1 
  Outline of the Safety Regulations for Motor Vehicles 
Equipped with Automated Driving System (Draft) 
1. Outline of Revision 
(1) Safety Regulations 
The following and other required revisions are proposed. 
 (Related to the Safety Regulations for motor vehicles) 
 ① Automated driving system 
 <Outline of the safety regulations to be stipulated> 
 During the operation of the automated driving system, it shall not interfere with the safety of 
passengers and other road users. 
 In the event that the Operational Design Domain (ODD) gets to be unsatisfied during the 
operation of the automated driving system, in principle, a warning that prompts the driver to 
take over the driving operation shall be provided with sufficient time in advance. Safe driving 
shall be continued until the driver has taken over the dynamic driving task, and Minimum Risk 
Manoeuver shall start and finally stop safely if the driver does not take over. 
 When there is a possibility of collision with other traffic or obstacles, braking to avoid collision 
or to reduce damage at the time of collision to the maximum shall be activated. 
 It can be activated and deactivated by the driver's willing operation. 
 If the ODD is not satisfied, or if any failure affecting the safe operation or the functionality of 
the system is present, the system shall not become active. 
 Any failure affecting the operation of the system shall be indicated to the driver with an optical 
signal. 
 The system status shall be indicated to the driver. 
 The system shall detect if the driver is available and in an appropriate driving position to 
respond to a transition demand by monitoring the driver. As soon as the system has assessed 
the driver to no longer be available, the system shall provide a distinctive warning. 
 Automated driving system shall be functionally designed with redundancy. (The fulfilment of 
this provision shall be demonstrated by the manufacturer to the technical service during the 
inspection of the safety approach as part of the assessment on [complex electronic vehicle 
control systems (CEL)]) 
 
* In addition to the above provisions, especially for vehicles equipped with ”Automated Lane 
Keeping System (ALKS)” which works in low speed on expressway, that are expected to be put 
to practical use at an early stage, the detailed technical requirements for lane keeping and 
vehicle distance keeping are specified separately under this safety regulation. 
 
 
 
 2 
  ② DSSAD (Data Storage System for Automated Driving vehicles) 
  <Outline of the regulations to be stipulated> 
DSSAD shall store following information: 
 Time stamped switches of the Automated Driving System (ADS) from a status to 
another status 
 Time stamped Transition Demand by the ADS 
 Nature of the cause of Transition Demand by the ADS 
 Time stamped Minimum Risk Maneuver engagement by the ADS 
 Time stamped Override through steering, brake, and accelerator control by the driver  
DSSAD shall be able to store a minimum of X thousands (to be determined correspond to 
period of 6 months of use) timestamped significant interactions or cover a minimum period of 6 
months of use, whichever is achieved first1 
 
 ③ Cyber security 
  <Scope of the regulations> 
   Vehicles equipped with automated driving system 
  <Outline of the regulations to be stipulated> 
   (Requirements for vehicle types) 
 The vehicle manufacturer shall demonstrate to the satisfaction of the Approval 
Authority or Technical Service the risk assessment for the vehicle type and how the 
risks have been treated/managed. The risk assessment shall consider the systems of 
the vehicle type and their interactions. The risk assessment shall further consider 
interactions with any external system. 
 The vehicle manufacturer shall describe what testing has been performed and the 
outcome of those tests. 
(Requirements for the Cyber Security Management System) 
* This requirement will be specified separately under this safety regulation. 
 The vehicle manufacturer shall demonstrate to an Approval Authority or Technical 
Service that their Cyber Security Management System considers the following 
phases: 
- Development phase; 
- Production phase; 
- Post-production phase. 
 The vehicle manufacturer shall demonstrate that their Cyber Security Management 
System considers the following processes to ensure security: 
 The processes used within the manufacturer’s organization to manage cyber 
security  
                                                   
1 This requirement is being discussed under the WP.29, and would be made consistent with 
the commonly recognized requirement in the discussions. 3 
  The processes used for the identification of risks to vehicle types 
 The processes used for the assessment, categorization and treatment of the 
risks identified  
 The processes in place to verify that the risks identified are appropriately 
managed  
 The processes used for testing the cyber security of a vehicle type  
 The processes used for ensuring that the risk assessment is kept current  
 The processes used to monitor for, detect and respond to cyber-attacks, cyber 
threats and vulnerabilities on vehicle types and the processes used to assess 
whether the cyber security measures implemented are still effective in the light 
of new cyber threats and vulnerabilities that have been identified 
 The vehicle manufacturer shall be required to demonstrate that contracted suppliers, 
service providers or manufacturer’s sub-organizations consider processes listed 
above. 
 
 ④ Software updates  
  <Scope of the regulations> 
   Vehicles equipped with automated driving system 
  <Outline of the regulations to be stipulated> 
  (Requirements for vehicle types)  
 The authenticity and integrity of software updates shall be protected to reasonably 
prevent their compromise and reasonably prevent invalid updates. 
 Where a vehicle type uses RXSWIN: 
 Each RXSWIN shall be uniquely identifiable. When type approval relevant 
software is modified by the vehicle manufacturer, the RXSWIN shall be updated 
if it leads to a type approval extension or to a new type approval. 
 Each RXSWIN shall be easily readable in a standardized way via the use of an 
electronic communication interface, at least by the standard interface (OBD 
port). 
If RXSWINs are not held on the vehicle, the manufacturer shall declare the 
software version(s) of the vehicle or single ECUs with the connection to the 
relevant type approvals to the Approval Authority. This declaration shall be 
updated each time the declared software version(s) is updated. In this case, the 
software version(s) shall be easily readable in a standardized way via the use 
of an electronic communication interface, at least by the standard interface 
(OBD port). 
 The vehicle manufacturer shall protect the RXSWINs and/or software 
version(s) on a vehicle against unauthorised modification. At the time of Type 
Approval, the means implemented to protect against unauthorized modification 4 
 of the RXSWIN and/or software version(s) chosen by the vehicle manufacturer 
shall be confidentially provided. 
 Additional Requirements for over the air updates: 
 The vehicle manufacturer shall ensure that the vehicle is able to restore 
systems to their previous version in case of a failed or interrupted update or 
that the vehicle can be placed into a safe state after a failed or interrupted 
update. 
 The vehicle manufacturer shall ensure that software updates can only be 
executed when the vehicle has enough power to complete the update process 
(including that needed for a possible recovery to the previous version or for the 
vehicle to be placed into a safe state). 
 When the execution of an update may affect the safety of the vehicle, the 
vehicle manufacturer shall demonstrate how the update will be executed safely. 
This shall be achieved through technical means that ensure the vehicle is in a 
state where the update can be executed safely. 
 In the situation where the execution of an update whilst driving may not be 
safe, the vehicle manufacturer shall demonstrate how they will: 
・Ensure the vehicle cannot be driven during the execution of the update 
・Ensure that the driver is not able to use any functionality of the vehicle that  
would affect the safety of the vehicle or the successful execution of the  
update 
 The vehicle manufacturer shall demonstrate that the vehicle user is able to be 
informed about an update before the update is executed. The information made 
available shall contain  
・The purpose of the update. 
・Any changes implemented by the update on vehicle functions  
・The expected time to complete execution of the update 
・Any vehicle functionalities which may not be available during the execution of  
the update  
        ・Any instructions that may help the vehicle user safely execute the update  
 After the execution of an update the vehicle manufacturer shall demonstrate 
how the following will be implemented. 
・The vehicle user is able to be informed of the success (or failure) of the 
update 
・The vehicle user is able to be informed about the changes implemented and 
any related updates to the user manual (if applicable). 
 
 
 5 
   ⑤ Mitigation of the regulations 
 Currently, when conducting verification tests on vehicles equipped with automated driving 
system, based on the Article 55 of the Safety Regulations for motor vehicles, it is possible to 
exempt some requirements of the regulations related to control devices, steering devices, etc. 
with the approval by the Director of the District Transport Bureaus, subject to taking safety 
measures such as limiting driving routes and speed limits. The MLIT proposes that this 
exemption measure will be applied to cases other than verification tests. In addition, an 
exemption measure will be applied to motorized bicycles in the case of verification tests. 
 
(2) Provision of Operational Design Domain (ODD) 
<Outline of the procedure for grant of ODD> 
An applicant for grant of ODD shall submit an application including the "ODD to be granted" 
and present the subject vehicle to the Minister of Land, Infrastructure, Transport and Tourism. 
<Requirements for ODD>  
   ODD shall be set in terms of the following categories: 
 Infrastructural conditions and geographical conditions 
 Environmental conditions, 
 Driving conditions, and 
 Conditions, other than above, provided by the Minister of Land, Infrastructure, 
Transport and Tourism 
ODD shall be: 
 Appropriate conditions such as not violating laws and regulations stipulating traveling 
speed limit 
 Conditions which can usually be foreseen and are clear 
 Conditions in which the automated driving system shall conform to the regulations set 
forth in the Safety Regulations for motor vehicles  
<Description of vehicle inspection certificate> 
Vehicles with the automated driving system may be described in their vehicle 
inspection certificates. 
 
2. Schedule 
  Issue: March, 2020 
Enforcement: Date of enforcement of Article 2 of the revised Road Vehicle Act