آموزش و ابتکار ایمنی در مقابل بوروکراسی ایمنی در طراحی بخش ترافیک

This paper deals with the processes of evaluating the possible safety effects of measures introduced either in the road infrastructure or in the electronic and information systems in cars. It uses speed control measures (speed bumps and the Intelligent Speed Adapter [ISA]) as cases to describe and test the approach. The paper describes and critically assesses the current methods of ex-ante design and evaluation of such measures, which relies on design to national and international standards. It criticises this approach, particularly from the point of view of predicting unexpected and unwanted effects of the new designs. It proposes an adapted form of hazard and operability study as a tool to help predict these effects and validates this approach against the experiences of a field study of an ISA instrument.

The use of information and communication technology in traffic is increasing. Advanced Driver Assistance Systems (ADAS) have been developed to support the driver by providing information or even to temporarily take over part of the driving task. For instance systems for lane keeping in trucks and for distance keeping for cars on motorways have already been introduced to the market. ADAS for other driving tasks are expected. These future ADAS will support many tasks at the same time. Such an integrated system may for example include route guidance, distance and speed keeping. Although car manufacturers sell these systems as ‘comfort extensions’ the applications have the potential to influence the safety of the user and/or the safety of the road traffic system as a whole. Up to now safety assessments of ADAS mostly occur by testing a more or less standard set of possible safety issues in various simulations and field trials, based on checklists and guidelines. The emphasis in (larger) field tests for ADAS has focused on acceptance of the specific system under study and on predictable safety effects (Jagtman et al., 2001). These mainly consist of testing for known technical problems, for the usability of the system and for effects on safety resulting from the desired (normative, designed) operation of the system. The criteria available in all current evaluation frameworks have mainly been derived from this intended operation process (see, Carsten, 1993, Morello, 1995 and European Transport Safety Council, 2001). However effects on safety can also result from all kinds of deviations from the process that is intended. When we are dealing with new technologies, not yet introduced to the market, the range of safety effects is particularly uncertain. Apart from unexpected modes in which the ADAS may operate and all sorts of user violations, the system settings may generate deviations. The driver may use a device in a way that does not comply with the limited conditions in which it should be used according to the designed intended process. For example, distance-keeping systems, which are extensions of the conventional cruise control, are, according to the instruction manuals, designed for motorway environments in which a steady speed can be driven for a prolonged period. However one can switch-on such ADAS at any speed from 30 or 40 km/h or faster (see e.g., BMW, 2002, Mercedes Benz, undated and Nissan, undated), which could be in a congested traffic situation without a steady speed. A safety assessment should identify and incorporate all such plausible scenarios resulting not only from the intended operation processes, but also from deviations from them.

The need to rethink the safety assessment procedure for in-vehicle systems has arisen since various ADA systems have come on the market. These systems potentially influence not only the single driver but also other road users in the vicinity of ADA equipped vehicle, since they can influence the safety of the interactions between road users. Plausible scenarios in road traffic, in which ADAS equipped vehicles participate, are not only defined by the variety of modes defined by the functionality of such systems, but also by the use of the systems by the drivers. Innovation is ongoing, which means that the scope of these scenarios today is still not fully known. Current approaches and methods for safety assessment require designers to define scenarios based only on the proper functioning of the ADAS and on deviations (failures) in its basic functionality. These do not include deviations from the intended use by drivers. The scenarios that are currently (implicitly) tested at the driver safety and traffic safety level arise from state-of-the-art knowledge at the time the standards and guidelines were established. Although a bureaucratic strategy, such as the type approval procedure, is suitable for well-known systems and components, the use of performance and product guidelines and standards to assess the safety of new technologies under development inevitably lags behind newer understandings. The current guidelines and preliminary standards available in the bureaucratic strategy also tend to split up the problem into elements, which are seen as operating autonomously. It does not consider an overall assessment of the traffic system, including the dynamic environment in which the ADAS will be used. The failure scenarios identified at the functional level, for instance, are not included in analyses on the other safety levels. Furthermore the evaluation omits a study of the system level of interactions between drivers with an ADAS equipped vehicle and other road users. Finally future vehicles will most probably have several ADAS installed. The current guidelines and standards do not cope with the possible interference between the assistance provided by these different ADAS. The type approval procedure lays the responsibility for identification of all plausible scenarios, including those related to deviations from the intended use, primarily with the approval authority. Designers in such a regime can wash their hands of responsibility, provided that they comply with the standards, and do not have to think about the implications of their design in a broader context. Another considerable problem lies in the fact that the assessment for type approval takes place at the end of the design process, which can create problems if safety issues are only then identified. An alternative has been presented in this paper: a proactive strategy. The traffic Hazop specifies a systematic procedure to identify potential safety problems explicitly from an early stage in design, through to detailed design. The method includes the identification of problems at all safety levels by means of a brainstorm driven by guidewords and traffic parameters. It also includes the discussion of expectations of road users to take account of the complex interactions which regulate the traffic process. The Hazop method has been found to be able to go beyond the known effects and explored problems resulting from past deviations and to penetrate into the design limitations of the ADAS and the problems of predictable use and ‘misuse’. The method is applicable to define what evaluation questions policy makers need to get answered in order to decide whether the ADAS can be introduced. It provides a method for designers to review their developing designs. Although the proactive and the bureaucratic strategies were discussed earlier in this paper as two extremes or alternatives, the two can better be seen as complementary; the approaches used in one strategy can be used to overcome problems in the other. The type approval procedure asks for an advice from an authority regarding the acceptability of new technologies for which current standards are inadequate. This gap can be filled by the use of the proactive traffic Hazop as a procedural way to derive and rate problems and make explicit how they can be or are being solved. This offers the opportunity to start discussion during the design process. This can help to increase the awareness of both designers and policy makers about potential safety problems.