# Safety of Autonomous Vehicles

Authors: Jun Wang; Li Zhang; Yanjun Huang; Jian Zhao
Journal: Journal of Advanced Transportation
 (2020)

---

## Abstract

Autonomous vehicle (AV) is regarded as the ultimate solution to future automotive engineering; however, safety still remains the key challenge for the development and commercialization of the AVs. Therefore, a comprehensive understanding of the development status of AVs and reported accidents is becoming urgent. In this article, the levels of automation are reviewed according to the role of the automated system in the autonomous driving process, which will affect the frequency of the disengagements and accidents when driving in autonomous modes. Additionally, the public on-road AV accident reports are statistically analyzed. The results show that over 3.7 million miles have been tested for AVs by various manufacturers from 2014 to 2018. The AVs are frequently taken over by drivers if they deem necessary, and the disengagement frequency varies significantly from 2 × 10−4 to 3 disengagements per mile for different manufacturers. In addition, 128 accidents in 2014–2018 are studied, and about 63% of the total accidents are caused in autonomous mode. A small fraction of the total accidents (∼6%) is directly related to the AVs, while 94% of the accidents are passively initiated by the other parties, including pedestrians, cyclists, motorcycles, and conventional vehicles. These safety risks identified during on-road testing, represented by disengagements and actual accidents, indicate that the passive accidents which are caused by other road users are the majority. The capability of AVs to alert and avoid safety risks caused by the other parties and to make safe decisions to prevent possible fatal accidents would significantly improve the safety of AVs. Practical applications. This literature review summarizes the safety-related issues for AVs by theoretical analysis of the AV systems and statistical investigation of the disengagement and accident reports for on-road testing, and the findings will help inform future research efforts for AV developments.


---

## Body

## 1. Introduction

With the demands on reducing traffic accidents, congestion, energy consumption, and emissions, autonomous driving technology has been recognized as one of the promising solutions to these critical social and environmental issues. An autonomous vehicle (AV, i.e., automated or self-driving vehicle) equipped with advanced technologies assists a human driver or to control the vehicle independently, where human interference may not be required [1, 2]. The control decisions, such as accelerating, deaccelerating, changing lanes, and parking, can be made by a human driver or an autonomous system, depending on the automated levels of the vehicle and the perception results of the surrounding environment (e.g., pedestrians, cyclists, other vehicles, traffic signals, and school zones) [2–5]. Vehicle automation can be divided into several levels, e.g., no automation, partial automation, high automation, or full automation according to the involvement of a human driver or automated system in monitoring the surrounding environment and control the vehicle.The autonomous technology employed in transportation systems brings opportunities to mitigate or even solve transportation-related economic and environmental issues, and therefore, the autonomous vehicle has been actively studied recently [6]. AV techniques are capable of changing the traditional means of transportation by (i) improving road safety, where human errors account for 94% of the total accidents [7], (ii) enhancing the commute experience, via working or entertaining instead of driving and shortening the commute time when the traffic path is planned [8, 9] or the parking task is conducted autonomously [10, 11], and (iii) improving mobility for everyone, which enables differently abled people to access transportation and improve their independence [2, 12]. In 2011, more than 5.3 million vehicle crashes were reported in the United States, leading to approximately 2.2 million injuries, 32 thousand fatalities, and billions of dollars losses [1]. According to [13], the crashes caused by human factors, including speeding, distractive driving, alcohol, and other behaviors, take up 93% of the total crashes. By minimizing the involvement of human operations, AVs have the potential to significantly reduce car crashes. According to the Insurance Institute for Highway Safety [1], partially autonomous technology such as forward collision and lane departure warning systems, side view assist, and adaptive headlights will potentially prevent or mitigate crashes, and the reduction in injuries and fatalities can be up to 33%. When a human operator is not required to operate a vehicle, it would enable the blind, disabled, and those too young to drive, enhancing their independence, social connection, and life experience [14, 15]. AVs would also reduce the needs in mass transit or paratransit agencies, which saves the costs borne by the taxpayer and improves social welfare. The owner and the community will also benefit from the development of the autonomous technology from (i) the potential for fuel savings in terms of better fleet management [16–19] to avoid congestion [9, 20] and more manageable parking arrangement [10], and (ii) the potential of relieving people from the stress of commute driving, perhaps even taking a snap on the way to work [21]. The substantial potential to reduce the congestion would benefit not only AV drivers but also other drivers. Even though significantly increased AV users may potentially increase the congestion [13], the traffic conditions may also be improved by optimized vehicle operation and reduced crashes and delays [22, 23]. With an improved transportation system, AV techniques have a significant potential to save energy and reduce emissions [17, 24]. The benefits of energy-saving may be resulted from a smooth accelerating and decelerating in comparison to a human driver, better fleet management by lowering peak speeds and higher effective speeds, reduced travel time, and lighter design of vehicles because of fewer crashes [1]. If lighter vehicles can be enabled by autonomous technology, the use of electric vehicles can be promoted due to the improved driveable range [1]. Accordingly, emissions in the whole transportation ecosystem can be reduced. Studies also indicate that advanced lateral control scheme for AVs can also improve pavement sustainability [25, 26].The significant potential benefits brought by autonomous technology have driven the development of AVs in the past four decades. From the 1980s to 2003, AV studies are mainly led by universities with a focus on two technical pathways: infrastructure-centered and vehicle-centered technology developments. The former requires advanced highway infrastructure systems to guide the vehicles, whereas the latter one does not. Between 2003 and 2007, the U.S. Defense Advanced Research Projects Agency (DARPA) led the development of AV techniques in both rural and urban areas. After 2007, private companies, such as Google, Audi, Toyota, and Nissan, continue this technology development because of the increasing demands on AV technologies [1]. Recently, the road testing of such technologies is booming [27]. In fact, various features have been widely used in modern vehicles including lane-keeping, collision avoidance, automatic braking, adaptive cruise control (ACC), and onboard navigation to assist human drivers [28]. In recent years, many manufacturers, as well as high-tech companies, joined this AV competition. Audi, BMW, Mercedes-Benz, Volkswagen, Volvo, Ford, General Motors, Toyota, Nissan, as well as Google, Baidu, and other research institutes, have begun testing on- and off-road AVs [13, 28].Even though AVs have been substantially improved, fully autonomous vehicles are still not ready for commercialization. The obstacles mainly come from safety concerns. Moody et al.’s studies indicated that the youth with high salary and education male are the most optimistic about the AV safety [29], while western European countries are more pessimistic about the safety in comparison with Asian countries [30]. They claim that the optimism of autonomous technology among risk-taking people in developing countries may promote the global development of AVs. Lee et al.’s studies indicated that safety risks can affect customers’ intention to use autonomous vehicles [31]. In addition, a ‘safe’ AV should be able to obey traffic laws and to avoid road hazards automatically and effectively [21]. It should be noted that for a fully automated vehicle, human factors in the vehicle-human interface are one of the most significant concerns [2]. Regulations, in which the role of the human driver is defined, can be changed depending on the progress of the AV technology development. In turn, the levels of automation and its maturity can also affect the regulation-making [32], e.g., whether a human driver should be responsible for monitoring the surrounding environment throughout the autonomous driving modes or immediately taking over the control when an AV failure occurs [13]. In other words, AV safety can be affected by various social and technical factors, including automation level definition, regulation-making, nature of vehicles, road and traffic conditions, and even weather conditions. Therefore, a comprehensive understanding of the definition of automation levels for vehicles, types of potential and reported accidents, and current status of on-road testing will be beneficial for the AV technology development.Therefore, it is urgent to conduct a careful investigation of the available data on AV-related accidents and the potential accident prediction when the AV technology moves forward to higher automation levels. Great efforts have been devoted to AV technology development; however, an updated statistical point of view for the safety issues is missing in the literature. The safety issues for AVs have been reported individually in the literature, and critical analysis about the status and causes would be beneficial for the further design and development of AVs. This is of great significance for the related personnel to understand the system failures and possible causes.The objectives of the study are, therefore, to systematically analyze the safety issues related to autonomous technology applied to vehicular applications. The levels of automation in vehicles are reviewed in Chapter2, and the types of accidents and their potential causes are comprehensively analyzed in Chapter 3. The current status of the on-road testing and accidents are investigated in Chapter 4, and finally, the opportunities and challenges for AV safety studies are discussed in Chapter 5.


## 2. Levels of Automation

The definition of AVs is crucial for regulation makers to minimize the impact of this technology on traditional road users, such as other vehicles, pedestrians, bicyclists, and even construction workers. As aforementioned, the automation levels of the vehicles depend on the complexity of the autonomous technology applied, the perception range of the environment, and the degree of a human driver or vehicle system get involved in the driving decision, which is closely related to the AV safety. The definition of automation levels from various organizations is thus summarized and compared in this section.The traditional definition of the automation levels was reported by Sheridan and Verplank [33] as early as 1987 and later modified by Parasuraman et al. [34] in 2000. Ten levels of automation are defined based on roles of the human operator and vehicle system in the driving process. Level 1 means no automation is involved and human makes all decisions and takes all actions. In Level 2 to 4, the systems can suggest a complete set of the alternative decision or action plans, but human supervisors decide to execute the suggested actions or not. From Level 5, the system is becoming capable of executing a decision with a human operator’s approval. At Level 6, the system allows the human driver to react within a certain time span before the automatic action. At Level 7, after an automatic action, the system will inform the human supervisor; while at Level 8, the system will not inform the human supervisor unless it is asked. At Level 9, the system will decide if the human supervisor will be informed or not after an automatic action. Level 10 means fully automation, completely ignoring human factors. The details of the ten levels of automation can be found elsewhere [33, 34].In aerospace engineering, the levels of automation are varied, and generally, six levels are defined, which is known as the Pilot Authorisation and Control of Tasks (PACT) framework [35]. This automation system is labeled from Level 0 to 5. Level 0 denotes no computer autonomy, and Level 5 means the systems can be fully automatic but can still be interrupted by a human pilot. In addition to human commanded and automatic modes, the PACT also recommended four assisted modes depending on the operational relations between human pilots and the systems. The details of the six levels can be found in [35].In automotive engineering, the U.S. National Highway Traffic Safety Administration (NHTSA) defined five levels of automation [36]. In this system, the automation levels are divided into 5 categories, which are numbered from 0 to 4. Level 0 represents no automation, where the drivers completely control the vehicles. The highest level, Level 4, represents fully self-driving automation, where the vehicle is able to monitor external conditions and perform all driving tasks. It can be seen that most of the current autonomous vehicle development activities can be classified into Level 3, limited self-driving automation, where the drivers are able to take over the driving in some instances. Recently, NHTSA has adopted a more widely used definition of AVs based on the Society of Automotive Engineers (SAE) [2], which is regularly updated [37]. SAE defines 6 levels of automation for vehicles from 0 (no automation) to 5 (full driving automation) based on the extent to which the human factor is required for the automation system. Six levels of driving automation are defined by SAE, which is widely adopted by automobile manufacturers, regulators, and policymakers [2, 37–39]. These automation levels are divided by the role of the human driver and automation system in the control of the following driving tasks: (i) execution of steering and throttle control, (ii) monitoring driving environment, (iii) fallback of dynamic driving task (DDT), and (iv) system capability of various autonomous driving modes. According to the role of a human driver in the DDT, Levels 0–2 rely on the human driver to perform part of or all of the DDT, and Levels 3–5 represent conditional, high, and full driving automation, respectively, meaning that the system can perform all the DDT while engaged. This detailed definition of the levels of vehicle automation is widely used for current AV development activities. The six levels of driving automation defined by the Society of Automotive Engineer (SAE) are shown as follows [2, 37, 40]:(i)
Level 0 (No Automation). All driving tasks are accomplished by the human operator.(ii)
Level 1 (Driver Assistance). The human operator controls the vehicle, but driving is assisted with the automation system.(iii)
Level 2 (Partial Driving Automation). Combined automated functions are applied in the vehicle, but the human operator still monitors the environment and controls the driving process.(iv)
Level 3 (Conditional Driving Automation). The human operator must be prepared to operate the vehicle anytime when necessary.(v)
Level 4 (High Driving Automation). The automation system is capable of driving automatically under given conditions, and the human driver may be able to operate the vehicle.(vi)
Level 5 (Full Driving Automation). The automation system is capable of driving automatically under all conditions, and the human driver may be able to control the vehicle.It can be seen from the various definitions of automation levels by different organizations that human operators and vehicle systems can be involved in the driving processes at different degrees. This implies that the safety concerns for partially, high, and fully autonomous vehicles can be varied significantly. When the AVs are operated in no automation, partial automation, or high automation modes, the interaction between human operators and machines can be a significant challenge for AV safety; when AVs are operated at fully automation modes, the reliability of the software and hardware will become a vital issue. In other words, as more autonomous technology is applied in vehicles, the complexity of the autonomous system grows, which brings challenges for system stability, reliability, and safety. Therefore, theoretical analysis of the potential AV errors will be urgent to understand the current AV safety status and to predict the safety level in the future.


## 3. Types of Errors for Autonomous Vehicles

As more autonomous techniques are employed, different types of errors may be generated. If such errors are not properly handled, they may lead to critical safety issues. A systematical analysis of different types of errors or accidents for the AV technology will be helpful for the understanding current status of AV safety. It should be noted that the accidents reported in the literature for AVs are extremely less in comparison with those for traditional vehicles. However, it does not necessarily mean that current AVs are safer than human-controlled vehicles. Since the AV technology is still at the early stage of the commercialization and far away from the fully autonomous driving, more road tests should be done and the accident database may show a different trend.AV safety is determined by the reliability of the AV architecture and its associated hardware and software. However, AV architecture is highly dependent on the level of automation such that AV safety may show different patterns at different stages. Even at the same automation level, the architecture of AVs may also vary in different studies. Figure1 shows the general architecture and major components for AVs. A typical AV is composed of a sensor-based perception system, an algorithm-based decision system, and an actuator-based actuation system, as well as the interconnections between systems [41, 42]. Ideally, all components of the AVs should function well such that the AV safety can be ensured.Figure 1
A typical autonomous vehicle system architecture.


### 3.1. Accidents Caused by Autonomous Vehicle

Safety issues or accidents of AVs are highly related to the errors committed by AVs within various automation levels. Generally, such errors can be categorized according to the abovementioned architecture.


#### 3.1.1. Perception Error

The perception layer is responsible for acquiring data from multiple sensing devices to perceive environmental conditions for real-time decision making [41, 43]. The development of AVs is primarily determined by the complexity, reliability, suitability, and maturity of sensing technology [43]. The sensors for environment perception include, but not limited to, light detection and ranging (LIDAR) sensors, cameras, radars, ultrasonic sensors, contact sensors, and global positioning system (GPS). The function and ability of various sensing technologies can be found somewhere else [44]. It should be noted that any errors in the perception of the status, location, and movement of the other road users, traffic signals, and other hazards may raise safety concerns for AVs.Figure2 summarizes the past and potential future AV technology evolution based on the specific sensing technology applied to the vehicle systems, and the information is obtained from [43, 45–55]. At the end of the 20th century, proprioceptive sensors including wheel sensors, inertial sensors, and odometry are widely employed in-vehicle systems for better vehicle dynamics stabilization to achieve the functions of traction control system, antilock braking system, electronic stability control, antiskid control, and electronic stability program. In the first decade of the 21st century, many efforts have been devoted to the information, warning, and comfort during the driving process with the help of exteroceptive sensors such as sonar, radar, lidar, vision sensors, infrared sensors, and global navigation satellite system. The vehicles enable the functions of navigation, parking assistance, adaptive cruise control, lane departure warning, and night vision [56]. In the past decade, sensor networks installed in both vehicle and road systems have been adopted in the modern transportation system for the purpose of automated and cooperative driving [46]. Advanced autonomous functions will be enabled, including collision avoidance and mitigation, and automated driving such that the drivers will be eventually released from the driving process. Depending on the level of vehicle automation, the perceived data may also come from the communication between the AVs and the corresponding infrastructure [57, 58], other vehicles [44, 59], the Internet [60], and cloud [60].Figure 2
Past and potential future evolution of autonomous vehicle technology.Hardware, software, and communication are the three major sources of perception errors. The perception system heavily relies on sensing technology; therefore, the perception errors may come from the hardware including sensors. For example, the degradation and failure of the sensors may cause server perception errors, confuse the decision system, and lead to dangerous driving behaviors. Therefore, reliable and fault-tolerant sensing technology will be a potential solution to such issues. In addition, the perception errors may also result from the malfunction of the software, and this type of error would cause misleading to the decision and action layers, which may either fail the mission tasks or cause safety problems [57]. Communication errors will become important when the AVs are approaching fully automation levels. The communication errors may come from errors resulted from the communication between the AVs and the corresponding infrastructure [57], other road users [44], and the Internet [60]. Interpersonal communication is a vital component of the modern transportation system [61]. Road users, including drivers, pedestrians, bicyclists, and construction workers communicate with each other to coordinate movements and ensure road safety, which are the basic requirements of AVs [62]. The communication methods include gestures, facial expressions, and vehicular devices, and the comprehension of these messages can be affected by a variety of factors including culture, context, and experience, and these factors are also the key challenges for AV technology [61].


#### 3.1.2. Decision Error

The decision layer interprets all processed data from the perception layer, makes decisions, and generates the information required by the action layer [41, 63]. Situational awareness serves as the input of the decision-making system for short-term and long-term planning. The short-term involves trajectory generation, obstacle avoidance, and event and maneuver manager, while long-term planning involves mission planning and route planning [57, 64–66].The decision errors mainly come from the system or human factors. An efficient AV system will only take over the driving or warn the drivers when necessary, with a minimized false alarm rate but acceptable positive performance (e.g., safety level) [67]. As the AV technology is improved over time, the false alarm rate can be reduced significantly with sufficient accuracy and meet the requirements of the safety requirements [68]. However, if the algorithm is not able to detect all the hazards effectively and efficiently, the safety of AVs will be threatened. It should be pointed out that it may take a few seconds for the drivers occupied by secondary tasks to respond and take over the control from the automated vehicle [69–71], which bring uncertainties to the safe AV control.Unfortunately, AV technology is not yet completely reliable; therefore, the human driver has to take over the driving process, supervising, and monitoring the driving tasks when AV system fails or is limited by performance capability [69, 72]. In turn, the shifting role of a human driver in AV driving may lead to inattention, reduced situational awareness, and manual skill degradation [73]. Therefore, how to safely and effectively re-engage the driver when the autonomous systems fail should be considered in designing the AVs from a human-centered perspective.


#### 3.1.3. Action Error

After receiving the command from the decision layer, the action controller will further control the steering wheel, throttle, or brake for a traditional engine to change the direction and accelerate or decelerate [74, 75]. In addition, the actuators also monitor the feedback variables and the feedback information will be used to generate new actuation decisions.Similar to traditional driving systems, action errors due to the failure of the actuators or the malfunction of the powertrain, controlling system, heat management system, or exhaust system may rise to safety problems. However, a human driver would be able to identify this type of safety issues during the driving and pull over within a short response time. How the vehicle learns in these scenarios and responds to these low-frequency but fatal malfunctions of major vehicular components would be challenging to the full automation driving system. Therefore, the accident reconstruction of traditional vehicles would also be important [76].


### 3.2. Accidents Caused by Other Road Users

According to the accidents related to AVs reported by State of California Department of Motor Vehicles [2, 77], the majority of the accidents related to the AVs are caused by the other parties on a public road. For example, vehicles, bicyclists, and angry or drunk pedestrians who share the same road with the AVs may behave abnormally, which is even difficult for a human driver to handle.It will be urgent to investigate what the advanced AVs will react with these hazardous scenarios, and it would not be surprising that this technology will dramatically reduce the fatal accidents on roads. However, the autonomous technology is still not mature enough to handle very complicated scenarios before some key issues could be solved, including the effective detection and prediction of hazardous behaviors caused by other road users, and the correct decision made by the autonomous system. The effective detection of hazards caused by the other road users is crucial for the AVs to make active decisions to avoid oncoming accidents. The AVs should decide if they need to take actions that may violate traffic regulations to avoid potential fatal or injurious accidents.


## 3.1. Accidents Caused by Autonomous Vehicle

Safety issues or accidents of AVs are highly related to the errors committed by AVs within various automation levels. Generally, such errors can be categorized according to the abovementioned architecture.


### 3.1.1. Perception Error

The perception layer is responsible for acquiring data from multiple sensing devices to perceive environmental conditions for real-time decision making [41, 43]. The development of AVs is primarily determined by the complexity, reliability, suitability, and maturity of sensing technology [43]. The sensors for environment perception include, but not limited to, light detection and ranging (LIDAR) sensors, cameras, radars, ultrasonic sensors, contact sensors, and global positioning system (GPS). The function and ability of various sensing technologies can be found somewhere else [44]. It should be noted that any errors in the perception of the status, location, and movement of the other road users, traffic signals, and other hazards may raise safety concerns for AVs.Figure2 summarizes the past and potential future AV technology evolution based on the specific sensing technology applied to the vehicle systems, and the information is obtained from [43, 45–55]. At the end of the 20th century, proprioceptive sensors including wheel sensors, inertial sensors, and odometry are widely employed in-vehicle systems for better vehicle dynamics stabilization to achieve the functions of traction control system, antilock braking system, electronic stability control, antiskid control, and electronic stability program. In the first decade of the 21st century, many efforts have been devoted to the information, warning, and comfort during the driving process with the help of exteroceptive sensors such as sonar, radar, lidar, vision sensors, infrared sensors, and global navigation satellite system. The vehicles enable the functions of navigation, parking assistance, adaptive cruise control, lane departure warning, and night vision [56]. In the past decade, sensor networks installed in both vehicle and road systems have been adopted in the modern transportation system for the purpose of automated and cooperative driving [46]. Advanced autonomous functions will be enabled, including collision avoidance and mitigation, and automated driving such that the drivers will be eventually released from the driving process. Depending on the level of vehicle automation, the perceived data may also come from the communication between the AVs and the corresponding infrastructure [57, 58], other vehicles [44, 59], the Internet [60], and cloud [60].Figure 2
Past and potential future evolution of autonomous vehicle technology.Hardware, software, and communication are the three major sources of perception errors. The perception system heavily relies on sensing technology; therefore, the perception errors may come from the hardware including sensors. For example, the degradation and failure of the sensors may cause server perception errors, confuse the decision system, and lead to dangerous driving behaviors. Therefore, reliable and fault-tolerant sensing technology will be a potential solution to such issues. In addition, the perception errors may also result from the malfunction of the software, and this type of error would cause misleading to the decision and action layers, which may either fail the mission tasks or cause safety problems [57]. Communication errors will become important when the AVs are approaching fully automation levels. The communication errors may come from errors resulted from the communication between the AVs and the corresponding infrastructure [57], other road users [44], and the Internet [60]. Interpersonal communication is a vital component of the modern transportation system [61]. Road users, including drivers, pedestrians, bicyclists, and construction workers communicate with each other to coordinate movements and ensure road safety, which are the basic requirements of AVs [62]. The communication methods include gestures, facial expressions, and vehicular devices, and the comprehension of these messages can be affected by a variety of factors including culture, context, and experience, and these factors are also the key challenges for AV technology [61].


### 3.1.2. Decision Error

The decision layer interprets all processed data from the perception layer, makes decisions, and generates the information required by the action layer [41, 63]. Situational awareness serves as the input of the decision-making system for short-term and long-term planning. The short-term involves trajectory generation, obstacle avoidance, and event and maneuver manager, while long-term planning involves mission planning and route planning [57, 64–66].The decision errors mainly come from the system or human factors. An efficient AV system will only take over the driving or warn the drivers when necessary, with a minimized false alarm rate but acceptable positive performance (e.g., safety level) [67]. As the AV technology is improved over time, the false alarm rate can be reduced significantly with sufficient accuracy and meet the requirements of the safety requirements [68]. However, if the algorithm is not able to detect all the hazards effectively and efficiently, the safety of AVs will be threatened. It should be pointed out that it may take a few seconds for the drivers occupied by secondary tasks to respond and take over the control from the automated vehicle [69–71], which bring uncertainties to the safe AV control.Unfortunately, AV technology is not yet completely reliable; therefore, the human driver has to take over the driving process, supervising, and monitoring the driving tasks when AV system fails or is limited by performance capability [69, 72]. In turn, the shifting role of a human driver in AV driving may lead to inattention, reduced situational awareness, and manual skill degradation [73]. Therefore, how to safely and effectively re-engage the driver when the autonomous systems fail should be considered in designing the AVs from a human-centered perspective.


### 3.1.3. Action Error

After receiving the command from the decision layer, the action controller will further control the steering wheel, throttle, or brake for a traditional engine to change the direction and accelerate or decelerate [74, 75]. In addition, the actuators also monitor the feedback variables and the feedback information will be used to generate new actuation decisions.Similar to traditional driving systems, action errors due to the failure of the actuators or the malfunction of the powertrain, controlling system, heat management system, or exhaust system may rise to safety problems. However, a human driver would be able to identify this type of safety issues during the driving and pull over within a short response time. How the vehicle learns in these scenarios and responds to these low-frequency but fatal malfunctions of major vehicular components would be challenging to the full automation driving system. Therefore, the accident reconstruction of traditional vehicles would also be important [76].


## 3.1.1. Perception Error

The perception layer is responsible for acquiring data from multiple sensing devices to perceive environmental conditions for real-time decision making [41, 43]. The development of AVs is primarily determined by the complexity, reliability, suitability, and maturity of sensing technology [43]. The sensors for environment perception include, but not limited to, light detection and ranging (LIDAR) sensors, cameras, radars, ultrasonic sensors, contact sensors, and global positioning system (GPS). The function and ability of various sensing technologies can be found somewhere else [44]. It should be noted that any errors in the perception of the status, location, and movement of the other road users, traffic signals, and other hazards may raise safety concerns for AVs.Figure2 summarizes the past and potential future AV technology evolution based on the specific sensing technology applied to the vehicle systems, and the information is obtained from [43, 45–55]. At the end of the 20th century, proprioceptive sensors including wheel sensors, inertial sensors, and odometry are widely employed in-vehicle systems for better vehicle dynamics stabilization to achieve the functions of traction control system, antilock braking system, electronic stability control, antiskid control, and electronic stability program. In the first decade of the 21st century, many efforts have been devoted to the information, warning, and comfort during the driving process with the help of exteroceptive sensors such as sonar, radar, lidar, vision sensors, infrared sensors, and global navigation satellite system. The vehicles enable the functions of navigation, parking assistance, adaptive cruise control, lane departure warning, and night vision [56]. In the past decade, sensor networks installed in both vehicle and road systems have been adopted in the modern transportation system for the purpose of automated and cooperative driving [46]. Advanced autonomous functions will be enabled, including collision avoidance and mitigation, and automated driving such that the drivers will be eventually released from the driving process. Depending on the level of vehicle automation, the perceived data may also come from the communication between the AVs and the corresponding infrastructure [57, 58], other vehicles [44, 59], the Internet [60], and cloud [60].Figure 2
Past and potential future evolution of autonomous vehicle technology.Hardware, software, and communication are the three major sources of perception errors. The perception system heavily relies on sensing technology; therefore, the perception errors may come from the hardware including sensors. For example, the degradation and failure of the sensors may cause server perception errors, confuse the decision system, and lead to dangerous driving behaviors. Therefore, reliable and fault-tolerant sensing technology will be a potential solution to such issues. In addition, the perception errors may also result from the malfunction of the software, and this type of error would cause misleading to the decision and action layers, which may either fail the mission tasks or cause safety problems [57]. Communication errors will become important when the AVs are approaching fully automation levels. The communication errors may come from errors resulted from the communication between the AVs and the corresponding infrastructure [57], other road users [44], and the Internet [60]. Interpersonal communication is a vital component of the modern transportation system [61]. Road users, including drivers, pedestrians, bicyclists, and construction workers communicate with each other to coordinate movements and ensure road safety, which are the basic requirements of AVs [62]. The communication methods include gestures, facial expressions, and vehicular devices, and the comprehension of these messages can be affected by a variety of factors including culture, context, and experience, and these factors are also the key challenges for AV technology [61].


## 3.1.2. Decision Error

The decision layer interprets all processed data from the perception layer, makes decisions, and generates the information required by the action layer [41, 63]. Situational awareness serves as the input of the decision-making system for short-term and long-term planning. The short-term involves trajectory generation, obstacle avoidance, and event and maneuver manager, while long-term planning involves mission planning and route planning [57, 64–66].The decision errors mainly come from the system or human factors. An efficient AV system will only take over the driving or warn the drivers when necessary, with a minimized false alarm rate but acceptable positive performance (e.g., safety level) [67]. As the AV technology is improved over time, the false alarm rate can be reduced significantly with sufficient accuracy and meet the requirements of the safety requirements [68]. However, if the algorithm is not able to detect all the hazards effectively and efficiently, the safety of AVs will be threatened. It should be pointed out that it may take a few seconds for the drivers occupied by secondary tasks to respond and take over the control from the automated vehicle [69–71], which bring uncertainties to the safe AV control.Unfortunately, AV technology is not yet completely reliable; therefore, the human driver has to take over the driving process, supervising, and monitoring the driving tasks when AV system fails or is limited by performance capability [69, 72]. In turn, the shifting role of a human driver in AV driving may lead to inattention, reduced situational awareness, and manual skill degradation [73]. Therefore, how to safely and effectively re-engage the driver when the autonomous systems fail should be considered in designing the AVs from a human-centered perspective.


## 3.1.3. Action Error

After receiving the command from the decision layer, the action controller will further control the steering wheel, throttle, or brake for a traditional engine to change the direction and accelerate or decelerate [74, 75]. In addition, the actuators also monitor the feedback variables and the feedback information will be used to generate new actuation decisions.Similar to traditional driving systems, action errors due to the failure of the actuators or the malfunction of the powertrain, controlling system, heat management system, or exhaust system may rise to safety problems. However, a human driver would be able to identify this type of safety issues during the driving and pull over within a short response time. How the vehicle learns in these scenarios and responds to these low-frequency but fatal malfunctions of major vehicular components would be challenging to the full automation driving system. Therefore, the accident reconstruction of traditional vehicles would also be important [76].


## 3.2. Accidents Caused by Other Road Users

According to the accidents related to AVs reported by State of California Department of Motor Vehicles [2, 77], the majority of the accidents related to the AVs are caused by the other parties on a public road. For example, vehicles, bicyclists, and angry or drunk pedestrians who share the same road with the AVs may behave abnormally, which is even difficult for a human driver to handle.It will be urgent to investigate what the advanced AVs will react with these hazardous scenarios, and it would not be surprising that this technology will dramatically reduce the fatal accidents on roads. However, the autonomous technology is still not mature enough to handle very complicated scenarios before some key issues could be solved, including the effective detection and prediction of hazardous behaviors caused by other road users, and the correct decision made by the autonomous system. The effective detection of hazards caused by the other road users is crucial for the AVs to make active decisions to avoid oncoming accidents. The AVs should decide if they need to take actions that may violate traffic regulations to avoid potential fatal or injurious accidents.


## 4. On-Road Testing and Reported Accidents

In this section, publicly available data for on-road AV testing including disengagement and accident reports have been analyzed for a direct understanding of the safety status of AVs. Two typical data sources from the California Department of Motor Vehicles (USA) and Beijing Innovation Center for Mobility Intelligent (China) are investigated in this section.


### 4.1. California Department of Motor Vehicles

Safety risks exposed during on-road testing, represented by disengagements and actual accidents, are reported by the State of California Department of Motor Vehicles [78, 79]. This section reviews the disengagement and accident reported by the State of California Department of Motor Vehicles as of April 2019, and 621 disengagement reports between 2014 and 2018 have been statistically analyzed.Figure3 shows the statistical status of the on-road AV testing in California reported by the Department of Motor Vehicles, in terms of cumulative mileage and breakdown of mileage and disengagements. The disengagements during an AV on-road test do not necessarily yield to traffic accidents, but they represent risk events that require the human operator to be alert and take over the automated vehicles [77, 78]. The 621 disengagement reports indicated that the total mileage of the AVs tested in California has reached 3.7 million miles (see Figure 3(a)), among which Google contributed 73% of the total autonomous driving mileage, followed by GM Cruise (13%), Baidu (4%), Apple (2%), and other manufacturers (8%) as shown Figure 3(b). In total 159,870 disengagement events have been reported, and the top four manufacturers are Apple (48%), Uber (44%), Bosch (2%), and Mercedes-Benz (1%). The disengagement events were categorized into two primary modes by Apple: manual takeovers and software disengagements [77]. Manual takeovers were recorded when the AV operators make the decisions to manually control the vehicles instead of automated systems when they deem necessary. These events can be caused by complicated actual driving conditions, including but not limited to emergency vehicles, construction zone, or unexpected objects around the roads. Software disengagements can be caused by the detection of an issue with perception, motion planning, controls, and communications. For example, if the sensors cannot sufficiently percept and track an object in the surrounding environments, human drivers will take over the driving process. The failure of generating a motion plan by the decision layer and the late or inappropriate response of the actuator will result in a disengagement event.Figure 3
(a) Cumulative mileage, (b) breakdown of mileage, and (c) breakdown of disengagements based on various manufacturers. (Data are statistically analyzed from the reports by the State of California Department of Motor Vehicles between September 2014 and November 2018; the data from Waymo and Google are combined and noted as Google in this figure).
(a)(b)(c)However, it should be noted that different manufacturers may have a different understanding of the disengagement events, which means the reported disengagement events may be incomplete for some companies. Figure4 presents the relation between disengagements per mile and total miles for different manufacturers. It can be seen that the manual takeover frequency varies significantly from 2 × 10−4 to 3 disengagements per mile for different manufacturers. The significant difference may primarily result from the maturity of the autonomous technology; however, the definition of disengagements at this early stage of the on-road testing may also contribute to the difference in disengagement frequency. Policymakers may play a vital role in the widely accepted definition of disengagement events, considering perception errors, decision errors, action errors, system fault, and other issues.Figure 4
Number of disengagements vs. autonomous miles according to reported data from various manufacturers.Figure5 indicates the breakdown of the actual AV accident reports in California between 2014 and 2018 from the Department of Motor Vehicles. 128 accident reports are statistically analyzed, and the top four reporters are GM Cruise (46%), Waymo (22%), Google (17%), and Zoox (5%). It should be noted that Waymo originated from the Google Self-Driving Car Project in 2009 [80]. Among these 128 accident reports in the past four years, 36.7% of the accidents occur during the conventional manual-control mode, while the remaining 63.3% are found in autonomous driving mode. This indicates that the autonomous technology still requires more intensive on-road testing before it can be completely applied to the AVs. It is also interesting to find that only a small portion (around 6.3%) of the total accidents is caused by the AVs, while 93.7% of the accidents are caused by the other parties, including pedestrians, cyclists, motorcycles, and conventional vehicles. This indicates that a further study on the potential operating strategy of the AVs to avoid passive accidents may dramatically improve AV safety.Figure 5
Breakdown of autonomous vehicle accident reports. (Data are statistically analyzed from the reports by the State of California Department of Motor Vehicles between September 2014 and November 2018).Figure6 indicates the relation between reportable accidents and the total mileage for the AVs tested in California. It can be seen before 2017 that the number of reportable accidents increases with the total testing mileage slowly with a rate of 1.7 × 10−5 accidents per mile; however, from 2017 to 2018, the increase rate becomes 4.9 × 10−5 accidents per mile, which is almost tripled. This is likely due to the advanced but immature technology applied to the recent tested AVs and the increasing number of AVs being tested simultaneously in California.Figure 6
Relation between cumulative accidents and cumulative autonomous miles. (The data shown in this figure are reported by the manufacturers as of April 2019.)


### 4.2. Beijing Innovation Center for Mobility Intelligent

The Beijing Innovation Center for Mobility Intelligent recently reported the on-road AV testing in restricted urban areas for the year of 2018 [27]. Since March, the autonomous driving mileage has reached 153,565 km (equivalent to 95,420 miles) at the end of December 2018 (see Figure 7(a)). The top four manufacturers are Baidu (90.8%), Pony.ai (5.6%), NIO (2.8%), and Daimler AG (0.5%). However, no disengagement and accident reports are available yet. It would be meaningful if the accident-related information can be available publicly, and the shared information could be beneficial for all manufacturers to promote the application of automated technology in vehicles and build the customers’ confidence in AVs.Figure 7
(a) Cumulative mileage and (b) breakdown of mileage contribution due to various manufacturers tested in Beijing in the year 2018.
(a)(b)


## 4.1. California Department of Motor Vehicles

Safety risks exposed during on-road testing, represented by disengagements and actual accidents, are reported by the State of California Department of Motor Vehicles [78, 79]. This section reviews the disengagement and accident reported by the State of California Department of Motor Vehicles as of April 2019, and 621 disengagement reports between 2014 and 2018 have been statistically analyzed.Figure3 shows the statistical status of the on-road AV testing in California reported by the Department of Motor Vehicles, in terms of cumulative mileage and breakdown of mileage and disengagements. The disengagements during an AV on-road test do not necessarily yield to traffic accidents, but they represent risk events that require the human operator to be alert and take over the automated vehicles [77, 78]. The 621 disengagement reports indicated that the total mileage of the AVs tested in California has reached 3.7 million miles (see Figure 3(a)), among which Google contributed 73% of the total autonomous driving mileage, followed by GM Cruise (13%), Baidu (4%), Apple (2%), and other manufacturers (8%) as shown Figure 3(b). In total 159,870 disengagement events have been reported, and the top four manufacturers are Apple (48%), Uber (44%), Bosch (2%), and Mercedes-Benz (1%). The disengagement events were categorized into two primary modes by Apple: manual takeovers and software disengagements [77]. Manual takeovers were recorded when the AV operators make the decisions to manually control the vehicles instead of automated systems when they deem necessary. These events can be caused by complicated actual driving conditions, including but not limited to emergency vehicles, construction zone, or unexpected objects around the roads. Software disengagements can be caused by the detection of an issue with perception, motion planning, controls, and communications. For example, if the sensors cannot sufficiently percept and track an object in the surrounding environments, human drivers will take over the driving process. The failure of generating a motion plan by the decision layer and the late or inappropriate response of the actuator will result in a disengagement event.Figure 3
(a) Cumulative mileage, (b) breakdown of mileage, and (c) breakdown of disengagements based on various manufacturers. (Data are statistically analyzed from the reports by the State of California Department of Motor Vehicles between September 2014 and November 2018; the data from Waymo and Google are combined and noted as Google in this figure).
(a)(b)(c)However, it should be noted that different manufacturers may have a different understanding of the disengagement events, which means the reported disengagement events may be incomplete for some companies. Figure4 presents the relation between disengagements per mile and total miles for different manufacturers. It can be seen that the manual takeover frequency varies significantly from 2 × 10−4 to 3 disengagements per mile for different manufacturers. The significant difference may primarily result from the maturity of the autonomous technology; however, the definition of disengagements at this early stage of the on-road testing may also contribute to the difference in disengagement frequency. Policymakers may play a vital role in the widely accepted definition of disengagement events, considering perception errors, decision errors, action errors, system fault, and other issues.Figure 4
Number of disengagements vs. autonomous miles according to reported data from various manufacturers.Figure5 indicates the breakdown of the actual AV accident reports in California between 2014 and 2018 from the Department of Motor Vehicles. 128 accident reports are statistically analyzed, and the top four reporters are GM Cruise (46%), Waymo (22%), Google (17%), and Zoox (5%). It should be noted that Waymo originated from the Google Self-Driving Car Project in 2009 [80]. Among these 128 accident reports in the past four years, 36.7% of the accidents occur during the conventional manual-control mode, while the remaining 63.3% are found in autonomous driving mode. This indicates that the autonomous technology still requires more intensive on-road testing before it can be completely applied to the AVs. It is also interesting to find that only a small portion (around 6.3%) of the total accidents is caused by the AVs, while 93.7% of the accidents are caused by the other parties, including pedestrians, cyclists, motorcycles, and conventional vehicles. This indicates that a further study on the potential operating strategy of the AVs to avoid passive accidents may dramatically improve AV safety.Figure 5
Breakdown of autonomous vehicle accident reports. (Data are statistically analyzed from the reports by the State of California Department of Motor Vehicles between September 2014 and November 2018).Figure6 indicates the relation between reportable accidents and the total mileage for the AVs tested in California. It can be seen before 2017 that the number of reportable accidents increases with the total testing mileage slowly with a rate of 1.7 × 10−5 accidents per mile; however, from 2017 to 2018, the increase rate becomes 4.9 × 10−5 accidents per mile, which is almost tripled. This is likely due to the advanced but immature technology applied to the recent tested AVs and the increasing number of AVs being tested simultaneously in California.Figure 6
Relation between cumulative accidents and cumulative autonomous miles. (The data shown in this figure are reported by the manufacturers as of April 2019.)


## 4.2. Beijing Innovation Center for Mobility Intelligent

The Beijing Innovation Center for Mobility Intelligent recently reported the on-road AV testing in restricted urban areas for the year of 2018 [27]. Since March, the autonomous driving mileage has reached 153,565 km (equivalent to 95,420 miles) at the end of December 2018 (see Figure 7(a)). The top four manufacturers are Baidu (90.8%), Pony.ai (5.6%), NIO (2.8%), and Daimler AG (0.5%). However, no disengagement and accident reports are available yet. It would be meaningful if the accident-related information can be available publicly, and the shared information could be beneficial for all manufacturers to promote the application of automated technology in vehicles and build the customers’ confidence in AVs.Figure 7
(a) Cumulative mileage and (b) breakdown of mileage contribution due to various manufacturers tested in Beijing in the year 2018.
(a)(b)


## 5. Opportunities and Challenges

AV technology will benefit from various perspectives by improving transportation safety, reducing traffic congestion, releasing humans from the driving process, and impacting our community both economically and environmentally [81–84]. Therefore, advanced AV technology has gained increasing interests in both academia and industry, which indicates a variety of opportunities for the development of AVs. However, the AVs require extensive experimental efforts before they can be promoted in markets, and new challenges from the adopted software, hardware, vehicle system, infrastructure, and other road users have to be addressed.


### 5.1. Opportunities

One argument for AV technology development is that many traditional job opportunities will be eliminated. However, as technology is developed, more jobs, in reality, will be created. The AV development requires extensive testing on software, hardware, vehicle components, vehicle system, sensing devices, communication systems, and other multidisciplinary fields. With the AV technology, human operators can be released from the driving process, and time can be better managed. People will work, play, and study more efficiently due to the promotion of AV technology. In addition, the current lifestyle would be altered. For instance, the ways of driving training and driver’s license test would be changed. In other words, not only the AV-related field but also the non-AV industry can be promoted.AV techniques can also change the traditional way of transportation. The demands of releasing vehicle operators from driving have driven the development of intelligent vehicle grid with the help of a platform of sensors to collect information from the surrounding environment including other road users and road signs. These signals will be provided to the drivers and infrastructures to enable safe navigation, to reduce emission, to improve fuel economy, and to manage traffic efficiently. Stern et al. carried out a ring road experiment involving both autonomous and human-operated vehicles, and their results indicate that a single AV can be used to control the traffic flow of at least 20 human-operated vehicles with significant improvements in vehicle velocity standard deviation, excessive braking, and fuel economy [85]. Liu and Song investigated two types of lanes designed for AVs: dedicated AV lane and AV/toll lane [86]. The dedicated AV lane only allows AVs to pass, while AV/toll lane permits human-operated vehicles to pass by paying extra fees, and their modeling results indicate that the system performance can be improved by utilizing both of the two methods [86]. Gerla et al. reviewed the Internet of Vehicles capable of communications, storage, intelligence, and self-learning [60]. Their work indicated that the communication between vehicles and the Internet will dramatically change the way of public transportation, making traditional transportation more efficient and cleaner. Therefore, traditional transportation systems have to be modified for AVs.Driving simulators have drawn significant attention to reproduce the automatic driving conditions and accident scenarios in a virtual reality environment. Owing to the driving simulators, the driving behaviors, take-over request, car-following maneuver, and other human factors can be efficiently studied [69–71, 87]. This can minimize the risk putting drivers in dangerous environment and simulate the decision-making process and the associated consequence.


### 5.2. Challenges

The wide application of AVs still remains challenging due to safety issues. The AVs will be promoted if the following challenges can be further addressed:


#### 5.2.1. Minimizing Perception Errors

To effectively detect, localize, and categorize the objects in the surrounding environment will be challenging to minimize perception errors. In addition, the perception and comprehension of human behaviors including posture, voice, and motion will be important for AV safety.


#### 5.2.2. Minimizing Decision Errors

To correctly and timely respond to the ambient environment, a reliable, robust, and efficient decision-making system should be developed. This should be achieved through extensive and strict hardware and software testing. In addition, how to make correct decisions under complicated scenarios is still difficult, e.g., what should be the decision if the AVs will have to hurt pedestrians to avoid fatal accidents due to sudden system faults or mechanical failures.


#### 5.2.3. Minimizing Action Errors

To achieve safe AVs, actuators should be able to communicate with the decision systems and execute the commands either from human operators or automated systems with high reliability and stability.


#### 5.2.4. Cyber-Security

As the autonomous technology develops, the AVs will have to wirelessly communicate with road facilities, satellites, and other vehicles (e.g., vehicular cloud). How to make sure the cyber-security will be one of the biggest concerns for AVs [88].


#### 5.2.5. Interaction with Traditional Transportation System

The AVs and traditional vehicles will share the public roads in urban areas, and the interaction between AVs and other road users including traditional vehicles and pedestrians will be challenging [89]. For the other road users, it is difficult to identify the types of vehicles that they are interacting with. For pedestrians, this uncertainty may lead to stress and altered crossing decisions, especially when the AV driver is occupied by other tasks and does not make eye contact with other pedestrians [56]. Rodríguez Palmeiro et al.’s work suggested that fine-grained behavioral measures, such as eye-tracking, can be further investigated to determine how pedestrians react to AVs [4].


#### 5.2.6. Customer Acceptance

The major factors limiting the commercialization of AVs include safety [90], cost [17, 91], and public interests [92–97], among which safety is the most paramount issues that can significantly affect the public attitude towards the emerging AV technology.


## 5.1. Opportunities

One argument for AV technology development is that many traditional job opportunities will be eliminated. However, as technology is developed, more jobs, in reality, will be created. The AV development requires extensive testing on software, hardware, vehicle components, vehicle system, sensing devices, communication systems, and other multidisciplinary fields. With the AV technology, human operators can be released from the driving process, and time can be better managed. People will work, play, and study more efficiently due to the promotion of AV technology. In addition, the current lifestyle would be altered. For instance, the ways of driving training and driver’s license test would be changed. In other words, not only the AV-related field but also the non-AV industry can be promoted.AV techniques can also change the traditional way of transportation. The demands of releasing vehicle operators from driving have driven the development of intelligent vehicle grid with the help of a platform of sensors to collect information from the surrounding environment including other road users and road signs. These signals will be provided to the drivers and infrastructures to enable safe navigation, to reduce emission, to improve fuel economy, and to manage traffic efficiently. Stern et al. carried out a ring road experiment involving both autonomous and human-operated vehicles, and their results indicate that a single AV can be used to control the traffic flow of at least 20 human-operated vehicles with significant improvements in vehicle velocity standard deviation, excessive braking, and fuel economy [85]. Liu and Song investigated two types of lanes designed for AVs: dedicated AV lane and AV/toll lane [86]. The dedicated AV lane only allows AVs to pass, while AV/toll lane permits human-operated vehicles to pass by paying extra fees, and their modeling results indicate that the system performance can be improved by utilizing both of the two methods [86]. Gerla et al. reviewed the Internet of Vehicles capable of communications, storage, intelligence, and self-learning [60]. Their work indicated that the communication between vehicles and the Internet will dramatically change the way of public transportation, making traditional transportation more efficient and cleaner. Therefore, traditional transportation systems have to be modified for AVs.Driving simulators have drawn significant attention to reproduce the automatic driving conditions and accident scenarios in a virtual reality environment. Owing to the driving simulators, the driving behaviors, take-over request, car-following maneuver, and other human factors can be efficiently studied [69–71, 87]. This can minimize the risk putting drivers in dangerous environment and simulate the decision-making process and the associated consequence.


## 5.2. Challenges

The wide application of AVs still remains challenging due to safety issues. The AVs will be promoted if the following challenges can be further addressed:


### 5.2.1. Minimizing Perception Errors

To effectively detect, localize, and categorize the objects in the surrounding environment will be challenging to minimize perception errors. In addition, the perception and comprehension of human behaviors including posture, voice, and motion will be important for AV safety.


### 5.2.2. Minimizing Decision Errors

To correctly and timely respond to the ambient environment, a reliable, robust, and efficient decision-making system should be developed. This should be achieved through extensive and strict hardware and software testing. In addition, how to make correct decisions under complicated scenarios is still difficult, e.g., what should be the decision if the AVs will have to hurt pedestrians to avoid fatal accidents due to sudden system faults or mechanical failures.


### 5.2.3. Minimizing Action Errors

To achieve safe AVs, actuators should be able to communicate with the decision systems and execute the commands either from human operators or automated systems with high reliability and stability.


### 5.2.4. Cyber-Security

As the autonomous technology develops, the AVs will have to wirelessly communicate with road facilities, satellites, and other vehicles (e.g., vehicular cloud). How to make sure the cyber-security will be one of the biggest concerns for AVs [88].


### 5.2.5. Interaction with Traditional Transportation System

The AVs and traditional vehicles will share the public roads in urban areas, and the interaction between AVs and other road users including traditional vehicles and pedestrians will be challenging [89]. For the other road users, it is difficult to identify the types of vehicles that they are interacting with. For pedestrians, this uncertainty may lead to stress and altered crossing decisions, especially when the AV driver is occupied by other tasks and does not make eye contact with other pedestrians [56]. Rodríguez Palmeiro et al.’s work suggested that fine-grained behavioral measures, such as eye-tracking, can be further investigated to determine how pedestrians react to AVs [4].


### 5.2.6. Customer Acceptance

The major factors limiting the commercialization of AVs include safety [90], cost [17, 91], and public interests [92–97], among which safety is the most paramount issues that can significantly affect the public attitude towards the emerging AV technology.


## 5.2.1. Minimizing Perception Errors

To effectively detect, localize, and categorize the objects in the surrounding environment will be challenging to minimize perception errors. In addition, the perception and comprehension of human behaviors including posture, voice, and motion will be important for AV safety.


## 5.2.2. Minimizing Decision Errors

To correctly and timely respond to the ambient environment, a reliable, robust, and efficient decision-making system should be developed. This should be achieved through extensive and strict hardware and software testing. In addition, how to make correct decisions under complicated scenarios is still difficult, e.g., what should be the decision if the AVs will have to hurt pedestrians to avoid fatal accidents due to sudden system faults or mechanical failures.


## 5.2.3. Minimizing Action Errors

To achieve safe AVs, actuators should be able to communicate with the decision systems and execute the commands either from human operators or automated systems with high reliability and stability.


## 5.2.4. Cyber-Security

As the autonomous technology develops, the AVs will have to wirelessly communicate with road facilities, satellites, and other vehicles (e.g., vehicular cloud). How to make sure the cyber-security will be one of the biggest concerns for AVs [88].


## 5.2.5. Interaction with Traditional Transportation System

The AVs and traditional vehicles will share the public roads in urban areas, and the interaction between AVs and other road users including traditional vehicles and pedestrians will be challenging [89]. For the other road users, it is difficult to identify the types of vehicles that they are interacting with. For pedestrians, this uncertainty may lead to stress and altered crossing decisions, especially when the AV driver is occupied by other tasks and does not make eye contact with other pedestrians [56]. Rodríguez Palmeiro et al.’s work suggested that fine-grained behavioral measures, such as eye-tracking, can be further investigated to determine how pedestrians react to AVs [4].


## 5.2.6. Customer Acceptance

The major factors limiting the commercialization of AVs include safety [90], cost [17, 91], and public interests [92–97], among which safety is the most paramount issues that can significantly affect the public attitude towards the emerging AV technology.


## 6. Summary and Concluding Remarks

Fully autonomous vehicles (AVs) will allow the vehicles to be operated entirely by automated systems, facilitating the engagements of the human operators into tasks other than driving. AV technology will benefit both individuals and community; however, safety concern remains the technical challenges to the successful commercialization of AVs. In this review article, the levels of automation defined by different organizations in different fields are summarized and compared. The definitions of automation levels by the Society of Automotive Engineer (SAE) are widely adopted by automotive engineering for AVs. A theoretical analysis of the types of existing and potential types of accidents for AVs is conducted based on typical AV architectures, including perception, decision, and action systems. In addition, the on-road AV disengagement and accident reports available publicly are statistically analyzed. The on-road testing results in California indicate that more than 3.7 million miles have been tested for AVs by various manufacturers between 2014 and 2018. The AVs are frequently manually taken over by human operators, and the disengagement frequency varies significantly from 2 × 10−4 to 3 disengagements per mile based on different manufacturers. In addition, 128 accidents are reported over 3.7 million miles, and approximately 63.3% of the total accidents occur when driving in autonomous mode. A small portion (around 6.3%) of the total accidents is directly related to the AVs, while 93.7% of the accidents are passively initiated by the other parties, including pedestrians, cyclists, motorcycles, and conventional vehicles. These safety risks exposed during on-road testing, represented by disengagements and actual accidents, indicate that the passive accidents which are caused by other road users are the majority. This implies that alerting and avoiding safety risks caused by the other parties will be of great significance to make safe decisions to prevent fatal accidents.



---

*Source: 8867757-2020-10-06.xml*