View More
Share




04

How Toyota Approaches Automated Driving Development

DEFINITIONS: AUTOMATED OR AUTONOMOUS?

Over decades, vehicles have become more automated. Direct control over key functions, such as acceleration and braking, is increasingly  handled by computers. More recently, new technologies have emerged to perform additional tasks, such as helping keep a vehicle in its lane or taking some control if a collision is imminent.

With the rise of systems that can perform some or all driving tasks, a host of terms have entered the market to describe them. These include “automated,” “highly automated,” “semi-” and “partially autonomous,” “self-driving,” and “driverless,” to name a few. 

In general, Toyota uses the word “automated” to describe vehicle functions performed with little or no direct human control. We use the term “autonomous” to describe only those vehicles where an automated system can perform the full-time dynamic driving task.

By contrast, much of what is commonly described as an “autonomous vehicle” is not truly “autonomous” from human oversight or driving responsibility. Care using these terms is important, as their application to vehicles in the market may impact consumer expectations and understanding about how those vehicles perform. As we implement these technologies in passenger vehicles, we believe it is more appropriate to describe accurately, or to use terminology that suggests, the actual function the vehicle can perform.

Regardless of whether one prefers “automated” or “autonomous,” just one word fails to describe the range of research into the capabilities of these emerging vehicles. For that, international standards have been developed to establish a baseline.




STANDARDS FOR VEHICLE AUTONOMY

The SAE International standard J3016 categorizes vehicle autonomy based on whether a system can operate in some or all driving modes, and whether the driver or the vehicle is responsible for three categories of driving tasks: steering and acceleration/deceleration; monitoring the driving environment; and fallback responsibility if the system cannot manage dynamic driving tasks.

SAE has defined levels of vehicle automation that range from no automation at Level Zero to full automation at Level Five.

 

SAE LEVELNo Automation
the full-time performance by the human driver of all aspects of the dynamic driving task, even when enhanced by warning or intervention systems
Execution of Steering
& Acceleration/
Deceleration
Human Driver
Monitoring of Driving
Environment
Human Driver
Fallback Performance
of Dynamic Driving Task
Human Driver
System Capability
(Driving Modes)
 
SAE LEVELPartial Automation
the driving mode-specific execution by one or more driver assistance systems of both steering and acceleration/ deceleration using information about the driving environment and with the expectation that the human driver perform all remaining aspects of the dynamic driving task
Execution of Steering
& Acceleration/
Deceleration
System
Monitoring of Driving
Environment
Human Driver
Fallback Performance
of Dynamic Driving Task
Human Driver
System Capability
(Driving Modes)
Some Driving Modes
SAE LEVELHigh Automation
the driving mode-specific performance by an automated driving system of all aspects of the dynamic driving task, even if the human driver does not respond appropriately to a request to intervene
Execution of Steering
& Acceleration/
Deceleration
System
Monitoring of Driving
Environment
System
Fallback Performance
of Dynamic Driving Task
System
System Capability
(Driving Modes)
Some Driving Modes
SAE LEVELDriver Assistance
the driving mode-specific execution by a driver assistance system of either steering or acceleration/deceleration using information about the driving environment and with the expectation that the human driver perform all remaining aspects of the dynamic driving task
Execution of Steering
& Acceleration/
Deceleration
Human Driver & System
Monitoring of Driving
Environment
Human Driver
Fallback Performance
of Dynamic Driving Task
Human Driver
System Capability
(Driving Modes)
Some Driving Modes
SAE LEVELConditional Automation
the driving mode-specific performance by an automated driving system of all aspects of the dynamic driving task with the expectation that the human driver will respond appropriately to a request to intervene
Execution of Steering
& Acceleration/
Deceleration
System
Monitoring of Driving
Environment
System
Fallback Performance
of Dynamic Driving Task
Human Driver
System Capability
(Driving Modes)
Some Driving Modes
SAE LEVELFull Automation
the full-time performance by the automated driving system of all aspects of the dynamic driving task under all roadway and environmental conditions that can be managed by a human driver
Execution of Steering
& Acceleration/
Deceleration
System
Monitoring of Driving
Environment
System
Fallback Performance
of Dynamic Driving Task
System
System Capability
(Driving Modes)
Some Driving Modes

These levels provide valuable and useful guidance, and they serve an important role to bring consistency to global discussions and regulation around vehicle automation. However, when using this scale, we also consider the following three points:

    1. The taxonomy collapses several dimensions of varying capability and responsibility onto a single axis, and therefore implies a progression in vehicle automation from Level Zero to Level Five. In fact, automakers and technology companies are exploring the automated driving aspects of several SAE levels simultaneously. 

    2. SAE Level Three automation, where the vehicle is 100 percent responsible for monitoring the driving environment and must give sufficient time for drivers to act as fallbacks, is potentially as challenging to implement as Level Four automation, where the human driver has no responsibility at all.

    3. The difficulty of the driving environment – whether from traffic, weather conditions, construction, or other factors – is only used to differentiate SAE Levels Four and Five. In fact, this is a complex metric that applies to all levels


HOW TOYOTA THINKS ABOUT VEHICLE AUTOMATION IN ITS RESEARCH

Toyota’s work is divided into three basic areas of study: the capabilities of the automated driving system, the capabilities of the driver, and the difficulty of the driving environment.

Autonomy Capability
In our research into automated driving, we focus on two types of capability – one we call “Chauffeur” and another we call “Guardian”:





Guardian Capability is a measure of how much the automated driving system helps to protect vehicle occupants while the human is driving – both from mistakes or other errors by the driver and from external factors on the road such as vehicles, obstructions, or traffic conflicts. The higher the Guardian capability, the greater the number and types of crashes it can help protect against. For example, at a modest level of Guardian capability, systems like Lane Departure Alert (LDA) and Automatic Emergency Braking (AEB) can help prevent some crashes. At the highest level, Guardian capability would help ensure a vehicle driven by a human being would never cause a crash, regardless of any error made by the human driver, and steer a vehicle to avoid many crashes that would otherwise be caused by other vehicles or external factors.
Chauffeur Capability is a measure of the degree to which the vehicle takes primary responsibility for driving, relieving the human driver of some or all driving tasks. If the Chauffeur capability is low, the human may be responsible for monitoring the environment and acting as a fallback (similar to SAE Level Two). If the capability is a bit higher, the human driver may be responsible only for acting as a fallback (similar to SAE Level Three). If the Chauffeur capability is high, the human driver may have no responsibility at all (like SAE Levels Four and Five).

Guardian Capability is a measure of how much the automated driving system helps to protect vehicle occupants while the human is driving – both from mistakes or other errors by the driver and from external factors on the road such as vehicles, obstructions, or traffic conflicts. The higher the Guardian capability, the greater the number and types of crashes it can help protect against. For example, at a modest level of Guardian capability, systems like Lane Departure Alert (LDA) and Automatic Emergency Braking (AEB) can help prevent some crashes. At the highest level, Guardian capability would help ensure a vehicle driven by a human being would never cause a crash, regardless of any error made by the human driver, and steer a vehicle to avoid many crashes that would otherwise be caused by other vehicles or external factors.



Chauffeur Capability is a measure of the degree to which the vehicle takes primary responsibility for driving, relieving the human driver of some or all driving tasks. If the Chauffeur capability is low, the human may be responsible for monitoring the environment and acting as a fallback (similar to SAE Level Two). If the capability is a bit higher, the human driver may be responsible only for acting as a fallback (similar to SAE Level Three). If the Chauffeur capability is high, the human driver may have no responsibility at all (like SAE Levels Four and Five).



Although Chauffeur and Guardian capabilities reflect distinct concepts for automated driving, their development builds on similar perception, prediction, and planning technology. Indeed, the hardware and software required for Guardian capability serves as the backbone for Chauffeur capability


Human Driver Capability and Environmental Difficulty

Toyota’s work to develop automated driving technology is broader than just the capabilities of the vehicle itself. It also considers the capability of human drivers and the difficulty of the driving environment.

Importantly, driver capability and driving difficulty are not static. They instead rise and fall over time – driver capability adjusts based on factors like skill, level of fatigue, and level of distraction; driving difficulty shifts based on a range of issues including weather, traffic, or construction. Most of the time, driver capability may be sufficient to prevent a crash. It is the times when driving difficulty rises above the driver’s skill that a crash is likely.

 



Automated driving offers the potential to help offset those periods when driving difficulty is higher than the driver’s capability to navigate safely and provides Guardian capability when necessary to help prevent a crash. What’s more, at times of low driving difficulty, automated driving might be able to provide Chauffeur capability to relieve the driver in certain conditions.

At present, Guardian capability’s technical abilities might be higher than the driver’s skill only in some circumstances. Over time, though, Guardian capability will grow steadily as technology improves, with a goal of creating a vehicle never responsible for a crash regardless of errors made by a human driver. At the same time, Chauffeur capability will advance toward a goal of being able to drive safely in all conditions without any human responsibility for supervision or fallback.

Importantly, driving environments can be extremely complex and difficult, and no automated driving system – regardless of how capable it may be – is likely to prevent crashes entirely. A fundamental question yet to be addressed is “how safe is safe enough?” The answer will depend on government regulation, liability risks, societal acceptance, and what is technically possible. In general, we believe systems providing Chauffeur capability will need to be significantly safer than average human drivers to be accepted by society. Guardian capability, by contrast, may be judged against a lower standard, which is, on average and as often as possible, to “do no harm.”