Consideraciones a tener en cuenta en nuevos dise˜ nos de limas rotatorias de N´ıquel-Titanio

The three research questions that were derived in subchapter 3.1 are the following: Q 1 Which viewpoints are necessary to be considered for a sufficient derivation of

requirements for macroscopic risk?

Q 2 Which acceptance criteria result, if all viewpoints identified in Q 1 are analyzed scien- tifically?

Q 3 What is the influence on introduction concepts due to the acceptance criteria derived in Q 2?

The state of the art discussion about safety requirements lacked quantitative measures for macroscopic risk requirements involving all relevant viewpoints. In subchapter 4.1, the viewpoints of user, society and individual passers-by were derived. The viewpoint of an in- dividual passers-by is often ignored because he is also part of the society as a whole. Never- theless, it should be addressed individually because the society is a group of users and pass- ers-by and its requirements might vary from individuals because the average safety of the whole group is addressed. It is impossible to derive risk requirements for each individual person because their individual requirements might vary by personal experience, personal benefit and affinity towards new technologies. Nevertheless, requirements can be derived, if each viewpoint is analyzed scientifically addressing the second research question.

To derive quantitative risk requirements, acceptance in other technologies and studies about general risk acceptance are analyzed to address the viewpoints of individuals. As personal risk acceptance varies with the experienced benefit, different requirements based on the type of exposure (voluntary/involuntary/job-related) are deduced. For passers-by, new risks that are unique to the technology are of importance because without personal benefit, those risks must be minimal also if another risk is reduced. Society’s requirements focus on the risk reduction over time and total accident numbers in a time period. So an increase in accident numbers can be compensated by a stronger decrease afterwards. This temporary increase

motivates Kalra et al.219 _{to analyze how fast safety performance must increase to reduce the} total number of accidents even if a system with lower safety is introduced at the beginning. While this concept might not function because of the user’s requirements, which does not allow increasing risk, a similar idea that monitors the rate of market introduction while re- evaluating the risk based on new information from the field might be beneficial. The risk- limited introduction was formulated by Wachenfeld220 _{and is motivated by the fact that cur-} rent test methods are unable to determine the safety performance without a large uncertainty. The impact for total safety is diluted when the field penetration rate of AD3+ vehicles is low. The dilution of risk is used for the quantitative risk requirements for passers-by and society resulting in lower requirements at the beginning of introduction. Assuming an increase in penetration rate comparable to other mechatronic automotive systems, the society’s and passers-by’s requirements become stricter than the user’s at a field penetration rate of about 12% or higher. Quantitate requirements for an accident occurrence rate with lesser than fatal severity cannot be derived in the same way. Comparison with today’s traffic is possible due to detailed accident statistics, but other risk studies and principles such as the minimal en- dogenous mortality are only available for fatal risks. To derive requirements for other sever- ity categories as well, a reduction of the accident rate equivalent to the reduction of fatal accidents is demanded. As it is questionable, if different severity categories can be weighed against each other, it is suggested that a decrease in one accident category can reduce re- quirements in categories with less severity but not vice versa. Weighting factors such as the factor ten as used in ISO26262 or a monetary balance based on the costs are possible candi- dates. However, further studies about risk acceptance or discussions with representatives on how to handle the different severity categories are advised.

Addressing the third research question, it is analyzed if the requirements, the risk-limited introduction, and the expected field penetration increase fit into an introduction scenario, where the uncertainty about the driving function’s safety performance decreases fast enough. As the safety performance of the first AD3+ vehicles must comply with their requirements, an initial test distance of about 10 million km is required. If the system is in fact safe enough, the uncertainty is reduced due to field observation so that the requirements of society are fulfilled at all time. However, if the system’s safety performance is lower (e.g. as required by the user who has benefits), an increase in performance over time (due to updates of the system or infrastructure) will be required to comply with all requirements. Assuming that the user follows the hypothesis of sufficient safety and rejects it only under sufficient statis- tical evidence, an introduction is possible as soon as a system is available that tests in an unsupervised field test with 10 million km without accident.

The scope of this dissertation was the derivation of acceptable MaR requirements based on different viewpoints, other technologies and risk acceptance studies. However, it is not guar- anteed if those risks are later accepted. The subjective assessment of risks by individuals is often not fact-oriented as described in section 2.1.2. Especially if accidents happen shortly after the introduction, or if two accidents happen within a short mileage, general acceptance is questionable, though the statistical evidence might still hint towards an increased safety and the fulfillment of acceptable MaR requirements.

However, it is unknown if the user and the industry will accept the high uncertainty after introduction. Here, other test strategies might increase trust but the effect on a decreasing uncertainty is unknown or not sufficiently researched yet.