But that argument ignores that these systems help stop accidents from happening 99% of the time and focuses only on the 1% when they fail. (numbers are made up) Automation has lead to accidents in aviation as well. But it's still being pushed forward, because when looking at total miles traveled, more automation tends to be significantly safer. The same principle holds true for ground vehicles.
Driving is infinitely harder than flying, from the perspective of a truly autonomous system. Once at altitude, there isn't much to run into. There are also very few possible emergencies that demand the pilot's attention within the next few seconds. Midair collisions are about the only exception I can think of, and there are already automated systems in place to prevent those. Bird strikes might be another, but those don't tend to coincide with periods of autopilot usage.
For a motor vehicle, though, the idea that "eyes off" and "mind off" should exist as separate levels of autonomy is just nuts. "Eyes off" will absolutely be interpreted as "mind off" by the majority of real-world drivers. It doesn't make sense to offer an "eyes off" solution at all, IMHO. Wait until we can genuinely call it a "mind off" solution.
eyes off means a driver is available. Its perfectly reasonable to cope with a problem by slowing down, pulling over and asking the driver for help. This is a choice that aircraft autopilots don't get to make. I agree that eyes off should not involve sounding an alarm and make the distracted driver take over in an instant at highway speed, and any solution that did that would be really dangerous.
mind off would need to cope with there being no capable driver or even any occupants at all. And even those systems will need to phone for roadside assist sometimes.
I think that is level 4 you are describing as "eyes off", not level 3, at least according to the Consumer Reports summary of the standard:
"The car can drive itself, but the human driver must still pay attention and take over at any time. The car is supposed to notify its driver if intervention is needed." [my emphasis.]
Pulling over or shutting down appears under level 4.
A system where the failure case is to slow down, pull over, and ask for help already is a system that can drive without a human inside - if the "need for a capable driver" can wait until you're stopped, then it can stay stopped and wait for a few hours until a driver (or mechanic) arrives or it gets towed.
There are a huge range of failures while flying which is why small aircraft are so dangerous. If nothing breaks and the weather is perfect then sure it can seem safe, but in practice you can't make those assumptions.
Saying commercial aviation is safe is like saying school busses are safe, it ignores people going out in bad weather etc. Commercial aviation has a great safty record beause they are cautious, not because it's an easy problem.
Autopilots on commercial aircraft work well, because of the infrastructure surrounding them.
Small aircraft is not commercial aviation. One of the most common failures in small aircraft is running out of fuel and then having the sudden need to find somewhere to land. That's a very rare problem in commercial aviation.
Basically, commercial aviation succeeds because it avoids the vast number of failure modes. Fully automated car autopilots are not a simpler problem, they simply need to deal with the mess which aircraft autopilots sidestep. Ex: 747's autopilot does not have a look for an open field I can land in which I can then take off from again after I refuel.
I am still not sure I get it - are you saying that autopilots are not a good analogy for autonomous cars because the car problem is more like that of using an autopilot in a small airplane? If so, be aware that autopilots for small single-engine airplanes are available [1]. Automobile automation is actually a much harder problem than that, and the "mess which aircraft autopilots sidestep" cannot be "simply" dealt with.
BTW, if you do have an engine failure in a single-engine airplane (or double failure on an A320), being able to take off again should be low on your priorities in picking a place to put down on.
The trick about autopilots (especially those in smaller aircraft) is that they operate almost exclusively based on information about their own state. Wing levelers just operate to keep the wings parallel to the ground, using information from a gyro. Direction keepers keep you on a particular heading, as determined by a gyro (which is corrected by a magnetometer). Even landing systems rely on radio signals being beamed at them.
The big exception to this is collision avoidance systems which use a radar combined with transponders; and is limited to fairly expensive aircraft as a result.
Autonomous cars have to start with radar-based collision avoidance simply to provide "smart" cruise control, and work outwards with lane detection for lane keeping, lidar and prediction for external body collision avoidance (deer, children, bikers), and so forth.
Aircraft autopilot is dead simple in comparison, and still has its share of failures. And speaking of failures, the other advantage of aircraft is that in the case of failure (in any phase of the flight other than takeoff/landing), pilots have tens of seconds to take over and hours each year of deliberate practice at flying compromised aircraft. Drivers, on the other hand, will be lucky to have a single second to realize their car isn't going to stop when they expect it to.
I think your still missing my point. A small aircraft running out of fuel is a common problem. If you turn on an autopilot when there is not enough fuel to get to an airport they don't deal with this situation.
So, no we don't have fully autonomous small aircraft autopilots. We have the equivalent of lane following + collision avoidance not the full range of piloting skills because they are designed as assistants for pilots not replacements for pilots. Worse a pilot in the aircraft or on ground would also needs to deal with air traffic control which is a vastly larger jump than reading road signs etc.
PS: Yes aircraft autopilots can deal with ~99% of the time flying just fine. But, that last 1% has dragons. Getting an autonomous trick to drive on highways in most weather conditions but which would drive into road construction is a good analogy.
As 100% reliability is unattainable in practice, I would assume this has already been taken into account in defining the levels - which leaves the question hanging: while, in principle, there may be a distinction between "hands off", "eyes off" and "mind off", will there be a distinction in practice? Volvo (and Ford?) seem to think not.
And is there any "hands off" system that tests if the driver is "eyes on"? With eye-tracking, it is feasible, but I have not read of it being used.
