Will Mercedes jump to level 3 before Tesla? Looks like it.

[stopcrazypp]

Sleeping is not desired on 5 minute trips.

But your design must still account for it (as well as for intermediate times like 30 minutes) if it explicitly allows sleeping. You can't rely on the "desire" of the owner.

To me, a standby driver car is one that legally must leave its ODD while moving. Stopping in the middle of the highway is not legal except in an emergency situation, which is how I would class a non-responsive driver.

The key difference is this. Most plans for fake level 3 involve being able to give the driver 10 seconds warning, as they can almost always respond in 10 seconds unless asleep. I am saying you can let them sleep if you make the warning a few minutes in advance, particularly when there is an emergency escape plan, like an off-ramp.

This has been discussed in the past, but if your car can give a warning minutes in advanced including have emergency escape plans, it would be L4 already. People have asked this and no one was able to present a convincing scenario of a system that can give minutes of advanced warning, while still not being able to safely handle things if the driver ends up not responding.

If your design requires getting them back on board in 10 seconds for a surprise event like surprise construction, you would not want to let them sleep. Other surprises like debris on road, stalled cars etc. the car is expected to handle on its own. The main plan for fake level 3 is a car which can do only freeway, or can do entry to off-ramps but needs takeover once in the off-ramp as it can't handle things like lights at the base of the ramp. It can probably handle red lights at the end of the ramp, it's green which it would have a problem with.

People are also working on tolerable handling of freeway construction zones. Tesla certainly plans to do this. Then you can avoid issues with surprise zones. Though again, for a Tesla, it should be almost impossible to be surprised by a construction zone in the places that are thick with Teslas. Long before the zone becomes real there will be cones and construction equipment that weren't there before, easy to notice if Teslas had maps. Which they will, after Elon takes the stick out of his butt about maps.

The above ties into the narrow operating scenarios for L3, basically a limited traffic jam feature being the only application that can convincingly make sense. If you come up with a system that can safely handle all scenarios you throw at it at full speed, the complexity required of the system would be no different from a L4 system.

Note I'm using the SAE definitions. I'm not entire sure what you mean when you say "fake L3". I suggest not making up new terminology as there is enough of that already done by "journalists" that have largely confused the public further.

 

[bradtem]

This has been discussed in the past, but if your car can give a warning minutes in advanced including have emergency escape plans, it would be L4 already.

No. A fake L3 car needs to know when its ODD is ending, and in fact should know the moment you engage where it is expected to end, be that 10 minutes down the road or 2 hours. While normally 10 second warning is considered a good idea, there is no constraint against doing a 2 minute warning other than it would annoy people who want to not be interrupted minutes sooner than needed. However, if you are asleep (which the car should know with its inward camera) it can and should decide to wake you a few minutes in advance, to assure you have time to come to full alertness, or it has time to deal with it (in an emergency way) if you don't. L3 cars do need to have to handle emergency situations like non-responsive driver, and it does not make them full self-driving cars.

Note I'm using the SAE definitions. I'm not entire sure what you mean when you say "fake L3". I suggest not making up new terminology as there is enough of that already done by "journalists" that have largely confused the public further.

I am not making up new terminology. I find that amusing. I was writing about this stuff years before NHTSA defined their levels 0-4, and was immediately critical of them (as were many others in the field.) They are the ones who made up new terms, and SAE followed them with 0-5, and because of their position, they got many people who are newcomers to the field to use their terms, but the leaders of the field certainly did not move to using them at the time, though some have given up and accepted using them. Nobody asked them to make a taxonomy of a technology they didn't understand and which was still being worked out by those building it. In particular we were afraid because it was NHTSA that made them up that some day they might try to regulate based on the tech. For now, in the USA at least, they have not. Regulations here have mostly related to the difference between ADAS and self-driving, which everybody agreed is a real difference and might play a role in regulation, and in fact I participated in a small way in the drafting of those laws in Nevada and California.

 

[Knightshade]

No. A fake L3 car needs to know when its ODD is ending, and in fact should know the moment you engage where it is expected to end,

Tell me you don't understand ODDs without telling me you don't understand ODDs

There's lots of ODD limits your claim would not be remotely true for.

L3 cars do need to have to handle emergency situations like non-responsive driver, and it does not make them full self-driving cars.

I am not making up new terminology.

You literally just made some up.

"full self driving car" is not a defined term in J3016.

In an L3 car when the system is engaged, the car is FULLY driving, by definition. The only thing being done by the human is the fallback safety task, not any part of the dynamic driving task.

The fact the human is doing THAT job is why they need to be awake. If the CAR can also do THAT job, it's L4 and the human need not be there at all.

 

[daktari]

I never claimed that. That is merely you projecting your own prejudices onto my statements and putting words into my mouth (you are not the only one that have done that, so I've come to expect it in these forums).
This is the exchange that prompted you to get on my back and using a factually incorrect statement to do so:


Entire early comment for context:

My point was the driver is not allowed to sleep in a L2 or L3 car. It's that simple.

I never claimed the stop in lane feature MB has is a level 4 thing. Again others pointed out Tesla AP has the same thing. A car being able to stop in its own lane after the driver does not respond to the car is not a L4 feature. I will note it's not necessarily a "safe stop" either, as it can be quite dangerous to come to a complete stop in a travel lane (part of why it can't be considered L4). Others already pointed out, a L4 car never has to ask the driver to take over in the first place. It'll do whatever maneuver necessary (including pulling to shoulder or even pulling to a parking lot, if necessary).

It is good that you admit that your claim "need to take over within seconds" was wrong for MB drive pilot. Immediate takeover vs a safe stop mitigation is the difference. Stopping on a highway is never "safe" wherever one stops. But stopping is safer than sitting in a car that is tolling and not controlled anymore.

A Tesla on AP will rear end a car in certain scenarios. MB drive pilot should never, but time will tell.
AP will sometimes suddenly disengage in a split second. MB drive pilot should not. and that is the huge difference.

I am not trying to put word in your mouths, but my interpretation is that you mean the difference between AP and drive pilot in the same ODD is negligible. I mean it is huge.

 

[daktari]

But Drive Pilot does not always stop safely.

It just always stops.

So does Autopilot if you don't take over.

In fact both stop the same way- by just braking to a stop in their current lane and sitting there.


There's no blur at all.

Neither is designed or intended to be able to stop safety-- or more accurately bring the car to a minimal risk condition, which is the actual thing L4 requires and which neither system from Tesla nor Mercedes can or even claims to do.

Except that AP does crash into things and cars on the highway just suddenly, and also disengage just like that sometimes.
MB drive pilot shall never do that, but time will tell if it really is that safe. The difference is huge.

 

[Knightshade]

Except that AP does crash into things and cars on the highway just suddenly, and also disengage just like that sometimes.
MB drive pilot shall never do that, but time will tell if it really is that safe. The difference is huge.

The difference is imaginary at this point though.

AP is never SUPPOSED to hit things, but on rare occasions does (far less often than humans do, based on the public crash data, though that's a whole other argument)

MBs system is never SUPPOSED to hit things, but has a track record of... nothing.... to judge it on.

 

[bradtem]

Tell me you don't understand ODDs without telling me you don't understand ODDs

There's lots of ODD limits your claim would not be remotely true for.



You literally just made some up.

"full self driving car" is not a defined term in J3016.

In an L3 car when the system is engaged, the car is FULLY driving, by definition. The only thing being done by the human is the fallback safety task, not any part of the dynamic driving task.

The fact the human is doing THAT job is why they need to be awake. If the CAR can also do THAT job, it's L4 and the human need not be there at all.

Of course there are all sorts of ODD limits. However, for all planned level-3 type cars I have seen, the prime limitation is that the car's ODD is limited to sections of limited access freeway, sometimes with limitations based on conditions like weather or day/night or construction.

The central element of needing a standby driver is that the vehicle has a reason to exit its ODD without stopping. This is of course the rule on freeways, stopping is for emergency situations (or due to traffic.) A self-driving car (which, in its various forms, was the primary name for the technology before NHTSA decided to invent fake levels) does not leave its ODD (a useful term they did invent though everybody knew that vehicles would only drive in a certain set of roads and conditions.)

The idea of a standby driver arose when people thought about how since a car doesn't self-drive outside its ODD, and if the ODD is just the freeway, how does it get off the freeway? The answer is a standby driver, who takes over before departure. If it's a regular robotaxi, it never leaves the ODD and doesn't even have a steering wheel. If it has a wheel, it would stop and then a human could drive it like a regular car. The standby driver concept that got the name Level 3 allowed something more useful if all you could do was drive freeways. That was actually one of the original plans at Chauffer (proto-Waymo) to make a highway self-driving car. I pushed instead for Robotaxi. Another factor was research that suggested that standby drivers were a dangerous idea, not worth doing.

I call them fake levels because there are people out there actually leading the way on self-driving cars, and there are other people who created the levels to the annoyance of the first group. There is this false impression that these levels are some sort of taxonomy that came from the leading teams and which guides them. They are not. They are externally imposed ideas of how it might work. As such, I have little interest in what J3016 says except when regulators think they want to include it in regulations, which they should not.

However, I am not a fan of your style of discussion which contains statements about the person rather than the issues and facts. So I will give you the last word and not reply to you further.

 

[EVNow]

Does Merc handle snow ?

https://twitter.com/x/status/1508497886010613761

 

[Knightshade]

Of course there are all sorts of ODD limits. However, for all planned level-3 type cars I have seen, the prime limitation is that the car's ODD is limited to sections of limited access freeway, sometimes with limitations based on conditions like weather or day/night or construction.

I mean, the actual Mercedes L3 system here is based on none of those. It's based on speed.

If traffic gets over 37 mph the human needs to take over. The car has no idea how long that will take

A traffic jam might take an hour. It might resolve in a few minutes.

So we already disproved your premise from the very example the thread is about.

The central element of needing a standby driver is that the vehicle has a reason to exit its ODD without stopping.

No, it's not.

Again you keep trying to discuss SAE levels while clearly not understanding them.

The idea of a standby driver arose when people thought about how since a car doesn't self-drive outside its ODD, and if the ODD is just the freeway, how does it get off the freeway? The answer is a standby driver, who takes over before departure.

Again, this a wrong.

L4 cars still have an ODD, but require no standby driver.

If it's a regular robotaxi, it never leaves the ODD and doesn't even have a steering wheel.

This again misunderstands ODDs.

Also Waymo has L4 robotaxis right now. They still have steering wheels so that's also wrong.

The standby driver concept that got the name Level 3

Is Yet Another Thing You Made Up.

"standby driver" in this case.

There's a specific fallback function defined. At L3 the human performs it, at L4 and L5 the car does.

As such, I have little interest in what J3016 says

Which might explain why you keep misrepresenting it so badly.

So I will give you the last word and not reply to you further.

#dubious

 

[stopcrazypp]

No. A fake L3 car needs to know when its ODD is ending, and in fact should know the moment you engage where it is expected to end, be that 10 minutes down the road or 2 hours. While normally 10 second warning is considered a good idea, there is no constraint against doing a 2 minute warning other than it would annoy people who want to not be interrupted minutes sooner than needed. However, if you are asleep (which the car should know with its inward camera) it can and should decide to wake you a few minutes in advance, to assure you have time to come to full alertness, or it has time to deal with it (in an emergency way) if you don't. L3 cars do need to have to handle emergency situations like non-responsive driver, and it does not make them full self-driving cars.

If the car can handle a non-responsive driver 100% safely (meaning it *never* needs the driver to respond) it's a L4 car. Have you read the full SAE J3016 document as others have suggested? I'm not sure why you are bringing in "full self-driving cars" (a term that is not clearly defined) when we are discussing SAE levels.

I am not making up new terminology. I find that amusing. I was writing about this stuff years before NHTSA defined their levels 0-4, and was immediately critical of them (as were many others in the field.) They are the ones who made up new terms, and SAE followed them with 0-5, and because of their position, they got many people who are newcomers to the field to use their terms, but the leaders of the field certainly did not move to using them at the time, though some have given up and accepted using them. Nobody asked them to make a taxonomy of a technology they didn't understand and which was still being worked out by those building it. In particular we were afraid because it was NHTSA that made them up that some day they might try to regulate based on the tech. For now, in the USA at least, they have not. Regulations here have mostly related to the difference between ADAS and self-driving, which everybody agreed is a real difference and might play a role in regulation, and in fact I participated in a small way in the drafting of those laws in Nevada and California.

California is using SAE terminology to definite was is L2 vs L3+ for what they regulate. The same thing is being used to draft the UN standard that Mercedes is using as part of this thread. Just because you might have been writing about this first, doesn't mean you get to definite what terms the industry uses.

 

[stopcrazypp]

It is good that you admit that your claim "need to take over within seconds" was wrong for MB drive pilot. Immediate takeover vs a safe stop mitigation is the difference. Stopping on a highway is never "safe" wherever one stops. But stopping is safer than sitting in a car that is tolling and not controlled anymore.

A Tesla on AP will rear end a car in certain scenarios. MB drive pilot should never, but time will tell.
AP will sometimes suddenly disengage in a split second. MB drive pilot should not. and that is the huge difference.

I am not trying to put word in your mouths, but my interpretation is that you mean the difference between AP and drive pilot in the same ODD is negligible. I mean it is huge.

Lol, now you are trying to say I am wrong about "within seconds" because you were wrong about it being safe to sleep in the car? It's because you have to respond in seconds, that you can't sleep in the car in the first place! You can't rely on the car stopping after no response as something that is safe, which is why it's L3 and not L4.

Someone posted up thread the UN standard is a 10 second warning (Mercedes says the same thing "If the buttons in the steering wheel rim turn red, the vehicle requests the driver to retake control within ten seconds."). That's the problem. That's not enough time for you to wake up, much less take over a car from sleep!
Conditionally automated driving with the DRIVE PILOT | Mercedes-Benz Group

SAE's L3 standard says "several seconds". You have not posted anything to the contrary.

 

[bradtem]

If the car can handle a non-responsive driver 100% safely (meaning it *never* needs the driver to respond) it's a L4 car. Have you read the full SAE J3016 document as others have suggested? I'm not sure why you are bringing in "full self-driving cars" (a term that is not clearly defined) when we are discussing SAE levels.

California is using SAE terminology to definite was is L2 vs L3+ for what they regulate. The same thing is being used to draft the UN standard that Mercedes is using as part of this thread. Just because you might have been writing about this first, doesn't mean you get to definite what terms the industry uses.

Well, first of all, I call it fake level 3 for a reason, because I don't like the design. However, your description of it is not accurate. It says:

NOTE 6: Although automated DDT fallback performance is not expected of Level 3 ADS features, a Level 3 feature may be capable of performing the DDT fallback and achieving a minimal risk condition under certain, limited conditions.

So it is still an SAE level 3 system if it is able to perform the fallback. As noted, back in 2013, Google's experiments concluded that not having such a fallback was not a good idea, it was unsafe. And generally most others agree and if they build such a system they put in some fallback. There is debate about what a minimal risk condition is, but people often talk about just stopping in the lane, though nobody is fond of that but it's something you generally can always do.

These experiments and others found you could almost always (but not 100% always) get a response in 10 seconds, so people aim for that. However, I point out that when you know your ODD continues for another hour, you can either alert the user 10 seconds before it ends and expect them to take over, you also can alert them sooner, with enough time for them to wake up and become fully aware. In general it is wise to alert them well before 10 seconds and most designs I have seen do so, but they don't do it 3 minutes in advance as you might for somebody asleep. The trick I point out is that in this situation you are typically looking at a Freeway exit as the end of the ODD you are warning about. If you have a sleeping driver you can alert them some time before the previous exit, and, if they don't respond, most cars should be able to take the exit if the map indicates that is reasonable, where they can then safely pull onto the shoulder. (Neither stopping in a freeway lane or pulling onto shoulder are considered non-emergency moves. Going to the shoulder of an off-ramp is generally an allowed driving move.)

This is not just a special case, because "freeway in decent weather" is in fact the most likely ODD of SAE-L3 systems, once you get past "freeway in traffic jam." That's the one I hear most talk of plans for.

Generally SAE-L3 designs ideally never truly demand 10 second takeover. That's not safe. It's safe most of the time but times will come that fail that test. Generally, the goal should be planned takeovers at geographic locations. Though some imagine they might do it on seeing a "construction ahead" sign that's a pretty crappy system in my view. In particular, you are partly right when you think what I describe is a SAE-L4 system. That's because to be safe, I think an SAE-L3 system has to be a real self-driving car within its freeway ODD, and pretty much do the entire driving task in that area (though not in all weather.) It should be very hard to tell it apart from the full self driving car that could run unmanned, and the only difference is, it needs a driver to get off the freeway. In fact, it would be a real self driving car if it weren't for the fact you can't just stop on the freeway and you can't pick up or drop off passengers on the freeway, so something has to get you to/from the freeway and actual destinations. There are no destinations or stopping places on the freeway, so a freeway-only car needs a driver to get to and from destinations.

I realize this is not what SAE says. I don't care much what they say. I am talking about what I think is a good and safe design.

 

[S4WRXTTCS]

I realize this is not what SAE says. I don't care much what they say. I am talking about what I think is a good and safe design.

There is nothing wrong with being opposed to L3.

You called the MB system a fake L3, but the MB system is practically the very definition of what we are to expect with L3. I highly doubt anyone is going to take L3 much further than the MB system.

As soon as you start trying to remove those limitations from the system it dramatically increases the requirement of the system, and the dangers of having an unresponsive human fallback. As a result anything beyond traffic assist for L3 simply isn't feasible. It might be evaluated, and tested but I don't believe we'll ever see a highway speed L3 system being sold to consumers.

Unless the driver is in some hell hole traffic wise the odds of reaching a geographical take over location is really low. Most takeovers will be because the traffic ahead was speeding up or a few rain drops came down from the sky.

Audi's system years ago even had people take over if the car was no longer boxed in. Thankfully it never got released, and wasn't able to torture any paying customers with beeping.

L3 systems will be really needy. They won't be unsafe though as any accident that does happen will be low speed accidents.

I imagine L4 will have scheduled take over events. Things like scheduling a take over a couple miles before a rest stop where if I don't take over the car simply stops at the rest stop.

The trick to good L4 consumer car is being able to design it in such a way that the driver can still drive when they want, but lock out the controls so restless legs while sleeping doesn't hit the brake or throttle.

 

[powertoold]

Oh great, more useless levels discussion

 

[t3sl4drvr]

If the car can handle a non-responsive driver 100% safely (meaning it *never* needs the driver to respond) it's a L4 car.

No. The outcome from L3 handling non-response does not have to be a successful drive. For example, L3 can just bring the car safely to stop, but does not need to get that to the destination.

L4 should always bring the car to the destination within the defined ODD.

For this reason, L3 cars cannot operate without a driver (no human in the car), but L4 can.

 

[Daniel in SD]

Well, first of all, I call it fake level 3 for a reason, because I don't like the design. However, your description of it is not accurate. It says:

So it is still an SAE level 3 system if it is able to perform the fallback. As noted, back in 2013, Google's experiments concluded that not having such a fallback was not a good idea, it was unsafe. And generally most others agree and if they build such a system they put in some fallback. There is debate about what a minimal risk condition is, but people often talk about just stopping in the lane, though nobody is fond of that but it's something you generally can always do.

These experiments and others found you could almost always (but not 100% always) get a response in 10 seconds, so people aim for that. However, I point out that when you know your ODD continues for another hour, you can either alert the user 10 seconds before it ends and expect them to take over, you also can alert them sooner, with enough time for them to wake up and become fully aware. In general it is wise to alert them well before 10 seconds and most designs I have seen do so, but they don't do it 3 minutes in advance as you might for somebody asleep. The trick I point out is that in this situation you are typically looking at a Freeway exit as the end of the ODD you are warning about. If you have a sleeping driver you can alert them some time before the previous exit, and, if they don't respond, most cars should be able to take the exit if the map indicates that is reasonable, where they can then safely pull onto the shoulder. (Neither stopping in a freeway lane or pulling onto shoulder are considered non-emergency moves. Going to the shoulder of an off-ramp is generally an allowed driving move.)

This is not just a special case, because "freeway in decent weather" is in fact the most likely ODD of SAE-L3 systems, once you get past "freeway in traffic jam." That's the one I hear most talk of plans for.

Generally SAE-L3 designs ideally never truly demand 10 second takeover. That's not safe. It's safe most of the time but times will come that fail that test. Generally, the goal should be planned takeovers at geographic locations. Though some imagine they might do it on seeing a "construction ahead" sign that's a pretty crappy system in my view. In particular, you are partly right when you think what I describe is a SAE-L4 system. That's because to be safe, I think an SAE-L3 system has to be a real self-driving car within its freeway ODD, and pretty much do the entire driving task in that area (though not in all weather.) It should be very hard to tell it apart from the full self driving car that could run unmanned, and the only difference is, it needs a driver to get off the freeway. In fact, it would be a real self driving car if it weren't for the fact you can't just stop on the freeway and you can't pick up or drop off passengers on the freeway, so something has to get you to/from the freeway and actual destinations. There are no destinations or stopping places on the freeway, so a freeway-only car needs a driver to get to and from destinations.

I realize this is not what SAE says. I don't care much what they say. I am talking about what I think is a good and safe design.

All of this makes sense however I’m still trying to understand the flaws of SAE J3016. Is there a viable self-driving product (”eyes off”, I hate that it has to be qualified in this way) that does not meet the SAE L3/4 definition?
Also I’m curious if you think the Mercedes Drive Pilot system will be safe? Or do you just think it’s not useful product?

Oh great, more useless levels discussion

At least this discussion is related to an (almost) real product! If released it will almost certainly be the most used unsupervised self-driving system ever.

 

[stopcrazypp]

Well, first of all, I call it fake level 3 for a reason, because I don't like the design.

Whether you personally like a design is hardly a reason to set a definition around it.

However, your description of it is not accurate. It says:

NOTE 6: Although automated DDT fallback performance is not expected of Level 3 ADS features, a Level 3 feature may be capable of performing the DDT fallback and achieving a minimal risk condition under certain, limited conditions.

So it is still an SAE level 3 system if it is able to perform the fallback.

You missed the bolded part. That's not 100% safe and that part suggests will be situations that the driver must respond, which is why it's not L4. L4 must be able to do that in all conditions, not just limited ones.
Page 11 on SAE J3016 APR2021 actually clarified this difference explicitly:
"NOTE 2: Some Level 3 features may be designed to automatically perform the fallback and achieve a minimal risk condition in some circumstances, such as when an obstacle-free, adjacent shoulder is present, but not in others, such as when no such road shoulder is available. The assignment of Level 3 therefore does not restrict the ADS from automatically achieving the minimal risk condition, but it cannot guarantee automated achievement of minimal risk condition in all cases within its ODD. Moreover, automated minimal risk condition achievement in some, but not all, circumstances that demand it does not constitute Level 4 functionality."

As noted, back in 2013, Google's experiments concluded that not having such a fallback was not a good idea, it was unsafe. And generally most others agree and if they build such a system they put in some fallback. There is debate about what a minimal risk condition is, but people often talk about just stopping in the lane, though nobody is fond of that but it's something you generally can always do.

These experiments and others found you could almost always (but not 100% always) get a response in 10 seconds, so people aim for that. However, I point out that when you know your ODD continues for another hour, you can either alert the user 10 seconds before it ends and expect them to take over, you also can alert them sooner, with enough time for them to wake up and become fully aware. In general it is wise to alert them well before 10 seconds and most designs I have seen do so, but they don't do it 3 minutes in advance as you might for somebody asleep. The trick I point out is that in this situation you are typically looking at a Freeway exit as the end of the ODD you are warning about. If you have a sleeping driver you can alert them some time before the previous exit, and, if they don't respond, most cars should be able to take the exit if the map indicates that is reasonable, where they can then safely pull onto the shoulder. (Neither stopping in a freeway lane or pulling onto shoulder are considered non-emergency moves. Going to the shoulder of an off-ramp is generally an allowed driving move.)

If it can safely pull into a shoulder 100% of the time and ODD ends at the offramp it's a L4 already.

This is not just a special case, because "freeway in decent weather" is in fact the most likely ODD of SAE-L3 systems, once you get past "freeway in traffic jam." That's the one I hear most talk of plans for.

Generally SAE-L3 designs ideally never truly demand 10 second takeover. That's not safe. It's safe most of the time but times will come that fail that test.

It's safe in a traffic jam scenario. That's why the only scenario that is realistic that has been proposed for L3 are traffic jams.

Generally, the goal should be planned takeovers at geographic locations. Though some imagine they might do it on seeing a "construction ahead" sign that's a pretty crappy system in my view. In particular, you are partly right when you think what I describe is a SAE-L4 system. That's because to be safe, I think an SAE-L3 system has to be a real self-driving car within its freeway ODD, and pretty much do the entire driving task in that area (though not in all weather.)

That's exactly the whole point of L4. You never have to worry about it in terms of safety because you are never requested to do anything while it's in its ODD. This is not the case in L3. If you fail to respond within the allotted time, there is a good probability you may be put into a dangerous situation.

It should be very hard to tell it apart from the full self driving car that could run unmanned, and the only difference is, it needs a driver to get off the freeway. In fact, it would be a real self driving car if it weren't for the fact you can't just stop on the freeway and you can't pick up or drop off passengers on the freeway, so something has to get you to/from the freeway and actual destinations. There are no destinations or stopping places on the freeway, so a freeway-only car needs a driver to get to and from destinations.

I realize this is not what SAE says. I don't care much what they say. I am talking about what I think is a good and safe design.

You are talking about a design that is complex enough it would have the technical capability to be L4 (pulling to shoulder safely if necessary in all cases). I'm not seeing a convincing case of an alternative design where the car is too dumb to safely pull into a shoulder (or other similar alternatives like into a parking lot), but yet can handle everything you can throw at it in a highway drive (lane changes, cars/objects partially or fully in lane, construction, emergency vehicles, merging vehicles, etc).

 

[stopcrazypp]

No. The outcome from L3 handling non-response does not have to be a successful drive. For example, L3 can just bring the car safely to stop, but does not need to get that to the destination.

The comment I'm responding to is talking about the scenario of a L3 car that is coming to the end of its ODD and one that can safely stop at all times (including pulling into shoulders) throughout the whole process including into the end. That's an L4 car.

L4 should always bring the car to the destination within the defined ODD.

That's not true either, the L4 car can fail to bring the car to the destination within the ODD if a DDT performance-relevant system failure occurs (examples can be sensor failure, compute module failures, or general car mechanical failure), but it must be able to handle that condition without needing the driver to respond.
Page 29 in J3016 APR2021:
"Performs DDT fallback and transitions automatically to a minimal risk condition when:
○ A DDT performance-relevant system failure occurs
○ A user requests that it achieve a minimal risk condition
○ The vehicle is about to exit its ODD"

For this reason, L3 cars cannot operate without a driver (no human in the car), but L4 can.

That's not the core difference. The difference is that in a L4 car, it can safely handle any condition thrown at it without needing the driver to respond, while an L3 may not.

In fact, SAE gave an example that pretty much describes the feature @bradtem was talking about (a system that can finish the whole highway trip even if it's not in a traffic jam, but yet ends its ODD at the exit ramp) and what would make that a L4 system and not a L3 system:

On page 32:
"NOTE 2: Level 4 ADS features may be designed to operate the vehicle throughout complete trips (see 3.7.3), or they may be designed to operate the vehicle during only part of a given trip (see 3.7.2), For example, in order to complete a given trip, a user of a vehicle equipped with a Level 4 ADS feature designed to operate the vehicle during high-speed freeway conditions will need to perform the DDT when the freeway ends in order to complete his or her intended trip; the ADS, however, will automatically perform the DDT fallback and achieve a minimal risk condition if the user fails to take over when the freeway ends (e.g., because s/he is sleeping). Unlike at Level 3, the Level 4 feature user is not a DDT fallback-ready user while the ADS is engaged (see Example 2 below), and thus is not expected to respond to a request to intervene in order to perform the fallback. Nevertheless, in the case that a Level 4 sub-trip feature reaches its ODD limit, the ADS may issue an alert to the passenger that s/he should resume driving in order to complete their trip. (Note that in this latter case, the alert in question is not a request to intervene, because it does not signal the need for fallback performance.)
...
EXAMPLE 2: A Level 4 ADS feature capable of performing the entire DDT during sustained operation on a motorway or freeway (i.e., within its ODD). (Note: The presence of a user in the driver’s seat who is capable of performing the DDT is envisioned in this example, as driver performance of the DDT would have been necessary before entering, and would again be necessary after leaving, the motorway or freeway. Thus, such a feature would alert the user that s/he should resume vehicle operation shortly before exiting the ODD, but if the user fails to respond to such an alert, the ADS will nevertheless perform the DDT fallback and achieve a minimal risk condition automatically.)"

 

[bradtem]

You are talking about a design that is complex enough it would have the technical capability to be L4 (pulling to shoulder safely if necessary in all cases). I'm not seeing a convincing case of an alternative design where the car is too dumb to safely pull into a shoulder (or other similar alternatives like into a parking lot), but yet can handle everything you can throw at it in a highway drive (lane changes, cars/objects partially or fully in lane, construction, emergency vehicles, merging vehicles, etc).

Yes, it would be SAE4 -- on the highway. That's the point. SAE3 is a dangerous distraction, or modestly useful luxury feature (traffic jams.) This is why it was decided not to do it, and aim only at a full self-driving car. No just by Waymo but by all the leading teams. Only a few carmakers, who think the car OEM way, were attracted by it because it was, it seemed, simpler and within their grasp, and also something one can sell as a luxury feature for a car, which is how they think. Waymo and the others were not interested in making that.
That said, the particular "Highway only self-driving car" is of interest because it's useful and it is easier. Highways are a LOT easier than city streets, though the speeds are more dangerous. But what actually happened with the people thinking about that was they decided to move to trucks. Because long haul trucking is just a highway self-driving vehicle, plus some very limited trips to depots off the highway, then expanding to more off-highway locations.

Highway self-driving car has that one problem. You need to get to and from the highway, particularly from. But the car can't stop on the highway and it can't drive off the highway. That's the time where a handoff to a standby driver becomes necessary. This was one of NHTSA's mistakes. They thought level 3 was in between 2 and 4, when actually it's a special case of 4. Which is one reason that 4 was the first level to be developed, first by Navia back in 2012, later for real by Waymo in 2018. Which was one reason we all thought it was stupid to give them numbers when the order was all wrong. (SAE later agreed but didn't retract the numbers, just added in lines to say don't think of them as ordered, after I started making arguments like the one I later wrote up here: NHTSA/SAE's "levels" of robocars may be contributing to highway deaths )

To this day the public routinely thinks that Autopilot/ADAS is just a lower level of self-driving car, which is why people sometimes (though rarely) die using it.

 

[diplomat33]

Mercedes will start selling their L3 system in Germany in 11 days, starting on May 17, 2022:

Mercedes-Benz today released details of the sales launch of DRIVE PILOT in Germany. The system for conditionally automated driving (SAE Level 3[1]) can be ordered from May 17, 2022 as an optional extra for the S-Class for 5,000 Euro and for the EQS for 7,430 Euro (Driver Assistance Package Plus: 2,430 Euro and DRIVE PILOT: 5,000 Euro) excl. VAT. This makes Mercedes-Benz the first car manufacturer in the world with an international valid certification for conditional automated driving, to offer such a system as an option ex-works for vehicles from series production. DRIVE PILOT enables customers to hand the driving task over to the system under certain conditions in heavy traffic or congestion situations on suitable motorway sections in Germany up to a speed of 60 km/h.

Source: Conditionally automated driving: Mercedes-Benz announces sales launch of DRIVE PILOT | marsMediaSite