According to Georges Massing, VP MBOS Automated Driving, Powernet & Integration E/E at Mercedes-Benz, the company’s new Drive Pilot L3 ALKS offers customers a unique, luxurious driving experience that gives them the most precious thing: time.
Drive Pilot is described as a Level 3 system – would you agree with that?
Drive Pilot is classified as an SAE Level 3 system, [termed] ‘conditional automated driving’. This is a paradigm shift: for the first time, a vehicle will be offered to customers that will take over the driving task and related responsibilities under certain conditions. As drivers in automated mode are allowed to disengage from the driving task, they cannot be expected to detect situations that are safety- and time-critical and take over the driving task immediately. Therefore, a conditional automated driving system like Drive Pilot includes appropriate safety features such as the ability to automatically perform emergency maneuvers – for example, independent emergency braking to avoid collisions. In addition, Drive Pilot supports a safe, predictable transition phase, which includes sufficient lead time for the driver to safely resume dynamic control.
Has the automotive sector been clear in how it explains self–driving features?
Safety is our first priority [at Mercedes-Benz]. This includes transparency regarding the capabilities of our systems, as well as system limitations. To avoid the general risk of confusing the customer about their responsibilities and systems capabilities, only true automated driving systems such as automated lane keeping systems (ALKS; UN-R157) – where the system is in primary control of the vehicle and not the driver – should be labeled to the customer as such. This will ensure greater understanding regarding the paradigm shift of taking over the driving task and related responsibilities under predefined conditions by
the ALKS system.
We install the technology that is needed for a safe and legally justified L3 system. That is not only redundant sensors, steering and braking systems, but also technology, concepts and strategies to recognize approaching emergency vehicles, for example. We designed Drive Pilot from scratch to offer an L3 system within the legal framework, rather than just adapting an L2 system with potential compromises. This includes a very clear user interface to ensure mode awareness and to avoid mode confusion. This will be proven by extensive and multiple test person studies in our driving simulator, at our proving ground and on the road.
What were some of the major technical and certification challenges?
It’s important to note that the technical approval regulation (UN-R157) under which such systems can be certified only came into force at the beginning of 2021. Only after this point could such a system be implemented in Europe – an opportunity we were the first manufacturer to seize. It should also be noted that with the amendment of the Road Traffic Act (StVG) for L3 systems in 2017, Germany became the first country to create a legal basis for the intended use of these systems.
However, at that time, there was no lidar sensor available at the higher volumes required in the automotive market that met the high performance and accuracy required for an L3 system. Thus, we first had to develop one together with a supplier. Other sensors like cameras and radars now have the necessary resolution for safe L3 operation.
Is the system currently restricted to certain roads and an overall speed limit?
Yes, it is true. First, we start offering our system in Germany compliant with the UN-R157 and in accordance with national laws, meaning 60km/h in dense traffic on motorways. The total passable distance for Drive Pilot in Germany is 13,191km. As mentioned before, our first priority is to offer a system that is safe and on which the driver can rely. Relying on our long-term experience gained through the market introduction of longitudinal and lateral control systems, we expect the same development for Drive Pilot as for our driving assistance system. We will start within a specific operational domain to ensure we offer a safe system; and will extend this specific domain as soon as possible but step-by-step, wherever the regulatory framework and national laws allow our customers to benefit from the full range of capabilities of an ALKS automated driving system.
How does the system know when it is on a road approved for its use?
The vehicle position of Drive Pilot is determined via a highly accurate positioning system that goes far beyond conventional GPS. This positioning system squares correction data-based satellite navigation data with sensor data and data from a quality-tested HD map. This adjustment is continuous and has an accuracy of less than 1m.
To ensure this accuracy over the entire lifecycle of the vehicle, even continental drift is taken into account in the calculation itself.
It should be noted that the reliability of positioning is many orders of magnitude higher than with consumer devices such as smartphones. For example, we collect sensor data using lidar, camera, radar and ultrasonic sensors to provide even further information on road geometry, route characteristics, landmarks or traffic signs.
The HD map also differs from maps for navigation devices by, among other things, its higher accuracy in centimeters rather than meter range, and its detailed junction and lane model. The system’s highly accurate positioning system is also enriched with information from the HD map. The HD map is supplied with up-to-date data during each journey, for example by sensors on the vehicle, and provides a three-dimensional road and environmental image.
Furthermore, it provides data on special traffic events, such as accidents or construction sites. The map data is stored in back-end data centers and is constantly updated. Each vehicle also stores an image of this map information on board, constantly comparing it with the backend data and updating the local data set if necessary. The HD map therefore offers stable positioning through a representation of the surroundings independent of factors such as shadows or a dirty sensor.
In addition, it provides information much earlier than it might be detected by sensors, such as information on short-term road geometry changes or special traffic events.
What have been the main testing and validation processes and challenges?
The most difficult part in developing automated driving systems is the perfect tuning between customer benefit and safety. We want to offer a system that as a first priority is safe and capable of managing as many traffic situations as possible. On the other hand, it shouldn’t confuse the driver through too many interventions, otherwise it wouldn’t be a huge benefit. In addition, it is a priority to bring a system out on the road that has been trained for as many unlikely events as possible.
The validation strategy for our former and current ADAS, as well as for Drive Pilot, is based on the current state of the art (such as the PEGASUS project), as well as on complementary methods: real-world testing in road traffic with specially equipped test vehicles to test the system in real traffic and to statistically analyze the resulting data; virtual, scenario-based testing using simulation to determine performance quickly and efficiently, even in scenarios that do not occur to a sufficient extent due to their low frequency in real-world testing; and determination and evaluation of sensor performance via analysis of the real tests, as well as by special tests on the test site for rare objects, to ensure that all relevant objects and environmental information are correctly recorded in Drive Pilot.
Further evaluation and safeguarding of driver interaction was carried out using the MB driving simulator, as well as special tests on the test site, via a step-by-step implementation strategy for Drive Pilot, as agreed with the authorities. A number of test rides with a safety co-driver were undertaken, alongside extensive testing on proving grounds with soft-crash targets, global vehicle targets and guided soft targets.
All these testing scenarios are based on the requirements of Regulation UN-R157, as well as on
our experience with real-life safety – for example, close cut-ins, lost cargo and vulnerable road users.
Last but not least, an important part of our validation is the scientific deterministic approach. This means we focus on the so-called corner cases, the above-mentioned unlikely events. Very rare, almost impossible traffic scenarios that may happen are derived from practical, but also highly theoretical, scientific considerations. Searching for corner cases combined with our many years of experience in testing and field validation of ADAS has served us very well so far. In practice that means, for example, that we essentially calculate several trajectories in parallel within the Drive Pilot algorithm while driving, to cover as many eventualities as possible.
What scenarios could see the system hand back control to the driver?
Weather conditions need to be appropriate for the system to operate: no heavy rain, no frost, no snow and daylight. The conditions are checked continuously via the vehicle’s sensor suite, including the road moisture sensor, light sensor or temperature sensor, as well as via back-end information and the HD map.
The system would also hand back control should an emergency vehicle be present on the road. To recognize emergency vehicles, we use a multipurpose camera in the rear window to detect blue lights and other special signals from emergency vehicles. Furthermore, we use the interior microphones that have a similar function as noise cancellation: even if music is played very loudly in the vehicle, a special algorithm filters sirens from nearby emergency vehicles.
All vehicles equipped with Drive Pilot have redundant steering and braking systems, as well as a redundant onboard electrical system that remains maneuverable even if one of these systems fails, to ensure a safe handover to the driver.
Please can you describe the HMI – how does the driver know when to take back control?
If Drive Pilot is outside of the ODD and fading out, the driver is requested to get back in control. Depending on the situation, we have visual, audible and haptic (belt tensioner) warnings. Among other things, our instrument cluster (UI) system and special illuminated displays in the steering wheel rim clearly communicate to the driver which driving mode the vehicle is in.
To ensure the driver’s ability to take over, a stereo infrared camera in the instrument cluster observes the movement of the head and eyelids, and other variables such as seat occupancy recognition are evaluated. The user interface with the various escalation levels has also been developed and validated on the basis of various, extensive driving simulator and test person studies.
In Germany, we allow secondary activities on the onboard systems, such as the central display, such as browsing the web, watching a movie and activities in the in-car office such as emailing or video conferences. Specific regulations concerning side activities may vary in different countries.
When Drive Pilot is not activated, these side activities are locked on the media display.
What next?
Germany adopted a pioneering role with its amendment of the Road Traffic Act (StVG) on March 30, 2017 (SAE-Level 3). It was the first country in Europe to clearly define that secondary activities are permitted for the driver while the Level 3 system is active. This can be, for example, the use of onboard systems for emailing or similar. We would like to see such clarity and uniformity in other countries as well, as it is difficult to explain to drivers why there are currently different regulations in each country.
Currently, we are working to offer Drive Pilot in other markets as well, initially in the USA and China. This will be done step-by-step as soon as the national legal situation there allows for conditional automated driving. However, in addition to the regulatory aspects, technical requirements must also be met, such as the availability of the HD map in the respective countries. Thus, there is still a bit of development/validation work ahead of us.
Now that the technical approval regulation for certifying such systems has come into force, it can be implemented in Europe – an opportunity that we seized quickly. With its amendment of the Road Traffic Act (StVG) for L3 systems in 2017, Germany created a legal basis for the intended use of these systems for the first time, and we have been working toward this point. We are bringing a system to market that has already been certified. Furthermore, Drive Pilot has been certified within the framework of an existing regulation and does not require a special process or exemption permit.
In parallel, we are confident that we will soon receive official approval for our L4 parking system, Intelligent Park Pilot. The new Mercedes-Benz S-Class, as well as the EQS and EQE, are the world’s first production vehicles preinstalled with our future infrastructure-based Automated Valet Parking (AVP) technology, called Intelligent Park Pilot.
This interview was first published in the April 2022 edition of Autonomous Vehicle International. You can subscribe to receive future issues, for free, by filling out this simple form.