Commission Implementing Regulation (EU) 2022/1426 of 5 August 2022 laying down rules for the application of Regulation (EU) 2019/2144 of the European Parliament and of the Council as regards uniform procedures and technical specifications for the type-approval of the automated driving system (ADS) of fully automated vehicles (Text with EEA relevance)

Article 1

Scope

This Regulation applies to the type-approval of fully automated vehicles of category M and N, with regard to their automated driving system, for the following use cases:

• (a) Fully automated vehicles, including dual mode vehicles, designed and constructed for the carriage of passengers or carriage of goods on a predefined area.

• (b) ‘Hub-to-hub’: fully automated vehicles, including dual mode vehicles, designed and constructed for the carriage of passengers or carriage of goods on a predefined route with fixed start and end points of a journey/trip.

• (c) ‘Automated valet parking’ (‘AVP’): vehicles with an automated driving system (‘ADS’) feature for parking applications within an operational design domain (‘ODD’). The system may use or not external infrastructure (including, where relevant, localization markers and perception sensors) to perform the dynamic driving task.

The manufacturer may apply for the individual or the type-approval under this Regulation of the automated driving system of vehicles defined in Article 2(3) of Regulation (EU) 2018/858, provided that those vehicles fulfil the requirements of this Regulation.

Article 2

Definitions

In addition to the definitions in Regulation (EU) 2018/858 and Regulation (EU) 2019/2144, for the purpose of this regulation, the following definitions shall apply:

• 1. ‘Automated Driving System’ (ADS) means the hardware and software that are collectively capable of performing the entire DDT on a sustained basis in a specific operational design domain (ODD).

• 1. ‘ADS feature’ means an application of an ADS designed specifically for use within an ODD.

• 1. ‘ADS function’ means an application of ADS hardware and software designed to perform a specific portion of the DDT.

• 1. ‘dynamic driving task (‘DDT’)’ means all real time operational functions and tactical functions required to operate the vehicle, excluding strategic functions such as trip scheduling and selection of destinations and waypoints and including without limitation the following subtasks:
• (a) Lateral vehicle motion control via steering (operational);
• (b) Longitudinal vehicle motion control via acceleration and deceleration (operational);
• (c) Monitoring the driving environment via object and event detection, recognition, classification, and response preparation (operational and tactical);
• (d) Object and event response execution (operational and tactical);
• (e) Manoeuvre planning (tactical);
• (f) Enhancing conspicuity via lighting, sounding the horn, signalling, gesturing, etc. (tactical).

• 1. ‘operational function’ means a capability to control the real-time motion of the vehicle, which involves executing micro-changes in steering, braking, and accelerating to maintain lane position or proper vehicle separation and immediate responsive actions to avoid crashes in critical driving situations.

• 1. ‘tactical function’ means a capability to perceive the vehicle environment and control real-time planning, decision, and execution of manoeuvres, including conspicuity of the vehicle and its motion and which includes deciding whether to overtake a vehicle or change lanes, signalling intended manoeuvres, deciding when to initiate the manoeuvre, choosing the proper speed, and executing the manoeuvre.

• 1. ‘fault’ means an abnormal condition that can cause a failure. This can concern hardware or software.

• 1. ‘failure’ means the termination of an intended behaviour of a component or a system of the ADS due to a fault manifestation.

• 1. ‘in-service monitoring’ means data collected by the manufacturer and data from other sources, to get evidence on the in-service safety performance of the ADS in the field.

• 1. ‘in-service reporting’ means data reported by the manufacturer to demonstrate evidence on the in-service safety performance of the ADS in the field.

• 1. ‘lifetime of the ADS’ means the period of time during which the ADS system is available on the vehicle.

• 1. ‘lifecycle of the ‘ADS’ means the period of time that consists of the design, development, production, field operation, service and decommissioning phases.

• 1. ‘malfunctioning behaviour’ means a failure or unintended behaviour of a component or a system of the ADS with respect to its design intent.

• 1. ‘minimal risk manoeuvre (‘MRM’)’ means a manoeuvre aimed at minimising risks in traffic by stopping the vehicle in a safe condition (i.e. minimal risk conditions).

• 1. ‘minimal risk condition (‘MRC’)’ means stable and stopped state of the vehicle that reduces the risk of a crash.

• 1. ‘operational design Domain (‘ODD’)’ means operating conditions under which a given ADS is specifically designed to function, including, but not limited to, environmental, geographical, and time-of-day restrictions, and/or the requisite presence or absence of certain traffic or roadway characteristics.

• 1. ‘object and event detection and response’ (‘OEDR’) means subtasks of the dynamic driving task that include monitoring the driving environment and executing an appropriate response. It includes detecting, recognizing, and classifying objects and events and preparing and executing responses as needed.

• 1. ‘scenario’ means a sequence or combination of situations used to assess the safety requirements for an ADS.

• 1. ‘nominal traffic scenarios’ means reasonably foreseeable situations encountered by the ADS when operating within its ODD. These scenarios represent the non-critical interactions of the ADS with other traffic participants and generate normal operation of the ADS.

• 1. ‘critical scenarios’ means scenarios related to edge-cases (e.g. unexpected conditions with an exceptionally low probability of occurrence) and operational insufficiencies, not limited to traffic conditions but also including environmental conditions (e.g. heavy rain or low sunlight glaring cameras), human factors, connectivity and miscommunication leading to emergency operation of the ADS.

• 1. ‘failure scenarios’ means the scenarios related to ADS and/or vehicle components failure which may lead to normal or emergency operation of the ADS depending on whether or not the minimum safety level is preserved.

• 1. ‘normal operation’ means the ADS operation within specified operational limits and conditions to perform the designed activity.

• 1. ‘emergency operation’ means the ADS operation due to the occurrence of events requiring prompt action to mitigate adverse consequences on human health or property damage.

• 1. ‘on-board operator’ means, where applicable to the ADS safety concept, a person located inside the fully automated vehicle who may:
• (a) activate, re-initialise, deactivate the ADS,
• (b) request the ADS to start an MRM,
• (c) confirm a manoeuvre proposed by the ADS while the vehicle is at standstill,
• (d) after an MRM, while the fully automated vehicle is at standstill, request the ADS to perform safely a low speed manoeuvre limited to 6 km/h with the remaining performance to evacuate the fully automated vehicle to a nearby preferable location.
• (e) select or modify the planning of an itinerary or stopping points for the users; or
• (f) provides assistance in duly identified situations to the passengers of the fully automated vehicle. In the above situations, the on-board operator shall not drive the fully automated vehicle and the ADS shall continue to perform the DDT.

• 1. ‘remote intervention operator’ means, where applicable to the ADS safety concept, person(s) located outside the fully automated vehicle who may remotely achieve the tasks of the on-board operator provided it is safe to do so. The remote intervention operator shall not drive the fully automated vehicle and the ADS shall continue to perform the DDT.

• 1. ‘remote capabilities’ mean capabilities specifically designed to support remote intervention.

• 1. ‘R2022/1426 Software Identification Number (R2022/1426SWIN)’ means a dedicated identifier, defined by the manufacturer, representing information about the type approval relevant software of the ADS contributing to the type approval relevant characteristics of the ADS.

• 1. ‘unreasonable risk’ means the overall level of risk for the vehicle occupants and other road users which is increased compared to a manually driven vehicle in comparable transportation services and situations within the operational design domain.

• 1. ‘functional safety’: absence of unreasonable risks under the occurrence of hazards caused by malfunctioning behaviour.

• 1. ‘operational safety’ means the absence of unreasonable risk under the occurrence of hazards resulting from functional insufficiencies of the intended functionality (e.g. false/missed detection), operational disturbances (e.g. environmental conditions like fog, rain, shadows, sunlight, infrastructure) or by reasonably foreseeable misuse/errors by the vehicle occupants and other road users (i.e. safety hazards – without system faults).

• 1. ‘control strategy’ means a strategy to ensure robust and safe operation of the ADS in response to a specific set of ambient and/or operating conditions (such as road surface condition, other road users, adverse weather conditions, imminent collision risk, failures, reaching ODD boundaries, etc.). This may include temporary performance restrictions (e.g. a reduction in the maximum operating speed, etc.), MRM manoeuvres, collision avoidance or mitigation, remote intervention, etc.

• 1. ‘Time to Collision’ (TTC) means the time before a collision happens between involved vehicles/objects/subjects if their speeds would not change and taking into account their paths. For pure longitudinal situations with constant speeds, unless differently specified in the text, the TTC is obtained by dividing the longitudinal distance (in the direction of travel of the subject vehicle) between the subject vehicle and the other vehicles/objects/subjects by the longitudinal relative speed of the subject vehicle and the other vehicles/objects/subjects. For pure crossing situations with constant speeds, unless differently specified in the text, this is obtained by dividing the longitudinal distance between the subject vehicle and the lateral line of movement of the other vehicles/objects/subjects by the longitudinal velocity of the subject vehicle.

• 1. ‘vehicle type with regard to the ADS’ means fully automated vehicles which do not differ in such essential aspects as:
• (a) vehicle features which significantly influence the performances of ADS;
• (b) the system characteristics and design of ADS.

• 1. ‘dual mode vehicles’ means fully automated vehicles with a driver seat designed and constructed:
• (a) to be driven by the driver in the ‘manual driving mode’ and
• (b) to be driven by the ADS without any driver supervision in the ‘fully automated driving mode’. For dual mode vehicles, the transition between the manual driving mode and the fully automated mode, as well the transition between the fully automated mode and the manual mode may only occur when the vehicle is at standstill, not when the vehicle is moving.

• 1. ‘transport service operator’ means the entity providing a transport service using one or more fully automated vehicles.

Article 3

Administrative provisions and technical specifications for the type-approval of the automated driving system of fully automated vehicles

In addition to the requirements set out in the first subparagraph, the type approval of the AVP features of ADS shall be subject to the technical specifications set out in Annex V. Those specifications shall be assessed by the approval authorities or their technical services in accordance with Annex V.

Article 4

Entry into force

This Regulation shall enter into force on the twentieth day following that of its publication in the Official Journal of the European Union.

This Regulation shall be binding in its entirety and directly applicable in all Member States.

ANNEX I

Information document for EU type-approval of fully automated vehicles with regard to their automated driving system

MODEL

Information document No … relating to the EU type-approval of a type of a fully automated vehicle with regard to the automated driving system (ADS).

The following information shall be supplied in triplicate and include a list of contents. Any drawings or pictures shall be supplied in appropriate scale and in sufficient detail on size A4 or on a folder of A4 format. Photographs, if any, shall show sufficient detail.

• 0.GENERAL

• 0.1.Make (trade name of manufacturer):

• 0.2.Type:

• 0.2.1.Commercial name(s) (if available):

• 0.2.2For multi-stage approved vehicles, type-approval information of the base/previous stage vehicle, list the information for each stage. (This can be done with a matrix)

• Type:

• Variant(s):

• Version(s):

• Number of the type-approval certificate including extension number …

• 0.3.Means of identification of type, if marked on the vehicle/component/separate technical unit:

• 0.3.1.Location of that marking:

• 0.4.Category of vehicle:

• 0.5.Company name and address of manufacturer:

• 0.5.1For multi-stage approved vehicles, company name and address of the manufacturer of the base/previous stage(s) vehicle: …

• 0.6Location and method of attachment of statutory plates and location of vehicle identification number: …

• 0.6.1.On the chassis: …

• 0.6.2.On the bodywork: …

• 0.8.Name(s) and address(es) of assembly plant(s):

• 0.9.Name and address of the manufacturer’s representative (if any):

• 17.AUTOMATED DRIVING SYSTEM (ADS)

• 17.1.General ADS description

• 17.1.1.Operational design domain/Boundary conditions

• 17.1.2.Basic Performance (e.g. Object and Event Detection and Response, planning, etc.)

• 17.2.Description of the functions of the ADS

• 17.2.1.Main ADS Functions (functional architecture)

• 17.2.1.1.Vehicle-internal functions

• 17.2.1.2.Vehicle-external functions (e.g. backend, off-board infrastructure needed, operational measures needed)

• 17.3.Overview of the major components of the ADS

• 17.3.1.Control units

• 17.3.2.Sensors and installation of the sensors on the vehicle

• 17.3.3.Actuators

• 17.3.4.Maps and positioning

• 17.3.5.Other hardware

• 17.4.ADS layout and schematics

• 17.4.1.Schematic system layout (e.g. block diagram)

• 17.4.2.List and schematic overview of interconnections

• 17.5.Specifications

• 17.5.1.Specifications in normal operation

• 17.5.2.Specifications in emergency operation

• 17.5.3.Acceptance criteria

• 17.5.4Demonstration of compliance

• 17.6.Safety concept

• 17.6.1.Manufacturer Statement that the vehicle is free from unreasonable risks

• 17.6.2.Outline of the software architecture(e.g. block diagram)

• 17.6.3.Means by which the realization of ADS logic is determined

• 17.6.4.General explanation of the main design provisions built into the ADS so as to generate safe operation under fault conditions, under operational disturbances and the occurrence of conditions that would exceed the ODD

• 17.6.5General description of failure handling main principles, fall-back level strategy including risk mitigation strategy (minimal risk manoeuvre)

• 17.6.6.Conditions for triggering a request to the on-board operator or the remote intervention operator

• 17.6.7.Human machine interaction concept with vehicle occupants, on-board operator and remote intervention operator including protection against simple unauthorised activation/operation and Interventions

• 17.7.Verification and validation by the manufacturer of the performance requirements including the OEDR, the HMI, the respect of traffic rules and the conclusion that the system is designed in such a way that it is free from unreasonable risks for vehicle occupants and other road users

• 17.7.1.Description of the adopted approach

• 17.7.2.Selection of nominal, critical and failure scenarios

• 17.7.3.Description of the used methods and tools (software, laboratory, others) and summary of the credibility assessment

• 17.7.4.Description of the results

• 17.7.5.Uncertainty of the results

• 17.7.6.Interpretation of the results

• 17.7.7.Manufacturer’s declaration:

• The manufacturer(s) … affirm(s) that the ADS is free of unreasonable safety risks to the vehicle occupants and other road users.

• 17.8.ADS data elements

• 17.8.1.Type of data stored

• 17.8.2.Storage location

• 17.8.3.Recorded occurrences and data elements

• 17.8.4.Means to ensure data security and data protection

• 17.8.5.Means to access the data

• 17.9.Cyber security and software update

• 17.9.1.Cyber Security type-approval number:

• 17.9.2.Number of the certificate of compliance for cyber-security management system:

• 17.9.3.Software update type-approval number:

• 17.9.4.Number of the certificate of compliance for software-update management system

• 17.9.5.Software Identification of the ADS

• 17.9.5.1.Information on how to read the RxSWIN or software version(s) in case the RxSWIN is not held on the vehicle.

• 17.9.5.2.If applicable, list the relevant parameters that will allow the identification of those vehicles that can be updated with the software represented by the RxSWIN under item 17.9.4.1.

• 17.10.Operating manual (to be annexed to the information document)

• 17.10.1.Functional description of the ADS and expected role of the owner, transport service operator, on board operator, remote intervention operator, etc.

• 17.10.2.Technical measures for safe operation (e.g. description of the necessary off-board infrastructure, timing, frequency and template of maintenance operations);

• 17.10.3.Operational and environment restrictions

• 17.10.4.Operational measures (e.g. if on-board operator or remote intervention operator needed)

• 17.10.5.Instructions in case of failures and ADS request (safety measures by vehicle occupants, transport service operator, on board operator and remote intervention operator and public authorities to be taken in the event of malfunctioning of the operation)

• 17.11.Means to enable periodic road worthiness tests

• List of Figures/Tables

• Acronyms

• Annex I – Simulation Handbook

• Annex II – Operating Manual

Explanatory note

This information document comprises the information relevant for the automated driving system and shall be completed in accordance with the template laid down in Annex I to Commission Implementing Regulation (EU) 2020/683.

ANNEX II

Performance requirements

1. DDT under nominal traffic scenarios.

• 1.1.The ADS shall be capable of performing the entire DDT.

• 1.1.1.The capability of the ADS to perform the entire DDT shall be determined in the context of the ODD of the ADS.

• 1.1.2.As part of the DDT, the ADS shall be able to:

• (a) operate at safe speeds and respect speed limitations applicable to the vehicle;

• (b) maintain appropriate distances from other road users by controlling the longitudinal and lateral motion of the vehicle;

• (c) adapt its behaviour to the surrounding traffic conditions (e.g., by avoiding disruption to the flow of traffic) in an appropriate safety oriented way;

• (d) adapt its behaviour in line with safety risks and give the highest priority to the protection of human life;

• 1.1.3.The system shall demonstrate anticipatory behaviour in interaction with other road user(s), in order to ensure stable, low-dynamic, longitudinal behaviour and risk minimising behaviour when critical situations could become imminent, e.g. with unobstructed and obstructed vulnerable road users (pedestrians, cyclist, etc.) or with other vehicles crossing or cutting-in in front of the fully automated vehicle.

• 1.1.4.The requirements related to the DDT shall be fulfilled in the reverse direction if the reverse gear is required by or declared in the ODD,

• 1.2The ADS shall detect and respond appropriately to objects and events relevant for the DDT within the ODD.

• Objects and events might include, but are not limited, to:

• (a) motor vehicles and other road user such as motorcycles, bicycles, scooters, wheelchair users, pedestrians, and obstacles (e.g. debris, lost cargo);

• (b) road accidents;

• (c) traffic congestions;

• (d) road works;

• (e) road safety officers and law enforcement agents;

• (f) emergency vehicles;

• (g) traffic signs, road markings;

• (h) environmental conditions (e.g. lower speed due to rain, snow).

• 1.3.The ADS shall comply with traffic rules of the country of operation

• 1.3.1.The ADS shall interact safely with other road users in accordance with traffic rules, such as via:

• (a) signalling manoeuvre intentions (e.g. direction indicator).

• (b) using the audible warning device where appropriate.

• (c) interacting safely with road safety officers/law enforcement agents, road maintenance workers, emergency service personnel, road inspectors, etc.

• (d) for dual mode vehicles, the ADS status (manual driving mode or fully automated driving mode) shall be recognizable for road safety officers/law enforcement agents

• 1.3.2.In the absence of specific traffic rules, vehicles with ADS intended to carry standing or unrestrained vehicle occupants shall not exceed a combined horizontal acceleration of 2,4 m/s² (in absolute value and calculated as the combination of lateral and longitudinal acceleration), and an acceleration rate of change of 5 m/s³.

• Depending on the factors influencing the risk to occupants and other road users, it might be appropriate to exceed these limits, such as emergency operations.

2. DDT under critical traffic scenarios (emergency operation).

• 2.1The ADS shall be able to perform the DDT for all reasonably foreseeable critical traffic scenarios in the ODD.

• 2.1.1.The ADS shall be able to detect the risk of collision with other road users, or a suddenly appearing obstacle (debris, lost load) and shall be able to automatically perform appropriate emergency operation (braking, evasive steering) to avoid reasonably foreseeable collisions and minimise risks to safety of the vehicle occupants and other road users.

• 2.1.1.1.In the event of an unavoidable alternative risk to human life, the ADS shall not provide for any weighting on the basis of personal characteristics of humans.

• 2.1.1.2.The protection of other human life outside the fully automated vehicle shall not be subordinated to the protection of human life inside the fully automated vehicle.

• 2.1.2.The vulnerability of road users involved should be taken into account by the avoidance/mitigation strategy.

• 2.1.3.After the evasive manoeuvre the vehicle shall aim to resume a stable motion as soon as technically possible.

• 2.1.4.The signal to activate the hazard warning lights shall be generated automatically in accordance with traffic rules. If the fully automated vehicle automatically drives off again, the signal to deactivate the hazard warning lights shall be generated automatically.

• 2.1.5.In the event of a traffic accident involving the fully automated vehicle, the ADS shall aim to stop the fully automated vehicle and aim to perform a Minimal risk Manoeuvre to reach the Minimal risk Condition. ADS resuming normal operation shall not be possible until the safe operational state of the fully automated vehicles has been confirmed by self-checks of the ADS or/and the on- board operator (if applicable) or the remote intervention operator (if applicable).

3. DDT at ODD boundaries

• 3.1.The ADS shall recognise its ODD conditions and boundaries of the ODD.

• 3.1.1.The ADS shall be able to determine if the conditions for ADS activation are met.

• 3.1.2.The ADS shall detect and respond when one or more ODD conditions are not fulfilled or no longer fulfilled.

• 3.1.3.The ADS shall be able to anticipate exits from the ODD

• 3.1.4.The ODD conditions and boundaries shall be established by the manufacturer.

• 3.1.4.1.The ODD conditions to be recognised by the ADS include:

• (a) precipitation (rain, snow);

• (b) time of day;

• (c) light intensity, including when lighting devices are used;

• (d) Fog, mist;

• (e) Road and lane markings;

• (f) Road category (e.g. number of driving lanes, separated lanes;

• (g) Geographical area (if applicable).

• 3.1.5.When the ADS reaches the ODD boundaries, it shall perform a MRM to reach a MRC and shall warn the on board operator (if applicable)/remote operator accordingly (if applicable).

4. DDT under failure scenarios

• 4.1.The ADS shall detect and respond to ADS or/and vehicle malfunctioning behaviour.

• 4.1.1.The ADS shall self-diagnose faults and failures.

• 4.1.2.The ADS shall evaluate its ability to fulfil the entire DDT.

• 4.1.2.1.The ADS shall respond safely to a fault/failure in the ADS that does not significantly compromise ADS performance.

• 4.1.2.2.The ADS shall execute a MRM to achieve a MRC in the event of a failure of the ADS and/or other vehicle system that prevents the ADS from performing the DDT.

• 4.1.2.3.The ADS shall immediately upon detection, signal major failures and resulting operational status to vehicle occupants, the on-board operator (if available) or the remote intervention operator (if relevant), as well as to other road users in accordance with traffic rules (e.g. activation of the hazard warning lights).

• 4.1.2.4.If failures affect the braking or steering performance of the vehicle, the MRM shall be carried out with consideration for the remaining performance.

5. Minimal risk manoeuvre (MRM) and Minimal risk Condition (MRC)

• 5.1.During the MRM, the fully automated vehicle with the ADS shall be slowed down, with an aim of achieving a deceleration demand not greater than 4,0 m/s², to a full standstill in the safest possible place taking into account surrounding traffic and road infrastructure. Higher deceleration demand values are permitted in the event of a severe ADS or severe fully automated vehicle failure.

• 5.2.The ADS shall signal its intention to place the fully automated vehicle in an MRC to occupants of the fully automated vehicle as well as to other road users in accordance with traffic rules (e.g., by activating the hazard warning lights)

• 5.3.The fully automated vehicle shall only leave the MRC after confirmation by self-checks of the ADS or/and by the on-board operator (if applicable) or remote intervention operator (if applicable) that the cause(s) of the MRM is no longer present.

6. Human machine interaction

• 6.1.Adequate information shall be given to the occupants of the fully automated vehicle wherever needed for safe operation and with regard to safety hazards,

• 6.2.If a remote intervention operator is part of the ADS safety concept, the fully automated vehicle shall provide means for vehicle occupants to call a remote intervention operator through an audiovisual interface in the fully automated vehicle. Unambiguous signs shall be used for the audiovisual interface (e.g. ISO 7010 E004)

• 6.3.The ADS shall provide vehicle occupants with means to request a minimal risk manoeuvre to stop the fully automated vehicle. In case of emergency:

• (a) for vehicles equipped with automatically operated doors, the unlocking of the doors shall be conducted automatically when it safe to do so,

• (b) a mean shall be given to passengers to exit a vehicle at standstill (opening the doors or via an emergency exit).

• 6.4.If a remote intervention operator is part of the ADS safety concept, the fully automated vehicle shall provide vision systems (e.g. cameras in accordance with chapter 6 of ISO16505:2019) of the occupant space inside the vehicle and of the surrounding of the vehicle to allow the remote intervention operator to assess the situation inside and outside of the vehicle.

• 6.5.If a remote intervention operator is part of the ADS safety concept, it shall be possible for the remote intervention operator to open the power operated service door remotely.

• 6.6.The ADS shall activate the relevant vehicle systems when necessary and applicable (e.g. opening doors, activate wipers in case of rain, heating system, etc.)

7. Functional and operational safety

• 7.1.The manufacturer shall demonstrate that an acceptable degree of consideration has been given to the functional and operational safety for the ADS during its design and development processes. The measures put in place by the manufacturer shall ensure that the fully automated vehicle is free of unreasonable safety risks to vehicle occupants and other road users during the vehicle lifetime when compared with comparable transport services and situations within the operational domain.

• 7.1.1.The manufacturer shall define the acceptance criteria from which the validation targets of the ADS are derived to evaluate the residual risk for the ODD taking into account, where available, existing accident data ([^E0001]), data on performances from competently and carefully driven manual vehicles and technology state-of-the-art.

• 7.2.The manufacturer shall have processes to manage the safety and continued compliance of the ADS over lifetime (wear and tear of components especially for sensors, new traffic scenarios, etc.).

8. Cyber security and software updates

• 8.1.The ADS shall be protected from unauthorised access in accordance with UN Regulation No 155 ([^E0002]).

• 8.2.The ADS shall support software updates. The effectiveness of the software update procedures and processes concerning the ADS shall be demonstrated by compliance with UN Regulation No 156 ([^E0003]).

• 8.2.1As specified in the Software Update and Software Update Management System Regulation, for the purpose of ensuring the software of the System can be identified, an R2022/1426SWIN shall be used. The R2022/1426SWIN may be held on the vehicle or, if R2022/1426SWIN is not held on the vehicle, the manufacturer shall declare the software version(s) of the vehicle or single ECUs with the connection to the relevant type-approvals to the type-approval authority.

• 8.2.2The manufacturer shall provide the following information in the information document:

• (a) The R2022/1426SWIN;

• (b) How to read the R2022/1426SWIN or software version(s) in case the R2022/1426SWIN is not held on the vehicle.

• 8.2.3.The manufacturer may provide in the information document a list of the relevant parameters that will allow the identification of those vehicles that can be updated with the software represented by the R2022/1426SWIN. The information provided shall be declared by the manufacturer and may not be verified by a type-approval authority.

• 8.2.4.The manufacturer may obtain a new vehicle type-approval for the purpose of differentiating software versions intended to be used on vehicles already registered in the market from the software versions that are used on new vehicles. This may cover the situations where type-approval regulations are updated, or hardware changes are made to vehicles in series production. In agreement with the type-approval authority, duplication of tests shall be avoided where possible.

9. ADS data requirements and specific data elements for event data recorder for fully automated vehicles

• 9.1.The ADS shall record the following occurrences whenever the ADS is activated:

• 9.1.1.Activation/re-initialisation of the ADS (if applicable)

• 9.1.2.Deactivation of the ADS (if applicable)

• 9.1.3.Request sent by the ADS to the remote intervention operator (if applicable)

• 9.1.4.Request/Input sent by the remote intervention operator (if applicable)

• 9.1.5.Start of emergency operation

• 9.1.6.End of emergency operation

• 9.1.7.Involved in a detected collision

• 9.1.8.Event data recorder (EDR) trigger input

• 9.1.9.Minimal risk manoeuvre engagement by the ADS

• 9.1.10.Minimal risk condition reached by the fully automated vehicle

• 9.1.11.ADS failure (Description)

• 9.1.12.Vehicle failure

• 9.1.13.Start of lane change procedure

• 9.1.14.End of lane change procedure

• 9.1.15.Abortion of lane change procedure

• 9.1.16.Start of intentional lane crossing

• 9.1.17.End of intentional lane crossing

• 9.2Occurrences flags for points 9.1.13., 9.1.14., 9.1.16. and 9.1.17. are only required to be stored if they happen within 30 seconds before the occurrences in points 9.1.5., 9.1.7., 9.1.15. or 9.1.8.:

• 9.3.ADS Data elements

• 9.3.1.For each occurrence listed in point 9.1., the following data elements shall be recorded in a clearly identifiable way:

• 9.3.2.The recorded occurrence flag

• 9.3.3.Reason for the occurrence, as appropriate,

• 9.3.4.Date (resolution: yyyy/mm/dd);

• 9.3.5.Position (GPS coordinates)

• 9.3.6.Timestamp:

• (a) resolution: hh/mm/ss time zone e.g. 12:59:59 UTC

• (b) accuracy: +/– 1,0 second.

• 9.4.For each recorded occurrence, the RXSWIN, or the software versions, indicating the software that was present when the event occurred, shall be clearly identifiable.

• 9.5.A single timestamp may be allowed for multiple elements recorded simultaneously within the timing resolution of the specific data elements. If more than one element is recorded with the same timestamp, the information from the individual elements shall indicate the chronological order.

• 9.6.Data availability

• 9.6.1.The ADS data elements shall be available subject to requirements specified in the Union or national law ([^E0004]).

• 9.6.2.Once the storage capacity reaches its limit, existing data shall only be overwritten following a first in first out procedure with the principle of respecting the relevant data availability requirements.

• Documented evidence on the storage capacity shall be provided by the manufacturer.

• 9.6.3.For vehicles of category M1 and N1, the data elements shall be retrievable even after an impact of a severity level set by UN Regulations Nos 94 ([^E0005]), 95 ([^E0006]) or 137 ([^E0007]).

• 9.6.4.For vehicles of categories M2, M3, N2 and N3, the data elements listed in point 9.2. shall be retrievable even after an impact. To demonstrate that capability, the following applies:

• Either:

• (a) A mechanical shock shall be applied to on-board data storage device(s), if any, at a severity level as specified in the component test of Annex 9C to the 03 series of amendment to UN Regulation No 100 ([^E0008]), and

• (b) On-board data storage device(s) shall be mounted in the vehicle cab/passenger compartment or in a position of sufficient structural integrity to protect against physical damage that would prevent the retrieval of data. This shall be demonstrated to the technical service together with appropriate documentation (e.g. calculations or simulations); Or,

• (c) The manufacturer demonstrates fulfilling the requirements of point 9.6.3. (e.g. for M2/N2 vehicles derived from M1/N1).

• 9.6.5.If the main on-board vehicle power supply is not available, it shall still be possible to retrieve all data recorded.

• 9.6.6.Data stored shall be easily readable in a standardised way via the use of an electronic communication interface, at least through the standard interface (OBD port).

• 9.7Specific data elements for event data recorder for fully automated vehicles

• 9.7.1.For vehicles fitted with an Event Data Recorders in accordance with Article 6 of Regulation (EU) 2019/2144, it shall be possible to retrieve through the standard interface (OBD port) the ADS data elements as referred to in points 9.3.1. and 9.3.2. recorded for at least the last 30 seconds before the last setting of the occurrence flag ‘Event Data Recorder (EDR) trigger input’, alongside the data elements specified in UN Regulation 160 ([^E0009]), Annex 4 (EDR data).

• 9.7.2.In the absence of any occurrence referred to in point 9.1. within the last 30 seconds before the last setting of the occurrence flag ‘Event Data Recorder (EDR) trigger input’, it shall be possible to retrieve, alongside the EDR data, the data element corresponding to the last occurrences within the same power cycle referred to in points 9.1.1. and 9.1.2., as a minimum.

• 9.7.3.The data elements retrieved in accordance with point 9.7.1. or 9.7.2. shall not include the date and the timestamp or any other information allowing for identification of the vehicle, its user or owner. Instead the time stamp shall be replaced with information representing the time difference between the occurrence flag ‘Event Data Recorder (EDR) trigger input’ and the occurrence flag of the respective ADS data element.

• 9.8.The manufacturer shall provide instructions on how to access the data.

• 9.9.Protection against manipulation

• 9.9.1.An adequate protection against manipulation (e.g. data erasure) of stored data shall be ensured for example by way of an anti-tampering design

10. Manual driving mode

• 10.1.If the ADS allows manual driving for the purpose of maintenance or to take over after a minimal risk manoeuvre is provided in the fully automated vehicle, the vehicle shall be limited to 6 km/h and shall be provided with means to enable the person driving the vehicle to perform the driving task safely in accordance with the safety concept of the manufacturer. Except in case of failure, the ADS shall continue detecting an obstacle (e.g. vehicles, pedestrian) in the manoeuvring area and shall support the driver in bringing the vehicle immediately to a stop to avoid a collision.

• 10.2.If manual driving is limited to 6 km/h, it is not necessary for the driver to stay within the fully automated vehicle. The control can be performed via a remote control located in the vicinity of the vehicle provided that the vehicles stays in the direct line of sight of the driver. The maximum distance over which control is possible by a remote control shall not exceed 10 metres.

• 10.3.If, in manual driving, the vehicle is intended to be driven at speeds higher than 6 km/h, the vehicle shall be considered as dual mode vehicle.

11. Operating manual

• 11.1.The manufacturer shall draw up an operating manual. The purpose of the operating manual is to ensure the safe operation of the fully automated vehicle by means of detailed instructions to the owner, vehicle occupants, transport service operator, on-board operator, remote intervention operator and any relevant national authorities.

• When the fully automated vehicle includes the possibility of manual driving for the purpose of maintenance or to take over after a minimal risk manoeuvre, it shall also be covered by the operating manual.

• 11.2.The operating manual shall include the functional description of the ADS.

• 11.3.The operating manual shall include the technical measures (e.g. checks and maintenance works of vehicle and off-board infrastructure, transport and physical infrastructure requirements such as localization marker and perception sensors), operational restrictions (e.g. speed limit, dedicated lane, physical separation with oncoming traffic), environmental conditions (e.g. no snow) and operational measures (e.g. on-board operator or remote intervention operator needed) necessary to ensure safety during the fully automated vehicle operation.

• 11.4.The operating manual shall describe the instructions for vehicle occupants, transport service operator, on board operator (where applicable) and remote intervention operator (where applicable) and public authorities in case of failures and ADS request.

• 11.5.The operating manual shall set out rules to ensure proper performance of maintenance, overall tests and further examinations.

• 11.6.The Operating Manual shall be submitted to the type-approval authority together with the application for a type-approval and shall be annexed to the type-approval certificate.

• 11.7.The Operating Manual shall be made available to the owner and, where applicable, to the transport service operator, on-board operator (where applicable), remote intervention operator (where applicable) and any relevant national authorities.

12. Provisions for periodic roadworthiness tests

• 12.1.For the purpose of periodic roadworthiness tests, it shall be possible to verify the following features of the ADS:

• (a) Its correct operational status, by visible observation of the failure warning signal status following the activation of the vehicle master control switch and any bulb check. Where the failure warning signal is displayed in a common space (the area on which two or more information functions/symbols may be displayed, but not simultaneously), it must be checked first that the common space must be observed to be functional prior to the failure warning signal status check;

• (b) Its correct functionality and the software integrity, by the use of an electronic vehicle interface, such as the one laid down in point I. (14) of Annex III to Directive 2014/45/EU of the European Parliament and of the Council ([^E0010]), where the technical characteristics of the vehicle allow for it and the necessary data is made available. Manufacturers shall ensure to make available the technical information for the use of the electronic vehicle interface in accordance with Article 6 of Commission Implementing Regulation (EU) 2019/621 ([^E0011]).

ANNEX III

Compliance assessment

The overall compliance assessment of the ADS is based on:

• — Part 1: The traffic scenarios to consider

• — Part 2: The assessment of the ADS safety concept and the audit of the manufacturer safety management system.

• — Part 3: The tests for the most relevant traffic scenarios.

• — Part 4: The principles to be used for the credibility assessment for using virtual toolchain to ADS validation

• — Part 5: The system established by the manufacturer to ensure in-service reporting.

Any requirement in Annex II may be checked by means of tests performed by the type-approval authority (or its technical service).

PART 1

TRAFFIC SCENARIOS TO CONSIDER

• 1.Minimum set of traffic scenarios

• 1.1.Scenarios and parameters listed in point 1 shall be used, when these scenarios are relevant for the ODD of the ADS.

• If the manufacturer deviates from the parameters proposed in point 1, the safety performance metrics and inherent assumptions used by the manufacturer shall be documented in the documentation package. The safety performance metrics and inherent assumptions chosen shall demonstrate that the fully automated vehicle is free of unreasonable safety risks. The validity of such safety performance metrics and inherent assumptions shall be supported by in-service monitoring data.

• 1.2.Parameters to be used for the lane change scenarios by the fully automated vehicle

• 1.2.1.The scenarios and parameters, with regard to lane change, shall be applied as specified in UN Regulation No 157 ([^E0012]).

• 1.3.Parameters to be used for the turning and crossing scenario by the fully automated vehicle.

• 1.3.1.In the absence of more specific traffic rules, the following requirements shall be taken into account with regard to interaction with other road users involved in the movement when turning and crossing (see Figure 1) in dry and proper road pavement conditions.

• 1.3.2.In the case of merging with privileged traffic during turning with and without crossing the opposite traffic direction, privileged traffic in the target lane should not have to decelerate. However, it must be ensured that the TTC of the approaching privileged traffic in the target road (case (a) in Figure 1) never falls below the threshold TTC dyn defined as:

Image omitted; see official source

• With:

v e equal to the speed of the fully automated vehicle

v a equal to the speed of the privileged approaching traffic

β equal to 3 m/s² being the maximum admissible deceleration for the privileged approaching traffic.

ρ equal to 1,5 s being the reaction time of the privileged approaching

• 1.3.3.In the case of a turning manoeuvre crossing the opposite traffic direction, when considering oncoming traffic, privileged traffic in the target lane should not have to decelerate. However, if justified by the traffic density, it must be ensured – in addition to the distance from the approaching privileged traffic in the target road – that the TTC of the privileged crossing traffic to the fictitious collision point (point of intersection of the trajectories, case (b) in Figure 1) never falls below the threshold TTC int defined as:

Image omitted; see official source

• With:

v c equal to the speed of the privileged conflicting traffic

β equal to 3 m/s² being the maximum admissible deceleration for the privileged crossing traffic.

ρ equal to 1,5 s being the reaction time of the privileged crossing traffic

• The same applies to crossing with privileged traffic (case (c) in Figure 1): The TTC of privileged traffic to the imaginary collision point (point of intersection of the trajectories) shall never fall below the threshold TTC int defined in the present point.

• Image omitted; see official source

• Figure 1: Visualisation of the distances during turning and crossings.

• Case (a): Distance to the approaching privileged traffic in the target lane to be observed during turning-in and merging with privileged traffic.

• Case (b): Distance to the oncoming privileged traffic to be observed when turning by crossing the opposite traffic direction.

• Case (c): distance to the privileged crossing traffic to be respected when crossing.

• 1.4.Parameters to be used for the emergency manoeuvre scenarios by the fully automated vehicle (DDT under critical scenarios)

• 1.4.1.The ADS shall avoid a collision with a leading vehicle which decelerates up to its full braking performance provided that there was no cut-in by another vehicle.

• 1.4.2.Collisions with cutting in vehicles, pedestrians and cyclists travelling in the same direction, as well as with pedestrians who can start to cross the street, shall be avoided at least within the conditions determined by the following equation.

Image omitted; see official source

• With:

Image omitted; see official source

being the time to-collision at the moment of the cut-in of the vehicle or cyclist by more than 30 cm in the lane of the fully automated vehicle.

• v rel being the relative speed in metres per second [m/s] between the fully automated vehicle and the cutting-in vehicle (positive if the ADS is faster than the cutting-in vehicle).

• β being the maximum deceleration of the fully automated vehicle and assumed to be equal to:

2,4 m/s² if it is transporting standing or not fastened vehicle occupants and there is a cutting in vehicle scenario;

6 m/s² if it is transporting standing or not fastened vehicle occupants for other scenarios with pedestrians or cyclists.

6 m/s² for other fully automated vehicles.

ρ being the time required by the fully automated vehicle to initiate an emergency braking and assumed to be equal to 0,1 s

τ being the time to reach the maximum deceleration β and assumed to be equal to

0,12 s for fully automated vehicles transporting standing or not fastened vehicle occupants;

0,3 s for other fully automated vehicles

• The compliance with this equation is required only for road users cutting in, and only if the inserting road users were visible at least 0,72 seconds before cut-in:

• This results in a required collision avoidance when another road user enters ego lane above the following TTC values (for example shown for speeds in 10 km/h steps). These requirements shall be met independently of environmental conditions.

v rel[km/h]	Image omitted; see official source [s] for vehicles with standing or unfastened vehicle occupants	Image omitted; see official source [s] for other vehicles
10	0,74	0,48
20	1,32	0,71
30	1,9	0,94
40	2,47	1,18
50	3,05	1,41
60	3,63	1,64

• If a lane change with a lower TTC is carried out to the lane of the fully automated vehicle, it can no longer be assumed that there will be no collision avoidance. The control strategy of the ADS may change between collision avoidance and mitigation only if the manufacturer can demonstrate that this increases the safety of the vehicle occupants and the other road users (e.g. by prioritising braking over an alternative manoeuvre).

• 1.4.3.The ADS shall avoid a collision with a crossing pedestrian or a cyclist in front of the vehicle.

• 1.4.3.1.Urban and rural driving conditions

• 1.4.3.1.1.The ADS shall avoid a collision, up to a speed of 60 km/h, with an unobstructed pedestrian crossing with a lateral speed component of not more than 5 km/h or an unobstructed cyclist crossing with a lateral speed component of not more than 15 km/h in front of the vehicle. This shall be ensured independently from the specific manoeuvre the ADS is undertaking.

• 1.4.3.1.2.In the case the pedestrian or the cyclist proceed with higher speed than the aforementioned values and the ADS can no longer avoid collision, the control strategy of the ADS may change between collision avoidance and mitigation only if the manufacturer can demonstrate that this increases the safety of the vehicle occupants and the other road users (e.g. by prioritizing braking over an alternative manoeuvre).

• 1.4.3.1.3.The ADS shall mitigate a collision with an obstructed pedestrian or cyclist crossing in front of the vehicle by reducing its speed at impact by at least 20 km/h. This shall be ensured independently from the specific manoeuvre the ADS is undertaking.

• 1.4.3.1.4.For the purpose of demonstrating fulfilment of the previous requirements related to crossing of pedestrians and cyclists in front of the vehicle, test and assessment scenarios developed under the European New Car Assessment Programme (Euro NCAP) may be taken as guidance.

• 1.4.3.2.Motorway driving conditions

• 1.4.3.2.1.The relevant scenarios, with regard to pedestrian crossing, shall be applied as specified in UN Regulation No 157.

• 1.4.3.2.2.In the case the pedestrian crosses with parameter values outside the boundaries specified in UN Regulation 157 and the ADS can no longer avoid collision, the control strategy of the ADS may change between collision avoidance and mitigation only if the manufacturer can demonstrate that this increases the safety of the vehicle occupants and the other road users (e.g. by prioritizing braking over an alternative manoeuvre).

• 1.5.Motorway entry

• The fully automated vehicle shall be able to safely enter the motorway by adapting the speed to the traffic flow, and activate the relevant direction indicator according to the traffic rules.

• The direction indicator shall be deactivated once the vehicle has performed the lane change manoeuvre (LCM). The parameters used in the lane change scenario shall be applied.

• 1.6.Motorway exit

• The fully automated vehicle shall be able to anticipate the targeted motorway exit by driving on the adjacent lane to the exit lane and shall not unnecessarily decelerate before the LCM into the exit lane starts.

• The fully automated vehicle shall apply the direction indicator in accordance with the traffic rules, and perform the LCM into the exit lane without undue delay.

• The direction indicator shall be deactivated once the LCM has been completed in compliance with the traffic rules in the country of operation.

• 1.7.Passing a toll station

• Depending on the ODD, the fully automated vehicle shall be able to select the proper passing gate, and adapt its speed to that permitted limits within the toll area while considering the traffic flow.

• 1.8.Operation on other road types than motorways

• Depending on the ODD, the relevant scenario defined in points 1.2. to 1.4. above shall be applied.

• 1.9.Parameters to be used for Automated valet parking

• 1.9.1.Depending on the ODD, the relevant scenarios defined in points 1.3. to 1.5 above shall be applied. The parameters to be used for these scenarios may need to be adapted to take into account of the limited driving speed and the general lack of visibility that may occur in a parking facility. Special attention shall be given to avoiding of collision with pedestrians and in particular with children and prams.

• 2.Scenarios not covered by point 1.

• 2.1.Scenarios that are not listed in point 1 shall be generated to cover reasonably foreseeable critical situations, including failures and traffic hazards within the operational design domain.

• 2.2.When ADS capabilities depend on remote capabilities, scenarios shall include failures and traffic hazards stemming from the corresponding remote capabilities.

• 2.3.The method to generate scenarios that are not listed in Section 1, shall follow the principles set in Appendix 1 to Part 1 of this Annex.

• 2.4.The method used by the manufacturer to generate scenarios that are not listed in point 1 shall be documented in the documentation package to be provided for the ADS assessment.

Appendix 1

Principles to be followed to derive scenarios relevant for the ODD of the ADS

Image omitted; see official source

1. Generation and classification of scenarios

From a qualitative perspective, scenarios can be classified into Nominal/Critical/Failure and correspond to normal or emergency operation. For each of these categories, a data-based approach and a knowledge-based approach can be used to generate corresponding traffic scenarios. A knowledge-based approach utilizes expert knowledge to identify hazardous events systematically and create scenarios. A data-based approach utilizes the available data to identify and classify occurring scenarios. Scenarios shall be derived from the ODD of the fully automated vehicle.

2. Nominal scenarios

A series of analytical frameworks can help the manufacturer to derive additional nominal scenarios to ensure coverage for the specific application. These frameworks are divided into:

2.1.   ODD analysis

An ODD consists of scenery elements (e.g., physical infrastructure), environmental conditions, dynamic elements (e.g., traffic, vulnerable road users) and operational constraints to the specific ADS application. The aim of this analysis is to identify the characteristics of the ODD, allocate properties and define interactions between the objects. Here the effect of ODD on the behaviour competencies of the ADS is explored. An example of the analysis is provided in Table 1.

Table 1

Dynamic elements and their properties

Objects	Events/Interactions
Vehicles (e.g. cars, light trucks, heavy trucks, buses, motorcycles)	Lead vehicle decelerating (frontal) Lead vehicle stopped (frontal) Lead vehicle accelerating (frontal) Changing lanes (frontal/side) Cutting in (adjacent) Turning (frontal) Encroaching opposing vehicle (frontal/side) Encroaching adjacent vehicle (frontal/side) Entering roadway (frontal/side) Cutting out (frontal)
Pedestrians	Crossing road – inside crosswalk (frontal) Crossing road – outside crosswalk (frontal) Walking on side walk/shoulder
Cyclists	Riding in lane (frontal) Riding in adjacent lane (frontal/side) Riding in dedicated lane (frontal/side) Riding on sidewalk/shoulder Crossing road – inside crosswalk (frontal/side) Crossing road – outside crosswalk (frontal/side)
Animals	Static in lane (frontal) Moving into/out of lane (frontal/side) Static/moving in adjacent lane (frontal) Static/moving on shoulder
Debris	Static in lane (frontal)
Other dynamic objects (e.g. shopping carts)	Static in lane (frontal/side) Moving into/out of lane (frontal/side)
Traffic signs	Stop, yield, speed limit, crosswalk, railroad, crossing, school zone
Traffic signals	Intersection, railroad crossing, school zone
Vehicle signals	Turn signals (direction indicator)

2.2.   OEDR Analysis: Behaviour competency identification

Once the objects and relevant properties have been identified, it is possible to map the appropriate ADS response. The ADS response is modelled on applicable functional requirements and by applying the performance requirements of this regulation and the traffic rules of the country of operation.

The outcome of the OEDR analysis is also a set of competences that can be mapped to the behavioural competences applicable to the ODD, to ensure compliance with the relevant regulatory and legal requirements. Table 2 provides a qualitative example of a matching event – response.

The combination of objects, events, and their potential interaction, as a function within the ODD, constitute the set of nominal scenarios pertinent to the ADS under analysis. The identification of nominal scenarios can benefit from an enhanced combination of scenario descriptors covering, within the ODD, e.g. infrastructure attributes, objects and events characteristics, hazards affecting responses (e.g. weather, visibility). The identification of nominal scenarios is not limited to traffic conditions but also covers environmental conditions, human factors, connectivity and miscommunication. As parameters (assumptions) for the events are yet to be defined, the nominal scenarios derived from the application of the analysis are to be considered in their functional and logical abstraction layer.

Table 2

Behaviour competences for given events

Event	Response
Lead vehicle decelerating	Follow vehicle, decelerate, stop
Lead vehicle stopped	Decelerate, stop
Lead vehicle accelerating	Accelerate, follow vehicle
Lead vehicle turning	Decelerate, stop
Other vehicle changing lanes	Yield, decelerate, follow vehicle
Other vehicle cutting-in	Yield, decelerate, stop, follow vehicle
Vehicle entering roadway	Follow vehicle, decelerate, stop
Opposing vehicle encroaching	Decelerate, stop, shift within lane, shift outside lane
Adjacent vehicle encroaching	Yield, decelerate, stop
Lead vehicle cutting out	Accelerate, decelerate, stop
Pedestrian crossing road – inside crosswalk	Yield, decelerate, stop
Pedestrian crossing road – outside crosswalk	Yield, decelerate, stop
Cyclists riding in lane	Yield, follow
Cyclists riding in dedicated lane	Shift within lane
Cyclists crossing road – inside crosswalk	Yield, decelerate, stop
Cyclists crossing road – outside crosswalk	Yield, decelerate, stop

3. Critical scenarios

Critical scenarios can be derived by either considering edge-case assumptions on nominal traffic scenarios (data-based) or applying standardised methods (knowledge-based) for the evaluation of operational insufficiencies (see example of methods in point 3.5.5. of Part 2). The identification of critical scenarios can benefit from an enhanced combination of scenario descriptors and edge values covering, within the ODD, e.g. infrastructure attributes, objects and events characteristics, hazards affecting responses (e.g. weather, visibility masks, interactions with other road users than the triggered object or event). The identification of critical scenarios is not limited to traffic conditions but also covers environmental conditions, human factors, connectivity and miscommunication. Critical scenarios correspond to emergency operation of the ADS.

4. Failure scenarios

These scenarios aim to assess how the ADS responds to a failure. Different methods are available in literature (see example of methods in point 3.5.5. of Part 2).

For each of the behaviour failures and consequential effects identified, the manufacturer shall put in place relevant strategies when developing the ADS (i.e., fail-safe).

When applying the failure scenarios, the objective is to assess the ability of the ADS to comply with requirements for safety-critical situations, including for example ‘The ADS shall manage safety-critical driving situations’ and ‘The ADS shall safely manage failure modes’ and their respective sub-requirements.

5. Assumptions: Logical to concrete scenarios

To ensure that the scenarios identified in the previous points are ready to be assessed through simulation or physical testing, the manufacturer may need to coherently parametrise them by applying assumptions.

The manufacturer shall provide evidence supporting the assumptions made such as data collection campaigns performed during the development phase, real-world accidentology and realistic driving behaviour evaluations.

Parameters used to characterise critical scenarios should cover reasonably foreseeable values in scenario descriptors, but shouldn’t be limited to values already observed in documented data bases.

PART 2

ASSESSMENT OF THE ADS SAFETY CONCEPT AND AUDIT OF THE MANUFACTURER SAFETY MANAGEMENT SYSTEM

1. General

• 1.1.The type-approval authority granting the type-approval or the technical service acting on its behalf shall verify through targeted spot checks and tests, in particular as specified in point 4 of this annex, that the safety argumentation provided by the documentation complies with the requirements of Annex II and that the design and processes described in documentation are actually implemented by the manufacturer.

• 1.2.While based on the provided documentation, evidences provided for the audit of the safety management system and the assessment of the ADS safety concept carried out to the satisfaction of the type-approval authority in accordance with this regulation, the residual level of safety risk of the type-approved ADS is deemed to be acceptable for the entry into service of the vehicle type, the overall ADS safety during the ADS lifetime in accordance with the requirements of this regulation remains the responsibility of the manufacturer requesting the type-approval.

2. Definitions

For the purposes of this annex,

• 2.1.‘safety concept’ means a description of the measures designed into the ADS, so that the fully automated vehicle operates for the scenarios and events relevant to the ODD in such a way that it is free of unreasonable safety risks to the vehicle occupants and other road users under fault (functional safety) and non-fault conditions (operational safety). The possibility of a fall-back to partial operation or even to a back-up system for vital ADS functions shall be a part of the safety concept.

• 2.2.‘units’ means the smallest divisions of system components which will be considered in this annex, since these combinations of components will be treated as single entities for purposes of identification, analysis or replacement.

• 2.3.‘transmission links’ means the means used for inter-connecting distributed units for the purpose of conveying signals, operating data or an energy supply. This equipment is generally electrical but may, in some part, be mechanical, pneumatic or hydraulic.

• 2.4.‘range of control’ means an output variable and defines the range over which the system is likely to exercise control.

• 2.5.‘boundary of functional operation’ means the boundaries of the external physical limits within which the ADS is able to perform the dynamic driving tasks.

3. Documentation on the ADS

3.1.   Requirements

The manufacturer shall provide a documentation package which gives access to the basic design of the ADS and the means by which it is linked to other vehicle systems or by which it directly controls output variables as well as off-board hardware/software and remote capabilities.

The function(s) of the ADS, including the control strategies, and the safety concept, as laid down by the manufacturer, shall be explained.

Documentation shall be brief, yet provide evidence that the design and development has had the benefit of expertise from all the ADS fields which are involved.

For periodic road worthiness tests, the documentation shall describe how the current operational status of the ADS and the functionality and software integrity can be checked.

The type-approval authority shall assess the documentation package which shall show that the ADS:

• (a) is designed and was developed to operate in such a way that it is free from unreasonable risks for a vehicle occupants and other road users within the declared ODD and boundaries;

• (b) fulfils the performance requirements of Annex II to this Regulation;

• (c) was developed according to the development process/method declared by the manufacturer.

• 3.1.1.Documentation shall be made available in three parts:

• (a) Application for type-approval: the information document submitted to the type-approval authority at the time of the type-approval application shall contain brief information on the items listed in Annex I. It will become part of the type-approval.

• (b) The formal documentation package for the type-approval, containing the material listed in this Section 3. (with the exception of that of point 3.5.5.) which shall be supplied to the type-approval authority for the purpose of conducting the ADS type-approval. This documentation package shall be used by the type-approval authority as the basic reference for the verification process set out in point 4. of this annex. The type-approval authority shall ensure that this documentation package remains available for a period of at least 10 years counted from the time when production of the vehicle type is definitely discontinued.

• (c) Additional confidential material and analysis data (intellectual property) of point 3.5.5. which shall be retained by the manufacturer, but made open for inspection (e.g. on-site in the engineering facilities of the manufacturer) at the time of the ADS type-approval. The manufacturer shall ensure that this material and analysis data remains available for a period of 10 years counted from the time when production of the vehicle type is definitely discontinued.

3.2.   General description of the ADS

• 3.2.1.A description shall be provided giving a simple explanation of the operational characteristics of the ADS and ADS features.

• 3.2.2.The description shall include:

• 3.2.2.1the operational design domain such as maximum speed of operation, road type (e.g. dedicated lane), country(ies)/areas of operation, road conditions and environmental conditions required (e.g. no snow), etc.)/Boundary conditions

• 3.2.2.2basic performance (e.g. object and event detection and response, off-board infrastructure needed during operation)

• 3.2.2.3.Interaction with other road users

• 3.2.2.4.main conditions for minimal risk manoeuvres.

• 3.2.2.5.interaction concept with vehicle occupants, the on board operator (if applicable) and the remote intervention operator (if applicable).

• 3.2.2.6.the means to activate or deactivate the ADS by the on-board operator (if relevant) or the remote intervention operator (if relevant), vehicle occupants (if relevant) or other road users (if relevant).

• 3.2.2.7.operational measures (e.g. on-board operator or remote intervention operator needed) to be met to ensure safety during the fully automated vehicle operation.

• 3.2.2.8.backend, off-board infrastructure needed to ensure safety during the fully automated vehicle operation.

3.3.   Description of the functions of the ADS

A description shall be provided giving an explanation of all the functions including control strategies to ensure the robust and safe operation of the ADS and the methods used to perform the dynamic driving tasks within the ODD, and the boundaries under which the automated driving system is designed to operate, including a description on how this is ensured.

Any enabled or disabled automated driving functions for which the hardware and software are present in the vehicle at the time of production, shall be declared and are subject to the requirements of this annex as well as Annex II to this Regulation, prior to their use in the vehicle. The manufacturer shall also document the data processing if continuous learning algorithms are implemented.

• 3.3.1.A list of all input and sensed variables shall be provided and the working range of these defined, along with a description of how each variable affects the ADS behaviour.

• 3.3.2.A list of all output variables that are controlled by the ADS shall be provided and an explanation given, in each case, of whether the control is direct or via another vehicle system. The range over which the ADS is likely to exercise control on each such variable shall be defined.

• 3.3.3.Limits defining the boundaries of functional operation including ODD-limits shall be stated where appropriate to ADS performance.

• 3.3.4.The human machine interaction (HMI) concept with the vehicle occupants/on-board operator/remote intervention operator (if any) when ODD limits are approached and then reached shall be explained. The explanation shall include the list of types of situations in which the ADS will generate a support request to the on board operator/remote intervention operator (if applicable), the way the request is performed, the procedure that handles a failed request and the minimal risk manoeuvre. Signals and information given to the on-board operator/remote intervention operator, vehicle occupants and other road users in each of the above aspects shall also be described.

3.4.   ADS layout and schematics

• 3.4.1.Inventory of components.