Inland Transport Committee

World Forum for Harmonization of Vehicle Regulations
Framework document on automated/autonomous vehicles1
1This document has been prepared by the representatives of China, European Union, Japan and the United States of America. It has been adopted by theWorld Forum for Harmonization of Vehicle Regulations (WP.29) at its 178th session, see ECE/TRANS/WP.29/1147, para. 27 and then revised. It has beenendorsed by the Inland Transport Committee of UNECE at its February 2020 session. The Annex has since been updated in November
2021, see ECE/TRANS/WP.29/2021/151 and ECE/TRANS/WP.29/1161, para. 28.

PurposeThis Framework document’s primary purpose is to provide guidance to World Forum for
Harmonization of Vehicle Regulations (WP.29) subsidiary Working Parties (GRs) by identifying
key principles for the safety and security of automated/autonomous vehicles of levels 3 andhigher2.
The framework document also defines the work priorities for WP.29 and indicates thedeliverables, timelines and working arrangements for those certain work products related tothose priorities.

Working Principles
Technical provisions and/or guidance and resolutions for automated/autonomous vehicles shallbe conducted within the contexts of both the 1958 Agreement and 1998 Agreement.
Technical provisions, guidance resolutions and evaluation criteria for automated vehicles will tothe extent possible, be performance based, technology neutral, and based on state-of-the-art
technology while avoiding restricting future innovation.
Existing standards/guidelines of the contracting parties and in standardization bodies shall bereviewed as well as previous work and reference documents agreed in UNECE.
This document shall be approved and managed by WP.29 as specific work items are expected
to be prepared in multiple GRs with extensive cross-coordination between them. The
implementation of each work item shall be monitored at each WP.29 session under a dedicatedagenda item. Furthermore, this document shall be reviewed once a year and be updated, ifnecessary.

Safety Vision
WP.29 recognizes that for automated/autonomous vehicles to fulfil their potential in particular to
improve road transport, then they must be placed on the market in a way that reassures road
users of their safety. If automated/autonomous vehicles confuse users, disrupt road traffic, orotherwise perform poorly then they will fail. WP.29 seeks to avoid this outcome by creating theframework to helping to deliver safe and secure road vehicles in a consistent manner, and topromote collaboration and communication amongst those involved in their development andoversight.
The level of safety to be ensured by automated/autonomous vehicles implies that “anautomated/autonomous vehicle shall not cause any non-tolerable risk”, meaning that
automated/autonomous vehicle systems, under their automated mode (Operational Design
Domain (ODD) or Operational Domain (OD)), shall not cause any traffic accidents resulting ininjury or death that are reasonably foreseeable and preventable. Based on this principle, thisframework sets out a series of vehicle safety topics to be taken into account to ensure safety.

2See Automated Driving definitions referenced in WP.29 ECE/TRANS/WP.29/1140, adopted in March 2018

Key issues and principles to be considered
by WP29 subsidiary bodies as a priority
The following list of issues and principles will guide discussions and activities onautomated/autonomous vehicles within WP.29 and each of its relevant subsidiary Working
Parties. The aim is to capture the shared interests and concerns of regulatory authorities,
provide the general parameters for work, and to provide common definitions and guidance.
The following is a list of common principles with brief descriptions and explanation. It isexpected these would form the basis for further development.
a) System Safety: When in the automated mode, the automated/autonomous vehicle
should be free of unreasonable safety risks to the driver and other road users andensure compliance with road traffic regulations;b) Failsafe Response: The automated/autonomous vehicles should be able to detect
its failures or when the conditions for the [ODD/OD] are not met anymore. In such acase the vehicle should be able to transition automatically (minimum risk manoeuvre)
to a minimal risk condition;c) Human Machine Interface (HMI) /Operator information: Automated/ autonomousvehicle should include driver engagement monitoring in cases where drivers could beinvolved (e.g. take over requests) in the driving task to assess driver awareness andreadiness to perform the full driving task. The vehicle should request the driver tohand over the driving tasks in case that the driver needs to regain a proper control ofthe vehicle. In addition, automated vehicle should allow interaction with other roadusers (e.g. by means of external HMI on operational status of the vehicle, etc.);d) Object Event Detection and Response (OEDR): The automated/autonomousvehicles shall be able to detect and respond to object/events that may be reasonably
expected in the [ODD/OD];e) Operational Design Domain (ODD/OD)] (automated mode): For the assessment of
the vehicle safety, the vehicle manufacturers should document the OD available on
their vehicles and the functionality of the vehicle within the prescribed OD. The OD
should describe the specific conditions under which the automated vehicle is intended
to drive in the automated mode. The OD should include the following information at aminimum: roadway types; geographic area; speed range; environmental conditions(weather as well as day/night time); and other domain constraints;f) Validation for System Safety: Vehicle manufacturers should demonstrate a robust
design and validation process based on a systems-engineering approach with thegoal of designing automated driving systems free of unreasonable safety risks andensuring compliance with road traffic regulations and the principles listed in thisdocument. Design and validation methods should include a hazard analysis andsafety risk assessment for Automated Driving System (ADS), for the OEDR, but also
for the overall vehicle design into which it is being integrated and when applicable, forthe broader transportation ecosystem. Design and validation methods shoulddemonstrate the behavioural competencies an Automated/autonomous vehicle would
be expected to perform during a normal operation, the performance during crash
avoidance situations and the performance of fall back strategies. Test approaches
may include a combination of simulation, test track and on road testing;g) Cybersecurity: The automated/autonomous vehicle should be protected against
cyber-attacks in accordance with established best practices for cyber vehicle physicalsystems. Vehicles manufacturers shall demonstrate how they incorporated vehicle
cybersecurity considerations into ADSs, including all actions, changes, design
choices, analyses and associated testing, and ensure that data is traceable within arobust document version control environment;h) Software Updates: Vehicle manufacturers should ensure system updates occur as
needed in a safe and secured way and provide for after-market repairs andmodifications as needed;i) Event data recorder (EDR) and Data Storage System for Automated Driving
vehicles (DSSAD): The automated/autonomous vehicles should have the functionthat collects and records the necessary data related to the system status, occurrenceof malfunctions, degradations or failures in a way that can be used to establish thecause of any crash and to identify the status of the automated/autonomous driving
system and the status of the driver. The identification of differences between EDR andDSSAD to be determined.

Additional issues not listed in the currently agreed WP29 prioritiesj) Vehicle maintenance and inspection: Vehicle safety of in-use vehicles should beensured through measures such as related to maintenance and the inspection ofautomated vehicles etc. Additionally, vehicle manufacturers are encouraged to havedocumentation available that facilitates the maintenance and repair of ADSs after acrash. Such documentation would likely identify the equipment and the processes
necessary to ensure safe operation of the automated/autonomous vehicle afterrepair;k) Consumer Education and Training: Vehicle manufacturers should develop,
document and maintain employee, dealer, distributor, and consumer education andtraining programs to address the anticipated differences in the use and operation ofautomated vehicles from those of conventional vehicles;l) Crashworthiness and Compatibility: Given that a mix of automated/autonomousvehicles and conventional vehicles will be operating on public roadways,
automated/autonomous vehicle occupants should be protected against crashes withother vehicles;m) Post-crash AV behaviour: Automated/autonomous vehicles should be able toreturn to a safe state immediately after being involved in a crash. Things such as
shutting off the fuel pump, removing motive power, moving the vehicle to a safe
position off the roadway, disengaging electrical power, and other relevant actions
should be considered. A communication with an operations canter, collisionnotification canter, or vehicle communications technology should be used.
The following annex contains the full consolidated list of safety aspects in the guidelines ofContracting Parties.

Annex
Table 1
Detailed WP.29 work priorities related to automated/autonomous vehicles
Title
Functional
Requirements
for automated/autonomousvehicles)

Description of work /ECE/TRANS/WP.29/2019/2

Corresponding
principles/elements

This work item should cover thefunctional requirements for thecombination of the different
functions for driving: longitudinal
control (acceleration, braking
and road speed), lateral control(lane discipline), environment
monitoring (headway, side,rear), minimum risk manoeuvre,
transition demand, HMI (internaland external) and drivermonitoring.
This work item should also
cover the requirements for
Functional Safety.

a. System safety
b. Failsafe Response
c. HMI /Operator
informationd. OEDR (FunctionalRequirements)
e. Operational
Design Domain

Activities
Allocation toMain targets

GRVA/

Automated /Autonomousvehicles

FRAV
informalgroup

Current activitiesFuture Activities

Identification anddefinition of high-level
performancerequirements for ADS
High-level definitionof
safety of ADS andmandatory manufacturer
description of ADS

Deliverable/
Deadline forsubmission toWP29
March 2021

March 2021

Draft initial WP.29
guidelines for ADS safety
requirements based on"current activities" including
the requirementson
motorway use case.

GRVA ofSeptember 2021 fordelivery to WP.29
ofNovember 2021
(information) /March 2022
(endorsement)

Proposal for WP.29
guidelines on ADS safety
requirements

GRVA of February
2022 for delivery toWP.29 ofMarch 2022
(information)/ June2022(endorsement)TitleNewassessment /Test method

Cyber securityand (Over-theAir) Software
updates

Description of work /ECE/TRANS/WP.29/2019/2

Corresponding
principles/elements

Multi-pillar concept: Audit,
simulation, electronic systemcompliance, digital
identity, test track, real world
driving evaluation., in-use
monitoring, use ofscenarios.

b. Failsafe Response(Assessment Method)c. HMI /Operator
information(AssessmentMethod)d. OEDR (AssessmentMethod)e. Operational Design
Domain (AssessmentMethod)f. Validation for System
Safety (including CEL)Work of Task Force on Cyber
Security and (OTA) software
updates (TF CS/OTA) ongoing.
Draft recommendations on theapproach (based on draft
technical requirements).

g. Cybersecurity
h. Software Updates

Activities
Allocation toMain targets

GRVA/VM
AD
informalgroup

Automated/
Autonomousvehicles

GRVA
Cyber/softw
are update
informalgroup

Conventionaland Automated /AutonomousvehiclesCurrent activities

Future Activities

Description of New
assessment /Test method(NATM)
process/procedures for theassessment of an ADS

Review of draft set oftechnical requirements for1998 CPs

Deliverable/
Deadline forsubmission toWP29
March 2021

Second iteration of NATM addressingthe "outstanding issues" identified by
VMAD and the evaluation of NATM forthe motorway use-case

GRVA ofSeptember 2021
for delivery toWP.29 ofNovember 2021
(information) /March 2022
(endorsement)

Proposal of WP29 guidelines for NATM
including outcome of "outstandingissues" and translation of FRAV
requirements

GRVA of February
2022 for delivery to
WP.29 of March2022 (information) /June 2022(endorsement)
November 2021

Data Storage
System for
Automated
Driving vehicles(DSSAD)DSSAD are for autonomousvehicles (e.g. accidentrecoding). This work item
should take into considerationof the discussion at GRVA and
its Informal Working Group on
Automatically Commended
Steering Function (IWG onACSF).
Clear objectives, deadline andthe identification of differenceswith EDR to be determined first
before discussion on detailed
data information.

i. EDR/DSSAD

Event Data
Recorder (EDR)

Existing systems - as roadsafety measure(e.g. accident recoding).

i. EDR/DSSAD

GRVA
EDR/DSSAD
informal group

GRSG
In coordination
with GRVAEDR/DSSAD
informal group

Automated /AutonomousvehiclesConventionaland Automated /Autonomousvehicles

Inventory of best ADS storagepractices

November 2022

DSSAD performance elements
for ADS

June 2024

Complete EDR Performance
Elements for 1958/1998
Contracting Parties

July 2021

Corrections/ amendments toexisting EDR regulation andADS data elements for ALKS

March 2022

WP.29 guidelines on EDR
Performance Elements forADS

November 2022

EDR Step 2:
Consideration of additional
technical requirements tocurrent UN Regulation
regarding trucks
and buses

March 2023