ISO/TS 23792-1:2023

TECHNICAL ISO/TS
SPECIFICATION 23792-1
First edition
2023-06
Intelligent transport systems —
Motorway chauffeur systems (MCS) —
Part 1:
Framework and general requirements
Systèmes de transport intelligents — Systèmes de conduite
automatisée sur voie à chaussée séparée (MCS) —
Partie 1: Cadre et exigences générales
Reference number
© ISO 2023
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on
the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below
or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: +41 22 749 01 11
Email: copyright@iso.org
Website: www.iso.org
Published in Switzerland
ii
Contents Page
Foreword .v
Introduction . vi
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Abbreviated terms . 4
5 Characteristics of MCS . 4
5.1 General . 4
5.2 Operational design domain . 4
5.2.1 General . 4
5.2.2 Roadway physical characteristics . 5
5.2.3 Traffic in the surrounding environment . 6
5.2.4 Abnormalities in roadway operational condition . . 6
5.2.5 Ambient environmental conditions . 6
5.3 System functionalities . 6
5.3.1 General . 6
5.3.2 Basic functionalities to realize in-lane operation . 7
5.3.3 Lane changing functionalities . 7
5.4 System limitations . 7
5.5 Providing information to the user . 7
6 Operational requirements . 8
6.1 Operating conditions . 8
6.1.1 General . 8
6.1.2 Engagement conditions . 8
6.1.3 Disengagement triggering conditions . 8
6.1.4 Direct disengagement conditions . 8
6.2 State transition . 8
6.2.1 General . 8
6.2.2 Off state . 9
6.2.3 Standby state . 10
6.2.4 Normal state . 11
6.2.5 Requesting fallback state.12
6.3 System functions .12
6.3.1 General .12
6.3.2 Object and event detection and response (OEDR) .13
6.3.3 Vehicle motion control (VMC) . 13
6.3.4 Generation of request to intervene (RTI) . 14
6.3.5 Status indication . 14
6.3.6 User control interface . 16
6.3.7 FRU input detection . 16
6.3.8 MCS monitoring the FRU . 17
6.3.9 Subject vehicle condition monitor . 18
6.3.10 MCS condition monitor . 18
6.3.11 Localization. 18
6.3.12 External warning generation . 18
6.3.13 Function required for route following functionalities . 18
6.3.14 Related functions . 18
6.4 Requirements for continuing operation after detecting disengagement-triggering
conditions . 19
6.4.1 General . 19
6.4.2 Classification of adverse situations . 19
6.4.3 Responses to adverse situations . 20
iii
7 Minimum performance requirements of the DDT .20
7.1 General . 20
7.2 Operating speed range . 21
7.3 Normal operation . 21
7.3.1 Sustained longitudinal vehicle motion control . 21
7.3.2 Sustained lateral vehicle motion control . 21
7.3.3 Crash avoidance . 22
7.4 Performance-impaired operation . 22
7.5 MCS reaction to unresponsive FRU . 22
8 Test procedures .23
8.1 General .23
8.1.1 Purpose .23
8.1.2 Driving environment . 23
8.1.3 System settings and test driver roles . 23
8.1.4 Common test pass criteria . 23
8.1.5 Confirmation of the HMI design . 23
8.1.6 Success rate and number of trials . 24
8.1.7 List of test scenarios . 24
8.1.8 Test sites . 24
8.2 Scenario 1: MCS reaction to unresponsive FRU . 25
8.2.1 Test scenario .25
8.2.2 Pass criteria .25
8.3 Scenario 2: Direct disengagement by steering input . 25
8.3.1 Test scenario .25
8.3.2 Pass criteria . 25
8.4 Scenario 3: Continued operation after brake intervention . 25
8.4.1 Test scenario .25
8.4.2 Pass criteria . 26
8.5 Scenario 4: Forward vehicle braking hard . 26
8.5.1 Test scenario . 26
8.5.2 Pass criteria . 26
8.6 Scenario 5: Aggressive cut-in from the adjacent lane . 26
8.6.1 Test scenario . 26
8.6.2 Pass criteria . 27
8.7 Scenario 6: Obstacle in lane . 27
8.7.1 Test scenario . 27
8.7.2 Pass criteria .28
8.8 Scenario 8: Approaching geographical ODD boundary .28
8.8.1 Test scenario .28
8.8.2 Pass criteria .28
8.9 Scenario 9: Engagement restricted outside ODD .29
8.9.1 Test scenario .29
8.9.2 Pass criteria .29
Bibliography .30
iv
Foreword
ISO (the International Organization for Standardization) is a worldwide federation of national standards
bodies (ISO member bodies). The work of preparing International Standards is normally carried out
through ISO technical committees. Each member body interested in a subject for which a technical
committee has been established has the right to be represented on that committee. International
organizations, governmental and non-governmental, in liaison with ISO, also take part in the work.
ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of
electrotechnical standardization.
The procedures used to develop this document and those intended for its further maintenance are
described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the
different types of ISO documents should be noted. This document was drafted in accordance with the
editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives).
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. ISO shall not be held responsible for identifying any or all such patent rights. Details of
any patent rights identified during the development of the document will be in the Introduction and/or
on the ISO list of patent declarations received (see www.iso.org/patents).
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and
expressions related to conformity assessment, as well as information about ISO's adherence to
the World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT), see
www.iso.org/iso/foreword.html.
This document was prepared by Technical Committee ISO/TC 204, Intelligent transport systems.
Any feedback or questions on this document should be directed to the user’s national standards body. A
complete listing of these bodies can be found at www.iso.org/members.html.
v
Introduction
An automated driving system (ADS) needs to be designed with the capability to cope with various
conditions, such as the driving environment, behaviour of other vehicles in the surroundings, traffic
regulations, etc.
In addition, an ADS designed to operate on motorways can encounter various situations such as
merging into the main lane of traffic, adjusting the speed according to congested or freely flowing
traffic, overtaking other vehicles, or changing lanes when approaching an exit/lane closure.
For Level 3 automated driving, the ADS issues a request to the fallback-ready user (FRU) to take over
driving tasks when it cannot respond to certain conditions/situations.
The ISO 23792 series identifies the performance requirements for an ADS based on its capability to
respond to certain conditions and situations. The requirements are derived in order to reliably transfer
the control between the human driver and ADS, and for safe operation by the ADS.
The ISO 23792 series focuses on the system functionalities, under the assumption that the FRU is
available and responsive to system requests to take over driving tasks.
vi
TECHNICAL SPECIFICATION ISO/TS 23792-1:2023(E)
Intelligent transport systems — Motorway chauffeur
systems (MCS) —
Part 1:
Framework and general requirements
1 Scope
[1]
Motorway chauffeur systems (MCS) perform Level 3 automated driving on limited access motorways
with the presence of a fallback-ready user (FRU). MCS can be implemented in various forms capable
of responding to different driving scenarios. This document describes a framework of MCS including
system characteristics, system states/transition conditions and system functions.
MCS are equipped with a basic set of functionalities to perform in-lane operation and can also be
equipped with additional functionalities such as lane changing.
This document specifies requirements of the basic set of functionalities and test procedures to verify
these requirements. The requirements include vehicle operation to perform the entire dynamic
[1] [1]
driving task (DDT) within the current lane of travel, to issue a request to intervene (RTI) before
disengaging, and to extend operation and temporarily continue to perform the DDT after issuing an
RTI.
This document describes one specific form of system engagement. Other forms are possible. These other
system engagement forms, especially those provided in combination with other driving automation
system features, are not within the scope of this document.
Requirements and test procedures for the additional functionalities are provided in other parts of the
ISO 23792 series.
Means related to setting a destination and selecting a route to reach the destination are not within the
[2]
scope of this document. This document applies to MCS installed in light vehicles.
2 Normative references
The following documents are referred to in the text in such a way that some or all of their content
constitutes requirements of this document. For dated references, only the edition cited applies. For
undated references, the latest edition of the referenced document (including any amendments) applies.
ISO 15622:2018, Intelligent transport systems — Adaptive cruise control systems — Performance
requirements and test procedures
ISO/SAE PAS 22736, Taxonomy and definitions for terms related to driving automation systems for on-
road motor vehicles
3 Terms and definitions
For the purposes of this document, the terms and definitions given in ISO/SAE PAS 22736 and the
following apply.
ISO and IEC maintain terminology databases for use in standardization at the following addresses:
— ISO Online browsing platform: available at https:// www .iso .org/ obp
— IEC Electropedia: available at https:// www .electropedia .org/
3.1
subject vehicle
vehicle equipped with a motorway chauffeur system (MCS) feature
3.2
motorway
road specially designed and built for motorized traffic that does not serve properties bordering on it,
and which;
— is provided, except at special points or temporarily, with separate carriageways for the two
directions of traffic, separated from each other either by a dividing strip not intended for traffic or,
exceptionally, by other means;
— does not cross at level with any road, railway or tramway track, or footpath;
— is specifically sign-posted as a motorway;
— is prohibited for access from non-motorized road users, such as pedestrians and cyclists.
Note 1 to entry: Roads which satisfy the defined conditions above may be referred to using different terms in
different countries.
3.3
route
planned sequence of waypoints to reach a destination
Note 1 to entry: See Figure 1:
Key
1 route A
2 route B
3 route C
a
To destination.
Figure 1 — Route
3.4
path
combination of one or more neighbouring lanes in the same direction of travel along a given route
Note 1 to entry: See Figure 2:
Key
1 path A
2 path B
Figure 2 — Path
3.5
trajectory
sequence of locations that define the intended motion vector of the subject vehicle (SV) used as
references for vehicle motion control
Note 1 to entry: The motion vector includes longitudinal position and/or speed, also lateral position and/or the
vehicle’s orientation information.
Note 2 to entry: see Figure 3:
Key
a
Trajectory.
Figure 3 — Trajectory
3.6
vehicle motion control
activities necessary to adjust vehicle movement continuously in real time, which include “lateral vehicle
motion control” and “longitudinal vehicle motion control”
Note 1 to entry: “Lateral vehicle motion control” and “longitudinal vehicle motion control” are defined in ISO/
SAE PAS 22736.
4 Abbreviated terms
[1]
ADS Automated driving system
[1]
DDT dynamic driving task
[1]
FRU fallback-ready user
FV forward vehicle
HMI human machine interface
MCS motorway chauffeur system
[1]
MRC minimal risk condition
MRM minimal risk manoeuvre
[1]
ODD operational design domain
[1]
OEDR object and event detection and response
TTC time to collision
[1]
RTI request to intervene
SV subject vehicle
VMC vehicle motion control
5 Characteristics of MCS
5.1 General
This document covers a variety of implementations of MCS based on its operational design domain
(ODD) (see 5.2) and functionalities (see 5.3).
The ODD definition of an MCS is considered to be design-specific for its implementation. Therefore,
the requirements in this document apply to the functionalities and performance of the MCS within its
prescribed ODD.
5.2 Operational design domain
5.2.1 General
Each MCS shall have a pre-defined ODD, and the user shall be informed of the general ODD limitations
(i.e. to make clear under which conditions a given MCS is capable of operating or not).
The description of an ODD shall, at minimum, include the following information unless the item does
not represent a restriction for system operation.
— Roadway physical characteristics.
— Traffic in the surrounding environment.
— Abnormalities in roadway operational condition.
— Ambient environmental conditions.
The following subclauses provide examples of possible ways to describe the above-mentioned ODD
attributes. However, such attributes are not limited to those listed below, and more details should also
be added as needed. ISO 34503 provides a sample list of ODD attributes.
Figure 4 illustrates an image of the geographical ODD boundaries for an MCS capable of operating from
the entrance through the exit of a motorway.
Key
1 service area
2 junction
3 tollgate
4 exit
example of geographical ODD of MCS
MCS may also be designed to operate within more restricted boundaries that do not include entrance
and exit ramps or merging and lane changing locations
Figure 4 — Example of geographic boundary (geofence) of an ODD
5.2.2 Roadway physical characteristics
Roadway characteristics should be considered as possible ODD attributes. MCS may be designed to
operate on roads with or without certain characteristics such as those mentioned below.
— Road configuration (e.g. number of lanes in each direction, existence of medians, road shoulders).
— Road structure characteristics (e.g. curvatures, slopes, undulations).
— Quality and visibility of lane markings.
— Surface characteristics of road structures (e.g. irregularity, running resistance friction coefficient,
potholes).
NOTE To explain the above general roadway characteristics as part of the ODD to the user, sections of the
motorway can be mentioned. For example, if the absence of a median strip to divide the carriage way is an out of
ODD condition, the starting point and the end point of the section with no median strips can be considered as the
geographical boundaries of the ODD.
5.2.3 Traffic in the surrounding environment
Existence of traffic in the surrounding environment and its motions (e.g. travelling speed, travelling
direction) may be considered as a possible ODD attribute. Vehicles in the forward direction, as well as
in the adjacent lanes and behind the subject vehicle (SV) may be considered as ODD attributes for an
MCS to operate.
Existence of emergency vehicles (e.g. ambulance) may also be considered as a possible ODD attribute.
If an MCS is not capable of responding appropriately to emergency vehicles, existence of approaching
emergency vehicles should be considered as an out of ODD condition.
5.2.4 Abnormalities in roadway operational condition
Restrictions in roadway operational conditions, such those in the following list, should be considered as
possible ODD attributes.
— Lane blockage.
— Traffic incident (e.g. crash, failed vehicle).
— Existence of road work (e.g. construction, maintenance).
5.2.5 Ambient environmental conditions
Characteristics related to ambient environmental conditions (including weather conditions), such as
those in the following list, should be considered as possible ODD attributes.
— Sunlight (e.g. illuminance, direction).
— Temperature.
— Rain, snow, hail (e.g. precipitation impact on visibility).
— Wind (e.g. speed, direction).
— Fog (e.g. visual distance).
5.3 System functionalities
5.3.1 General
The following subclauses define the functionalities of an MCS. Each MCS shall be equipped with the
basic set of functionalities (5.3.2) and may also be equipped with additional functionalities (6.3.13).
Each functionality may have further detailed classifications associated with individual requirements.
5.3.2 Basic functionalities to realize in-lane operation
The following items are the basic set of functionalities with which all MCS shall be equipped, including
those that only operate in a single lane.
— Perform the entire DDT within the current lane of travel. See Clause 7 for minimum performance
requirements of the DDT.
— Continuously monitor (at minimum, the driving environment, system conditions, vehicle conditions,
and driver/FRU) if the required operating conditions are satisfied. See 6.2 for the requirements
on the changes in system states as the result of monitoring these items. See 6.3.2, 6.3.8, 6.3.9, and
6.3.10 for requirements on the monitoring functions.
— Inform the driver/FRU of the MCS operating state and state changes. See 6.2 for requirements
related to state transitions, and 6.3.5 for status indication requirements.
— Issue an RTI when operating conditions are either detected or predicted to no longer be satisfied.
See 6.3.4 for related requirements.
— While issuing an RTI, extend operation and continue to perform the DDT for a sufficient time for the
FRU to respond. See 6.4 for related requirements.
— If the FRU does not respond adequately to the RTI, bring the SV to a stop. See 7.5 for related
requirements.
5.3.3 Lane changing functionalities
In addition to the basic set of functionalities, an MCS may be equipped with additional functionalities,
for example to perform a lane change during its operation. The ISO 23792 series classifies lane changes
into two categories: a discretionary lane change and a mandatory lane change.
The primary difference between discretionary and mandatory lane changes are the time-criticality to
perform a lane change, whereas a mandatory lane change becomes time-critical for trip continuation.
Examples of situations where a mandatory lane change can be necessary include when the appropriate
lane needs to be selected to pass junctions, or the current lane of travel will end and so merging into
another lane is required. For a mandatory lane change, the lane change manoeuvre shall be completed
before reaching a specific location. Requirements and test procedures to verify these requirements are
specified in ISO 23792-3.
Examples of situations when an MCS may perform a discretionary lane change include overtaking slower
traffic or selecting a lane to prepare for a future diverging/merging scenario. For a discretionary lane
change, MCS may delay the manoeuvre until the conditions for initiating the lane change are satisfied
or cancel the lane change when conditions are not satisfied. Requirements and test procedures to verify
these requirements are specified in Part 2 of this set of documents.
MCS may be equipped with additional functionalities other than lane changes. However, they are not
defined in ISO 23792 series.
5.4 System limitations
Situations with performance impairing effects (see 6.4.2.5) and incapacitating effects (see 6.4.2.6) and
their possible consequences should be documented.
5.5 Providing information to the user
Providers of an MCS shall provide the user with the necessary information regarding its usage prior
to the first actual usage of the MCS, for example by actively explaining the intended usage and roles of
the FRU to the user and including the information in the owner’s manual. When doing so, information
provided in 5.2, 5.3, and 5.4 should be considered as the basis of the information.
6 Operational requirements
6.1 Operating conditions
6.1.1 General
The following sub-clauses describe the basic principles of MCS engagement and disengagement. These
principles serve the purpose of highlighting the specifics for a Level 3 ADS compared to other levels of
automation, especially considering the interaction with the driver/FRU.
6.1.2 Engagement conditions
The MCS shall engage to perform the entire DDT within its prescribed ODD, only when minimum
performance requirements of the DDT during normal operation specified in 7.3 can be satisfied. The
MCS shall have a predefined set of engagement conditions specified in the overall system design. See
6.2.3.2 for details.
6.1.3 Disengagement triggering conditions
The MCS shall continue to operate for a sufficient time for the FRU to respond (see 6.2.5) before
disengaging, unless specific direct disengagement conditions described in 6.1.4 are satisfied. For this
reason, the MCS shall have a predefined set of disengagement triggering conditions specified in the
overall system design (see 6.2.4.3) which occur within the prescribed ODD to notify the FRU of a need
to disengage. The MCS should avoid trip continuation and unnecessary acceleration after detecting a
disengagement-triggering condition.
Refer to 6.4 for detailed requirements related to continuation of MCS operation after encountering
disengagement-triggering conditions.
6.1.4 Direct disengagement conditions
The MCS shall be designed to disengage in such a way that the risk of relinquishing control of the SV
in active traffic, without confirming that the FRU has taken over the control (i.e. becoming a driver to
perform the DDT) is minimized. See 6.3.7 for system reaction to driver FRU input.
6.2 State transition
6.2.1 General
The MCS shall operate based on the system states and transition conditions specified in the following
subclauses.
Figure 5 shows the fundamental system state transition diagram for an MCS. The following subclauses
define the system condition of each state as well as the transition conditions when the system state
changes. Sub-states may be added as needed. In general, all of the system states and transitions
described in Figure 5 shall be indicated to the user (see 6.3.5 for requirements).
Key
1 MCS turned on A disengagement triggering condition detected
2 engagement conditions are satisfied B MCS requested and FRU responded
3 FRU initiated transfer of control from MCS to FRU transfer of control from MCS to FRU
4 MCS turned off C MCS turned off
5 off state D MCS turned off
6 standby state
7 requesting fallback state
8 MRM
9 normal state
10 MCS does not perform the DDT
(i.e. MCS is disengaged, user is expected to be a driver)
11 MCS performs the DDT
(i.e. MCS is engaged, user is expected to be a FRU)
Figure 5 — State transition diagram
6.2.2 Off state
6.2.2.1 State definition
In the off state, the MCS is turned off. Therefore, the VMC function (see 6.3.3) shall be inactive.
Monitoring functions (e.g. localization as described in 6.3.11) may be active in order to detect conditions
that influence transitions.
6.2.2.2 Transition 1 (from off state to standby state)
At least the following conditions shall be satisfied for the MCS to transition from its off state to the
standby state (key element 1 of Figure 5).
— Absence of performance-impairing situations (see 6.4.2.5).
— Powertrain of the SV is activated.
— SV is approaching to or detected to be on a motorway (see 6.3.11).
6.2.3 Standby state
6.2.3.1 State definition
In the standby state, the MCS shall determine if engagement conditions are satisfied by continuously
monitoring, at a minimum, the conditions of the driving environment (see 6.3.2), system (see 6.3.10)
and SV (6.3.8).
6.2.3.2 Transition 2 (from standby state to normal state)
The MCS shall transition from the standby state to the normal state (key element 2 of Figure 5) when
engagement conditions are satisfied. Engagement conditions shall, at minimum, include all of the
following conditions.
— The driving environment satisfies the ODD.
— FRU is present within the designated driver’s seat (see 6.3.8).
— The current speed of travel is within the operating speed range (see 7.2).
— Absence of performance-impairing situations (see 6.4.2.5)
— Explicit driver command for system engagement is provided through the user control interface (see
6.3.6).
The MCS should indicate when all of the engagement conditions other than the driver command are
satisfied. When the MCS detects the driver command in response to this indication, MCS shall either
— immediately transition to its normal state;
— notify the driver of an unsuccessful engagement (see 6.3.5.3) due to unsatisfied engagement
conditions; or
— withhold its engagement for up to 10 s when some engagement conditions are temporarily
unsatisfied.
— If all of the engagement conditions are satisfied during this 10-second period, the MCS shall
immediately transition to its normal state.
— If all of the engagement conditions are not satisfied during this 10-second period, the MCS shall
indicate an unsuccessful engagement (see 6.3.5.3) and the driver command shall therefore
become invalid.
— A distinct visual display shall be provided to indicate that the MCS is withholding its engagement.
6.2.3.3 Transition 4 (from standby state to off state)
The MCS shall transition from its standby state to the off state (key element 4 of Figure 5), when at
minimum, any of the following conditions are detected.
— Powertrain of the SV is deactivated.
— User control interface to turn on/off MCS is turned off (see 6.3.6).
— SV is exiting or detected not to be on the motorway (see 6.3.11).
6.2.4 Normal state
6.2.4.1 State definition
In the normal state, the MCS shall:
— perform the entire DDT (see 6.3.2 and 6.3.3) in accordance with the minimum DDT performance
requirements during normal operation (see 7.3);
— detect the occurrence of disengagement-triggering conditions (see 6.1.3) and direct disengagement
conditions (see 6.1.4) by continuously monitoring, at a minimum, conditions of the driving
environment, FRU, MCS system and SV.
6.2.4.2 Transition 3 (from normal state to standby state)
The MCS shall transition from its normal state to the standby state (key element 3 of Figure 5) when a
user input that satisfies the criteria for direct disengagement (see 6.3.7) is detected.
6.2.4.3 Transition A (from normal state to requesting fallback state)
The MCS shall transition from its normal state to the requesting fallback state (key element A of
Figure 5), when disengagement-triggering conditions are detected. Disengagement-triggering
conditions shall, at minimum, include any of the following conditions.
— Changes in the driving environment are detected such that the prescribed ODD is either no longer
satisfied, or predicted to be no longer satisfied in the near future.
— Minimum performance requirements of the DDT during normal operation (7.2) are either detected
to be no longer satisfied (this includes detecting occurrence of a performance impairing situation as
described in 6.4.2.5), or predicted to be no longer satisfied in the near future.
— Presence of the FRU cannot be confirmed (see 6.3.7.2).
The MCS may also transition from its normal state to the requesting fallback state (key element A of
Figure 5) under further conditions such as the following.
— The MCS detects a situation with either potential future effect, minor effect, or degrading effect (see
6.4.2).
— The MCS detects an FRU input that does not satisfy the criteria for direct disengagement.
— The MCS determines that the FRU is not available for performing the fallback (see 6.3.8).
6.2.4.4 Transition D (from normal state to off state)
MCS shall transition from its normal state to the off state (key element D of Figure 5) when, at minimum,
any of the following direct disengagement conditions are detected.
— Interface to turn on/off the MCS is manually turned off upon the SV reaching a stationary condition.
— Powertrain of the SV is deactivated upon the SV reaching a stationary condition.
— Occurrence of an incapacitating situation (see 6.4.2.6 for details). The MCS should be designed to
minimize the occurrence of such forced disengagement.
6.2.5 Requesting fallback state
6.2.5.1 State definition
In the requesting fallback state, the MCS shall:
— extend its operation and continue to perform the DDT (see 6.4) for a sufficient length of time for the
FRU to perform the fallback, unless transition condition B or C is satisfied;
— be capable of bringing the SV to a complete stop in case the FRU does not respond adequately to the
RTI
...