Recomendaciones

Automated driving challenging is not the only technology with a challenging safety valida- tion. In the following risk-handling in pharmacy and aviation is briefly discussed. The ex- ample of aviation is obvious because it is another traffic system, where more and more au- tomation was introduced in the past. Pharmaceutics are especially interesting because weighting risks and benefits is crucial because every (new) medicine has side-effects. 2.1.3.1 Pharmaceutical Risk/Benefit-Analyses

When introducing new medicines to the market a pharmaceutical risk/benefit-analyses is mandatory and established. It is typically done by clinical studies in comparison to no treat- ment (absolute risk/benefit) and treatment with alternative drugs (relative risk/benefit).58 _Ad- ditionally, the supervision of the product in the market is mandatory. When the estimation of the risk/benefit changes, the product needs to be re-evaluated. In analogy to the introduction of automated driving, this would mean a supervision of accident statistics. If the system does not meet the requirements, a mandatory update or even a prohibition would follow. This would happen for example, if side effects become known that were not discovered in clinical studies before market introduction.

Another aspect is product liability. For pharmaceutical products, the manufacturer is not li- able when damages occur that are considered acceptable during the risk/benefit analysis. Even more, if the threats were not considered during the analysis but would not have changed the results (e.g. because the occurrence rate is low or the benefits are overwhelming), there is no liability.59a

There is no mandatory quantitative measure for conducting the risk/benefit analysis because weighting the different factors is challenging and varies from case to case. Instead the anal- ysis shall be assessed using scientific findings according to the legislation in Germany (§84(2) No. 1, AMG59b_{). It is also practice weighing fatal risks with very low occurrence rate} but benefits in curing a non-fatal diseases.60,59c _{However, the introduction of AD3+ will even} influence passers-by that have no direct benefit. In pharmacy, it concerns usually the same

58 _{Hart, D.: Die Nutzen/Risiko-Abwägung im Arzneimittelrecht (2005).}

individual. Therefore, it is questionable if the transfer of risk to others due to societal benefits is reasonable.

If the same logic were applied to AD3+, that would mean that a risk/benefit analysis shall be conducted comparing additional risks e.g. due to systematic failures to the benefit of reduc- ing accidents. Similar to pharmaceutics, it is impossible to guarantee that all risks are known before the introduction. Hence, a field surveillance should be mandatory, re-evaluating the risk/benefit analysis at a regular basis. The manufacturer would not be liable, even if new risks occur that do not change the overall assessment.

2.1.3.2 New Technologies in Aviation61

In aviation, passengers are exposed to a technical system without having personal control. Although severe accidents happen, its safety is accepted by most of the population. Aviation has become increasingly automated in the past, although today’s systems are still comparable to SAE level 2 because they are supervised by the crew. However, it is not directly compa- rable because the safe state is very difficult to obtain. This increased difficulty is compen- sated by reaction time that is usually longer than in a vehicle. Due to the long travelling distance and the fact that accidents mostly happen during take-off and landing, accident rates are typically given per flight and not per travel distance. Accidents and critical scenes are strictly reported and collected in a database, so we have even more profound data compared to road traffic. To compare annual risks for the average person, the average driving distance and the number of flights per year is used. One fatal accident happens about once per ten million flights62_{. With a typical exposure of two flights per year, the risk of a fatal accident} would be lower than the risk of involuntary exposure finv and about one order of magnitude lower than driving on a highway. However, with 20 flights per year, one would be exposed to a risk that is in the same order of magnitude. Therefore, the levels of risk are in fact com- parable, if only driving on Autobahn is considered. However, users typically drive on all types of roads. The risk of car accident is at least one order of magnitude higher in total, so the superior reputation of air traffic is justified. Additionally, accidents of lesser severity are much more frequent in vehicles traffic compared to aviation.

As mentioned before, aviation has become increasingly automated over the past decades. The detailed collection of data in aviation allows an analysis per generation of airplanes, which was summarized by Airbus Industries62_{. As depicted in Figure2-3, with every intro-} duction of a new technology generation, the fatal accident rate for this new generation was higher than state of the art. Due to the low number of new airplanes at introduction, this trend

61 _{This section is taken from Junietz, P. et al.: Macroscopic Risk Requirements (2019)} 62 _{Airbus: Commercial Aviation Accidents 1958-2016 (2017).}

cannot be observed in the total accident rate. Nevertheless, the introduction was clearly ben- eficial to society in total because after an introduction phase of five to ten years, the new generation achieved the lowest accident rate of all.

Judging from this data, new generations of airplanes are not tested in a way to prove statis- tically that the system is superior to the former. In fact, this is impossible; because the knowledge about the new system’s behavior is incomplete and only field experience can reduce the unknowns. Like AD3+, statistical testing is neither economically feasible nor necessary because the strict supervision of air traffic allows efficient improvement in case of critical scenes or accidents. However, the highest automation in commercial air traffic is still comparable to SAE level 2, so human error is still a factor. Nevertheless, the leap in accident rate occurred with the introduction of technology, either because of flaws in human- machine-interaction or in the technology itself.

Figure 2-3 Fatal accidents with different generations of airplanes in commercial traffic. Dotted line means less than one million flights a year. First generation: Early commercial jets, Second generation: More inte- grated Auto Flight System, Third generation: Glass cockpit and Flight-Management-System, Fourth genera- tion: Fly-By-Wire with flight envelope protection.63