GB 44721-2026Intelligent and connected vehicles — Safety requirements for automated driving systems (English PDF)

5.1 DDT performance

5.1.1 General requirements

5.1.1.1 The safety level of ADS shall be at least equivalent to that of a qualified and attentive driver who is currently performing the DDT.

Note: Qualified and attentive refers to the driving level specified by relevant laws and regulations.

5.1.1.2 ADS shall not pose unreasonable safety risks to users and ORUs.

5.1.1.3 ADS shall identify whether the current situation complies with the ODC of the ADS feature.

5.1.1.4 In the active state, ADS shall perform all DDT.

Note: When an occupant sitting in the driver's seat intervenes, the occupant's control of the lateral and/or longitudinal motion of the vehicle may take priority over ADS.

5.1.1.5 ADS shall adopt reasonable control strategies to address performance degradation of the perception system.

5.1.1.6 For a level 3 ADS feature, if its ODD includes roads other than expressways and/or urban expressways, ADS shall at least have the capabilities of lane cruising, lane change and passing through intersections (excluding roundabouts).

Note: A bus rapid transit system operating only in dedicated lanes may not have the capability of lane change.

5.1.1.7 For a level 4 ADS feature, if its ODD includes only expressways and/or urban expressways, ADS shall at least have the capabilities of lane cruising, lane change and partially or completely entering an adjacent lane to bypass an obstacle ahead; if its ODD also includes roads other than expressways and/or urban expressways, ADS shall at least have the capabilities of lane cruising, lane change, passing through intersections (excluding roundabouts), partially or completely entering an adjacent lane to bypass an obstacle ahead, reversing and making a U-turn.

5.1.2 DDT performance in nominal scenarios

5.1.2.1 The driving behavior of ADS shall not cause a collision.

5.1.2.2 ADS shall not collide with safety-related targets.

Note: Safety-related targets refer to targets that, if collided with, may cause non-minor damage to the vehicle, or may pose safety risks to ORUs, users or infrastructure.

5.1.2.3 According to safety risks, ADS shall adjust its driving behavior, which shall at least include.

a) anticipating risks in the driving environment to reduce the possibility of encountering critical scenarios;

b) adjusting the driving speed according to safety risks;

c) controlling the longitudinal and lateral motion of the vehicle to maintain an appropriate distance from ORUs.

5.1.2.4 ADS shall adopt reasonable control strategies to address safety risks existing in areas that cannot be adequately detected.

Note: Areas that cannot be adequately detected include blind areas caused by occlusion by ORUs or obstacles, blind areas caused by road topology or shape, etc.

5.1.2.5 ADS shall detect and respond to targets and events related to its performance of DDT.

5.1.2.6 ADS shall interact safely with ORUs, which shall at least include.

a) exhibiting expected behavior and maintaining stable driving behavior;

b) conducting effective information interaction (e.g., direction-indicator lamps, stop lamps, etc.).

5.1.2.7 For a level 4 ADS feature, if a passenger requests stopping according to the method specified in C.3.1.2, ADS shall bring the vehicle to a safe stop.

5.1.2.8 According to safety risks, ADS shall not unreasonably disrupt traffic flow and cause a decrease in traffic efficiency.

5.1.2.9 The performance of DDT by ADS shall comply with road traffic regulations.

5.1.2.10 ADS shall detect and respond to vehicles having priority right of way (e.g., police cars, fire engines, ambulances and engineering rescue vehicles performing emergency tasks). When obstructing the passage of vehicles having priority right of way, the following requirements shall at least be met.

a) for a level 3 ADS feature, performing yielding control or performing ADS fallback response;

b) for a level 4 ADS feature, performing yielding control.

5.1.2.11 ADS shall detect and respond to on-site instructions of traffic police, and shall at least meet the following requirements.

a) for a level 3 ADS feature, passing according to the on-site instructions of traffic police or performing ADS fallback response;

b) for a level 4 ADS feature, passing according to the on-site instructions of traffic police.

5.1.3 DDT performance in critical scenarios

5.1.3.1 Where reasonably practicable, ADS performing DDT in critical scenarios shall comply with the requirements of 5.1.2 to minimize the overall safety risk.

5.1.3.2 When the ADS feature is in the active state, if a collision is unavoidable, except when the collision causes ADS to lose control of the vehicle motion, ADS shall reduce the injury or damage caused by the accident.

Note: Whether a collision is avoidable is based on the level of a qualified and attentive driver who is currently performing the DDT.

5.1.3.3 When the ADS feature is in the active state and a collision is detected to have occurred, except when the collision causes ADS to lose control of vehicle braking, ADS shall bring the vehicle to a stop.

5.1.4 DDT performance in failure scenarios

5.1.4.1 Where reasonably practicable, ADS performing DDT in failure scenarios shall comply with the requirements of 5.1.2 to minimize the overall safety risk.

5.1.4.2 ADS shall detect faults and functional abnormalities that affect its capability to perform DDT within the ODD.

5.1.4.3 When a fault occurs, ADS shall meet either of the following requirements.

a) if the fault makes ADS unable to safely perform DDT, perform ADS fallback response and prohibit activation of other affected ADS features; if MRM is performed, the requirements of 5.1.6 shall be met.

b) if ADS can still safely perform DDT, adjust its capability to perform DDT according to the severity of the fault.

5.1.5 DDT performance in scenarios that do not comply with the ODC

5.1.5.1 ADS shall be capable of safely responding to situations that do not comply with the ODC. For foreseeable situations that do not comply with the ODC, ADS shall also be capable of anticipating them.

5.1.5.2 When the ADS feature is not in the active state, if there is a situation that does not comply with the ODC, the corresponding ADS feature shall not be activated.

5.1.5.3 When the ADS feature is in the active state, if there is a situation that does not comply with the ODC, ADS shall perform ADS fallback response. If MRM is performed, the requirements of 5.1.6 shall be met.

5.1.5.4 During the performance of ADS fallback response, where reasonably practicable, the following requirements shall be met.

a) in nominal scenarios, the requirements of 5.1.2 shall continue to apply;

b) in critical scenarios, the requirements of 5.1.3 shall continue to apply;

c) in failure scenarios, the requirements of 5.1.4 shall continue to apply.

5.1.6 Minimal risk maneuver

5.1.6.1 For a level 3 ADS feature, if the fallback user has not completed the takeover or a situation described in the safety case that requires direct performance of MRM occurs, ADS shall perform MRM to bring the vehicle to the MRC, and shall meet the following requirements.

a) have the capability to perform lane change;

b) minimize safety risks to users and ORUs;

c) aim to move the vehicle to a safe stop at the side of the road where it does not obstruct traffic; when a severe vehicle failure or severe ADS failure makes it impossible to safely move the vehicle to the side of the road, at least bring the vehicle to a safe stop in the current lane; during the performance of MRM and after bringing the vehicle to the MRC, ADS shall not prohibit intervention and deactivation by the fallback user;

d) reasonably use hazard warning signals during the performance of MRM by ADS and after bringing the vehicle to the MRC;

e) after ADS brings the vehicle to the MRC, ADS can be activated only after the vehicle's power system is restarted (excluding automatic engine start-stop).

5.1.6.2 For a level 4 ADS feature, if a situation described in the safety case that requires performance of MRM occurs, ADS shall perform MRM to bring the vehicle to the MRC, and shall meet the following requirements.

a) have the capability to perform lane change;

b) minimize safety risks to users and ORUs;

c) aim to move the vehicle to a safe area where it does not obstruct traffic and bring the vehicle to a stop, and at least move the vehicle to the side of the road where it does not obstruct traffic and bring the vehicle to a safe stop;

d) when a severe vehicle failure makes it impossible to safely move the vehicle to the side of the road, at least bring the vehicle to a safe stop in the current lane;

e) reasonably use hazard warning signals during the performance of MRM by ADS and after bringing the vehicle to the MRC.

5.2 Human-machine interaction

5.2.1 General requirements

5.2.1.1 ADS shall ensure that ADS features are safely activated and deactivated.

5.2.1.2 After each start-up of the vehicle power system (excluding automatic engine start-stop), ADS shall not be automatically activated.

5.2.1.3 Safety-related indications of ADS shall meet the following requirements.

a) be noticeable by the intended occupants in all ADS operating states;

b) be easy to understand and unambiguous;

c) adopt multiple indication modes where necessary (e.g., visual, audible and tactile).

5.2.1.4 When performing an ADS fallback response, ADS shall continuously provide occupants with an indication that an ADS fallback response is being performed.

5.2.1.5 Where ADS affects door control, ADS shall ensure that the operation of doors by occupants takes priority over ADS.

5.2.1.6 When an ADS feature is in the active state and a collision is detected to have occurred, ADS shall provide an indication to occupants; the indication shall continue at least until ADS deactivation is completed or confirmed by a user.

5.2.1.7 Where an automated parking feature and an ADS feature (other than an automated parking feature) share human-machine interaction means, the relevant human-machine interaction means and their rationality shall be described in the safety case.

Note: Shared human-machine interaction means may include dedicated control means, system status indications, etc.