Review of the USDOT Report on Connected Vehicle Initiative Communications Systems Deployment (2015)

Below is the uncorrected machine-read text of this chapter, intended to provide our own search engines and external engines with highly rich, chapter-representative searchable text of each book. Because it is UNCORRECTED material, please consider the following text as a useful but insufficient proxy for the authoritative book pages.

April 28, 2015 The Honorable Anthony R. Foxx Secretary U.S. Department of Transportation 1200 New Jersey Avenue, SE Washington, D.C. 20590-9898 Dear Secretary Foxx: As required in Section 53006 of P.L. 112-141 (Moving Ahead for Progress in the 21st Century, dated July 6, 2012), Congress directed the U.S. Department of Transportation (USDOT) to prepare a report that would (1) assess the status of dedicated short-range communications [DSRC] technology and applications developed through research and development; (2) analyze the known and potential gaps in short-range communications technology and applications; (3) define a recommended implementation path for dedicated short-range communications technology and applications that a) is based on the assessment described in paragraph 1; and b) takes into account the analysis described in paragraph 2; (4) include guidance on the relationship of the proposed deployment of dedicated short-range communications to the National ITS [Intelligent Transportation Systems] Architecture and ITS Standards; and (5) ensure competition by not preferencing the use of any particular frequency for vehicle to infrastructure operations. Congress further directed the Secretary of USDOT to engage the National Research Council (NRC) in an independent peer review of the draft report. This letter report contains the peer review conducted by the committee convened by NRC for this purpose. The names of the committee members and their affiliations are listed in Enclosure A, and biographical information about the members is provided in Enclosure B. 500 Fifth Street, NW Phone: 202 334 2934 Washington, DC 20001 Fax: 202 334 2003 www.TRB.org

2 After the committee was convened, it reviewed USDOT’s draft report,1 referred to here as the “DSRC report.” The committee subsequently held one 2-day meeting, at which time it was briefed by the main authors of the DSRC report, USDOT staff, and invited stakeholders; gave the public an opportunity to comment; and deliberated in private on the contents of this report. The names and affiliations of the participants in the meeting are included in Enclosure C. The committee completed its report through a series of conference calls and correspondence. In addition, the committee’s report was independently reviewed by external individuals, whose names were not known to the committee at the time of the review. The committee’s response to these reviews and subsequent changes to the report were approved by NRC. The names of the reviewers appear in Enclosure D. EXECUTIVE SUMMARY In this section the committee summarizes its main conclusions about the DSRC report, which are organized under headings of the charge from Congress. 1. Status of DSRC Technology and Applications The use of 5.9 gigahertz (GHz) DSRC is appropriate for the connected vehicle initiative. The committee agrees with the DSRC report’s arguments concerning the low latency, privacy protection, and other benefits this technology offers compared with other communications technologies for safety-critical messages. Many applications reliant on DSRC are at an early stage of development and are heavily dependent on what manufacturers choose to implement for vehicle-to-vehicle (V2V) and what infrastructure owners and vehicle and device manufacturers choose to implement for vehicle-to- infrastructure (V2I). 2 Any detailed assessment of the maturity and effectiveness of these applications is premature. The principal references relied on in the DSRC report to estimate the benefits of connected vehicle safety applications are not yet available to the public. Therefore, the committee could not verify them independently. It would be helpful to Congress, program stakeholders, and the public for the National Highway Traffic Safety Administration (NHTSA) to complete its review of these reports expeditiously and make them available by the time the DSRC report to Congress is released. 2. Known and Potential Gaps With regard to DSRC as the chosen low latency technology for communicating safety-critical information, the committee agrees with the DSRC report conclusion that proposed spectrum sharing in the 5.9 GHz band is the most serious risk and uncertainty for the program, but it is not the only one. The committee believes that unless local area wireless technology (Wi-Fi) and other unlicensed and licensed technologies are determined not to interfere with DSRC, the potential benefits of the program will be severely compromised. 1 Status of the Dedicated Short-Range Communications Technology and Applications [Draft] Report to Congress. John A. Volpe National Transportation Systems Center, USDOT, 2014. 2 V2I is used throughout the report to refer to vehicle-to-infrastructure as well as infrastructure-to-vehicle. This terminology is consistent with the nomenclature used by industry and government.

3 The committee believes that, contrary to the impression conveyed in the DSRC report, other important unknowns and uncertainties will also need to be resolved for the benefits of the connected vehicle initiative to be realized. As discussed in greater detail in a subsequent section of this report, most of these unknowns and uncertainties depend on how the program will be implemented by government and industry, and many implementation details have not been resolved. On the basis of the questions posed for comment in its August 20, 2014, Advance Notice of Proposed Rulemaking (ANPRM) on Vehicle-to-Vehicle Communications, NHTSA itself apparently realizes the importance of several of these issues. The following are other unknowns and uncertainties that the report could acknowledge or address in greater detail:  Spectrum frequency coordination,  Scalability of DSRC beyond levels tested to date,  Security and privacy considerations,  Estimated effectiveness and safety benefits of applications,  Human factors issues associated with implementation of the applications,  Certification processes for V2V and V2I equipment,  Reliability of sensors and related electronic systems on vehicles,  Priority for safety-critical messages to drivers in complex situations,  Availability of funding for necessary infrastructure,  Stability of standards, and  Liability issues associated with system failure. These issues are addressed in the section headed “Known and Potential Gaps” in the body of the committee report. 3. Implementation Path The DSRC report explicitly offers a “vision” of how technologies will be implemented in the future rather than a detailed path for implementation. Since the government may choose to mandate installation of DSRC in new vehicles but not mandate applications for the foreseeable future, the committee agrees that stating a vision is more appropriate at this time than defining a detailed implementation path. However, several of the unknowns and uncertainties mentioned above (e.g., certification) are on the critical path to implementation and deserve greater discussion in the draft. In addition, while USDOT has announced a technical plan to build and test the security system, which is critical in enabling any V2V or V2I implementations, the plan to address the policy issues related to that system, such as funding and operation, appears to be unresolved. 4. Consistency with ITS Architecture and Standards The report includes appropriate guidance on the relationship of the proposed deployment of DSRC to the National ITS Architecture and ITS Standards.

4 5. Preferencing of Technologies for V2I Applications The report appropriately preferences 5.9 GHz DSRC for crash-imminent safety applications but allows for other communication technologies for other applications. In summary, strengthening of the DSRC report in a variety of ways, which are itemized in the following sections, would be beneficial. COMMITTEE REPORT Introductory Comments The connected vehicle initiative is a broad government–industry effort to rely on communications among vehicles (V2V) and between vehicles and infrastructure (V2I) that could provide major improvements in motor vehicle safety and offer many services to travelers. Research, concept development, prototype development, and testing have been taking place for more than a decade. In 1999, the Federal Communications Commission (FCC) allocated 75 megahertz (MHz) of spectrum in the 5.9 GHz DSRC band for use in ITS vehicle safety and mobility applications. 3 On August 20, 2014, NHTSA issued an ANPRM concerning a Federal Motor Vehicle Safety Standard (FMVSS) on V2V communications (Docket No. NHTSA-2014- 0022). In the ANPRM, NHTSA indicates that its interest is in mandating the installation of DSRC in future vehicles and that it is not proposing the mandating of any applications based on DSRC at this time. In reviewing the draft DSRC report, the committee interpreted Congress’s intent in Item 5 of the charge—to “ensure competition by not preferencing the use of any particular frequency”—to refer to “communications technology” rather than the radio frequency per se. USDOT should clarify its interpretation of this term in its report. In addition, in reviewing potential connected vehicle applications, the committee focused on safety applications, as did USDOT’s DSRC report itself, with the exception of Item 5 of the charge, which includes communications technologies for V2I safety and nonsafety applications. The committee’s responsibility was to review the DSRC report, which relies heavily on other documents for substantiation of claims that it makes. A main reference relied on is Vehicle to Vehicle Communications: Readiness of V2V Technology for Application, 4 which is referred to here as the “Readiness report.” That report is the principal technical reference accompanying NHTSA’s 2014 ANPRM on vehicle-to-vehicle communications. The committee did not review the Readiness report or any of the other references in the same depth as it did the DSRC report. The DSRC report references research conducted for NHTSA by the Crash Avoidance Metrics Partnership (CAMP). 5 The committee was briefed on the results of some of the CAMP research, 3 FCC, 47 CFR Parts 2 and 90, November 26, 1999. http://www.gpo.gov/fdsys/pkg/FR-1999-11-26/html/99- 30591.htm. 4 Report No. DOT HS-812-014. NHTSA, USDOT, August 2014. 5 CAMP, formed in 1995 by Ford Motor Company and General Motors Corporation “to accelerate the implementation of crash avoidance countermeasures in passenger cars to improve traffic safety,” is a research organization that includes employees of up to nine automotive companies. It has a cooperative agreement with USDOT to conduct research on new and emerging technologies for vehicles. Because the costs are shared, both

5 but it did not have access to the reports themselves, which are still under review by NHTSA. Before the substance of the DSRC report itself is discussed, a note about terminology is needed. The term “DSRC” in the report is used to refer to different aspects of DSRC. For example, the DSRC report in 2.II.A refers to “(1) DSRC’s low latency and high availability, and (2) the ability to provide security, privacy, and a no-subscription fee policy.” Here, aspects of DSRC spectrum allocation, communications protocols, software, and system design are all mixed in one statement. The DSRC report would provide the reader a better understanding if it enumerated the various aspects of DSRC, indicated what entities [e.g., FCC, USDOT, state departments of transportation, original equipment manufacturers (OEMs)] influence each, and clarified which aspects are indicated when the term “DSRC” is invoked. A key metric invoked in discussing DSRC’s suitability for crash avoidance applications is “latency.” The USDOT report makes the point that DSRC technology is uniquely capable of meeting the “low latency” requirements of safety applications; however, the report uses multiple definitions of latency, spanning at least three orders of magnitude. Furthermore, the definitions are used in contradictory comparisons with other technologies, and it is often not possible to infer which of them is being invoked. For example, in Section 2.II.A of the DSRC report (page 20), under the heading “Speed of Transmission,” the report states that DSRC has latency “well under 100 microseconds.” On the same page the report notes two definitions of latency. First, “the lower limit of latency is determined by the physics of the medium.” Second, “latency further includes any delays in the transmission processing, propagation delays through the medium … and receiving processing.” Does the “well under 100 microsecond” latency claim on that page include those processing delays? It does not appear to, and it does not even appear to be consistent with the “physics of the medium.” Given that basic safety messages (BSMs) are on the order of 3 kilobits and are transmitted at 6 megabits per second, the transmission time from first bit to last bit is on the order of 500 microseconds. Later in Section 2.II.A (page 22), the DSRC report notes that some technologies impose a delay to “join the network” but that “latency estimates assume that the technologies are already part of a network.” This assumption does not appear to be reflected consistently in the technology comparisons reported in Tables B-1 and D-1 of the report. Table B-1 shows DSRC latency in the range of 0.2 to 15 milliseconds (msec). Table D-1 uses the 0.2 msec value for DSRC. However, both tables report Wi-Fi latencies in the range of 3 to 5 seconds, which can only be accurate if the time to join the network is included. The tables are inconsistent with respect to the latency they attribute to LTE (3G) cellular, with Table B-1 reporting 79 to 100 msec and Table D-1 reporting 1.5 to 3.5 seconds. These tables apparently apply different definitions of latency. The claims of sub-millisecond latency for DSRC in Tables B-1 and D-1 also appear to neglect the channel access delay that is fundamental to the IEEE 802.11 MAC protocol. In a dense vehicle environment, a given sender can expect to wait up to 10 msec before beginning transmission. 6 Finally, the DSRC report invokes a third definition of latency in Appendices B and D. The third definition includes not only physics and processing but also message scheduling delay. Appendix B.II.B (page 79) states that “the latency will be driven by the message repeat interval parties need to agree before research conclusions are published. Recently, CAMP has been performing research on spectrum issues and has provided those results to NHTSA in the form of reports. 6 IEEE 802.11-2012 Wireless Local Area Networking standard. See http://standards.ieee.org/findstds/standard/802- 11-2012.html.

6 and the communications latency.” The default BSM repeat interval is 100 msec (for example in the Safety Pilot Model Deployment). 7 Similarly, Appendix D of the report cites the NHTSA Vehicle Safety Communications (VSC) report (footnote 140), 8 which is the source of Table D-1 and which defines “allowable latency” as “the maximum duration of time allowable between when information is available to be transmitted and when it is received (e.g. 100 msec).” Thus, the report variously claims that DSRC can achieve BSM latency on the order of hundreds of microseconds to hundreds of milliseconds. It also contains contradictory claims about whether “network join” latency is included or excluded in technology comparisons. Collectively these inconsistencies obscure the key point that DSRC does have latency advantages over other technologies, particularly those requiring multiple hops between source and destination and those requiring “network join” delays. If USDOT wishes to use multiple definitions of latency, which one is being invoked in any given instance should be clear, either explicitly or implicitly from the context. 1. Status of DSRC Technology and Applications The congressional charge to USDOT to assess the readiness of 5.9 GHz DSRC for the connected vehicle initiative expresses equal interest in the status of the applications that will rely on the communications technology. As mentioned, the NHTSA ANPRM indicates that NHTSA would only mandate that future vehicles be equipped with DSRC devices. NHTSA does not propose to mandate any applications at this time. Instead, NHTSA will rely on industry to develop the applications according to performance metrics that NHTSA might specify in future FMVSSs or in the New Car Assessment Program (NCAP) rating criteria. The committee views fundamental DSRC technology to be adequately tested and appropriate as the preferred communications medium for low latency connected vehicle safety applications, but it notes that some related upper protocol layers, and particularly applications, are less mature. The committee agrees with the DSRC report’s assessment of its advantages over other technologies for safety-critical communication. The DSRC report appropriately describes a handful of crash-imminent safety applications as having been the subjects of intensive work by CAMP and individual OEMs. Other safety warning and nonsafety applications are more conceptual at this stage and are described appropriately in the report. As noted earlier, many of the reports from CAMP projects are not yet publicly available. Therefore, it is critical that NHTSA complete its reviews and release them, preferably by the time the DSRC report is finalized this summer, so that they will be available to Congress, program stakeholders, and the public. 2. Known and Potential Gaps The draft DSRC report to Congress, Section 3.IV.C.1, indicates that spectrum sharing with unlicensed users is “the one known [technical] gap” in the performance of V2V communications. 7 Vehicle Awareness Device Specification, USDOT, Document USDOTVAD, Version 3.5, Walton Fehr, December 2011. 8 NHTSA, Vehicle Safety Communications Project Task 3 Final Report: Identify Intelligent Vehicle Safety Applications Enabled by DSRC. DOT HS 809 859. (March 2005, p. 46).

7 The report notes that administration policy has directed “the FCC to identify and make available 500 Megahertz (MHz) of spectrum over the next 10 years to share with wireless broadband use.” It also notes that a group of federal agencies advising FCC has recommended allowing the sharing of spectrum that overlaps with the 5.9 GHz band and that federal legislation directs the Department of Commerce to evaluate “spectrum-sharing technologies and the risk to users” in this same band. Congress has also asked FCC to consider allowing unlicensed WiFi operations in this band as well, which if decided would likely impact the ability to utilize the frequency for connected vehicles. Such a decision has not yet been made. In a similar manner, the International Telecommunications World Radio Conference 2015 is considering proposals to expand the band above 5,925 MHz for sharing with broadband systems such as Wi-Fi. The DSRC report concludes that wireless industry spectrum-sharing proposals made to date fall short of ensuring that unlicensed Wi-Fi would not interfere with V2V communications and states that USDOT has research under way evaluating possible coexistence with unlicensed users in the 5.9 GHz band. The committee agrees that resolving the interference issue from potential unlicensed as well as licensed broadband uses in the band used by DSRC is critically important. 9 However, the DSRC report is silent about other possible sources of interference from other unlicensed as well as licensed devices. The committee notes that there are regions of the country, including the greater Washington, D.C., area, where military radars have precedence in or near the DSRC band could interfere with V2V and V2I safety messages. DSRC will not receive protection within 75 kilometers of radars in locations specified in §47 CFR 90.371(a). Because the vehicle safety messages will be broadcast frequently, intermittent military radars may not pose a conflict, but this issue should be checked. In addition, §47 CFR 18.305 permits industrial, scientific, and medical (ISM) equipment to operate in the band 5,800 MHz ± 75.0 MHz, which encompasses Channel 172, and to transmit unlimited radiated energy, and radio- frequency identification systems typically operate in ISM and unlicensed bands, including 5,725 to 5,875 MHz. Further study is needed to determine the interference potential of these uses and, depending on severity, means for ensuring reliable reception of critical safety messages. 10 FCC rules for international intercontinental fixed satellite systems are codified in 47 CFR 2.108, which requires case-by-case electromagnetic compatibility analysis that demonstrates compatible operations with all users of this band including DSRC. It is the committee’s understanding that this coordination with DSRC has been performed. In discussions with the committee, authors of the DSRC report and USDOT staff with expertise in spectrum-sharing issues indicated that USDOT interaction with FCC on spectrum sharing is mediated through the National Telecommunications and Information Administration (NTIA) of the Department of Commerce. Committee members with expertise in this area and familiar with FCC operations were unaware that USDOT technical staff are not working directly 9 The report does not address whether USDOT is participating in appropriate ITU-R World Radio Conference preparation, the NTIA–FCC broadband spectrum Policy and Plans Steering Group, and related activities to ensure that the spectrum requirements of DSRC are considered in any reallocation of spectrum. 10 This study need not result in moving BSM Channel 172 to a different frequency. For example, a second DSRC BSM channel, supplemental to but not adjacent to Channel 172, could be considered to avoid the possibility of interference. This is similar to what was successfully adopted by the Automatic Identification System (AIS) used in maritime service for the safety of navigation [(ITU-R) Recommendation M.1371 (series)]. Use of two BSM channels would require duplication of the on-board equipment receiver/decoding component to monitor two DSRC channels simultaneously.

8 with their counterparts in FCC, who could be helpful in identifying and addressing some of the possible sources of interference in the 5.9 GHz band. The committee also believes that V2V and V2I should be considered by FCC as a safety service. FCC Regulation 47 CFR Section 2.1 and International Telecommunication Union Radiocommunication Sector (ITU-R) 2012 Radio Regulations §1.59 both define safety service as “any radiocommunication service used permanently or temporarily for the safeguarding of human life and property.” Usage of DSRC Channels 172, 178, and 184 appears to meet this definition, and planned uses of the remaining DSRC channels are also expected to meet this definition. FCC designation of 5.9 GHz DSRC as a safety service would afford the DSRC (V2V and V2I) safety services a higher level of protection from interference on the 5.9 GHz band. 11 Greater proactivity on the part of USDOT staff with regard to threats to connected vehicle communications appears to be needed. Other unknowns and uncertainties could affect DSRC and safety applications, and not all of them are identified or adequately addressed in the DSRC report. Spectrum Frequency Coordination In Section 3.IV.C.2, the DSRC report recognizes as a “gap” the lack of an organization to coordinate frequency use, particularly among safety and nonsafety applications. It raises appropriate questions about which organization would fulfill this role, the characteristics it should have, and how its activities would be funded. Other questions not raised in the DSRC report are equally important. The organization that eventually becomes the frequency coordinator will need policies or regulations in place to guide its activities and will need enforcement mechanisms. As DSRC radio technology is deployed, numerous unforeseen uses will likely be found for the spectrum, and the frequency coordination effort will need to make clear which ones are allowed and how to prevent the ones that are not allowed. The following are examples of possible uses:  State department of transportation–developed safety application on the standard DSRC safety channel;  Commercial safety application, perhaps advertisement or subscription supported, perhaps not using USDOT security certificates, on a DSRC safety or service channel; and  Commercial nonsafety application (e.g., notification of roadside service ahead) on a service channel. Acknowledgment by the DSRC report of these issues and how they are being addressed by the connected vehicle initiative would be useful. 11 For example, the ITU-R Radio Regulations state: 4.10 Member States recognize that the safety aspects of radionavigation and other safety services require special measures to ensure their freedom from harmful interference; it is necessary therefore to take this factor into account in the assignment and use of frequencies. 15.37 § 29 An administration receiving a communication to the effect that one of its stations is causing harmful interference to a safety service shall promptly investigate the matter and take any necessary remedial action and respond in a timely manner.

9 Scalability The issue of scalability concerns whether DSRC technologies can manage the volume of messages that would be broadcast within the 300-meter range of DSRC devices without being overwhelmed at expected maximum vehicle density in traffic. The potential could be even greater in urban environments with the pedestrian applications being contemplated. In Section 3.IV.B, the DSRC report notes that unpublished NHTSA and CAMP research demonstrates that V2V communications “perform reliably” with up to 200 vehicles and that ongoing research will estimate the number of vehicles at which channel congestion would be significant. Without access to the results of the CAMP research, the committee is not in a position to verify this conclusion. The NHTSA Readiness report (page 109) provides an example indicating that up to 800 vehicles could be within DSRC range on a congested freeway. The Readiness report (page 110) also discusses proposed research to test scalability at maximum traffic volumes and research into possible mitigation measures. The committee agrees that such research is important and that the uncertainty about channel congestion remains a major concern for the V2V initiative until it is resolved through technical analysis and testing. The DSRC report should recognize the importance of scalability and describe work planned or under way to address the potential for interference at likely maximum levels of safety messaging. Security and Privacy Considerations The DSRC report addresses one aspect of security, recognizing that public acceptance of V2V and V2I will depend on having a rigorous process for guaranteeing the credentials of devices broadcasting messages and warnings to ensure accuracy of messages and avoid spoofing. However, discussion of this issue is scattered throughout the DSRC report, and treatment of this topic is less than cohesive. The DSRC report notes on page 43 that “USDOT, CAMP, and security experts have developed an initial security and privacy protection solution that will be prototyped and tested in 2015.” The report is silent with regard to unanswered questions about the organization that would perform the credentialing service and how its operations would be funded. The Readiness report, for example on pages 158–207, treats the technical and policy aspects of a security credentialing management system (SCMS) in considerable detail and lays out options for how the system might be organized and managed. NHTSA’s ANPRM states that it will solicit statements and comments from organizations that would be interested in carrying out the SCMS management function (https://www.federalregister.gov/articles/2014/10/15/2014- 24482/vehicle-to-vehicle-security-credential-management-system-request-for-information; Docket No. NHTSA-2014-0023), indicating the agency’s appreciation of the importance of this issue. The committee views the policy questions about SCMS management and funding as central issues that require resolution and more discussion in the DSRC report. However, credentialing is only one of a number of security issues that will need attention. Work in recent years demonstrating the vulnerability of automobiles to standard hacking techniques, including remote hacking, is illustrative of the challenges faced in securing software- intensive systems. The difficulty is compounded by the longevity of vehicles, which greatly exceeds the lifetime of many other software-intensive systems and complicates such tasks as monitoring the security of devices or ensuring that their software is patched to address security flaws. Security will need to be addressed as a property of the overall system rather than of individual components. For example, unless sensors are properly certified and protected, a credentialed communication device fed by a faked sensor could be removed from a car and used

10 to broadcast spurious warnings. Operating agencies plan to utilize the latest USDOT-led security system design, which will affect operations and maintenance budgets. The additional operations and maintenance cost will need to be accounted for by any agency deploying connected vehicle systems and technology. However, potential third party business models to support, maintain, and operate (or any combination of these functions) the security system are also being considered. With respect to privacy, the report focuses primarily on avoiding personal information disclosure and does not, except by reference to the standard IEEE 1609.2-2013 address the issue of linkability (the ability to link identifiers through serial numbers, certificates, or other means). The committee is concerned that the DSRC report does not adequately distinguish between privacy expectations in connection with an authorized service provider and privacy expectations in connection with third parties who may monitor the wireless medium. The user may have different expectations in those two regards. Thus, a subscription model, for example, may be entirely acceptable for some services (e.g., tolling), despite the lack of privacy the user obtains with respect to the provider. Statements like “non-DSRC communications companies will need to find a business model that is not reliant upon knowing information about the user” (page 28) do not seem to be well supported in relation to nonmandatory, “opt-in” types of applications. Possible techniques for subscription service privacy, such as cryptographic schemes akin to those developed for digital cash and anonymous credentialing systems, were not mentioned. The committee is also concerned that USDOT may expect a uniform security solution to be applied to all communications between DSRC devices. The committee believes that DSRC use cases will arise that do not necessarily rely on the security and privacy mechanisms required for mandatory use cases, such as V2V safety. The report should provide a clearer explanation of applications that require security and privacy protection, applications that do not and why they do not, and which technologies and frequencies the latter applications would be expected to use. Estimated Benefits The committee recognizes the difficulty of precisely projecting the benefits of the connected vehicle initiative at this point. Doing so with high reliability would require a large-scale test in a naturalistic driving environment that would be more complex, extensive, and expensive than the field operational test involving 2,800 vehicles conducted previously in Ann Arbor, Michigan. Thus, the DSRC report appears to be justifiably cautious in its estimates of benefits, which the committee views as another source of uncertainty. However, the benefits estimated on pages 30 and 31 (Section 2.II.C) of the DSRC report are stated with high precision and without equivocation, even though NHTSA’s own ANPRM describes the same estimates as “very preliminary.” The estimates on these pages of the DSRC report, as presented, appear to assume widespread deployment and 100 percent effectiveness, with no adjustment for deployment penetration and estimates of application effectiveness. (These estimates are derived from CAMP and other NHTSA research, much of which has not yet been made public.) Estimates of how DSRC applications, benefits, and costs might unfold over time as more and more vehicles are equipped would be much more relevant. In the committee’s view, considerably more research, and independent review of that research, appears to be needed to estimate more credibly the effectiveness of connected vehicle applications. The DSRC report, pages 30 and 31 (Section 2.II.C), cites benefit estimates derived from two V2V applications [intersection movement assist (IMA) and left-turn assist (LTA)] that

11 would improve intersection safety. It fails to describe the benefits that are likely to come from V2I intersection safety applications and how these benefits have been considered in ascribing safety benefits to the IMA and LTA V2V applications. If these benefits were not considered in ascribing safety benefits to the IMA and LTA V2V applications, this omission should be made explicit in the report along with the rationale for the omission. If they are widely deployed, the V2I intersection safety applications appear likely to produce more intersection safety benefits during the initial decade of DSRC deployment than the V2V intersection safety applications. For the long ramp-up period until a majority of vehicles are DSRC equipped, V2V applications will not be able to sense vehicles that are not DSRC- equipped. Infrastructure-based traffic detectors can sense non-DSRC equipped vehicles and can provide the information about those vehicles to equipped vehicles by using I2V communication. In the long run, most vehicles may have DSRC radios, but many years could elapse before the number of equipped vehicles surpasses the number of nonequipped vehicles, since 20 years or more may be needed for the full vehicle fleet to turn over. A clear description of how this situation has been addressed in arriving at the benefits estimation for the IMA and LTA applications would be desirable, as well as an explanation of why benefits estimates have not been included for the additional V2V safety applications that have been developed and tested under USDOT cooperative research with CAMP. Human Factors One important issue, about which the report is silent, is how drivers might adapt to V2V and V2I warnings and whether they will become less attentive to the driving task because of overreliance on technology. Another human factors challenge could arise if applications are not standardized, which could result in greater risks for drivers using unfamiliar vehicles. The obvious tension is between OEM innovation and competitive differentiation on the one hand and greater uniformity on the other. For example, standardization of such applications could result in a “least common denominator” implementation approach, since such a standard would necessarily be based on the capabilities of the least capable vehicle, unless a mandate required that the enhanced sensor, onboard processing, and driver–vehicle interface capabilities of more advanced vehicle platforms be included on all cars. However, such a requirement would likely increase the base price to the consumer of the least expensive new vehicles. NHTSA may have research planned or under way that addresses human–systems integration (HSI) issues, but such research is not mentioned in the DSRC report. In contrast, the NHTSA ANPRM acknowledges the importance of human factors research and seeks public comment on how it might address connected vehicle HSI concerns through such research. Certification Processes In Section 3.IV.C.3, the DSRC report lists as an “open item” certification test procedures that will be needed to ensure that vehicular and infrastructure devices perform as intended. It notes that some certification procedures exist in draft form and refers to Appendix G of the report for additional details. However, Appendix G is incomplete; it merely describes the layers of performance that will need to be certified without providing details about the procedures for doing so. The DSRC report focuses on DSRC device certification, but performance of other system components is not addressed. V2I efficacy assumes accuracy of signal phase and timing (SPaT) information provided to vehicles, but there is no known certification program guaranteeing that

12 traffic controllers generate accurate SPaT data. (V2I efficacy at full scale-up also assumes ubiquitous accurate intersection map geometry data, but how these data would be systematically produced across the nation is not indicated in the DSRC report.) The DSRC report notes that new hardware has to be certified by FCC, but the process has not yet been laid out. FCC has regulatory authority over devices that transmit radio frequencies, which, for example, could provide a means of certifying aftermarket DSRC devices. FCC could, by rulemaking, apply a recognized DSRC equipment performance standard and test procedure in addition to its existing certification requirements, as it has often done for safety equipment used in the maritime service (e.g., 47 CFR §80 Parts 1101–1103). NHTSA’s Readiness report assumes that vehicle OEMs will be responsible for certification and acknowledges (on page xvii) that OEMs and V2V device manufacturers will have a “significant testing obligation” to guarantee interoperability with other devices and security credentialing. The Readiness report notes in several places the proposed NHTSA research projects to address aspects of certification. The committee views certification issues for OEMs and aftermarket devices as more of a challenge than is conveyed in the DSRC report. Although resolution of this challenge will presumably largely be the responsibility of the private sector, it is a fundamentally important step on the path to deployment and therefore should be discussed more prominently in the DSRC report. In addition to certification, some process will need to be determined for verifying that DSRC radios and devices continue to perform as intended. Ongoing credentialing of devices that might be in the field for 20 years is an important aspect that needs to be considered. Development of performance and test standards for DSRC systems (including aftermarket systems) by recognized national and international standards organizations, to be incorporated by reference into the certification regulations of an agency (such as FCC) having appropriate statutory authority to certify such equipment to ensure that vehicle devices perform as intended over their lifetime of use, would assist in the certification process. It would also be helpful for USDOT and FCC staff to meet routinely to address DSRC spectrum and certification issues addressed in this review, with participation by NTIA staff where appropriate when national spectrum allocation policy issues are considered, as the U.S. Coast Guard and FCC have done for many years to good effect. Frequency coordination with Canada and Mexico could be included. Congress and program stakeholders would benefit from a discussion in the DSRC report concerning how USDOT staff are interacting with FCC to prepare for performance and test standards for DSRC systems. Sensor Reliability Another obligation that will fall on the private sector is to ensure that the vehicle sensors that provide the basic data for warnings are themselves accurate and that the most safety-critical warnings receive priority over others. The DSRC report states on page 3 that “the incorporation of a communications capability within vehicle sensor systems permits data on emerging threats and hazards in the roadway to be gathered from multiple external sources . . . and fused with on- board data.” This integration with vehicle sensor systems needs to be carefully understood. How thoroughly V2V data will be integrated with data from on-vehicle sensor and positioning systems initially is not clear; the data may be loosely coupled. As the evolution of external data with onboard sensor data reaches a point of fusion when both are necessary and critical for making judgments about safety situations, the accuracy and robustness of the onboard sensor

13 data need to be assured. A “hard” sensor failure is relatively easy to identify, and appropriate action can be taken to correct the situation via built-in redundancy or some other form of data correction. However, a gradual, long-term degradation of a sensor (such as the sensors and systems described below) resulting in a gradual increase in the inaccuracy of the data provided can be a significant problem, as can intermittent failures. This type of error, especially in the case of a critical data element, can cause significant problems in a connected vehicle scenario when, for example, 200 or more cars in a 300-meter range are all receiving some form of erroneous data from a given sensor. Strict built-in test parameters and limits will need to be defined for data that are derived from sensors, especially those critical to safety applications (e.g., rate sensors, accelerometers, speed sensors, steering angle and torque sensors, antennas, GPS receivers, and visual data). For example, the yaw sensor used for electronic stability control (ESC) application has a continuous built-in test that monitors the performance of the sensor and all of its associated electronics to determine whether the sensor output is within predefined “acceptable limits.” If the sensor demonstrates an unacceptable performance, the ESC is turned off within fractions of a second and the vehicle is operated in the manual mode. DSRC systems will need to use position data from navigation receivers such as GPS that have been authenticated and certified to ensure that requirements have been effectively met. Reliability of sensors may have been studied as part of the field tests in Ann Arbor, Michigan, but the report of these tests has not yet been made public. If a study or report pertaining to ensuring the reliability of the electronics (and associated sensors) does exist, it needs to be referenced in the report and made public for independent investigation and analysis. The DSRC report should discuss this issue and describe how it is being addressed in the connected vehicle initiative. Safety-Critical Messages and Multicriteria Decision Making The related issues of safety alert prioritization and driver overload are not addressed in the report. These topics are not limited to V2V and V2I safety systems; they are of concern to all safety warning systems and continue to receive much attention, and thus, should be included in the DSRC report. Hierarchical data aggregation and multicriteria decision-making techniques could be applied in such situations, which must be addressed for the system to work effectively. This issue is expected to be addressed in a proprietary manner by individual OEMs with regard to their advanced safety systems features. Whether this would be an appropriate area for industry standards or federal regulations, or both, is not clear due to the diversity in applications and technical capabilities of various vehicle platforms. However, there has been some previous informative research on this subject. 12 Even though this research was not entirely based on DSRC-enabled safety systems, reference to it would strengthen the DSRC report. Funding for Infrastructure As USDOT is undoubtedly well aware, funding for the deployment, operation, and maintenance of the roadside hardware and software necessary for V2I communication is unresolved. Congress has struggled to find ways to fund the upkeep of the existing highways and bridges on the 12 For more information on relevant projects, the reader is referred to http://www.nhtsa.gov/DOT/NHTSA/NRD/Multimedia/PDFs/Crash%20Avoidance/2008/DOT-HS-810-905.pdf; Human Factors for Connected Vehicles: Effective Warning Interface Research Findings, DOT HS 812 068, September 2014; and Crash Warning System Interfaces: Human Factors Insights and Lessons Learned, J. L. Campbell, C. M. Richard, J. L. Brown, and M. McCallum, DOT HS 810 697, January 2007.

14 federal-aid system, and DSRC will add new, more sophisticated technologies that will require ongoing upkeep expenditures. Moreover, many of the nation’s busiest intersections that would be priority candidates for V2I infrastructure and applications may not even be on the federal-aid system, and a new financial burden on county and municipal governments that can barely afford to retime traffic signals on a regular basis would be imposed. Until these issues are addressed, rollout of V2I applications on a broad scale appears questionable, and this should be noted in the DSRC report. Stability of Standards The DSRC report notes on page 40 that standards groups are working on “next versions for publication in the near future” and on page 41 notes that they are “developing additional protocols. . . .” The stability of underlying communications technologies and standards is a known gap that should be acknowledged in the DSRC report. Liability for System Failures The DSRC report is silent about liability issues for both the public and the private sectors resulting from failures of the connected vehicle system to provide warnings as intended. In contrast, the Readiness report acknowledges that this is a major concern of some segments of industry and devotes a full chapter to the issues (pages 208–215). The NHTSA position stated in the Readiness report is that the V2V and V2I warnings that drivers will receive are not different in kind from the types of warnings that vehicles already provide to motorists from onboard sensors. According to the Readiness report, manufacturers can manage their liability in this regard by complying with industry standards and federal regulations and by providing adequate guidance to vehicle owners through manuals and other warnings. In addition, liability concerns as related to the public sector will need to be addressed. The committee has no viewpoint to express on the liability issue, but because of the controversy and concern about it in some segments of the industry, the DSRC report should acknowledge the industry concerns and how NHTSA views them as summarized above. 3. Implementation Path Because the connected vehicle initiative will depend on industry development and deployment of applications, the DSRC report appropriately describes future applications at a fairly conceptual level and describes a vision for how these systems might be deployed in the future, rather than specifying a specific path for implementation. However, as noted above, several critical steps in the implementation path receive limited attention in the DSRC report (frequency coordinator, operation and funding of SCMS, equipment certification, equipment accuracy, infrastructure funding, and resolution of liability concerns). Obviously, additional work is required in these areas for implementation to proceed. Such issues could influence the effectiveness of the applications and the willingness of OEMs to deploy these applications in their vehicles. Therefore, the timeline and implementation milestones in the vision could be less certain than might be implied.

15 4. Consistency with ITS Architecture and Standards Section 4.II.B of the DSRC report, Role of the National ITS Architecture in Deployment, provides good guidance on the close relationship of the proposed deployment of DSRC to the National ITS Architecture. The report identifies the purpose and role of the National ITS Architecture for state and local transportation agencies in meeting their “needs in planning for ITS deployments while ensuring nationwide interoperability.” The report outlines USDOT’s development of the Connected Vehicle Reference Implementation Architecture (CVRIA), initiated in 2012, with the intent of supporting deployment of connected vehicle applications and technologies. The CVRIA currently remains under development and once “sufficiently mature” will become part of the National ITS Architecture. The report also highlights USDOT’s work on a stakeholder community software tool to develop connected vehicle architectures, known as “Set-IT.” The software has been released in an alpha version and is available to the stakeholder community to support deployment activities. Development of training materials to support the tool’s use is also under way. Section 3.III includes guidance on the relationship of the deployment of DSRC to ITS standards. It explicitly lists the relevant standards developed by the Institute of Electrical and Electronics Engineers (IEEE) and the Society of Automotive Engineers (SAE) with support of the ITS Joint Program Office’s Standards Program. Appendix D.II.C.ii provides more details on individual standards. USDOT recognizes that key standards are in a revision cycle, potentially breaking backwards compatibility and containing new protocols. In the future, standards may be periodically updated and revised to correct problems or add new features, but this could affect the validity of testing results produced to date. The effectiveness of the deployed system may be compromised if it is not built on a stable set of standards. The DSRC report notes on page 40 that standards groups are working on “next versions for publication in the near future” and on page 41 notes that they are “developing additional protocols. . . .” Of less importance is a misstatement on page 39 of the DSRC report: “Wi-Fi standard IEEE 802.11 describes the performance of DSRC.” A more accurate statement would be the following: “IEEE standard 802.11 specifies the lower-layer behavior of radios used in DSRC.” 5. Preferencing of Technologies The DSRC report makes a convincing case that DSRC technologies are the best choice for low latency communications. Section 2.II.B expresses USDOT’s intent to explore all wireless technologies and summarizes USDOT and other research investigating the range of options. The section notes that the connected vehicle initiative can rely on technologies other than DSRC (potentially operating at non-DSRC frequencies) for non–low latency V2I communications. However, the concluding page of the section (page 28) notes that any non-DSRC technologies participating in safety messaging, presumably even those that are not crash imminent (such as an indication that there is fog 1 to 2 miles ahead), would face major challenges in maintaining the necessary level of security, in demonstrating that they can maintain a sufficiently high level of reliability, and in building a business model that is not dependent on information concerning the user.

16 Conclusion In conclusion, the committee, as charged, reviewed the USDOT Status of the Dedicated Short Range Communications Technology and Applications [Draft] Report to Congress. The committee’s findings are summarized in the Executive Summary and are not repeated here. Specific guidance on strengthening the DOT draft report is provided in the body of this report. On behalf of the committee, I express our appreciation for the opportunity to be of service in furthering the important and valuable connected vehicle initiative. We hope that you find our comments on the draft DSRC report to Congress to be constructive in this regard. Sincerely, Dennis Wilkie (NAE) Committee Chair cc: Dale Thompson, USDOT, ITS-JPO Enclosure A Committee Roster Enclosure B Committee Biographical Information Enclosure C Meeting Participants Enclosure D Acknowledgment of Reviewers