Author | Wang Qi, Assistant Professor, School of Law, Beihang University
Deputy Director of the Civil Law Research Center, Contracted Author of Peking University Legal Information Network
Source | Sino-German Law Forum, Vol. 16, Vol. 1
Published by Law Press in 2019, pp. 73-98
Thanks to the author for authorizing the push
Unmanned driving does not mean that no one is responsible, and the existing three-yuan liability system for motor vehicles in tort law, namely "motor vehicle party liability", "communication safety obligation liability" and "product liability", is enough to cover autonomous vehicles. However, autonomous driving technology makes the importance of product liability in the above liability system continue to emerge.
Autonomous vehicles as products are a composite of software and hardware. The responsible subjects are not limited to the directly responsible entities stipulated in the legislation, namely the producer and seller, but also include the judicially recognized subjects, that is, quasi-producers and importers.
Producer refers to both the producer of the complete vehicle (finished product) and the producer of components, which includes, in particular, the provider of autonomous driving software systems. The three main types of product defects – "manufacturing defects", "design defects", and "warning defects" – need to be refined and expanded to respond to the particularities of autonomous vehicles. Motor vehicles on the road for testing purposes have met the requirements of "put into circulation", which is sufficient to trigger product liability.
I. Introduction
(1) Background
Autonomous vehicles have become the direction of scientific and technological development that attracts global attention. The world's major industrial countries are hitting hard, hoping to take advantage of this emerging field with great potential. Not only the motor vehicle industry giants such as BMW, Ford, Volvo, Daimler, Volkswagen, Toyota, General Motors, tesla quickly followed, but also emerging Internet companies such as Google and Baidu also used their strengths in software development and data processing to pour in. In addition, many transportation service companies are also stepping up the test of self-driving systems, such as Uber's automatic driving service program that started earlier abroad, and Shenzhen in China has launched a trial operation of an intelligent driving bus system called "Alphaba". The mainland is also aiming at this field, including autonomous driving in the national industrial strategy, hoping to give full play to its own advantages to achieve "curve overtaking".
(2) Unmanned driving does not mean that no one is responsible: based on the analysis of the ternary liability system of motor vehicles in tort law
As self-driving technology gradually approaches, the mass media has become more and more frequent to see the question of who is responsible for traffic accidents caused by autonomous driving or driverless motor vehicles, and some even call it a "disaster of the law". But if we look closely at tort law, we will find that this concern does not hold true in tort law. Motor vehicle is a source of danger or a complex of sources of responsibility, the mainland tort law carefully distinguishes the three hazard sources at different levels on the same motor vehicle, and sets a corresponding liability basis for each layer of danger, thus forming a "ternary liability system for motor vehicles in tort law", as follows:
The above three types of responsibilities may be the same or separate from each other in the subject matter, depending on whether there is a transfer change in the relationship between the use of the motor vehicle. However, no motor vehicle can be separated from the network of responsibilities composed of these three types of responsibilities, that is, even if it is a driverless motor vehicle, there are "motor vehicle parties" responsible for it, communication safety obligors, producers and sellers. Therefore, there is no fundamental loophole or gap in tort law for self-driving motor vehicles. The real challenge of autonomous vehicles to tort law is that with the gradual intervention of intelligent systems in driving tasks until they are completely taken over, the status of human domination and routine safety and security obligations in motor vehicles continues to decline, while the status of defects in motor vehicle products continues to rise. Autonomous driving technology has highlighted the importance of motor vehicle product liability to an unprecedented level, and as a new technology, it has indeed raised a series of difficult problems for product liability so far, and this article will try to explore and answer these problems.
(3) The classification of the degree of automation of motor vehicles and the clarity of the research objects in this paper
Autonomous driving cannot be equated with autonomous driving. Autonomous driving is the superior concept of unmanned driving, which refers to the highest level of autonomous vehicles, that is, motor vehicles that are so automated that they can complete all driving tasks without human drivers. The first step to a correct understanding of autonomous driving is to clarify the classification of autonomous driving, and the most influential in the world is the classification system developed by the American Society of Automotive Engineers (SAE), which is almost a de facto international standard. The system is divided into 6 classes, as follows:
Among them, L0 level refers to traditional motor vehicles, that is, motor vehicles that do not have automatic driving functions, which obviously only has the meaning of a frame of reference. L1 belongs to the driver assistance hierarchy and does not constitute "autonomous driving" in essence. True autonomous driving, i.e. (partial) vehicle operation tasks can be undertaken by intelligent systems independent of the human driver, first appearing at L2 level. At present, the mainstream of motor vehicles in the consumer market is between L0 and L1, L2 is equipped in some luxury or high-end models, the most widely known is Tesla's autopilot system "Autopilot", in addition to many car companies have also introduced similar functions in their high-end products, such as the general "Super Cruise" system, Volvo's "Pilot Assist" system. L3-class motor vehicles have just achieved mass production and entered the consumer market. As for the L4 and L5 levels, they are still very far away from the consumer market. In view of the fact that the vast majority of the so-called self-driving motor vehicles seen on the market can only reach the highest level of L2, the so-called self-driving motor vehicles in this article are self-driving vehicles starting from the L2 level. In terms of product liability, the significance of clarifying the level of autonomous driving is first of all that there are different safety expectations for different levels of autonomous vehicles, so different product defect standards apply, which will be discussed in detail below.
(iv) General rules of product liability and the structure of this article are explained
The general rules on product liability are clear in both judicial practice and doctrine. According to the general theory, product liability belongs to no-fault liability, and the premise of its liability can be divided into two parts, legal interpretation, which are concentrated in article 41, paragraph 1, of the Product Quality Law, and the latter is concentrated in paragraph 2 of the same article.
According to Article 41, Paragraph 1 of the Product Quality Law, the necessary elements for the establishment of product liability include three parts: (1) "Product defect": there is a defect when the product is put into circulation; (2) "Damage result": personal rights and interests, damage to the property of others; (3) "Causality": there is a causal link between product defect and damage result. According to paragraph 2 of the same article, there are three types of elements of obstruction (grounds for exemption), namely, (1) the product has not been put into circulation; (2) the defect causing the damage does not exist when the product is put into circulation; and (3) the scientific and technological level at the time the product is put into circulation cannot find the defect existing. The necessary elements and the elements of obstruction are determined, and the distribution of the burden of proof is also clarified: the injured party bears the burden of proof for the necessary elements for the establishment of responsibility, and the counterparty bears the burden of proof on the elements of obstruction of the establishment of responsibility. A panoramic display is visible in Appendix 3 at the end of the article.
Due to space limitations, it is not possible to discuss all issues of product liability in this article, and autonomous vehicles are not specific to all issues, so the following will select special or difficult issues of autonomous vehicles under the framework of product liability to be studied. The first question is, what kind of product is a self-driving motor vehicle (see Part 2 of this article)? The second question is, who should be responsible for the product for self-driving vehicles (see Part 3 of this article)? The third question is, under what circumstances can a self-driving motor vehicle be found to be a product defect (see Part 4 of this article)? The fourth question is, what is the legal significance of autonomous vehicles entering public road tests from the perspective of product liability (see Part 5 of this article)?
Second, autonomous vehicles as products
According to Article 2, Paragraph 2 of the Product Quality Law, "Products referred to in this Law refer to products that have been processed, manufactured, and used for sale". Obviously, this formal definition covers both traditional motor vehicles and autonomous vehicles, and it is necessary to pay attention to the structural characteristics of autonomous vehicles.
(1) Autonomous vehicles as a complex of software and hardware
Compared with traditional motor vehicles, the structural characteristics of autonomous vehicles are reflected in the combination of software and hardware (so-called "embedded systems" or embedded systems), and their operation is also based on the collaboration of software and hardware. In summary, the hardware device pre-stored intelligent software and basic data; when running, the intelligent system uses GPS and electronic maps to locate and understand the traffic situation in the relevant area, and plan and adjust the route on this basis; during the march, radar, laser rangefinder, and camera continue to explore the surrounding environment and feedback to the intelligent system, and the intelligent system summarizes the obtained data and makes overall judgments and decisions.
From a macroscopic point of view, in the contemporary era of informatization and electronicization, the combination of soft and hard is not an isolated phenomenon, but rather has become the standard form of high-end industrial products (example: computers, smart mobile phones). Specific to automatic driving technology, software (algorithm) plays a key role in all stages of automatic driving perception, integration, reaction, planning, decision-making, etc., which can be said to be the factor that has the greatest impact on the safety of autonomous vehicles. Therefore, the danger of autonomous vehicles stems not only from the defects in their hardware parts, but also from the defects in their software parts. These require that the product concept extension in the sense of product liability is not limited to pure hardware, but should cover such software-hard combination embedded systems, especially the software part therein.
In practice, the product that the software belongs to the product liability has been affirmed by many judicial decisions. An example of a judgment directly related to in-vehicle software is as follows:
Example: "Software as a product": A major accident in a motor vehicle causes the death of the driver, and the identification indicates that the front airbag of the car should have been opened to play a protective role but was not opened. It was then found that the car was a recalled product, and the reason for the recall was a software parameter setting problem with the airbag control unit, which may cause the front airbag to not be opened correctly. The court affirmed that the motor vehicle had a product defect due to software problems and held the motor vehicle manufacturer liable.
Therefore, product defects in motor vehicles are not limited to hardware, but also include software running on them. It should also be noted that in addition to the "driving-related part", the self-driving motor vehicle software also includes the "non-driving related part", such as in-car entertainment software and in-vehicle Internet information software, which are also part of the motor vehicle. In summary, autonomous vehicles as products are a complex of software and hardware, each of which is within the scope of product liability.
(2) Special problems: cloud software and data as product components
With the development of high-speed mobile communication networks (such as 5G technology) as industrial and social infrastructure, the need to install software or store data on local hardware will become less and less necessary. It is entirely conceivable that producers of self-driving vehicles – for example, for the sake of convenience of updates and maintenance – will save some software and data in part or in whole on cloud servers, which will be called by intelligent systems with high-speed networks when needed. The question that this raises is whether the software and data in the cloud form part of a motor vehicle.
The answer is yes, what is decisive is not the physical storage location of the software and data, but whether these objects can be retrieved by the motor vehicle and act on the function and safety of the motor vehicle. Therefore, if with the help of high-speed communication networks, the intelligent system can call cloud objects like local objects, then cloud objects and local objects are part of the whole of the motor vehicle. Further, the development of high-speed communication technology requires us to update our understanding of the state of existence of a product, that is, the entire components of a product do not need to be concentrated in the same physical space, but can be scattered in different locations and connected by communication networks.
Third, the main body of product liability
(1) The subjects directly responsible for the provisions of the legislation: producers and sellers
The subjects directly responsible under the legislation are the producer and the seller, and even if the seller can indicate that the producer or the producer's identity information is public, the seller is liable to the victim in advance (article 43, paragraph 1, of the Product Quality Law). In practice, it is generally permissible for the injured party to sue the producer and the seller as co-defendants, which is usually beneficial to the claims of the injured party and to the clarification of the facts of the case.
(2) Subjects recognized by the judiciary: prospective producers and importers
The judiciary has expanded the subject scope of product liability in two ways. On the one hand, it involves "quasi-producers", that is, although the product is not actually produced, it identifies itself as the subject of the producer through a name, trademark or other distinctive sign. This phenomenon is usually based on the "OEM" (OEM) popular in modern industry, where the trademark owner (OEM) uses his trademark or other logo for a product produced by another person (the actual producer), so it seems that the OEM is the producer of the product (the so-called "quasi-producer"). The Reply of the Supreme People's Court on Whether the Victim of a Product Infringement Case Can File a Civil Lawsuit with the Trademark Owner of the Product as the Defendant (Fashi [2002] No. 22) confirms that prospective producers are liable for the product.
The "OEM" model also exists in the motor vehicle industry. If Company A allows Company B to use the name of the former in the self-driving motor vehicle produced by the latter, once the defect in the motor vehicle gives rise to product liability, then A (as a prospective producer) and B (as the actual producer) shall be jointly liable.
The expansion on the other hand involves importers. In the era of trade globalization, it is very common for importers to import motor vehicles from abroad and sell them domestically. In order to strengthen the protection of its own nationals, the importer should be included in the subject of product liability, so that the national does not need to file a lawsuit in the unfamiliar country, but can claim rights directly from the importer in the country. Judicial rules on importer liability have been basically established in food quality cases, and this rule should be applied by analogy to motor vehicle product liability cases.
(3) The relationship between the producer of parts and components and the producer of finished products
1. General rule: Shared responsibility
Under the division of labor system of modern industry, the motor vehicle industry has formed a distinct "upstream and downstream industrial chain". Vehicle producers inevitably need to use products produced by upstream enterprises, at this time not only the motor vehicle is a product, but also the parts (hardware and software) are also products, which are also within the scope of product liability. If a defect in a part causes damage to occur, and the producer of the part is different from the producer of the vehicle, then the part producer is also liable.
With regard to the allocation of liability between vehicle producers and parts producers, since the law does not have special provisions on joint and several liability, the general rule of most tortious liabilities should be applied, that is, "those who can determine the size of liability shall bear corresponding liabilities; if it is difficult to determine the size of liability, they shall bear the liability for compensation on an average basis" (Article 12 of the Tort Liability Law). Referring to paragraph 2 of article 3 of the Supreme People's Court's Interpretation on Several Issues Concerning the Application of Law in the Trial of Personal Injury Compensation Cases, the size of liability should be determined by the degree of negligence and the proportion of causal force.
In addition, since the parts have been integrated into the finished product, the finished product producer should be held responsible for defects in the part ("The overall responsibility of the finished product producer"). When the producer of parts and components cannot be identified or has no ability to pay, the finished product producer shall bear full responsibility for the injured party. After that, the producer of the finished product has the right to recover from the producer of the parts, and the empirical law is based on the analogy of the second and third sentences of article 43 of the Product Quality Law.
2. Subordination: Autonomous driving software provider as parts producer
The biggest difficulty facing autonomous driving is not hardware production, but the development of software systems and data collection for autonomous driving. It can be said that after more than a hundred years of development of the motor vehicle industry to this day, there are many large and small enterprises that can manufacture motor vehicle hardware, but there are very few companies that can develop autonomous driving software systems (usually emerging Internet companies). Once the software development of the autonomous driving system is mature, based on the replicability of the software and the compatibility of the hardware, it is likely that a software developer will authorize multiple motor vehicle manufacturers to use it. This phenomenon is no stranger to modern consumers, and Microsoft's Windows operating system and Google's Android operating system have adopted this licensing model. The success stories of Microsoft and Google have foreshadowed the favorable prospects of this model: on the one hand, software developers can effectively increase the market share of their own software, on the other hand, traditional car companies, especially small and medium-sized enterprises that lack research and development capabilities, can overcome the technological gap that cannot be overcome independently, quickly launch products to participate in market competition, and both sides can focus on their own areas of expertise and avoid cross-border risks.
Returning to the framework of product liability, this business model will highlight the responsibility of software developers. With the help of the relationship between the finished product producer and the parts producer defined above, this problem can be solved, that is, the motor vehicle company is the finished product producer, and the software developer is the producer of the part (automatic driving software system), and the shared responsibility rule discussed above is also applicable to them. In some cases, it is even possible to consider identifying hardware producers and software developers as "mitherstellers" of self-driving vehicles, such as when both parties collaborate to develop and therefore have roughly the same impact on product quality.
Fourth, the product defects of the automatic driving machine
(1) Basic concept: defects as unreasonable dangers
The concept of defects has a statutory definition in article 46 of the Product Quality Law, that is, "the defects referred to in this Law refer to the unreasonable dangers of products that endanger the safety of persons and the property of others; if the products have national standards and industry standards to protect human health and personal and property safety, it means that they do not meet the standards". To understand this article, it is necessary to distinguish between the two clauses of the article.
In the field of autonomous motor vehicles, the value of the second clause of this article is very limited, because the current national standard "Technical Conditions for the Safety of Motor Vehicle Operation" (GB 7258-2017) in mainland China is designed for traditional motor vehicles, and the standard specifically for autonomous vehicles has not yet been introduced. Secondly, even with the introduction of specific national standards, these public-administrative or technical norms are not decisive, but only have a guiding significance. Rather, the fact that a motor vehicle meets the above criteria simply implies a "presumption of absence", which the victim may adduce to rebut the presumption and the court may make a contrary determination, which is consistent with the general view of doctrine and judgment.
Subsection 1 of that article reveals that the law does not require the exclusion of all dangers, but that such a requirement is nothing more than a utopian fantasy. What the law requires producers to eliminate is only "unreasonable danger", which is usually described in a positive light as "security that the average user (consumer) or a good person can reasonably expect". As for which situations are unreasonable hazards, it is necessary to return to the framework of three types of product defects, namely "manufacturing defects", "design defects" and "warning defects".
(2) Manufacturing defects
Manufacturing defects mean that although the product has no defects in the design, there are problems in the production process, so that the product deviates from the design scheme or does not meet the safety level specified by the designer. Manufacturing defects can occur in a single product, or in the same or several batches of products. In practice, there are many cases of product liability arising from manufacturing defects.
The manufacturing process of a self-driving motor vehicle – as in the making of any one product – cannot be flawless, so manufacturing defects can also occur. Due to the different manufacturing processes of hardware and software, the probability of manufacturing defects in the former is much greater than that of the latter, so manufacturing defects are most likely to occur in the hardware used in autonomous driving intelligent systems, mainly various types of radar (lidar, ultrasonic radar, millimeter wave radar), sensors, cameras, etc. Examples of some manufacturing defects in the software can be imagined, such as errors in the first installation of the software or after the upgrade, such as incomplete installation or the wrong version installed, or infection with computer viruses, malware, etc. during the installation process.
(3) Design defects
1. General
A design defect means that the product has had problems with the design so early that the product produced according to this design is in unreasonable danger. Unlike manufacturing defects, which are generally limited to a single or single batch of products, design defects tend to affect all products manufactured according to this design. If the same product is designed to be used by different producers, the impact of the defect is greater. This is particularly the case with software design flaws, such as Company A licensing its own self-driving software system to multiple motor vehicle manufacturers, and if the software is designed, then all manufacturers' products will be in unreasonable danger.
2. Two-step judgment of design defects
Determining design flaws has always been a difficult point. The design flaws of autonomous vehicles are particularly peculiar, first of all because the classification of autonomous driving functions has led to the classification of safety expectations (defect criteria). Therefore, the judgment of the design defects of the autonomous vehicle should be divided into two steps, the first step is to determine the safety standards that should be applied, the key to this step is to find out the automation level of the motor vehicle ("level determination"),the second step is to determine whether the performance of the motor vehicle does not meet the safety standards applicable to this level ("performance determination"), and the key to this step is to find the correct reference object.
(1) The first step - "level determination": safety standards that vary according to the level of automation
There are different safety expectations for motor vehicles with different degrees of automation. The higher the degree of automation, the less dependent the human driver, the higher the safety expectations, and correspondingly, the stricter the defect criteria for product liability. Therefore, for an autonomous motor vehicle, it is necessary to first clarify the defect criteria that should be applied according to the level of automation to which it belongs.
Example: "Tesla American Death Case": In September 2016, Joshua Brown activated the Autopilot system on the Tesla Model S sedan he was driving, and the motor vehicle was generally in L1 (driver assistance) after opening, and the maximum level was L2 (partial automatic driving). The system requires that the human driver must be ready to take over the operation at all times after starting, and that it is necessary to keep his hand on the steering wheel at all times. For technical reasons, the system failed to identify a trailer in front of it that was in a cross-highway position, and the driver could have fully noticed the car in front of it, but was distracted and did not find it in time. Eventually, the two cars collided, resulting in the death of Joshua Brown. The Tesla motor vehicle in this case is less automated, and for L2-level self-driving vehicles, the need for a human driver to always monitor the driving environment and react in a timely manner does not mean unreasonable risks, so the car is not defective.
By extension, a motor vehicle that claims to have reached L4 or even L5 should be found to have a design flaw if it fails to respond appropriately in this scenario, because L4 and L5 motor vehicles must have the ability to autonomously monitor the driving environment. Conversely, if the L2-level motor vehicle cannot effectively remind the driver to maintain attention to the driving environment after activating the automatic driving function, or cannot immediately return control at the driver's request, then there is a possibility of identifying design defects.
(2) The second step - "performance determination": compare with the appropriate reference object
The principle of the second step of judgment is the "comparative method", which first needs to find an object that is comparable to the motor vehicle involved as a frame of reference. If the cause of the accident involves only the individual functional components of the autonomous vehicle, such as an emergency braking system or a avoidance system, then the frame of reference is a reasonably designed corresponding functional system. If the reference can operate normally under the same circumstances and avoid accidents or reduce accident losses, but the corresponding components of the motor vehicle involved cannot, then design defects can generally be identified.
If the cause of the accident involves the overall environmental observation and decision-making response of autonomous driving (usually found in motor vehicles at L3 and above), then the object of reference is a human driver with an average level of skill, driving experience and concentration (the "average human standard"). If the performance of the human driver in the same scenario can better meet safety expectations, such as completely avoiding accidents or at least reducing losses, then the design flaws of the motor vehicle should generally be determined. In other words, high-level self-driving vehicles must be at least as safe as average human drivers to show that they have no design flaws.
It should be pointed out that the "average human standard" needs to be amended in its application. Because man is a creature after all, his ability is limited by various biological properties, such as vision depends on enough light, the body will be tired or suddenly sick, and it takes a certain amount of time to react. Such biological restrictions naturally do not exist for mechanical systems. Therefore, when applying average human standards to self-driving vehicles, these biological constraints should be removed. That is, even if some biological restriction can reduce the safety expectations of human drivers, it is usually not enough to reduce the safety expectations of self-driving vehicles.
It should also be emphasized that the "average human standard" is only the lower limit of the defective standard for high-level autonomous vehicles. If a motor vehicle producer promises a user higher safety (e.g. through product promotion), then a stricter defect standard should be applied, because the producer's presentation of the product is sufficient to affect the user's expectations of the safety of the product. Linking the product defect standard with the producer's market propaganda behavior will also play a role in guiding the producer's behavior, so the producer must weigh the pros and cons more carefully when carrying out commercial publicity: if he says that the safety of the product is higher, the stricter the defect standard of the product, and the greater the risk of his liability.
3. The "Trolley Problem" of the Autonomous Vehicle Version
The "Trolley Problem" began as a professional issue in the field of ethics, and then gained high social visibility through mass media dissemination, and self-driving technology has brought new controversies to this issue. In the long discussion and dissemination, the "tram problem" has produced many variants, but the basic situation is the same: there are many people on the track in front of one tram who are tied up and cannot get out, and if you want to save these people, the only option is to move the turnout so that the tram turns into another track, and there is only one person bound on that track. How should I choose at this point? Is it possible to sacrifice the lives of a few in order to save the lives of the many?
The autonomous vehicle version of the tram problem first poses a challenge to the motor vehicle producer, that is, what decision-making process should the producer design for the autonomous driving intelligent system for such a scenario as the tram problem? Should the motor vehicle be allowed to maintain its original route of travel, even if many people will be killed? Or should we change course, despite the sacrifice of a few others? Which design can stand up to the test of law, thus indicating that the motor vehicle does not have defects in the sense of product liability? Moral philosophers can think and argue endlessly about the problem of trams, but the legal person does not enjoy this freedom and leisure, and the legal person must provide a plan that is both justified and feasible. The following in this article outlines an arguable solution.
First of all, the perspective should be broadened, and the previous stage of the tram problem, that is, the formation stage, should be included in the observation and judgment. In this regard, the "average human standard" proposed in the previous subsection points out the basic direction of thinking. The question to be asked is whether an average human driver would end up in such a predicament. If the two are compared, human drivers can avoid falling into the dilemma of the tram problem from the beginning, while self-driving vehicles are in trouble based on a series of previous decisions, which constitutes strong evidence of design flaws in motor vehicles.
If it is found that even human drivers cannot avoid falling into the dilemma of the tram problem, then the choice problem described earlier is also in front of us, and simply imagining a human driver as a reference object does not help much, because there is no obvious answer to this dilemma for humans, so we must appeal to basic values to make trade-offs and arguments. There are two arguments for the position supported by this article that producers should equip motor vehicles with decision-making mechanisms that select smaller casualties.
The first argument is the principle of "loss minimization" in tort law and the obligation to avoid the expansion of loss. From the perspective of tort law, the ideal state is naturally to completely avoid the occurrence of losses, but if the occurrence of losses is a fait accompli or unavoidable, tort law is not passive and inactive, but actively puts forward requirements to relevant parties to avoid the expansion of losses. Accordingly, in response to the inevitable occurrence of losses such as the tram problem, the legal obligation of the producer is to make the motor vehicle take all possible measures to reduce the consequences of the loss, which means that as long as there is an option to reduce the loss, the producer should make the motor vehicle implement this option. This result is self-evident in the author's view, so why is it said that the design that ignores the option of reducing losses and allows the loss to expand is more in line with the value objectives of tort law and the security expectations of society?!
Another novel argument was made by the German jurist Gerhard Wagner, who introduced rawls' conception of the veil of ignorance as an argument in his discussion. The veil of ignorance can assist in analysis and decision-making on public issues with major differences of opinion and sharp conflicts of interest. Specifically, put the representatives of all the participants in public transportation behind the "veil of ignorance" and then organize them to discuss what decision-making procedures should be designed for autonomous vehicles on the tram problem. Because of the role of the "curtain of ignorance", everyone knows neither all their personal information nor what role they play in the "tram problem" scenario. Let's speculate on how the representatives behind the "curtain of ignorance" will think about their situation in the tram conundrum and make choices.
First, the delegates could not determine whether they were the threat party, that is, the self-driving motor vehicle party, or the threatened party such as bicycle riders and ordinary pedestrians; second, they had no way of knowing whether they were on the side of the majority or the minority if they were in a threatened position. In this case, the outcome of the delegates' deliberations was obvious: they would choose a plan with fewer casualties. The reason is not difficult to understand, if the representative imagines that he is on the threatening side, then whether out of emotional pity or out of utilitarian calculation of the consequences of the damage, they will choose to cause less harm to the lesser people; if the representative imagines that he is on the threatened side and cannot determine whether he belongs to the majority or the minority, the reasonable choice is still to save the majority, because the more people are saved, the greater the chance that he himself or the people he cares about will survive.
Secondly, the calculation of the size of the loss of personnel is a rather complex issue, for which we only need to recall the legal debate about "whether the same life is the same price", so what standard should be used by the automatic driving system to compare the size of the loss of personnel? Delegates under the "Veil of Ignorance" can also agree on an answer to this. Based on the role of the Curtain of Ignorance, delegates take a position of equality of life when determining the extent of the loss of personnel, because the veil of ignorance obscures all the differences in age, sex, nationality, education, income, occupation, etc., so that even if the delegates want to give special treatment to a certain group, they cannot be sure that they will benefit from this special treatment or suffer disadvantages. According to this position, when comparing the magnitude of losses, only the atomic number of life needs to be considered, which is not only in line with the principle of equality of the status of civil subjects (Article 4 of the General Provisions of the Civil Code), but also reduces the variables to be concerned in the design of the algorithm to a degree of ease of handling.
In summary, if the self-driving motor vehicle inevitably falls into the dilemma of the tram problem, then a flawless design should minimize the loss as the decision-making goal, and the basic criterion for the size of the loss is the number of lives.
4. Two types of software design defects
(1) Critical programming error
Software programs for autonomous driving systems — like other software programs — cannot absolutely avoid programming errors. According to statistics, even for medium-complexity software development, there are about 150 to 300 programming errors in the range of 50,000 to 100,000 lines of program statements, and highly complex software such as autonomous driving systems must have more errors. Therefore, it must first be made clear that not any kind of programming error means that the software system has a design flaw, because given the characteristics of software development, one can reasonably expect that the producer is not perfect, that is, zero error software, but relatively safe software that avoids serious programming errors. The so-called serious programming errors are errors that are enough to cause the automatic driving system to crash or crash, and thus cause traffic accidents.
To avoid serious programming errors, producers need to weigh in on either rolling out the software to the point where there is a great deal of confidence in eliminating serious programming errors, or presetting emergency response procedures for system crashes caused by serious programming errors, a conceivable emergency program based on the "principle of least risk," in which the system should immediately activate protection mode as soon as it detects even the smallest risk, such as parking a car in a safe area.
(2) Hacking
The intelligent networking of motor vehicles also makes hacking possible. For the object of self-driving motor vehicles, which is directly related to personal safety, users can reasonably expect that intelligent systems have the ability to resist manipulation by unauthorized people according to their design. If a software system has a vulnerability that a hacker uses to take control of a self-driving vehicle, it means a software design flaw. In judicial practice to date, the type of case that most closely resembles the above situation involves third-party intrusion into data information systems. Although the court is usually more cautious in such cases, there are already judgments that hold the manager of the data information system liable for the intrusion of the third party, such as the unknown third party using a forged savings card to steal money from the banking system, resulting in losses suffered by the real savers, and the court found that the bank should bear the corresponding responsibility; or for example, the POS machine trading system was modified by hackers, so that the money did not enter the account of the real payee, and the court ruled that the trading system manager was liable to the real payee. Such adjudication results are indicative of product liability.
(4) Warnings explain defects
Producers must provide easy-to-understand instructions about how they are used, and they must also provide adequate warnings about the risks of the product. A product that does not have manufacturing defects or design defects can be unreasonably dangerous due to the lack of proper warning instructions. Judicial judgments have greatly enriched and expanded the connotation of warnings and deficiencies. General rules can be directly applied to autonomous vehicles, for example, not only the correct way to use the product, but also common misuses and their possible consequences and remedies; if a particular part of the product requires specialized maintenance or modification is prohibited, then this must also be explained to the user; in addition, the wording of the warning must be understood by an ordinary consumer, even a person who does not have expertise in motor vehicles. The following two points of special characteristics of autonomous vehicles are selected to explain.
1. Point I. Failure to accurately state the automation level of the motor vehicle as a warning to indicate defects
Different levels of autonomous vehicles have different ways of operating, and the requirements for human drivers are also very different, so producers must accurately indicate the level of automation to which the motor vehicle belongs. Producers must not deliberately exaggerate the level of automation of motor vehicles for the purpose of publicity, which can easily lead to improper use by users. For example, Tesla's two fatal accidents in the United States so far, and after-the-fact investigations have found that the driver did not put his hand on the steering wheel according to the system requirements at the time of the accident. The most likely reason is that users rely too much on the automation function of the system and therefore do not pay the necessary attention to driving, and the root cause is that the producer's "over-publicity" causes the user to relax his vigilance. Comparable cases in judicial practice involve situations where electric bicycles (non-motor vehicles) exceed the standard to motor vehicles and the producer does not give a corresponding warning explanation.
Example: "Electric bicycle exceeds the standard": The producer describes the electric bicycle with the maximum speed and weight to the motor vehicle standard as "non-motorized" in the product description. Due to the significant differences in the potential hazards and driving methods of non-motorized vehicles and motor vehicles, the court found that the product was defective in the warning instructions, inducing the user to operate incorrectly, and the producer was therefore liable for the product for the accident damage. Since the producer labels "motor vehicle" as "non-motor vehicle" constitutes a warning description defect, similar to this, marking a motor vehicle with a lower automation level as a higher level motor vehicle also constitutes a warning description defect, and its common feature is that the warning instructions of the product do not accurately describe (or even obscure) the correct operation mode and the true degree of danger of the product.
Furthermore, for different levels of motor vehicles, producers cannot simply state their general risks in general terms, but must point out the special risks of that level of motor vehicles in a targeted manner. For example, for L2 and L3 motor vehicles, the manufacturer should make the user fully aware of the limitations of the automatic driving function through warning instructions, that is, the user needs to monitor the driving environment from beginning to end, or be ready to intervene at any time according to the requirements of the system. For L4-level motor vehicles, although such motor vehicles have a high degree of automation function, but limited to specific road environments (such as highways); for this purpose, the producer must emphasize to the user the site limitation of the automatic driving function, and should add a corresponding reminder program to the system, each time before the motor vehicle is about to leave such a road, the system should promptly remind the user to take over the operation.
2. Point II: Warnings against unreasonable dangers are insufficient to avoid liability
It should be emphasized that the warning statement does not exclude the obligation to safely manufacture and properly design the product. In other words, only within the reasonable danger range, the obligation to warn and explain can have an exemption effect. Within the limits of unreasonable danger (i.e. when there is a manufacturing defect or design defect), there is no exemption even if the producer makes a warning statement. This also means that producers cannot pass on the driving tasks that a motor vehicle should undertake according to its level of automation to the user through warning instructions, or shirk the safety guarantees that the motor vehicle should provide by making warning instructions.
Fifth, two special problems of self-driving motor vehicle on-road testing
(1) Brief description
The research and development of autonomous driving technology generally requires that after a certain mile of closed road testing, the open space, that is, the real road test, is carried out, so that producers can accumulate data and improve algorithms. Since the end of 2017, many places in the mainland (Shanghai, Chongqing, Shenzhen, Fujian, etc.) have issued normative documents on the test of autonomous vehicles, taking Beijing as the first. Beijing also took the lead in issuing a temporary number plate for autonomous driving testing to Baidu on March 22, 2018, and identified the first batch of 33 treaty 105 kilometers of open test roads in beijing's economic and technological development zone, Shunyi district and Haidian district, and then Shanghai and Fujian also issued test licenses. On April 11, 2018, the Ministry of Industry and Information Technology, the Ministry of Public Security and the Ministry of Transport announced the "Management Specification for Road Testing of Intelligent And Connected Vehicles (Trial)" (hereinafter referred to as the "Road Test Specification" of the three ministries and commissions), and since then, the road test of autonomous vehicles in the mainland has risen from the local level to the central level and is expected to be rolled out nationwide. In view of the difficulty of developing autonomous driving technology, it is foreseeable that for a long time in the future, autonomous driving technology will be in or stay in the stage of on-the-road testing. During this period, self-driving motor vehicles are first used as test vehicles rather than marketed sales commodities to gain real influence and enter the regulatory vision of the law, so the motor vehicle on-road test is worth a special exploration.
Testing of autonomous vehicles into public transport spaces will raise two important questions about product liability. The first question is whether the self-driving motor vehicle tested on the upper road, although it has not yet started to be sold, is it also a product that has been put into circulation (and thus has product liability applied)? When the first question is affirmed (this is the position adopted in this article), the second question follows, that is, if the test vehicle has different sources in the hardware and software parts, who is the producer of the car (and thus the primary responsible subject for product liability)?
(2) Input and circulation problem: The upper road test motor vehicle is used as a product for circulation
1. Based on the general criterion of "input and circulation" - the argument of "factory door theory"
The most critical time point of product liability is "put into circulation", which is first reflected in the fact that the three types of blocking elements (exemptions) for the establishment of product liability are all on the time point of "putting into circulation", especially in retrospective of article 41, paragraph 2, item 1 of the Product Quality Law, it can be known that only products put into circulation can trigger product liability. The question is, under what circumstances does "put-in circulation" be constituted?
If it is believed that self-driving motor vehicles are not put into circulation until they are officially approved for marketing, then it is clear that there is no product liability for the upper road test vehicles. But this understanding is not correct, because according to the general principle of product liability, the key to determining whether to put into circulation is not to obtain the approval of the regulatory authorities for listing, but to leave the producer's dominant field based on the producer's will, or more figuratively, to put into circulation means that the producer voluntarily allows the product to pass through its "factory door" (the so-called "factory door theory", Werktortheorie). It can be seen that there are two elements for "input circulation", one is "leaving the field of domination of the producer" and the other is "voluntariness". From this point of view, the self-driving motor vehicle tested on the upper road has met this standard, because on the one hand, the public road is obviously outside the producer's "factory door", that is, it does not belong to the producer's dominant field; on the other hand, in this case, the motor vehicle leaves the producer's dominant field - unlike when it is stolen or robbed - it occurs based on the producer's will.
In addition, although usually the hallmark of a product going into circulation is that the producer delivers the product to a party at another link in the commodity exchange chain (either the end consumer or the seller). However, this phenomenon does not occur in the on-road test of the self-driving motor vehicle, in the test, there is either no one on the motor vehicle, or only the safety officer or test driver hired by the test subject, who is generally an employee of the test subject rather than as an ordinary consumer. But this does not prevent the evaluation of the upper road test motor vehicle as put into circulation, which is determined by the uniqueness of automatic driving technology, because the role of automatic driving is reflected in reducing or even eliminating the dependence of driving tasks on humans, so no matter who is in the car, it does not affect the safety or danger of the motor vehicle in essence. If we presuppose that producers voluntarily extend product risks beyond the boundaries of their own areas of control to other areas, then the motor vehicles tested on the upper road have undoubtedly met this premise.
2. Further arguments
With regard to products that constitute the production of motor vehicles tested on the upper road, two kinds of arguments will be presented below.
(1) Argument based on horizontal comparison: "Similar objects, similar treatment"
The first argument is based on the "horizontal comparison" of "similar objects, similar treatment": as long as an autonomous vehicle tests enters the open road, its influence and likelihood of harm to the entire transportation system and other traffic participants are no longer fundamentally different from that of an ordinary motor vehicle. Based on this similarity, test motor vehicles should be subjected to the same radiation of product liability as regular motor vehicles.
(2) Argument based on vertical comparison: "Lifting the light is the light"
The second argument is based on the "vertical comparison" of "light and heavy": if the autonomous vehicle is approved for sale in the future, it is obvious that the risk of the self-driving motor vehicle at that time is lower than that of the current test car, because the autonomous driving technology will become more mature with development. Since producers of mature products with lower levels of danger are subject to product liability ("light"), producers of test products with higher levels of danger are more liable for products ("heavy").
3. Legal policy trade-offs
Test vehicles are allowed (exceptionally) to enter public spaces at immature because, although this poses a particular danger, autonomous driving, as a science and technology with public utility and ultimately benefiting all members of society, should be encouraged and supported by policies, which requires members of society to make certain concessions in terms of safety. But precisely because concessions have been made, it is all the more important to "compensate" for them, and one of the main ways of compensating is to open the protective net of product liability while allowing the test vehicle to go public. Once a self-driving motor vehicle causes a traffic accident, the victim can claim compensation under product liability, which is the lightest burden of proof for the injured party and therefore the most advantageous because the product liability is no-fault liability.
Finally, the imposition of product liability will not bring too heavy or more than expected burdens to the test subject, because on the one hand, a single subject is only allowed to test a small number of motor vehicles, on the other hand, the test subject must generally purchase special insurance for the test motor vehicle, such as the "Road Test Specification" of the three ministries and commissions requires the tester to provide a traffic accident liability insurance certificate of not less than five million yuan per vehicle or a letter of guarantee of not less than the same amount, and the local norms in Beijing and Shanghai also make the same requirements.
(3) Responsible subject issue: The test subject acts as the producer
Because autonomous driving technology is closely related to algorithms, data, and the Network, the active players in this field are not only traditional motor vehicle manufacturers, but also emerging Internet companies, especially those with deep accumulation in search engine technology, the international representative is Google, the domestic representative is the first to promote Baidu, and the first batch of test licenses in Beijing was even awarded to Baidu. Since these Internet companies do not produce motor vehicles themselves, in order to test, they either need to cooperate with motor vehicle companies or directly modify existing motor vehicles. As testing rolls out, it is foreseeable that the sources of tested vehicles will become more complex and diverse.
For example, if Baidu modifies a Volkswagen branded motor vehicle and uses it for testing, who is the producer of the test motor vehicle, is it Baidu or Volkswagen? This question is actually equivalent to another question, that is, whether installing an autonomous driving system on a motor vehicle that did not originally have autonomous driving functions bring about a qualitative change that makes the car another product?
The answer is yes. Because assembling a pre-completed product (as a component) according to a specific conception is also a production according to the general rules of product liability, the result is a separate product (finished product). The above example is exactly such a situation, and this assembly behavior is enough to make the assembler (Baidu in the above example) become the producer of the test motor vehicle. Therefore, as long as the test subject has specially assembled the motor vehicle for the purpose of automatic driving on-road testing, then regardless of the source of the original car, the test subject becomes the producer of the test vehicle based on the assembly behavior.
VI. Conclusion
Self-driving motor vehicles are indeed a new thing with the significance of the times, but in the long years that law has accompanied the development of human civilization, autonomous vehicles are not the first and will never be the last new things encountered by the legal system. Since modern times, law, especially tort law, has successfully responded to the impact of new technologies more than once. We can fully believe that in the face of the booming autonomous driving technology, the legal system with learning ability will live up to expectations, fulfill the mission of protecting the members of the community, take into account the purpose of promoting the development of science and technology, and ultimately guide autonomous driving (and other artificial intelligence technologies) on the road to improving social welfare. Based on past experience, the key to this task is that the legal system must face the challenges of autonomous driving technology and seize the opportunity to learn, which requires both judicial and researchers to fully activate and develop the potential of the existing normative library, and also requires legislators to legislate or amend the law when necessary, and introduce new normative resources. After this confrontational learning process, the Legal System—as it has benefited from countless previous learning processes—will usher in the improvement of its own normative ability.
Finally, the establishment of product liability is summarized in the form of a chart as follows, and the relevant points discussed in this article are also embedded in the table and marked in the footnote to the position of the discussion in the text. All the laws in the table refer to the provisions of the Product Quality Law.
-END-
Responsible Editor | Liu Zhuozhi
Auditor | Zhang Wenshuo
This document declares | This article is for learning and communication purposes only, and in case of infringement, we will delete it in a timely manner. This article does not represent the legal opinions of Peking University Legal Information Network (Peking University Magic Treasure) and Beijing Peking University Yinghua Technology Co., Ltd. or the interpretation of relevant regulations/cases/events.
▼