Perspective on Voluntary Safety 

Self-Assessments

Dee Williams

Deputy Associate Administrator, Vehicle Safety Research

National Highway Traffic Safety Administration

June 25-26, 2019

1

Logos are trademarks of the corresponding corporate partners in the U.S. and other countries
2

U.S. DOT PREPARING FOR THE FUTURE OF 

TRANSPORTATION – AUTOMATED VEHICLES 3.0

Provides:

1. New multimodal safety guidance

2. Clarifies policy and roles

3. Outlines how to work with U.S. DOT 

as automation technology evolves

Reaffirms and maintains that: 

1. A Vision for Safety 2.0 on the 

design, testing, and safe 

deployment of ADS remains central 

to U.S. DOT’s approach.

2. U.S. DOT’s primary focus is SAFETY.
3

U.S. DOT Automation Principles

U.S. DOT has established a clear and consistent Federal approach to shaping policy for automated vehicles, 

based on the following six principles.

1. We will prioritize safety.

2. We will remain technology neutral.

3. We will modernize regulations.

4. We will encourage a consistent regulatory 

and operational environment.

5. We will prepare proactively for automation.

6. We will protect and enhance the freedoms 

enjoyed by Americans.
4

VOLUNTARY SAFETY SELF-ASSESSMENTS (VSSAs)

• VSSAs are intended to demonstrate to the public that entities 

are: 

• Considering the safety aspects of ADSs

• Communicating and collaborating with USDOT

• Encouraging the self-establishment of industry safety norms 

for ADSs 

• Building public trust, acceptance, and confidence through 

transparent development and testing of ADSs. 
5

INTENDED USE AND SCOPE OF VSSAs

Submission of VSSA is 

voluntary - not a 

requirement for testing

Gives companies an 

opportunity to 

showcase their 

approach to safety, 

without revealing IP

Supports transparency 

with consumers and the 

general public 

Encourages sharing of 

best practices and 

methods
6

12 Safety Elements

1. Vehicle Cybersecurity

2. System Safety

3. Operational Design Domain

4. Object and Event Detection and 

Response

5. Fallback (Minimal Risk 

Condition)

6. Validation Methods

7. Human Machine Interface

8. Crashworthiness

9. Post-Crash ADS Behavior

10. Data Recording

11. Consumer Education and 

Training

12. Federal, State, and Local Laws

Companies are encouraged to consider and document their 

approach to safety.
7

STRUCTURING THE VSSA

• NHTSA provided a template for VSSA

• Template design accommodates the range and 

diversity of entities that are currently testing ADS

• Template was flexible – not prescriptive

• Provides guidance and an example of the types of 

summary information that could be shared
8

VSSAs: INDUSTRY DISCLOSURES TO DATE

NHTSA/USDOT have been strongly encouraging companies to disclose 

VSSAs in working to establish public trust and confidence in the 

technology. 16 VSSAs currently released and publicly available: 

• Apple

• Aurora

• AutoX

• Ford

• GM

• Mercedes-Benz/Bosch L4-L5

• Mercedes Benz L3

• Navya

• Nuro

• Nvidia

• Robomart

• Starsky Robotics

• TuSimple

• Uber

• Waymo

• Zoox

Published VSSAs can be viewed on NHTSA’s Index at

*https://www.nhtsa.gov/automated-driving-systems/voluntary-safety-self-assessment
9

WHAT ARE WE LEARNING SO FAR?

VSSAs received are: 

• Providing visibility into ADS development and testing activities across the industry

• Giving a narrative around how a company addresses each safety element, describing 

processes followed, standards used, and examples of how it operationalizes each area in their 

development and testing processes

• Communicating a company’s vision for ADS and approach to safety

• Educating and informing stakeholders and the public about ADS

• Showing variation in the level of detail provided (some take a more basic approach while 

others discuss each safety element at length)
10

Example Excerpts from VSSAs: Discussing 

Fallback or Minimal Risk Condition

“In the event of a collision, or a critical fault of the safety controller, the 

vehicle will execute a fallback stop. This action brings the vehicle to rest 

quickly but allows surrounding actors time to respond accordingly, while 

also avoiding hazards that may result from attempting a rapid stop. The 

fallback stop enables hazard lights, engages the horn, holds the steering in 

its last commanded position, and applies a constant deceleration until the 

vehicle comes to a stop. “

“Should a malfunction occur, the diagnostics system determines

whether the appropriate response is a fail-operational state or a

fail-safe state, and transitions the vehicle to the corresponding safe

state. When required, the self-driving system will operate the vehicle

at a reduced speed or pull to the side of the road and execute a safe

stop, as appropriate.”

“When a malfunction occurs, the vehicles dynamically sort potential 

responses into one of any number of fail-functional or fail-safe states. 

Minor faults not affecting the ability to drive are flagged for later 

resolution while more serious conditions might entail the decision to 

securely stop at a waypoint a short distance away, on the shoulder at the 

next opportunity or immediately. “

“Beyond safety drivers, we have also developed a layered system

fallback strategy that can support full self-driving in our vehicles,

without requiring human intervention. At all times, our onboard,

high-reliability computer calculates multiple potential trajectories 

that would be safe to take should a system fail. If, for example, a 

sensor were to malfunction, our vehicle could safely pull over to the 

side of the road or lane using a trajectory calculated before the 

malfunction, when the system had full information.”
11

PUBLIC NOTIFICATION OF PETITIONS

• RFCs on 2 petitions for exemption 

(closed May 20, 2019)

• GM

• Nuro
12

We continue to remain in step -- without 

getting ahead of -- the developing technology

Safety Research

Technical

•Unintended Regulatory Barriers

•Safety Assurance Tools and Methods

•Alternative Metrics and Safety Assessment 

Models

•Crashworthiness in alternative vehicle designs

Behavioral

•Interactions with humans inside and outside of 

vehicle

•Public Acceptance

Communications-Related

•Confusion over types of systems and stages of 

systems

Safety without Regulatory Barriers - Rulemaking 

Removing Regulatory Barriers for Innovative Motor 

Vehicle Technologies: ANPRM published May 2019

Safety Principles for ADSs: New (2019 Spring Agenda)

Occupant Protection for ADSs: New (2019 Spring Agenda)

Considerations for Telltales and Indicators: New (2019 

Spring Agenda)

Update Exemptions Process

Automated Driving Systems Pilot

Public Education

Now: Advanced cruise control feature 

awareness and consistent terms

Preparing for testing: Law enforcement and 

first responder awareness

Public awareness of testing and deployment

Eventually: Safe road users education
13

THANK YOU!

For More Information:

Dee Williams

Deputy Associate Administrator, Office of Vehicle Safety 

Research

National Highway Traffic Safety Administration (NHTSA)

U.S. Department of Transportation`

Dee.Williams@dot.gov