cross traffic or in areas that do not consistently meet the ODD, such as roadways with inconsistent lane markings. Therefore, we reiterated Safety Recommendations H-17-41 and -42: that Tesla and other manufacturers of Level 2 automation incorporate system safeguards that limit use of automated vehicle control systems to those conditions for which they were designed. Tesla has still not officially responded to the NTSB regarding these safety recommendations. You have stated that “safety is always the primary design requirement for a Tesla.” Now that statement is undercut by the announcement that Tesla drivers can request access to “Full Self Driving Beta technology,” operational on both highways and city streets, without first addressing the very design shortcomings that allowed the fatal Williston, Delray Beach, and Mountain View crashes to occur. If you are serious about putting safety front and center in Tesla vehicle design, I invite you to complete action on the safety recommendations we issued to you four years ago. The NTSB has long advocated for implementation of myriad technologies to prevent tragedies and injuries and save lives on our nation’s roads, but it’s crucial that such technology is implemented with the safety of all road users foremost in mind. I look forward to receiving an update on our safety recommendations.
From: NTSB
To: Tesla Motors
Date: 2/1/2021
Response: The National Transportation Safety Board (NTSB) has reviewed the National Highway Traffic Safety Administration (NHTSA) advance notice of proposed rulemaking (ANPRM) titled “Framework for Automated Driving System Safety,” published at 85 Federal Register 78058 on December 3, 2020. In its notice, NHTSA requests comments on the development of a framework for automated driving system (ADS) safety. ADS, as defined by SAE International and as used in the ANPRM, refers to driving automation levels 3, 4, and 5. An ADS is the hardware and software that are, collectively, capable of performing the entire dynamic driving task on a sustained basis, regardless of whether it is limited to a specific operational design domain. Specifically, the agency seeks input on its role in facilitating ADS risk management through guidance, regulation, or both. NHTSA also requests guidance on how it should select and design the structure of a safety framework and the appropriate administrative mechanisms for improving safety, mitigating risk, and enabling the development and introduction of innovative safety technology. This recommendation was listed in the related safety recommendations list attached to this NPRM response.
From: NTSB
To: Tesla Motors
Date: 3/19/2020
Response: From "Collision Between a Sport Utility Vehicle Operating With Partial Driving Automation and a Crash Attenuator Mountain View, California March 23, 2018" Accident Report NTSB/HAR-20/01, PB2020-100112, Published on March 19, 2020: 2.3.1 Risk Mitigation Pertaining to Monitoring Driver Engagement 2.3.1.1 Tesla Driver Monitoring System. Based on system design, in an SAE-defined Level 2 partial driving automation system, it is the driver’s responsibility to monitor the automation, maintain situational awareness of traffic conditions, understand the limitations of the automation, and be available to intervene and take over for the driving automation system at all times. In practice, however, drivers are poor at monitoring automation and do not perform well on tasks requiring passive vigilance (Parasuraman and Riley 1997; Moray and Inagaki 2000; and Parasuraman and Manzey 2010). Research shows that drivers often become disengaged from the driving task for both momentary and prolonged periods during automated phases of driving (Banks and others, 2018). Driver disengagement from supervising Autopilot’s partial automation was a critical factor in the four Tesla crashes the NTSB investigated.68 In the Mountain View and Culver City crashes, the drivers were found to be distracted and not supervising Autopilot’s performance or monitoring the driving environment (detecting and recognizing roadway hazards) leading up to the crash. Likewise, in the Williston and Delray Beach crashes, the drivers were inattentive and did not take any evasive action in response to semitrailer vehicles crossing the paths of their cars. Autopilot assesses a driver’s level of engagement by monitoring his or her interaction with the steering wheel through changes in steering wheel torque. However, because driving is a highly visual task, a driver’s touch or torque on the steering wheel is an ineffective method to determine whether he or she is fully engaged with the driving task. Simply checking whether the driver has placed a hand on the steering wheel gives little indication of where the driver is focusing his or her attention. Following the investigation of the Williston crash, the NTSB concluded that the way the Tesla Autopilot system monitored and responded to the driver’s interaction with the steering wheel was not an effective method of ensuring driver engagement. As a result, the NTSB recommended that six manufacturers of vehicles equipped with Level 2 driving automation systems take the following action: H-17-42 Develop applications to more effectively sense the driver’s level of engagement and alert the driver when engagement is lacking while automated vehicle control systems are in use. Of the six automakers, Tesla was the only company that has not officially responded to Safety Recommendation H-17-42.69 The NTSB continues to maintain that the operational design of Tesla’s automated vehicle control systems requires an attentive driver as an integral system element. Therefore, the NTSB reiterates Safety Recommendation H-17-42 to Tesla and reclassifies the recommendation from “Open-Await Response” to OPEN-UNACCEPTABLE RESPONSE.
From: NTSB
To: Tesla Motors
Date: 3/19/2020
Response: Reiterated in the report "Collision Between a Sport Utility Vehicle Operating With Partial Driving Automation and a Crash Attenuator Mountain View, California March 23, 2018" Accident Report NTSB/HAR-20/01, PB2020-100112, Published on March 19, 2020
From: NTSB
To: Tesla Motors
Date: 9/28/2017
Response: The National Transportation Safety Board (NTSB) is an independent federal agency charged by Congress with investigating every civil aviation accident in the United States and significant accidents in other modes of transportation—railroad, highway, marine, and pipeline. We determine the probable cause of the accidents and issue safety recommendations aimed at preventing future accidents. In addition, we carry out special studies concerning transportation safety and coordinate the resources of the federal government and other organizations to provide assistance to victims and their family members affected by major transportation disasters. On September 12, 2017, the NTSB adopted its report Collision Between a Car Operating With Automated Vehicle Control Systems and a Tractor-Semitrailer Truck Near Williston, Florida, May 7, 2016, NTSB/HAR-17/02. The details of this accident investigation and the resulting safety recommendations may be found in the attached report, which can also be accessed at http://www.ntsb.gov. Among the Safety Recommendations are two issued to Tesla Inc., which can be found on page 43 of the report. The NTSB is vitally interested in these recommendations because they are designed to prevent accidents and save lives. We would appreciate a response within 90 days, detailing the actions you have taken or intend to take to implement these recommendations. When replying, please refer to the safety recommendations by number.
From: NTSB
To: Volvo Cars of North America, Inc.
Date: 2/1/2021
Response: The National Transportation Safety Board (NTSB) has reviewed the National Highway Traffic Safety Administration (NHTSA) advance notice of proposed rulemaking (ANPRM) titled “Framework for Automated Driving System Safety,” published at 85 Federal Register 78058 on December 3, 2020. In its notice, NHTSA requests comments on the development of a framework for automated driving system (ADS) safety. ADS, as defined by SAE International and as used in the ANPRM, refers to driving automation levels 3, 4, and 5. An ADS is the hardware and software that are, collectively, capable of performing the entire dynamic driving task on a sustained basis, regardless of whether it is limited to a specific operational design domain. Specifically, the agency seeks input on its role in facilitating ADS risk management through guidance, regulation, or both. NHTSA also requests guidance on how it should select and design the structure of a safety framework and the appropriate administrative mechanisms for improving safety, mitigating risk, and enabling the development and introduction of innovative safety technology. This recommendation was listed in the related safety recommendations list attached to this NPRM response.
From: NTSB
To: Volvo Cars of North America, Inc.
Date: 5/15/2018
Response: We recognize that our Williston investigation involved a Level-2 system vehicle, and that manufacturers’ development work is now focused on more advanced functionality. We also recognize that the upcoming vehicles with higher levels of automation are likely to retain the functionality of a Level-2 automated system. However, until Level-5 automation systems are fully developed, humans will need to assume multiple roles, either as active drivers, passive monitors of automated driving systems, or available drivers prepared to intervene when requested by the automation. Our intent in issuing these recommendations is to make you aware of the evidence we found that a driver is willing to engage automated systems in situations beyond their design envelope. We appreciate your description of Volvo Car’s automation features that constrain driver operations and monitor driver engagement. As you move forward in developing your automated vehicles, we encourage you to address an important issue that we found in our Williston investigation by limiting the use of automated vehicle control systems to only those conditions for which they were designed, which are defined by you, the manufacturer. Examples of such conditions include roadway type, geographic location, clear roadway markings, weather conditions, speed range, lighting condition, and other manufacturer-defined system performance criteria or constraints. Further, we encourage you to explore driver monitoring systems beyond those measuring steering wheel torque to capture where a driver is focusing his or her attention, or, if relying solely on torque, to describe how this method provides the appropriate level of driver engagement. We look forward to receiving periodic updates from you on your efforts to incorporate these safeguards into your automated systems. Until such actions are complete, Safety Recommendations H-17-41 and -42 are classified OPEN--ACCEPTABLE RESPONSE. Thank you for your ongoing efforts to improve vehicle safety.
From: Volvo Cars of North America, Inc.
To: NTSB
Date: 12/27/2017
Response: -From Katherine Yehl, Vice President Government Affairs the Americas, Volvo Car Corporation: Thank you for your letter regarding Report 17-02, PB2017 — 102600 and the National Transportation Safety Board (NTSB) recommendations for vehicle manufacturers equipped with Level 2 automation systems. Safety is a founding principle of Volvo Car Corporation (VCC) and VCC works hard to stay at the forefront of the industry by taking an overall approach to safety, which has proven effective in real world traffic situations. VCC invented the three point lap and shoulder safety belt and then gave away the global patent in order to save lives. It has been estimated that this one act could have saved over 1m lives globally. According to the latest US crash causation study, 94% of all crashes are due to human error. In 2016, traffic fatalities remain at epidemic levels. At VCC, we are appalled that 1.2 million people around the world are killed in traffic crashes annually — with over 35,000 of those deaths occurring in the U.S. alone. Crash avoidance and active safety technologies will be essential to substantially reduce this number and to eventually completely avoid crashes in the future. In 2007, VCC launched Vision 2020. This Vision states that no one should be killed or seriously injured in a new Volvo by 2020. Crash avoidance and active safety technologies are essential to reach our goal. These features which include systems that assist the driver or automatically act in order to prevent or mitigate crashes (such as automatic emergency braking systems, lane departure warning systems, pedestrian detection, and braking systems) are the precursors for self-driving cars. Numerous studies of real-world crash performance data in the US and abroad show the effectiveness of these active safety systems in reducing injuries and fatalities. These technologies will continue to be developed and they will become even more effective over time. So VCC strongly supports the NTSB June, 2015, recommendation that the US New Car Assessment Program (NCAP) include crash avoidance technologies in the 5-star safety rating scale. The USA is way behind all other major countries who already include these life-saving technologies in the overall consumer rating. With regard to the two NTSB recommendations for manufacturers of vehicles with level 2 vehicle automation systems, Volvo Cars supports the intent of these recommendations. See below: 1) Incorporate system safeguards that limit the use of automated vehicle control systems to those conditions for which they were designed. (H-17-41). Volvo Cars pilot assist adheres to this recommendation and the system only perform in the conditions for which they were designed. 2) Develop applications to more effectively sense the driver's level of engagement and alert the driver when engagement is lacking while automated vehicle control systems are in use. (H-17-42) Volvo Cars pilot assist adheres to this recommendation and our systems alert the driver when engagement is lacking. VCC would like to clarify how our pilot assist system works and would like to invite the NTSB to demo the system. The VCC pilot assist system is an active safety support function that combines steering with Adaptive Cruise Control and braking. Simply put it is lane centering support plus adaptive cruise control. It is very important to note that the system is designed as an assistance system. The driver is in control and the system gives assistance and complimentary support to the driver. It helps the operator keep within his lane and stay a safe distance and speed from the vehicle in front of it. However, the driver is expected to actively participate in the driving and remains responsible for monitoring and supervision over the entire operation of the vehicle. It also is important to emphasize that VCC systems are restricted in how much acceleration, braking and steering force can be applied. The driver is always responsible for maintaining their hands on the wheel and eyes on the road when using these features. If a driver's hands are not on the steering wheel, a warning is given to the driver to grasp the steering wheel. If the driver does not respond to the warning, an additional warning is provided with an audible alert. If the driver still does not respond, the system disengages. This functionality is specifically designed to prevent the driver from becoming overly reliant on the system. VCC's ambition is to provide our customers accurate, descriptive and easy-tounderstand information of driver support functionality to increase the driver's understanding and acceptance of function behavior & performance, function limitations, and driver responsibilities. If you have any additional questions or need further assistance, please do not hesitate contact us.
From: NTSB
To: Volvo Cars of North America, Inc.
Date: 9/28/2017
Response: The National Transportation Safety Board (NTSB) is an independent federal agency charged by Congress with investigating every civil aviation accident in the United States and significant accidents in other modes of transportation—railroad, highway, marine, and pipeline. We determine the probable cause of the accidents and issue safety recommendations aimed at preventing future accidents. In addition, we carry out special studies concerning transportation safety and coordinate the resources of the federal government and other organizations to provide assistance to victims and their family members affected by major transportation disasters. On September 12, 2017, the NTSB adopted its report Collision Between a Car Operating With Automated Vehicle Control Systems and a Tractor-Semitrailer Truck Near Williston, Florida, May 7, 2016, NTSB/HAR-17/02. The details of this accident investigation and the resulting safety recommendations may be found in the attached report, which can also be accessed at http://www.ntsb.gov. Among the Safety Recommendations are two issued to Volvo Group North America, which can be found on page 43 of the report. The NTSB is vitally interested in these recommendations because they are designed to prevent accidents and save lives. We would appreciate a response within 90 days, detailing the actions you have taken or intend to take to implement these recommendations. When replying, please refer to the safety recommendations by number.