Performance requirements
ANNEX IISupplementary provisions
ANNEX II Performance requirements 1. DDT under nominal traffic scenarios. 1.1. The ADS shall be capable of performing the entire DDT. 1.1.1. The capability of the ADS to perform the entire DDT shall be determined in the context of the ODD of the ADS. 1.1.2. As part of the DDT, the ADS shall be able to: (a) operate at safe speeds and respect speed limitations applicable to the vehicle; (b) maintain appropriate distances from other road users by controlling the longitudinal and lateral motion of the vehicle; (c) adapt its behaviour to the surrounding traffic conditions (e.g., by avoiding disruption to the flow of traffic) in an appropriate safety oriented way; (d) adapt its behaviour in line with safety risks and give the highest priority to the protection of human life; 1.1.3. The system shall demonstrate anticipatory behaviour in interaction with other road user(s), in order to ensure stable, low-dynamic, longitudinal behaviour and risk minimising behaviour when critical situations could become imminent, e.g. with unobstructed and obstructed vulnerable road users (pedestrians, cyclist, etc.) or with other vehicles crossing or cutting-in in front of the fully automated vehicle. 1.1.4. The requirements related to the DDT shall be fulfilled in the reverse direction if the reverse gear is required by or declared in the ODD, 1.2 The ADS shall detect and respond appropriately to objects and events relevant for the DDT within the ODD. Objects and events might include, but are not limited, to: (a) motor vehicles and other road user such as motorcycles, bicycles, scooters, wheelchair users, pedestrians, and obstacles (e.g. debris, lost cargo); (b) road accidents; (c) traffic congestions; (d) road works; (e) road safety officers and law enforcement agents; (f) emergency vehicles; (g) traffic signs, road markings; (h) environmental conditions (e.g. lower speed due to rain, snow). 1.3. The ADS shall comply with traffic rules of the country of operation 1.3.1. The ADS shall interact safely with other road users in accordance with traffic rules, such as via: (a) signalling manoeuvre intentions (e.g. direction indicator). (b) using the audible warning device where appropriate. (c) interacting safely with road safety officers/law enforcement agents, road maintenance workers, emergency service personnel, road inspectors, etc. (d) for dual mode vehicles, the ADS status (manual driving mode or fully automated driving mode) shall be recognizable for road safety officers/law enforcement agents 1.3.2. In the absence of specific traffic rules, vehicles with ADS intended to carry standing or unrestrained vehicle occupants shall not exceed a combined horizontal acceleration of 2,4 m/s 2 (in absolute value and calculated as the combination of lateral and longitudinal acceleration), and an acceleration rate of change of 5 m/s 3 . Depending on the factors influencing the risk to occupants and other road users, it might be appropriate to exceed these limits, such as emergency operations. 2. DDT under critical traffic scenarios (emergency operation). 2.1 The ADS shall be able to perform the DDT for all reasonably foreseeable critical traffic scenarios in the ODD. 2.1.1. The ADS shall be able to detect the risk of collision with other road users, or a suddenly appearing obstacle (debris, lost load) and shall be able to automatically perform appropriate emergency operation (braking, evasive steering) to avoid reasonably foreseeable collisions and minimise risks to safety of the vehicle occupants and other road users. 2.1.1.1. In the event of an unavoidable alternative risk to human life, the ADS shall not provide for any weighting on the basis of personal characteristics of humans. 2.1.1.2. The protection of other human life outside the fully automated vehicle shall not be subordinated to the protection of human life inside the fully automated vehicle. 2.1.2. The vulnerability of road users involved should be taken into account by the avoidance/mitigation strategy. 2.1.3. After the evasive manoeuvre the vehicle shall aim to resume a stable motion as soon as technically possible. 2.1.4. The signal to activate the hazard warning lights shall be generated automatically in accordance with traffic rules. If the fully automated vehicle automatically drives off again, the signal to deactivate the hazard warning lights shall be generated automatically. 2.1.5. In the event of a traffic accident involving the fully automated vehicle, the ADS shall aim to stop the fully automated vehicle and aim to perform a Minimal risk Manoeuvre to reach the Minimal risk Condition. ADS resuming normal operation shall not be possible until the safe operational state of the fully automated vehicles has been confirmed by self-checks of the ADS or/and the on- board operator (if applicable) or the remote intervention operator (if applicable). 3. DDT at ODD boundaries 3.1. The ADS shall recognise its ODD conditions and boundaries of the ODD. 3.1.1. The ADS shall be able to determine if the conditions for ADS activation are met. 3.1.2. The ADS shall detect and respond when one or more ODD conditions are not fulfilled or no longer fulfilled. 3.1.3. The ADS shall be able to anticipate exits from the ODD 3.1.4. The ODD conditions and boundaries shall be established by the manufacturer. 3.1.4.1. The ODD conditions to be recognised by the ADS include: (a) precipitation (rain, snow); (b) time of day; (c) light intensity, including when lighting devices are used; (d) Fog, mist; (e) Road and lane markings; (f) Road category (e.g. number of driving lanes, separated lanes; (g) Geographical area (if applicable). 3.1.5. When the ADS reaches the ODD boundaries, it shall perform a MRM to reach a MRC and shall warn the on board operator (if applicable)/remote operator accordingly (if applicable). 4. DDT under failure scenarios 4.1. The ADS shall detect and respond to ADS or/and vehicle malfunctioning behaviour. 4.1.1. The ADS shall self-diagnose faults and failures. 4.1.2. The ADS shall evaluate its ability to fulfil the entire DDT. 4.1.2.1. The ADS shall respond safely to a fault/failure in the ADS that does not significantly compromise ADS performance. 4.1.2.2. The ADS shall execute a MRM to achieve a MRC in the event of a failure of the ADS and/or other vehicle system that prevents the ADS from performing the DDT. 4.1.2.3. The ADS shall immediately upon detection, signal major failures and resulting operational status to vehicle occupants, the on-board operator (if available) or the remote intervention operator (if relevant), as well as to other road users in accordance with traffic rules (e.g. activation of the hazard warning lights). 4.1.2.4. If failures affect the braking or steering performance of the vehicle, the MRM shall be carried out with consideration for the remaining performance. 5. Minimal risk manoeuvre (MRM) and Minimal risk Condition (MRC) 5.1. During the MRM, the fully automated vehicle with the ADS shall be slowed down, with an aim of achieving a deceleration demand not greater than 4,0 m/s 2 , to a full standstill in the safest possible place taking into account surrounding traffic and road infrastructure. Higher deceleration demand values are permitted in the event of a severe ADS or severe fully automated vehicle failure. 5.2. The ADS shall signal its intention to place the fully automated vehicle in an MRC to occupants of the fully automated vehicle as well as to other road users in accordance with traffic rules (e.g., by activating the hazard warning lights) 5.3. The fully automated vehicle shall only leave the MRC after confirmation by self-checks of the ADS or/and by the on-board operator (if applicable) or remote intervention operator (if applicable) that the cause(s) of the MRM is no longer present. 6. Human machine interaction 6.1. Adequate information shall be given to the occupants of the fully automated vehicle wherever needed for safe operation and with regard to safety hazards, 6.2. If a remote intervention operator is part of the ADS safety concept, the fully automated vehicle shall provide means for vehicle occupants to call a remote intervention operator through an audiovisual interface in the fully automated vehicle. Unambiguous signs shall be used for the audiovisual interface (e.g. ISO 7010 E004) 6.3. The ADS shall provide vehicle occupants with means to request a minimal risk manoeuvre to stop the fully automated vehicle. In case of emergency: (a) for vehicles equipped with automatically operated doors, the unlocking of the doors shall be conducted automatically when it safe to do so, (b) a mean shall be given to passengers to exit a vehicle at standstill (opening the doors or via an emergency exit). 6.4. If a remote intervention operator is part of the ADS safety concept, the fully automated vehicle shall provide vision systems (e.g. cameras in accordance with chapter 6 of ISO16505:2019) of the occupant space inside the vehicle and of the surrounding of the vehicle to allow the remote intervention operator to assess the situation inside and outside of the vehicle. 6.5. If a remote intervention operator is part of the ADS safety concept, it shall be possible for the remote intervention operator to open the power operated service door remotely. 6.6. The ADS shall activate the relevant vehicle systems when necessary and applicable (e.g. opening doors, activate wipers in case of rain, heating system, etc.) 7. Functional and operational safety 7.1. The manufacturer shall demonstrate that an acceptable degree of consideration has been given to the functional and operational safety for the ADS during its design and development processes. The measures put in place by the manufacturer shall ensure that the fully automated vehicle is free of unreasonable safety risks to vehicle occupants and other road users during the vehicle lifetime when compared with comparable transport services and situations within the operational domain. 7.1.1. The manufacturer shall define the acceptance criteria from which the validation targets of the ADS are derived to evaluate the residual risk for the ODD taking into account, where available, existing accident data ( 1 ) , data on performances from competently and carefully driven manual vehicles and technology state-of-the-art. 7.2. The manufacturer shall have processes to manage the safety and continued compliance of the ADS over lifetime (wear and tear of components especially for sensors, new traffic scenarios, etc.). 8. Cyber security and software updates 8.1. The ADS shall be protected from unauthorised access in accordance with UN Regulation No 155 ( 2 ) . 8.2. The ADS shall support software updates. The effectiveness of the software update procedures and processes concerning the ADS shall be demonstrated by compliance with UN Regulation No 156 ( 3 ) . 8.2.1 As specified in the Software Update and Software Update Management System Regulation, for the purpose of ensuring the software of the System can be identified, an R2022/1426SWIN shall be used. The R2022/1426SWIN may be held on the vehicle or, if R2022/1426SWIN is not held on the vehicle, the manufacturer shall declare the software version(s) of the vehicle or single ECUs with the connection to the relevant type-approvals to the type-approval authority. 8.2.2 The manufacturer shall provide the following information in the information document: (a) The R2022/1426SWIN; (b) How to read the R2022/1426SWIN or software version(s) in case the R2022/1426SWIN is not held on the vehicle. 8.2.3. The manufacturer may provide in the information document a list of the relevant parameters that will allow the identification of those vehicles that can be updated with the software represented by the R2022/1426SWIN. The information provided shall be declared by the manufacturer and may not be verified by a type-approval authority. 8.2.4. The manufacturer may obtain a new vehicle type-approval for the purpose of differentiating software versions intended to be used on vehicles already registered in the market from the software versions that are used on new vehicles. This may cover the situations where type-approval regulations are updated, or hardware changes are made to vehicles in series production. In agreement with the type-approval authority, duplication of tests shall be avoided where possible. 9. ADS data requirements and specific data elements for event data recorder for fully automated vehicles 9.1. The ADS shall record the following occurrences whenever the ADS is activated: 9.1.1. Activation/re-initialisation of the ADS (if applicable) 9.1.2. Deactivation of the ADS (if applicable) 9.1.3. Request sent by the ADS to the remote intervention operator (if applicable) 9.1.4. Request/Input sent by the remote intervention operator (if applicable) 9.1.5. Start of emergency operation 9.1.6. End of emergency operation 9.1.7. Involved in a detected collision 9.1.8. Event data recorder (EDR) trigger input 9.1.9. Minimal risk manoeuvre engagement by the ADS 9.1.10. Minimal risk condition reached by the fully automated vehicle 9.1.11. ADS failure (Description) 9.1.12. Vehicle failure 9.1.13. Start of lane change procedure 9.1.14. End of lane change procedure 9.1.15. Abortion of lane change procedure 9.1.16. Start of intentional lane crossing 9.1.17. End of intentional lane crossing 9.2 Occurrences flags for points 9.1.13., 9.1.14., 9.1.16. and 9.1.17. are only required to be stored if they happen within 30 seconds before the occurrences in points 9.1.5., 9.1.7., 9.1.15. or 9.1.8.: 9.3. ADS Data elements 9.3.1. For each occurrence listed in point 9.1., the following data elements shall be recorded in a clearly identifiable way: 9.3.2. The recorded occurrence flag 9.3.3. Reason for the occurrence, as appropriate, 9.3.4. Date (resolution: yyyy/mm/dd); 9.3.5. Position (GPS coordinates) 9.3.6. Timestamp: (a) resolution: hh/mm/ss time zone e.g. 12:59:59 UTC (b) accuracy: +/– 1,0 second. 9.4. For each recorded occurrence, the RXSWIN, or the software versions, indicating the software that was present when the event occurred, shall be clearly identifiable. 9.5. A single timestamp may be allowed for multiple elements recorded simultaneously within the timing resolution of the specific data elements. If more than one element is recorded with the same timestamp, the information from the individual elements shall indicate the chronological order. 9.6. Data availability 9.6.1. The ADS data elements shall be available subject to requirements specified in the Union or national law ( 4 ) . 9.6.2. Once the storage capacity reaches its limit, existing data shall only be overwritten following a first in first out procedure with the principle of respecting the relevant data availability requirements. Documented evidence on the storage capacity shall be provided by the manufacturer. 9.6.3. For vehicles of category M 1 and N 1 , the data elements shall be retrievable even after an impact of a severity level set by UN Regulations Nos 94 ( 5 ) , 95 ( 6 ) or 137 ( 7 ) . 9.6.4. For vehicles of categories M 2 , M 3 , N 2 and N 3 , the data elements listed in point 9.2. shall be retrievable even after an impact. To demonstrate that capability, the following applies: Either: (a) A mechanical shock shall be applied to on-board data storage device(s), if any, at a severity level as specified in the component test of Annex 9C to the 03 series of amendment to UN Regulation No 100 ( 8 ) , and (b) On-board data storage device(s) shall be mounted in the vehicle cab/passenger compartment or in a position of sufficient structural integrity to protect against physical damage that would prevent the retrieval of data. This shall be demonstrated to the technical service together with appropriate documentation (e.g. calculations or simulations); Or, (c) The manufacturer demonstrates fulfilling the requirements of point 9.6.3. (e.g. for M 2 /N 2 vehicles derived from M 1 /N 1 ). 9.6.5. If the main on-board vehicle power supply is not available, it shall still be possible to retrieve all data recorded. 9.6.6. Data stored shall be easily readable in a standardised way via the use of an electronic communication interface, at least through the standard interface (OBD port). 9.7 Specific data elements for event data recorder for fully automated vehicles 9.7.1. For vehicles fitted with an Event Data Recorders in accordance with Article 6 of Regulation (EU) 2019/2144, it shall be possible to retrieve through the standard interface (OBD port) the ADS data elements as referred to in points 9.3.1. and 9.3.2. recorded for at least the last 30 seconds before the last setting of the occurrence flag ‘Event Data Recorder (EDR) trigger input’, alongside the data elements specified in UN Regulation 160 ( 9 ) , Annex 4 (EDR data). 9.7.2. In the absence of any occurrence referred to in point 9.1. within the last 30 seconds before the last setting of the occurrence flag ‘Event Data Recorder (EDR) trigger input’, it shall be possible to retrieve, alongside the EDR data, the data element corresponding to the last occurrences within the same power cycle referred to in points 9.1.1. and 9.1.2., as a minimum. 9.7.3. The data elements retrieved in accordance with point 9.7.1. or 9.7.2. shall not include the date and the timestamp or any other information allowing for identification of the vehicle, its user or owner. Instead the time stamp shall be replaced with information representing the time difference between the occurrence flag ‘Event Data Recorder (EDR) trigger input’ and the occurrence flag of the respective ADS data element. 9.8. The manufacturer shall provide instructions on how to access the data. 9.9. Protection against manipulation 9.9.1. An adequate protection against manipulation (e.g. data erasure) of stored data shall be ensured for example by way of an anti-tampering design 10. Manual driving mode 10.1. If the ADS allows manual driving for the purpose of maintenance or to take over after a minimal risk manoeuvre is provided in the fully automated vehicle, the vehicle shall be limited to 6 km/h and shall be provided with means to enable the person driving the vehicle to perform the driving task safely in accordance with the safety concept of the manufacturer. Except in case of failure, the ADS shall continue detecting an obstacle (e.g. vehicles, pedestrian) in the manoeuvring area and shall support the driver in bringing the vehicle immediately to a stop to avoid a collision. 10.2. If manual driving is limited to 6 km/h, it is not necessary for the driver to stay within the fully automated vehicle. The control can be performed via a remote control located in the vicinity of the vehicle provided that the vehicles stays in the direct line of sight of the driver. The maximum distance over which control is possible by a remote control shall not exceed 10 metres. 10.3. If, in manual driving, the vehicle is intended to be driven at speeds higher than 6 km/h, the vehicle shall be considered as dual mode vehicle. 11. Operating manual 11.1. The manufacturer shall draw up an operating manual. The purpose of the operating manual is to ensure the safe operation of the fully automated vehicle by means of detailed instructions to the owner, vehicle occupants, transport service operator, on-board operator, remote intervention operator and any relevant national authorities. When the fully automated vehicle includes the possibility of manual driving for the purpose of maintenance or to take over after a minimal risk manoeuvre, it shall also be covered by the operating manual. 11.2. The operating manual shall include the functional description of the ADS. 11.3. The operating manual shall include the technical measures (e.g. checks and maintenance works of vehicle and off-board infrastructure, transport and physical infrastructure requirements such as localization marker and perception sensors), operational restrictions (e.g. speed limit, dedicated lane, physical separation with oncoming traffic), environmental conditions (e.g. no snow) and operational measures (e.g. on-board operator or remote intervention operator needed) necessary to ensure safety during the fully automated vehicle operation. 11.4. The operating manual shall describe the instructions for vehicle occupants, transport service operator, on board operator (where applicable) and remote intervention operator (where applicable) and public authorities in case of failures and ADS request. 11.5. The operating manual shall set out rules to ensure proper performance of maintenance, overall tests and further examinations. 11.6. The Operating Manual shall be submitted to the type-approval authority together with the application for a type-approval and shall be annexed to the type-approval certificate. 11.7. The Operating Manual shall be made available to the owner and, where applicable, to the transport service operator, on-board operator (where applicable), remote intervention operator (where applicable) and any relevant national authorities. 12. Provisions for periodic roadworthiness tests 12.1. For the purpose of periodic roadworthiness tests, it shall be possible to verify the following features of the ADS: (a) Its correct operational status, by visible observation of the failure warning signal status following the activation of the vehicle master control switch and any bulb check. Where the failure warning signal is displayed in a common space (the area on which two or more information functions/symbols may be displayed, but not simultaneously), it must be checked first that the common space must be observed to be functional prior to the failure warning signal status check; (b) Its correct functionality and the software integrity, by the use of an electronic vehicle interface, such as the one laid down in point I. (14) of Annex III to Directive 2014/45/EU of the European Parliament and of the Council ( 10 ) , where the technical characteristics of the vehicle allow for it and the necessary data is made available. Manufacturers shall ensure to make available the technical information for the use of the electronic vehicle interface in accordance with Article 6 of Commission Implementing Regulation (EU) 2019/621 ( 11 ) . ( 1 ) For instance based on current accident data on buses, coaches, trucks and cars in the EU, an indicative aggregated acceptance criteria of 10 -7 fatalities per hour of operation could be considered for market introduction of ADSs for comparable transport services and situations. The manufacturer may use other metrics and method provided it can demonstrate that it leads to an absence of unreasonable safety risk when compared with comparable transport services and situations within the operational domain. ( 2 ) OJ L 82, 9.3.2021, p. 30 . ( 3 ) OJ L 82, 9.3.2021, p. 60 . ( 4 ) A storage capacity of 2 500 timestamps to correspond with a period of 6 months of use is recommended. ( 5 ) OJ L 392, 5.11.2021, p. 1 . ( 6 ) OJ L 392, 5.11.2021, p. 62 . ( 7 ) OJ L 392, 5.11.2021, p. 130 . ( 8 ) OJ L 449, 15.12.2021, p. 1 . ( 9 ) OJ L 265, 26.7.2021, p. 3 . ( 10 ) Directive 2014/45/EU of the European Parliament and of the Council of 3 April 2014 on periodic roadworthiness tests for motor vehicles and their trailers and repealing Directive 2009/40/EC ( OJ L 127, 29.4.2014, p. 51 ). ( 11 ) Commission Implementing Regulation (EU) 2019/621 of 17 April 2019 on the technical information necessary for roadworthiness testing of the items to be tested, on the use of the recommended test methods, and establishing detailed rules concerning the data format and the procedures for accessing the relevant technical information ( OJ L 108, 23.4.2019, p. 5 ).