1545
在年初的CES上，Mobileye的Amnon Shashua发表了题为“Mobileye: Now, Next, Beyond.”的演讲。
Shashua大叔好帅
Shashua的主要观点是在全范围的ODD（operational design domain）中适用Eyes-off驾驶，包括高速公路和干路、乡村和城市道路。他说：“You can go to sleep. You can do whatever you like.”
演讲中没有讨论法律责任、自动驾驶的国际法规，以及VRU（vulnerable road user）在eyes-off驾驶技术下的安全问题。
让我们仔细读一下Mobileye的这次演讲，并看一下Shashua的一些主张。
Eyes/Hands-on/off, No driver
视频的11:12开始，Shashua宣布Mobileye与SAE国际标准J3016中描述的驾驶自动化水平存在分歧。
The discourse today is Level 2, Level 3, Level 4. This taxonomy is good for engineers, it’s not good to talk about in a product-oriented language. We created our own language which says there is “eyes-on/eyes-off,” there is “hands-on/hands-off,” there is “a driver or no driver.”
他继续说：When you have an eyes-off system, there is no need to expect a driver to do anything. It means that, say you have a hands-off/eyes-off system designed for a highway ODD. You punch in an address, once you get onto a highway, you can let go – legally. That’s the whole idea of eyes-off. You can go to sleep. You can do whatever you like.
Shashua继续解释说，一旦汽车驶出了最后一条公路，到达ODD的边缘，就需要驾驶员重新控制，但并不依赖于此。
It needs to have the mechanism to stop safely on the side. This is called Minimum Risk Maneuver. But stop on the shoulder, not stop in-lane. Stopping in-lane is not safe, or not sufficiently safe.
他总结说：Once it’s activated, the driver doesn’t need to do anything because the car can, once it finishes the ODD, exit and stop on the shoulder.
请注意“driver”一词的模糊性。显然，Shashua将其描述为人类驾驶员，同时描述了驾驶员执行驾驶任务。没有讨论责任的问题。
从Eyes-off到Eyes-on
从14:10开始，Shashua解释了一个Hands-off/Eyes-on系统的运行：When talking about the hands-off/eyes-on system, this is an interaction between man and machine. If you have a good driver monitoring system, with the camera watching the driver, then you can create a very good interaction between man and machine, in which the man or woman is supervising the machine. This interaction creates a high level of safety.
然后，他转向了Eyes-off系统：
Today we’re very busy, the roads are very congested. I want to navigate from Point A to Point B. 90 percent of the time is within the ODD of the eyes-off. I activate it and read a book. It buys back time. A very different value proposition.
Shashua接着提出了最大胆的主张：
Of course, it increases safety because the system is at a higher safety than a human. So, it also increases safety, but really the value proposition, why do you want to pay money for it beyond increasing safety, is the fact you buy your time back.
然后他试图在稍后的演讲中解释这些陈述。
ODDs
从16:30开始，Shashua描述了Mobileye的ODD路线图。
When we talk about eyes-off, there are ODDs. Highway only, below 60 kilometers per hour (kph), in lane. So, the car does not change lane. Many carmakers are introducing this kind of ODD in the next few years. Second ODD is the same thing, but up to 130kph.
The next ODD is the car can go on-ramp, off-ramp autonomously. You punch in an address, and to navigate to that address you need to go through five different highways. The system would do this autonomously. Next ODD you add arterial roads with traffic lights and then with signal traffic, signal junctions. The next one is rural.
Shashua提到了各种类型的ODD，但他没有描述法律责任，也没有提供自动驾驶的定义。
显然，自动驾驶系统必须对其驾驶决策负责，否则它就不是自动驾驶。
他没有讨论允许在各类公共道路上自动驾驶的国际法规。让我们简单回顾一下最重要的一个。
《联合国自动车道保持系统条例》第157条于2021年1月生效，允许最高时速60公里。2022年6月，该规定扩展至允许“自动驾驶最高时速为130公里”。
第157条规定：
ALKS can be activated under certain conditions on roads where pedestrians and cyclists are prohibited and which, by design, are equipped with a physical separation that divides the traffic moving in opposite directions and prevent traffic from cutting across the path of the vehicle.
17:30 Shashua说：
The useful tipping point is when it’s highways, on- and off-ramp, up to 130kph. Anything below that is not that useful. So, the useful tipping point is starting from ODD 3 in this chart.
因此，尽管Shashua声称，目前尚不清楚ODD 4、5和6的国际法律地位，在演示中也没有提供进一步的细节。
Shashua还暗示将其与特斯拉的FSD和通用的Ultra Cruise进行比较，这两种系统都要求人类监督者对机器驾驶员的决定负责，并且要求人类始终保对道路的关注。
然后，演讲从ODD转向讨论一个好的Eyes-off解决方案的特性。Shashua说：
The first, it has to be useful. If it’s not useful, then why go through this trouble? The second we call “no reproducible errors.” It means you cannot hide behind statistics. The third one is expansion of ODD.
先不论Shashua的观点如何，一个好的Eyes-off系统需要具备以下属性：
经过验证，操作安全。
人类驾驶员既不能误会也不能误解他们在靠近VRU的公共道路上操作该系统的法律责任。
人类在任何时候都能理解他们何时在驾驶车辆，何时在监督驾驶车辆的机器。这种责任上的模糊被称为“模式混淆”。
Mobileye的产品组合
24:58，Shashua介绍了Mobileye的产品组合：
On the left hand is the base and enhanced driving assist, this is front-facing camera. The third column is SuperVision. It has the resolution to do hands-off driving in a full ODD, but it doesn’t have the mean time between failure to allow eyes-off. The second column is what we call SuperVision Lite, only for highways.
正如所解释的那样，联合国条例157只允许在双向高速公路上运行，并且只允许在行人和骑自行车等VRU禁行的道路上运行。因此，“Full ODD SuperVision”的国际法律地位是不明确和无法解释的。
Shashua继续说：
In the fourth column and above is the eyes-off system. We call this the Chauffeur family. First highway on-/off-ramp. Then comes arterial and rural, then urban. Once we reach full ODD, it’s robotaxi, but we need to add tele-operation, which we do not need in consumer AV.
他重申了Eyes-off操作，并重申了全范围ODD的路线图。Shashua之前的评论强化了这一点：“You can go to sleep. You can do whatever you like.”
统计数字背后
从36:52开始，Shashua开始讨论证明系统验证：
Talking about highway ODD, the requirement is 10^7 hours of mean time between failure. That means you need to prove the car will drive ten million miles without creating an accident.
请注意，他特别提到了“mean time between failure”和“without creating an accident”，而不是“没有发生事故”。
他继续说：
I need to prove to regulators, I need to prove to the public, that the system really meets that accuracy goal. So, we have three layers. The first two layers are “build,” the last layer is “prove.”
再次注意到，他仔提到了“证据”和“准确性目标”，而不是任何具体的安全问题，或者安全到什么程度才足够安全。
接着，Shashua说了些几乎没啥意义的观点：
The way we build a system is through complete redundancy. SuperVision is only cameras. As you saw, SuperVision can do full end-to-end autonomous driving, but it requires eyes on because it’s not sufficiently safe to say that I’m better than a human driver. So we have a subsystem of only cameras. A subsystem of only active sensors – each of them building an environmental model, a sensing state, completely separate from the other. Because we’re talking about different modalities. It looks like it’s statistically independent, I cannot prove it’s statistically independent and probably, maybe it’s 99.9% statistically independent, but not 100%. But if it were statistically independent, I can then take the product. So say I collect 10,000 hours of driving of real data to validate the camera-only subsystem. And then I collect 1,000 hours of real data to validate the radar/lidar system. If those were statistically independent, then the meantime between failure is the product. If they were completely independent – 10 to the seven (107). This claim will not stand in court, because I cannot prove this. Just like in aviation, you have redundancies. Nobody proves, nobody comes and claims that those redundant systems are statistically independent. You just create more and more redundant systems. So this is not a proving methodology, this is a building methodology. From a robustness point of view, it makes a lot of sense. So this is how we build the system.
同样，Shashua没有特别提到安全问题。从40:47开始他还说到了仿真，从43:54开始说到“影子模式”的作用。
Shashua的演讲有很多吸引眼球的噱头，但没有讨论责任、信任或安全。
记者请Mobileye就责任问题发表评论。他说：
Like all automotive suppliers, Mobileye works closely with customers to address liability concerns, taking into consideration different levels of autonomy, changing scope of ODD, drivers’ engagement and OEMs role. We anticipate that highly automated systems will require new approaches to liability, and our entire system architecture has been designed to develop and deploy driver assist and automation in a responsible, scalable, and transparent manner.
是不是还是很困惑？前不久，宝马在高速公路上发生异常加速的事故，宝马的CEO Oliver Zipse明确表示车厂不承担任何责任，其它车厂也很可能同样甩锅。
