Only the original UN/ECE texts have legal effect under international public law. The status and date of entry into force of this Regulation should be checked in the latest version of the UN/ECE status document TRANS/WP.29/343, available at:

http://www.unece.org/trans/main/wp29/wp29wgs/wp29gen/wp29fdocstts.html

Regulation No 131 of the Economic Commission for Europe of the United Nations (UN/ECE) — Uniform provisions concerning the approval of motor vehicles with regard to the Advanced Emergency Braking Systems (AEBS)

Incorporating all valid text up to:

Supplement 1 to 01 series of amendments — Date of entry into force: 13 February 2014

CONTENTS

REGULATION

Introduction (for information)

Scope and purpose

Definitions

Application for approval

Approval

Specifications

Test procedure

Modification of vehicle type and extension of approval

Conformity of production

Penalties for non-conformity of production

10.

Production definitively discontinued

11.

Names and addresses of the Technical Services responsible for conducting approval tests and of Type Approval Authorities

12.

Transitional provisions

ANNEXES

Communication

Arrangements of approval marks

Warning and activation test requirements — Pass/fail values

Special requirements to be applied to the safety aspects of complex electronic vehicle control systems

Introduction (for information)

The intention of this Regulation is to establish uniform provisions for advanced emergency braking systems (AEBS) fitted to motor vehicles of the categories M

, M

, N

and N

(1) primarily used under highway conditions.

While, in general, those vehicle categories will benefit from the fitment of an advanced emergency braking system, there are sub-groups where the benefit is rather uncertain because they are primarily used in other conditions than highway conditions (e.g. buses with standing passengers i.e. Classes I, II and A(1)). Regardless from the benefit, there are other sub-groups where the installation of AEBS would be technically difficult (e.g. position of the sensor on vehicles of category G and special purpose vehicles, etc.).

In addition, systems intended for vehicles not equipped with a pneumatic rear-axle suspension require the integration of advanced sensor technology to take into account the variation of the pitch angle of the vehicle. Contracting Parties wishing to apply this Regulation to these vehicles should provide adequate time for this.

The system shall automatically detect a potential forward collision, provide the driver with a warning and activate the vehicle braking system to decelerate the vehicle with the purpose of avoiding or mitigating the severity of a collision in the event that the driver does not respond to the warning.

The system shall only operate in driving situations where braking will avoid or mitigate the severity of an accident, and shall take no action in normal driving situations.

In the case of a failure in the system, the safe operation of the vehicle shall not be endangered.

The system shall provide as a minimum an acoustic or haptic warning, which may also be a sharp deceleration, so that an inattentive driver is made aware of a critical situation.

During any action taken by the system (the warning and emergency braking phases), the driver can, at any time through a conscious action, e.g. by a steering action or an accelerator kick-down, take control and override the system.

The Regulation cannot include all the traffic conditions and infrastructure features in the type-approval process. Actual conditions and features in the real world should not result in false warnings or false braking to the extent that they encourage the driver to switch the system off.

1. SCOPE AND PURPOSE

This Regulation applies to the approval of vehicles of category M

, N

, M

and N

(1) with regard to an on-board system to avoid or mitigate the severity of a rear-end in lane collision.

2. DEFINITIONS

2.1. ‘Advanced Emergency Braking System (AEBS)’ means a system which can automatically detect a potential forward collision and activate the vehicle braking system to decelerate the vehicle with the purpose of avoiding or mitigating a collision.

2.2. ‘Vehicle type with regard to its Advanced Emergency Braking System’ means a category of vehicles which do not differ in such essential respects as:

(a) The manufacturer's trade name or mark;

(b) Vehicle features which significantly influence the performances of the Advanced Emergency Braking System;

2.3. ‘Subject vehicle’ means the vehicle being tested.

2.4. ‘Target’ means a high volume series production passenger car of category M

AA saloon(1) or in the case of a soft target an object representative of such a vehicle in terms of its detection characteristics applicable to the sensor system of the AEBS under test.

2.5. ‘Moving target’ means a target travelling at a constant speed in the same direction and in the centre of the same lane of travel as the subject vehicle.

2.6. ‘Stationary target’ means a target at standstill facing the same direction and positioned on the centre of the same test lane of travel as the subject vehicle.

2.7. ‘Soft target’ means a target that will suffer minimum damage and cause minimum damage to the subject vehicle in the event of a collision.

2.8. ‘Collision warning phase’ means the phase directly preceding the emergency braking phase, during which the AEBS warns the driver of a potential forward collision.

2.9. ‘Emergency braking phase’ means the phase starting when the AEBS emits a braking demand for at least 4 m/s

deceleration to the service braking system of the vehicle.

2.10. ‘Common space’ means an area on which two or more information functions (e.g. symbol) may be displayed, but not simultaneously.

2.11. ‘Self-check’ means an integrated function that checks for a system failure on a semi-continuous basis at least while the system is active.

2.12. ‘Time to collision (TTC)’ means the value of time obtained by dividing the distance between the subject vehicle and the target by the relative speed of the subject vehicle and the target, at an instant in time.

3. APPLICATION FOR APPROVAL

3.1. The application for approval of a vehicle type with regard to the Advanced Emergency Braking System shall be submitted by the vehicle manufacturer or by his authorised representative.

3.2. It shall be accompanied by the documents mentioned below in triplicate:

3.2.1.

A description of the vehicle type with regard to the items mentioned in paragraph 2.2, together with a documentation package which gives access to the basic design of the AEBS and the means by which it is linked to other vehicle systems or by which it directly controls output variables. The numbers and/or symbols identifying the vehicle type shall be specified.

3.3. A vehicle representative of the vehicle type to be approved shall be submitted to the Technical Service conducting the approval tests.

4. APPROVAL

4.1. If the vehicle type submitted for approval pursuant to this Regulation meets the requirements of paragraph 5 below, approval of that vehicle shall be granted.

4.2. An approval number shall be assigned to each type approved; its first two digits (at present 01 corresponding to the 01 series of amendments) shall indicate the series of amendments incorporating the most recent major technical amendments made to the Regulation at the time of issue of the approval. The same Contracting Party shall not assign the same number to the same vehicle type equipped with another type of AEBS, or to another vehicle type.

4.3. Notice of approval or of refusal or withdrawal of approval pursuant to this Regulation shall be communicated to the Parties to the Agreement which apply this Regulation by means of a form conforming to the model in Annex 1 and documentation supplied by the applicant being in a format not exceeding A4 (210 × 297 mm), or folded to that format, and on an appropriate scale or electronic format.

4.4. There shall be affixed, conspicuously and in a readily accessible place specified on the approval form, to every vehicle conforming to a vehicle type approved under this Regulation, an international approval mark conforming to the model described in Annex 2, consisting of:

4.4.1.

A circle surrounding the letter ‘E’ followed by the distinguishing number of the country which has granted approval(2);

4.4.2.

The number of this Regulation, followed by the letter ‘R’, a dash and the approval number to the right of the circle prescribed in paragraph 4.4.1 above.

4.5. If the vehicle conforms to a vehicle type approved under one or more other Regulations, annexed to the Agreement, in the country which has granted approval under this Regulation, the symbol prescribed in paragraph 4.4.1 above need not be repeated; in such a case, the Regulation and approval numbers and the additional symbols shall be placed in vertical columns to the right of the symbol prescribed in paragraph 4.4.1 above.

4.6. The approval mark shall be clearly legible and be indelible.

4.7. The approval mark shall be placed close to or on the vehicle data plate.

5. SPECIFICATIONS

5.1. General

5.1.1. Any vehicle fitted with an AEBS complying with the definition of paragraph 2.1 above shall meet the performance requirements contained in paragraphs 5.1 to 5.6.2 of this Regulation and shall be equipped with an anti-lock braking function in accordance with the performance requirements of Annex 13 to Regulation No 13.

5.1.2. The effectiveness of the AEBS shall not be adversely affected by magnetic or electrical fields. This shall be demonstrated by compliance with Regulation No 10, 03 Series of amendments to the Regulation.

5.1.3. Conformity with the safety aspects of complex electronic control systems shall be shown by meeting the requirements of Annex 4.

5.2. Performance requirements

5.2.1. The system shall provide the driver with appropriate warning(s) as below:

5.2.1.1.

A collision warning when the AEBS has detected the possibility of a collision with a preceding vehicle of category M, N or O in the same lane which is travelling at a slower speed, has slowed to a halt or is stationary having not being identified as moving. The warning shall be as specified in paragraph 5.5.1 above.

5.2.1.2.

A failure warning when there is a failure in the AEBS that prevents the requirements of this Regulation of being met. The warning shall be as specified in paragraph 5.5.4 below.

5.2.1.2.1.

There shall not be an appreciable time interval between each AEBS self-check, and subsequently there shall not be an appreciable delay in illuminating the warning signal, in the case of an electrically detectable failure.

5.2.1.3.

A deactivation warning, if the vehicle is equipped with a means to manually deactivate the AEBS, shall be given when the system is deactivated. This shall be as specified in paragraph 5.4.2 below.

5.2.2. Subsequent to the warning(s) of paragraph 5.2.1.1 above, and subject to the provisions of paragraphs 5.3.1 to 5.3.3 below, there shall be an emergency braking phase having the purpose of significantly decreasing the speed of the subject vehicle. This shall be tested in accordance with paragraphs 6.4 and 6.5 of this Regulation.

5.2.3. The system shall be active at least within the vehicle speed range of 15 km/h up to the maximum design speed of the vehicle, and at all vehicle load conditions, unless manually deactivated as per paragraph 5.4 below.

5.2.4. The system shall be designed to minimise the generation of collision warning signals and to avoid autonomous braking in situations where the driver would not recognise an impending forward collision. This shall be demonstrated in accordance with paragraph 6.8 of this Regulation.

5.3. Interruption by the driver

5.3.1. The AEBS may provide the means for the driver to interrupt the collision warning phase. However, when a vehicle braking system is used to provide a haptic warning, the system shall provide the driver with a means to interrupt the warning braking.

5.3.2. The AEBS shall provide the means for the driver to interrupt the emergency braking phase.

5.3.3. In both cases above, this interruption may be initiated by any positive action (e.g. kick-down, operating the direction indicator control) that indicates that the driver is aware of the emergency situation. The vehicle manufacturer shall provide a list of these positive actions to the technical service at the time of type approval and it shall be annexed to the test report.

5.4. When a vehicle is equipped with a means to deactivate the AEBS function, the following conditions shall apply as appropriate:

5.4.1.

The AEBS function shall be automatically reinstated at the initiation of each new ignition cycle.

5.4.2.

A constant optical warning signal shall inform the driver that the AEBS function has been deactivated. The yellow warning signal specified in paragraph 5.5.4 below may be used for this purpose.

5.5. Warning indication

5.5.1. The collision warning referred to in paragraph 5.2.1.1 above shall be provided by at least two modes selected from acoustic, haptic or optical.

The timing of the warning signals shall be such that they provide the possibility for the driver to react to the risk of collision and take control of the situation, and shall also avoid nuisance for the driver by too early or too frequent warnings. This shall be tested in accordance with the provisions of paragraphs 6.4.2 and 6.5.2 of this Regulation

5.5.2. A description of the warning indication and the sequence in which the collision warning signals are presented to the driver shall be provided by the vehicle manufacturer at the time of type-approval and recorded in the test report.

5.5.3. Where an optical means is used as part of the collision warning, the optical signal may be the flashing of the failure warning signal specified in paragraph 5.5.4 below.

5.5.4. The failure warning referred to in paragraph 5.2.1.2 above shall be a constant yellow optical warning signal.

5.5.5. Each AEBS optical warning signal shall be activated either when the ignition (start) switch is turned to the ‘on’ (run) position or when the ignition (start) switch is in a position between the ‘on’ (run) and ‘start’ that is designated by the manufacturer as a check position (initial system (power-on)). This requirement does not apply to warning signals shown in a common space.

5.5.6. The optical warning signals shall be visible even by daylight; the satisfactory condition of the signals must be easily verifiable by the driver from the driver's seat.

5.5.7. When the driver is provided with an optical warning signal to indicate that the AEBS is temporarily not available, for example due to inclement weather conditions, the signal shall be constant and yellow in colour. The failure warning signal specified in paragraph 5.5.4 above may be used for this purpose.

5.6. Provisions for the periodic technical inspection

5.6.1. At a periodic technical inspection it shall be possible to confirm the correct operational status of the AEBS by a visible observation of the failure warning signal status, following a ‘power-ON’ and any bulb check.

In the case of the failure warning signal being in a common space, the common space must be observed to be functional prior to the failure warning signal status check.

5.6.2. At the time of type approval, the means to protect against simple unauthorised modification of the operation of the failure warning signal chosen by the manufacturer shall be confidentially outlined.

Alternatively, this protection requirement is fulfilled when a secondary means of checking the correct operational status of the AEBS is available.

6. TEST PROCEDURE

6.1. Test conditions

6.1.1. The test shall be performed on a flat, dry concrete or asphalt surface affording good adhesion.

6.1.2. The ambient temperature shall be between 0 °C and 45 °C.

6.1.3. The horizontal visibility range shall allow the target to be observed throughout the test.

6.1.4. The tests shall be performed when there is no wind liable to affect the results.

6.2. Vehicle conditions

6.2.1. Test weight

The vehicle shall be tested in a condition of load to be agreed between the manufacturer and the Technical Service. No alteration shall be made once the test procedure has begun.

6.3. Test targets

6.3.1. The target used for the tests shall be a regular high volume series production passenger car of category M

AA saloon, or alternatively a ‘soft target’ representative of such a vehicle in terms of its identification characteristics applicable to the sensor system of the AEBS under test(3).

6.3.2. Details that enable the target(s) to be specifically identified and reproduced shall be recorded in the vehicle type approval documentation.

6.4. Warning and activation test with a stationary target

6.4.1. The subject vehicle shall approach the stationary target in a straight line for at least two seconds prior to the functional part of the test with a subject vehicle to target centreline offset of not more than 0,5 m.

The functional part of the test shall start when the subject vehicle is travelling at a speed of 80 ± 2 km/h and is at a distance of at least 120 m from the target.

From the start of the functional part until the point of collision there shall be no adjustment to any control of the subject vehicle by the driver other than slight adjustments to the steering control to counteract any drifting.

6.4.2. The timing for the collision warning modes referred to in paragraph 5.5.1 above shall comply with the following:

6.4.2.1.

At least one warning mode shall be provided no later than specified in Table I, Column B of Annex 3.

In the case of the vehicles referred to in Table I, row 1 of Annex 3, the warning shall be haptic or acoustic.

In the case of the vehicles referred to in Table I, row 2 of Annex 3, the warning shall be haptic, acoustic or optical.

6.4.2.2.

At least two warning modes shall be provided no later than specified in Table I, Column C of Annex 3.

6.4.2.3.

Any speed reduction during the warning phase, shall not exceed either 15 km/h or 30 per cent of the total subject vehicle speed reduction, whichever is higher.

6.4.3. The collision warning phase shall be followed by the emergency braking phase.

6.4.4. The total speed reduction of the subject vehicle at the time of the impact with the stationary target shall be not less than the value specified in Table I, column D of Annex 3.

6.4.5. The emergency braking phase shall not start before a TTC equal to or less than 3,0 seconds.

Compliance shall be verified by either actual measurement during the test or using documentation provided by the vehicle manufacturer, as agreed between the Technical Service and the vehicle manufacturer.

6.5. Warning and activation test with a moving target

6.5.1. The subject vehicle and the moving target shall travel in a straight line, in the same direction, for at least two seconds prior to the functional part of the test, with a subject vehicle to target centreline offset of not more than 0,5 m.

The functional part of the test shall start with the subject vehicle travelling at a speed of 80 ± 2 km/h, the moving target at speed of the value specified in Table I, column H of Annex 3, and a separation distance of at least 120 m between them.

From the start of the functional part of the test until the subject vehicle comes to a speed equal to that of the target there shall be no adjustment to any subject vehicle control by the driver other than slight steering adjustments to counteract any drifting.

6.5.2. The timing for the collision warning modes referred to in paragraph 5.5.1 above shall comply with the following:

6.5.2.1.

At least one haptic or acoustic warning mode shall be provided no later than specified in Table I Column E of Annex 3.

6.5.2.2.

At least two warning modes shall be provided no later than specified in Table I Column F of Annex 3.

6.5.2.3.

Any speed reduction during the warning phase shall not exceed either 15 km/h or 30 per cent of the total subject vehicle speed reduction, whichever is higher.

6.5.3. The emergency braking phase shall result in the subject vehicle not impacting the moving target.

6.5.4. The emergency braking phase shall not start before a TTC equal to or less than 3,0 seconds.

6.6. Failure detection test

6.6.1. Simulate an electrical failure, for example by disconnecting the power source to any AEBS component or disconnecting any electrical connection between AEBS components. When simulating an AEBS failure, neither the electrical connections for the driver warning signal of paragraph 5.5.4 above nor the optional manual AEBS deactivation control of paragraph 5.4 shall be disconnected.

6.6.2. The failure warning signal mentioned in paragraph 5.5.4 above shall be activated and remain activated not later than 10 seconds after the vehicle has been driven at a speed greater than 15 km/h and be reactivated immediately after a subsequent ignition ‘off’ ignition ‘on’ cycle with the vehicle stationary as long as the simulated failure exists.

6.7. Deactivation test

6.7.1. For vehicles equipped with means to deactivate the AEBS, turn the ignition (start) switch to the ‘on’ (run) position and deactivate the AEBS. The warning signal mentioned in paragraph 5.4.2 above shall be activated. Turn the ignition (start) switch to the ‘off’ position. Again, turn the ignition (start) switch to the ‘on’ (run) position and verify that the previously activated warning signal is not reactivated, thereby indicating that the AEBS has been reinstated as specified in paragraph 5.4.1 above. If the ignition system is activated by means of a ‘key’, the above requirement shall be fulfilled without removing the key.

6.8. False reaction test

6.8.1. Two stationary vehicles, of category M

AA saloon, shall be positioned:

(a) So as to face in the same direction of travel as the subject vehicle,

(b) With a distance of 4,5 m between them(4),

6.8.2. The subject vehicle shall travel for a distance of at least 60 m, at a constant speed of 50 ± 2 km/h to pass centrally between the two stationary vehicles.

During the test there shall be no adjustment of any subject vehicle control other than slight steering adjustments to counteract any drifting.

6.8.3. The AEBS shall not provide a collision warning and shall not initiate the emergency braking phase.

7. MODIFICATION OF VEHICLE TYPE AND EXTENSION OF APPROVAL

7.1. Every modification of the vehicle type as defined in paragraph 2.2 above shall be notified to the Type Approval Authority which approved the vehicle type. The Type Approval Authority may then either:

7.1.1. Consider that the modifications made do not have an adverse effect on the conditions of the granting of the approval and grant an extension of approval;

7.1.2. Consider that the modifications made affect the conditions of the granting of the approval and require further tests or additional checks before granting an extension of approval.

7.2. Confirmation or refusal of approval, specifying the alterations, shall be communicated by the procedure specified in paragraph 4.3 above to the Contracting Parties to the Agreement which apply this Regulation.

7.3. The Type Approval Authority shall inform the other Contracting Parties of the extension by means of the communication form which appears in Annex 1 to this Regulation. It shall assign a serial number to each extension, to be known as the extension number.

8. CONFORMITY OF PRODUCTION

8.1. Procedures concerning conformity of production shall conform to the general provisions defined in Appendix 2 to the Agreement (E/ECE/324-E/ECE/TRANS/505/Rev.2) and meet the following requirements:

8.2. A vehicle approved pursuant to this Regulation shall be so manufactured as to conform to the type approved by meeting the requirements of paragraph 5 above;

8.3. The Type Approval Authority which has granted approval may at any time verify the conformity of control methods applicable to each production unit. The normal frequency of such inspections shall be once every two years.

9. PENALTIES FOR NON-CONFORMITY OF PRODUCTION

9.1. The approval granted in respect of a vehicle type pursuant to this Regulation may be withdrawn if the requirements laid down in paragraph 8 above are not complied with.

9.2. If a Contracting Party withdraws an approval it had previously granted, it shall forthwith so notify the other Contracting Parties applying this Regulation by sending them a communication form conforming to the model in Annex 1 to this Regulation.

10. PRODUCTION DEFINITIVELY DISCONTINUED

If the holder of the approval completely ceases to manufacture a type of vehicle approved in accordance with this Regulation, he shall so inform the Type Approval Authority which granted the approval, which in turn shall forthwith inform the other Contracting Parties to the Agreement applying this Regulation by means of a communication form conforming to the model in Annex 1 to this Regulation.

11. NAMES AND ADDRESSES OF THE TECHNICAL SERVICES RESPONSIBLE FOR CONDUCTING APPROVAL TESTS AND OF TYPE APPROVAL AUTHORITIES

The Contracting Parties to the Agreement applying this Regulation shall communicate to the United Nations Secretariat the names and addresses of the Technical Services responsible for conducting approval tests and of the Type Approval Authorities which granted approval and to which forms certifying approval or extension or refusal or withdrawal of approval are to be sent.

12. TRANSITIONAL PROVISIONS

12.1. As from the official date of entry into force of the 01 series of amendments, no Contracting Party applying the 01 series of amendments to this Regulation, shall refuse to grant type approvals in accordance with the 01 series of amendments of this Regulation.

12.2. As from the date of entry into force of the 01 series of amendments to this Regulation, Contracting Parties applying this Regulation may continue granting type approvals and extensions of type approvals to the 00 series of amendments to this Regulation.

In accordance with Article 12 of the 1958 Agreement, the 00 series of amendments may be used as an alternative to the 01 series. Contracting Parties shall notify to the Secretariat-General which alternative they apply. In the absence of notification of Contracting Parties to the United Nations Secretary-General, Contracting Parties will be considered to apply the 01 series.

12.3. As from the date of entry into force of the 01 series of amendments, no Contracting Party applying this Regulation shall refuse national or regional type approval of a vehicle type approved to the 01 series of amendments to this Regulation.

12.4. Until 1 November 2016, no Contracting Party applying this Regulation shall refuse national or regional type approval of a vehicle type approved to the 00 series of amendments to this Regulation.

12.5. As from 1 November 2016, Contracting Parties applying the 01 series of amendments to this Regulation shall not be obliged to accept, for the purpose of national or regional type approval, a vehicle type approved to the 00 series of amendments to this Regulation.

(1) As defined in the Consolidated Resolution on the Construction of Vehicles (R.E.3.), document ECE/TRANS/WP.29/78/Rev.3, para. 2.

(2) The distinguishing numbers of the Contracting Parties to the 1958 Agreement are reproduced in Annex 3 to the Consolidated Resolution on the Construction of Vehicles (R.E.3), document ECE/TRANS/WP.29/78/Rev.3 — www.unece.org/trans/main/wp29/wp29wgs/wp29gen/wp29resolutions.html

(3) The identification characteristics of the soft target shall be agreed upon between the Technical Service and the vehicle manufacturer as being equivalent to a passenger car of category M

AA saloon

(4) The point of reference of each stationary vehicle for establishing the distance between the two stationary vehicles, shall be determined in accordance with ISO 612-1978.

ANNEX 1

[Bild bitte in Originalquelle ansehen]

ANNEX 2

ARRANGEMENTS OF APPROVAL MARKS

(See paragraphs 4.4 to 4.4.2 of this Regulation)

[Bild bitte in Originalquelle ansehen]

a = 8 mm min

The above approval mark affixed to a vehicle shows that the vehicle type concerned has been approved in Belgium (E 6) with regard to the Advanced Emergency Braking Systems (AEBS) pursuant to Regulation No 131. The first two digits of the approval number indicate that the approval was granted in accordance with the requirements of the 01 series of amendments to the Regulation No 131.

ANNEX 3

WARNING AND ACTIVATION TEST REQUIREMENTS — PASS/FAIL VALUES

A	B	C	D	E	F	G	H	Row
	Stationary target			Moving target
	Timing of warning modes		Speed reduction (ref. paragraph 6.4.4)	Timing of warning modes		Speed reduction (ref. paragraph 6.5.3)	Target speed (ref. paragraph 6.5.1)
	At least 1 (ref. paragraph 6.4.2.1)	At least 2 (ref. paragraph 6.4.2.2)	Speed reduction (ref. paragraph 6.4.4)	At least 1 (ref. paragraph 6.5.2.1)	At least 2 (ref. paragraph 6.5.2.2)	Speed reduction (ref. paragraph 6.5.3)	Target speed (ref. paragraph 6.5.1)
M3 (1), N2 > 8 t and N3	Not later than 1,4 s. before the start of emergency braking phase	Not later than 0,8 s. before the start of emergency braking phase	Not less than 20 km/h	Not later than 1,4 s. before the start of emergency braking phase	Not later than 0,8 s. before the start of emergency braking phase	No impact	12 ± 2 km/h	1
N2 ≤ 8 t(2),(4) and M2 (2),(4)	Not later than 0,8 s before the start of the emergency braking phase	Before the start of the emergency braking phase(3)	Not less than 10 km/h	Not later than 0,8 s before the start of the emergency braking phase	Before the start of the emergency braking phase(3)	No impact	67 ± 2 km/h(5)	2

(1) Vehicles of category M

with hydraulic braking system are subject to the requirements of row 2.

(2) Vehicles with pneumatic braking systems are subject to the requirements of row 1.

(3) Values shall be specified by the vehicle manufacturer at the time of Type Approval (Annex 1, paragraph 15).

(4) Manufacturers of vehicles covered by row 2 may elect to gain vehicle Type Approval to the values specified in row 1; in this instance compliance shall be demonstrated with all the values contained in row 1.

(5) The values for the target speed in cell H2 shall be reviewed before 1 November 2021.

ANNEX 4

SPECIAL REQUIREMENTS TO BE APPLIED TO THE SAFETY ASPECTS OF COMPLEX ELECTRONIC VEHICLE CONTROL SYSTEMS

1. GENERAL

This annex defines the special requirements for documentation, fault strategy and verification with respect to the safety aspects of Complex electronic vehicle control systems (definition 2.3 below) as far as this Regulation is concerned.

This annex may also be called, by special paragraphs in this Regulation, for safety related functions which are controlled by electronic system(s).

This annex does not specify the performance criteria for ‘The System’ but covers the methodology applied to the design process and the information which must be disclosed to the Technical Service, for type approval purposes.

This information shall show that ‘The System’ respects, under normal and fault conditions, all the appropriate performance requirements specified elsewhere in this Regulation.

2. DEFINITIONS

For the purposes of this annex:

2.1.

‘Safety concept’ is a description of the measures designed into the system, for example within the electronic units, so as to address system integrity and thereby ensure safe operation even in the event of an electrical failure.

The possibility of a fall-back to partial operation or even to a back-up system for vital vehicle functions may be a part of the safety concept.

2.2.

‘Electronic control system’ means a combination of units, designed to cooperate in the production of the stated vehicle control function by electronic data processing.

Such systems, often controlled by software, are built from discrete functional components such as sensors, electronic control units and actuators and connected by transmission links. They may include mechanical, electro-pneumatic or electro-hydraulic elements.

‘The System’, referred to herein, is the one for which type approval is being sought.

2.3.

‘Complex electronic vehicle control systems’ are those electronic control systems which are subject to a hierarchy of control in which a controlled function may be over-ridden by a higher level electronic control system/function.

A function which is over-ridden becomes part of the complex system.

2.4.

‘Higher-level control’ systems/functions are those which employ additional processing and/or sensing provisions to modify vehicle behaviour by commanding variations in the normal function(s) of the vehicle control system.

This allows complex systems to automatically change their objectives with a priority which depends on the sensed circumstances.

2.5.

‘Units’ are the smallest divisions of system components which will be considered in this annex, since these combinations of components will be treated as single entities for purposes of identification, analysis or replacement.

2.6.

‘Transmission links’ are the means used for inter-connecting distributed units for the purpose of conveying signals, operating data or an energy supply.

This equipment is generally electrical but may, in some part, be mechanical, pneumatic, hydraulic or optical.

2.7.

‘Range of control’ refers to an output variable and defines the range over which the system is likely to exercise control.

2.8.

‘Boundary of functional operation’ defines the boundaries of the external physical limits within which the system is able to maintain control.

3. DOCUMENTATION

3.1. Requirements

The manufacturer shall provide a documentation package which gives access to the basic design of ‘The System’ and the means by which it is linked to other vehicle systems or by which it directly controls output variables.

The function(s) of ‘The System’ and the safety concept, as laid down by the manufacturer, shall be explained.

Documentation shall be brief, yet provide evidence that the design and development has had the benefit of expertise from all the system fields which are involved.

For periodic technical inspections, the documentation shall describe how the current operational status of ‘The System’ can be checked.

3.1.1. Documentation shall be made available in two parts:

(a) The formal documentation package for the approval, containing the material listed in paragraph 3 of this annex (with the exception of that of paragraph 3.4.4 below) which shall be supplied to the Technical Service at the time of submission of the type approval application. This will be taken as the basic reference for the verification process set out in paragraph 4 of this annex.

(b) Additional material and analysis data of paragraph 3.4.4 below, which shall be retained by the manufacturer, but made open for inspection at the time of type approval.

3.2. Description of the functions of ‘The System’

A description shall be provided which gives a simple explanation of all the control functions of ‘The System’ and the methods employed to achieve the objectives, including a statement of the mechanism(s) by which control is exercised.

3.2.1. A list of all input and sensed variables shall be provided and the working range of these defined.

3.2.2. A list of all output variables which are controlled by ‘The System’ shall be provided and an indication given, in each case, of whether the control is direct or via another vehicle system. The range of control (see paragraph 2.7 of this annex) exercised on each such variable shall be defined.

3.2.3. Limits defining the boundaries of functional operation (see paragraph 2.8 of this annex) shall be stated where appropriate to system performance.

3.3. System layout and schematics

3.3.1. Inventory of components

A list shall be provided, collating all the units of ‘The System’ and mentioning the other vehicle systems which are needed to achieve the control function in question.

An outline schematic showing these units in combination shall be provided with both the equipment distribution and the interconnections made clear.

3.3.2. Functions of the units

The function of each unit of ‘The System’ shall be outlined and the signals linking it with other Units or with other vehicle systems shall be shown. This may be provided by a labelled block diagram or other schematic, or by a description aided by such a diagram.

3.3.3. Interconnections

Interconnections within ‘The System’ shall be shown by a circuit diagram for the electric transmission links, by an optical-fiber diagram for optical links, by a piping diagram for pneumatic or hydraulic transmission equipment and by a simplified diagrammatic layout for mechanical linkages.

3.3.4. Signal flow and priorities

There shall be a clear correspondence between these transmission links and the signals carried between units.

Priorities of signals on multiplexed data paths shall be stated, wherever priority may be an issue affecting performance or safety as far as this Regulation is concerned.

3.3.5. Identification of units

Each unit shall be clearly and unambiguously identifiable (e.g. by marking for hardware and marking or software output for software content) to provide corresponding hardware and documentation association.

Where functions are combined within a single Unit or indeed within a single computer, but shown in multiple blocks in the block diagram for clarity and ease of explanation, only a single hardware identification marking shall be used.

The manufacturer shall, by the use of this identification, affirm that the equipment supplied conforms to the corresponding document.

3.3.5.1. The identification defines the hardware and software version and, where the latter changes such as to alter the function of the unit as far as this Regulation is concerned, this identification shall also be changed.

3.4. Safety concept of the manufacturer

3.4.1. The manufacturer shall provide a statement which affirms that the strategy chosen to achieve ‘The System’ objectives will not, under non-fault conditions, prejudice the safe operation of systems which are subject to the prescriptions of this Regulation.

3.4.2. In respect of software employed in ‘The System’, the outline architecture shall be explained and the design methods and tools used shall be identified. The manufacturer shall be prepared, if required, to show some evidence of the means by which they determined the realisation of the system logic, during the design and development process.

3.4.3. The manufacturer shall provide the technical authorities with an explanation of the design provisions built into ‘The System’ so as to generate safe operation under fault conditions. Possible design provisions for failure in ‘The System’ are for example:

(a) Fall-back to operation using a partial system.

(b) Change-over to a separate back-up system.

In case of a failure, the driver shall be warned for example by warning signal or message display. When the system is not deactivated by the driver, e.g. by turning the Ignition (run) switch to ‘off’, or by switching off that particular function if a special switch is provided for that purpose, the warning shall be present as long as the fault condition persists.

3.4.3.1. If the chosen provision selects a partial performance mode of operation under certain fault conditions, then these conditions shall be stated and the resulting limits of effectiveness defined.

3.4.3.2. If the chosen provision selects a second (back-up) means to realise the vehicle control system objective, the principles of the change-over mechanism, the logic and level of redundancy and any built in back-up checking features shall be explained and the resulting limits of back-up effectiveness defined.

3.4.3.3. If the chosen provision selects the removal of the higher level function, all the corresponding output control signals associated with this function shall be inhibited, and in such a manner as to limit the transition disturbance.

3.4.4. The documentation shall be supported, by an analysis which shows, in overall terms, how the system will behave on the occurrence of any one of those specified faults which will have a bearing on vehicle control performance or safety.

This may be based on a Failure Mode and Effect Analysis (FMEA), a Fault Tree Analysis (FTA) or any similar process appropriate to system safety considerations.

The chosen analytical approach(es) shall be established and maintained by the manufacturer and shall be made open for inspection by the technical service at the time of the type approval.

3.4.4.1. This documentation shall itemise the parameters being monitored and shall set out, for each fault condition of the type defined in paragraph 3.4.4 above, the warning signal to be given to the driver and/or to service/technical inspection personnel.

4. VERIFICATION AND TEST

4.1. The functional operation of ‘The System’, as laid out in the documents required in paragraph 3 above, shall be tested as follows:

4.1.1. Verification of the function of ‘The System’

As the means of establishing the normal operational levels, verification of the performance of the vehicle system under non-fault conditions shall be conducted against the manufacturer's basic benchmark specification unless this is subject to a specified performance test as part of the approval procedure of this or another Regulation.

4.1.2. Verification of the safety concept of paragraph 3.4 above

The reaction of ‘The System’ shall, at the discretion of the Type Approval Authority, be checked under the influence of a failure in any individual unit by applying corresponding output signals to electrical units or mechanical elements in order to simulate the effects of internal faults within the unit.

The verification results shall correspond with the documented summary of the failure analysis, to a level of overall effect such that the safety concept and execution are confirmed as being adequate.