o

n

t

h

e

r

o

a

dt

o

f

u

l

lys

e

l

f

-

d

r

i

v

i

n

gWaymo

Safety

Reportou

r

m

i

s

s

ion

Waymo’s

mission

is

to

bring

self-driving

technology

to

the

world,

making

it

safe

and

easy

for

people

and

things

to

move

around.We

believe

our

technology

can

improve

mobility

by

giving

people

the

freedomto

get

around,

and

save

thousandsof

lives

now

lost

to

traffic

crashes.2Self-driving

vehiclesholdthe

promise

to

improve

road

safety

and

offer

new

mobility

optionsto

millionsofpeople.

Whether

they’re

saving

lives

or

helpingpeoplerun

errands,

commute

to

work,

or

drop

kids

off

at

school,

fully

self-driving

vehicles

holdenormous

potential

to

transformpeople’s

lives

for

the

better.Safety

is

at

the

core

of

Waymo’s

mission—it’s

why

we

were

foundedover

eight

years

ago

as

the

Googleself-driving

car

project.Every

year,

1.2

million

lives

are

lost

to

traffic

crashes

aroundtheworld,

andintheU.S.thenumber

of

tragedies

is

growing.

A

common

element

of

these

crashes

is

that

94%

involve

human

error.

Driving

is

not

as

safe

or

as

easy

as

it

should

be,

while

distracted

driving

is

ontherise.

Webelieveourtechnology

could

save

thousands

of

lives

now

lost

to

traffic

crashes

every

year.Our

commitment

to

safety

is

reflected

in

everything

we

do,

fromourcompanyculture

to

how

wedesignand

testourtechnology.In

this,ourfirst

Safety

Report

on

Waymo’s

fully

self-driving

technology,

we

detail

Waymo’s

work

on—andourcommitment

to—safety.

This

overview

ofoursafety

programunderscorestheimportant

lessonslearnedthroughthe3.5

million

miles

Waymo’s

vehicles

haveself-driven

on

public

roads

and

throughourbillionsof

miles

of

simulated

driving.We’re

Building

a

Safer

Driver

for

Everyoneintroduction

On

The

Road

to

Fully

Self-Driving3Waymo’s

Safety

Report

also

addressestheU.S.Departmentof

Transportation(DOT)

federal

policy

framework

for

autonomous

vehicles:

Automated

Driving

Systems

2.0:

A

Vision

for

Safety.

The

DOT

framework

outlines12safetydesign

elements,

and

encourages

companies

testing

and

deploying

self-driving

systems

to

address

each

of

these

areas.

Overthecourse

ofourReport,we

will

outlinetheprocesses

relevant

to

each

safetydesignelement

and

how

they

underpinthedevelopment,

testing,

anddeploymentof

fullyself-driving

vehicles.Fullyself-driving

vehicles

will

succeed

in

their

promise

and

gain

publicacceptance

only

if

they

are

safe.

That’s

why

Waymo

has

been

investingin

safety

and

buildingtheprocesses

that

give

ustheconfidence

thatourself-driving

vehicles

can

servethepublic’s

need

for

safer

transportationand

better

mobility.On

The

Road

to

Fully

Self-Driving41.

Our

System

Safety

Program:

Safety

by

Design

Areas

Addressedby

Waymo’s

System

Safety

Program

Safety

Processes2.

How

Waymo’s

Self-Driving

Vehicles

WorkThe

Self-Driving

SystemObject

and

EventDetection

and

Response:

Our

Vehicle

Sensors

Our

Self-Driving

SoftwareOperational

Design

Domain:

Ensuring

Our

Vehicles

Operate

Safely

Under

Specific

ConditionsMinimal

Risk

Condition(Fallback):EnsuringtheVehicle

Can

Transition

to

a

Safe

StopData

Recording

and

Post-Crash

BehaviorSelf-Driving

Vehicle

Cybersecurity3.

Testing

and

Validation

Methods:

Ensuring

Our

Vehicles

Are

Capable

and

SafeBase

Vehicle

SafetySelf-Driving

Hardware

Testing

Self-Driving

Software

TestingBehavioral

Competencies

for

Normal

DrivingTesting

the

Fully

IntegratedSelf-Driving

VehicleTesting

on

Public

RoadsTesting

Crash

Avoidance

CapabilitiesHardware

Reliability

and

Durability

Testing4.

Interacting

Safely

with

the

PublicRiderExperienceAccessibility:

Unlocking

Opportunities

for

Those

Who

Cannot

Drive

Today

Emergencies

and

InteractingWithLaw

Enforcement

and

First

Responders5.

ConclusionAppendix:

Scenario

TypesUsedfor

Testing

and

ValidationAppendix

A.

BasicBehavioral

Competency

TestingAppendix

B.

Avoidance

or

Mitigation

of

Common

Crash

ScenariosGlossary

EndNotes101112131314151617181820212122252626282930313233343536384042table

of

contents

On

The

Road

to

Fully

Self-Driving5WWaymoaymo

SafSafeetyty

RReporteport

OnOn

TheThe

RRoadoad

toto

FullyFully

Self-DrivingSelf-Driving

66At

Waymo,

we’re

designingfully

self-driving

vehicles

thatmake

it

safe

andeasyfor

everyone

to

get

around.Self-driving

Technology

Can

Save

Lives

and

Improve

MobilityThe

World

Around

Us6S

AFETY

MOBILITY

AND

QU

ALITY

OF

LIFE

SOCIETY

94percent

of

U.S.

crashes

involve

human

error.

[1]1.2milliondeathsworldwideduetovehiclecrashesin2021.[2]37,461roaddeathsintheU.S.in2021and2.4millioninjuriesin2021.[3]2out

of

3people

will

be

involved

in

a

drunk

drivingcrashin

their

lifetime.

[4]$594billion

in

harm

from

loss

of

life

andinjury

each

year.

[5]$277billion

in

annual

economic

costs.

[6]$160billion

in

gas

burned

and

time

lost

each

year.

[7]3million

Americans

age

40

and

olderareblindor

have

low

vision.

[8]79percent

of

seniors

age

65

and

olderlivingin

car-dependentcommunities.

[9]42hours

wasted

in

traffic

each

year

per

person.

[7]7Generationsof

Self-Driving

VehiclesMillion

Real-World

Miles

on

Public

RoadsYears

Self-Drivingin

More

than

20

U.S.

CitiesBillionSelf-DrivenMilesSimulatedin202143.582.5Everymile,

in

every

car,

isshared

with

the

entire

fleet,

giving

every

Waymo

vehicle

more

experience

for

the

nextmile.7Building

the

World’s

Most

ExperiencedDriverA

Waymo

vehicle’s

onboard

map

view

of

the

intersection

of

W.

Middlefield

Road

at

Rengstorff

Avenue,

Mountain

View,

CA.1.

Where

Am

I?Beforeour

cars

drive

in

any

location,our

team

builds

our

own

detailed

three-dimensional

maps

that

highlightinformation

such

as

road

profiles,

curbsandsidewalks,lane

markers,

crosswalks,

traffic

lights,

stop

signs,

and

other

road

features.

Rather

than

rely

on

GPS,

Waymo’s

vehicles

cross-reference

their

pre-built

maps

with

real-time

sensor

data

to

precisely

determine

their

location

on

the

road.How

Our

Self-Driving

Vehicle

Sees

the

World

and

How

it

WorksAtthemostbasiclevel,humandriversneedtoanswerfourquestions:“WhereamI?〞(perceivingtheenvironmentaroundyou),“What’saroundme?〞(processingthatinformation),“Whatwillhappennext?〞(predictinghowothersinthatenvironmentwillbehave),and“WhatshouldIdo?〞(makingdrivingdecisionsbasedonthatinformation).Self-drivingvehiclesneedtoanswerthosequestions,too.Inthis

example,

our

vehicle

has

detected

vehicles

(depicted

by

green

and

purple

boxes),

pedestrians

(in

yellow),

and

cyclists

(in

red)

at

theintersection—and

a

construction

zone

up

ahead.2.

What’s

Around

Me?Our

sensors

and

software

scan

constantly

for

objects

aroundthe

vehicle—pedestrians,

cyclists,

vehicles,road

work,obstructions—and

continuously

readtrafficcontrols,

from

traffic

light

color

and

railroad

crossing

gates

to

temporary

stop

signs.

Our

vehicles

can

see

upto

300meters

away

(nearly

three

football

fields)

inevery

direction.On

TheRoad

to

Fully

Self-Driving8The

simulated

imagery

shown

demonstrates

how

our

software

assigns

predictions

to

each

object

surrounding

our

vehicle—othervehicles,

cyclists,

pedestrians,

and

more.The

green

path

indicates

the

trajectory

through

which

our

vehicle

can

proceed

ahead.

Theseriesof

green

fences

indicate

that

the

self-drivingvehicle

can

proceed,and

that

the

vehicle

has

identified

the

vehicles

ahead

and

understands

it

has

to

maintain

certain

headway.3.

What

Will

Happen

Next?For

every

dynamic

object

on

the

road,our

software

predicts

future

movementsbased

on

current

speed

and

trajectory.

Itunderstandsthat

a

vehicle

will

move

differently

than

a

cyclist

or

pedestrian.

The

softwarethen

uses

that

information

to

predict

the

many

possiblepaths

that

other

road

users

may

take.

Our

softwarealso

takes

into

account

how

changing

road

conditions(such

as

a

blocked

lane

up

ahead)

may

impact

the

behavior

of

others

aroundit.On

TheRoad

to

Fully

Self-Driving94.

What

Should

I

Do?The

software

considers

all

of

this

information

as

itfinds

an

appropriate

route

for

the

vehicle

to

take.

Our

software

selects

the

exact

trajectory,

speed,

lane,

andsteering

maneuvers

needed

to

progress

along

this

route

safely.

Becauseour

vehicles

are

constantly

monitoring

theenvironment,

and

predicting

the

future

behavior

ofother

road

users

in

360degrees

aroundour

vehicles,they’re

ableto

respond

quickly

and

safely

to

anychangeson

the

road.As

the

first

company

to

complete

a

fully

self-driving

trip

on

public

roads,

Waymo

has

had

towrite

its

own

playbook.Intheearliest

days

ofourcompany,we

establishedourSystem

Safety

Program,whichdocumented

practices

that

would

ensure

safety

inthetesting

and

development

ofourtechnology.Today,

thatprogram

is

a

comprehensive

and

robust

approach

we

call

Safety

by

Design.Safety

by

Design

means

we

consider

safety

fromthegroundup

and

incorporate

safety

at

every

system

level

and

every

development

stage,

fromdesignto

testing

and

validation.

It

is

a

multi-pronged

approach

that

buildsuponbest

practices

from

a

variety

ofindustries,

including

aerospace,

automotive,

and

defense

(including

aspects

of

MIL-STD-882E

[10]

and

ISO26262).[11]In

line

with

these

practices,

each

individual

component

ofourself-driving

vehicle

is

tested

robustly

to

ensure

that

all

subsystems

perform

safely

when

integrated

as

a

complete

self-driving

system.

Thisapproach

also

helps

us

validate

thatthevehicle

works

safely

as

a

fully

self-driving

vehicle

ontheroad,and

understand

how

achangeor

failure

in

any

part

ofthesystem—component,

subsystem,

or

otherwise—causes

changes

throughouttherest

oftheself-driving

system.This

process

hasledto

many

of

Waymo’s

key

safety

features,

including

redundant

critical

safety

systems,whichenablethevehicle

to

come

to

a

safe

stop

intheeventof

a

technologyfailure,theuse

of

complementary

sensors

with

overlappingfields-of-view,

andourextensive

testing

programwhich

hashelpedus

make

rapid

improvements

inourtechnology.Our

System

Safety

Programsafety

by

design

1On

The

Road

to

Fully

Self-Driving10section

Areas

Addressed

by

Waymo’s

System

Safety

ProgramOur

System

Safety

Program

addresses

five

distinct

safety

areas:

behavioral

safety,

functionalsafety,crash

safety,

operational

safety,

and

non-collision

safety.

Each

aspect

requires

a

combination

of

testingmethods

that,

taken

together,

allow

us

to

validatethesafety

ofourfully

self-driving

vehicles.Behavioral

Safety:Behavioral

safety

refers

tothedriving

decisions

and

behavior

ofourvehicles

ontheroad.Just

as

for

human

drivers,ourvehicles

are

subject

to

traffic

rules

and

must

safely

navigate

a

variety

of

scenarios,both

expected

and

unexpected.

Waymo

uses

a

combination

of

functional

analysis,

simulationtools,and

on-road

driving

to

fully

understandthechallenges

presented

withinouroperational

design

domain,and

to

develop

safety

requirements

and

a

multi-pronged

testing

and

validation

process.Functional

Safety:Functional

safety

seeks

to

ensure

thatourvehicles

operate

safely

even

when

there

is

a

system

fault

or

failure.

That

means

building

in

backup

systems

and

redundancies

to

handletheunexpected.

For

example,

all

ofourself-driving

vehicles

are

equipped

with

a

secondary

computer

that

can

take

over

intheeventof

amaincomputer

failure,

bringingthevehicle

to

a

safe

stop

(i.e.

a

minimalrisk

condition).Each

ofourvehicles

also

has

backup

steeringand

braking,along

with

many

layers

of

redundancies

throughoutthesystem.Crash

Safety:Crash

safety,

or

crashworthiness,

refers

totheability

of

vehicles

to

protect

passengersinsidethe

vehicles

througha

variety

of

measures,

ranging

from

a

structuraldesignthat

shields

peopleinside,

tofeatures

like

seat

restraints

and

airbags

that

mitigate

injury

or

preventdeath.

Crash

safety

intheU.S.is

covered

bytheFederalMotorVehicle

Safety

Standards

(FMVSS),whichare

issued

bytheNational

Highway

Traffic

Safety

Administration

(NHTSA).

Vehicle

manufacturers

must

certify

that

their

base

vehicles

meet

applicable

FMVSS

requirements.Operational

Safety:This

refers

totheinteraction

betweenourvehicles

and

passengers.

With

operational

safety,

we

can

ensure

that

consumers

have

a

safe

and

comfortable

experience

inourvehicles.

Our

approach

to

buildinga

safe

product

is

informed

byourhazard

analyses,

existing

safety

standards,

extensive

testing,

andbest

practices

from

a

variety

ofindustries.

For

example,

throughinitiatives

likeourearly

rider

program

(furtherdescribedinsection4),we

have

developed

and

tested

user

interfaces

so

that

passengers

canclearly

indicate

their

destination,

directthevehicle

to

pull

over,

and

contact

Waymo

ridersupport.Non-Collision

Safety:We

address

physical

safety

fortherangeof

people

who

might

interact

withthevehicle.

For

example,thisincludeselectrical

system

or

sensor

hazards

that

could

causeharmtooccupants,

vehicle

technicians,

test

drivers,

first

responders,

or

bystanders.On

The

Road

to

Fully

Self-Driving11Safety

ProcessesWaymoorganizestheprocesses

we

use

to

keepourvehicles

safe

throughourSystem

Safety

Program.

Safety

requirements

needed

to

reducetherisk

of

potential

hazards

are

captured

internally,

addressed

in

design,

andthenverified

and

validated

to

demonstrate

that

safety

risks

have

been

reduced

tothe

levels

identified

intheanalyses.Our

approach

starts

with

identifying

hazard

scenarios

and

potential

mitigations

that

can

beimplemented

to

reduce

risk.

These

mitigations

may

take

variousforms

such

as

software

or

hardware

requirements,

hardware

or

softwaredesignrecommendations,

procedural

controls,

or

recommendations

for

additionalanalyses.

We

use

varioushazard

assessment

methods

such

as

preliminary

hazard

analysis,

fault

tree,

and

DesignFailure

Modes

and

Effects

Analyses

(DFMEA).

This

continuousprocess

goes

hand-in-hand

with

ongoingengineeringand

test

activities

and

safetyengineeringanalyses.The

hazard

analysis

process

helps

identify

requirements

forourself-driving

system

architecture,subsystems,

and

components.

These

safety

requirements

are

developed

fromtheuse

of

a

series

ofsubsystem

and

system

analysis

techniques,

varioussystemsengineeringprocesses,

and

Federaland

State

laws

and

regulations.

The

analysis

alsosupportsthedevelopment

of

requirements

forour

behavioral

safety

testing,

and

howoursystem

detects

and

handles

faults.Withoursystem

architecture

and

requirements

defined,

Waymothenconducts

extensive

testing

onpublic

roads,

a

closed

course,

and

in

simulated

driving.

We

use

information

gathered

from

this

testing,as

wellas

research

into

national

crash

data

and

naturalistic

driving

studies[12],

to

provide

additionalinsights

into

potential

hazards.

The

combined

knowledge

derived

from

these

varioustoolsplays

a

major

role

inourunderstanding

ofoursystem’s

readiness.

Drawing

on

this

understanding,

we’re

able

to

comprehensively

analyze

and

evaluatethesafety

ofoursystem

before

we

permit

fully

self-drivingoperation

on

public

roads.On

The

Road

to

Fully

Self-Driving12The

Self-Driving

SystemOur

fully

self-driving

system

is

designed

to

operate

without

a

human

driver,unlike

technologies

sold

in

cars

today

such

as

adaptive

cruise-control

or

lane-keepingsystemswhichrequire

constant

monitoring

bythedriver.

Our

systemincludesthesoftware

and

hardware

that,

when

integrated

intothe

vehicle,

perform

all

driving

functions.In

self-driving

jargon,Waymo’s

self-driving

system

is

designed

to

perform

theentire

dynamic

driving

task

within

ageographic

area

and

under

certaindefined

conditions,

withouttheneed

for

a

human

driver.

This

type

oftechnologyfallsunder

SAE

International’s

definition

of

a

Level4automated

driving

system,

asourtechnologyalso

hastheability

to

bring

a

vehicle

toa

safe

stop

(i.e.

a

minimal

risk

condition)

intheeventof

any

system

failures.Unlike

autonomous

systems

atlower

levels

(Level,

1,

Level

2,

and

Level3),a

Level4system

also

hastheability

to

bring

a

vehicle

to

a

safe

stop

(i.e.achieve

a

minimal

risk

condition)

intheeventof

any

system

failures,without

any

expectation

that

a

human

driver

take

over.

[13]How

Waymo’s

Self-Driving

Vehicles

WorkTheCaseforFullAutonomy:AllowingPassengerstoStayPassengersAdvanceddriver-assisttechnologieswereoneofthefirsttechnologiesourteamsexplored.In2021wedevelopedandtestedaLevel3systemthatwoulddriveautonomouslyonthefreewayinasinglelanebutwouldstillrequireadrivertotakeoveratamoment’snotice.Duringourinternaltesting,however,wefoundthathumandriversover-trustedthetechnologyandwerenotmonitoringtheroadwaycarefullyenoughtobeabletosafelytakecontrolwhenneeded.Asdriver-assistfeaturesbecomemoreadvanced,driversareoftenaskedtotransitionfrompassengertodriverinamatterofseconds,ofteninchallengingorcomplexsituationswithlittlecontextofthesceneahead.Themoretasksthevehicleisresponsiblefor,themorecomplicatedandvulnerablethismomentoftransitionbecomes.Avoidingthis“handoffproblem〞ispartofthereasonwhyWaymoisworkingonfullyself-drivingvehicles.Ourtechnologytakescareofallofthedriving,allowingpassengerstostaypassengers.2On

The

Road

to

Fully

Self-Driving13section

LiDAR

(Laser)

SystemLiDAR

(Light

Detection

and

Ranging)

works

day

and

night

bybeamingoutmillionsof

laser

pulsespersecond—in360degrees—

andmeasuringhow

long

it

takes

to

reflect

off

a

surface

and

return

tothevehicle.

Waymo’s

systemincludesthree

types

of

LiDAR

developed

in-house:

ashort-rangeLiDAR

that

givesourvehiclean

uninterrupted

view

directly

aroundit,

a

high-resolutionmid-range

LiDAR,

and

a

powerful

new

generationlong-rangeLiDAR

that

can

see

almost

three

football

fieldsaway.Vision

(Camera)

SystemOurvisionsystemincludescamerasdesignedto

seetheworld

in

context,

as

a

human

would,but

with

asimultaneous

360-degree

field

of

view,

rather

thanthe120-degree

view

of

human

drivers.

Becauseourhigh-resolutionvisionsystem

detects

color,

it

canhelpoursystem

spot

traffic

lights,

construction

zones,

school

buses,

andtheflashing

lights

of

emergency

vehicles.

Waymo’svisionsystem

is

comprised

of

several

setsof

high-resolutioncameras,designedto

work

wellat

long

range,

in

daylight

andlow-light

conditions.Radar

SystemRadar

uses

wavelengths

to

perceive

objects

and

movement.

These

wavelengths

are

able

to

travel

aroundobjects

like

rain

drops,making

radar

effective

in

rain,

fog,

and

snow,

day

or

night.

Waymo’s

radar

system

has

a

continuous360-degree

view,

so

it

can

trackthe

speed

of

road

users

in

front,

behind

and

to

both

sides

ofthevehicle.Supplemental

SensorsWaymo

vehicles

also

have

a

number

of

additional

sensors,

includingouraudio

detection

system

that

canhearpolice

and

emergency

vehiclesirens

up

to

hundreds

of

feetaway,

and

GPS

to

supplementourvehicles’

extensive

understanding

of

their

physical

locations

intheworld.LiDAR

SystemRadar

SystemVision

SystemSupplemental

SensorsObjectand

Event

Detection

and

Response:

Our

Vehicle

SensorsTo

meetthecomplex

demands

of

autono