特斯拉AEB功能失效分析

ODIRESUME

Investigation:PE16-007

DateOpened:06/28/2016 DateClosed:01/19/2017

Investigator:KareemHabib Reviewer: JeffQuandt

Approver: StephenRidella

Subject: Automaticvehiclecontrolsystems

MANUFACTURER&PRODUCTINFORMATION

Manufacturer: TeslaMotors,Inc.

Products: MY2014-2016TeslaModelSandModelXPopulation: 43,781

ProblemDescription:TheAutomaticEmergencyBraking(AEB)orAutopilotsystemsmaynotfunctionasdesigned,increasingtheriskofacrash.

FAILUREREPORTSUMMARY

ODI Manufacturer Total

Complaints: 0 0 0

Crashes/Fires: 0 0 0

InjuryIncidents: 0 0 0

FatalityIncidents: 0 0 0

ACTION/SUMMARYINFORMATION

Action:ThisPreliminaryEvaluationisclosed.

Summary:

OnMay7,2016,a2015TeslaModelScollidedwithatractortrailercrossinganuncontrolledintersectiononahighwaywestofWilliston,Florida,resultinginfatalinjuriestotheTesladriver.DataobtainedfromtheModelS

indicatedthat:1)theTeslawasbeingoperatedinAutopilotmodeatthetimeofthecollision;2)theAutomaticEmergencyBraking(AEB)systemdidnotprovideanywarningorautomatedbrakingforthecollisionevent;and3)th

drivertooknobraking,steeringorotheractionstoavoidthecollision.OnJune28,2016,NHTSAopenedPE16-007to

“examinethedesignandperformanceofanyautomateddrivingsystemsinuseatthetimeofthecrash.”

TheOfficeofDefectsInvestigation(ODI)analyzedthefollowingsubjectsaspartofNHTSA’sexaminationofthedesignandperformanceofTesla’sAutopilotsystem:1)AutomaticEmergencyBraking(AEB)systemdesignandperformanceinthesubjectTeslaandpeervehicles;2)human-machineinterfaceissuesrelatedtoAutopilotoperatimode;3)datafromcrashincidentsrelatedtoTesla’sAutopilotandAEBsystems;and4)changesTeslahasimplementedintheAutopilotandAEBsystems.

NHTSA’sexaminationdidnotidentifyanydefectsinthedesignorperformanceoftheAEBorAutopilsystemsoftthesubjectvehiclesnoranyincidentsinwhichthesystemsdidnotperformasdesigned.AEBsystemsusedintheautomotiveindustrythroughMY2016arerear-endcollisionavoidancetechnologiesthatarenotdesignedtoreliablperforminallcrashmodes,includingcrossingpathcollisions.TheAutopilotsystemisanAdvancedDriverAssistanceSystem(ADAS)thatrequiresthecontinualandfullattentionofthedrivertomonitorthetrafficenvironmentandpreparedtotakeactiontoavoidcrashes.Tesla'sdesignincludedahands-onthesteeringwheelsystemformonitoringdriverengagement.Thatsystemhasbeenupdatedtofurtherreinforcetheneedfordriverengagementthrougha"strikeout"strategy.Driversthatdonotrespondtovisualcuesinthedrivermonitoringsystemalert

"strikeout"andloseAutopilotfunctionfortheremainderofthedrivecycle.

Asafety-relateddefecttrendhasnotbeenidentifiedatthistimeandfurtherexaminationofthisissuedoesnappeartobewarranted.Accordingly,thisinvestigationisclosed.TheclosingofthisinvestigationdoesnotconstituteafindingbyNHTSAthatnosafety-relateddefectexists.Theagencywillmonitortheissueandreservestherighttakefutureactionifwarrantedbythecircumstances.Formoreinformationabouttheanalysis,seetheattachedr

Investigation:PE16-007 CloseResumePage1of1

1.0INTRODUCTION

OnMay7,2016,a2015TeslaModelScollidedwithatractortrailercrossinganuncontrolledintersectiononahighwaywestofWilliston,Florida,resultinginfatalinjuriestotheTesladrivDataobtainedfromtheModelSindicatedthat:1)theTeslawasbeingoperatedinAutopilotmodeatthetimeofthecollision;2)theAutomaticEmergencyBraking(AEB)systemdidnotprovideanywarningorautomatedbrakingforthecollisionevent;3)thedrivertooknobraking,steeringorotheractionsthecollision;and4)thelastrecordeddriveractionwasincreasingthecruisecontrolsetspeedt

lessthantwominutespriortoimpaThecrashoccurredonacleardaywithdryroadconditions.t. OnJune21,2016,NHTSAdeployedaSpecialCrashInvestigationsteamtothecrashsitetoevaluatethevehicleandstudythecrashenvironment.NHTSA’scrashreconstructionindicatesthatthetractortrailer

shouldhavebeenvisibletotheTesladriverforatleastsevensecondspriortoimpact.OnJune28,2016,

NHTSAopenedPE16-007to“examinethedesignandperformanceofanyautomateddrivingsystemsinuseatthetimeofthecrash.”

TheOfficeofDefectsInvestigation(ODI)analyzedthefollowingsubjectsaNHTSA’spartofexaminationofthedesignandperformanceofTesla’sAutopilotsystem:1)AEBdesignandperformanceinthesubjectTeslaandpeervehicles;2)human-machineinterfaceissuesrelatedtoAutopilotopermode;3)datafromcrashincidentsrelatedTesla’sAutopilotandAEBsystems;and4)changesTeslato hasimplementedintheAutopilotandAEBsystems.

2.1AEBSYSTEM

2.2AEBtechnologies.AutomaticEmergencyBrakingincludesthefollowingcrashavoidancetechnologies:ForwardCollisionWarning(FCW),DynamicBrakeSupport(DBS),andCrashImminentBraking(CIB).AnFCWispresentedtothedriverifthesystempredictsacrashwithanobjectinthevehicle’sforwardpathisimminent.Tobeeffective,suchalertsareprovidedwithsufficientlead-timefothedrivertoassessthepotentialhazard,andtorespondwiththeappropriatebrakingorsteeringavoidthecrash.Ifthedriverchoosestoavoidthecrashbybraking,butdoesnotapplysufficientbratodoso,DBSautomaticallysupplementstheirapplication.Ifthedriverdoesnottakeactiontoavoidthecrash,CIBautomaticallyappliesthevehicle’sbrakessothatitmaybemitigatedoravoided.

2.3Background.AEBtechnologieshavebeeninuseforover10years.InSeptember2007,aNHTSA-sponsoredprojectwasinitiatedbytheCrashAvoidanceMetricsPartnership(CAMP)“todeveloptestmethodsforevaluatingcrashimminentbrakingsystemsandtoestablishbenefitsestimatmethodsforassessingtheireffectivenessatreducingtheseverityofpotentialinjuriesinvehiclecrashes.”1Thefinalreportfromthisproject,releasedinSeptember2011,validatedtheeffectivenessofradacameraandradar/camerafusionsystemsasrear-endcollisionmitigationoravoidanc2Thetechnologies.reportalsoidentifiedseveralcrashmodesthatwerenotvalidatedbytheproject,includingstraigcrossingpath(SCP)3andleftturnacrosspath(LTAP)collisions:

CrashImminentBraking(CIB)FirstAnnualReport.(2010).DOTHS811340.NationalHighwayTrafficSafetyAdministration.Washington,DC.

ObjectiveTestsforImminentCrashAutomaticBrakingSystemsFinalReportVolume1of2.(2011).DOTHS811521.NationalHighwayTrafficSafetyAdministration.Washington,DC.

TheclassicexampleofanSCPcrashisalaterallyapproachingvehicleinatrafficintersection.Challengesassociatedwiththesecrashmodesincreaseasspeedsoftargetand/orhostvehicleincrease.

ThetestmethodsrepresentingStraightCrossingPa[themphasisadded,LeftTurn]

Across–OppositeDirection,OppositeDirection,andpole/treecrashscenarioswere

alldesignatedas‘TestMethodNotValidated–BeyondScopeofCIBProject.’Whiletestscenariosweredevelopedanddemonstratedforthesecrashconditions,CIBsystemperformance,regardlessofsystemconfigurationorsettings,werenotcapableofreliablyrespondingtothesetests.Duetothedifficultyinpredictingthepre-crasheventsthatleaduptothesecrashtypes,thedifficultyinbalancingCIBactivationsforthesecrasheswithpotentialincreasesinundesirablefalseactivation,andmanyotherfactors,thesescenariosarealsonotlikelytobenear-termdeployablefeaturesofCIBsystemsandmaybebetteraddressedthroughotheractivesafetytechnologies.4

Figure1showsastraightcrossingpathtestconductedaspartoftheCIBproject.Thereportprovidesthefollowingassessmentofthetestresult,“Thelimitedtimethetargetisinthefieldofviewpriortoimpactchallengesthesystem’sabilitytoperformthreatassessmentandapplytheCIBsystem.Atargetisusuallyrecognizedverylateornotatallpriortoimpact.”5

Figure1.CIBProjectStraightCrossingPathTestScenario.

Sincemodelyear(MY)2010,NHTSAhasconductedtestingofFCWsystemperformanceaspartofitsNewCarAssessmentProgram(NCAP).Thetestsincludetherear-endcollisioncrashmodesvalidatedbytheCIBproject:LeadVehicleStopped(LVS),LeadVehicleMoving(LVM),andLeadVehicleDecelerating(LVD).OnNovember5,2015,theagencyannounceditwouldbeaddingAEBsystemevaluationstoNCAPeffectiveforthe2018modelyear.InMarch2016,NHTSAissuedajointstatementwiththeInsuranceInstituteforHighwaySafety(IIHS)providinginformationrelatedtothecommitme

ObjectiveTestsforImminentCrashAutomaticBrakingSystemsFinalReportVolume1of2,page84(2011).

DOTHS811521.NationalHighwayTrafficSafetyAdministration.Washington,DC.

ObjectiveTestsforImminentCrashAutomaticBrakingSystemsFinalReportVolume2of2,pageL-51(2011).DOTHS811521A.NationalHighwayTrafficSafetyAdministration.Washington,DC.

by20automobilemanufacturers,representing99percentoftheU.S.new-carmarket,tovoluntarilymAEB“standardonvirtuallyalllight-dutycarsandtruckswithagrossvehicleweightof8,500lbs.nolaterthanSeptember1,2022,andonvirtuallyalltruckswithagrossvehicleweightbetween8,5and10,000lbs.nolaterthanSeptember1,2025.”Thepredictedsafetybenefitscitedinthestatementarelimitedtorear-endcrashes:

IIHSresearchshowsthatAEBsystemsmeetingthecommitmentwourear-enldredudcecrashes[emphasisadded]by40percent.IIHSestimatesthatby2025–theearliest

NHTSAbelievesitcouldrealisticallyimplementaregulatoryrequirementforAEB–thecommitmentwillprevent28,000crashesand12,000injuries.6

ThecapabilitesofAEBsystemshavecontinuallyimprovedinperformanceandcapabilitiesasautomobilemanufacturersandsuppliersrefinesensorpackagesandthealgorithmsthatperformtheo

classificationsandmakethebrakingdecisions(e.g.,pedestriancollisionavoidance).Recognizingthis,

ODIsurveyedadozenautomotivemanufacturersandseveralmajorsupplierstodetermineiftheAEBcapabilitiesincrossingpathcollisionshadchangedsincetheCAMPCIBprojectwascompleted.NoneofthecompaniescontactedbyODIindicatedthatAEBsystemsusedintheirproductsthroughMY2016productionweredesignedtobrakeforcrossingpathcollisions.

2.4TeslaAEBsystem.TheTeslaAEBsystemisaradar/camerafusionsystemthatisfunctionalwhenswitchedONregardlessofAutopilotstatus.ThedrivercanswitchAEBON/OFFontheDriverAssistpageaccessibleviaadisplaymountedinthecenterofthedashboard.TheAEBisdefaultONforeachnewignitioncycle.ThedrivercanselectthetimingofFCWalertswithfouEarly,options:

Medium,Late,orOFF.IfFCWisOFF,thedriverwillstillgetaBrakeCapacityWarning(BCW)when

drivinginTraffic-AwareCruiseControl(TACC)mode(seeSection3below).BCWalertsthedriver

whentheclosingspeedtoaleadvehiclemaybetoogreattoavoidacollisionwiththestandardTAdecelerationlimits.AdjustingthetimingoftheFCWalertdoesnotaffecttheactivationtimingoftheTeslaAEBsystem.

Boththeradarandcamerasub-systemsaredesignedforfront-to-rearcollisionpredictionmitigaoravoidance.7Thesystemrequiresagreementfrombothsensorsystemstoinitiateautomaticbraking.ThecamerasystemusesMobileye’sEyeQ3processingchipwhichusesalargedatasetoftherearimages

ofvehiclestomakeitstargetclassificationdecisions.Complexorunusualvehicleshapesmaydelayorpreventthesystemfromclassifyingcertainvehiclesastargets/threats.

NHTSAconductedaseriesoftesttrack-basedAEBperformanceevaluationsshortlyaftertheMaycrashusinga2015TeslaModelS85Danda2015MercedesC3004Maticpeervehicle.Thevehicles

weretestedinthethreerear-endcollisioncrashmodes(LVS,LVM,andLVD)andthreedifferentvehoperatingmodes:manualdriving;adaptivecruisecontrol(ACC)systemsactivated;andACCandLaneCenteringControl(LCC)systemsactivated.ThistestingconfirmedthattheAEBsystemsintheTeslaandpeervehiclewereabletoachievecrashavoidanceinamajorityoftherear-endscenariostesteACCgenerallyprovidedenoughbrakingtoachievecrashavoidancewithoutalsorequiringCIBto

FactSheet,AutoIndustryCommitmenttoIIHSandNHTSAonAutomaticEmergencyBraking.(2016).NationalHighwayTrafficSafetyAdministration&InsuranceInstituteforHighwaySafety.Washington,DC.

ThesystemisalsodesignedtodetectandavoidimpactswithpedestriansandstationaryobjectsinthepathTeslawhenoperatingwithTACCenabled.

intervene;andthatneithervehicleeffectivelyrespondedtoarealisticappearingartifical“target”vehicleintheSCPorLTAPscenarios.

ODI’sanalysisofTesla’sAEBsystemfindsthat1)thesystemisdesignedtoavoidormitigateread-endcollisions;2)thsystem’scapabilitiesarein-linewithindustrystateoftheartforAEBperformacethroughMY2016;and3)brakingforcrossingpathcollisions,suchasthatpresentintheFloridafcrash,areoutsidetheexpectedperformancecapabilitiesofthesystem.8

3.1AUTOPILOT

TheAutopilotsystemisanadvanceddriverassistancesystem(ADAS),whichcontrolsvehiclespeeandpathbyautomatedcontrolofbraking,steeringandtorquetothedrivemot9FponentsusedbyAutopilottomonitorthedrivingenvironment.10ThemajorsubsystemsassociatedwithoperationinAutopilotmodeareTACCandAutosteer.

Figure2.2016TeslaModelSDriverAssistanceSensors(left)andFieldsofView(right).

3.2Traffic-AwareCruiseControl(TACC).TheTeslaTACCsystemusesinformationfromtheforwardlookingcameraandradarsensortodetermineifthereisavehicleinfrontoftheTeslainlane.IfthereisnovehicleinfrontoftheTesla,TACCmaintainsasetdrivingspeedselectedbytdriver.WhenthereisaleadvehicledetectedthatistravellingslowerthattheTesla’ssetspeed,theTACCwill

controlmotortorquestomaintainaselectedtime-baseddistancefromtheleadvehicle.

TheTeslaModelSowner’smanualstatesthatTACC“isprimarilyintendedfordrivingondry,straightroads,suchashighwaysandfreeways.Itshouldnotbeusedoncitystreets.”Themanual

includesseveraladditionalwarningsrelatedtosystemlimitations,usenearpedestriansandcyclistuseonwindingroadswithsharpcurvesorwithslipperysurfacesorpoorweatherconditions.Thesystemdoesnotpreventoperationonanyroadtypes.

3.3Autosteer.TheTeslaAutosteersystemusesinformationfromtheforward-lookingcamera,the

radarsensor,andtheultrasonicsensors,todetectlanemarkingsandthepresenceofvehiclesand

ObjectclassificationalgorithmsintheTeslaandpeervehicleswithAEBtechnologiesaredesignedtoavoidpositivebrakeactivations.TheFloridacrashinvolvedatargetimage(sideofatractortrailer)thatwouldnotbe“true”targetintheEyeQ3visionsystemdatasetandthetractortrailerwasnotmovinginthesamelongitudinadirectionastheTesla,whichisthevehiclekinematicscenariotheradarsystemisdesignedtodetect.

NHTSArecognizesthatotherjurisdictionshaveraisedconcernsaboutTesla’suseofthename“Autopilot.”Thisissueisoutsidethescopeofthisinvestigation.102016TeslaModelSOwner’sManual

toprovideautomatedlane-centeringsteeringcontrolbasedonthelanemarkingsandthevehicledir

infrontoftheTesla,ifpresent.TheTeslaowner’smanualcontainsthefollowingwarnings:1)“Autosteer

isintendedforuseonlyonhighwaysandlimited-accessroadswithafullyattentivedriver.WhenusAutosteer,holdthesteeringwheelandbemindfulofroadconditionsandsurroundingtraffic.Donot

Autosteeroncitystreets,inconstructionzones,orinareaswherebicyclistsorpedestriansmaybNeverdependonAutosteertodetermineanappropriatedrivingpath.Alwaysbepreparedtotakeimmediateaction.Failuretofollowtheseinstructionscouldcauseseriouspropertydamage,injuryodeath;”and2)“ManyunforeseencircumstancescanimpairtheoperationofAutosteer.Alwayskeepthisinmindandrememberthatasaresult,AutosteermaynotsteerModelSappropriately.Alwaysdriveattentivelyandbepreparedtotakeimmediateaction.”Thesystemdoesnotpreventoperationonanyroadtypes.

4.1HUMANMACHINEINTERFACE

4.2AutomationLevel.TheTeslaAutopilotsystemisaLevel1automatedsystemwhenoperatedwithTACCenabledandaLevel2systemwhenAutosteerisalsoactivated.Figure3showsasummary

ofthelevelsofdrivingautomationforon-roadvehicles,includingthedivisionofresponsibilityalevelforthedriverandsystem.11Level1and2systemrequirecontinuousattentionbytheoperatortomonitorthedrivingenvironmentandtakeimmediatecontrolwhennecessary.Itisimportantthat

operatorsrecognizethisresponsibilityandunderstandthecapabilitiesandlimitationsofthesyste

Figure3.SummaryofSAEInternational’sLevelsofDrivingAutomationforOn-RoadVehicles.

ThedesignofLevel2partialautonomoussystemsshouldconsiderhuman-machineinterfacedesignfactors,including:121)providetheoperatorwithinformationaboutsystemlimitations;2)includeamethodformonitoringdriverengagementwiththedrivingtaskandassistingthedriverwithmaintain

/misc/pdfs/automated_driving.pdf

HumanFactorsEvaluationofLevel2andLevel3AutomatedDrivingConcepts–ConceptsofOperation.(2014).DOTHS812044.NationalHighwayTrafficSafetyAdministration.Washington,DC.

attentiontotheenvironment;3)minimizethepotentialformodeconfusiontooccur,throughintuitifeedbackfromvehicledynamicsand/orwarningstothedriver;and4)considerrestrictingavailabilperformancewhenusedonroadsthatarenotintheintendeduseoperatingenvironments.

Systemlimitations.Teslaprovidesinformationaboutsystemlimitationsatmultiplelevels,including:1)theowner’smanual;2)inthereleasenotesfornewsoftwarereleases,whichrefertotheowner’smanual;3)auseragreementrequiredbeforeenablingAutosteerforthefirsttimeorafteraignitioncyclethatconcludedwithAutosteerbeingswitchedoff;4)adialogboxthatappearseveryAutosteerisactivatedremindingthedriverto“Alwayskeepyourhandsonthewheel”and“Beprepared

totakeoveratanytime”(Figure4);5)theinformationintheuserinterface,whichappearsatalltimewhiledriving-theblueshadedcirclearoundthewhitesteeringwheelindicatesAutosteerisinoperatasopposedtowhenthebackgroundisgraymeaningAutosteerisavailableshouldthedriverdecidetoenableit(Figure5).

Figure4.DialogBoxthatAppearsEveryTimeAutosteerisActivated.

Figure5.AutopilotUserInterfaceshowingSystemPerceivedLaneLines,OtherVehicles,andUltrasonicObjects.

Drivermonitoring.Teslamonitorsdriverengagement13throughtheinteractionswiththesteeringwheel,turnsignal,andTACCspeedsettingstalk.Ifthesystemdoesnotdetectthedriver’shandsonthesteeringwheel(assessedusingmicrotorquemeasurements)orothersignsofdriverengagementforperiodsoftimethatvarydependingonroadclass,vehiclespeed,roadcurvature,andtrafficcondiescalatingseriesofwarningsispresented.Thewarningsstartwithavisualalertindicatingthathandsonthesteeringwheelarerequired.Ifthedriverdoesnotrespondtothevisualwarning,anaudiblechimeissoundedafter15seconds.Amorepronouncedchimeisinitiatedifthedriverdoesnotrespondafteranother10seconds.Ifthedriverfailstorespondtothethirdalertstagewithinfiveseconds,thesy

graduallyslowsthevehiclewhilemaintainingpositioninthelane.Oncethedriver’shandsaredetectedonthesteeringwheel,thewarningsaresuspendedandAutopilotoperationresumes.

AspartofTesla’s8.0over-the-air(OTA)softwareupdateinSeptember2016,Teslarevisedthetimingofthehands-onwarningsandaddedafeaturethattakesawaytheAutopilotdrivingfeaturefremainderofthedrivecycleifthedriverfailstorespondtothealertsadequately(knownasan“Autopilotstrikeout”–Figure6).

Figure6.Autosteer"Strike-Out"Alert.

Modeconfusion.UnexpectedsystemresponseduringattemptedactivationorinadvertentoverrideofAutosteermayleavetheoperatorunawareofthestateofthevehicle(i.e.,“modeconfusion”).Tesla’sdesignisintendedtoprotectagainstmodeconfusionatseverallevels,including:1)informationavailableintheuserinterfaceregardingAutopilotavailability,Autopilotstate,andsuccessfula

transitionsbetweenstates;2)providingaudiovisual“TakeOverImmediately”warningwheneverthevehiclecrossesalanelineorroadedge,whilethedriver’shandsarenotdetectedonthesteeringwheel,within40secondsofanunsuccessfulactivationofAutosteeroranAutosteeroverride;and3)ifthattemptstoactivateTACCandAutosteerwithadouble-pullofthecruisestalkwhenAutosteerisnot

Driverengagementreferstothedriver’sengagementinmonitoringthedrivingenvironmentandbeingpreparedtotakeimmediateactiontoavoidcollisions,ifnecessary.

8

available,neitherfeaturewillactivateandtheAutosteerindicatoriconwillflashorange(Figure

audiblealertwillsound.

4.6

Roadrestrictions.

AccordingtoTesla,Autosteerisdesignedforuseonhighwaysthathavea

centerdividerandclearlanemarkings.

Thesystemdoesnotpreventoperationonanyroadtypes.

The

driverisresponsiblefordecidingwhentheroadtypeandotherconditionsareappropriateforsyst

activation.

Thehands-onwarningsoccurmorefrequentlyasafunctionofvehiclespeed,roadclass,an

existenceofheavytraffic.

5.1

CRASHINCIDENTS

5.2

Autopilotcrashes.

ODIanalyzeddatafromcrashesofTeslaModelSandModelXvehicles

involvingairbagdeploymentsthatoccurredwhileoperatingin,orwithin15secondsoftransitioning

from,Autopilotmode.

14

SomecrashesinvolvedimpactsfromothervehiclesstrikingtheTeslafrom

variousdirectionswithlittletonowarningtotheTesladriver.

Othercrashesinvolvedscenariosknownto

beoutsideofthestate-of-technologyforcurrent-generationLevel1or2systems,suchascut-ins,

andcrossingpathcollisions.

Ifavehicledrivingaheadofyousuddenly

swervesintoyourlane,thesystem

maynot

beabletoautomaticallyrestoretheselected

distance.Thisalsoappliestomajorspeed

differencestovehiclesdrivingaheadofyou,

e.g.,whenrapidlyapproachingatruck.

2016

BMW

7-

SeriesOwner’s

Manual,page174

Figure8.ACCCut-InScenarioWarning.2016BMW7-

SeriesOwner’s

Manual.

Figure9.ACCCut-OutScenarioWarning,2016Volvo

XC90Owner’sManual.

14

Datalogs,imagefiles,andrecordsrelatedtothecrasheswereprovidedbyTeslainresponsetoNHTSA

subpoenas.

9

Figures8and9showexamplesofwarningsfrompeervowner’shiclemanualsindicatingthatthesemodesarechallengingforACCsystems,inLevel1or2operatingmodes,andmayrequireactionbythdrivertoavoidacollision.Similarly,indiscussingACC,theBMWmanualdescribessystemlimitations,includingthatthesystemdoesnotdecelerateforcrosstraffic.15

5.3Driverbehaviorfactors.Manyofthecrashesappeartoinvolvedriverbehaviorfactors,includingtravellingtoofastforconditions,modeconfusion,anddistraction.Mostoftheseinvolvelatesteeringand/orbrakingactionsbythedrivertoavoidthecollision,butafewdonotshowanyactpriortoimpact.Highwayincidents,whichaccountedforalittleoverhalfofthecrashesreviewedbyODI,involvedcut-ins,cut-outs,andsuddenchangesintrafficflow.Somecrashesoccurredin

environmentsthatarenotappropriateforsemi-autonomousdriving(e.g.,citytraffic,highwayentrance/exitramps,constructionzones,inheavyrain,androadjunctions/intersections).

ODI’sanalysisofincidentsrelatedtomodeconfusiondidnotidentifyapatternoffailuresindapotentialdesigndefect.IncidentsincludedapparentmodeconfusionduringattemptedAutopilotactivationsandmodeconfusionafterinadvertantoverrides.Theincidentsassociatedwitheachofthesescenarioswereisolatedeventsthatinvolveddifferentsetsofcontributingfactors.Recentchanges

implementedbyTeslahavebeenmadetofurtherreducethepotentialformodeconfusioninthesubjec

vehicles.16

TheFloridafatalcrashappearstohaveinvolvedaperiodofextendeddistraction(atleast7seMostoftheincidentsreviewedbyODIinvolvedeventswithmuchshortertimeavailableforthesystanddrivertodetect/observeandreacttothependingcollision(lessthan3seconds).Anattentivedriver

hassuperiorsituationalawarenessinmostofthesetypesofevents,particularlywhencoupledwithabilityofanexperienceddrivertoanticipatetheactionsofotherdrivers.Teslahaschangeditsdrivermonitoringstrategytopromotedriverattentiontothedrivingenvironment.

5.4Driverdistraction.Figure10showsthedistributionsofoff-roadglancesbydurationthatwereobservedinaresearchstudybyGeneralMotorsofdriverbehaviorsinvehicleswithLimited-AbilityAutonomousDrivingSystems(LAADS)17whenoperatedinSAELevel1andLevel2modes.18Thedata

showdistractionsoccurineachoperatingmodeandthatthemajorityoccurfor3secondsorlesswh

drivinginACCmodeorwithACCandLaneCenteringControlusedtogether.ODI’sanalysisoffield

incidentsfoundthatmostofthecrashesdevelopedinlessthan3-4seconds.Distractionsgreatertsevenseconds,suchasappearstohaveoccurredinthefatalFloridacrashareuncommon,butforese

Tesla’sModelSOwner’sManualisnotasspecificastheexamplescitedhere;optinginsteadtoidentifyahanofscenariosunderwhichavehiclemaynotbedetected,followedbyabroadwarning:“Thelimitationsdescribedabovedonotrepresentanexhaustivelistofsituationsthatmayinter