ISO 22737:2021

INTERNATIONAL ISO
STANDARD 22737
First edition
2021-07
Intelligent transport systems — Low-
speed automated driving (LSAD)
systems for predefined routes —
Performance requirements, system
requirements and performance test
procedures
Systèmes de transport intelligents — Systèmes de conduite
automatisée à basse vitesse pour des itinéraires prédéfinis (LSAD) —
Exigences de performance, exigences du système et procédures de test
de performance
Reference number
©
ISO 2021
© ISO 2021
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting
on the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address
below or ISO’s member body in the country of the requester.
ISO copyright office
CP 401 • Ch. de Blandonnet 8
CH-1214 Vernier, Geneva
Phone: +41 22 749 01 11
Email: copyright@iso.org
Website: www.iso.org
Published in Switzerland
ii © ISO 2021 – All rights reserved

Contents Page
Foreword .v
Introduction .vi
1 Scope . 1
2 Normative references . 1
3 Terms and definitions . 1
4 Symbols and abbreviated terms . 3
5 Example use case for an LSAD system deployment . 4
6 LSAD system architecture . 5
7 Basic requirements . 6
7.1 General . 6
7.2 Minimum operating capabilities . 7
7.3 Operational design domains (ODDs) . 7
7.4 LSAD state transition diagram . 7
7.4.1 LSAD state functional descriptions . 8
7.4.2 LSAD state transition description: . 9
7.4.3 Possible extension of the LSAD state diagram to accommodate dispatcher
inputs .11
7.5 Communication requirements .11
8 Functional requirements .12
8.1 Determination of hazardous situation .12
8.1.1 General.12
8.1.2 Non-occluded view .12
8.1.3 Occluded view .13
8.2 Minimal risk manoeuvre (MRM) .14
8.3 Driving in the drivable area .15
8.4 Emergency stop (e-stop) .15
9 Performance requirements for the LSAD system .16
9.1 Maximum subject vehicle speed (V ) .16
SV_max
9.2 Obstacle detection requirements .16
9.2.1 Maximum pedestrian speed (V ) .16
ped_max
9.2.2 Maximum pedal cyclist speed (V ) .16
pc_max
9.2.3 LSAD system deceleration .16
10 System requirements .16
10.1 Recording data about a safety-critical event .16
11 Performance test procedures .17
11.1 General .17
11.2 Environmental parameters .17
11.3 Hazardous situation .18
11.3.1 Pedestrian as an obstacle .18
11.3.2 Pedal cyclist as an obstacle .20
11.3.3 Hazardous situation turning around a corner .23
11.3.4 False positive tests.24
11.4 Drivable area test .26
11.4.1 Test setup .26
11.4.2 Vehicle parameters .27
11.4.3 Evaluation path parameters .27
11.4.4 Environmental parameters .27
11.4.5 Pass criteria for unblocked drivable area .27
11.4.6 Pass criteria for blocked drivable area .28
11.5 Minimal risk manoeuvre (MRM) test.28
11.5.1 Test setup .28
11.5.2 Vehicle parameters .29
11.5.3 Evaluation path parameters .29
11.5.4 Environmental parameters .29
11.5.5 MRM trigger .30
11.5.6 Pass criteria .30
Annex A (informative) Test speeds for hazardous situation tests .31
Annex B (informative) Example LSAD communication messages .33
Annex C (informative) Example LSAD system data recorder .34
Annex D (informative) LSAD system activities (experiment tests) in various countries .35
Bibliography .43
iv © ISO 2021 – All rights reserved

Foreword
ISO (the International Organization for Standardization) is a worldwide federation of national standards
bodies (ISO member bodies). The work of preparing International Standards is normally carried out
through ISO technical committees. Each member body interested in a subject for which a technical
committee has been established has the right to be represented on that committee. International
organizations, governmental and non-governmental, in liaison with ISO, also take part in the work.
ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of
electrotechnical standardization.
The procedures used to develop this document and those intended for its further maintenance are
described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the
different types of ISO documents should be noted. This document was drafted in accordance with the
editorial rules of the ISO/IEC Directives, Part 2 (see www .iso .org/ directives).
Attention is drawn to the possibility that some of the elements of this document may be the subject of
patent rights. ISO shall not be held responsible for identifying any or all such patent rights. Details of
any patent rights identified during the development of the document will be in the Introduction and/or
on the ISO list of patent declarations received (see www .iso .org/ patents).
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and
expressions related to conformity assessment, as well as information about ISO's adherence to the
World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT), see www .iso .org/
iso/ foreword .html.
This document was prepared by Technical Committee ISO/TC 204, Intelligent transport systems.
Any feedback or questions on this document should be directed to the user’s national standards body. A
complete listing of these bodies can be found at www .iso .org/ members .html.
Introduction
The move towards automated driving systems is leading to a shift in the way people, goods and
services are transported. One such new mode of transport is low-speed automated driving (LSAD)
systems, which operate on predefined routes. LSAD systems will be used for applications like last-mile
transportation, transport in commercial areas, business or university campus areas and other low-
speed environments.
A vehicle that is driven by the LSAD system (which can include interaction with infrastructure) can
potentially have many benefits, like providing safe, convenient and affordable mobility and reducing
urban congestion. It can also provide increased mobility for people who are not able to drive. However,
with different applications of LSAD systems in the industry worldwide, there is a need to provide
guidance for manufacturers, operators, end users and regulators to ensure their safe deployment.
The LSAD system requirements and procedures specified herein are intended to assist manufacturers
of the LSAD systems in incorporating minimum safety requirements into their designs and to allow
end users, operators and regulators to reference a minimum set of performance requirements in their
procurements.
vi © ISO 2021 – All rights reserved

INTERNATIONAL STANDARD ISO 22737:2021(E)
Intelligent transport systems — Low-speed automated
driving (LSAD) systems for predefined routes —
Performance requirements, system requirements and
performance test procedures
1 Scope
This document specifies:
— requirements for the operational design domain,
— system requirements,
— minimum performance requirements, and
— performance test procedures
for the safe operation of low-speed automated driving (LSAD) systems for operation on predefined
routes. LSAD systems are designed to operate at Level 4 automation (see ISO/SAE PAS 22736), within
specific operational design domains (ODD).
This document applies to automated driving system-dedicated vehicles (ADS-DVs) and can also be
utilized by dual-mode vehicles (see ISO/SAE PAS 22736). This document does not specify sensor
technology present in vehicles driven by LSAD systems.
2 Normative references
The following documents are referred to in the text in such a way that some or all of their content
constitutes requirements of this document. For dated references, only the edition cited applies. For
undated references, the latest edition of the referenced document (including any amendments) applies.
ISO 19206-2, Road vehicles — Test devices for target vehicles, vulnerable road users and other objects, for
assessment of active safety functions — Part 2: Requirements for pedestrian targets
ISO 19206-3, Road vehicles — Test devices for target vehicles, vulnerable road users and other objects, for
assessment of active safety functions — Part 3: Requirements for passenger vehicle 3D targets
ISO 19206-4, Road vehicles — Test devices for target vehicles, vulnerable road users and other objects, for
assessment of active safety functions — Part 4: Requirements for bicyclist targets
ISO 26262 (all parts), Road vehicles — Functional safety
1)
ISO 21448:— , Road vehicles — Safety of the intended functionality
2)
ISO/SAE PAS 22736:— , Taxonomy and definitions for terms related to driving automation systems for
on-road motor vehicles
3 Terms and definitions
For the purposes of this document, the terms and definitions given in ISO/SAE PAS 22736 and the
following apply.
1) Under preparation. Stage at the time of publication: ISO/DIS 21448:2021.
2) Under preparation. Stage at the time of publication: ISO/SAE PRF PAS 22736:2021.
ISO and IEC maintain terminological databases for use in standardization at the following addresses:
— ISO Online browsing platform: available at https:// www .iso .org/ obp
— IEC Electropedia: available at http:// www .electropedia .org/
3.1
hazardous situation
condition whereby the position, orientation and motion of an obstacle (e.g. pedal cyclists, pedestrians,
vehicles, etc.) relative to the position, orientation and motion of the vehicle driven by the LSAD system,
can result in an imminent collision
3.2
predefined route
trajectory defined before start of a trip to be traversed by the vehicle driven by the LSAD system, from
a point of origin to one (or many) destination(s)
Note 1 to entry: A single trip of a vehicle driven by the LSAD system may have many destinations. A predefined
route has a length and curvature but not width.
3.3
minimal risk manoeuvre
MRM
tactical or operational manoeuvre triggered and executed by the LSAD system to achieve minimal risk
condition
3.4
trip segment
travel from point of origin to destination or from one destination to another destination in a trip
Note 1 to entry: A trip may comprise multiple trip segments.
3.5
drivable area
manoeuvrable area around the predefined route (3.2) where the LSAD system is capable of operating
Note 1 to entry: The width of the drivable area may vary along the predefined route.
3.6
pedal cyclist
human-vehicle combination consisting of a human riding on top of a wheel frame with a steering
mechanism, brakes, two pedals for propulsion (optionally with motor assist pedalling) that does not
require a licence for use on public roads
3.7
day-time
condition where the ambient illuminance is greater than 2 000 lx
3.8
night-time
condition where the ambient illuminance is less than 1 lx
3.9
standstill
vehicle state when vehicle speed is at 0 m/s
3.10
low-speed automated driving systems
LSAD
automated driving system that has a maximum speed of 8,89 m/s
2 © ISO 2021 – All rights reserved

3.11
low ambient lighting condition
ambient light between day-time (3.7) and night-time (3.8)
4 Symbols and abbreviated terms
ϴ angle between pedestrian trajectory and vehicle trajectory while in straight section of the
evaluation path
ADS-DV automated driving system-dedicated vehicle
DDT dynamic driving task
e-stop emergency stop
LSAD low-speed automated driving
MaaS mobility as a service
MRC minimal risk condition
ODD operational design domain
R radius of curvature of trajectory in drivable area
RTI request to intervene
S width of drivable area
lat1
S lateral distance between SV and pedestrian starting point
lat2
S lateral distance between SV and target vehicles (TV and TV )
lat3 1 2
S width of reduced drivable area
lat4
S longitudinal distance of drivable area
long
S longitudinal distance of evaluation path from situation C
long2
S longitudinal distance between point 1 and point 4
long3
S longitudinal distance between point 1 and point 4 where MRM is triggered
long4
S longitudinal distance between point 4 and end of evaluation path
long5
SV subject vehicle
T time taken by pedestrian to reach point 2
ped_to_Pt2
T time taken by pedal cyclist to reach point 2
pc_to_Pt2
TV target vehicle (1, 2)
(1, 2)
V2X vehicle to - X
V velocity for the LSAD system
LSAD
V maximum velocity for the LSAD system
LSAD_max
V velocity of pedal cyclist
pc
V maximum velocity of pedal cyclist
pc_max
V velocity of pedestrian
ped
V maximum velocity of pedestrian
ped_max
V maximum velocity of subject vehicle
sv_max
VRU vulnerable road users
DDT dynamic driving task
5 Example use case for an LSAD system deployment
Vehicles driven by LSAD systems may be used as a part of a larger (MaaS) system. Figure 1 depicts an
example system architecture of such a MaaS system. However, the scope of this document is restricted
to the LSAD system installed in a vehicle in Figure 1.
As per the example in Figure 1, the LSAD system receives a trip destination from the dispatcher via
wireless communication, which in turn receives a destination request from the user (through a web
portal or a mobile app. The dispatcher or the control centre processes the destination request and
provides a trip/trip segment confirmation to the user and commands the vehicle driven by the LSAD
system to proceed. The term "dispatcher" in this document refers to the driverless operation dispatcher
(see ISO/SAE PAS 22736).
As there may be more than one predefined route to reach the destination, the selected predefined route
may be:
1) provided by the dispatcher/control centre;
2) selected by the user via a user-interface on a mobile app or on-board the LSAD system equipped
vehicle;
3) selected by the LSAD system itself.
The LSAD system periodically provides its status (e.g. system health, trip status) to the user and the
dispatcher/control server.
4 © ISO 2021 – All rights reserved

Figure 1 — Example system architecture — LSAD in a MaaS system
6 LSAD system architecture
Figure 2 represents the system architecture of an individual LSAD system. Figure 2 also highlights the
components from the LSAD system architecture that are covered within the scope of this document.
Key
functional requirements defined in this document
optional features not defined in this document
functional requirements not defined in this document
Figure 2 — Example system architecture — Individual LSAD system
7 Basic requirements
7.1 General
The LSAD system shall perform the dynamic driving task (see ISO/SAE PAS 22736). The implementation
of the strategic driving tasks (see ISO/SAE PAS 22736) is left to the manufacturer’s discretion. However,
the LSAD system shall operate in predefined routes only. The maximum operational speed of an
LSAD system engaged vehicle shall be equal to or less than 8,89 m/s or 32 km/h. However, this may
be significantly reduced based on special conditions (selected as per the discretion of the driverless

operation dispatcher [ISO/SAE PAS 22736]) mentioned in this document, for example time of day,
visibility, day of week, rainfall, snow, fog, ice on roads etc.).
The LSAD system shall use sensors in order to enable part of the dynamic driving task. This includes
detecting objects, vehicles, pedestrians, buildings, pathways, etc. Appropriate hazard analysis and
risk assessment shall be performed for the sensor performance and failures, and other safety critical
system elements. The LSAD system development shall be developed according to the ISO 26262 series
and ISO 21448.
6 © ISO 2021 – All rights reserved

7.2 Minimum operating capabilities
Subject vehicles driven by the LSAD system shall be capable of performing the following functions:
a) follow a predefined route to the destination (8.3),
b) detect a hazardous situation (8.1),
c) initiate braking and/or steering, to mitigate and/or avoid collision with obstacles (9.1, 9.2),
d) perform minimal risk manoeuvre (8.2),
e) inform the dispatcher about the fault state of the LSAD system (e.g. binary flag) (8.4),
f) provide warnings to road users in case of a hazardous situation.
7.3 Operational design domains (ODDs)
Every LSAD system shall have its ODD defined by the manufacturer. The ODD limitations for an LSAD
system shall specify at least the following attributes:
a) Low speed: the speed of an LSAD system shall be equal to or less than 8,89 m/s or 32 km/h.
b) Areas of application: for example, either restricted access or dedicated roadways (public or
private), or pedestrian/bicycle pathways, or areas from which all or some specific categories of
motor vehicles are restricted. Restricted access roadways can be specified by lane markings or
speed restriction or physical demarcation. (See Annex D for examples).
c) Predefined routes: routes defined within the LSAD system before operation of the LSAD system.
An LSAD system shall only operate on the predefined routes. Predefined routes shall be defined
by relevant stakeholders in conjunction with each other (e.g. local authorities, service providers,
manufacturers, etc.). Any deviation from predefined routes shall be confirmed by the dispatcher to
not result in a hazardous situation.
d) Lighting conditions in the area of application.
e) Weather conditions.
f) Road conditions.
g) Presence or absence of VRUs.
h) Potential presence of static obstacles in the drivable area.
i) Connectivity requirements.
Either the LSAD systems or the dispatcher should select operating values (for a vehicle driven by the
LSAD system) within the boundaries of the predefined values of the ODD attributes for the specified
application based on current ODD conditions (e.g. foggy weather conditions, night-time lighting
conditions).
EXAMPLE A dispatcher or an LSAD system can decide to restrict the maximum allowable speed on a rainy
day to a lower speed as compared to a clear, sunny day.
7.4 LSAD state transition diagram
The LSAD system shall function according to the state transition diagram of Figure 3. Specific
implementation, beyond the description in Figure 3 shall be the responsibility of the manufacturer.
Key
A1 power on and self-test passed
B1 system failure or power-off dispatcher command or power turned off
B2 ODD conditions are met and dispatcher has sent engage ADS command and ADS equipped vehicle has data
recording capability and has engaged it
C1 dispatcher disengage command
C2 passenger or dispatcher initiates emergency stop
C3 detection of hazardous situation which the LSAD system is unable to handle or DDT performance relevant
system failure or loss of safety critical V2X communications or imminent violation of ODD or safe to proceed
confirmation authorization not received from dispatcher
C4 vehicle is in standstill, i.e. 0 m/s
C5 confirmation to proceed to standby state by dispatcher
C6 vehicle is in standstill, i.e. 0 m/s, and confirmation to proceed to standby state by dispatcher
Figure 3 — LSAD state transition diagram
7.4.1 LSAD state functional descriptions
7.4.1.1 LSAD off
The LSAD system shall not perform any aspect of the dynamic driving task in the LSAD off state.
8 © ISO 2021 – All rights reserved

7.4.1.2 LSAD standby
In LSAD standby state, the LSAD system shall:
a) Verify that ODD conditions are satisfied to enable a transition to LSAD active state.
b) Perform communications with dispatcher.
c) Remain in standstill.
LSAD standby state may receive an external operating command from the dispatcher selecting the
operating values (e.g. nominal or degraded) for the LSAD system when in DDT state.
Note that nominal mode suggests the ideal performance of the vehicle driven by the LSAD system.
Degraded mode suggests reduced performance on pre-defined vehicle parameters due to external or
the LSAD system’s internal conditions.
7.4.1.3 LSAD active
In LSAD active state, the LSAD shall perform the DDT. The LSAD system’s maximum operating speed is
determined by the dispatcher or by the system itself.
LSAD active state has four sub-states:
1) LSAD DDT sub-state: This shall be the default sub-state in the LSAD active state. Within the
LSAD DDT sub-state, based on the discretion of the LSAD system service providers, LSAD system
operating parameters may be dynamically varied. An LSAD system has two basic functions in LSAD
DDT sub-state:
— perform DDT, which includes safely following a predefined route while avoiding a collision with
obstacles, and
— detect the imminent violation of the ODD conditions.
2) LSAD perform e-stop sub-state: If the passenger or the dispatcher requests an e-stop, in this state
the LSAD system shall perform emergency deceleration to bring the vehicle driven by the LSAD
system to a standstill and provide state information to the dispatcher and convey the emergency
situation externally (e.g. via hazard lights, auditory alert).
3) LSAD perform MRM sub-state: If any of the triggers for transition C3 are fulfilled, the LSAD
system shall perform the minimal risk manoeuvre (MRM) (subclause 8.2).
4) LSAD MRC sub-state: In LSAD MRC state, LSAD shall:
— be in standstill,
— provide state information to the dispatcher.
In all LSAD active sub-states, the LSAD system shall continuously perform system performance
monitoring.
7.4.2 LSAD state transition description:
7.4.2.1 A1
Transition from LSAD off state to LSAD standby state.
Trigger(s):
a) Power on dispatcher command, and
b) Power on sequence has been completed and the system has no failures (self-test passed).
7.4.2.2 B1
Transition from LSAD standby state to LSAD off state.
Trigger(s):
a) Detection of a DDT performance-relevant system failure, or
b) Power-off dispatcher command or power has been turned off.
7.4.2.3 B2
Transition from LSAD standby state to LSAD active state’s default state (LSAD DDT).
Trigger(s):
a) LSAD system meets its ODD conditions, and
b) Dispatcher has sent command to transition to LSAD active state (dispatcher engage command), and
c) Data recorder (see 10.1) has sufficient capacity to store at least an additional safety critical event.
7.4.2.4 C1
Transition from LSAD active state’s default state (LSAD DDT) to LSAD standby state.
Trigger(s):
a) Dispatcher has commanded to disengage LSAD active state (dispatcher disengage command).
7.4.2.5 C2
Transition from LSAD DDT state (LSAD active state’s default state) to LSAD perform e-stop state.
Trigger(s):
a) Passenger or dispatcher initiates an e-stop command.
7.4.2.6 C3
Transition from LSAD DDT state to LSAD Perform MRM state.
Trigger(s):
a) Detection of a hazardous situation which the LSAD system is unable to resolve, or
b) Detection of DDT performance relevant system failure, or
c) Loss of safety critical V2X communications, or
d) Detection of imminent violation of the ODD conditions by the LSAD system, or
e) Safe to proceed confirmation authorization not received from the dispatcher (see 7.4.3.1).
7.4.2.7 C4
Transition from LSAD perform MRM state to LSAD MRC state.
Trigger(s):
a) LSAD vehicle comes to a standstill (i.e. 0 m/s)
10 © ISO 2021 – All rights reserved

7.4.2.8 C5
Transition from LSAD MRC state to LSAD standby state.
Trigger(s):
a) Dispatcher sends confirmation to proceed to standby state.
7.4.2.9 C6
Transition from LSAD perform e-stop state to LSAD standby state.
Trigger(s):
a) LSAD vehicle speed is 0 m/s (i.e. LSAD vehicle comes to a standstill), and
b) Dispatcher sends confirmation to proceed to standby state.
7.4.3 Possible extension of the LSAD state diagram to accommodate dispatcher inputs
7.4.3.1 Safe to proceed confirmation request
This is a request from LSAD DDT state to dispatcher (external entity) to authorize the vehicle driven
by the LSAD system to proceed temporarily outside its drivable area while the LSAD is in LSAD active
mode.
It is based on:
a) Upcoming out of ODD situation (for driveable area) being detected by the LSAD system, or
b) Blocking of drivable area.
7.4.3.2 Safe to proceed confirmation authorization
This is dispatcher input to the LSAD system while in LSAD active state to confirm that it is safe to
proceed.
It is based on:
a) Whether or not safe to proceed confirmation has been requested by LSAD DDT state.
7.4.3.3 Operating mode command
This is dispatcher input to the LSAD system while in LSAD standby state to select the operating mode
(e.g. nominal or degraded) in LSAD DDT state.
7.5 Communication requirements
Depending on the LSAD system implementation, safety critical event data shall be communicated
between the vehicle driven by the LSAD system and the dispatcher or control centre. The selection
of safety critical data shall be agreed upon by relevant stakeholders (e.g. local authorities, service
providers, manufacturers etc.), as per 7.3. An example set of communication messages is described in
Annex B.
8 Functional requirements
8.1 Determination of hazardous situation
8.1.1 General
In LSAD active state, the LSAD system shall monitor the surrounding environment of the vehicle
driven by the LSAD system and shall determine if a hazardous situation exists. A hazardous situation
can involve a pedal cyclist, pedestrian (child and adult) or a vehicle and/or stationary and dynamic
obstacles. A hazardous situation can be occluded due to other static/dynamic objects. Once the LSAD
system has determined the hazardous situation, the system shall act to avoid collision with the obstacle
and provide warnings to external road users.
8.1.2 Non-occluded view
As a minimum, the LSAD system shall respond to the hazardous situation involving a pedestrian as
shown in Figure 4, where the SV is the vehicle driven by the LSAD system. Typical hazardous situations
involving a pedal cyclist are shown in Figure 5, where the SV is the vehicle driven by the LSAD system.
Figure 4 and Figure 5 show hazardous situations in which the oncoming object (pedestrian or pedal
cyclist) is not occluded.
Key
SV subject vehicle
V velocity of pedestrian
ped
V velocity of LSAD
LSAD
Figure 4 — LSAD pedestrian hazardous situation
12 © ISO 2021 – All rights reserved

Key
SV subject vehicle
V velocity of pedal cyclist
pc
V velocity of LSAD
LSAD
Figure 5 — LSAD pedal cyclist hazardous situation
8.1.3 Occluded view
A typical hazardous situation involving a pedestrian in an occluded situation is shown in Figure 6 a),
where the SV is the vehicle driven by the LSAD system. A typical hazardous situation involving a pedal
cyclist in an occluded situation is shown in Figure 6 b), where the SV is the vehicle driven by the LSAD
system. In addition, in both the figures two examples of possible detection zones for the vehicle driven
by the LSAD system are depicted. The difference between the two detection zones lies in their field of
view which may lead to early or late detection of the hazardous situation.
a) Occluded hazardous situation — pedestrian b) Occluded hazardous situation — pedal
cyclist
Key
1 occluding object
2 pedestrian
3 pedal cyclist
V velocity of LSAD
LSAD
Figure 6 — Occluded hazardous situations — pedestrian and pedal cyclist
8.2 Minimal risk manoeuvre (MRM)
An MRM initiated by the LSAD system shall bring the vehicle to a standstill and may perform steering.
When an MRM is initiated by the LSAD system, it shall also provide notification to the occupant(s) and
other road users.
A minimal risk manoeuvre (MRM) shall be triggered at least due to the following:
a) a detection of a hazardous situation which the LSAD system is unable to resolve, or
b) a DDT performance relevant system failure, or
c) a safety critical V2X communications loss, or
d) imminent violation of the ODD conditions by the LSAD system, or
e) safe to proceed confirmation authorization not received from the dispatcher.
An MRM is initiated by the system, whereas an emergency stop (8.4) is initiated by the passenger or the
dispatcher.
In cases where the LSAD system has performed an MRM stop, the system shall communicate the
information about its MRC to the dispatcher. The dispatcher shall confirm the safety of the LSAD system
to invoke the transition from MRC to LSAD standby state.
NOTE An MRM is different from the degraded mode of the LSAD DDT sub-state by virtue of the fact that at
the end of an MRM the vehicle will be at standstill, whereas in the LSAD DDT sub-state the vehicle continues to
drive.
14 © ISO 2021 – All rights reserved

8.3 Driving in the drivable area
A vehicle driven by the LSAD system shall always remain within the driveable area defined as part of
the predefined route for the system. The drivable area shall always include the route along with the
width of the path (for the route), i.e. for defining the drivable area both S and S (in Figure 7)
long lat1
shall be specified throughout the predefined route by the relevant stakeholder. S may vary along the
lat1
predefined route. For curved routes, radius of curvature, R, shall also be defined. Parameters S and R
lat1
may vary along the length of the route.
Key
V velocity of LSAD system equipped vehicle (m/s) S width of drivable area (m)
LSAD lat1
S longitudinal distance of drivable area (m) R radius of curvature of drivable area (m)
long
Figure 7 — Drivable area
Depending upon the ODD definition by the manufacturer, maximum allowable V may be different
LSAD
for straight roads and curved roads.
8.4 Emergency stop (e-stop)
An e-stop is the emergency stop function that is activated by a vehicle driven by the LSAD system
passengers or dispatcher when they detect an emergency situation such as a fire or if the vehicle is not
driving safely.
A passenger-initiated emergency stop shall be appropriately triggered if the passenger presses the
emergency stop (e-stop) button present in the vehicle driven by the LSAD system. A passenger may
press the e-stop due to occupant illness, undesired behaviour of the LSAD system-equipped vehicle,
LSAD system-equipped vehicle becoming incapacitated, etc. The e-stop interface shall be visible, easy
to understand and accessible to passengers.
A dispatcher-initiated emergency stop shall be triggered if the dispatcher commands the emergency
stop. A dispatcher may command the e-stop due to vehicle driven by the LSAD system becoming
incapacitated, a change in ODD conditions, the detection of a hazardous situation that the LSAD system
has not recognized, etc.
In order for the LSAD system to re-engage to active state, a confirmation from the dispatcher shall be
required to ensure the system integrity of the LSAD system and the equipped vehicle.
9 Performance requirements for the LSAD system
9.1 Maximum subject vehicle speed (V )
SV_max
All vehicles driven by the LSAD system shall have an upper limit of 8,89 m/s (32 km/h) for maximum
velocity (V = V ).
LSAD SV_max
9.2 Obstacle detection requirements
9.2.1 Maximum pedestrian speed (V )
ped_max
The maximum pedestrian speed which the vehicle driven by the LSAD system shall be required to
detect is 2,22 m/s or 8 km/h. Vehicles driven by an LSAD system may be able to detect pedestrians
travelling at higher speeds.
Relevant stakeholders may decide to add additional requirements (e.g. higher target speeds in
accordance with the ODD definition).
9.2.2 Maximum pedal cyclist speed (V )
pc_max
The maximum pedal cyclist speed which the vehicle driven by the LSAD system shall be required
to detect is 6,94 m/s (25 km/h). Vehicles driven by LSAD system can be able to detect pedal cyclists
travelling at higher speeds.
Relevant stakeholders may decide to add additional requirements (e.g. higher target speeds in
accordance with the ODD definition).
9.2.3 LSAD system deceleration
Vehicles driven by the LSAD system shall have a maximum deceleration of 4,9 m/s for MRM.
If an e-stop (passenger- or dispatcher-initiated) or an MRM is triggered, the LSAD system shall apply a
deceleration up to a maximum deceleration of 4,9 m/s , until the vehicle comes to a standstill.
If the vehicle driven by the LSAD system can accommodate standing occupants, it shall have the
capability to detect standing occupants and reduce the deceleration if standing occupants are detected.
10 System requirements
10.1 Recording data about a safety-critical event
LSAD systems shall maintain the capability to record vehicle status and parameters throughout its
operation for enabling post-hoc analysis. The data recorder shall store data when the following events
occur:
— MRM
— e-stop
— collision
16 © ISO 2021 – All rights reserved

— other events as required by the relevant stakeholders (e.g. local authorities, service providers,
manufacturers, etc.)
There may be more than one data recorder. The LSAD system shall provide the ability to recover data
for at least 30 seconds prior to the safety-critical event and at least until the vehicle is at a standstill or
30 seconds after, whichever is earlier.
If the data recorder does not have capacity to store further events, the vehicle driven by the LSAD
system shall remain in LSAD standby state until the data have been preserved according to the
requirements of the relevant stakeholders and memory has been freed. An example set of data to be
recorded is described in Annex C.
11 Performance test procedures
11.1 General
Test procedures defined in this clause are not intended to be used as exhaustive conformance tests.
They are basic validation tests for use by the LSAD system stakeholders (e.g. local authorities, service
providers, manufacturers, etc.). If there are any changes in system functionality after the initial test
procedure validation, the test procedures shall be re-performed depending upon the criticality of the
changes to the system functionality. More extensive tests may be performed, at the discretion of the
manufacturer and in consultation with relevant stakeholders (for example using higher target speeds
in accordance with the ODD definition), to ensure the LSAD system’s conformance to the functional
requirements of this document. A test run shall be invalid if the test parameters and tolerances are not
met.
Manufacturers shall perform the test procedures relevant to the defined ODD of
...