Self-Driving Cars of the Not-So-Distant Future
Eventually, fully automated vehicles (AVs) without any human supervision will occupy our roads. Before that time, however — due to functional limitations of automation, hardware failures or policy factors — drivers will have to oversee their automated cars and may have to resume manual control at certain times during their drives. These are so-called "Level-3" AVs.
Certain AV players — Google and Ford, for example — take the position that this middle ground of “part-time” autonomy should be cut out of the path to a driverless future. Others, including General Motors, BMW, Volvo and Tesla, advocate implementing automation incrementally so humans cede control of the driving task over time. Volkswagen has opened the door to an entirely new approach, developing a feature that allows drivers to manually control certain automatic drive settings without disengaging the self-driving mode altogether.
One necessary design feature of these shared-control AVs is a human-machine interface (HMI) that facilitates the transition of control. Suppliers are already grappling with how best to design their HMIs and instruct customers on how to use them. The challenge: to bring (or keep) the human driver’s attention to the system state when necessary, optimizing cognitive performance and reaction time against the risk of dangerous human errors.
AVs that fall short of full self-driving capability pose several practical and technical problems. The difficulties of part-time autonomy include the following:
Suppliers are Increasingly Attractive Targets for Litigation
For those manufacturers that embrace the step-by-step adoption of automated driving, the adequacies of the HMI’s design and performance — and the user’s responsive behavior — are issues that will arise frequently in litigation stemming from a crash involving their vehicles.
Usually, responsibility for defective products and warnings falls on original equipment manufacturers (OEMs), who are sophisticated users and bear the burden of integrating components into the final, consumer-facing product. However, to have a defense based on its downstream status, a supplier must have warned its OEM customer of the limitations of the component or system.
Despite the OEM’s presence, a supplier is liable for failing to warn consumers of a product’s limitations where it is practical to do so or where it participates in the system’s integration into the assembled vehicle. With many Level-3 systems being developed as complete solutions or in collaboration with OEMs or software providers, suppliers will increasingly find themselves targeted in litigation.
At least three other factors will accelerate that trend. First, automated driving components, by definition, supplant the human driver’s role in any given accident, removing an important party from the fault picture and leaving more responsibility to allocate to manufacturers, including the supplier.
Second, Tier 1 suppliers are growing rapidly in size and financial resources, thanks to both global vehicle production growth and unprecedented merger activity driven by an appetite for autonomous and connected mobility technology. Larger, richer suppliers make more attractive targets for warranty and product liability claims alike.
Finally, advanced data recorders can log more detailed information and stand up better to damage than current models. That data will assist in isolating the cause(s) of a given crash, which could increase the likelihood of a single part-maker bearing the accident liability, rather than sharing those costs with the OEM that assembled the vehicle.
Liability Risks of Level-3 AVs will be Difficult to Avoid
Since the prospect of AV-specific liability limitations or other safe harbors is bleak, OEMs and their suppliers will likely face civil liability in tort as they do now. Level-3 AVs and their HMIs will invite claims of negligence and claims based in strict liability for defective design and failure to warn.
If a reasonably foreseeable interaction with the product creates a risk of harm that is not apparent to the user and the accompanying warnings or instructions are inadequate, the manufacturer is held liable for any resulting personal injury or property damage. While the law presumes that product users will read manufacturer instructions and bars recovery where the user disregarded them, the seller’s warning must itself be adequate. In addition, even if a seller warns of a risk in compelling terms, the warning may be found inadequate if other messages detract from the warning’s overall impact. Overly positive representations, whether from advertisements, seller demonstrations, or other promotional materials, can undermine otherwise adequate warnings.
We expect that product liability litigation will arise out of AV users’ failures to react quickly enough to, or overreacting to, an unexpected user override alert. There would likely be digital forensic proof as to those reactions, as some states require an AV manufacturer to store user-related data recorded in the moments before a crash. A jury would hear expert testimony from human factors experts and decide whether the user’s conduct was a foreseeable risk that the defendant could have prevented with a better design or adequate warning.
A sufficient warning, though, does not shield a manufacturer from liability where it would be reasonable to design away those dangers, even if, for example, an AV user ignores pre-trip warnings against using the vehicle because of some weather, traffic or software condition, or if the user tampers with the warning system so as not to give such a warning. If the AV user is subsequently injured under those circumstances, a court would have to determine whether the user’s ignorance or disabling of a pre-trip warning was a foreseeable risk that the AV manufacturer could have designed out, say, by making it impossible for the vehicle to drive itself under the unsafe condition. That inquiry is highly fact-specific and subject to the whims of a jury.
An injured plaintiff might also feasibly bring claims that the automated warning system was defectively designed: by failing to recognize a warning-triggering condition, by failing to include a given driving condition as a warning trigger, by alerting the user too late, by alerting the user in a way that caused an overreaction, by even allowing the user to retake control under certain conditions, or by some other failure. The difficulties of identifying a particular accident-causing algorithm and explaining the advanced hardware and software to a jury of laypeople would render the litigation of such issues unpredictable.
Solutions for Every Stage of the Transition
To minimize the risk of liability, our attorneys craft comprehensive solutions for suppliers that help facilitate the transition from automated driving to manual control. We custom tailor our advice to the specifics of the supplier’s product line and its relationships with customers, vendors and joint developers. Any supplier of HMI technology, though, would be well-advised to heed a few key insights:
1. Start with Reliable Inputs
The initial piece of the HMI product design puzzle is monitoring the human driver’s state of alertness. Advances in technology make it possible to reliably track a driver’s eyes and face. The duration a driver is looking away from the road and the pattern of his glances help measure distraction, while the movement and closure of eyelids, yawning, and postural adjustments indicate fatigue. The driver state monitoring system helps to ensure that the control unit has reliable information on which to base its ultimate “decision” to prompt a transition to human driver control. Suppliers who design an HMI with robust driver state monitoring features reduce the likelihood of a crash, and thereby minimize exposure to crash-related liability.
2. Adapt the Alerts Accordingly …
For vehicle-initiated transfers of control back to the driver, the magnitude, quality and modality of the alert that would optimize the driver’s response remain unsettled questions. There is no consensus, for example, as to whether a voice or a chime is the better auditory alert, or whether a vibration in the seat or a slight jerk of the steering wheel is the better haptic feedback.
Safety and ergonomics experts suggest that the alert should vary depending on the vehicle’s diagnoses along two continua: the driver’s level of alertness and the immediacy of the need for intervention. If the vehicle detects that the driver is at full attention and a nonstandard traffic situation is five miles down the road, then perhaps only a single chime would be required. If the vehicle detects that the driver is literally asleep at the wheel but needs to take control relatively quickly, then perhaps the vehicle should vibrate the seat vigorously, blare the driver’s preferred alarm clock ringtone and illuminate a head-up display.
In these early stages of the technology’s development, any standardization of alert systems is both undesirable and infeasible. Companies must be free to innovate on this front, in search of the safest possible solution for bringing a driver’s attention back to the road. Drivers, meanwhile, require repeated exposure to internalize the vehicle’s alerts and to be trained to respond accordingly. Because variability among makes and models complicates or slows that process of consumer adaptation, the supplier’s pre-purchase or pre-use communications regarding the transfer of control become that much more important.
3. … And Consider Keeping the Human Driver Out-of-the-Loop
At a more fundamental level, one programming decision suppliers have to make is when a transition to human control should be possible at all. Conditions of low alertness and high immediacy are the most dangerous scenarios for a human driver to retake driving control.
Such situations are likely to result in legal claims from injured plaintiffs alleging that the manufacturer’s programming decisions constituted a design defect, and that a reasonable alternative design would have forced the vehicle to stop, rather than prompting or allowing the human driver to take control on short notice. The emerging evidence indicating the likelihood of dangerous maneuvers when a human suddenly retakes control of an automated vehicle suggests that those claims are not without merit.
At least two trends will negatively impact the safety of allowing the human driver to take over in the first place: automation and ride-sharing. Current and future generations that grow up with automated driving technology and mobility alternatives, like ride-sharing, will have less experience and, therefore, less skill in manually driving a vehicle. Together with the legal protection that comes with using a “state of the art” design, these trends require suppliers to stay abreast of the latest safety research and, to the extent possible, incorporate that knowledge into the design process for HMI product development.
Of course, state-of-the-art safety features do not always correspond with consumer preference, so design choices will (as always) involve a certain balancing act. For the safety-focused or risk-averse supplier, the annoyance of a customer or product user is but a small price to pay in the name of maximizing the HMI’s effectiveness and informing users of its limitations.
4. Communicate Effectively
Suppliers must communicate clearly to customers (and to drivers) about the product’s limitations and the expected human responses to various alerts and scenarios. That communication should be crafted both to ensure the human driver’s safe use of the product and to fulfill the supplier’s legal duty to warn.
Remember that it is the totality of the representations made to the consumer that ultimately matters in litigation, not only the warnings of danger and instructions on safe use. The line of communication begins long before a plaintiff purchases the vehicle, and it continues well beyond that transaction. Advertisements are often the first conditioning of a product user’s expectations, and the post-sale duty to warn will prove increasingly important in the age of over-the-air software updates.
If suppliers rely entirely on OEMs and dealers to handle consumer awareness, then drivers might end up believing that they can read a newspaper or check email freely while behind the wheel, thus increasing the likelihood of a crash. On the other hand, the supplier who makes the effort to be crystal clear about when such behavior is permitted, and who designs the system’s human takeover algorithms accordingly, is likely to avoid liability, even when a crash inevitably occurs.
Especially before automated driving systems and their HMIs are standardized and before users have developed firm expectations for their performance, consumer education must be more extensive than it will be in the future. In-car video tutorials that include actual demonstrations of the different alerts are a no-brainer. Simple, visual representations of the algorithms governing control transitions could be incorporated into those tutorials and would enrich the user’s understanding of the product’s functions and inherent limitations. From a standpoint of safety, the instruction that a driver receives is important for calibrating the driver’s expectations of the technology to its actual capabilities.
Suppliers should think of any instructional or promotional materials as external “policy statements” regarding the use of their product. The severity of harm resulting from an accident should be apparent to any reasonable vehicle user, but the likelihood of such harm will be apparent only if users are adequately warned. While it is not a supplier’s responsibility to advise consumers to shop for safety, they must not mislead them or withhold information when they do. Consumer expectations as to vehicle safety are shaped not in the five seconds before an accident, but in the weeks, months and years leading up to the crash, including before the customer drives the car off the lot.
5. Develop a Narrative
Even if the HMI’s design and associated warnings comply with the state of the art in every way, injured plaintiffs will inevitably bring legal claims challenging the decisions of the maker of the component systems that facilitate shared AV control. It is critical that the supplier develop an airtight narrative with respect to two pairs of questions. First, what do you want drivers and dealers to know about the system's functions and capabilities? How do you expect them to know that? Second, what do you expect drivers to do with that information? How do you expect them to be able to do that?
Manufacturers at any level of the supply chain get into trouble in product liability litigation when an in-house engineer’s testimony regarding the product’s intended uses and limitations differs from the company’s policy statements. Of course, the dealers, buyers and drivers of a vehicle will never obtain the same knowledge of the product as an engineer who helped develop it; even if that information were made available, they simply would not read it. Product makers must nevertheless strive to reduce that informational gap to the fullest extent (within reason) and document the decisions made in furtherance of that goal. From the C-suite to the product development team, companies must maintain consistent internal messaging regarding their expectations of users’ knowledge and behavior.
