NHTSA Announces Second Automated Vehicle Guidelines Meeting

Today the DOT’s National Highway Transportation Safety Administration (NHTSA) published a meeting notice in the Federal Register (81 FR 22365-22367) for a second public meeting to seek input on planned guidelines for the safe deployment and operation of automated vehicles. The meeting will be held in Stanford, CA on April 27^th, 2016. The first meeting was held in Washington, DC earlier this month.

Input Requested

NHTSA is seeking public input on the following topics at this meeting:

• Evaluation and testing of scenarios the AV system should detect and correctly operate in;

• Detection and communication of operational boundaries;

• Environmental operation and sensing;

• Driver transitioning to/from AV operating mode;

• AV for persons with disabilities;

• Data;

• Crash avoidance capability;

• Electronics systems safety and cybersecurity;

• Non-passenger AVs;

• Aspects of AV technology that may not be suitable or ready for guidelines;

• Identification of industry voluntary standards, best practices, etc.;

• Information AVs may need to communicate to pedestrians and other vehicles (manual or automated) just as a driver would;

• Conditions in which AVs may need to be able to identify and communicate to a central location or authority that a problem has occurred;

• Operation of an AV with open safety recall; and

• Other topics needed for operational guidance.

Public Participation

The meeting is open to the public, but registration is required. The purpose of the meeting is to receive oral comments from the public on the above topics. Written comments and supporting information may be submitted in writing via the Federal eRulemaking Portal (www.Regulations.gov; Docket # NHTSA-2016-0036). Written comments should be submitted before May 15^th, 2016.

Commentary

Cybersecurity is briefly mentioned in the topics listed above, but it deserves a significant amount of attention. A large portion of the safety benefit that is expected to be derived from automated vehicles is due to the expectation that all of the integrated devices are going to perform as they were designed and programed. That expectation will be greatly undermined if adequate attention is not paid to cybersecurity issues.

The automotive industry is just now starting to take cybersecurity seriously, just like most of the control system community. The formation of a voluntary automotive information sharing and analysis organization was an important industry step forward in the cybersecurity realm. It cannot, however, be the be-all and end-all of the cybersecurity effort. Industry and/or NHTSA has got to address a number of other cybersecurity issues. These include the establishment of industry or regulatory standards for:

• Secure development of software and firmware for all devices that are physically or virtually connected to the CAN bus;

• Automatic and secure (signed) software and firmware updates for all such devices;

• Cybersecurity for all servicing departments that may gain physical access to the CAN bus during maintenance activities;

• Digital forensics capabilities for investigations of alleged cyber-attacks as an accident cause; and

• Coordination of vulnerability disclosure between independent security researchers and automotive vendors.

The decision to proceed with the development of industry standard or regulatory standards is mainly a political decision. A reminder to industry; a failure to adequately and quickly address these issues before a series of significant cyber-related accidents creates an ‘unsafe at any speed’ moment will result in a knee-jerk, Congressional-mandate for over-reactive regulations. Avoiding that type of mandate should probably be an automotive industry goal.

I am not sure that NHTSA has the technical expertise in control system cybersecurity to adequately develop a regulatory standard for any of the above listed topics, but there are other organizations within the Federal government that could provide technical assistance, most notably the National Institute of Standards and Technology (NIST) and/or ICS-CERT.

NOTE: A copy of this blog post was submitted to the docket for this meeting at 14;00 EDT 4-15-16.