TUSIMPLE SAFETY REPORTVERSION 2.0

TABLE OF CONTENTS

TUSIMPLE SAFETY REPORTCONTENTS
CHAPTER 1

INTRODUCTION				CHAPTER 2

ELEMENTS OF SAFETY		Appendix

4

Our Mission							12 System Safety 						32 Glossary

5

About Us								14 Operational Design Domain33 End Notes

7

Safety and Workforce Issues Facing the Trucking Industry

15 Object and Event Detection and Response

8Landscape for Autonomous Trucks				

16 Fallback (Minimal Risk Condition)

9

Our Autonomous System					17 Validation Methods
21 Human Machine Interface
22 Vehicle Cybersecurity
23 Crashworthiness
24 Post-Crash ADS Behavior
25 Law Enforcement Liaison Program
26 Combating Human Trafficking
27 Data Recording
28 Consumer Education and Training
29 TuSimple In the News 
31 Federal, Local, and State Laws
2

CHAPTER 1
INTRODUCTION

OUR MISSION
Increase Safety					Decrease Transportation Costs					Reduce Carbon Emissions

CHAPTER 1 INTRODUCTION

TUSIMPLE SAFETY REPORTABOUT USTuSimple is an autonomous driving technology company headquarteredin San Diego, and operates a fleet of autonomous trucks out of Tucson,
Arizona and Dallas, Texas. Founded in 2015, TuSimple is developing acommercial-ready Level 4 (SAE) fully autonomous driving solution for
long-haul heavy-duty trucks. For more information, please visit www.
tusimple.com, and follow us on Twitter, YouTube, and LinkedIn. To learn
more about AV testing around the United States and TuSimple pleasecheck out AV TEST Initiative.
TuSimple aims to transform the $800 billion U.S. trucking industry byenhancing safety, increasing efficiency, and significantly reducing
operating costs. Today, TuSimple operates a fleet of 50 autonomous
trucks on the TuSimple Autonomous Freight Network.

5

CHAPTER 1 INTRODUCTIONABOUT USTUSIMPLE SAFETY REPORT

Company History
SEP 2015

Founded with headquarters in San Diego, CA.

SEP 2016

Awarded ten world records for autonomous driving on the Karlsruhe Institute of Technology and Toyota Technological Institute (KITTI)
and Cityscapes public datasets.

AUG 2017

Opened testing and development facility in Tucson, AZ and began testing the TuSimple Autonomous Driving System (TADS) between
Tucson, AZ and Phoenix, AZ.

FEB 2018

Expanded to a new 50,000 sq ft production facility in Tucson, AZ to house our truck fleet.

AUG 2018

Began hub-to-hub autonomous hauling for customers in Tucson, AZ.

DEC 2019

University of California San Diego study found TuSimple trucks at least 10% more fuel efficient than traditional trucks.

JUL 2020

Strategically partnered with Navistar and ZF to co-develop SAE Level 4 autonomous semi-trucks targeted for production by 2024.

JUL 2020

Launched the Autonomous Freight Network, an ecosystem consisting of autonomous trucks, digital mapped routes, strategicallyplaced terminals, and TuSimple Connect, a cloud-based autonomous operations oversight system.

SEP 2020

Entered into a global partnership with TRATON GROUP to develop program to operate the first SAE level 4 autonomous hub-to-hub
route between Södertälje to Jönköping in Sweden using Scania trucks.

NOV 2020

Designed initial wear studies with strategic partner, The Goodyear Tire & Rubber Company, to understand how autonomous trucks
and tires can help predict better maintenance, understand tire longevity, and reduce the fleet carbon impact.

6

CHAPTER 1 INTRODUCTION

TUSIMPLE SAFETY REPORTSAFETY AND WORKFORCEISSUES FACING THE
TRUCKING INDUSTRY

TuSimple’s autonomous driving technology can help improve safety
and address the driver shortage.

The average age of truck drivers in North America is 46-50
years.

The truck driver shortage is projected to reach 105,000 by
2023; 160,000 by 2028.

During the third quarter of 2020 there was a 74% driver
turnover rate at small carriers and 92% turnover rate atlarge carriers.

On average, there have been 3,743 fatal crashes and over
80,000 injury crashes per year involving large trucks since
2010.

More than 50,000 drivers were disqualified by the Drug andAlcohol Clearinghouse in 2020.

On average, there have been over 290,000 property
damage only crashes per year involving large trucks since2010.

In 2020, 100,000 fewer commercial driver’s licenses (CDLs)
were issued than prior years due to CDL school and licensebranch closures.

At least 1 driver-related factor was recorded for all fatal
crashes involving large trucks in 2018.

7

CHAPTER 1 INTRODUCTION

TUSIMPLE SAFETY REPORTLANDSCAPE FORAUTONOMOUSTRUCKS
Long-haul trucking, generally recognized as routes requiring goods

As this past year has shown us the vulnerabilities across our supply

to be delivered further than 250 miles from the truck’s origin, is anchains, we are optimistic about the opportunity for autonomous

essential and significant portion of the U.S. economy and is facing atrucking to help our food system become more robust and sustainable.

number of safety and economic issues.

About 30-40%2 of our food supply goes to waste with spoilage being
one of the top reasons3. Additionally, food represents about 26% of

1.
2.

3.

https://www.pima.edu/news/pressreleases/2019/201906-tu-simple.html

TuSimple believes that our autonomous driving solution can help the

global greenhouse (GGH) emissions4. It is startling to see how foodindustry mitigate or eliminate some of the most pressing issues inwaste unnecessarily contributes to global warming. By providing

trucking, such as driver retention and shortage, vehicle parking, traffic

increased freight capacity and reduced transportation times, we arecongestion and safety, while maintaining the cost and convenience

excited about our role in helping America tackle its climate and foodadvantages the trucking industry relies on to be America’s preferredwaste challenges.

https://www.usda.gov/foodwaste/
faqs#:~:text=In%20the%20United%20States%2C%20
food,percent%20of%20the%20food%20supply.

freight movement method.

https://www.rts.com/resources/guides/foodwaste-america/#:~:text=The%20facts%3A%20
How%20much%20food%20is%20wasted%20
in%20America&text=That’s%2080%20billion%20
pounds%20of,up%20space%20inside%20US%20
landfills.

We are proud to spearhead efforts to understand how autonomy will4.

https://ourworldindata.org/food-ghg-emissions

5.

https://www.trucking.org/economics-and-industrydata#:~:text=11.84%20billion%20tons%20of%20
freight,of%20total%20domestic%20tonnage%20
shipped.

6.

https://www.refrigeratedtransporter.com/carriers/
article/21721717/freight-forecast-projects-continued-growth-for-trucking

7.

https://www.dcvelocity.com/articles/46119-studytruck-driver-pay-is-on-the-rise#:~:text=ATA%20
says%20its%20study%20shows,solo%20van%20
drivers%2C%20ATA%20said.

GROWING FREIGHT DEMAND AND INCREASING COSTS5•

be a net-add to our communities. Not only have we concluded that
autonomous trucks can benefit drivers, but we have also invested

Nearly 72.5% of domestic freight tonnage in the U.S. was moved
by truck in 2019.

•

resources to prepare drivers for a career in this budding industry. We

The annual shipping tonnage in America requires over 3.91 million
Class 8 trucks and over 3.6 million truck drivers in 2019.

have recently partnered with Pima Community College1 to create an•

Freight volumes are projected to increase 35.6% from 2018 to 2029.6

education program that equips truck drivers with the skills needed to•Total tonnage may reach ~21.7 billion tons by 2029.

be successful in the autonomous trucking industry. Our students will•

The mean compensation for truck drivers in 2019 grew by 11.5% tobe prepared for new jobs such as training the autonomous system as$58,000 compared to 2017 levels.7

test drivers, operating the vehicle in situations where autonomous
driving is not suitable and to remotely monitor the system from acommand center. We are proud that eight students have completed
the course so far and are on track to be certified for employment.
8

CHAPTER 1 INTRODUCTION

TUSIMPLE SAFETY REPORTOUR
AUTONOMOUS
SYSTEM
TuSimple believes in using cutting edge perception technology to

and detection at medium- and short-range, while our radar sensors

develop the world’s safest autonomous truck. We’re building a full-offer tertiary perception and detection at medium- and short-range.

stack solution and enabling autonomous trucks to improve shipping

HD MAP

times for goods and materials and to make highways safer and less

Large trucks, like the Class-8 trucks our system is designed for andcongested. Our system uses an array of perception and localization

used on, require significantly more stopping distance and time thansensors and data along with our proprietary deep-learning detection

passenger vehicles. At 65 MPH, we believe a large truck perception

algorithms to detect and track objects in real time and make pixel-levelsystem requires 300 to 500 meters of perception range, whereinterpretations within the field of vision. With this technology, a truck

perception means reliable detection, classification, localization, andcan achieve a decimeter-level of positioning accuracy — even whentracking. Because a combined and integrated sensor suite that cannot

in a tunnel or under a bridge.

reliably perceive the critical 300- to 500-meter range is not sufficient
for a heavy vehicle traveling at highway speeds, we have designed our

PLANNING
LOCALIZATION

Using our sensor array and deep-learning algorithms, our proprietary

sensor array to perceive at a much larger distance of 1,000 meters to

artificial intelligence (AI) decision-making system can guide vehicles

ensure reliable determination in the critical safety range and added

along a safe and fuel-efficient route based on terrain and real-time

efficiency. Our 1,000-meter perception range allows the autonomousroad conditions. Our solution has been purpose-built to provide a

software to make long-range, proactive, and strategic decisions torobust perception system, allowing the decision-making AI to act

improve safety and efficiency beyond what other systems can achieve.

with high confidence and detection reliability. Our camera-centric

PERCEPTIONCONTROL
PREDICTION

perception system operates more safely at highway speeds because

In addition to cutting-edge technology and advanced algorithms, it is

the sensor array is optimized for use on Class 8 tractors and provides

important that autonomous systems are designed, manufactured, andredundant secondary and tertiary perception, detection, and tracking

used in accordance with exceedingly high safety standards. That is why

data. To provide high confidence and reliable long-, medium-, and short-

we are building International Organization for Standardization (ISO)range perception, we use a variety of sensors that allow our system to26262 into every aspect of our system, hardware, software, purchasing,detect and track objects at distances of up to 1,000 meters. Our lightand production processes and are designing to meet the stringent

detection and ranging (LiDAR) sensors provide secondary perception

ISO/PAS 21448 SOTIF (safety of the intended function). In support of9CHAPTER 1 INTRODUCTION

TUSIMPLE SAFETY REPORTOUR
AUTONOMOUS
SYSTEMthese, we will be registered to International Automotive Task Force(IATF) 16949, the Automotive Quality Management System. IATF will
include the required documented supporting processes.
This Voluntary Safety Self-Assessment describes our safety processes
and features and the progress we’ve made implementing them. Oursafety assessment follows the U.S. Department of Transportation (DOT)
and National Highway Traffic Safety Administration (NHTSA) guidelines
laid out in Automated Driving Systems 2.0: A Vision for Safety and isorganized in two parts. In this first chapter, we introduced TuSimple,
our autonomous driving system, and our approach to safety. In thenext chapter, we address the 12 safety elements that the DOT and
NHTSA highlight in their guidelines.

10CHAPTER 2ELEMENTS OF SAFETY

CHAPTER 2 ELEMENTS OF SAFETY

TUSIMPLE SAFETY REPORTSYSTEM
SAFETYThe primary goal of our autonomous system is to reduce the danger
posed to humans around us. By removing the human operator fromour commercial product, we can eliminate errors such as those causedby driver fatigue or distraction. We also continue to evaluate theperformance of our system throughout the development and test cycle
to identify improvements which are then tested, verified, and included

FAIL

in software updates on all of our trucks. Unlike autonomous systems
that are designed for vehicles that carry passengers, our system will becapable of operating without human intervention. Because our system
SoftwareDevelopment

Software Release is tested through:
Unit tests & Simulation

Release is tested
on test track

will operate without occupants, our design is primarily concerned withthe safety of other drivers in its operational environment.

PASS

PASS

We understand the importance of using a System Safety approach toeliminate unreasonable safety risks and to mitigate risks that cannot

Safety Operators and Safety
Engineers are trained on therelease features and changes

Build moves to initialpublic road tests

be fully eliminated. We’ve incorporated well-established standards
and processes into the design of every element of our autonomous
system. We adhere to internationally recognized standards including
relevant standards, recommended practices and guidance from the

DEVELOPMENT AND TESTING CYCLE

DOT, aerospace, and military to inform the design, sourcing, verification,and validation of every element of the autonomous system. Following
the process outlined in ISO 26262 (Functional Safety – Road Vehicles),we begin by engaging in a requirements analysis to clearly develop theItem Definition. This becomes the basis for the Hazard Analysis and Risk
Assessment (HARA) to identify Safety Goals and assign Automotive
12

CHAPTER 2 ELEMENTS OF SAFETY

TUSIMPLE SAFETY REPORTSYSTEM
SAFETY
Automotive Safety Integrity Levels (ASIL) to every identified hazard andteams through detailed and rigorous fault-tree analysis, Failure Moderisk so that we can design, build, and implement mitigation, redundancy,

and Effects Analysis (FMEA), and all system testing and validation. For

and/or ASIL decomposition strategies that will avoid potential failure

more information about our specific testing and validation strategies

modes or mitigate the negative consequences of a potential failure.

and practices, refer to the Validation Methods section in this document.
TuSimple has a robust safety program regarding DOT compliance andIn addition, we are referencing additional state-of-the-art safety

public safety standards, TuSimple has taken the initiative to hire twostandards and guidelines, such as ISO 21448 Safety of The Intended

safety experts, a DOT expert and a retired law enforcement executive

Function, UL 4600 Standard for Evaluation of Autonomous Products,

who are Subject Matter Experts (SMEs) in their areas of expertise.

and industry research papers and studies from leading automotive
ISO 26262

IATF 16949

ISO/PAS 21488

Functional Safety – Road Vehicles

Automotive Quality Management Systemcompanies and academia with efforts to develop safety envelopes

DOT safety and compliance standards are overseen by a DOT expert.

around the development, testing, and deployment of machine learning

TuSimple is building pre-launch inspection protocols with the support

algorithms. Furthermore, we are implementing progressive safetyof third-party auditors that rise to the level of the commercial airline

methodologies used in aerospace and military to effectively analyze

standards and meet or exceed minimum inspection requirements set

the high level of complexity of our software, such as System Theoretic

forth by the Federal Motor Carrier Safety Administration (FMCSA), DOT

Process Analysis.

and Commercial Vehicle Safety Alliance (CVSA). All drivers have daily,
weekly, and monthly reviews of their performance, and any safety

Road Vehicles - Safety of the Intended Functionality

STANDARDS WE UTILIZE

Our Functional Safety and Quality team is led by safety experts withviolations are addressed quickly by our SMEs. TuSimple sets the bar

decades of experience in the automotive industry. This team is directly

higher than CVSA/FMCSA standards to ensure we are one of the safest

responsible for all safety-related issues and helps lead the engineering

fleets on the road.

13

CHAPTER 2 ELEMENTS OF SAFETY

TUSIMPLE SAFETY REPORTOPERATIONALDESIGNDOMAINWe are developing an automated driving solution for trucks that willstatements to define the limits under which the system is allowed

operate at SAE Level 4 (L4). An L4 autonomous vehicle is able to operate

to operate. ODDs must take into account road types and conditions,autonomously without a driver present only within a well-defined

weather, topographic features, speed limits, and traffic laws, and otheroperational design domain (ODD). Autonomous systems, much likejurisdictional regulations.

human drivers, have limitations that affect how well they perform ina variety of situations. The ODD for an L4 autonomous system defines

Our ODD definition includes highways and surface streets from depot

its operating limitations and excludes scenarios and situations forto depot during night and day and during inclement weather. It also

which an effective technical solution has not yet been validated. For

includes parameters for road types, geographic and topographic

instance, a system might not be able to meet performance requirements

features, speed limits, laws, and regulations. Our commercially deployedon snowy, high-grade, mountainous roads, so the system would notautonomous system is intended to operate under a variety of conditions

be authorized to operate in that domain. ODDs can be extremely

and will have an ODD that confines the system to previously mapped

broad (such as interstate highways in clear conditions) or extremelyroutes validated to the ODD.

narrow (such as a defined segment of a specific highway during certain
hours), but they must be specific and use clear and unambiguous

14

CHAPTER 2 ELEMENTS OF SAFETY

TUSIMPLE SAFETY REPORTOBJECT AND
EVENT DETECTION
AND RESPONSE
Every driver relies on their senses to perceive the world around them.

provide the time and space for a tractor trailer to safely and smoothly

They use the information acquired through their senses, along with theircomplete maneuvers. In addition to the high-integrity detection in theprevious experiences and knowledge, to predict the behavior of others

300- to 500-meter range that our sensor suite provides for safety aton and around the road and to make driving decisions. Autonomous

highway speeds, our 1,000-meter forward camera extends our system’ssystems are no different. Our autonomous system uses sensor solutions

range by an additional 500 meters, which allows our planning system

to perceive and determine a safe and appropriate vehicle command.

to make the safest and most efficient decision possible.

Our system detects, tracks, and predicts the behaviors of objects. Our
system tracks and resolves dynamic objects to ensure that they are

We collect massive amounts of real-world sensor data from our trucks

no longer associated with risks. Our autonomous system uses thesewhich we use to train the autonomous system to detect and classify

inputs to make appropriate driving decisions for the given situation.

objects it could encounter and to anticipate the behaviors of detected
objects. Our robust prediction system considers future actions of every

Our autonomous system is capable of identifying and tracking various

detected object in the environment. It assigns probabilities to eachstatic and dynamic objects it encounters. We use an array of sensors

potential action for each detected object and uses this set of predictions

including high definition cameras, LiDAR, radar, ultrasonic sensors, GPS,to choose and execute a trajectory that maximizes the probability ofinertial measurement units (IMUs), and audio sensors for long-distancea safe outcome. This allows us to have the safest possible course of

sensing in a high-speed environment under a variety of conditions. The

action available to the autonomous system, depending on the actions

distance penetration and clarity of our sensor solution is necessary toof other drivers and pedestrians and the surrounding infrastructure.

15

CHAPTER 2 ELEMENTS OF SAFETY

TUSIMPLE SAFETY REPORTFALLBACK(MINIMAL RISKCONDITION)
No automated driving system can be entirely free from faults, potential

internal system faults and external conditions to provide input to thefailures, or changes in conditions that might place it outside of its

Functional Safety module which will choose an appropriate Functional

operational design domain. Our automated driving system is designed

Safety response and, when necessary, perform appropriate actions

to identify and safely react to these events. To safely react to situations

to achieve an MRC ranging from logging an event for degradationthat limit the autonomous system’s capabilities or changes in roadway,

analysis through performing a safe emergency stop and park. With

weather, or other conditions outside the system’s operational design

fail-operational functionality, our system can determine whether todomain, the system must be able to detect the critical event or change

continue to operate under more restricted operational parametersin conditions and to perform a fallback, or minimal risk condition

or if it must stop operating immediately.

(MRC), maneuver in response. Our system constantly monitors thehealth of every safety-critical component and validates all data andWe’re building fault-tolerance and fail-operational capability into

timestamps through checks and redundancies to detect scenarios in

our autonomous system by using proven practices and frameworks

which an MRC maneuver is required.

developed for automotive, aerospace, and military applications toimprove the reliability and safety of our autonomous system. To

During the development phase, our automated driving system will

reduce the likelihood of system failure, we design for reliability, self-

recognize and attempt to perform most MRC maneuvers, but in somediagnostics, self-correction, and redundancy where necessary. We

cases the Safety Operator will be asked to assume control of the vehicle.

perform extensive testing to evaluate the reliability of every component

TuSimple’s Safety Operator program, which includes training, testing,of the system and implement 3-tier redundancy whenever possible.

continuous education, monitoring and strict policies, combined with theWe also perform fault analysis to develop a fault mitigation plan thatdesign of TuSimple’s development phase automated driving system,

covers the risks identified in our HARA. All safety mechanisms, faults,

help to ensure that this is a highly controllable disengagement ofand fault tolerances are validated as is required to meet our functional

the autonomous system. After the system is functionally complete,safety goals

automated MRC maneuvers have met functional safety goals, and thesystem has been validated, the Safety Operator will not be required.
Instead, our commercial-intent autonomous system will detect both
16

CHAPTER 2 ELEMENTS OF SAFETY

TUSIMPLE SAFETY REPORTVALIDATIONMETHODS
Throughout the system design process, we identify functionalteam of our Safety Operators and Safety Engineers. Whenever a new

performance requirements and the hazards and risks that could result

software release is made available to the TuSimple fleet, our Safety

from misbehaving functions. We perform a full Design Verification

Operators and Safety Engineers are provided with detailed system

Plan and Report (DVP&R) of functions, maneuvers, scenarios, andbehavior-oriented release notes and face-to-face meetings are held

degradation scenarios. Electrical/electronic (E/E) devices receive fullwith the development engineering teams to review the changes andrational automotive tests, including electronic emissions. To limit public

discuss their implementation. To pass our verification and validation

exposure to unnecessary risk, we use computer simulation testing

testing, each update to our system must achieve stringent reliability

before moving to test track/proving ground testing, then finally moveand confidence levels that are derived from well-developed automotive

to road-level testing with Safety Operators after the system has passed

industry standards.

the previous two phases of testing. Data from each testing phase isanalyzed and used to develop further improvements to the system.
Hardware components, including sensors, motherboards, graphics
processing units (GPUs), and central processing units (CPUs) are tested
for their reliability and their performance before integration into ouron-vehicle system. Similarly, each software module must pass rigorous
regression tests including intensive simulation-based tests that verify
the performance of the code against previous iterations before it isinstalled on our vehicles. After the individual modules and components
pass their respective unit tests, we perform a series of simulations

VERIFICATION AND VALIDATION

and closed-road track tests to verify the performance of the system.
Only after the system has successfully passed the unit, simulation,and closed-road track tests is it allowed to operate on public roads.
All public road tests of our developmental systems are conducted by a

We follow the design V-diagram with the design creation from system to component on
the left side of the V and the verification and validation from the component to the systemon the right side.

17

CHAPTER 2 ELEMENTS OF SAFETYVALIDATIONMETHODS

TUSIMPLE SAFETY REPORT

SafetyOperators

During the development period, our autonomous Class 8 trucks are

logging devices, real time driver alerts, inward and outward facing

operated by a 2-person team consisting of a trained Safety Operator

cameras and Advanced Driver Assistance Systems (ADAS) from industry

and a Safety Engineer. Our Safety Operators are all CDL Class A licensed

leading third-party vendors.

drivers who are responsible for maintaining control of the vehicle at
all times, disengaging the autonomous system when necessary, andmanually operating the vehicle in the case of an autonomous systemdisengagement.

Hiring and Qualifications

Whenever the system will be in autonomous mode, the Safety Engineers
are responsible for communicating road and system information to the
Safety Operator, monitoring the autonomous system, and recording
notes about system and road conditions by voice recording and alaptop. Our Safety Operator will continuously confirm and verify allroad conditions, traffic patterns and potential risks with the Safety
Engineer in real time, remaining vigilant throughout the drive. Whiledriving, all TuSimple trucks ensure safe operation by using electronic

Before Safety Operators are hired they must pass a background check,have a clean driving record, prove they possess a CDL Class A license, beSmith System certified, and pass a road test administered by the Lead
Safety Operator. Safety Engineers must also pass a background check,have a clean driving record, and pass a series of on-site interviews
where they are asked to display their engineering and critical thinking
skills by responding to a number of challenging scenarios.
18CHAPTER 2 ELEMENTS OF SAFETYVALIDATIONMETHODS

TUSIMPLE SAFETY REPORT

SafetyOperators

Training Program for Safety Operators and Engineers
The TuSimple autonomous vehicle operation training program is

We ensure the classroom to job knowledge transfer through extensive

designed for the Safety Operators and Safety Engineers to operate

practical training of Safety Operators and Safety Engineers via mission

the autonomous vehicles using the guiding principles of safety,

observations, job shadowing, closed track training, and hands-on

communication, and teamwork. The classroom learning objectives

training. Our trained instructors provide continuous coaching andcover the company’s safety policies, procedures, and practices, andmentoring based on rigorous evaluation of Safety Operator and Safetyvehicle inspection and emergency protocol. To help prioritize system

Engineer performance.

safety issues, the Safety Engineers are required to take the TuSimple
ASIL-Based Prioritization System (ISO 26262). To effectively isolate
potential vehicle safety issues during potential pre- or post trip safety
inspection failures, Safety Operators and Safety Engineers are trainedon the TuSimple Vehicle Lockout and Tagout policy course meeting
OSHA’s Control of Hazardous Energy standard.

19

CHAPTER 2 ELEMENTS OF SAFETYVALIDATIONMETHODS

TUSIMPLE SAFETY REPORT

SafetyOperators

Continuous Education

Strict Policies and Monitoring

Safety Operators and Safety Engineers hold debrief meetings after

Safety Operators and Safety Engineers are expected to follow allroad tests to discuss system performance, identify corner cases andcompany safety policies. The cabin’s audio and video recordings are

unusual scenarios, and provide feedback to product and engineering

constantly reviewed to ensure both Safety Operators and Safety

teams. Whenever a new software release is made available to the fleet,Engineers are following company policies. Violations of company

Safety Operators and Safety Engineers are provided with detailed,safety policies or changes to driving records may result in disciplinary

system behavior-oriented release notes and attend face-to-faceactions, ranging from training and testing to termination. For example,

meetings with the test engineering team to review changes andSafety Operators may only use hands-free mobile devices while thediscuss their implementation.

vehicle is on the road, unless they are parked or immobilized and needto contact emergency responders. Additionally, Safety Operators must
always keep their hands poised near the steering wheel and keep theirfeet poised near, but not on, the pedals.

20

CHAPTER 2 ELEMENTS OF SAFETY

TUSIMPLE SAFETY REPORTHUMANMACHINE
INTERFACE
When commercially deployed, our autonomous system is intended

interact with the autonomous vehicle. We will also publish a detailed

to function within its operational design domain without humaninteraction guide for first responders and public safety officers.

intervention. Therefore, the most important aspects of our HumanMachine Interface (HMI) are the external and public elements that help

During development, we provide an HMI for use inside the vehicle,

other road users (including pedestrians, cyclists, law enforcement

intended for use by the Safety Operators and Safety Engineers working

and first responders) interact with our autonomous trucks. We areon the autonomous system. Our development stage HMI monitors

designing an external-facing HMI to be intuitive and easily understood

the autonomous system and annotates recorded road and system

by other road users.

data. The development-stage HMI also provides passengers with theautonomous system’s perception, prediction, and planning information.

Because our autonomous system is intended for use on a variety

The HMI displays the detailed map, tracked objects and vehicles, andof third-party Class 8 tractors, it relies on standard interfaces andthe predicted behaviors of other road users. It also audibly announces

indicators for other road users. The system uses the OEM-installed

turns, lane changes, and other pertinent maneuver decisions. During thetractor lights (cabin, hazard, head, turn, and tail). It also uses the samedevelopment phase, the HMI allows the Safety Operator to disengage

side and tail lights installed on the trailers it hauls. These signals are all

the autonomous system in any of the following ways:

readily understood by other road users and require no further training•

Pressing the Disengage button on the steering wheelor education on the part of the public. The system does, however, have•

Depress the accelerator or brakesome unique indicators and interfaces on the exterior of the tractor.

•

Turning the steering wheel

The commercial autonomous system will indicate to other road usersthat it is operating autonomously. We are working with regulators

The development phase HMI includes a system that indicates theand other developers to standardize how the system will indicate

autonomous system’s status to the Safety Operator. It indicates if

its autonomous status. We are also working with regulators, state

the system is engaged, ready to engage, in an error or warning state,agencies, and other public safety entities to develop and improve

unable to engage, or disengaged. However, all other detailed system

the way first responders interface with the autonomous system, so

information comes from the Safety Engineers, so Safety Operators arethey are informed about the system and prepared when they need to

not monitoring the detailed HMI or at risk of on-screen distractions.
21

CHAPTER 2 ELEMENTS OF SAFETY

TUSIMPLE SAFETY REPORTVEHICLECYBERSECURITY
Cybersecurity is a critical element of our system safety approach. To

software event is detected, remote monitoring services are notified

protect our automated driving system from malicious attacks, we design

and pertinent data is automatically recorded to electronic logs so that

protections that will help prevent attacks and implement mitigation

the system events can be reconstructed.

strategies to minimize the potential impact of any cyber intrusion. We
work with cybersecurity specialists to create security protocols that

Any thorough approach to cybersecurity protections must also address

protect vulnerabilities in the autonomous system and all features,the potential for physical attacks. To mitigate the risk of physicalcomponents, or tools that interact with the autonomous electronics.

attacks against our autonomous system, we closely monitor and limit

We are actively developing cybersecurity controls based on ISO 21434

direct access to the system’s hardware components. Our system isfor automotive cybersecurity. ISO 21434 establishes a progressive anddesigned with physical enclosures that inhibit third-party access tocontinuous strategy to evaluate and monitor automotive system

hardware components, including physical tamper detection. We workarchitectures for cybersecurity risks, assign cybersecurity goals toclosely with security experts and our partners to review and approve

identified risks, develop technical controls based on those goals, then

all third-party libraries used in our software and hardware. We also

continuously monitor production systems for future facing security

review our internal processes and practices so that they align with theconcerns. Threat modeling is actively conducted internally and we also

recommendations for cybersecurity from NHTSA and the Automotive-

leverage third-party automotive cybersecurity companies to provide

Information Sharing & Analysis Center (Auto-ISAC).

threat analysis and risk assessment (TARA) based on the guidancein ISO 21434 and WP.29. The product security goals are derived fromthe risks identified and security controls are established to mitigate
prioritized security risks.
Our cybersecurity protocols are designed to isolate and protect all
onboard systems that communicate with the outside world through avariety of strategies, including encrypted communications and logicalservice isolation. If an MRC maneuver is triggered or an abnormal
22

CHAPTER 2 ELEMENTS OF SAFETY

TUSIMPLE SAFETY REPORTCRASHWORTHINESSWhen commercially deployed, TuSimple trucks are designed to haul

brakes, and airbags and rollover seat protections. We do not modify

freight without human intervention, therefore a human driver or otherany of the existing safety or collision mitigation systems of our test

occupant will not need to be present in the vehicle when operating

vehicles and we work closely with our OEM suppliers to ensure thatwithin the ODD. During the development phase, however, we do haveour system does not interfere with any of the intended functions of

Safety Operators, Safety Engineers, and other occupants in the vehicle

their systems.

and we anticipate that there will be times when commercially deployedtrucks will be operated by a human driver outside of the ODD. To assure

CRASHWORTHINESS OF

the safety of these vehicle occupants, we evaluate the crashworthiness

AUTONOMOUS SYSTEM AND MODIFICATIONS

and passenger safety implementations of our autonomous vehicles
through:••

We do not modify or disable any of the OEM installed safety features

the crashworthiness and passenger protection features of theor functions. We only modify our autonomous vehicles to install andbase vehicles

operate the autonomous sensors and system hardware. During thethe crashworthiness and passenger protection features of ourdevelopment and prototyping phase, we also modify selected test

autonomous system and modifications.

vehicles’ sleeper cabins to accommodate additional passengers. The
sleeper cab modifications to accommodate additional passengers will

CRASHWORTHINESS OF

only be present during the development phase.

BASE VEHICLE
We are developing, testing, and validating our autonomous system onClass 8 trucks manufactured by Peterbilt and Navistar International.
These tractor platforms comply with all applicable Federal safety
standards and offer numerous supplemental safety features, including
collision mitigation systems, radar-assisted rear end collision avoidance,
Adaptive Cruise Control (ACC), lane departure warning, improved air disk
23

CHAPTER 2 ELEMENTS OF SAFETY

TUSIMPLE SAFETY REPORTPOST-CRASHADS
BEHAVIOR
Should a TuSimple truck operating in autonomous mode be involved

In addition to the actions taken by the ADS in the event of a crash, wein a crash, it will immediately initiate a fallback, or MRC maneuver

will initiate a fleet-wide response. During development, the fleet-wide

appropriate to the severity of the incident. Depending on the severity of

response will be to immediately notify all Safety Operators to havethe incident and the vehicle’s functional capabilities, the autonomous

them disengage the self-driving system and take manual control ofsystem will immediately and simultaneously complete the following

the trucks they are operating. Post-development, TuSimple trucks inactions, using redundant systems to complete the actions, if necessary:commercial operations will immediately notify our central management•

Apply brakes and come to a complete stop or slowly move to

hub in the event of a crash, which will initiate an investigation into thethe closest safe stopping area (like the shoulder on an interstateroot cause of the crash.

highway).
•

Activate the vehicle’s hazard lights.

Finally, in the event of damage to one of our self-driving vehicles, a•

Alert the TuSimple operations center and request assistance*.

complete system test will be performed before it is allowed to operate•

Automatically record detailed system and vehicle data surroundingon the road again.

the incident to an electronic log.
*We are coordinating with regulatory bodies and first responders todevelop an appropriate notification protocol.
We will provide emergency responders with all necessary information
for them to safely interact with the self-driving vehicle at the sceneof a crash and during normal operations. We will also set up a toll-freehotline for first responders and other road users so that they may
communicate directly with company representatives regarding theself-driving vehicle’s post-crash and normal operation.

24

CHAPTER 2 ELEMENTS OF SAFETY

TUSIMPLE SAFETY REPORTLAWENFORCEMENTLIAISON PROGRAM
Our law enforcement liaison program is critical for TuSimple to meetthe safety standards we require to lead the industry. We have met
and partnered with law enforcement professionals and other first
responders to gain knowledge on best practices for highway safety andpost-collision investigations, how law enforcement will interact withfully autonomous commercial vehicles, and standards for in-motion
review by officers and CVSA inspectors for the health and safety ofour vehicles. This level of collaboration with law enforcement is thefirst of its kind in this space and it’s required to ensure TuSimple is aleader in safety.

25

CHAPTER 2 ELEMENTS OF SAFETY

TUSIMPLE SAFETY REPORTCOMBATING
HUMAN
TRAFFICKING
We also participate on two committees and boards for CVSA to include
the ADS CMV working group and the Human Trafficking subcommittee.
As we continue to grow the network we will continue to meet withand collaborate with our private and government stakeholders toensure we are involved in the conversations and help set the safety
standards for autonomous commercial motor vehicles.
We have a very strong commitment to combat Human Trafficking.
We have implemented a mandatory training program from Trucker
Against Human Trafficking for all TuSimple drivers. Additionally, alltrucks are equipped with this bumper sticker to signal our supportand highlight available resources.

26

CHAPTER 2 ELEMENTS OF SAFETY

TUSIMPLE SAFETY REPORTDATARECORDING
During the development phase, our autonomous system records
and logs all autonomous system, vehicle network (such as the CANbus), and vehicle control data. This data is critical to the continuous
improvement of our autonomous system. The data we record istransmitted to teams of TuSimple engineers and backed up after
every data collection or testing trip. This real-world data is then used
to test and train the autonomous system on varying road, weather,lighting, and control situations. Because we record all sensor, vehicle
control, and CAN-bus data, we can continuously run simulations with
our autonomous software against previous real-world experience toensure that the software continues to improve. Similarly, this data canbe used to create and inform new simulation scenarios that we use
to verify and validate the autonomous system.
Post-development, commercially deployed systems will record thesame data recorded during the development phase. We are working
with other ADS developers and appropriate regulatory bodies todesign and implement data recording standards that can be used for
all autonomous vehicles, and our system will comply with any relevant
data recording requirements.

27

CHAPTER 2 ELEMENTS OF SAFETY

TUSIMPLE SAFETY REPORTCONSUMEREDUCATION
AND TRAINING
The day-to-day experience for the general public who will interact with
TuSimple’s autonomous trucks will not be noticeably different fromtheir current interaction with long-haul logistics carriers’ manuallyoperated trucks. To keep the public informed about autonomous trucks
and address any concerns about how to properly interact with them,
we will publish educational materials for public consumption as ourautonomous system matures and becomes commercialized. Thesematerials will be made available through traditional media outlets
and through our website.
TuSimple is also working closely with our logistics partners to informthe employees who will interact directly with the autonomous system
about the system’s features and limitations. The loading and unloadingof their trailers will remain unchanged and we will provide direct inperson and documented training for any changes that are requiredwith regard to preparing the trailer for shipment. We are also partnering
and working closely with a number of fuel, parking, and rest location
operators to develop procedures for refueling and parking autonomous
trucks.

28

CHAPTER 2 ELEMENTS OF SAFETY

TUSIMPLE SAFETY REPORTTUSIMPLE
IN THE
NEWS

29

CHAPTER 2 ELEMENTS OF SAFETY

TUSIMPLE SAFETY REPORTTUSIMPLE
IN THE
NEWS30

CHAPTER 2 ELEMENTS OF SAFETY

TUSIMPLE SAFETY REPORTFEDERAL,
LOCAL, AND
STATE LAWS
Our system safety approach requires that our autonomous system be

TuSimple joined the NHTSA AV Test Initiative and other state AV related

capable of meeting or exceeding all federal, local, and state requirements

projects because we believe the only way for the public to trust AVs isand standards. We’ve also designed the autonomous system to follow

to be transparent and collaborative with our government partners.

all applicable laws. Our detailed ODD and capable OEDR system work

TuSimple works closely with both state and federal partners on thein conjunction to cross reference all road rules and ensure that thetesting and deployment of AV Truck technology. The CVSA, FMCSA, andautonomous system follows the appropriate laws and rules of theindustry partners have been integral in developing recommendations

road. We incorporate road sign information into our detailed maps,

for law enforcement interactions and inspections. TuSimple will continue

such that the map contains information that informs the autonomous

to work closely with the law enforcement community to develop safest

vehicle’s speed limit or lane assignment. This information is cross-electronic inspection in the industry.

referenced with ground-truth sensor data to ensure compliancewith all applicable laws. For example, when our map indicates that the

As a USDOT authorized carrier for the TuSimple test fleet, we are held

autonomous vehicle is operating in a solid line lane, the OEDR system

accountable for all safety incidents and inspections, similar to otherconfirms the presence of solid lane lines and the autonomous system

trucking companies.

knows that it cannot legally change lanes.
Any modifications we make to the base vehicle in our commercial
system will meet all applicable Federal Motor Vehicle Safety Standards(FMVSS), or we will seek an exemption to the standard following the
NHTSA process, which requires that we demonstrate that our system
offers the same or greater level of safety as a vehicle meeting thestandard. Similarly, we are committed to ensuring that our autonomousvehicles are correctly licensed, registered, insured, and maintained.

31

APPENDIX

TUSIMPLE SAFETY REPORTAPPENDIX
Glossary
ACC 		

Adaptive Cruise Control

GPU 		

Graphics Processing Unit

ADAS 		

Advanced Driver Assistance Systems

HARA 		

Hazard and Risk Analysis

ADS 		

Automated Driving System

HIL 		

Hardware-in-LoopAI 		

Artificial Intelligence

HMI		

Human-Machine Interface

ASIL 		

Automotive Safety Integrity Level

IATF 		

International Automotive Task Force

Auto-ISAC

Automotive-Information Sharing & Analysis Center

IMU 		

Inertial Measurement Unit

CAN 		

Controller Area Network

ISO		International Organization for Standardization

CDL 		

Commercial Driver License

KITTI 		Karlsruhe Institute of Technology and Toyota Technological Institute

CLD 		

Commercially Licensed Driver

LiDAR 		Light Detection and Ranging

CPU 		

Central Processing Unit

MRC 		

Minimal Risk Condition

CVSA 		

Commercial Vehicle Safety Alliance

NHTSA

National Highway Traffic Safety Administration

DOT		

Department of Transportation

ODD 		

Operational Design Domain

EDR		Event Data Recorder

OEDR 		

Object and Event Detection and Response

FMCSA

Federal Motor Carrier Safety Administration

OEM 		

Original Equipment Manufacturer

FMVSS

Federal Motor Vehicle Safety Standards

OSHA 		

Occupational Safety and Hazard Administration

GGE 		

Global Greenhouse Emissions

SAE 		

Society of Automotive Engineers

GGH 		

Global Greenhouse

TADS		TuSimple Autonomous Driving System

GPS 		

Global Positioning System

32

APPENDIX

TUSIMPLE SAFETY REPORTAPPENDIX
End Notes[1]

SAE J3016. Taxonomy and Definitions for Terms Related to Driving Automation
Systems for On-Road Motor Vehicles. SAE International, September 2016.

[7] American Trucking Association (2018). “ATA’s Freight Forecast Projects Growthfor Trucking.” Retrieved December 20, 2018 from https://www.truckinginfo.
com/312756/ atas-freight-forecast-projects-growth-for-trucking.

[2] Bureau of Labor Statistics, U.S. Department of Labor, Occupational Outlook
Handbook, Heavy and Tractor-trailer Truck Drivers, Retrieved March 18, 2019[8] McNally, Sean. (2018) “New Survey Data Reveals Increases in Driver Compensation.”from https:// www.bls.gov/ooh/transportation-and-material-moving/heavy-

Retrieved December 20, 2018 from https://www.trucking.org/article/New-

and-tractor-trailertruckdrivers.htm.

SurveyData-Reveals-Increases-in-Driver-Compensation[3] McNally, Sean. (2018) “Turnover Rate at Large Truckload Carriers Rises in First[9] U.S. Department of transportation. (2017) Automated Driving Systems

Quarter. Accelerating Churn Rate Indicates Continued Tightness in Driver Market.”

2.0: A Vision for Safety. https://www.nhtsa.gov/sites/nhtsa.dot.gov/files/

Retrieved December 21, 2018 from https://www.trucking.org/article/Turnover-documents/13069aads2.0_090617_v9a_tag.pdf

Rateat-Large-Truckload-Carriers-Risesin-First-Quarter.
[10] https://www.drivedifferent.com/[4] Costello, Bob (2017). Truck Driver Shortage Analysis 2017. American Trucking
Association.
[5] U.S. Department of Transportation. (2018) Federal Motor Carrier Safety[11] https://www.internationaltrucks.com/support/safety[12] https://www.peterbilt.com/innovation/safety

Administration Analysis Division: Large Truck and Bus Crash Facts 2016. (FMCSARRA-17-016) Washington, DC: U.S. Government Printing Office[13] U.S. Department of transportation. (2018) Automated Vehicles 3.0: Preparing for
the Future of Transportation. https://www.transportation.gov/sites/dot.gov/[6] American Trucking Association. (n.d.) Reports, Trends and Statistics. Retrieved
December 21, 2018 from https://www.trucking.org/News_and_Information_

files/ docs/policy-initiatives/automated-vehicles/320711/preparing-futuretransportationautomated-vehicle-30.pdf

Reports_Driver_Shortage.aspx
33