The UKAEA owned Culham Science Centre is located in Oxfordshire and has some 10km of private (gated) roads and hosts approaching 2,500 tenants. As the roads are not classed as ‘the public highway’ we have been able to host trials of Level 4 self-driving vehicles¹ for in excess of 4 years with a high degree of safety throughout. During this time we have had to address what is sometimes called the self-driving vehicle paradox: arguably the greatest benefit from introducing such vehicles is improved road safety, but the single biggest challenged faced at the moment is proving that they can operate safely.

Our experience of hosting self-driving vehicle trials means that our site tenants have developed an implicit level of trust in the technology. However, we recognise that building such trust takes time to build, but it can then rise or fall as time goes on. Hence we are always looking at what evidence our site users, and the wider public are going to need if they are to spend their money on, or place their children in, a self-driving vehicle. Within this context we recognise that engineering-led approaches to building an evidence base tends to be ‘technology push’ and as such focus on collecting miles. Whilst such approaches are essential, the downside of such approaches is that driving real-vehicles on real-roads is time consuming, ties up expensive (and scarce) vehicles and cannot guarantee that the vehicles will experience all of the scenarios we can envisage them needing to be able to negotiate. This is where simulation comes in, with in-silico vehicles being able to navigate around tens of thousands of scenarios in minutes.
In the robotics and AI sphere simulation is a well-recognised development tool and the impact its application can have on the development cycle has been shown to significant.

For example in 2017 NASA launched the Space Robotics Challenge² as a virtual competition to advance robotic software and autonomous capabilities for space exploration missions on the surface of extra-terrestrial objects, such as Mars or the moon. The participants were asked to programme a NASA Valkyrie (prototype) humanoid robot to complete specified tasks using the Gazebo open-source robotics simulator³. This development in simulation, followed by implementation in ‘the real’ highlight the advantage of the approach in that the competition allowed multiple teams to look at the problem without having to queue up and take turns to utilise a scarce resource. The individual who ‘won’ the challenge was invited to implement his simulation based approach on one of only four physical Valkyrie robots, and it was reported that it took 3 hours to achieve this⁴.

However, simulation is not a panacea. The NASA challenge focused on a number of very difficult but well-defined tasks, and if the robot had been tasked with doing anything else it would have failed. This illustrates the strength of simulation where we can envisage allowing self-driving vehicles to demonstrate the ability of their systems to respond to well-defined challenges, and as such can be argued to demonstrate their ability to undertake the minimum range of manoeuvres that a robot/AI needs to be able to safely undertake. This ‘library’ can (and will) grow with time.

This approach of using simulation to address defined challenges is well developed, and much utilised, in the testing of self-driving vehicles, with companies such as Waymo regularly reporting how many billions of miles they have driven in a simulator⁵. As well as miles driven, simulators allow developers to explore how their systems will react under the tens of thousands of scenarios that exist within the library. Such libraries are highly dynamic and grow daily in the range and complexity of situations where the response of self-driving vehicles can be explored. As will soon be explained in forthcoming OmniCAV Blog taxonomies are emerging to allow these to be more systematically described and their coverage extended and the OmniCAV project is a leading contributor to this process.

However, no matter how good simulators are, unexpected things happen and we need to react to the seemingly random behaviour of individuals etc. (such as the pedestrian in Figure 1). As well as individual behaviour changing, so can the physical location – for example Figure 3 shows traffic on a road in Renfrewshire⁶ following heavy rain, where successful navigation of the flood requires knowledge of both where the road is, the water depth and its impact of steering/traction etc.

Setting this sort of situation up as a formal Operational Design Domain (ODD) whilst necessary does not lend itself to the application of current taxonomies. Similarly, Figure 4 shows a road in Maidenhead⁷ and from the visual information on offer it is not possible to say with confidence if we are seeing a degraded road surface that has trapped some surface water, or something more significant. In fact what we are seeing is the consequence of a sewer collapse and the water depth of the associated sinkhole is measured in metres. Finally, as Figure 5 shows that whilst sounding trite, it a nonetheless a truism that not all cars look alike and Figure 6 reflects the fact that new road layouts continued to be deployed…

One implication of this inherent unpredictability is that it is good practice to match simulations with real-world locations contexts and with this introduce a mechanism for incorporating ‘non-routine’ scenarios into the simulated analogue. Hence, we at the Culham Science Centre are looking to OmniCAV to produce a digital twin of our site, that will help improve safety, support increased learning and extend our relevance to those testing self-driving vehicles by supporting:

• Visualisation, by real-world users, in real-time that supports dynamic recalibrations
• The connection of otherwise disparate systems in a traceable manner
• An ability to refine assumptions with integrated predictive analytics
• Improved troubleshooting
• The emergence of tools to manage complexities and linkage within what is a highly interconnected systems-of-systems

An emerging area where we foresee simulation playing an increasing prominent role is in exploring how a self-driving vehicle responds to unforeseen incidents. For Level 4 vehicles the presence of an always-engaged safety operator means that when a vehicle finds itself outside its defined ODD the option of handing control of the vehicle back to the on-board safety operator always exists. However, as the much discussed fatal accident involving an Uber vehicle tragically illustrated⁸ this does not always work.

The development of global standards for vehicles is guided by the work of the United Nations Economic Commission for Europe (UNECE). A body that operates under the jurisdiction of the United Nations and promotes economic cooperation and integration⁹. One area where it is currently active is in the development of policy and regulation pertaining to self-driving road vehicles. In their deliberations they are guided by the principle that “When in the automated mode, the automated/autonomous vehicle should be free of unreasonable safety risks to the driver and other road users and ensure compliance with road traffic regulations¹⁰.”

What has emerged from the UNECE deliberations is the concept of a “minimal risk manoeuvre” as a procedure aimed at reducing risks in traffic. Where such a manoeuvre is to be automatically performed by the system when the driver does not respond to a transition demand. In many cases such a manoeuvre will entail slowing the vehicle or bringing it to a halt. However, this will not always represent the lowest risk option – for example being the only vehicle in the overtaking lane of a motorway that applies emergency braking is more likely to be a high than a low risk operation. In such circumstances, slowing the vehicle and pulling over to an unobstructed stretch of the hard shoulder is probably the minimal risk manoeuvre.

The emerging UNECE guidelines, which following a recent Law Commission consultation¹¹, look likely to be introduced into UK legislation require vehicle manufacturers to provide information to the technical service about which kind of minimum risk manoeuvres are foreseen depending on the given traffic situation. Given that it is essentially inherently dangerous to set up conditions where a vehicle needs to actively invoke a minimal risk manoeuvre. It is our expectation that simulation will play a huge role in supporting manufacturers in showing compliance with the expected legislation.

We believe that OmniCAV, with Culham as one of its physical twins, is very well placed to play a prominent role in addressing the self-driving vehicle safety paradox and in so doing help this exciting technology become a major factor in global thinking on personal mobility.