Good afternoon, and welcome to today's Vehicle Autonomy Levels Reflections on Safety presented by ACOM Transportation Section. My name is Danielle Feinberg, and I am with the American College of Occupational and Environmental Medicine. There are two features available to communicate with the panelists and other attendees. You may post general messages in the chat feature. Messages can be shared with either the panelists or all the participants. Use the drop down box to select who you want to share your message with. Go ahead and give it a try by introducing yourselves to all the panelists and attendees. Let us know your role and where you are from. Questions, on the other hand, should be submitted in the Q&A box. Panelists are monitoring this box for questions, so please be sure to post all your questions here and not in the chat box, and we will address them at the end of the presentation. We are joined today by Dr. Kristen Polin and Dr. Michelle Waters. Dr. Polin is the Deputy Director in the Office of Highway Safety at the NTSB and serves in a leadership role over all investigations and product development within the office, including those addressing collision avoidance, automated vehicle technologies, fatigue, impairment, medical fitness, vehicle design, and occupant protection. Through this role, she has influenced the safety of numerous vehicles and systems and has testified before Congress on the federal role of school bus safety. Previously, she served as the Senior Biomechanical Engineer in the Vehicle Performance Division in the Office of Research and Engineering. She developed the NTSB methodology for occupant kinematics investigations, performed occupant kinematics simulations, and injury causation analysis for numerous highway, rail, and aviation crashes. Dr. Polin has published multiple peer-reviewed papers addressing many unique aspects of accident investigations and has served as a technical expert at multiple board meetings, forums, and investigative hearings, including the Motorcycle Forum, the Aging Driver Forum, the Child Safety Forum, the Truck and Bus Safety Forum, and the WMATA Rail Investigative Hearing. Further, Dr. Polin led the board's work to document and analyze accidents with 3D laser scanners and to develop models with the 3D printer. Dr. Polin earned several prestigious awards at the NTSB, including the NTSB Managing Director's Award in 2015, the NTSB Peer Award in 2013, and the NTSB Dr. John K. Lauber Award for Technical Excellence in 1999. Dr. Waters is a medical officer at the NTSB Office of Research and Engineering. She serves as a subject matter expert, reviewing and providing medical options, opinions, excuse me, regarding medical information gathered during the conduct of NTSB's transportation accident investigations. She also engages in other agency activities related to medical aspects of transportation research, policy, and outreach. Prior to joining the NTSB, Dr. Waters served with several organizations within the U.S. Department of Health and Human Services, evaluating hazard exposure, providing support during disasters, and serving as a technical expert. Dr. Waters received her Doctor of Medical Degree in Residency Training in Occupational and Environmental Medicine from the University of Illinois. Additionally, she holds a PhD in Civil Engineering from Northwestern University and a Master of Public Health degree from the University of Illinois. We are delighted to have you here with us today, and I will now turn the presentation over to you. Thank you, Danielle, for that introduction. And we'll wait to the slide. So, as mentioned, I'm Dr. Michelle Waters, and with me today is Dr. Chris Poland. We're both from the NTSB, and we're going to present on vehicle autonomy levels and reflections on safety. So, neither of us have anything to disclose. And in terms of our learning objectives, I was approached by Dr. Gillis a couple of months ago. I saw that she was on the line. I saw the chat popped up. And, you know, she had mentioned the entrance of the ACON transportation section and learning more about autonomous vehicles. So, in that respect, I know everyone sees the ads on TV for the self-driving cars, and you get all the sort of interesting news about which company and what they're doing, and we won't mention all these names because I said I wasn't going to say anything. So, I won't mention any of those. So, one of the first things is to describe the different levels of vehicle autonomy, so you have a better understanding of what you're trying to deal with when you're looking at safety recommendations. And for what we are, which is our second objective, in terms of our agency, in terms of when we do highway investigations, focusing on autonomous vehicles, what is our role, what are the safety issues, what are the issues related to driver safety, and of course, since you're an occupational medicine group, medical certification for these autonomous vehicles. So, let's start out with telling you who we are. We are an independent federal agency. We're charged by Congress to investigate every civil aviation accident in the United States, as well as very significant accidents that meet certain criteria in the other modes of transportation, such as rail, marine, pipeline, and for this discussion, we're going to talk about highway. Within that, what we're trying to do in our investigation is to determine the probable cause of the accident, and from that, determine if there's any kind of safety issues we need to discuss and make safety recommendations. We'll also carry out some special studies concerning transportation safety, with the overall idea of our mission being to make transportation safer by conducting independent accident investigations and advocating for safety improvements in transportation. We're going to give you a background in terms of where we all started from, and originally we came from 1926 with the Air Commerce Act, where Congress charged the U.S. Department of Commerce with investigating the cause of the civil aircraft accidents. This was an emerging transportation mode. In 1940, you had the Civil Aeronautics Board created with the Bureau of Aviation Safety, so they took the role of performing accident investigations. 1967 was actually more of the year where NTSB, as we know it today, came to exist, so it was created by statute, and it expanded that function from just doing aviation accidents to, as I said, more specific, specialized issues related to the other transportation modes when they met certain criteria. At that time, we were located within the Department of Transportation, and gave it a few years, and Congress recognized that, hey, if we're giving probable cause and recommendations to our sister agencies, such as FAA and FMCSA, and even worse, telling our parent agency DOT recommendations, that there might be a little bit of conflict. So, both by statute and regulation, we were made an independent agency, and with that, we now get funding and report directly to Congress. As mentioned, we have both statutory and regulatory authority in order to complete our mission, so we can actually subpoena any record and make any record available to us that's relative to, pertinent to our investigation, and for the medical side, it also includes subpoenaing biological specimens when they're available. Next slide, please. So, this is our structure. As mentioned, we're a board, so the top five positions represent our board members. They are nominated by the President and confirmed by the Senate to serve five-year terms. Presently, four of the five board member positions are full. Below that, we have our Managing Director and the Office of Investigation, the Deputy Managing Director for Investigations, which include the bottom five left boxes on that, is the Transportation Modes and both the Office of Research and Engineering, where I reside, and the Office of Highway Safety, which Dr. Poland will talk about. And just one other side. As I mentioned, we are a small agency. Despite all this structure, there's only 400 of us to do this task, just so you know. Next slide, please. Thank you. So, we're going to start out with the medical officers. As mentioned, we're in the Office of Research and Engineering. There's two of us currently. I'm sure some of you may have known Dr. Mary Pat McKay, who decided to retire last year. And just as a heads up, there will be a job announcement to fill that position come late March, early April, as anticipated. So, keep that open and pass the alert. So, our role, as you might guess, is to, and we're subject matter experts. So, we conduct the medical part of the investigations for the accidents across all the modes. For the most part, we deal with human performance issues related to the operators, though we will provide some consultations on survival factors for some of the passengers, as well as weigh into some of the operational issues when they are in an emergency. And we also involve some issues of impairment. And in addition to that, as far as the job description, we do participate in a lot of other medical aspects related to research, policy, and outreach, including this webinar today. So, for medical investigations, our big question is, did the medical condition, its treatment, or use of, or exposure to substances lead to impairment or incapacitation that contributed to the accident? So, now I'm sure many of you are sitting back, next slide please, and saying, well, I deal with impairment, next slide please. Thank you. I deal with impairment all the time. You know, you're OCDOCs, you're dealing with impairment and disability. So, we're going to step back in terms of what, TSB medical officers use impairment, and that's any loss or abnormality of psychological, physiological, or anatomical structure or function. So, the impairment can be from both a medical condition, or from a substance, to treat the condition, or taken with substance abuse, which may affect the thinking process and judgment. You know, does it make you more of a risk taker? It might diminish your reaction time. It might make it difficult to coordinate your eyes and hands. So, again, a slightly different perception on, perspective on impairment, and while someone might have longstanding impairment or disability, we're focusing on the period that's really much more leading up to the accident, as opposed to a longer term impairment. So, when we view impairment, we look at it as a spectrum, from the peak performance on one end, and in that we put in the context of the person, like their individual skill and experience level. So, someone who's renting a U-Haul to get their stuff and move out of college is viewed differently than someone who's a 35-year career truck driver. On the other end, we have incapacitation, and when you think about total incapacitation, it's often potentially medical conditions, such as a stroke, some arrhythmia, a seizure. Everything else in between, whether it's from substance or medical, we look as impairment. Next slide, please. So, as you might guess, when we're trying to get our information, I mentioned we do have subpoena authority for both medical records, and in that context, the NTSB is viewed as a public health entity under HIPAA, so we're able to obtain these personal medical records. Some of them might include certification files. We also have the ability to subpoena and get specimens, biological specimens. So, many of you with DOT testing are like, ah, yeah, I get my 15 substance abuse type of substance, drugs of abuse type of compounds, but we can also subpoena leftovers, and we send them, we have a memorandum of agreement with the FAA's forensic toxicology lab, where we can get, they test for over 1,000 substances. So, part of it is just looking at even, not only is there a presence of a drug there that indicates an impairing medical condition, or potentially a drug that is impairing, but isn't one of those top 15, 15 drugs for DOT, but it indicates that they potentially can be impairing when used. On the right-hand side, I think you'll see that, like, whoa, these are also what you use for medical information, and yes, we do. You can tell a lot from times from, like, flight tracking data, inward and outward facing data in terms of trying to assess behavioral issues for the person to suggest impairment. And, next slide. And, oh, in general, though, all of these, our medical decisions are put in the context of sort of the operational and mechanical issues, so we work really closely with our investigators, such as with highway, which is my segue to you, Dr. Polin, in terms of doing our investigation and putting that kind of the medical side into that context. Thanks, Dr. Waters. So, I wanted to take some time today to talk to you about what happens when we do launch on an investigation, what that looks like, and then give you some examples focusing on partial automation and full automation. So, I guess to start with, if we launch a team, and this would be for a major investigation, we would launch a multidisciplinary team that would be led by an investigator in charge, or IIC, and then in the highway mode, we have specific investigators focusing on each of the disciplines that may have areas for safety improvements. And that includes human performance, survival factors, highway factors, vehicle factors, motor carrier operations, and then depending on the investigation, we may add additional support staff. That may be someone that can focus on the recorded information, especially if that recorded information was degraded by a post-crash fire or maybe submersion in water. We may have drone specialists to document the environmental conditions at the time or the wreckage itself. So, that's our multidisciplinary team approach. So, as we mentioned today, we're going to talk about automated vehicle investigations. I have a QR code here. And if you want to look, the NTSB does have a webpage where we've documented both our partial automated investigations and those investigations dealing with the testing of vehicles that are more on the fully autonomous. Before we dive into some of the examples, I just want to lay out the different levels of vehicle automation. And these are set out by both SAE and then also adopted by the National Highway Traffic Safety Administration, or NHTSA. So, the first set of levels, the levels go all the way up to five, but zero through two are considered advanced driver assistance systems. And that's a key point to make here. We're assisting the driver, but the driver is still in control. So, for level zero, one, and two, the driver is in control. This can be a misperception, and I'll talk to you about that in a couple minutes. Level zero, driver's in control, but the vehicle may take action if there's a need, kind of a last minute intervention to either avoid a crash or something that may lead up to a crash. So, that would be like automatic emergency braking. There's something in front of the vehicle, likely the rear end of another vehicle, and the driver hasn't taken action, the vehicle may brake for the driver. Some of these may also be warning systems. So, just a warning that there's something in front of the vehicle, or maybe that the driver is departing the lane without putting on their turn signal. So, a lane departure warning system. That's all level zero. Level one, driver's still in control. These are assistance systems. The vehicle assists with either speed or with steering. So, with the speed, we'd be talking about an adaptive cruise control system. So, it's not just regular cruise control, but it's adaptive. So, it either goes to the set cruise speed, or it can maintain a set following distance behind a vehicle in front. The steering part would be that it could keep you within the lane if you started to depart. So, we call these lane departure prevention systems. So, you start to depart the lane, but now the vehicle will nudge you back into your lane of travel because there's no indication that you want to change lanes. Level two, again, driver's in control. In this case, the vehicle assists with both speed and steering. So, that's important here. These systems are what you typically hear about in the news, maybe a pro pilot system or an auto pilot system. These are all the systems that are available for us to buy with our passenger car fleet today. But there can be some confusion because even if we're talking an auto pilot system, a pro pilot system, when the vehicle is assisting with both speed and steering, it's only assist. The driver is in control and is expected to be monitoring the driving environment and making all decisions about the driving performance. Okay, level three, four, and five are now considered a higher level of automation or an automated driving system. Sometimes you see it labeled ADS. So, the other one was ADAS and this one is ADS. So, that can be a little bit confusing. These vehicles are not currently available for purchase in the United States, but they are being tested on our roads. And that's both for passenger vehicles and also for commercial vehicles. So, level three, we still have the driver able to take over control in this case, but we do have the vehicle handling the aspects of the driving task. So, this is really a challenging level there that a lot of people have struggled with because, and we'll get into that when we talk about some of the NTSB investigations. Is the driver really able and aware enough to take control in appropriate circumstance? So, some companies are skipping right to the level four system and kind of skipping over the level three. Level four is that the vehicle or the system, the ADS system is responsible for the driving tasks, but only within a limited area. So, a certain design domain, so maybe it's only in good weather, or maybe it's only on certain roads that have already been mapped out, but it's a very limited area and the occupants are just passengers. So you may see that there's no steering wheel or no brake pedals in that case. Level five, full automation, this is basically the vehicle control, control the vehicle in all operating environments and again occupants are just the passengers. So the NTSB has had a long history of investigating partial automation crashes and then also some that are in the test environment for this automated driving system. The photographs that you see here are all partial automation crashes. The Williston crash that's on the far left, that crash actually happened in 2016. So this has been many years, we're talking seven years ago that we had our first fatality involving a vehicle operating with partial automation. In that case we had a crossing tractor trailer, very similar to the Delray Beach one that you see in the bottom right there. The vehicle did not detect the tractor trailer passing in front of it and drove underneath the trailer. So you can kind of see the shearing of the roof. Culver City, California, there's some challenges with these vehicles and the recognition of emergency vehicles and I'm going to talk a little bit more about the Mountain View, California as an example for this presentation. So Mountain View, California, this crash happened in March 2018. It involved a 2017 Tesla Model X that struck a previously damaged highway attenuator, in this case with autopilot engaged. The Tesla had a high voltage lithium-ion battery fire and a re-ignition and actually this was the reason why we got involved in this crash in the first place. We knew about the fire and we have a separate report that was dealing with emergency responder safety associated with these high voltage lithium-ion battery fires after a crash. Once we started investigating, we determined that autopilot was engaged and so we looked at both aspects, both the partial automation and then also the safety associated with the post-crash fire. The driver did die in this crash. Importantly, the driver died from the blunt force trauma, not from the from the fire. Okay, so let me just kind of step you through this crash sequence so you have some understanding. So it happened in California. Those of you that are familiar with California, there's a lot of HOV lanes. HOV lanes are usually in the left and instead of when you have an exit that you need to take, instead of having that HOV vehicle have to cross all the way over to the right to take an exit, they'll often have an HOV exit lane. So in this case, our driver's traveling in the HOV lane on US 101 South and then there's a an exit for State Route 85. So in this area where we have the two separations between the exit and the southbound 101 lanes, we have what's called a gore area and that's highlighted with a yellow triangle. At the end of the gore area in the inset at the bottom right is our crash attenuator. So for those of you that aren't familiar, this crash attenuator should be pulled all the way out kind of at the far bottom corner of what looks like a ladder. It's designed so that it will absorb the energy of a crash at this speed and we actually know it works because a couple weeks earlier a Prius is what hit this energy attenuator and the Prius driver survived. Unfortunately there wasn't a timely repair, NTSB has made some recommendations associated with that, but that was what was at the end of this gore area. So specific to this crash sequence, our Tesla shown in blue was following behind a lead vehicle. So I talked about that earlier. So it will adopt its cruise speed or it will follow at a set distance behind. So in this case, the vehicle in front was setting the speed so our Tesla is traveling about 64 miles per hour. In the inset you can see a photograph of this gore area developing on US 101 South. This photograph was taken after the crash. Important to note is that the lane lines are not well defined on the right side of the triangle of the gore, but they are on the left side. So what happens, we continue, we're following our lead vehicle, we have a hands-off the steering wheel detection that's recorded for this vehicle. So we know the driver, at least from the vehicle's perspective, is not engaged in the driving task as measured by the torque sensor on the steering wheel. That doesn't always mean the driver is not engaged, but what we also know is that subsequent to this, the vehicle misreads these gore lane lines and starts to read the left side of the gore instead of the right side of the gore. The Tesla moves into the gore area, the driver doesn't take any action, the speed now is about 62 miles per hour, but because we're no longer following a lead vehicle, the Tesla accelerates and unfortunately accelerates up to about 71 miles per hour crashing into this previously damaged attenuator. One of the downfalls with these systems currently is that they don't detect roadside hardware very well and unfortunately it did not detect that roadside hardware and so again accelerated, impacted at 71 miles per hour, which with it already damaged it's not survivable. A couple other vehicles were involved in this crash, an Audi and a Mazda, and you can see the final rest positions in this image here. So I mentioned a couple of the challenges with these L2 or partial automation systems. The systems may not be able to detect four lane markings and may put the vehicle in a position that isn't ideal for the driving conditions. Again, remember the driver is in control, they must be paying attention in operating this vehicle at all times, but there's sometimes misunderstanding where a driver either misinterprets that or they become disengaged and then they're not necessarily recognizing their responsibility. The vehicle then accelerated to its preset cruise speed once we didn't have a lead vehicle because it didn't know that it wasn't in a travel lane, but we know after the fact that it was fully in the gore lane at this area, the gore area at this area. These systems have an inability to be able to detect the roadside hardware. In this case it was a damaged energy attenuator, we've seen it for other aspects too. They have a challenge detecting roadside hardware, they're very much trained to read the back, the rear end of other vehicles, that's the main focus. NTSB is continuing to push for these systems to be able to detect others like vulnerable road users or motorcycles, other hazards that may be on the road as well, but right now they're mainly trained for that rear impact into another vehicle. And of course the insufficient driver monitoring system. In this case it's just a torque sensor that was only for about six or seven seconds that the driver was disengaged prior to the crash, but as you know at highway speeds bad things can happen in that short time frame. So NTSB has also looked at some crashes that are involving developmental automated driving systems. In this case this is a Uber ATG vehicle that is put on top of a Volvo system. So the crash that I'm going to talk about occurred in Tempe, Arizona also in March 2018. Uber test vehicle on a 2017 Volvo XC90. We know that the automated driving system was active at the time. The vehicle also had a female operator who was occupying the driver's seat. She was essentially the backup to this system. In this case the vehicle struck a pedestrian pushing a bicycle across the roadway and the pedestrian was killed. So let me let me step you through this a little bit here. So this is North Mill Avenue. Our test vehicle our Uber test vehicle is represented by the yellow arrow. That vehicle is traveling and going to turn right at this intersection up ahead here. You can also see that there's kind of an x pattern in between the median area of North Mill Avenue that is not a crosswalk. That's decorative and there's actually signs up. There aren't sidewalks along those lines there but despite that that's where our pedestrian is crossing. There is not a crosswalk in this area. They're not coming from a set of sidewalks but you can see where that may be misinterpreted to be a walkway. The nearest crosswalk is actually down the road a good distance and I have it highlighted here with the red rectangle. Okay in this crash the the automated driving system actually detected this pedestrian six seconds before impact when the vehicle was going about 43 miles per hour 44 miles per hour. What happened though was that the detection of the hazard the classification of this hazard so it sees that there's a hazard but then it has to determine what that hazard is in order to plan its own path and predict the path of the hazard. So the hazard flickered between an unknown object a vehicle and then a bicycle and with each flicker for that automated driving system at that time in 2018 it became a new hazard. So it didn't have the history of where it had been previously and with each flicker it then had a new prediction of what that path was. If it was a vehicle it assumed it was going to travel along the lane it was in. It wasn't going to have a crossing pattern. The hazard because of course we're going to have an incursion here the ADS system did determine that emergency braking was needed about 1.3 seconds before impact but at this time because there were false positives with these systems the designers had put on a one second delay for any emergency braking with the goal that the driver in the seat would recognize that there was a hazard take action. Unfortunately the driver at that time was watching a show on her cell phone and was not looking forward. The driver looked up last moment steered less than a second before and unfortunately impacted the pedestrian at 39 miles per hour. The speed differential was actually because of the upcoming turn not because of the detection of the hazard. The vehicle had not executed any sort of speed reduction because of a hazard. So let me detail this a little bit more here. So here's our pedestrian 5.6 seconds to impact. Our vehicle's still going a little bit faster at this time. So 45 you're going to see the the speed is going to go down. Our pedestrian is continuing across the roadway. Please remember that the classification is now changing at each of these. So while you can see the history of where this pedestrian is and predict of course we're going to have a pedestrian crossing our roadway at a non-crosswalk area the vehicle is thinking that this object when it's a bicycle is going to continue along the lane not have that crossing pattern. 1.2 seconds of course we've already determined that we need emergency braking but the vehicle is going to wait a second and then we have impact at 39 miles per hour. Okay some of the challenges that we have here and you can see on the right hand side we have a picture of the bicycle that was involved in this crash where you can see it lined up with the front. Again this was being pushed by the pedestrian. So some of the sensor and system challenges again this was a test vehicle but some of these things could be anticipated and you'll probably see that as I talk through some of these. So the system had an inability to properly classify the pedestrian pushing a bicycle. If it was just a pedestrian potentially if it was just a bicyclist we might have had an easier classification but it's not unusual to have a pedestrian pushing a bicyclist and we can all come up with different scenarios that may be challenging and not a traditional pedestrian scenario. But these systems should be able to detect that and properly account for them. We also know through our investigation that this automated driving system gave greater dependence on the objects on the classification to determine the object's direction of travel than on the previous position. So like I said with those red dots if we had tracked the history we would have seen oh it's traveling across my path and it's going to be in my way no matter what object it is. But because of how this ADS system was programmed it gave a new path every time it got a new classification and so that made it much more challenging for it to predict. The system programming also did not have a pedestrian classification for a person crossing the road outside of a marked crosswalk. So you think this is absolutely crazy because as we all know many pedestrians do not cross at an assigned crosswalk. But we know after this investigation that had this pedestrian been pushing the bicycle in the crosswalk it would have been detected as a pedestrian and the crossing path would have been immediately identified. Of course these things have been fixed after the fact but these are some of the challenges with a test system in that decisions are made for various reasons and there may be errors in some of the assumptions that are made. And then finally the emergency braking. Had emergency braking been activated at that 1.3 seconds we would have had a significant decrease in the speed and likely that would have increased our time to collision giving the driver in the vehicle time to steer but also giving the pedestrian time to clear the path of the roadway because you saw that they were almost across the roadway at that time. So because we had the emergency braking delayed due to the potential for false positives and the idea that our driver who had been monitoring this automated system for a long time would have been engaged and available at that moment that they were needed was another failure of this system. So the last example that I want to talk about today is a very minor crash that occurred in Las Vegas Nevada involving a Navia autonomous shuttle. So you can see the shuttle on the right hand side here. This is a small shuttle. There's an operator or an attendant on board. It's a low speed shuttle about 20 miles per hour. It doesn't have traditional vehicle controls and you can see that it's actually controlled by like an xbox controller that's in the lower left hand side there. This xbox controller though is stored away so that's a little bit different than what the exemption that Navia got said. The exemption required that the controller be available to the attendant to use at all times but this controller was used infrequently and again stored away. The interior here you can see there's seatbelts for our occupants. This vehicle is being operated on a level four type of environment where it's just operating in a limited area in north Las Vegas as kind of an example of autonomous vehicle driving so people can hop on and off on a given route. There's a huge amount of sensors on this vehicle to detect the environment around it. Unfortunately though on its first day of operation it had a crash and so I'll talk you through this overhead view here. So our Navia shuttle is represented by the yellow arrows and so it had just made a right turn onto south sixth street and it immediately detected a truck which you can see in white. So the trailer's a big white rectangle and then you the truck tractor is in front of it there. So this truck was actually in the process of backing up into an alley. The system the ADS system on the shuttle bus was designed to stop three meters away from any obstacle in its path so as soon as it detected this truck it began to decelerate. Unfortunately though the perception system doesn't necessarily recognize that the truck is backing up. So when the shuttle is about 10 feet away from the truck it is almost at a complete stop but at that point the attendant on board recognizes that the truck doesn't see them and is still backing up and the shuttle is still moving forward so he hits the emergency stop button which is a big red button on the side. The shuttle stopped but the truck still continued backing up. It did not see the shuttle. We can all kind of envision this this scenario here and there was an impact with the right front tire that impacted the shuttle and actually this is this is the band-aid that Navia put on it. Keolis and Navia put on it after the crash so very very minor but interesting from the perspective of how does the ADS system perceive its environment and recognize other hazards and how does it react along the lines of how does the attendant then take control if necessary when there is a hazard in its path. And so what we know from this case some of our takeaways from this case is that we had both prediction problems even in a low speed operation. We knew that in that operation the system couldn't accurately predict the truck's path that it was reversing so it did take action to slow and eventually almost come to a stop but it still wasn't able to predict accurately where the truck was going. So problems with the path prediction and also operational errors. I mentioned that there was an exemption in the federal motor vehicle safety standards and exemption for those federal motor vehicle safety standards specified that the controls would be easily accessible to the operator or attendant which they were not in this case. So we see these issues being recurrent in the partial automation or those level two types of crashes where there are perceptual limitations with these systems. They can't see certain things that a human operator would be able to see and and perceive and then recognize the hazard whether it's a crossing tractor trailer or movement into the gore area or in the case of the the tractor trailer backing up anticipating that it's going to continue to back up to go into this alleyway. We've known for a long long time that human drivers are poor monitors of automation. That's what we're also seeing in these crashes that they're misinterpreting how much how effective these systems are how good these systems are and in the case of our driver in Tempe our our operator in Tempe that operator was was using a cell phone to watch a show. So not monitoring the automation in the way that was intended by Uber ATG. So there's failure this this combination of the failure and partial automation and the inattentive driver puts us at risk and of course that's where NTSB gets involved when we have these types of crashes. So then there's still some questions of safety versus convenience. So some of these systems some of the earlier systems that I was talking about those level zero automatic emergency braking the systems that will stop us from having a crash purely safety focused some of these other systems it's still in question whether it's a convenience or a safety and of course then there's also the question of who are we talking about as being the driver or the operator because humans are excellent when they are not impaired not distracted when they're fully engaged in the driving task to be able to detect and classify and understand what may be happening around them but obviously we know that's not necessarily all the drivers that are on our roads today. So NTSB has a number of recommendations addressing these partial automation crashes improving monitoring monitoring of driver engagement and then limiting the operational design domain of these vehicles to what it was designed for. If we talk about issues in the developmental ADS or automated driving system crashes we know that the testing is going to contain errors and expose some of the system limitations and we talked about some of those todays with machine perception and human attention. We know that these ADS development and operator oversights need to address risk management. They need to implement safety redundancies as well. And through this process of testing, we have to have a holistic view of the risks and the safety envelope that we're operating within and take that into consideration. Now, this is always kind of added on there. NTSB does not instruct developers in how to build an AV. We identify the risks and then issue recommendations that we think can shore up some of these systems. Ultimately, the safety goal, how to mitigate the expected risk of testing on the public roads. And I think at this point, I'll turn it back over to Dr. Waters to sum up our presentation. Thank you, Dr. Polan. Yeah, and Dr. Polan actually brought up a few issues, obviously, from the occupational medicine side, starting with Mountain View and just thinking sort of not even related to autonomous vehicles is what about the lithium batteries and the notice for firefighters in terms of putting them out? So that's obviously been one of the issues that we have addressed and have tried to address in terms of firefighter safety. Mountain View also brings to mind issues related to highway design and the attenuators, but one can also think about highway construction workers, for example. We've all been on tracks like, which way am I supposed to be going? And you realize that you potentially can endanger some of the highway construction workers on these sites if you can't easily transition from the automation back to the driver so that they can take control, you know, do the appropriate speeds, recognize what the hazards are, recognize the difference lanes. And that's a bit to go with in terms of having those AB work up to those standards in terms of highway construction safety. As Dr. Pollan also pointed out that, you know, with the early, the base level, the lower level autonomous vehicles, the human is essential part of that. And so with that, in terms of for commercial drivers, you'd say, well, they have still have the issues what we need to address. We always do with your getting your certification exams, you know, what kind of medical conditions you're worried about, what kind of medications they're taking. We address fatigue a bit with looking at obstructive sleep apnea. And, you know, you can sort of have some objective findings where you feel that some people are at higher risk than others in terms of evaluating them. But some of the automation complacency is a challenge. How do you recognize which people might be more likely to be a little bit more complacent? Do you do more training of people? Or do you have to try to do more engineering controls to make sure that, you know, like the steering wheel torque that was mentioned, so that you really bring people back into focus on that. So issues to be addressed, but probably because the human is always considered it's, you know, these are just assistance devices that the human is probably follows more into the umbrella that we're used to. The L4, L5 brings up some other more interesting occupational issues and also concerns. So yes, you have the other features that we mentioned before in terms of recognition, but what has actually very timely in terms of this presentation, about a month ago, the Federal Motor Carrier and Motor Safety Carrier Administration put out its supplemental notice of proposed rulemaking. And they're trying to get input from professionals such as yourselves in terms of, well, with this new technology, what do we have to do when you don't have a driver? How do we regard the remote assistance? They, I say supplemental in this recent notice, because there was one in 2018. So they were trying to be on the edge of what shall we do with our commercial drivers, as well as some other issues. I believe ACOM did actually respond to that one. And essentially, you know, to me, the bottom line summation I saw from the ACOM response was that, yeah, you know what, we're going to treat them just the same as drivers. So in terms of looking at fatigue management, medication use, the hours of service should be the same, drug and alcohol testing, and physical qualification should still be in that umbrella. Now, perhaps for physical qualification, something to think about is if you're only working from a desk, perhaps some of the physical tasks involved in being a truck driver, such as helping with unloading and those kind of aspects fall away side. But this is actually in terms of actually controlling them from particularly, not necessarily even on site. But that brings into point the final one in terms of what other limitations do you place on working conditions? Now, what is a saturation point in terms of looking at how many vehicles can you be simultaneously monitoring correctly? What if you find one vehicle is having some issues? Do you have fallback people to actually then monitor the remaining fleet that you're dealing with? So many issues sort of to address on that plane. Again, you want to stay at the front of some of this technology in terms of anticipating some of the problems that you may have. And as I said, I think ACOM has been quite the leader in terms of looking at some of these points, and I hope you continue to do so. And we support efforts to do anything to improve safety on all fronts on these points. So I think with that, we'll take questions. I don't know, I think there might have been a couple in the Q&A section. Yes, we definitely got a few questions coming in. So our first question says, in light of the fatal injury due to autopilot and must continue to promote its autopilot feature to consumers, why has Tesla not been held accountable yet? I can take that one, Dr. Waters, if that's OK with you. I appreciate that. Yeah, so OK, so the NTSB, Dr. Waters talked about this. The NTSB is an independent agency. I think it's important to note that we actually don't have any regulatory or enforcement authority. We issue recommendations. We can't force people to do the recommendations. So it's actually NHTSA who has that enforcement capability. And actually, part of what NHTSA is doing right now is they're looking at several investigations into Tesla crashes into emergency vehicles. So like fire trucks, like the picture that I showed. They're looking at those to see if that is, in defects investigation world, they look to see if that is a known hazard, how that system performs to then determine whether there should be a recall on how that system is performing. And I believe last week NHTSA put out some information on what they, NHTSA terms of recall, Tesla terms and over their update to change how their performance, how their automated driving system performance is working. So that I believe, I don't have all the details, but I believe that was focused on the fully self-driving vehicles. So I don't know if I touched on all the points there in that question. Is there a follow up on that one or did I cover it? I think you covered everything on that question. Next question says, what challenges should first responders expect when attempting rescue of passengers involved in an automated vehicle crash? Okay, so I think obviously they're all the same ones that they would normally have for a crash vehicle. The other things to think about with an automated vehicle is if there is somebody else that may be giving information on the vehicle. So if you have a remote operator for some of these vehicles, you may be communicating with somebody that's not in the car. So it may be that as you approach a vehicle, you'll hear a remote operator saying, I know this car has crashed and here's some information that's provided. So that may be surprising. I think the other thing to think about is what's powering that vehicle. So some of our automated vehicles that are in the test environment are going to be electric vehicles or maybe even powered by some other alternative fuels. And so usually those vehicles are marked in the NTSB crashes because they were catastrophic crashes. The intrusion compromised the battery system and that's where we were having those high voltage lithium ion battery fires. So I think awareness of the types of vehicles looking at the markings that are on the vehicles. If a vehicle's in test, it usually has markings of like what type of vehicle or what type of test environment that is. That said, there's also training that a lot of these companies are doing for first responders. So taking that training and then sharing the training with your peers. Sometimes we're seeing that there may be just one person that gets trained on a specific aspect, whether it's alternative fueled vehicles, and then the information isn't disseminated throughout the entire emergency responder community or that office. So take the training that's offered. A lot of it's free. GM is offering some of this type of training. Others are offering some of this type of training. So take the training and share it with your peers. Excellent. And that's actually a great segue into this question. What are the risks, i.e. specific airborne chemical exposures to firefighters and bystanders from fires of electric vehicle batteries? Okay. So I don't have all of the details, but what I would say is I'm going to refer the emergency responders to the emergency response guide for each vehicle. So that can be obtained from NFPA, National Fire Protection Association. They list all of the emergency response guides for these vehicles. You can also get it from the manufacturer if you Google the manufacturer in ERG or emergency response guide. That will tell you what types of equipment you need to use to safely approach that, whether it's some sort of breathing device or how to put out a fire or how to, if it's not damaged in a certain way, how to cut the appropriate cut lines so that you don't have high voltage going through the vehicle in certain areas. So again, emergency response guide is going to be your source for that information, and that's provided by the manufacturer. So of course they know exactly how their vehicle is designed. How did the truck backing up have damage to the front fender? It doesn't look like the point of impact. Yeah. So the truck was actually backing up into the alley. So it was backing up. So its back end was going to the left side of the screen. Sorry if I didn't make that clear in my presentation. So by the time it had almost negotiated the whole turn, except the front end of the tractor was then swinging back around and it hit the front of the shuttle bus. So it wasn't just backing up direct street. And if it were, then of course the trailer would have hit the front of the shuttle. Is there evidence that level zero systems decrease accident risks? If yes, are some level zero systems more effective than other? Yeah, so that's a great question. So there is research out there looking at automatic emergency braking and the effectiveness of automatic emergency braking for the passenger car fleet. So NTSB has actually issued some recommendations that we believe NHTSA should be evaluating these to compare them one next to another. But if you look at NHTSA's crash testing, kind of their star rating system that you may see when you're buying a car, it will basically tell you whether the system is equipped or not. Does it have forward collision avoidance, which would be the automatic emergency braking or not? It doesn't tell you whether that system is better than another one. The Insurance Institute for Highway Safety, IIHS, is doing some of this testing as well as Consumer Reports is doing some of this testing to see how these systems are performing compared to each other, but also in maybe some more challenging environments. So at darkness. So if it's dark out, how well do these systems detect other vehicles in front? And then also equally important is how well do these systems detect pedestrians or crossing traffic or other hazards that you would have on the roadway that can result in fatal crashes, just like an impact into the rear of another vehicle. So there are sources of information out there, but right now you have to do a bit more work, which is one of the reasons why NTSB has made the recommendations we have, because we think it should be more transparent to the consumer which systems are functioning well. And we also think, of course, that will drive the manufacturers. It'll incentivize the manufacturers to improve their systems continuously. And that's a good segue into this question. What are the rates of accidents per miles driven comparing autonomous and driven vehicles? That's another recommendation NTSB has. So I can't say that anybody has that answer because it's not tracked that way. There's not a reporting of how often vehicles are, how many miles traveled while a vehicle is operating with, say, ADAS, Advanced Driver Assistance System, or even the ADS system. So you'll see that there's some questions. NHTSA has some requests for comments out, even for some of their exemptions. So I think GM Cruise and Ford maybe put in for an exemption to some of the Federal Motor Vehicle Safety Standards. And NHTSA put out some questions to say, should they be asking for this information? Should they be asking for vehicle miles traveled while on ADS or while on operating as an ADAS? But right now, that information isn't available. Dr. Waters, which personal checklist have you come across which would assess a person's risk factors preceding or leading up to the accident, such as the I'm safe in a general aviation industry? I guess I'm not quite sure about the question in terms of the checklist. If you're asking me how I do the evaluation, again, unfortunately, we usually start out with an autopsy. So we're going back. We're doing things retrospectively. So it is really looking at the combination of things we know that could potentially impair someone, again, from the whole list of impairment things, whether it's the easiest, of course, from some of those points is the anatomical structure and function. We find out the medical conditions. We find out the medications they may be using. We have the toxicology results to help support that. And then we use supporting information from interviews and other material to help us get to that point. So I said, I really don't have a checklist other than you end up having the whole gamut of things available to you. Sometimes there's pieces missing that we never get a hold of. So you end up having more questions. But that's essentially the sort of the process without actually having a specific checklist that I have created. We've got about three minutes left and two questions. So hopefully we can get to these last two. Automation is already used in some other modes like rail. Have there been issues seen or lessons learned in other modes that could be relevant here? Are you seeing similar challenges in this area across modes? I answer one part of that, Chris. I know, of course, I'm sure you can weigh in as well. I think the biggest challenge we found is sometimes both in rail and truly sometimes truly sometimes in the air traffic controllers is that you have the accident on the ground so far removed from the actual controlling part of it or potentially the controlling part that we don't find that occasionally you do not have testing of some of the like say drug post-accident drug testing or an assessment of the remote control operators. I think that's the biggest gap that I have seen in some of our investigations is that you might not recognize the role those people have in terms of the accident causation. So you never end up having that perishable material is gone. I mean, you take someone's drug test a week later and it's like, what's the value? So that's what I would say is probably the challenge I have with looking at those systems in terms of being able to support how much any given operator does. I actually don't have those numbers. Chris, perhaps you can speak a little bit more to some of the things you may have come across. Yeah, I can think of a couple quick examples just in terms of the time. The Asiana Airlines crash was one where there was some pilot misunderstanding of the automation that was happening while landing in San Francisco. I think that crash happened in 2013. That's one that people can look up. And then there was a WMATA, that's the Washington DC Metro system, Fort Totten crash. That was a case where there was kind of an automated system to detect where trains were and it was flickering on and off. And so we had one train crash into the back of another train because the train disappeared, essentially. So the sensor system failed to say there's a train there. And so the train behind it thought it was free and clear. So there are some examples, but there's also a lot of lessons learned where there's been a lot of successes as well for automation and how that can assist. But really understanding how the automation is assisting either the pilot or the rail operator is critical. And I think that's some of the same challenges that we're seeing in highway, making sure that those people understand. And of course, the environment is different. You have a highly trained pilot, highly trained rail operators may be different than the general public that may purchase a level two type of vehicle and not understand the limitations. Excellent. So we are going to wrap up our presentation today. So bear with me one second. It's over. We thank you so much for sharing your knowledge in our question and answer. That was just great. Hearing those questions, very in-depth, very detailed questions and your answers and the examples that you provided. Truly, thank you. Any updates on future webinars, please visit ACOM.org slash webinars. I do want to remind everybody that the American Occupational Health Conference is coming up April 16th through 19th in Philadelphia. Hard to believe we are almost done with February. So it's just around the corner. Last but not least, thank you so much to Dr. Pollin and Dr. Waters today for sharing your knowledge with us, taking time out of your busy schedules, answering all of our questions. We truly appreciate both of you being here with us today and to all of our learners. As a reminder, within the next 24 hours, if you attended the presentation live, you will receive a link to the archive presentation, the handouts and evaluation, and then your CME credit. We do thank everyone for joining us today. We wish everybody all the best. Please stay safe out there. Thank you so much, everybody. Thank you. Bye.

vehicle autonomy

NTSB

automated vehicles

Tesla autopilot system

automated vehicle crashes

first responders

electric vehicle battery fires

accidents per miles driven

driver monitoring

risk management