DVN CEO Paul-Henri Matha conducted a test of the Mercedes-Benz S-Class equipped with L3 Drive Pilot on the motorway between Sindelfingen and Mercedes’ Immendingen test site. Recently, the German Federal Motor Transport Authority approved an increase in its top speed to 95 km/h.
History of Drive Pilot
In December 2021, Mercedes-Benz became the world’s first car company to meet the requirements of UN R157 for an L3system enabling conditionally automated driving. Mercedes-Benz initially offered Drive Pilot in Germany, where 13,191 kilometers of motorway had been approved for conditionally automated driving.
Drive Pilot has been available on E- and S-Class cars in Germany since May 2022. Meanwhile, Mercedes-Benz has also received world-first approval in the U.S. states of California and Nevada, and Drive Pilot has been offered as an option on E-and S-Class cars in the US since model year 2024. The L3 functionality is operable in Germany, France, Nevada, and California. Local laws have not yet been adjusted to allow it in other European countries or US states. And only testing is possible in China for the moment.
Functional Description of Drive Pilot
Drive Pilot permits the vehicle to take over the dynamic driving task under certain conditions in heavy traffic or congestion situations on suitable sections of freeway. At first, it was operable up to 60 km/h. This gives customers back precious time when they’re in the car, so they can relax or be productive instead of battling traffic. For instance, they can communicate with work colleagues via in-car office tools, write messages and emails via the head unit, browse the internet, or just sit back, relax, and watch a movie.
L3 conditional automated driving features present the unique challenge of managing the interaction between the automated driving feature and the driver/fallback-ready user, which is foundational to the design of Mercedes-Benz’s system. Three principles that are key to managing this interaction are:
- After engaging Drive Pilot, the fallback-ready user can resume manual driving at any time by steering, braking, accelerating, or manually switching the feature off.
- While the Drive Pilot feature is engaged, it continuously monitors the fallback-ready user’s ability to resume driving when requested (they aren’t allowed to sleep, leave the driver’s seat, etc.).
- After issuing a request for the fallback-ready user to resume driving, Drive Pilot continues safely operating the vehicle until the person resumes driving, or, if they fail to do so, it brings the vehicle automatically to a controlled stop while turning on the hazard warning lamps. The system will not rely on the fallback-ready user to manage an urgent and hazardous situation. Instead, it will continue to operate the vehicle until the fallback-ready user is able to resume driving or the vehicle is brought to a controlled stop.
Availability and Fade In
The Mercedes-Benz Drive Pilot operates only within its operational design domain (ODD), which includes medium to dense traffic on fully access-controlled highways in fair weather. It won’t engage outside these conditions, even if the driver tries to activate it.
When entering a highway, Drive Pilot signals its availability. The driver can enable it, and the system will adjust the vehicle’s parameters to enter conditional automated driving mode. This adjustment period is called ‘fade In’.
L3 Conditional Automated Driving
In conditional automated driving, the person who was driving becomes a fallback-ready user and may use the multimedia system for communication, productivity, or entertainment. Drive Pilot monitors the user’s readiness to resume driving and prohibits behaviours like sleeping that can delay takeover. If detected, warnings are issued, and if ignored, the system will stop the vehicle and put on the hazard lights. If the driver remains unresponsive, Drive Pilot will secure the vehicle, call for emergency aid, and unlock the doors.
Unavailability and Failure Mitigation
When Drive Pilot senses that it will be unable to continue operating the vehicle (whether due to exiting its ODD or a malfunction), it will prompt the fallback-ready user to resume driving and provide time for him or her to do so in an orderly manner. In the event the fallback-ready user is unable or unwilling to resume driving, Drive Pilot will bring the vehicle to a controlled stop and activates the hazard lamps. During this failure mitigation sequence, and even in the event of a malfunction, Drive Pilot will continue to safely operate the vehicle, including making emergency manoeuvres as needed, until the vehicle is brought to a controlled stop.
ODD (operational design domain) of Drive Pilot
The operational design domain (ODD) consists of the geographical area and conditions under which an automated driving system like Drive Pilot is intended to be operational. These conditions include weather, traffic, lighting, and road types.
Currently, Drive Pilot’s ODD is confined to fully access-controlled highways, commonly known as freeways or motorways, up to a specified maximum speed. A fully access-controlled highway is defined as a divided highway with at least two lanes of traffic in each direction and no intersections – only on-ramps and off-ramps.
Drive Pilot’s ODD is also limited based on the presence or absence of certain road features and conditions, such as:
- Machine-detectable Lane markings
- Absence of tunnels, toll booths, and traffic control devices (stop signs, traffic lights, etc.)
- Compliance with legal requirements
These ODD boundaries are defined within a high-definition map, forming a geofence for Drive Pilot’s area of operation. The feature will not function, nor allow driver engagement, outside these boundaries.
Mercedes-Benz implements a robust solution with two independent positioning methods to secure the geofence. There’s a high-precision satellite positioning system which uses live correction data to mitigate satellite and transmission errors affecting conventional navigation systems’ accuracy and integrity. And various objects like signs, poles, and guardrails are stored in the high-definition map. Their expected locations are continuously compared to their real counterparts detected by the vehicle’s sensors, ensuring reliable positioning.
Transient conditions can further restrict the ODD. Examples include inclement weather—heavy rain, snowstorms, heavy fog—and adverse traffic conditions, such as temporary construction sites. Dedicated sensors detect these conditions by monitoring the performance of the vehicle’s sensors to ascertain if environmental factors affect Drive Pilot’s perception of its surroundings.
If ambient conditions prevent Drive Pilot from accurately perceiving its environment or operating safely due to conditions like icy roads, activation of the Drive Pilot feature is denied. If already activated, the system requests the fallback-ready user to resume driving as presented below.
Mercedes-Benz aims to expand Drive Pilot’s ODD continually as technological advancements allow. Alterations to the ODD may be necessary in response to evolving laws or regulatory requirements. The goal is for Drive Pilot to operate in numerous geographical areas, under varied environmental conditions, and at any time.
Drive Pilot’s sensing system
Mercedes-Benz Drive Pilot uses radar, lidar, cameras, road moisture sensors, ultrasonic sensors, and microphones to monitor traffic and road conditions around the vehicle. These overlapping sensors ensure reliable perception.
If a sensor fails, Drive Pilot’s redundant system allows it to function and hand over control to the driver. If the driver doesn’t take over, Drive Pilot will safely stop the vehicle and put on the hazard lights.
Combined input from all sensors creates an accurate representation of the vehicle’s surroundings, leveraging each sensor’s strengths for robust environmental perception.
Stereo Multipurpose Front Camera
This system is implemented in the top windscreen area for these tasks:
- Depth perception of road in the immediate vicinity of the vehicle (occupation grid) in complement of lidar.
- Roadside equipment recognition and localization (traffic signs) in complement with GNSS and lidar to enhance and verify HD map (SLAM)
- Identification of mobile objects (vehicles, vulnerable) in redundancy with other sensors like front radars and lidar.
360° 77-79 GHz Radar belt
A frontal long-range radar is placed behind a cover in the upper grille area. Here are sample specifications of the ARS 54x from Continental:
LR Radar key points:
- Object List for subfunctions like: ACC full speed, AEB,
- Safety rated ASIL B for autonomous driving applications.
- Continuous alignment and misalignment detection capabilities allow to compensate it during operation.
- Real Elevation measurement capabilities proving 3D spatial info on targets.
Four corner radars (Continental SRR 52x) are implemented behind frontal and rear bumpers, to provide object lists for subfunctions like blind spot warning, lane change assist (Type IIIc), front and rear cross traffic alert with braking, rear pre-crash sensing, occupant safe exit, and lateral collision avoidance. They have blockage detection, automatic alignment, and an Ethernet interface. Their safety integrity level is ASIL-B per ISO 26262, and they operate on frequencies approved for use in the European Union, Russia, Canada, the USA, Japan, South Korea, Australia, and China.
Drive Pilot comprises additional sensors Mercedes-Benz considers indispensable for safe L3 driving, including lidar and a camera in the rear window and microphones, especially for detecting flashing lights and sirens from emergency vehicles. There is also a wetness sensor in the wheel well for adhesion detection, for ODD monitoring.
Front lidar
This is the Valeo Scala 2. It is integrated behind a transparent cover in the grille, below the front long-range radar. This lidar has the following specifications:
Rear multipurpose camera
This camera is dedicated to the detection of emergency vehicles (flashing lights) and other vehicles in the rear space of the vehicle. Rear radars ensure redundancy with this camera especially assuming an efficient perception of relative speed of these approaching vehicles.
Precise localization
The top priority for Mercedes-Benz with this system is safety, which includes high demands on operational reliability. The exact location of the car is determined using a highly accurate positioning system. This is much more powerful than conventional GPS. In addition, data obtained from satellite navigation are matched with sensor data and data from an HD map. The type of data collected by lidar, camera, radar and ultrasonic sensors can include information on road geometry, route characteristics, landmarks or traffic signs.
HD map (on- and offboard)
As well as the sensor data, the Drive Pilot control unit receives information on road geometry, route profile, traffic signs and unusual traffic events (e.g. accidents or roadworks) from a digital HD map, which provides a three-dimensional street and environment image. The map data are stored in backend data centres and updated constantly and transmitted to Mercedes cars through their V2X system. Each vehicle also stores an image of this map information on board, constantly comparing it with the backend data and updating the local data set if necessary. The HD map thus offers stable positioning through a representation of the surroundings independent of factors such as shadows or a dirty sensor. This high-precision map differs from maps for navigation devices through its greater accuracy down to centimetres rather than metres and its detailed intersection and track model among other things.
The V2X function ensures the connection with the Mercedes Data Centre through secured communication networks (4G or 5G). A dedicated cellular antennas system is integrated in the rear part of the roof among GNSS receivers.
AD L3/L2 central control unit
The central unit is equipped with Nvidia Drive AGX Orin, which incorporates multiple processing engines delivering high-performance, energy-efficient computation and artificial intelligence capabilities. It is integrated with surround sensors to guarantee highly efficient and redundant fusion. This unit also ensures fallback-ready user’s monitoring through a cockpit camera, ODD supervision through the HD-map and sensor’s status data and consequently minimum risk manoeuvres when the driver is unable to take over the system. All critical algorithms are calculated redundantly.
Cars with Drive Pilot also have redundant steering and braking systems, and a redundant onboard electrical system. This ensures that the car will remain maneuverable even if one of these systems fails, and enables safe handover to the driver.
