Who is responsible for automated driving? A macro-level insight into automated driving in the United Kingdom using the Risk Management Framework and Social Network Analysis

Applied Ergonomics 81 (2019) 102904

Contents lists available at ScienceDirect

Applied Ergonomics journal homepage: www.elsevier.com/locate/apergo

Who is in responsible for automated driving? A macro-level insight into automated driving in the United Kingdom using the Risk Management Framework and Social Network Analysis

T

Victoria A. Banks*, Neville A. Stanton, Katherine L. Plant Human Factors Engineering, Transportation Research Group, Faculty of Engineering and Physical Sciences, University of Southampton, SO16 7QF, UK

ARTICLE INFO

ABSTRACT

Keywords: Driving automation Network analysis Risk management framework Social network analysis

To date, vehicle manufacturers have largely been left to their own initiatives when it comes to the design, development and implementation of automated driving features. Whilst this has enabled developments within the field to accelerate at a rapid pace, we are also now beginning to see the negative aspects of automated design (e.g., driver complacency, automation misuse and ethical dilemmas). It is therefore becoming increasingly important to identify systemic aspects that can address some of these Human Factors challenges. This paper applies the principles of the Risk Management Framework to explore the wider systemic issues associated with automated driving in the United Kingdom through the novel application of network metrics. The authors propose a number of recommendations targeted at each level of the Risk Management Framework that seek to shift the power of influence away from vehicle manufacturers and back into the hands of governing bodies.

1. Introduction Since the early 2000's, most new vehicles entering the marketplace have some form of advanced driver assistance system fitted at point of sale (Banks et al., 2018a). From a commercial perspective, automation of the driving task can improve safety, comfort, efficiency and enjoyment (e.g. Alessandrini et al., 2015; Banks et al., 2018a; Fagnant & Kockelman, 2014; Walker et al., 2001). Khan et al. (2012) stated that increasing the level of automation on our roads represented a major challenge with regards to the role of the government and any associated public policy. This is because automated driving signifies a new phenomenon in which no previous experience can be used to guide the development of policies and procedures. However, over recent years, developments within the field have accelerated rapidly (Banks et al., 2018a). This has bought issues relating to policy, legislation and certification to the forefront. In 2015, the Department for Transport determined that it was legal for driverless cars to operate on public roads without the need for permits or extra insurance. In fact, the UK government pledged to have driverless cars on British roads by 2021 and stated that they would introduce further changes to regulations in order to support this. A preliminary consultation paper was released by the Law Commission in November 2018 but arguably, this has come too late, especially when we consider that the negative aspects of vehicle automation is already being felt. On 7th May 2016, Joshua Brown became the first fatality in an accident involving a Tesla Model S being operated in Autopilot *

mode (see Banks et al., 2018b). The National Transport Safety Board (National Transportation Safety Board, 2017a; 2017b) criticised Tesla for the shortcomings of the Autopilot feature. In another incident on 18th March 2018, a pedestrian was killed by an Uber modified Volvo XC90 being operated by a “self-driving system in computer control mode” (National Transportation Safety Board, 2018a). This sparked an ethical debate as the National Transportation Safety Board, 2018a suggested that the vehicle had decided it needed to brake 1.3 s before the pedestrian was hit but Uber had previously disabled the Autonomous Emergency Brake system to prevent erratic driving (see Stanton et al., 2019). In the same month, a driver of a 2017 T Model X P100D was fatally injured in California. A preliminary report by the National Transportation Safety Board, 2018b states that at the time of the crash, Traffic-Aware Cruise Control and Autosteer Lane-Keeping Assist (features of the ‘Autopilot’ system) were both active. There have also been numerous other incidents involving automated vehicles that have not resulted in any loss of life (e.g., two incidents involving Tesla vehicles colliding with fire trucks - CBS, 2018; Ferris, 2018). Automation misuse is also becoming a real concern with an incident occurring on 21st May 2017 in which a driver was reported to have moved over to the passenger seat whilst their vehicle was being operated in Autopilot mode (Harnett, 2018). There have also been some unconfirmed reports of drivers falling asleep behind the wheel (e.g., Lambert, 2018). Whilst within industrial practise, the role and responsibilities of the driver are alluded to; they are not explicitly defined within standardised taxonomies (e.g., SAE J3016). This

Corresponding author. E-mail address: [email protected] (V.A. Banks).

https://doi.org/10.1016/j.apergo.2019.102904 Received 19 December 2018; Received in revised form 10 July 2019; Accepted 19 July 2019 0003-6870/ © 2019 Elsevier Ltd. All rights reserved.

Applied Ergonomics 81 (2019) 102904

V.A. Banks, et al.

Fig. 1. Annotated RMF relating to automation implementation (Adapted from Parnell et al. 2017).

means that the role of the driver is often left open to interpretation (Banks et al., 2018a). This has significant implications for the intermediate phases of automation as “driver error” remains an inevitable, if wrong, conclusion (Stanton and Baber, 2002; Stanton and Salmon, 2009). The task of automated driving must not be considered in isolation. It is clear that automated functionality has the potential to affect society as a whole (e.g., through urban planning, settlement and travel patterns, and vehicle ownership: Swedish Transport Agency, 2014) and it is therefore important to take a wider view of the system to properly understand how it may function. Banks et al. (2018c) argue that a macro level approach should be adopted, that takes into consideration the entirety of the sociotechnical system rather than a subsystem in isolation. Whilst there are a number of sociotechnical systems models and approaches, Rasmussen’s (1997) Risk Management Framework (RMF) has been most widely applied within the road transportation domain (e.g., McIlroy et al. 2019; Young and Salmon, 2015; Parnell et al. 2017; Stanton et al., 2019). The original RMF outlined six hierarchical levels within a sociotechnical system, but it has since been expanded by Parnell et al. (2017) to include two additional levels; national and international committees (see Fig. 1). In brief, the RMF hierarchy

indicates that international and national committees at the top-level generate standards and polices that inform government policies and legislation across countries, which in-turn inform regulators (e.g. media, manufacturers, and infrastructure designers) to abide by these. Regulators influence the uptake of systems within the relevant industries, including the policy and management of individual companies. This goes on to affect the resources that are provided and the products that they subsequently design. However, there are also middle-up processes as vehicle manufacturers lobby and influence the top levels of the RMF. The end-user and contextual environment reside at the bottom level of the hierarchy. In driving, this bottom level relates to the driver, vehicles, infrastructure, in-vehicle technology and the road environment within which they operate (Parnell et al, 2017; Young and Salmon, 2015; Stanton et al., 2019). Rasmussen (1997) proposes that each systemic level of the RMF is implicated in safety management with different actors having their own roles and responsibilities. In this paper, we utilise actor map representations, part of the Accimap approach to accident and systems analysis, as a means to explore the ‘layout of the decision-makers, planners, and actors’ within the automated driving system within the UK (Svedung & Rasmussen, 2

Applied Ergonomics 81 (2019) 102904

V.A. Banks, et al.

2. Modelling the automated driving system

Table 1 Signal detection matrix. Coder 2 Link Coder 2 No Link

Coder 1 Link 88 (H) 12 (M)

The actor map for automated driving in the UK was developed using a mix of existing academic literature (e.g., Young and Salmon, 2015; Parnell et al. 2017; McIlroy et al., 2019), government documentation (e.g., Department for Transport, 2015; Highways England, 2017) websites from industry, charity, non-governmental organisations and UK government websites (e.g., European Automobile Manufacturers Association, 2016; UK parliament website (parliament.uk); public sector information websites (gov.uk); Brake (brake.org.uk) and accessible European Union documentation (e.g., COM 283, 2018; European Commission, 2016; Medina et al., 2017). From this, a total of 49 actors were identified following an extensive review. These were distributed over the 8 different levels of the RMF. This representation was then taken by two independent Human Factors Specialists who developed their own individual representations of a social network by adding in the links between the actors. The two separate representations were then compared and inter-analyst reliability was calculated using the principles of signal detection (see Table 1) using Matthews Correlation Coefficient (MCC; Matthews, 1975). Phi has traditionally been used to evaluate the reliability and validity of ergonomics methods (Stanton and Young, 1999). For this analysis, MCC was calculated and showed a strong positive correlation (Phi = 0.91). This means that the identification of links in the network is reliable between two independent analysts. However, in order to provide an indication of node influence within the RMF, we wanted to interrogate the actor map using Social Network Analysis (SNA). Each link identified in the actor map was individually assessed by both Human Factors Specialists working together to determine the direction of the relationship. The final directed social network is presented in Fig. 2. It is this representation that has been taken forward for a comprehensive network analysis.

Coder 1 No Link 4 (FA) 1072 (CR)

Note: Hit (H) = both coders agree there is a link False Alarm (FA) = Coder 1 put a link but not Coder 2 Miss (M) = Coder 2 puts a link but not Coder 1 Correct Rejection (CR) = Neither coder puts a link.

2002, p.18). Applying the RMF levels to the assessment of our current understanding of automation will enable us to better identify aspects of the system that can be targeted to overcome these key systemic human factors challenges. We propose that actor map representations could also be viewed as a form of social network as it is possible to ‘link’ actors together based upon their relationship to one another. This approach will reveal the connections between the micro-, meso- and macro-levels of the system, therefore going much further than the traditional micro-approach. Importantly, previous research has also sought to investigate social networks at multiple organisational system levels (e.g., Stanton and Harvey, 2017; Banks et al., 2018c). However, we propose that levels of the RMF offer a means to explore the underlying structure of a complex sociotechnical system. Conceptually therefore, the authors propose that actor maps offer an alternative means of portraying the links that exist between actors within a social network. Hence, there appears to be no reason why social network metrics cannot be applied and mapped onto actor map representations (particularly as some of the metrics are binary). In this paper, the authors use Social Network Analysis (SNA) to examine the structural properties of the macro-level automated driving system (Driskell and Mullen, 2005; Baber et al., 2013; Stanton, 2014; Stanton et al., 2016). This represents a new extension of the RMF approach, and a potentially useful one, especially when considering the potential effects of introducing new technologies (such as vehicle automation).

Fig. 2. Directed social network (note: dash lines reflect one-way interaction whereas solid lines reflect two-way interaction between agents). 3

Applied Ergonomics 81 (2019) 102904

V.A. Banks, et al.

Table 2 Global and nodal metrics selected for analysis, along with their definition.

Nodal Metrics

Metric

Definition

Nodes Edges Density

The total number of ‘entities’ or nodes within the network. Number of pairs of connected ‘entities’ or nodes Represents the level of interconnectivity between nodes (Kakimoto et al. 2006). Essentially represents a fraction of the total number of possible relations (Stanton et al., 2017a). The following formula can be used: Network density = 2e/n (n-1) where: e is the total number of links within the network n is the number of nodes within the network

Diameter

The largest geodesic distance within the network (i.e. how many ‘hops’ it takes to get from one side of the network to the other) (Stanton, 2014). It is calculated using the following formula (Bin et al., 2018): Diameter =

Global Metrics

Cohesion Emission Reception Sociometric Status

i > j dij n (n 1) / 2

where: n is the number of node pairs dij is the shortest path between node i and j Presents the number of reciprocal links divided by all possible connections (Stanton, 2014). Total number of links emanating from a node within the network Total number of links received by a node within the network A measure of ‘how busy’ a node is in comparison to all other nodes (Houghton et al., 2006). It is the number of emissions and receptions relative to the number of actors within the network and therefore provides an indication of node prominence within the network (Salmon et al., 2012). It is calculated using the following formula outlined by Houghton et al. (2006): Sociometric Status =

Centrality

(x ij, x ji)

g i = 1; j = 1 ij g j = 1 ( ij + ji )

where: g is the size of the network δji is the geodesic distance between nodes Indicates how close a node is to all other nodes within the network. Closeness is the inverse of farness. It is calculated using the following formula (Bavelas, 1950): Closeness =

Farness Centrality Betweeness Centrality

g j=1

1

where: g is the total number of nodes in the network i and j are individual nodes x ij are the number of communications between node i and j x ji are the number of communications between node j and i Centrality is calculated to determine the most central or key nodes within the network (Stanton, 2014). There are a number of centrality metrics available in the literature but we utilise the Bavelas-Leavitt (B-L) Centrality Index in this analysis. B-L centrality is the sum of all distances within the network divided by the sum of all distances to and from the node (Stanton et al., 2017a). It is calculated using the following formula outlined by Houghton et al. (2006): B-L Centrality =

Closeness Centrality

1

g

n

1

j d (i, j )

where: n = is the number of nodes within the network d(i,j) = the distance of the shortest path between nodes i and j Sum of the distances of the shortest paths from the node to every other node in the network (Stanton et al., 2017a). The presence of an actor between two other actors (Stanton, 2014). It is calculated using the following formula, as outlined by Freeman (1977): Betweeness =

st (v) s v 1V

st

where: V represents the node represents the edges or links between nodes st is the total number of shortest paths from node s to t st (v ) is the number of those paths that pass through v

3. Network analysis

directed). The results of the global metrics are presented in Table 3. It confirms that a total of 49 ‘entities’ have been included in the analysis that result in 166 pairings of connected entities. The network does however low cohesion which may impact upon the effectiveness of the

A number of global and nodal network metrics were used to assess system dynamism (see Table 2). These have previously to assess social networks in a number of domains including command and control (Stanton et al. 2008), submarine command teams (Stanton, 2014; Roberts and Stanton, 2018; Stanton and Roberts, 2018; Roberts et al., 2017; Stanton et al., 2017a), search and rescue operations (Baber et al., 2013; Plant and Stanton, 2016) and driving automation (Banks and Stanton, 2016). The network analysis was completed using version 2.1.1. of the Applied Graphic Network Analysis tool, also known as AGNA (Benta, 2005). The analysis reports that the network can be described as binary (i.e., it can be presented by a zero-one matrix) and non-symmetric (i.e.

Table 3 Results of the global network metrics.

4

Global Metric

Result

Nodes Edges Density Diameter Cohesion

49 166 0.07 10 0.04

Applied Ergonomics 81 (2019) 102904

V.A. Banks, et al.

system as a whole (i.e., it may signal that the different tiers within the RMF may not operate effectively together). Low density and cohesion values may be indicative of a loosely coupled system (Plant and Stanton, 2016). Such a system is characterised by actors who remain considerably independent despite operating together in order to deliver intended outcomes (Marriott et al., 2011). This is an important observation, especially when we consider that Perrow (1984) argues that many failures relate to organisations rather than technology. Events that seem trivial to begin with will unpredictably cascade through the system, creating a much larger event with bigger consequences. The consequence of which is that the performance of a system may collapse if greater levels of coupling are not achieved (e.g., Stanton et al., 2017b). Perrow (1984) expressed concern for the high reliability industry regarding tightly coupled systems because they are typically highly interdependent and have little tolerance for disturbances. Small disruptions can have large consequences and ultimately bring the whole system down. Examples include the failure of the O-rings in the Challenger launch disaster (Vaughan, 1996), the open pilot relief values in the Three Mile Island incident (Reason, 1990), and missing a red signal at the Ladbroke Grove rail collision (Stanton and Walker, 2011). Loosely coupled systems are supposedly associated with greater flexibility and accommodation a wider range of potential responses. They are also associated with decentralised control and are not as easily disrupted as tightly coupled systems. The problem identified in the macro analysis of automated transportation system is that the whole system seems to be loosely coupled, whereas some aspects of the system might benefit from tighter control (such as the regulatory framework for vehicle automation). In a comparison of connected and autonomous vehicles (CAV) with traditional vehicles, Banks et al. (2018c) showed that the CAV networks were more tightly coupled. This might be expected with more vehicle-to-vehicle and vehicle-to-infrastructure communications. Similarly, Stanton et al. (2016) showed that distributed crewing of an aircraft cockpit (which included greater cockpit automation and a ground station) was more densely connected than the traditional two pilot cockpit. It might be that there is a ‘Goldilocks’ zone for ideal coupling, i.e., not too tight and not too loose. This zone might be different depending on the level of the system under investigation: micro, meso or macro (Grote et al., 2014). This is an interesting area that should be pursued in future research. It would be interesting to compare the findings from this paper with the traditional automotive system, but that it beyond the scope of the present paper. To fully understand how the system levels interact within the UK automated driving system, a comprehensive analysis using nodal metrics was completed. The results are presented in Table 4. Firstly, global metrics relating to sociometrics (emission, reception and sociometric status) are discussed. In terms of emission, nodes located within the Government and Industrialists levels yield the greatest number of emissions. A similar trend is true for reception values. In terms of sociometric status, Houghton et al. (2006) propose that any score above the mean, plus one standard deviation can be considered as a key node (i.e., 0.14 + 0.09 = 0.23). Using this rule, five agents have been identified as being most prominent. ‘Vehicle Manufacturers’ yield the highest score by far meaning that they are most prominent within the system network (i.e., they are highly interconnected). Next, Research Centres have benefitted from the significant rise in research opportunities over the past few years to invest into the field of automated driving. This is largely driven by UK Government having “created a supportive environment for the development of connected and AV technologies” (KPMG International, 2018, p. 21). The analysis goes some way in confirming this as the Department for Transport is also identified as having high levels of agent prominence within the system network. Systems Architects/Engineers also yield high sociometric status scores, again partly attributable to the opportunities to develop automated driving solutions and the links they have to other agents within the network. Finally, Automated Systems are the final agent

being identified as having high levels of agent prominence. These findings demonstrate that the network is indeed distributed, as key nodes reside in numerous layers of the RMF (Government; Industrialists; Resource Providers and; Equipment and Environment). However, nodes from the top levels of the RMF are absent from this metric suggesting that they lack prominence within the network noticeably absent from this list. According to Houghton et al. (2006) having high sociometric status does not always mean that a node will have high levels of centrality. In some instances, a node with high sociometric status may find itself on the periphery of the network and is only connected to other peripheral nodes. The reverse can also be true for nodes yielding low sociometric status scores. Nodes may be classified as being highly central based upon its topographical location within the network rather than it having many connections (Houghton et al., 2006). Again, in order to identify the most central nodes within a network, Houghton et al. (2006) propose that key agents can be defined using the value of the mean plus one standard deviation (i.e., 25.80 + 7.22 = 33.02). The analysis reveals that the most central nodes (i.e., those resulting in the highest centrality scores) reside in the lowest level of the RMF (‘Equipment and Environment). Both the ‘Vehicle’ and ‘Weather’ are found to be most central, despite yielding low sociometric scores. Interestingly, the European Parliament Committee on Legal Affairs which is located within the highest tier of the RMF (‘International Committees’) yields a higher centrality score than both Vehicle Manufacturers and Research Centres (located in the ‘Industrialists’ tier of the RMF) despite having low levels of sociometric status. This simply means that whilst such nodes are relatively close in terms of geodesic distance to all other nodes in the network, they can be viewed as peripheral nodes. Thus, their ability to communicate and influence other nodes in the system network is significantly compromised. However, it does mean that International Committees, whilst are not represented as being prominent within the system network, do have an underlying influence over specific areas within the network. The other notions of centrality (closeness, farness, betweeness) present a similar trend. For instance, whilst more agents from the higher tiers of the RMF are represented as scoring highly on betweeness and closeness metrics of centrality (e.g., European Automobile Manufacturers Association; ACEA), they have low sociometric values meaning that their degree of influence over the entirety of the network may be somewhat limited. Overall the results suggest that it is nodes within the ‘Industrialists’ tier of the RMF that have most power when it comes to influencing the automated driving system. However, lack of stronger top down influence from International Committees, National Committees and the Government means that we may be in serious danger of failing to adequately support and guide industrialists ibn their pursuit of more sophisticated automated driving solutions. We therefore continue to face a much broader systemic error that centres upon the apparent ‘loosely coupled’ nature of automated driving system when we take into account a macro perspective. A more tightly coupled system would be more conducive to system-wide change (Firestone, 1985). 4. Discussion There has been an abundance of literature written over the last two decades that focusses on the human factors implications of automated driving features (e.g., Stanton and Marsden, 1996; Stanton et al., 1997). However, much of this work has concentrated on how driver behaviour may change as a result of increasing the level of automation (e.g. Banks et al., 2018e; Merat et al., 2014; Stanton and Young, 2005; Stanton, 2019).This paper however, calls for a much broader insight into the entirety of automated driving system to reveal more fundamental systemic sociotechnical concerns. This analysis highlights a lack of top down influence within the system network which means that lower tiers within the RMF lack appropriate support and guidance. Vehicle 5

Applied Ergonomics 81 (2019) 102904

V.A. Banks, et al.

Table 4 Results of the nodal metrics analysis. System Level

Hierarchical Level

Macro

International Committees

National Committees

Government

Regulators

Meso

Industrialists

Resource Providers

Micro

End User Equipment and Environment

Node

International Standards United Nations European Commission ERTRAC ACEA European Automotive Telecom Alliance International Transport Forum International Organisation of Motor Vehicle Manufacturer European Parliament Committee on Legal Affairs WHO CLEPA Global Mobile Suppliers Association (GSA) GSMA (Connected Car Forum) Transport Select Committee Highways England Science and Technology Select Committee Business, Energy & Industrial Strategy Committee CCAV British Standards Organisation Department for Transport Department for Business, Energy & Industrial Strategy Department for Culture, Media and Sport Road Safety Policy Police Association of British Insurers UK Automotive Council Licencing Agencies Funding bodies Vehicle Manufacturing Design Standards BSI Code of Practise Road Safety Charities Vehicle Manufacturers Research Centres Insurance companies Engineering consultancies Telecommunication companies Infotainment/HMI Designers Systems Architects/Engineers Third Party Suppliers Sales/Aftermarket Care Driver Education/Training Providers Media Driver Weather Infrastructure Automated system Vehicle HMI Other road users Mean Score Standard Deviation

Nodal Metrics Emission

Reception

Sociometric Status

B-L Centrality

Closeness

Farness

Betweeness

5 2 3 4 5 2 1 4

4 2 1 1 3 2 1 2

0.19 0.08 0.08 0.10 0.17 0.08 0.04 0.13

21.67 18.00 17.09 18.58 24.94 21.36 19.15 27.94

0.40 0.33 0.39 0.36 0.42 0.29 0.30 0.41

121 147 123 132 114 166 158 118

241.30 51.83 21.47 16.54 325.21 11.13 0.00 323.83

1

0

0.02

36.79*

0.24

202

0.00

4 1 1 2 2 3 3 1

1 1 3 2 2 2 5 3

0.10 0.04 0.08 0.08 0.08 0.10 0.17 0.08

19.30 24.61 23.52 27.53 21.54 21.86 22.87 20.88

0.41 0.33 0.29 0.37 0.27 0.28 0.28 0.24

117 147 167 130 179 174 173 200

26.75 0.00 0.00 34.91 0.00 16.00 32.30 4.90

5 5 7 6

6 2 7 5

0.23 0.15 0.29* 0.23

29.15 25.81 28.69 24.05

0.36 0.35 0.35 0.31

133 136 138 156

260.82 77.70 400.32 149.21

3 2 4 3 3 1 1 1 3 2 13 8 3 4 6 6 8 1 4 3 2 4 4 1 4 0 2 2 3.37 2.37

3 3 4 1 4 1 1 2 1 2 14 8 3 3 5 4 5 0 3 5 4 7 0 3 8 6 7 4 3.39 2.61

0.13 0.10 0.17 0.08 0.15 0.04 0.04 0.06 0.08 0.08 0.56* 0.33* 0.13 0.15 0.23 0.21 0.27* 0.02 0.15 0.17 0.13 0.23 0.08 0.08 0.25* 0.13 0.19 0.15 0.14 0.09

21.30 23.30 24.77 23.52 30.09 20.14 23.82 22.05 22.05 21.17 35.06* 33.48* 27.12 24.77 27.53 28.92 29.49 29.97 28.58 28.15 21.42 28.26 40.17* 19.51 22.80 62.45* 24.69 24.53 25.80 7.22

0.25 0.27 0.29 0.33 0.39 0.27 0.31 0.33 0.34 0.27 0.47 0.43 0.34 0.37 0.39 0.39 0.40 0.19 0.37 0.32 0.26 0.33 0.26 0.20 0.24 0.00 0.26 0.29 0.32 0.08

192 179 164 147 124 179 156 146 140 179 103 112 140 131 123 123 121 248 129 148 186 147 185 246 202 0.00 185 179 151.94 39.46

30.04 45.51 150.25 13.73 270.58 37.60 0.00 0.00 0.50 13.53 928.22 476.78 117.83 6.31 192.37 22.32 99.80 0.00 123.93 200.65 29.65 191.94 0.00 10.10 127.92 0.00 66.33 118.92 107.53 167.38

Note: Asterisks denote key nodes.

manufacturers, to some extent, have been left to their own devices when it comes to designing, testing and marketing their systems. This is a problematic approach but the UK is not the only country facing these issues. The United States for instance has been testing automated vehicles for some years (European Commission, 2017). This has largely been driven by the companies located within Silicon Valley (i.e., at an ‘industrialist’ level) rather than through the adoption of a top-down approach. With evidence beginning to surface about the misuse of SAE Level 2 features, it is clear that greater top-down influence is required from higher tiers of the RMF to evoke the change necessary to ensure that automated systems are properly tested and verified. Going forward

however, the authors propose that a combined top-down, and bottomup, sociotechnical systems approach is adopted. Such an approach recognises the significant progress made by the intermediate tiers of the RMF (e.g., from ‘Industrialists’) in producing the evidence required to update, amend and event create new design standards and protocols to enable certification (Walker et al., 2015, 2018) will be essential. This evidence needs to be acted on by International and National Committees to generate standards and polices that will go on to inform new government policies and legislation across countries. This in-turn will inform regulators (i.e. top down) and so on. Taking responsibility for automated driving therefore requires both a top-down and bottom-up 6

Applied Ergonomics 81 (2019) 102904

V.A. Banks, et al.

Table 5 Targeted recommendations for each level of the RMF. Systems Level

Hierarchical Level

Recommendations

Macro

International Committees, National Committees, Government

1. Provide clearly worded legislation surrounding the design, use, testing of and implementation routes of automation to vehicle manufacturers 2. Standardise the level of driver support provided by manufacturers a. Clearly outline the role of the driver and their responsibilities b. Offer no room for interpretation 3. Provide clear guidance to industrialists and resource providers and ensure appropriate enforcement 4. Ensure marketing strategies reflect actual capabilities of the system to ensure appropriate expectations are set 5. Provide evidence of thorough testing highlighting the potential risks involved with using the system. This will facilitate the exploration of systemic actions that could minimise risk 6. Provide evidence of thorough human factors analysis in relation to the impact of technology on driver behaviour prior to release of new technology 7. Adopt principles of driver-centred design rather than technology-centred design 8. Consider additional training programmes for drivers of automated vehicles 9. Set realistic expectations through media campaigns. Road safety charities should publicise the risks associated with automation misuse similar to that of alcohol and phone use 10. Drivers must understand the limitations and capabilities of the automated system in use. They must have a clear understanding of their roles and responsibilities 11. Activities conflicting with the driving/new monitoring task must be understand by other element of the system (e.g. Police) who must be able to enforce laws relating to new devices in the vehicle 12. Appropriate maintenance of the transportation network should be prioritised to ensure safety of automated vehicles 13. Additional vehicle checks as part of the annual MOT to check vehicle components essential for automated function

Regulators Meso

Industrialists

Resource Providers Micro

End User Equipment and Environment

approach. Of course, this could take years to achieve and in the meantime, the rate of innovation may be halted as people become discouraged by the sheer magnitude of the challenges ahead. Even so, the European Commission (2018) recognises that if we are truly to meet the aspirational desire of driverless vehicles on our roads, initiatives need to be better coordinated. Preliminary results a survey conducted by the European New Car Assessment Programme (Euro NCAP; 2018) suggests that only 26% of people believe they must remain alert and in control of a vehicle being operated in automated mode. This represents a significant threat to the future of road safety, particularly during our current era of partially automated driving solutions. Taking a more systemic approach, the authors propose a number of recommendations targeted at each hierarchical level of the RMF that seek to shift the power of influence away from the Industrialists (i.e., middle-up) back into the hands of Governing bodies (i.e., top-down). These are presented in Table 5 and are intended to complement the sociotechnical principles for future vehicle design outlined by Walker et al. (2015). From a methodological standpoint, this paper extends the use of the RMF as it has been used as a means to structure the development of a social network for automated driving. This has enabled subsequent network analysis to be performed which has provided the opportunity to explore the dynamism of the structure of automated driving within the UK. Indeed, the authors acknowledge that the actor map representation presented in Fig. 2 will require continued updating as developments continue to evolve and should therefore be viewed as a starting point in which further investigations can be based. Nevertheless, the recommendations provided in Table 5 are likely to remain highly relevant in the future development of automated vehicles.

given the persistent challenges surrounding the implementation of automation on the road, this paper adopts a macro-level (Grote et al., 2014). This has provided insight into some key areas of weakness within the system network. In order to build upon the progress made thus far, the authors have provided a list of targeted recommendations designed to improve the operation of the sociotechnical system network as a whole. 6. Future work As increasing levels of automation become commonplace on our roads, there is growing interest in the utilisation of connected technologies. However, KPMG International (2018) ranks the UK 5th on the Autonomous Readiness Scale as it recognises that UK infrastructure represents a significant weakness to the system. This is because the UK 4/5G communication network lags behind other countries which may become a barrier to implementation (European Commission, 2017). This calls into question whether the aspirations of vehicle manufacturers to achieve, promote and market sophisticated automated driving features, are attainable given the current social, economic and legal challenges surrounding the use and implementation of them (Banks et al., 2018d). The National Highway Traffic and Safety Administration (National Highway Traffic and Safety Administration, 2014) estimate that Vehicle-to-Vehicle (V2V) and Vehicle-to-Infrastructure (V2I) could reduce the severity of 80% of crashes and whilst the UK may look to NHTSA and the NTSB for guidance, these bodies were not considered within our analysis because they represent government agencies within the United States and therefore beyond scope of the current analysis. However, this may actually indicate that the extended RMF (Parnell et al. 2017) could be further extended to include a ‘Global Influences’ layer. Even so, the Centre for Connected and Autonomous Vehicles (CCAV) or other government level departments could support this function.

5. Conclusions It goes without question the immense effort that has been put into the innovative design of automated vehicles. However, we are seeing increasing amounts of evidence demonstrating that some drivers fail to adhere to their new monitoring responsibilities during partially automated driving (e.g. Banks et al., 2018a). This is unsurprising when we consider that humans are unable to efficiently monitor automated systems for extended periods (Casner and Schooler, 2015; Fisher et al., 2016; Molloy and Parasuraman, 1996; Stanton and Marsden, 1996; Young and Stanton, 2002). Most of the research to date has focussed on the micro-level (i.e., driver and automation: Stanton, 2019) whereas

Acknowledgements Professor Neville A Stanton's contribution to this paper was funded by the Engineering and Physical Sciences Research Council as part of the TASCC programme: Human Interaction: Designing Autonomy in Vehicles (HI:DAVe), grant reference number EP/N011899/1. 7

Applied Ergonomics 81 (2019) 102904

V.A. Banks, et al.

References

Highways England, 2017. Connecting the country: planning for the long term. Available: https://assets.publishing.service.gov.uk/government/uploads/system/uploads/ attachment_data/file/666876/Connecting_the_country_Planning_for_the_long_term. pdf, Accessed date: 19 November 2018. Houghton, R.J., Baber, C., McMaster, R., Stanton, N.A., Salmon, P., Stewart, R., Walker, G., 2006. Command and control in emergency services operations: a social network analysis. Ergonomics 49 (12–13), 1204–1225. Khan, A.M., Bacchus, A., Erwin, S., 2012. Policy challenges of increasing automation in driving. IATSS Res. 35 (2), 79–89. KPMG International, 2018. Autonomous Vehicles Readiness Index: Assessing Countries' Openness and Preparedness for Autonomous Vehicles. Available: https://kpmg. com/avri, Accessed date: 26 November 2018. Lambert, F., 2018. Tesla Employee Was Filmed Sleeping or Unconscious at the Wheel Driving on Autopilot. Electrek. Available: https://electrek.co/2018/06/08/teslaemployee-video-sleeping-unconscious-autopilot/, Accessed date: 17 October 2018. Marriott, N., Mellett, H., Macniven, L., 2011. Loose coupling in asset management systems in the NHS. Manag. Account. Res. 22 (3), 198–208. Matthews, B.W., 1975. Comparison of the predicted and observed secondary structure of T4 phage lysozyme. BA Protein Struct. 405 (2), 442–451. McIlroy, R.C., Plant, K.L., Hoque, M.S., Jianping, W., Kokwaro, G.O., Vu, N.H., Stanton, N.A., 2019. Who is responsible for global road safety? A cross-cultural comparison of actor maps. Accid. Anal. Prev. 122, 8–18. Medina, A., Maulana, A., Thompson, D., Shandilya, N., Almeida, S., Aapaoja, A., Kutila, M., Merkus, E., Vervoort, K., 2017. Public Support Measures for Connected and Automated Driving. Framework contract no. ENTR/300/PP/2013/FC 300/pp/ 2013/FC. Merat, N., Jamson, A.H., Lai, F.C., Daly, M., Carsten, O.M., 2014. Transition to manual: driver behaviour when resuming control from a highly automated vehicle. Transp. Res. F Traffic Psychol. Behav. 27, 274–282. Molloy, R., Parasuraman, R., 1996. Monitoring an automated system for a single failure: vigilance and task complexity effects. Hum. Factors 38, 311–322. National Highway Traffic and Safety Administration, 2014. Fact sheet: improving safety and mobility through vehicle-to-vehicle communication technology. Available: https://www.nhtsa.gov/pdf/v2v_fact_sheet-02032014.pdf, Accessed date: 19 October 2018. National Transportation Safety Board, 2017a. Driver assistance systems specialists factual report. Available at: https://dms.ntsb.gov/pubdms/, Accessed date: 9 August 2017. National Transportation Safety Board, 2017b. Collision between a Car Operating with Automated Vehicle Control Systems and a Tractor-Semitrailer Truck Near Williston, Florida, May 7, 2016. Available at: https://dms.ntsb.gov/pubdms/, Accessed date: 9 August 2017. National Transportation Safety Board, 2018a. Preliminary report highway HWY18MH010. Available: https://www.ntsb.gov/investigations/AccidentReports/ Reports/HWY18MH010-prelim.pdf, Accessed date: 17 October 2018. National Transportation Safety Board, 2018b. Preliminary report highway HWY18MH011. Available: https://www.ntsb.gov/investigations/AccidentReports/ Reports/HWY18FH011-preliminary.pdf, Accessed date: 17 October 2018. Perrow, C., 1984. Normal Accidents: Living with High-Risk Technologies. Basic Books, New York. Plant, K.L., Stanton, N.A., 2016. Distributed cognition in Search and Rescue: loosely coupled tasks and tightly coupled roles. Ergonomics 59 (10), 1353–1376. Reason, J., 1990. Human Error. Cambridge University Press, Cambridge. Roberts, A.P., Stanton, N.A., 2018. Macrocognition in submarine command and control: a comparison of three simulated operational scenarios. J. Appl. Res. Mem. Cognit. 7 (1), 92–105. Roberts, A.P., Stanton, N.A., Fay, D., 2017. Land ahoy! Understanding submarine command and control during the completion of inshore operations. Hum. Factors 59 (8), 1263–1288. Salmon, P.M., Stanton, N.A., Young, K.L., 2012. Situation awareness on the road: review, theoretical and methodological issues, and future directions. Theor. Issues Ergon. Sci. 13 (4), 472–492. Stanton, N.A., 2014. Representing distributed cognition in complex systems: how a submarine returns to periscope depth. Ergonomics 57 (3), 403–418. Stanton, N.A., 2019. Driving Autonomy and automation. Theor. Issues Ergon. Sci. 20 (3), 215–222. Stanton, N.A., Baber, C., 2002. Error by design: methods for predicting device usability. Des. Stud. 23, 363–384. Stanton, N.A., Harris, D., Starr, A., 2016. The future flight deck: modelling dual, single and distributed crewing options. Appl. Ergon. 53, 331–342. Stanton, N.A., Harvey, C., 2017. Beyond human error taxonomies in assessment of risk in sociotechnical systems: a new paradigm with the EAST ‘broken-links’ approach. Ergonomics 60 (2), 221–233. Stanton, N.A., Marsden, P., 1996. From fly-by-wire to drive-by-wire: safety implications of automation in vehicles. Saf. Sci. 24 (1), 35–49. Stanton, N.A., Roberts, A.P.J., 2018. Examining social, information, and task networks in submarine command and control. IEEE Trans. Hum. Mach. Sys. 48 (3), 252–265. Stanton, N.A., Roberts, A.P.J., Fay, D.T., 2017a. Up periscope: understanding submarine command and control teamwork during a simulated return to periscope depth. Cognit. Technol. Work 19, 399–417. Stanton, N.A., Salmon, P.M., 2009. Human error taxonomies applied to driving: a generic driver error taxonomy and its implications for intelligent transport systems. Saf. Sci. 47 (2), 227–237. Stanton, N.A., Salmon, P.M., Walker, G.H., Salas, E., Hancock, P.A., 2017b. State-of-science: situation awareness in individuals, teams and systems. Ergonomics 60 (4), 449–466. Stanton, N.A., Salmon, P.M., Walker, G.H., Stanton, M., 2019. Models and methods for

Alessandrini, A., Campagna, A., Delle Site, P., Filippi, F., Persia, L., 2015. Automated vehicles and the rethinking of mobility and cities. Trans. Res. Procedia 5, 145–160. Baber, C., Stanton, N.A., Atkinson, J., McMaster, R., Houghton, R.J., 2013. Using social network analysis and agent-based modelling to explore information flow using common operational pictures for maritime search and rescue operations. Ergonomics 56, 889–905. Banks, V.A., Eriksson, A., O'Donoghue, J., Stanton, N.A., 2018e. Is partially automated driving a bad idea? Observations from an on-road study. Appl. Ergon. 68, 138–145. Banks, V.A., Plant, K.L., Stanton, N.A., 2018a. Driving Aviation Forward; Contrasting Driving Automation and Aviation Automation. Theoretical Issues in Ergonomics Science (Article (in press). Banks, V.A., Plant, K.L., Stanton, N.A., 2018b. Driver error or designer error: using the perceptual cycle model to explore the circumstances surrounding the fatal Tesla crash on 7th may 2016. Saf. Sci. 108, 278–285. Banks, V.A., Shaw, E., Large, D.R., 2018d. Keeping the driver in the loop: the ‘Other’ ethics of automation. In: In: Bagnara, S., Tartaglia, R., Albolino, S., Alexander, T., Fujita, Y. (Eds.), Proceedings of the 20th Congress of the International Ergonomics Association (IEA 2018). Advances in Intelligent Systems and Computing, vol. 823. Springer, Cham, pp. 70–79. Banks, V.A., Stanton, N.A., 2016. Driver-Centred Vehicle Automation: using Network Analysis for agent-based modelling of the driver in highly automated driving systems. Ergonomics 59 (11), 1442–1452. Banks, V.A., Stanton, N.A., Burnett, G., Hermawati, S., 2018c. Distributed Cognition on the road: using EAST to explore future road transportation systems. Appl. Ergon. 68, 258–266. Bavelas, A., 1950. Communication patterns in task orientated groups. J. Acoust. Soc. Am. 22, 271–282. Benta, M., 2005. Studying communication networks with AGNA 2.1.1. Cognit. Brain Behav. 9, 567–574. Bin, C., Weixing, Z., Ying, L., 2018. Algorithm for complex network diameter based on distance matrix. J. Syst. Eng. Electron. 29 (2), 336–342. Casner, S.M., Schooler, J.W., 2015. Vigilance impossible: diligence, distraction, and daydreaming all lead to failures in a practical monitoring task. Conscious. Cognit. 35, 33–41. CBS, 2018. Tesla Driver Says She Slammed into Fire Truck on Autopilot. CBS Available: https://www.cbsnews.com/news/tesla-autopilot-crash-utah-fire-truck-driver-elonmusk-bemoans-attention/, Accessed date: 17 October 2018. COM 283, 2018. Communication from the commission to the european parliament, the Council, the europeam ecnoomic and social committee, the committee of the regions: on the road to automated mobility: an EU strategy for mobility of the future. Brussels Document number 52018DC0283, 17/5.2018. Available: https://ec.europa.eu/ transport/sites/transport/files/3rd-mobility-pack/com20180283_en.pdf, Accessed date: 19 November 2018. Department for Transport, 2015. The Pathway to Driverless Cars: Summary Report and Action Plan. Available. www.gov.uk, Accessed date: 19 October 2018. Driskell, J.E., Mullen, B., 2005. Social network analysis. In: Stanton, N.A. (Ed.), Handbook of Human Factors and Ergonomics Methods. CRC Press, London, pp. 58 1–58.6. European Automobile Manufacturers Association, 2016. 37 leading companies join forces in European Automotive-Telecom Alliance. Available: https://www.acea.be/pressreleases/article/37-leading-companies-join-forces-in-european-automotive-telecomalliance, Accessed date: 19 November 2018. European Commission, 2016. A European strategy on cooperative intelligent transport systems, a milestone towards cooperative, connected and automated mobility. Available: https://ec.europa.eu/transport/sites/transport/files/com20160766_en. pdf, Accessed date: 19 November 2018. European Commission, 2017. Public Support Measures for Connected and Automated Driving: Final Report. Contract no. ENTR/300/pp/2013/FC. European Commission, 2018. On the road to automated mobility: an EU strategy for mobility of the future. Brussels. 17.5.2018. Available:https://eur-lex.europa.eu , Accessed date: 11 July 2018. Euro NCAP, 2018. For the first time, Euro NCAP puts automated driving technology to the test. Available at: https://www.euroncap.com/en/press-media/press-releases/ testingautomation/, Accessed date: 24 October 2018. Fagnant, D.J., Kockelman, K., 2014. Preparing a Nation for Autonomous Vehicles: 1 Opportunities, Barriers and Policy Recommendations for 2 Capitalizing on SelfDriven Vehicles 3, vol. 20 Transportation Research. Ferris, R., 2018. Feds to Investigate Tesla Crash Driver Blamed on Autopilot, CNBC. Available. https://www.cnbc.com/2018/01/23/tesla-on-autopilot-crashes-into-firetruck-on-california-freeway.html, Accessed date: 17 October 2018. Firestone, W.A., 1985. The study of loose coupling. Problems, progress and prospects. In: Kerckhoff, A. (Ed.), Research in Sociology of Education and Socialisation (5). JAI Press, Greenwich, CT, pp. 3–30. Fisher, D.L., Lohrenz, M., Moore, D., Nadler, E.D., Pollard, J.K., 2016. Humans and intelligent vehicles: the hope, the help, and the harm. IEEE Trans. Intell. Veh. 1 (1), 56–67. Freeman, L.C., 1977. A set of measures of centrality based on betweeness. Sociometry 40, 35–41. Grote, G., Stanton, N.A., Weyer, J., 2014. Beyond human-centred automation. Ergonomics 57 (3), 289–294. Harnett, A., 2018. Tesla Driver Caught Turning on Autopilot and Leaving Driver's Seat on Motorway. Independent, Available: https://www.independent.co.uk/news/uk/ crime/tesla-autopilot-driver-motorway-m1-nottingham-a8326911.html, Accessed date: 17 October 2018.

8

Applied Ergonomics 81 (2019) 102904

V.A. Banks, et al. collision analysis: a comparison study based on the uber collision with a pedestrian. Saf. Sci (in press). Stanton, N.A., Walker, G.H., 2011. Exploring the psychological factors involved in the Ladbroke Grove rail accident. Accid. Anal. Prev. 43 (3), 1117–1127. Stanton, N.A., Young, M.S., 1999. What price ergonomics? Nature 399, 197–198. Stanton, N.A., Young, M.S., 2005. Driver behaviour with adaptive cruise control. Ergonomics 48 (10), 1294–1313. Stanton, N.A., Young, M., McCaulder, B., 1997. Drive-by-wire: the case of mental workload and the ability of the driver to reclaim control. Saf. Sci. 27 (2–3), 149–159. Swedish Transport Agency, 2014. Autonomous Driving. Report TSG 2014-1316. Available at: www.unece.org, Accessed date: 17 October 2018. Vaughan, D., 1996. The Challenger Launch Decision: Risky Technology, Culture, and Deviance at NASA. University of Chicago Press, Chicago.

Walker, G.H., Stanton, N.A., Salmon, P.M., 2015. Human Factors in Automotive Engineering and Technology. CRC Press. Walker, G.H., Stanton, N.A., Salmon, P.M., 2018. Vehicle Feedback and Driver Situation Awareness: the Human Factors of Driver-Vehicle Interaction. CRC Press. Walker, G.H., Stanton, N.A., Young, M.S., 2001. Where is computing driving cars? Int. J. Hum. Comput. Interact. 13 (2), 203–229. Young, K.L., Salmon, P.M., 2015. Sharing the responsibility for driver distraction across road transport systems: a systems approach to the management of distracted driving. Accid. Anal. Prev. 74, 350–359. Young, M.S., Stanton, N.A., 2002. Malleable attentional resources theory: a new explanation for the effects of mental underload on performance. Hum. Factors 44 (3), 365–375.

9