National Transportation Safety Board

Highly automated systems are becoming omnipresent. They range in function from self-driving vehicles to advanced medical diagnostics and afford many benefits. However, there are assurance challenges that have become increasingly visible in high-profile crashes and incidents. Governance of such systems is critical to garner widespread public trust. Governance principles have been previously proposed offering aspirational guidance to automated system developers; however, their implementation is often impractical given the excessive costs and processes required to enact and then enforce the principles. This Perspective, authored by an international and multidisciplinary team across government organizations, industry and academia, proposes a mechanism to drive widespread assurance of highly automated systems: independent audit. As proposed, independent audit of AI systems would embody three ‘AAA’ governance principles of prospective risk Assessments, operation Audit trails and system Adherence to jurisdictional requirements. Independent audit of AI systems serves as a pragmatic approach to an otherwise burdensome and unenforceable assurance challenge.

Objective On March 23, 2018 a Tesla Model X driver was killed in Mountain View, CA after colliding with a previously collapsed crash attenuator at a speed of 31.7 m/s (70.8 mph). The attenuator, which must be repaired following a collision, had been struck 11 days prior by a 2010 Toyota Prius at a minimum speed of 33.9 m/s (75.8 mph). The Toyota driver survived. The maintenance of traffic safety hardware and benefit of the crash attenuator are evaluated. Methods Public information from an NTSB investigation is used to evaluate crash impact severity. Vehicle crash data from Event Data Recorders (EDRs) are compared with test data for the SCI Smart Cushion 100GM crash attenuator. An idealized triangular crash pulse is used to estimate longitudinal peak impact acceleration, and longitudinal impact energy is calculated. The medical outcomes for drivers are considered. Results The California Department of Transportation (Caltrans) maintenance and repair program for safety critical traffic safety hardware was found to be ineffective. The Tesla collision into the nonfunctional attenuator was estimated have roughly three times the impact force to the passenger compartment as it would have been if striking a functional attenuator. Conclusions The Tesla driver could have survived the collision had the crash attenuator been functional. Roadway management and timely maintenance of safety critical traffic hardware are necessary to ensure safety.

Abstract Major chemical incidents continue at industrial facilities in the United States. More effective arguments for a “business case” for safety are necessary, but not sufficient, to achieve prevention. Findings of the U.S. Chemical Safety and Hazard Investigation Board from its investigations at two oil refineries suggest that greater authority for engineers and safety professionals is a critical requirement to prevent future incidents. Engineers and safety professionals should have greater influence on process design, commissioning, maintenance, and capital and operating budgets. They should be part of the firm's highest level of management and Board of Directors. Engineers should also have the ability to make process hazard analysis an ongoing process and to directly communicate hazards and needed safeguards to senior corporate leaders.

Objective: The objective of this investigation was to evaluate the interaction between an SAE level 2 automated vehicle and the driver, including the limitations imposed by the vehicle on the driver.Methods: A case study of the first fatal crash involving a vehicle operating with an automated control system was performed using scene evidence, vehicle damage, and recorded data available from the vehicle, and information from both drivers, including experience, phone records, computer systems, and medical information, was reviewed.Results: System performance data downloaded from the car indicated that the driver was operating it using the Traffic-Aware Cruise Control and Autosteer lane-keeping systems, which are automated vehicle control systems within Tesla’s Autopilot suite. As the car crested the hill, a tractor trailer began its left turn onto a crossing roadway. Although reconstruction of the crash determined that there was sufficient sight distance for both drivers to see each other and take action, neither responded to the circumstances leading to the collision. Further, based on the speeds of the vehicles and simulations of the truck’s path, the car driver had at least 10.4 s to detect the truck and take evasive action. Neither the car driver nor the Autopilot system changed the vehicle’s velocity. At the time of the crash, the system performance data indicated that the last driver interaction with the system was 1 min 51 s prior when the cruise control speed was set to 74 mph. The driver was operating the vehicle using the Autopilot system for 37 of the 41 min in the last trip. During this period, the vehicle detected the driver’s hands on the steering wheel for a total of 25 s; each time his hands were detected on the wheel was preceded by a visual alert or auditory warning.Conclusions: The National Transportation Safety Board (NTSB) determined that the probable cause of the Williston, Florida, crash was the truck driver’s failure to yield the right of way to the car, combined with the car driver’s inattention due to overreliance on vehicle automation, which resulted in the car driver’s lack of reaction to the presence of the truck. Contributing to the car driver’s overreliance on the vehicle automation was the car’s operational design, which permitted the driver’s prolonged disengagement from the driving task and his use of the automation in ways inconsistent with guidance and warnings from the manufacturer.

This article will focus on the fatal explosion and fire which occurred on April 17, 2013, at West Fertilizer in West, Texas, resulting in 15 fatalities, more than 260 injuries, and widespread community damage. The deadly fire and explosion occurred when about 30 tons of fertilizer grade ammonium nitrate exploded after being heated by a fire at the storage and distribution facility. The US Chemical Safety Board deployed an investigative team to examine the incident and conducted a thorough root cause investigation of the massive fire and explosion. © 2016 American Institute of Chemical Engineers Process Saf Prog 35: 312–316, 2016

The accident investigator is often faced with an in-flight breakup of an aircraft. In such cases, the wreckage is scattered over the ground and, depending on the pattern, it may be possible to determine some aspect of the state of the aircraft at breakup. Sometimes part of an aircraft, such as an engine turbine, leaves the aircraft, but the aircraft is able to continue to a safe landing or, alternatively, most of the aircraft is found but a piece is missing. In such cases, it is desirable to locate the shed part for analysis to determine the cause of the failure. To be considered a ballistic object for such analysis, an object must behave as having no organized lift. Most wreckage items will have a tumbling falling mode, which fits this category or “fly” in a tight circle around what can be described as a ballistic trajectory. This paper will discuss the equations needed to describe ballistic motion, which are simplified from the general simulation equations. It will then discuss general ballistic behavior and the cues a visual inspection of the scatter pattern can provide as to the breakup state. It will then present case studies from accident investigations.