Safety @ Nuro: Our Vehicles

Every hardware decision we make has been informed and dictated by a deliberate, uncompromising approach to safety. That’s because we are committed to making neighborhood roads safer, and we believe the way to do that starts with using zero-occupant vehicles to complete daily tasks. Without worrying about passengers, we can become particularly agile in our safety approach.

Our hardware choices — from our zero-occupant design to our sensors and built-in redundancies to our patented safety innovations — are fundamental to deploying reliable autonomous delivery vehicles in the world.

Here’s a deeper look at how we’re approaching the safety of our vehicles holistically to improve the communities in which we operate.

The zero-occupant design.

There’s no one inside our bots: they only carry goods. That means we’re putting fewer humans on the road, which immediately and dramatically reduces the possibility of harm. To quantify that reduction, for every mile of driving replaced by a zero-occupant design vehicle, the risk of fatality or injury can be reduced by approximately 60%. That’s why it’s so important we deploy at scale.

Removing people from the autonomous vehicle equation also allows us the freedom to design a smaller vehicle because we don’t have to account for the size or comfort of human passengers. The smaller footprint of our third-generation vehicle provides more room on the road so that bikers and cars can pass safely while providing the vehicle a greater margin in which to make safe maneuvers.

Another advantage of a zero-occupant design is that our autonomous delivery vehicle operates at a lower speed than other vehicles, which allows for faster stopping time and less risk of harm to other road users. When necessary, it can even maneuver and brake in ways that would be difficult — if not impossible — for vehicles carrying people, further reducing the risk of collision.

Beyond the safety benefits of our design, we also thought about how to make other elements of our hardware safer, too, such as our doors: they’re on the curbside, so customers don’t need to step into traffic to retrieve their order, and they open upwards so customers won’t hit their heads taking bags out of the bot. We also have a specially designed front panel that absorbs energy, better protecting pedestrians in the unlikely event of an impact.

Sensors and redundancy.

We’ve designed our hardware and software systems with numerous redundancies, including redundant computing, braking, steering, power, and sensor systems to ensure our vehicle can safely come to a stop should anything go wrong. By making critical systems redundant, even if a component malfunctions, another can remain functioning.

And, since our vehicle is a completely custom, zero-occupant vehicle, we can be deliberate about the placement of our sensors instead of having to retrofit them to a manufactured vehicle. Our vehicle features multiple redundant sensing modalities in both the long and short range, so we have confidence we’re seeing objects at a distance while also eliminating blind spots close to the vehicle. The different information absorbed by the different sensor types is complementary (which is especially important in adverse weather conditions). In essence, we’re “seeing” through different lenses for a 360° view of the world.

Here’s a breakdown of what each of our sensors does:

LiDAR — Provides accurate depth measurement information with high angular resolution.

High-resolution camera — Allows software to understand what it sees by differentiating between vehicles, pedestrians, and other objects.

Radar — Allows software to measure both the distance and the speed of the object it is detecting. It also helps to estimate how quickly the object is moving towards or away from the vehicle. And it’s great at sensing in inclement weather.

Thermal camera — Detects infrared (heat) from objects instead of visible light. This is an additional modality for detecting pedestrians in front of the vehicle, and it works extremely well at night and in cases where a pedestrian is only partially visible.

IMU (Inertial Measurement Unit) — Measures the acceleration, orientation, and angular velocity of the robot to determine its location and position within space. Multiple IMUs are used on different modules on the vehicle for redundancy purposes.

Emergency vehicle microphone system — This array of many microphones is placed around the bot and is constantly listening for sirens coming from emergency vehicles (police car, fire truck, ambulance, etc). These mics are designed to be able to hear well from very far away and triangulate where a siren is located so that we can detect an emergency vehicle well in advance and safely pull over.

All of these sensors work together to ensure the vehicle is able to navigate safely through its environment. And, in addition to the sensing modalities above, we’ve also developed a layered system fallback strategy that can support full autonomous driving in our vehicles without requiring human intervention. At all times, our onboard computer calculates multiple potential stopping trajectories that would be safe to take should a system fail. This approach is resilient to a loss of connectivity or a computer malfunction, as the trajectories are preplanned and sent to our high reliability computer frequently. The system can choose to execute one of many fail-safe trajectories, depending on the situation and the fault detected. Preparing for multiple potential scenarios with increasing layers of severity allows the vehicle to choose the option that is safest under the circumstances.

Patented safety innovations.

Our zero-occupant design allows us to be particularly innovative, since we aren’t building conventional vehicles that must protect their passengers. We can, in essence, turn safety features inside-out — we don’t need to focus on passenger-protecting features such as seatbelts and can instead focus on making our vehicle safer for others on the road. That means that some of our safety features are among the first of their kind in the autonomous vehicle category.

One example of this is our category-first external air bag designed to protect the safety of those outside the vehicle. We know that one of the leading causes of fatal injuries in the event of collisions between pedestrians and vehicles is head injuries, so we optimized this custom pedestrian airbag to reduce head and neck injuries in the event of a collision.

Typical passenger cars only deploy airbags after the collision has started, but because our vehicle has the additional benefit of the high-accuracy redundant sensors with 360° coverage we describe above, we can pre-deploy the external airbag prior to contact to maximize safety benefits. The airbag deploys in milliseconds and it is able to take a larger, more effective shape than what could be allowed in a passenger vehicle due to space constraints. The result is a truly innovative approach to protecting others on the road instead of focusing efforts on those inside the vehicle.

We’ve also considered what happens when the sensors on our vehicle get dirty — after all, our robots drive in the real world. Our first-of-its-kind cleaning and cleaning mechanism can remove dirt, debris, mud, and even bird droppings from the sensor as quickly as possible to prevent the camera or lidar from being obscured. We’ve even made a special effort to make sure we can clean each sensor individually. That allows us to clean just the sensor that is dirty rather than trying to clean all sensors at once, which might otherwise temporarily blind other sensors.

And our clearing mechanism is great at removing rain droplets from the lens of the camera and from the lidar. This is vital for our hardware to be able to operate safely in rainy conditions: we need to be able to remove water droplets faster than new rain droplets coming in. Our software detects when it’s raining so it can adjust data accordingly and avoid false positives caused by rain droplets in the air. This practical, forward-thinking approach to environmental management allows us to clear away debris that could prevent us from seeing something vital even in inclement weather.

The results.

All of the above decisions and innovations combine to produce a vehicle that we believe is among the safest on the road. By starting with a zero-occupant design, we have a baseline that’s immediately safer than passenger cars and also allows us to implement innovations not possible when having to prioritize concern for people inside the vehicle. Our sensors can be placed strategically instead of having to conform to a standard passenger car design, and we’ve implemented redundancies throughout the vehicle to consider the unlikely scenario of malfunction.

In addition, we’re constantly challenging ourselves to think of and solve for possible scenarios — no matter how unlikely — so that our autonomous delivery service only gets safer and more robust over time. In fact, we like to think of our third-generation vehicle as a tangible commitment to safety: it’s a mobile reminder that every decision we make needs to better the communities we serve.