24315-1 METR ConOps |
Submit Comment Traceability Tables: |
ID | Description | Discussion | Links |
---|---|---|---|
S-28 |
8 Operational scenarios** Under Development ** ** Diagrams need to be added ** |
||
S-90 |
8.1 GeneralThis section is intended to provide an overview of the major operational uses for the METR. These scenarios are arranged based on the service packages that make up the METR. Each scenario begins with a brief description followed by one or more diagrams that define different sequences of actions that occur in the scenario. Following each diagram, each sequence is described in terms of the overall flow of the service package – what happens first, what information is shared, what activities are required in order for the service or application to succeed, what other factors need to be considered? |
||
S-43 |
8.2 Sandy the busy mum |
||
S-54 |
8.2.1 GeneralOur first operational scenario is Sandy, a busy mother, using her minivan for errands around town. Her minivan supports a Level 4 ADS coupled with a driver information system when in manual mode. |
||
S-44 |
8.2.2 Refresh rule setWhen Sandy starts her minivan, components on her minivan immediately go to work preparing for the journey. The ADS, driver information system, and METR receiver each begin various diagnostic checks. The METR receiver checks how old each of its previously downloaded rule sets are and discovers that several have expired. The receiver downloads the rule sets necessary for the journey that are not currently downloaded or that are nearing or past their expiration. The receiver may download other rule sets (e.g., to refresh rules early), but is not required to do so. Sandy's minivan only downloads rule sets that are relevant for its supported Level 4 ADS and driver support capabilities, which includes "general rules", "motor-vehicle road geometry", "motor vehicle right-of-way", "motor vehicle parking", and "motor vehicle speed limits". Sandy's ADS can have confidence in the data contained in the rules because the translator, collector, and disseminator are all required to adhere to strict data access policies within their systems and all rules are signed by each of these entities and exchanged over encrypted links. Sandy can begin manually driving before the download is complete but some of the driver support features might be limited until the receiver completes the download. The Level 4 ADS will not operate until all necessary rule sets are downloaded for the vehicle's current location and immediate vicinity. Sandy's minivan provides a large display on the center console where much of the driver information is displayed. It includes a dedicated area that displays the current speed limit along with a larger area used for case-specific information, such as stop sign, traffic signal, and other information. If Sandy begins driving with recently expired rules, the minivan continues to display the old rules, but they are displayed with a transparent effect to emphasize the reduced trust and if they are sufficiently old they are no longer displayed. |
incorporates:
UN-88 Trustworthiness — Reliability — Quality …
UN-33 Trustworthiness — Reliability — Timeline…
UN-14 Trustworthiness — Reliability — Usabilit…
UN-22 Trustworthiness — Security — Communicati…
UN-21 Trustworthiness — Security — Integrity —…
UN-25 Trustworthiness — Security — Integrity —…
UN-86 User — Awareness — Geopositioning
UN-47 User — Rule — Categories
UN-34 User — Rule — Distribution — Efficiency
UN-41 User — Rule — Journey planning
|
|
S-11 |
8.2.3 Snowy conditionsLocal ordinances in Sandy’s locale specify that ADS are not permitted to operate during snowy conditions (partially due to an incident from years prior where several ADS-equipped vehicles behaved erratically during a snowstorm). The ordinance is written such that the assessment of whether "snowy conditions" exist is determined by the local transportation operator. Due to current conditions this morning, the operator has temporarily activated the rule banning the operation of ADS due to the snowy conditions. This ban is automatically transmitted to all ADS-equipped vehicles within the jurisdiction as a part of the "wide area supplemental data set". Due to the ban, the ADS is unable to engage, and Sandy is required to assume all responsibility for the dynamic driving task; however, she still has the assistance of the driver information system (including anti-lock brakes, automated emergency braking, etc). |
incorporates:
RC-17 Supplemental data
UN-12 Trustworthiness — Reliability — Timeline…
UN-48 User — Rule — Characteristics
SP:
SP-20 The ConOps should provide practical use …
SP-95 The ConOps should provide an example of …
SP-130 The ConOps should structure at least one…
SP-132 The ConOps might include a scenario with…
|
|
S-77 |
8.2.4 Start of snowfallWithin this jurisdiction, a lower speed limit applies when raining. Unlike the ADS-ban, the lower speed limits take effect dynamically based on conditions rather than through a centralized manual assessment. As a result, to provide trustworthy information to the driver, the driver support system has to always be aware of whether it is raining or not and to be aware of what qualifies as "rain" within the jurisdiction (e.g., Does snow activate this rule? What rate of precipitation activates the rule?). All this information is provided within the electronic representation of the rule as provided by METR. Sandy's vehicle is equipped with sensors that can determine the rate and type of precipitation and provide this supplemental data to the METR receiver, which then compares the data with the rule information to determine the current legal speed limit. Today, the receiver determines that the current snowfall is legally considered to be "rain" and the receiver reports a lower speed limit to the driver information system, which displays the lower speed limit to Sandy. As the precipitation is first detected, the driver information system also chimes once to alert Sandy to the lower speed limit. Other vehicles might detect rain conditions in other ways. For example, a vehicle might contact its OEM to obtain current weather conditions, or another vehicle might base its logic on the state of the windshield wipers. The acceptable forms of supplemental data are specified within the electronic rule as determined by the rule-maker and translator. |
incorporates:
RC-17 Supplemental data
RC-42 Environmental conditions
UN-7 Trustworthiness — Reliability — Quality …
UN-48 User — Rule — Characteristics
|
|
S-46 |
8.2.5 Operation of a traffic signalThe "motor vehicle right-of-way" rule set includes the location of traffic signals along the expected route and an indication of whether each of the signals support the provision of electronic intersection status information. By being aware of these locations and capabilities, the receiver knows where to expect to receive intersection status information, which is one type of supplemental data. The intersection status information provides indications of which manoeuvres have right-of-way in real time. As this supplemental data is received, it is conveyed to Sandy through the main display screen allowing her to see the current permissions even when the view of the signal head is blocked by another vehicle or obscured due to sunlight. Further, because the vehicle can determine its own location and it has the location of known traffic signals, the receiver will be able to detect instances when expected intersection status information is missing. In this case, it will be able to warn Sandy of abnormal conditions and to be extra cautious. |
incorporates:
RC-2 Location
RC-17 Supplemental data
UN-67 User — Awareness — Mapping
UN-86 User — Awareness — Geopositioning
UN-48 User — Rule — Characteristics
|
|
S-65 |
8.2.6 Locating appropriate parkingAs Sandy reaches her destination to meet her child, she searches for an appropriate parking spot. As her son has disabilities, she has an accessible parking permit that has been electronically registered with the METR receiver on her minivan. The driver information system is also aware that the minivan's accessible door is on the right side of the van. As a result, as she enters the parking lot, the driver support system on her minivan guides her to the area of the lot with accessible parking spaces and highlights spots that have accessibility aisles on the right side of the parking space. |
incorporates:
RC-21 Mapping resolution
UN-40 User — Rule — Applicability — Permits
SP:
SP-146 METR rules need to define areas reserved…
SP-150 A METR operational scenario should indic…
|
|
S-47 |
8.3 Trip to grandma's house |
||
S-55 |
8.3.1 OverviewLittle Red Riding Hood has decided to take a trip to her grandma's house 1,000 km away using her new Level 4 ADS-equipped vehicle to overcome the mountains and valleys along the way. |
||
S-48 |
8.3.2 Download rule set for long journeyBased on the information contained on her calendar, Ms. Hood's virtual assistant alerts her car that a trip to her grandmother's house is planned for the following day. Due to some previous encounters with unseemly characters, Ms. Hood is very concerned about her privacy and keeping her information confidential. Protecting her information requires all components with access to her information adhere to strict information security practices and Ms. Hood is aware that this is a built-in aspect of the METR components. For example, the METR interface is encrypted to ensure confidentiality while the data is in motion and the disseminator does not store her requests nor the details about what information it supplies to Ms. Hood's vehicle, nor does it use this information for any other purpose. Likewise, her vehicle implements strict access controls on the data it stores. All of these policies prevent unauthorized data access. This level of information security allows the vehicle's on-board computer to notify the METR receiver of Ms. Hood's planned trip. Because it was notified a day in advance, the METR receiver has the flexibility to retrieve the rule set for the trip using Ms. Hood's preferred connectivity option, which is her home Wi-Fi connection. The connection becomes available the evening before the trip and all the relevant rules that are expected to be needed for the journey are retrieved. This includes retrieving rule sets for different national jurisdictions. The next morning, Ms. Hood gets into her vehicle and confirms that she wishes to travel to her grandma's house and that she wants to engage the ADS mode. The ADS informs her that the trip includes a segment at the end that is outside of the ADS's ODD and that she will have to agree to accept manual control for this portion of the journey. While she agrees to this condition, the ADS is already checking other aspects of her journey to ensure everything is in order. |
incorporates:
UN-33 Trustworthiness — Reliability — Timeline…
UN-22 Trustworthiness — Security — Communicati…
UN-26 Trustworthiness — Security — Data privac…
UN-30 User — Connectivity — Preferences
UN-41 User — Rule — Journey planning
|
|
S-56 |
8.3.3 Encountering road worksAs the ADS leaves Ms. Hood's neighbourhood, the METR receiver receives a broadcast message that there are road works, and the lane lines are shifted by 1 meter for a downstream road section. The METR receiver informs the ADS of this information thereby allowing the vehicle to traverse this section of roadway without disturbing Ms. Hood at all. |
incorporates:
RC-2 Location
RC-21 Mapping resolution
UN-33 Trustworthiness — Reliability — Timeline…
|
|
S-4 |
8.3.4 Encountering a new traffic control deviceAs the vehicle proceeds through the work zone, it approaches the site of a new stop sign associated with a new side street. Even though the sign was installed minutes before, Ms. Hood's vehicle was already aware of the new sign location. Stop signs are included in the pre-announced "motor vehicle right-of-way" rule set that Ms. Hood's vehicle retrieved the evening before. The rule set included an announcement of an "inactive" stop sign at this location with a flag indicating that it was planned for installation. This information had been entered the previous week and although the sign had originally been scheduled to be installed yesterday, the field crew did not install it until this morning. When the field crew installed the sign, they also activated a roadside beacon that continually broadcasts supplemental data indicating that the stop sign is now active. They also notified the appropriate translator and had them change the pre-announced rule to indicate that the sign was now active. The crew will come back in roughly a week (after all previously distributed "motor vehicle right-of-way" rule sets have expired) to retrieve the temporary roadside beacon. In the case of Ms. Hood, her vehicle downloaded the rule set the prior evening, when the rule for the new stop sign was known but before it was activated; as a result, the vehicle was aware that a sign might be encountered but would proceed as normal unless it received an update. As Ms. Hood's vehicle approaches the site of the sign, it receives the broadcast from the temporary beacon activating the sign and the Level 4 ADS stops without causing Ms. Hood to spill her coffee. This approach ensures that the electronic rules stay synchronized with field conditions, even when traffic control devices are not installed according to original schedule. NOTE: The same process can be followed for the installation or removal of any traffic control device. |
incorporates:
UN-33 Trustworthiness — Reliability — Timeline…
UN-12 Trustworthiness — Reliability — Timeline…
UN-56 Rule-maker — Publicize — Rules at a dist…
SP:
SP-20 The ConOps should provide practical use …
SP-81 The ConOps should include a use case tha…
SP-152 Process to deploy known rules includes p…
SP-186 Within our scenarios, we should assume t…
|
|
S-49 |
8.3.5 Encountering a variable speed limitAs Ms. Hood's vehicle gets onto the motorway, it encounters a section of road managed with a variable speed limit system. The location of the variable speed limit system was included in the pre-announced "motor vehicle speed limit" rule set retrieved the previous evening. The ADS had also checked the speed limit as it started the trip (for trip navigation purposes) but as this is a variable speed limit system, the exact speed limit is not known for certain until the driver enters the subject road section. As the ADS approaches the location of the variable speed limit system, the METR receiver expects to receive a broadcast of the current speed limit. If the broadcasted supplemental data is not received, the METR receiver might try to connect to the disseminator to retrieve the information or use its on-board cameras to detect the posted speed limit. If all of these means fail, the ADS would disengage. In this case, the broadcasted supplemental data is received and the METR receiver provides the information to the ADS without Ms. Hood having to get involved. Ms. Hood continues comfortably towards her grandmother's house. |
incorporates:
UN-33 Trustworthiness — Reliability — Timeline…
UN-12 Trustworthiness — Reliability — Timeline…
UN-56 Rule-maker — Publicize — Rules at a dist…
|
|
S-50 |
8.3.6 Snow chain requirementsAs Ms. Hood begins to cross the mountain pass, the weather takes a turn for the worse and snow begins to accumulate on the roadway. Shortly afterwards, the METR receiver receives a notification that snow chain regulations have been activated. This rule indicates that there is a 30-minute grace period prior to the rule being enforced, which is designed to allow drivers to safely stop and put chains on at designated areas. Ms. Hood's ADS is advanced enough to be allowed to drive under such conditions, but the vehicle is still required to use chains. The ADS alerts Ms. Hood of the recently activated rule and informs her that it will stop at the next safety spot to allow her to install the chains. Luckily, Ms. Hood always keeps snow chains in the car. When the car stops, she gets out and installs the chains and uses the vehicle's interactive display to confirm that the chains are properly attached to the tires. Once Ms. Hood is resettled into her snug cabin, the ADS continues on its way, verifying that the tire sensors detect traction and vibrations that are consistent with having snow chains on the wheels. |
incorporates:
UN-36 Trustworthiness — Reliability — Quality …
UN-33 Trustworthiness — Reliability — Timeline…
UN-12 Trustworthiness — Reliability — Timeline…
UN-64 User — Status — Manual inputs
|
|
S-79 |
8.3.7 Pit stopAs the trip continues, Ms. Hood realizes that coffee is a diuretic. She requests the ADS to accommodate a comfort break and indicates the types of conveniences that she would like to use, which includes a toilet, a convenience store, and an electric charging spot for the car. The ADS works with Ms. Hood's virtual assistant to identify several options and Ms. Hood confirms a final selection. The ADS adds the stop as a waypoint and the METR receiver contacts the respective disseminator to obtain its necessary pre-announced rules for the newly added road segments. As the ADS approaches the waypoint, it takes the exit and navigates to the selected convenience store without any intervention by Ms. Hood. |
incorporates:
UN-3 Trustworthiness — Reliability — Availabi…
UN-27 User — Disseminator — Discovery
|
|
S-7 |
8.3.8 ADS fallback based on METR informationAs Ms. Hood nears her destination, the ADS begins to remind her that end of the journey includes a section outside of its ODD and that she will have to take over the DDT. In its pre-trip planning, the ADS identified potential locations where local rules indicate that it can achieve a "minimal risk condition" for the purpose of switching to manual-drive mode; shortly before exiting the motorway, it informs Ms. Hood of where it will park so that she can assume control. Once stopped, Ms. Hood assumes control of the vehicle and continues along her journey assisted with the driver support system. She arrives at her grandmother's house before Mr. Big Bad Wolf arrives. |
incorporates:
UN-2 Trustworthiness — Reliability — Availabi…
UN-47 User — Rule — Categories
SP:
SP-20 The ConOps should provide practical use …
SP-97 The ConOps should indicate that we assum…
SP-124 Between METR and the map data, ADS-equip…
|
|
S-8 |
8.3.9 Starting outside of METR coverageAfter an extended visit with her grandmother, Ms. Hood decides to return home. However, her grandmother does not have any Internet connectivity and all the rules previously downloaded by her vehicle have expired. Ms. Hood is faced with two options:
Since Ms. Hood's vehicle supports manual drive mode, she opts to driver herself to an area with internet connectivity rather than waiting for someone to assist her. During this portion of the trip, the vehicle's driver support system is more limited than normal since its rules are out-of-date and what information is displayed is clearly marked as being of questionable trustworthiness. Nonetheless, many driver support features still work (e.g., anti-lock brakes) and Ms. Hood can still arrive without undue burden. Once she has received updated pre-announced rules, the ADS is allowed to re-engage and Ms. Hood returns home safely. |
incorporates:
UN-88 Trustworthiness — Reliability — Quality …
UN-42 User — Rule — Obsolescence
SP:
SP-98 The ConOps should provide an example use…
SP-99 The ConOps should indicate that for the …
SP-100 Any remote refresh would have to be prov…
|
|
S-57 |
8.4 Klaus the truck operator |
||
S-58 |
8.4.1 OverviewKlaus drives a container-carrying commercial vehicle that includes a level-4 ADS. The operational design domain (ODD) for the truck includes most motorways and dual carriageways, but few single carriageways. Thus, the ADS controls the truck over long haul (inter-urban) routes, but Klaus typically takes over once the truck leaves major inter-urban facilities. The ADS requires the following electronic rule sets to engage: "general rules", "motor-vehicle road geometry", "motor vehicle right-of-way", "motor vehicle speed limits", and "regulated vehicle". In addition, when carrying dangerous goods, it must have the "dangerous goods" rule set. |
||
S-59 |
8.4.2 Download rulesWhile Klaus's truck is being loaded with the next delivery, the delivery addresses are electronically provided to his navigation system. The navigation system, in cooperation with an external service, computes several viable routes to provide all the deliveries while complying with corporate rules (e.g., avoiding cross-traffic turns). The navigation system then requests the METR receiver to report on the availability of its required rule sets for each of the routes developed. Some of the routes include sections that do not yet have all of the required rules in electronic form. The navigation system displays the various routes for Klaus, ordered based on overall efficiency which balances the desire to minimize total trip time while maximizing the percent of time spent with the ADS engaged. Once Klaus selects the route selection, the navigator requests the METR receiver to retrieve the rule sets for the entire route, contacting multiple disseminators, if necessary. The scope of rules requested include both the ADS-controlled parts as well as the sections for which Klaus will be responsible. When the ADS is in control, it is equipped with sufficient operational autonomy to deviate from its pre-defined route when necessary to avoid breaking any rules. If the ADS detects options (e.g., among two alternate paths), it may prompt Klaus for input, providing him with alternatives such as a longer fully automated route vs. a shorter route that has sections where Klaus must drive. In some cases (e.g., if the vehicle reverts to the fallback mode), Klaus will be alerted, and he is always allowed to take over control. When Klaus is in control, an on-board display shares relevant rules when Klaus is near an area where a rule might apply. It automatically notifies him if he seems headed for a road where his truck is not permitted, warns him of speed and lane restrictions and violations automatically. If Klaus deviates from a predicted route, the on-board electronics ask for any new relevant rules from the appropriate disseminator. |
incorporates:
UN-2 Trustworthiness — Reliability — Availabi…
UN-3 Trustworthiness — Reliability — Availabi…
UN-4 Trustworthiness — Reliability — Availabi…
UN-33 Trustworthiness — Reliability — Timeline…
UN-14 Trustworthiness — Reliability — Usabilit…
UN-27 User — Disseminator — Discovery
|
|
S-80 |
8.4.3 Hazardous goodsToday's trip includes the transport of hazardous goods. While the material is being loaded onto the truck, the shipping firm downloads information about the hazardous good to the on-board computer where it is stored. The on-board computer notifies the METR receiver of this special condition. The METR receiver then initiates the download of the "hazardous goods transport" rule set for each of the jurisdictions that it will pass through. One of the downloaded rules is a requirement for the hazardous goods manifest to be available via the on-board computer when proper emergency responder credentials are provided. The METR receiver notifies the on-board computer of this rule and the on-board computer ensures that the hazardous goods manifest is available as required by the rule prior to enabling the truck to depart. |
incorporates:
UN-19 User — Awareness — Jurisdictional classi…
UN-20 User — Awareness — Self-awareness
UN-47 User — Rule — Categories
|
|
S-60 |
8.4.4 Encountering rainAs Klaus begins his journey, he notices that it is beginning to rain. Local rules only require headlights to be activated when significant rain is detected, but Klaus' company has loaded all vehicles in the fleet with a rule that requires headlights to be activated anytime any precipitation is detected or anytime the windshield wipers are engaged. The Level-4 ADS detects a slight mist of rain with on-board sensors and activates the headlights and windshield wipers to comply to corporate rules. |
incorporates:
RC-60 General
UN-7 Trustworthiness — Reliability — Quality …
UN-12 Trustworthiness — Reliability — Timeline…
UN-65 User — Status — Environmental awareness
|
|
S-5 |
8.4.5 Ad-hoc rules due to emergencyAs Klaus leaves the city, the METR receiver is notified through a recent ad-hoc rule via wide area broadcast (entered by the local police) that the road the ADS had planned to take is has been closed and a detour has been defined. As a result, the ADS plots a new course that avoids the road closure. |
incorporates:
UN-33 Trustworthiness — Reliability — Timeline…
UN-56 Rule-maker — Publicize — Rules at a dist…
SP:
SP-20 The ConOps should provide practical use …
SP-82 The ConOps should also include a use cas…
SP-157 Ad Hoc rules might provide detour inform…
|
|
S-45 |
8.4.6 Downloading new rules en-routeThe ADS decides that the publicized detour is the most appropriate since it is being actively managed by the traffic centre to minimize delays and is designed to accommodate Klaus's large truck. The ADS notifies the METR receiver of the change and the METR receiver retrieves the additional rules for the new route. The detour route involves several signs deployed by police. Rather than issuing electronic rules for each of these signs, the police have temporarily issued a single electronic, ad-hoc rule banning ADS from operating along the detoured route. |
incorporates:
UN-33 Trustworthiness — Reliability — Timeline…
|
|
S-62 |
8.4.7 Transition to manual controlThe METR receiver notifies the ADS of the ADS ban and the ADS notifies Klaus of this rule. Klaus responds by taking over manual control of the truck. As this occurs, the driver information system engages, which assumes control of the on-board display while also blocking its use for most non-driving related tasks. |
incorporates:
UN-33 Trustworthiness — Reliability — Timeline…
|
|
S-61 |
8.4.8 Turn prohibitedAs Klaus continues to follow the detour, he encounters a temporary police sign that bans large trucks from turning at the intersection. This has been installed to prevent having large trucks travel through a business district. Klaus follows the direction on the sign, however, since the ban against large trucks was not transmitted electronically, his METR receiver had not expected Klaus to continue straight and once it realizes that Klaus has deviated from the defined detour route, it immediately contacts the disseminator to retrieve its necessary regulatory rules in the immediate vicinity. In the meantime, the interpreter informs the HMI that rule information is not available and the HMI warns Klaus of this fact; for the interim, Klaus will have to rely on physical traffic control devices. Eventually, the METR receiver obtains the necessary rules and the interpreter updates the HMI so that the warning is removed and rules are once again available through the main display - along with warnings, if and when Klaus violates any rules. Klaus continues to follow signage on the sign and he ends up on the town's ring road; eventually he rejoins the remainder of the detoured traffic on the other side of town at the end of the detour. As the detour ends, Klaus re-engages the ADS, as it is no longer banned. |
incorporates:
UN-33 Trustworthiness — Reliability — Timeline…
UN-55 User — Rule — Distribution — Prioritizat…
|
|
S-93 |
8.4.9 Crossing a major borderAs Klaus continues along his route, he crosses a national border. While international agreements and electronic technologies have made crossing this border almost seamless, there are changes in laws that impact how his METR receiver and ADS operate. In particular, the METR receiver works with other vehicle systems to address these changes, including:
From Klaus's perspective, when the ADS is operating nothing seems to change. When Klaus is in control of the vehicle, he may occasionally see warning messages that he would have not seen before (e.g., a warning that he did not stop long enough at the stop sign). |
incorporates:
UN-19 User — Awareness — Jurisdictional classi…
UN-20 User — Awareness — Self-awareness
UN-32 User — Facility — Jurisdiction
UN-87 User — Rule — Definition
|
|
S-63 |
8.4.10 On-board management of rulesOver time, the on-board electronics accumulate more and more rules based on the different routes that the truck has driven. As the rules age and expire, the METR receiver deletes them to preserve sufficient space for new rules. |
incorporates:
UN-14 Trustworthiness — Reliability — Usabilit…
|
|
S-51 |
8.5 Bilo the jet-set professor |
||
S-67 |
8.5.1 OverviewBilo is an international expert in his field and travels a lot. He has concluded that owning a car is an unnecessary expense and he usually relies on ridesourcing and does not have a driver's license. However, today he realizes that he will need to be making several distinct trips to visit multiple field sites and it would be better to have a vehicle at his disposal. He rents a high-end Level-5 ADS-equipped vehicle with no manual controls so that he has confidence that he does not have to worry about local traffic rules. |
||
S-92 |
8.5.2 Configuring the carAs a part of Bilo's rental car account, he has established a number of preferences. As the rental car company assigns a vehicle to his account, it also reconfigures the human-machine interface (HMI) component to use Bilo's preferred language, based on his previously established preferences. When METR rules and video image detected rules are received and processed, the interpreter translates the rules to the preferred language for its proper display on the HMI. While Bilo does not necessarily need to see most of these rules, as he is in a high-end Level-5 ADS-equipped vehicle, allowing Bilo the option to display the rules in his preferred language allows him to better understand the decisions being made by the vehicle. |
incorporates:
UN-13 Trustworthiness — Reliability — Transpar…
UN-17 Trustworthiness — Reliability — Usabilit…
|
|
S-68 |
8.5.3 Rental carIn addition to the rules that all other cars retrieve, the rental car also needs to be aware of additional rules (e.g., prohibition against driving on unpaved roads, limits within which the vehicle is allowed to operate) specific to the rental car company's vehicle fleet. While these rules could be provided by other means, the rental car company determined that this was the appropriate way to convey its rules to its vehicle fleet. While Bilo agrees to these rules as a part of the rental contract, the ADS navigation logic needs to be aware of the rules to ensure that they are not violated. As a result, the rental car company authorized its vehicle fleet manager as a rule-maker to establish these rules and provides its own METR distribution system to provide these rules to its vehicle fleet. Once the vehicle fleet manager decides upon a rule, it is entered by one of its two employees that are authorized to do so (i.e., "agents"). The rental car company also manages various car rental locations, each with their own parking lots with rules (e.g., one-way aisles/lanes, stop signs at exit points, restricted access) established by the local property manager. The local property manager is a rule-maker with the authority to establish these types of campus rules. Since non-fleet vehicles may also access the parking area for dropping off customers, campus rules that might be relevant to non-fleet vehicles are distributed using the main METR distribution system used for all other jurisdictional rules. Since these rules are enforced by a private entity (e.g., the rental car company itself with the aid of a tow truck operator), the rules do not have to be approved by any higher jurisdictional entity. The campus rule-maker may also choose to establish rules to restricted sections of its campus that are only distributed to the vehicle fleet via the campus's own METR distribution system. |
incorporates:
UN-33 Trustworthiness — Reliability — Timeline…
UN-14 Trustworthiness — Reliability — Usabilit…
UN-85 Trustworthiness — Security — Integrity —…
UN-27 User — Disseminator — Discovery
UN-45 Rule-maker — Jurisdictions — Rule-maker
UN-46 Rule-maker — Jurisdictions — Agents
|
|
S-69 |
8.5.4 Campus rulesThe first stop on Bilo's trip is the university campus. The university covers multiple square kilometres and has a road network separate from the city transport system. All the transport rules on the campus are governed by the university rather than by the city, except for University Avenue, a city street that traverses the campus. In particular, the default speed limit on the campus streets is lower than in the city due to the high number of pedestrians. The university's transport division is responsible for defining these rules and is registered with the local government as the provider of rules for the campus based on a letter of authorization from the campus owner. However, because the university relies upon city police to issue tickets, all its rules must be approved by the city prior to being enforced due to a clause in the contract with city police. The METR receiver in Bilo's vehicle is aware of Bilo's destination and requests rules from all of the necessary jurisdictions, including the national, regional, and city governments along with the private campuses encountered, such as the university. As Bilo enters the university campus, the ADS is aware that the jurisdiction has changed but is also aware that it is still on University Avenue and subject to the rules of the city. As the vehicle turns onto a campus street, it recognizes that the campus speed limits and other rules apply. |
incorporates:
UN-67 User — Awareness — Mapping
UN-86 User — Awareness — Geopositioning
UN-32 User — Facility — Jurisdiction
UN-43 User — Jurisdiction — Sub-areas
|
|
S-85 |
8.5.5 Rule discrepancySuddenly, Bilo's ADS detects an inconsistency. METR indicates that the road uses the lower university default speed limit, but the vehicle's video imaging system detects a speed limit sign with a slightly higher speed. The interpreter considers that the METR speed limit has not been verified for a couple of years, that it is signed by a less trustworthy source (i.e., a university rather than a large city), and that crowdsourced information started reporting an inconsistency a day earlier; it also notes that its video imaging system reported a high confidence on its reading of the sign. While the interpreter concludes that its video imaging system has more reliable data, it determines that it is safer to follow the lower speed limit and reports this lower speed limit to the ADS. The interpreter also notifies the discrepancy reporter, which then notifies the report handler at a randomized time after it reaches stable WiFi coverage (i.e., the delayed notification increases privacy by preventing the data from being used to identify its location at a point in time). When the report handler receives frequent notices of a discrepancy (based on street volumes), it provides an anonymized report to the rule verifier to investigate the discrepancy. It turns out that the university posted a new speed limit sign but did not yet enter the information into METR. The rule verifier notifies the university and the traffic division received a bit of a slap on the wrist for failing to follow its defined procedures. Nonetheless, the discrepancy feedback mechanism allowed the inaccuracy to be corrected within 72 hours. |
incorporates:
UN-8 Trustworthiness — Reliability — Quality …
UN-24 Trustworthiness — Security — Integrity —…
UN-58 Rule-maker — Conflicts — Physical
|
|
S-14 |
8.5.6 Permitted parkingThe large university campus requires visitors to have parking passes. During the trip to the university, the ADS identifies its preferred parking spot and interfaces with the METR receiver to obtain the rules for using the parking facility. The ADS then informs Bilo that he will be required to register and pay for a temporary permit to park on campus. Since Bilo is not driving, he fills out the necessary forms using the on-board computer and pays the associated fee. Once payment is confirmed and Bilo's visit is approved, the electronic permit is downloaded to the on-board computer and the on-board computer notifies both the ADS and the METR receiver of the newly received permit. The METR receiver then downloads additional rules for operating inside of the parking lot based on presenting the new certificate. As the vehicle reaches the parking lot, it discovers it is controlled by a gate. The on-board computer presents its permit electronically to the gate controller and is granted access without interfering with the METR receiver. As the vehicle enters the parking lot for which it has a permit, the ADS continues to control the vehicle, but in this case, the prevailing limiting speed limit is one defined by the vehicle's OEM. Although the university parking lot has a speed limit of 25 kph, the ADS is equipped with internal logic that limits its speed in parking lots to 20 kph. The METR receiver is constantly integrating all the rules it has (e.g., from national, regional, local, campus, fleet, OEM) and provides the resultant rules (i.e., typically the most restrictive rules) to the ADS, which applies them in its performance of the DDT. |
incorporates:
UN-39 User — Rule — Precedence
UN-40 User — Rule — Applicability — Permits
UN-44 Rule-maker — Jurisdictions — Assign sub-…
SP:
SP-20 The ConOps should provide practical use …
SP-145 Within one of its scenarios, the METR Co…
SP-147 Within one of its scenarios, the METR Co…
SP-150 A METR operational scenario should indic…
|
|
S-39 |
8.5.7 Micromobility and VRUsOnce parked, Bilo exits his vehicle and realizes that he is still some distance from his scheduled meeting location, and he is running late. While Bilo normally avoids e-scooters, he decides that he will need to use one to get to his meeting on time. He notifies his virtual assistant, who arranges the rental and guides him to the nearest e-scooter available. As he approaches the e-scooter, the virtual assistant coordinates with the e-scooter rental company to ensure that access is provided as soon as he boards the vehicle. Bilo's virtual assistant also downloads the local e-scooter rule set and informs Bilo of the optimal route to reach the destination. As Bilo is in a bit of a rush, the virtual assistant reminds him several times to not exceed the campus speed limit for e-scooters and to stay within the designated e-scooter lanes. After encountering various challenges along the way, Bilo makes it to his meeting on time. |
incorporates:
UN-19 User — Awareness — Jurisdictional classi…
UN-20 User — Awareness — Self-awareness
UN-47 User — Rule — Categories
UN-34 User — Rule — Distribution — Efficiency
|
|
S-74 |
8.6 Partially blind Fiona |
||
S-75 |
8.6.1 OverviewFiona just bought a new cup and saucer and is headed home from the store. Due to a recent eye injury from an e-scooter incident, she relies heavily on ride-sourced services that she accesses through her smartphone. When she requests service, she enters her origin and destination, and the ride-sourced service determines whether to send a driverless or conventional (driver-provided) car based on current demands and the rules that currently apply. |
||
S-81 |
8.6.2 Navigation to meeting spotThe ride-sourced service notes that Fiona's account is authorized for using special kerbside passenger loading location for those with disabilities. The ride-sourcing service maintains its own database of METR rules by downloading a small number of rule sets. While many of these rules are static and could be maintained separate from METR, the ride-sourcing company has realized that using METR is important to accommodate changes to rules due to special events and other reasons. The ride-sourcing service directs both Fiona and the driver of the conventional car that she is to meet to the closest passenger loading location for those with disabilities. The ride-sourcing service also provides an electronic copy of Fiona's permit to the driver with a timestamp so that the driver has evidence that he is authorized to access the restricted passenger loading location. In this case, the closest passenger loading location is co-located with a bus stop. |
incorporates:
UN-33 Trustworthiness — Reliability — Timeline…
UN-20 User — Awareness — Self-awareness
UN-40 User — Rule — Applicability — Permits
|
|
S-76 |
8.6.3 Kerbside pickupAs the driver approaches the passenger loading location, the METR receiver provides the driver information system with the rule defining the boundary of the bus-only lane. Although the driver has been informed of his permission to enter the bus lane, the ride-sourcing app has not been integrated with the driver information system so the driver information system is unaware of the permission and it warns the driver that he is infringing upon the bus-only lane. The driver acknowledges the alert once he comes to a stop and then locates Fiona and assists her into his vehicle. Now happily seated, Fiona enjoys the ride back to her house. |
incorporates:
UN-33 Trustworthiness — Reliability — Timeline…
UN-40 User — Rule — Applicability — Permits
|
|
S-40 |
8.7 Rosie the delivery robot |
||
S-70 |
8.7.1 OverviewRosie, along with eleven other sibling robots, has a simple task in life: to deliver packages along the last mile from a delivery van, that they all share as a home. However, this seemingly simple task entails knowing all sorts of information about local rules as well as being able to access live data from sensors to avoid collisions with her sister robots and other obstacles along the route, including humans, pets, wild animals, potholes, and other obstructions. |
||
S-73 |
8.7.2 Parking the vanRosie's parent van is a level-4 ADS-equipped vehicle with a broad ODD, and it has a human operator to address any problems that might occur. One morning the van drives to and parks at a location that METR rules indicate is a valid parking spot for the delivery vehicle and is reasonably centrally located to all twelve final delivery points. The van then opens its doors, and all twelve robots swing into action to disperse and deliver packages. |
incorporates:
UN-33 Trustworthiness — Reliability — Timeline…
UN-20 User — Awareness — Self-awareness
UN-67 User — Awareness — Mapping
UN-86 User — Awareness — Geopositioning
UN-48 User — Rule — Characteristics
|
|
S-82 |
8.7.3 Sidewalk closureOn the way to the parking spot, Rosie was already provided with all the pathway robot rules for the area that she will be serving. Even though Rosie is only two blocks away from her delivery location, as the doors open on the delivery van, she receives supplemental data from a nearby beacon that the sidewalk she was planning to use is closed due to construction activities. Additional rules inform her that she is not allowed to operate on the sidewalk on the other side of the street either – the local rule-maker determined that the foot traffic in the area was high enough that the single sidewalk on the street should be limited to human users. And due to her small engine, Rosie is not allowed to operate in the travel lanes of the street. Instead, she is forced to find an alternate route using only sidewalks, which takes her to locations that have not been recently mapped by the delivery firm. |
incorporates:
UN-33 Trustworthiness — Reliability — Timeline…
UN-19 User — Awareness — Jurisdictional classi…
UN-20 User — Awareness — Self-awareness
UN-86 User — Awareness — Geopositioning
UN-48 User — Rule — Characteristics
|
|
S-71 |
8.7.4 Reporting unexpected conditionsAs Rosie traverses the alternate path, dodging various pedestrians and e-scooters along the way, she encounters a section of sidewalk where the map indicates there should be a crosswalk ramp, but no ramp is present. missing ramp is not a problem for most humans, they are just stepping off the kerb and proceeding on their journey, but Rosie is not allowed (and not equipped) to do this. Instead, she notifies her parent van of the situation, and the van reroutes her to use yet another diversion route. The van then notifies its central office, which notifies the report handler to investigate. Rosie eventually makes her delivery and returns to her van to meet up with all her other sisters. |
incorporates:
UN-58 Rule-maker — Conflicts — Physical
|
|
S-72 |
8.7.5 Propagation of conditionsIn the meantime, the report handler receives sufficient reports of the missing crosswalk ramp that it notifies the rule verifier of the discrepancy. The rule verifier confirms the missing ramp and works with the map provider to correct the issue. The updates is information then becomes available to other users in the area that indicate their plans to use that sidewalk if they happen to have sidewalk requirements that exceed the current limitation (e.g., vulnerable road users in wheelchairs). |
incorporates:
UN-58 Rule-maker — Conflicts — Physical
|
|
S-52 |
8.8 Thibideaux on the Bayou |
||
S-83 |
8.8.1 OverviewThibideaux is enjoying his étouffée when he receives an evacuation order on his smartphone due to approaching "Hurricane Knut". He hops on his airboat and gets to his Level-3 ADS pickup that is parked on the bank of the bayou. As he arrives, he notices that the water has already risen since he parked but luckily, he can still get out before the gators notice he is there. |
||
S-1 |
8.8.2 Evacuation ordersThibideaux attempts to engage his ADS once he gets on the road, but along with the evacuation order the city issued a couple of ad-hoc METR rules. The first was the evacuation order that everyone should leave specified low-lying areas. These areas are designated as a geofence and contained as a part of the evacuation rule. The second rule was a temporary ban on the use of ADS in the evacuation area and on all evacuation routes. These rules were prioritized by the translator, which resulted in them being sent to all receivers contacting the disseminator as soon as contact is made (i.e., to ensure that they are delivered prior to communications being lost). As a result of these rules, Thibideaux is forced to manually drive the car with the assistance of the driver support system.
|
incorporates:
UN-33 Trustworthiness — Reliability — Timeline…
UN-67 User — Awareness — Mapping
UN-55 User — Rule — Distribution — Prioritizat…
SP:
SP-20 The ConOps should provide practical use …
SP-165 In some cases, authorities might disable…
SP-168 In order to automatically update systems…
|
|
S-41 |
8.8.3 Manual traffic directionsAs Thibideaux creeps along in slow traffic, he approaches the motorway and discovers that the motorway is now operating in evacuation mode with both sides of the motorway being used to evacuate people from the shoreline. A police officer is on-site directing everyone in his lane to enter the motorway - in what is normally the wrong way. Thibideaux follows the orders of the police officer and enters the motorway using what is normally an off-ramp. |
incorporates:
UN-33 Trustworthiness — Reliability — Timeline…
UN-39 User — Rule — Precedence
UN-90 Rule-maker — Rules — Non-electronic
|
|
S-84 |
8.8.4 Ignoring signs that are overriddenAs Thibideaux enters the motorway, he observes "do not enter" signs along with several signs facing the other way. It is odd driving on the other side of the road, but he understands the situation as this is what agencies have always told him would happen in case of an evacuation. Normally, if Thibideaux entered the motorway using the off ramp, his driver information system would be constantly issuing audio and visual warnings due to the wrong way travel. It would also issue electronic warnings to other drivers. Fortunately, his driver information system is aware of the situation. Shortly after the METR receiver received the evacuation rule and rule banning the operation of ADS, it also received a rule indicating that this stretch of motorway was being converted into its hurricane evacuation mode, which includes contraflow operation. This information was provided to the driver information system, and, as a result, it does not issue any of the warnings and is able to distinguish electronic wrong way warnings from other vehicles when they are properly driving in the evacuation direction. While the trip takes longer than normal, Thibideaux arrives at his relative's house, where he can safely ride out the storm while enjoying the local gumbo while listening to Buckwheat Zydeco. |
incorporates:
UN-39 User — Rule — Precedence
|
|
S-12 |
8.8.5 Reporting inconsistent dataWhile Thibideaux likes his relatives, he only likes them so much. He decides to leave shortly after the storm and return to his own home on the bayou. As he starts his truck, his METR receiver is notified that cellular data coverage is unavailable for portions of his route back. As he travels the motorway, he begins to see all the devastation left by the storm, which includes fallen trees, blown-down signs, and high water levels. The ADS ban is still in effect, so he is manually driving, but with his driver information system, he is aware of the pre-announced speed limit, stop signs, gator crossing, and other rules based on stored METR information. He is also alerted several times along the trip with ad-hoc rules that have been established by the police to warn of specific high-water areas. Some of these are broadcast through the use of localized beacons while others are announced a wide-area signal where coverage is available. As he travels, the interpreter on-board Thibideaux's vehicle compares the METR rules against what is reported by its cameras. The interpreter of the rules is aware that the area has recently experienced a hurricane and when inconsistencies between METR rules and physical traffic control devices (e.g., mainly due to missing signs coupled with a few temporary detour signs placed by police), it notifies its discrepancy reporter. Intermittently, Thibideaux's pickup enters into cellular coverage. Due to the number of discrepancy reports that it is holding, the discrepancy reporter decides to immediately upload the discrepancy reports to the report handler. As the report handler receives multiple reports from independent sources, it notifies the verifier of the reported discrepancies. Normally, the report handler and the verifier would flag the number of distinct discrepancies at different locations as suspect, but because they are aware of the recent hurricane, they accept that these might be real reports worthy of investigation. Within a couple of hours of the storm passing through, the agency is aware of virtually all potentially missing signs in the region due to various drivers reporting discrepancies; unfortunately, the shear volume of missing signs means that it will be a while before they are all investigated and replaced. To minimize the volume of discrepancy reports exchanged, the verifier notifies the translator to issue a notice for each discrepancy reported and to indicate that it is being investigated. At this point, the notices include an indication that interpreters should make their own best judgement of which source to believe (i.e., as the reports are not yet verified, it is inappropriate for the verifier to provide guidance). As the verifier investigates each inconsistency, it directs the translator to update its data, for example to:
With this information interpreters are better able to ensure that they provide METR users with trustworthy information in a timely manner. |
incorporates:
UN-2 Trustworthiness — Reliability — Availabi…
UN-9 Trustworthiness — Reliability — Resilien…
UN-31 User — Conflicts — Observed
SP:
SP-20 The ConOps should provide practical use …
SP-91 A disseminator should not publicize repo…
SP-135 We need an example scenario that describ…
|
|
S-91 |
8.8.6 Encountering a disabled traffic signalThe METR receiver is aware of where traffic signals are located and where the vehicle should receive supplemental data with real-time traffic signal timing information. However, as Thibideaux approaches one of the recorded traffic signal locations, no such data is received. The driver information system warns Thibideaux that the signal is not transmitting electronic information as it should be and that he should be extra cautious; it also reminds him of the rule that requires him to treat the intersection as being under a four-way stop sign control when the signal is not displaying any indications. Thibideaux realizes that the traffic signal is without power and is not showing any indications. He treats the signal as a four-way stop and proceeds. |
incorporates:
UN-6 Trustworthiness — Reliability — Availabi…
UN-12 Trustworthiness — Reliability — Timeline…
UN-58 Rule-maker — Conflicts — Physical
|
|
S-78 |
8.9 Larry the lawyer |
||
S-86 |
8.9.1 OverviewLarry is a lawyer that has been hired to defend a client for a ticket that was issued because the Level-3 ADS that was engaged at the time of the ticket was supposedly following the speed limit being publicized through METR. |
||
S-87 |
8.9.2 DefenceOne of the main pieces of evidence that Larry relies upon is the records that are maintained by the on-board ADS, the METR receiver, and the METR disseminator. Each of these system components record what information it received and made available. Further, each component strictly controls data access to prevents users from inappropriately modifying their logs. From these records, Larry can demonstrate that the disseminator was publishing the pre-announced rules of a higher speed limit and that the METR receiver and ADS relied upon this information. He can further show that the rules were initially signed by the translator, in this case the city transport department, and then sent to the collector and disseminator prior to their distribution to his client's vehicle. |
incorporates:
UN-13 Trustworthiness — Reliability — Transpar…
UN-21 Trustworthiness — Security — Integrity —…
UN-23 Trustworthiness — Security — Integrity —…
|
|
S-88 |
8.9.3 ProsecutionThe prosecutor points out that the lower speed limit was due to an ad hoc rule that was put into effect shortly before the ticket was issued. The prosecutor was able to demonstrate that the local RSUs sent out notices of the ad-hoc rule along with a timestamp of when the ad-hoc rule began. For whatever reason, the METR receiver did not have a record of receiving the ad-hoc rule, resulting in the violation and the ticket. |
incorporates:
UN-13 Trustworthiness — Reliability — Transpar…
UN-23 Trustworthiness — Security — Integrity —…
|
|
S-89 |
8.9.4 RebuttalLarry can demonstrate that several other vehicles in the area that day did not record any reception of the lower speed limit ad hoc rule and that no vehicles had been discovered that did receive the transmission. The issue is left to the courts to decide. |
incorporates:
UN-13 Trustworthiness — Reliability — Transpar…
UN-23 Trustworthiness — Security — Integrity —…
|
Does the METR receiver provide data based on queries or does it notify other entities of rules?
To what extent does the METR receiver receive and process supplemental data and provide the results to other entities vs the other entities being responsible for processing the supplemental data?
Example 1: Does a METR receiver include a clock and determine when time-of-day rules are active or is that the responsibility of each METR user?
Example 2: Does a METR receiver process SPaT information and inform METR users when they have permission to make certain maneuvers or does the METR receiver only provide locations of signals and require the user to handle the SPaT message?
If the answer is different between Example 1 and Example 2, where is the system boundary line?