I recently read yet another argument that a driving road test should be enough to certify an autonomous vehicle as safe for driving. In general, the idea was that if it's good enough to put a 16 year old on the road, it should be good enough for a self-driving vehicle. I see this idea enough that it's worth explaining why it it's a really bad one.
Even if we were to assume that a self-driving vehicle is no different than a person (which is clearly NOT true), applying the driving test is only half the driver license formula. The other half is the part about being 16 years old. If a 12 year old is proficient at operating a vehicle, we still don't issue a drivers license. In addition to technical skills and book knowledge, we as a society have imposed a maturity requirement in most states of "being 16." It is typical that you don't get an unrestricted license until you're perhaps 18. And even then you're probably not a great driver at any age until you get some experience. But, we won't even let you on the road under adult supervision at 12!
The maturity requirement is essential. As a driver we're expected to have the maturity to recognize when something isn't right, to avoid dangerous situations, to bring the vehicle to a safe state when something has gone wrong, to avoid operating when the vehicle system (vehicle + driver) is impaired, to improvise when something weird happens, and to compensate for other drivers who are having a bad day (or are simply suffering from only being 16). Autonomous driving systems might be able to do some of that, or even most of it in the near term. (I would argue that they are especially bad at self-detecting when they don't know what's going on.) But the point is a normal driving test doesn't come close to demonstrating "maturity" if we could even define that term in a rigorous, testable way. It's not supposed to -- that's why licenses require both testing and "being 16."
To be sure, human age is not a perfect correlation to maturity. But as a society we've come to the situation in which this system is working well enough that we're not changing it except for some tweaks every few years for very young and very old drivers who have historically higher mishap rates. But the big point is if a 12 year old demonstrates they are a whiz at vehicle operation and traffic rules, they still don't get a license. In fact, they don't even get permission to operate on a public road with adult supervision (i.e., no learners permit at 12 in any US state that I know of.) So why does it make sense to use a human driving test analogy to give a driver license, or even a learner permit, to an autonomous vehicle that was designed in the last few months? Where's the maturity?
Autonomy advocates argue that encapsulating skill and fleet-wide learning from diverse situations could help cut down the per-driver learning curve. And it could reduce the frequency of poor choices such as impaired driving and distracted driving. If properly implemented, this could all work well and could improve driving safety -- especially for drivers who are prone to impaired and distracted driving. But while it's plausible to argue that autonomous vehicles won't make stupid choices about driving impaired, that is not at all the same thing as saying that they will be mature drivers who can handle unexpected situations and in general display good judgment comparable to a typical, non-impaired human driver. Much of safe driving is not about technical skill, but rather amounts to driving judgment maturity. In other words, saying that autonomous vehicles won't make stupid mistakes does not automatically make them better than human drivers.
I'd want to
at least see an argument of technological maturity as a gate
before even getting to a driving skills test. In other words, I want an argument that the car is the equivalent of "being 16" before we even issue the learner permit, let alone the driver license. Suggesting that a driving test is all it takes to put a vehicle on the road means: building a mind-boggling complex software system
with technology we really don't understand how to validate, doing an
abbreviated acceptance test of basic skills (a few minutes on the
road), and then deciding it's fine to put in charge of several
thousand pounds of metal, glass, and a human cargo as it hurtles
down the highway. (Not to mention the innocent bystanders it puts
at risk.)
This is a bad idea for any software. We know from history that a functional acceptance test doesn't prove something is safe (at most it can prove it is unsafe if a mishap occurs during the test). Not crashing during a driver exam is to be sure an impressive technical achievement, but on its own it's not the same as being safe! Simple acceptance testing as the gatekeeper for autonomous vehicles is an even worse idea. For other types of software we have found that in practice that you can't understand software quality for life-critical systems without also considering the rigor of the engineering process. Think of good engineering process as a proxy for "being 16 years old." It's the same for self-driving cars.
(BTW, "life-critical" doesn't mean perfect. It means designed with sufficient engineering rigor to be suitable for its intended criticality. See ISO 26262 or your favorite software safety standard, which is currently NOT required by the government for autonomous vehicles, but should be.)
It should be noted that some think that a few hundred million miles of testing can be a substitute for documenting engineering rigor. That's a different discussion. What this essay is about is saying that a road test -- even an hour long grueling road test -- does not fulfill the operational requirement of "being 16" for issuing a driving license under our current system. I'd prefer a different, more engineering-based method of certifying self-driving vehicles for use on public roads. But if you really want there to be a driver test, please tell me how you plan to argue the part about demonstrating the vehicle, the design team, or some aspect of the development project has the equivalent 16-year-old maturity. If you can't, you're just waving your hands about vehicle safety.
You make a good point on testing and rigor, but that is still insufficient. Projecting human practices, or rather a human-machine practices on autonomous machines is a mistake.
ReplyDeleteHuman tests for autonomous machines are a mistake as those tests were designed for human-machine systems only -- maturity does not apply to machines, as they do not go through morphogenesis for about 20 years as humans do, and maturity is a progress indicator of the morphogenesis process that culminates in forming the highest-level brain functions (judgement and such) at about the age of 20, followed by forming of social instincts (values, priorities, accepted behaviours and such). Machines are expressions of thoughts of people who are already mature, but that expression is very imperfect: they fail to express their maturity in algorithms and systems of machines. Which brings up the point of rigor. Engineering rigor is insufficient in this case, as without a certain missing component that would predictably produce rigorously honest mistakes: mature people will be making machines that function comparably to immature humans, including making stupid mistakes sporadically. The missing component is autonomy -- the difference between an autonomous organism, and the extreme of sophistication in automation. Autonomy is achieved not by sophistiation or algorithm complexity, but by a completely different theory as a starting point. Your cat is autonomous -- it does not require guidance at any time of its life, even if stuck on a tree. A fly on the wall is autonomous, though with about hundred thousand neurons and several thousand pixels of myoptic light receptors it is quite limited in resources. I would argue that any self-driving car today has by far surpassed a fly in computational power and sensory capabilities, perhaps even a cat. But both a fly and a cat have autonomy as a basic principle of operation, the core component, not as an added feature on the right tip of the logistical curve. That is completely missing in the current engineering practice, even in the current theory, therefore self-driving cars cannot be made safe by any definition. In order for autonomous cars to be safe, human drivers have to be completely removed from roads. That change reduces the problematic requirement of machine autonomy to a workable requirement of automation, only then rigor and overall good engineering practice will be sufficient to make self-driving cars safe over some time.