Prioritizing Safety or Tra ﬃ c Flow? Qualitative Study on Highly Automated Vehicles’ Potential to Prevent Pedestrian Crashes with Two Di ﬀ erent Ambitions

: Interaction between drivers and pedestrians enables pedestrians to cross the street without conﬂicts. When highly automated vehicles (HAVs) become prevalent, interaction will change. Although HAVs manage to identify pedestrians, they may not be able to assess pedestrians’ intentions. This study discusses two di ﬀ erent ambitions: Prioritizing pedestrian safety and prioritizing e ﬃ cient tra ﬃ c ﬂow; and how these two a ﬀ ect the possibilities to avoid fatal crashes between pedestrians and passenger cars. HAVs’ hypothetical possibilities to avoid di ﬀ erent crash scenarios are evaluated based on 40 in-depth investigated fatal pedestrian crashes, which occurred with manually-driven cars in Finland in 2014–2016. When HAVs prioritize pedestrian safety, they decrease speed near pedestrians as a precaution which a ﬀ ects tra ﬃ c ﬂow due to frequent decelerations. When HAVs prioritize e ﬃ cient tra ﬃ c ﬂow, they only decelerate, when pedestrians are in a collision course. The study shows that neither of these approaches can be applied in all tra ﬃ c environments, and all of the studied crashes would not likely be avoidable with HAVs even when prioritizing pedestrian safety. The high expectations of HAVs’ safety beneﬁts may not be realized, and in addition to safety and tra ﬃ c ﬂow, there are many other objectives in tra ﬃ c which need to be considered.


Introduction
Highly automated vehicles (HAVs) without human drivers are claimed to enhance traffic safety of all road users by eliminating human errors (see e.g., Fagnant and Kockelman [1]). The conversation about the safety benefits of HAVs has mostly focused on the elimination of driver errors, which may be the key factor to consider in collisions between motor vehicles. However, in the encounters between HAVs and other road users (e.g., pedestrians and cyclists), interaction between vehicle automation and humans is an important factor from the perspective of safety [2]. The elimination of driver error is also an important factor for improved safety in these encounters, but changes in interaction and behavior cause potentially new safety problems [3].
For pedestrians, eye contact with the driver is a clear message to decide to cross the street [3]. Text-based or visual messages, as e.g., Ackermann et al. [4] have described, can be options to replace eye contact when implementing HAVs. A more complicated task for HAVs is to assess pedestrians' intentions, e.g., whether they are about to cross the street. HAVs should always be cautious nearby pedestrian crossings as the pedestrians have a right of way, but all pedestrians walking or standing near a pedestrian crossing are not going to cross the street. Are HAVs able to specify these cases?
In theory, HAVs could be programmed to maximize safety in encounters with pedestrians and other road users. However, safety is not the only objective to be maximized in the transport system suggesting that HAV operation is likely a compromise between optimization of safety and other ambitions (e.g., flow of traffic, accessibility, travel time, environmental effects, etc.). Eventually, artificial intelligence may be able to understand the intentions of other road users, and at that point of development, encounters may not be as problematic as in the initial stage of HAV implementation. However, in the initial stage, traffic safety requires attention from various stakeholders to ensure the acceptance of the general public [5].
This study addresses the issue that the expected safety effects of the HAVs may not be realized if safety is not prioritized over other ambitions. As the other ambition, this study highlights the efficient flow of traffic, which can be seen to conflict with the safety ambition especially when discussing pedestrian traffic. By analyzing fatal crashes which have occurred between driver-managed passenger cars and pedestrians in Finland in 2014-2016, it is discussed whether HAVs-replacing the driver-managed cars in these crash scenes-could have avoided these collisions with pedestrians. Potential new crashes, which the HAVs could cause, are not discussed in this study. In the analysis, it is assumed that the HAVs operate faultlessly and reliably, e.g., there are no operational or programming errors. The hypothetical encounters between HAVs and pedestrians are studied qualitatively with in-depth investigated crash data, and it is analyzed whether prioritizing pedestrian safety or efficient traffic flow in HAVs operation leads to crash avoidance. This study aims to complement the discussion on highly automated vehicles and pedestrian safety and to point out issues to be considered in future.
In Section 2, encounters between HAVs and pedestrians are discussed based on previous studies. Thereafter, Section 3 describes the analyzed crash data and presents the method to analyze the data, i.e., the fatal crashes between driver-managed cars and pedestrians with the hypothetical setting in which HAVs replace the driver-managed cars. Results of the analysis are presented in Sections 4-6 for different types of pedestrian crashes. Finally, the two approaches, prioritizing pedestrian safety and efficient traffic flow are discussed in Section 7 and conclusions are presented in Section 8.

Interaction between Highly Automated Vehicles and Pedestrians
Human error is stated to be the main reason for traffic accidents in more than 90% of cases [6]. In an HAV, driving automation replaces the human driver and thus eliminates human error if the driver is fully removed from the driving task. This does not mean that errors would not be possible with HAVs as these are programmed by humans, and HAVs operate in various environments and interact with external objects in countless situations. Besides human error, other errors (e.g., poor roadway design), can constitute additional reasons for a crash [5]. In addition, at the initial stage of HAVs implementation, HAVs are likely to operate on roads without complex intersections and without encounters with other road users [7] and thus have a minor effect on pedestrian safety.
Even if we assume that automated vehicles' systems would not make a mistake while identifying pedestrians in any weather condition or that pedestrians' physical characteristics would not influence the identification, which may not be realistic according to Combs et al. [7], the interaction between HAVs and other road users is an important topic to discuss. Insufficient communication between drivers in conventional vehicles and pedestrians has been indicated to influence safety as pedestrians' decision to cross the street is greatly affected by the communication [8]. Even though the interaction in traffic situations is based on formal rules, the rules can be applied subconsciously and by non-verbal communication [9]. According to Dey and Terken [10], pedestrians do not usually show a clear message (e.g., a hand gesture) while interacting with drivers when they are about to cross the street, but they typically look in the direction of the approaching car. Understanding pedestrians' behavior and trajectories may be a challenge to HAVs' operation, but this should be able to be settled to guarantee safe encounters with other road users.
The safety of vulnerable road users (e.g., pedestrians and cyclists) requires specific focus while implementing driverless vehicles [11] as changes affect the traffic environment. Previous studies involving HAVs and pedestrians have investigated how HAVs could signal to pedestrians that they have been recognized. Ackermann et al. [4] indicated that pedestrians want a message from the HAV that they have been seen and can cross the street. Text-based messages were noticed as a better option compared to other light signals and symbols [4]. Lundgren et al. [12] argued that eye-contact should be replaced in one way or another to ensure safe interaction with HAVs. Especially in shared space areas, conflicting interactions between HAVs and pedestrians are likely without understandable communication [2].
Some other studies have found that safe interaction does not always need light or text signals. Rothenbücher et al. [13] studied the interaction in a field test, in which pedestrians thought that the vehicle was self-driving as the driver was hidden inside the vehicle and concluded that the pedestrians could manage an encounter with the HAV without any text or visual signals. The study noticed that pedestrians are adaptable road users as they are already used to operating without communication e.g., in dark conditions [13]. This argument is based on the observation that a vehicle's speed and distance to a pedestrian crossing are more important factors than the visual signal of HAVs would be when a pedestrian makes the decision to cross the street [3]. In addition, Tengvall [14] found that other road users (e.g., pedestrians), when interacting with an HAV, seem to be able to anticipate the HAV's operation by detecting its speed and trajectory, and changes in these factors. Consequently, simplifying the interactions (e.g., not implementing light or text signals) could lead to safer encounters as there would not be as many elements to handle during the interaction. In most encounters, pedestrians could probably rely on factors such as vehicle's speed and trajectory, while making the decision to cross the street or not. However, these factors do not always guarantee safe encounters, if e.g., a pedestrian does not recognize the approaching HAV, when the pedestrian is crossing the street. In addition, the HAV may not always recognize the pedestrian early enough. These situations, which finally determine HAVs' safety effects (e.g., cases requiring evasive action), need to be examined in more detail.
Detwiller and Gabler [15] assessed that HAVs could prevent 95% of the studied pedestrian injury crashes in the United States, if the pedestrian was visible over one second at the edge of the roadway or a driver violation caused the crash. Millard-Ball [16] found that potential risk-free operation of HAVs could enhance the status of pedestrians. Tengvall [14] focused on the interaction between a low speed driverless shuttle bus and other road users (e.g., pedestrians) and reported that clear safety benefits were not identified in these encounters compared to conventional vehicles. Some studies have evaluated the safety effects of automatic emergency braking (AEB) system with pedestrian detection, which is one area of vehicle automation. Lubbe and Kullgren [17] evaluated that the AEB system could decrease crash costs by 26% by preventing pedestrian crashes. The safety impact is not completely comparable to HAV's operation as the AEB system activates at the last possible moment before the collision, if the driver has not applied brakes. In addition, a human driver may break the law, e.g., by speeding, which has an impact on the AEB system's possibilities to avoid the collision as there is less time to stop the vehicle. Unlike the AEB system, HAVs should be able to anticipate forthcoming situations to increase the potential to avoid collisions with pedestrians and other road users.
How HAVs indicate that they have registered the pedestrian and that the pedestrian is safe to cross the street is an essential situation to be solved as e.g., Ackermann et al. [4] and Rodríguez Palmeiro et al. [3] have discussed. Before HAVs communicate to pedestrians by e.g., changes in vehicle speed or visual signals, the system needs to identify the nearby pedestrians, who are going to cross the street. It should be easy to identify pedestrians near the crossing by advanced technology, but it is challenging to analyze whether these pedestrians are actually going to cross the street or if they are just walking along the pavement next to a roadway without crossing. The latter would not demand action from the HAV, but in the first alternative, a conflict is possible without further actions. At the initial stage of implementation, HAVs may not be able to understand body language and non-verbal messages as human drivers do since the current algorithms assessing pedestrians' intentions are not good enough [18]. If the system cannot be sufficiently certain of the forthcoming location of the pedestrians some seconds before reaching the pedestrian crossing, the only way is to stop the vehicle or decrease vehicle speed to enable avoiding a potential collision, if the pedestrian would cross the street. Although these hypothetical procedures could ensure pedestrian safety, some other negative effects could be realized involving, for example, flow of traffic, travel times, and risk of rear-end crashes, when there are also conventional, driver-managed vehicles in traffic. It seems clear that a strategy or regulation should be implemented for the encounters in traffic between HAVs and other road users [2].

Data and Methods
This study assesses HAVs' hypothetical possibilities of crash avoidance by analyzing data of 40 in-depth investigated fatal pedestrian crashes, which took place in Finland in 2014-2016 and in which a driver-managed passenger car was involved. In these crashes, there were 41 pedestrian fatalities, i.e., in one crash two pedestrians were killed and, in the others, there was one pedestrian fatality per crash. Overall, there were 97 pedestrian fatalities in Finland in these years, when all involved vehicle types (e.g., heavy vehicles) are considered [19]. The analyzed data was provided by Finnish Crash Data Institute upon request for research purposes. By analyzing the crashes case-by-case, we discuss the impacts of two different ambitions, i.e., prioritizing pedestrian safety and efficient traffic flow in the operation of HAVs. The analysis is based on in-depth crash data and qualitative analysis methodology. In the analysis, we use crash data variables on the crash type, the pre-crash event, the immediate risk factor, the vehicle speed, the width of the roadway, the number of lanes, the location of the collision point, and the sight distance. In addition, written crash descriptions are used to have a better understanding of the pre-crash event. The variables and the crash descriptions on which the analysis is based are from the findings of the multidisciplinary crash investigations teams.
The operational capabilities of HAVs in adverse weather or low-light condition is not evaluated in this study, albeit adverse conditions are one of the main challenges in the development of HAVs. Inclement weather conditions pose a challenge to automated driving, but the technology is rapidly advancing, as e.g., the sensors of automated vehicles may already detect objects in foggy and dusty conditions, see e.g., TechCrunch [20]. In addition, dark conditions increase the risk of a pedestrian crash [21], but these conditions are not focused on in this study. However, it is important to ensure HAVs will be able to operate in dark conditions, because these conditions were identified in some of the studied 40 pedestrian crashes. In the crash analysis, the assessment is made based on the assumption that HAVs would be able to operate in all weather and light conditions. HAVs are also assumed to always follow rules and not drive through a red light, for example.
HAVs' possibilities to prevent fatal pedestrian crashes, which have occurred with driver-managed cars, are evaluated qualitatively by the authors based on the data. In the evaluation of crash avoidance possibilities, it is assumed that even if HAVs are able to identify the presence of nearby pedestrians, they are not able to assess pedestrians' intentions (e.g., intentions to cross the street). This assumption is based on the results of the literature review by Rasouli and Tsotsos [18] and the expert survey by Botello et al. [22], which state that the current algorithms cannot assess pedestrians' intentions in a way that the information could be used for automated driving. Based on the assumption, the evaluation of crash avoidance is made with two approaches related to different ambitions in traffic; could a HAV in a similar crash scene instead of the driver-managed car manage to avoid the crash, if prioritizing (1) pedestrian safety or (2) efficient traffic flow? Here, prioritizing pedestrian safety refers to the approach, in which the HAV would always take necessary safety precautions (e.g., slow down or stop depending on the situation), when there are pedestrians identified nearby the vehicle or in the proximity of the planned driving path. These precautions are taken in this prioritizing pedestrian safety approach as the HAV cannot be sure of pedestrians' intentions, e.g., whether they are going to cross the street. This is likely to cause unnecessary decelerations as all pedestrians nearby the roadway are not going to cross the street. This would consequently influence the flow of traffic, especially in urban areas with many pedestrians and vehicles.
In the second approach, in which efficient traffic flow is prioritized, the HAV slows down or stops only when a pedestrian is identified in the immediate collision course. In this approach, unnecessary decelerations can be avoided, but it is questionable if there is always enough time to brake and avoid collisions with pedestrians. Table 1 depicts the difference between the two ambitions and approaches (prioritizing pedestrian safety and efficient traffic flow) in the analyzed crashes. Table 1. Description on the two highly automated vehicles' (HAVs') approaches used in the analysis of different crash scenes, prioritizing (1) pedestrian safety and (2) efficient traffic flow in HAVs operation.

How Would the HAV Operate in a
Situation, in which . . .

Prioritizing Pedestrian Safety Prioritizing Efficient Traffic Flow
. . . a pedestrian was recognized to approach the roadway with an intersection trajectory, or a pedestrian was about to cross the street?
HAV decelerates to ensure avoiding the potential conflict HAV continues to operate without actions . . . a pedestrian stepped to the roadway? HAV has decelerated in advance and hence, it only needs to apply the brakes moderately HAV brakes strongly only just when a pedestrian is in a collision course and time to the possible collision is 1.5 s In the following cases there is no difference between the two approaches . . . a pedestrian was recognized to be on the roadway (e.g., approaching oncoming traffic in the same lane)?
HAV decelerates strongly or moderately to avoid a collision . . . the driver had not obeyed the law, and had e.g., driven through a red light or was speeding?
HAV obeys the laws and thus can avoid the collision . . . the driver had drifted out of lane due to attack of illness? HAV is in control of the car, and is not affected by illnesses . . . the driver had drifted out of lane due to loss of control and exceeding the speed limit?
HAV avoids exceeding the speed limit and thus manages to keep the right lane and the control of the car ... the driver had crashed with a pedestrian during backing up or at a parking area?
HAV recognizes pedestrians during backing up and at parking area and can avoid these cases . . . the driver had intentionally caused the crash (i.e., the crash is due to suicidal act)?
The driver is considered to be able to override the automated driving system, and thus HAV is not able to avoid these crashes. . . . the pedestrian had intentionally caused the crash (i.e., the crash is due to suicidal act)?
The intentionally caused crashed by pedestrians are evaluated case-by-case.
HAVs' possibilities to avoid the studied 40 fatal pedestrian crashes are evaluated from the perspective of the two aforementioned ambitions and approaches (pedestrian safety, efficient traffic flow) with three results on the potential outcomes of crash avoidance for each crash scene. The three possible outcomes are that (A) the crash would likely be preventable by the HAV, (B) the crash would likely be unpreventable by the HAV, or (C) the crash avoidance is unclear. The analysis of the crashes is divided to three different crash types because these differ in the way HAVs would operate according to the two ambitions. The crash types and the amount of studied crashes are: Thirteen pedestrian crossing crashes with two subtypes; crashes related to driver's behavior (four crashes) and crashes related to wrong observations (nine crashes), 13 crashes outside pedestrian crossings and 14 other pedestrian crashes. The first two crash types include crashes in which the pedestrian was crossing the street, whereas in the other pedestrian crashes the pedestrian was e.g., in a parking area. These three crash types are analyzed in Sections 4-6, respectively. As a contrast to the pedestrian crossing crashes, in which pedestrians have a right of way, the crashes outside pedestrian crossings differ from the HAV's point of view. To prevent pedestrian crossing crashes and to maintain undisturbed traffic, the HAVs should be able to identify pedestrians' intentions. Outside pedestrian crossings, HAVs could be designed not to assume that the pedestrian on a pavement or at the roadside is intending to cross the road. At least this would be the way according to the current regulation. According to the Vienna Convention [23], "pedestrians shall not step on to the carriageway without first making sure that they can do so without impeding vehicular traffic." The assessment principles of crash avoidance in the three different crash types are presented in Table 2. In the efficient traffic flow approach, HAVs are not assumed to decelerate when pedestrians are recognized nearby the vehicle. The HAV only decelerates when a pedestrian is identified in a collision course (e.g., when the pedestrian steps from the pavement to the roadway or is walking along the same lane where the HAV is driving). Consequently, time-to-collision (TTC) analysis is applied to evaluate whether there is enough time to decelerate and avoid the collision by the HAV, when the pedestrian steps to a roadway in pedestrian crossing crashes and crashes outside pedestrian crossings. TTC is calculated as presented in Equation (1) and rounded to the nearest 0.5 s. The crash is analyzed as unlikely preventable, if TTC is smaller than 1.5 s, because it represents a high collision risk and TTC = 1.5 s is when the system should apply the brakes at the latest [24,25]. If TTC is less than 1.5 s, there is likely too little time to avoid a collision. Cases with higher TTC than 1.5 s are assumed potentially preventable crashes. Cases, in which TTC was 1.5 s, are determined unclear cases.
In Equation (1), the distance (s) represents the distance between the point in which the pedestrian steps onto the roadway and the collision point in pedestrian crossing crashes or in other crashes with intersecting trajectories. The assumed pedestrian speed (v p ) is 1.2 m/s, which is based on the findings of Onelcin and Alver [26] and Rastogi et al. [27]. In some of the analyzed crashes, the pedestrian was already on the roadway or in the collision point, when the HAV could firstly have recognized the pedestrian. In these cases, the sight distance is utilized as the distance (s) and the car's speed (v c ) is used instead of pedestrian's speed. The sight distance is the distance between the point from which the collision point could firstly have been recognized by the HAV and the collision point. TTC analysis cannot be applied if the crash is situated at a parking area, the crash involved reversing, or the crash was intentionally caused. In addition, the TTC analysis is not applied if the crash took place due to loss of control of the car as in these crash scenes the crash avoidance is managed by HAV safe operation as described in Table 2.

Pedestrian Crossing Crashes
The studied 13 fatal pedestrian crashes in pedestrian crossings (Table 3) involved mostly human errors, e.g., the driver did not observe the pedestrian (at all or early enough) while driving through the pedestrian crossing. In addition, excessive vehicle speed or driving through a red light were reported in some cases. Two crashes involved misunderstanding as the driver expected the pedestrian to yield. For example, if a pedestrian stops before crossing the street, the driver may think that the pedestrian is yielding, although the pedestrian has a right of way. Without informal signals, e.g., waving a hand, both road users may think they may continue safely. Crashes presented in Table 3 were analyzed individually, but similar crashes in terms of the analysis and its results, if these existed, are presented together. Table 3. The studied fatal pedestrian crashes with driver-managed passenger cars situated in pedestrian crossings and assessment of crash avoidance in two approaches, i.e., prioritizing pedestrian safety or efficient traffic flow by a HAV.

Crash Description (Number of Crashes if More than One) HAV Prioritizing Pedestrian Safety HAV Prioritizing Traffic Flow
Crashes related to a driver's behavior: The driver was speeding and dazzled by sunlight, TTC = 4.5 s Likely preventable Likely preventable The driver was speeding, TTC = 4.5 s Likely preventable Likely preventable The driver was speeding and drove through a red light, TTC = 10.0 s Likely preventable Likely preventable The driver was speeding and competing with another driver, TTC = 1.5 s Likely preventable Likely preventable Crashes related to driver's wrong observations: The driver did not recognize the pedestrian, or the driver assumed the pedestrian would yield, TTC = 2.0-4.5 s (five crashes) Likely preventable Likely preventable The driver did not recognize the pedestrian, TTC = 1.5 s (three crashes) Likely preventable Unclear The driver did not recognize the pedestrian, TTC = 1.0 s Likely preventable Unlikely preventable The analyzed pedestrian crossing crashes are all likely preventable by HAVs prioritizing pedestrian safety. The HAVs can drive cautiously and with decreased speed nearby the pedestrian crossings as these are clearly visible in the road environment. If the HAVs prioritize efficient traffic flow, TTC has a key role when assessing the possibilities for crash avoidance related to analyzed crashes with drivers' wrong observations. In the analyzed crashes in which the driver had not obeyed the obligation to yield due to wrong observations (e.g., the driver had not recognized the pedestrian at all or early enough), the HAV is assessed to be able to recognize the crossing pedestrian. However, in the efficient traffic flow approach, there may not always be enough time to avoid the collision as the HAV does not decelerate until the pedestrian is already in front of the vehicle and has started to cross the street. Five of the nine crashes related to wrong observations are determined likely preventable based on TTC analysis in the prioritizing efficient traffic flow approach. In three crashes in which a driver had not recognized the pedestrian, TTC was 1.5 s. As described in Section 3, the avoidance of these crashes is determined as unclear, because it is difficult to evaluate whether the crash would be preventable or unpreventable. One crash, in which TTC was less than 1.5 s, is assessed as unlikely preventable. In the crashes related to wrong observations, vehicle speeds varied between 15 km/h and 50 km/h. In the crashes related to a driver's behavior, speeds were between 58 km/h and 120 km/h.

Pedestrian Crashes outside Pedestrian Crossings
In the analyzed data, there were 13 fatal pedestrian crashes in road areas outside pedestrian crossings (Table 4). In most of these crashes, the pedestrian was crossing the road, and the driver did not recognize the crossing pedestrian at all or early enough. In some of the crashes, the pedestrian was standing on the roadway or approaching oncoming traffic in the same lane. Again, similar crashes in terms of the analysis and its results, if these existed, are presented together in the table. Table 4. The studied fatal pedestrian crashes with driver-managed passenger cars situated outside pedestrian crossings and assessment of crash avoidance in two approaches, i.e., prioritizing pedestrian safety or efficient traffic flow by a HAV.

Crash Description (Number of Crashes if
More than One). The Driver did not Recognize . . . All of the analyzed crashes on road sections without pedestrian crossings are likely preventable by HAVs in prioritizing pedestrian safety approach, as the HAVs operate cautiously and decrease speed to guarantee short stopping distance and ability to react to possible conflicts. Most of the crashes are also likely preventable in the prioritizing efficient traffic flow approach, but TTC values are at the critical threshold (1.5 s) in four crashes, in which avoidance is classified as unclear. Due to a small TTC margin, these four crashes may not be preventable, but the impact speed would likely be small. In addition, one case, in which a pedestrian crossed the street all of a sudden, is assumed likely unpreventable due to short TTC. Vehicle speeds varied from 30 km/h to 80 km/h in these 13 crashes.

Other Pedestrian Crashes
Besides the crashes described in Sections 4 and 5, there were 14 other types of fatal crashes between pedestrians and passenger cars in the analyzed data ( Table 5). Most of these crashes were situated in parking areas or involved reversing. In some cases, the car had drifted out of the lane and hit a pedestrian. The data also included one case in which the pedestrian was hit by a car which was in a rear-end collision. In two cases there was suicidal behavior, of which one was by the driver and the other by the pedestrian. Again, similar crashes in terms of the analysis and its results, if these existed, are presented together in the table. In most of the crashes, TTC analysis is not applicable.
The crashes with reversing cars and in the parking areas, were assessed to be likely preventable by HAVs in both approaches. HAVs were also analyzed to be likely able to prevent crashes in which the car had drifted out of lane, e.g., due to a driver's attack of illness or loss of control of the vehicle, as the HAV does not drive with an excessive speed in curves or is not affected by attack of illness. The rear-end crash between two motor vehicles, in which the crashed vehicle hit a pedestrian was also analyzed to be likely preventable in both approaches, because the HAV is assumed to recognize the rear-ended vehicle earlier. In this case TTC was 10.0 s, when the sight distance and vehicle's speed is considered. The crash, in which a pedestrian was under the vehicle, when the car started to back up, was assessed to be likely unpreventable as the HAVs were not assumed to have sensors which would recognize objects under the car. The analyzed crash including suicidal action by the driver is likely unpreventable as we consider that the driver is able to bypass the automation if they choose to do that as discussed in Section 3. The crash related to pedestrian's suicidal act was also assessed likely unpreventable due to sudden act of the pedestrian. In most of the studied crashes, vehicle speeds were usually low e.g., smaller than 15 km/h. In four crashes speeds varied from 70 km/h to 125 km/h.

Discussion
Previous studies on highly automated vehicles from the perspective of pedestrians and pedestrian safety have mainly focused on the interaction and alternative ways to communicate to the pedestrians that they are seen. As one starting point for this study was the finding that HAVs may not be able to interpret pedestrians' non-verbal messages as human drivers do, and thus HAVs cannot be sure whether the pedestrian nearby the roadway is going to cross the street. We found no previous studies with a similar setting to analyze the possibilities to prevent pedestrian crashes by considering HAVs instead of driver-managed cars in actual fatal crashes, and with two approaches, prioritizing pedestrian safety or efficient traffic flow.
Although the number of analyzed crashes in this study is only 40, the crash types and crashes are comparable to larger sample studies e.g., in the United States. According to Dai [28], in 37% of the studied pedestrian injury crashes (n = 7195) in Atlanta, the trajectories of a pedestrian and a driver intersected outside pedestrian crossings and the trajectories intersected in a pedestrian crossing in 22% of the cases. In this study, the correspondent shares (33% and 33%, respectively) are relatively close to Dai's [28] study. In addition, in Kemnitzer et al.'s [21] study on pedestrian crashes (n = 11,241) in Ohio, 33% of the crashes were situated at the pedestrian crossing, which is comparable to our study. Next HAVs' possibilities and challenges in enhancing pedestrian safety are discussed in the three different types of pedestrian crashes analyzed in this study.

Pedestrian Crossing Crashes
HAVs' possibilities to prevent crashes in pedestrian crossings assessed seem promising as all 13 studied fatal crashes could potentially be preventable by the approach prioritizing pedestrian safety. In this approach, driver-related errors (e.g., driving through a red light) are assumed to be avoided by the HAV. In addition, cautious automated driving would ensure that the HAV would have enough time to stop or make an evasive action in the potential conflicts with pedestrians. The pedestrians have a right of way at the pedestrian crossings, but sometimes they may let cars go first by waving a hand or without any visual communication. These situations may be hard to interpret by the HAVs and cause even longer delays and stops in traffic, when automated driving is introduced. It is also worth noting that pedestrian crossings on urban streets are often signalized. In signalized pedestrian crossings there would be no need to evaluate pedestrians' intentions if HAVs could assume that all road users follow the signals.
Prioritizing safety over other ambitions in HAV operation by e.g., slowing down before pedestrian crossings as a precaution, when there is a pedestrian nearby the pedestrian crossing, is a potential mode on urban streets with speed limit of 30-40 km/h and relatively low amount of vehicular traffic and pedestrians. If there is a great amount of pedestrian traffic, HAVs may end up totally jammed as these would be cautious to proceed if there is a risk of pedestrians coming to a collision course. Traffic lights would help HAVs in these situations as well as a defined "safe" speed, with which the HAV would pass pedestrians even if they are close to the road. The safe speed should be defined for different traffic environments and situations, but to avoid fatal consequences, the speed must be moderate. The discussion about the safe speed relates to many stakeholders, from city dwellers and citizens to local government and state officers, from HAV developers to international organizations, such as the UN and EU.
Driving with lower speed than what is allowed by the speed limit in the prioritizing pedestrian safety approach may, however, cause other undesired impacts such as rear-end crashes in traffic with automated and driver-managed vehicles, and reduced traffic flow due to lower speeds and decelerations. Despite possible inconveniences for vehicular traffic, the pedestrians should be prioritized over vehicles on urban areas (see e.g., ETSC [29]; Toroyan et al. [30]) and hence, low speeds and cautious driving patterns are recommendable for HAVs in urban streets. In urban areas with higher speed limits, the prioritizing pedestrian safety approach may conflict with other ambitions (e.g., efficient traffic flow) and hence, this approach may be difficult to implement as such.
Low speed limits (e.g., 30 km/h) in urban areas could also allow HAVs to operate with the efficient traffic flow approach, as HAVs then could have enough time to avoid the collision, although the braking would not start until a pedestrian is in the collision course in front of the HAV. However, the crash avoidance would highly depend on the distance to a pedestrian, when the evasive action is taken. According to TTC analysis, nine of the 13 analyzed crashes would likely be preventable as the HAV would probably have enough time to avoid the collision, when the pedestrian is recognized in a collision course. The avoidance of three of the remaining four crashes was unclear, because in these cases TTC values (1.5 s) reflect a high collision risk and hence, crash avoidance could not be determined. However, if the crash would occur, impact speed would likely be low and hence fatal consequences could likely be avoided. Less than 2% of the collisions between a pedestrian and a passenger car end up with fatal consequences at impact speed of 30 km/h [31]. In addition, in some cases, only a minor change in vehicle speed could lead to crash avoidance, because the pedestrian may have passed a collision point. It should be noted that the prioritizing efficient traffic flow approach may not be desired from the perspective of pedestrians, because the HAV seem to ignore them until the last possible moment when the HAV brakes heavily to avoid the collision or mitigate its consequences. This affects the perceived safety of pedestrians. Heavy braking would also be unpleasant for HAVs' passengers, too. On roads with higher speed limits and non-signalized pedestrian crossings, the HAVs should not operate in the prioritizing efficient traffic flow mode, because all crashes could probably not be avoided, and the greater the speed is, the more likely are the serious consequences.

Crashes Outside Pedestrian Crossings
Based on the analyzed 13 crashes, HAVs would not likely be able to avoid all pedestrian crashes which are situated outside pedestrian crossings. This is because HAVs are not likely able to adopt a policy in which they would reduce speed considerably and prepare for a quick stop whenever there is a pedestrian nearby the roadway. Preparing for all possible conflicts would reduce the flow of traffic considerably. HAVs can be programmed to expect that pedestrians obey their responsibility to yield, but in theory, HAVs can also be designed to avoid collisions with pedestrians in all situations to emphasize the important role of pedestrians in (urban) traffic. If HAVs are programmed to avoid collisions in all situations, also e.g., when there are no pedestrian crossings, pedestrians may take advantage of this feature and change their behavior, increasing risk in encounters with HAVs [16]. For instance, the pedestrians could cross the road anywhere without a worry as HAVs would take evasive action in all situations. Thus, the approach of prioritizing pedestrian safety could eventually lead to undesired outcomes.
Whether HAVs are programmed to prioritize pedestrian safety or not seems to have a significant effect on the possibility of crash reduction in the crashes outside pedestrian crossings. In the prioritizing pedestrian safety approach, all 13 crashes situated on other road sections than pedestrian crossings would likely be preventable. Solely eight of 13 crashes could potentially be preventable if the efficient traffic flow approach is prioritized. However, four of the remaining five crashes were assessed as unclear as TTC was evaluated to be at the critical threshold. This could mean that fatal consequences could potentially be avoided in these cases, although the collision would still occur.
As the efficient traffic flow has been one of the key goals of traffic planning, it is possible that HAVs will be programmed to minimize anomalies in traffic flow. This could mean that the vehicles would not decelerate their speed as precaution on road sections without pedestrian crossings, although pedestrians are identified at the roadside. If a pedestrian is crossing the road and the HAV is on a collision course, the time distance defines whether there is enough time to avoid the collision. Some of the crashes, which currently happen with driver-managed cars, e.g., when the pedestrian is standing on the roadway in dark conditions or oncoming traffic is approaching in the same lane, are likely to be avoided if HAVs can identify the pedestrian earlier than the human driver currently does. Evasive action (e.g., steering the vehicle to other driving path) could be another option to avoid the collision with a pedestrian in front, but at the same time, the vehicle may hit oncoming vehicles or some other obstacles. If the HAV is able to assess different options for crash avoidance and the crash is not avoidable, ethics involving the decision-making is another challenge, as e.g., Lin [32] has discussed. However, the approach, i.e., how the HAVs are going to operate, has a notable impact on the outcomes, and thus, the operation principles should be widely discussed from various perspectives.

Other Pedestrian Crashes
The analyzed other pedestrian crashes included a wide range of different types of crash scenes (e.g., crashes, where the car drifted out of lane, reversing and parking area crashes, and suicidal acts) despite the low amount of crashes analyzed (14). The versatility of the cases makes them difficult to consider in HAV development, because there are numerous situations which could take place with pedestrians. It was assessed that 11 of 14 other pedestrian crashes were likely preventable by HAVs prioritizing pedestrian safety as well as in the prioritizing efficient traffic flow approach.
Some of the reversing and parking area crashes could already be avoided with partially automated vehicles, e.g., with parking assistance or AEB systems. However, HAVs may not be able to prevent some of the other pedestrian crashes at all or at least in the early stage of HAVs implementation. For instance, the crash in which a pedestrian was under the vehicle when the car started to back up was assessed to be likely unpreventable in this study, but such a crash scene could be preventable in a longer term as the sensors would develop and also recognize objects under the vehicle. Additionally, crashes with suicidal behavior can remain difficult to be avoided by vehicle automation. The suicidal crashes caused by the driver can be prevented only if the driver cannot bypass the driving automation system. Overall, the group of other pedestrian crashes includes a wider range of cases compared to two other groups, and hence it is possible that crashes in this group are the last remaining unavoidable crashes when HAVs develop and become prevalent.

General Discussion
In this study, the prioritizing pedestrian safety approach referred to the principle that if an HAV would not be sure about the pedestrian's intention to cross the street when the pedestrian is walking or standing nearby the roadway, the HAV would always slow down or stop as a safety precaution. Although this mode aims to maximize pedestrian safety, it can also cause unnecessary decelerations or stops, which influences the flow of traffic and may increase the risk of rear-end crashes in traffic including both automated and conventional, driver-managed vehicles. This raises the question, would the drivers be willing to decrease speed similarly as the HAV could do to maximize pedestrian safety? If adopting lower speeds, the human drivers would also have more time to react to obstacles and make an evasive action. In urban traffic, especially in residential areas, lowering the speed limit from 40 to 30 km/h has become widespread [33], which allows both current driver-managed and future automated vehicles more time to recognize nearby pedestrians and make an evasive action in different scenarios. Slowing down as precaution on the roads, which have been designed for high volume of motor vehicle traffic, may not be acceptable by drivers. Consequently, HAVs may not be able to avoid all crashes at these streets if not decreasing their speed when pedestrians are recognized.
As different modes and policies in HAVs' operation are possible, it is not certain that all HAVs by different manufacturers and in different traffic environments would be programmed to operate according to a similar policy. To avoid misunderstandings, as well as undesired and unexpected outcomes, an integrative regulation for HAVs' operation is important to implement. As HAVs would replace drivers and thus reduce driver error, errors made by pedestrians and other road users, e.g., cyclists, remain. In addition, the persons requiring special attention (e.g., visually impaired people, elderly, and children) should be taken into consideration in the operation of HAVs.
In the encounters between pedestrians and HAVs (e.g., when a pedestrian crosses a street), the possibility to avoid a collision is affected by the HAV's speed and whether the HAV decelerates as a precaution before the pedestrian steps to a roadway (e.g., pedestrian safety approach). If the HAV decelerates in advance to the reduce crash risk, the flow of traffic is affected. If we want HAVs to be able to avoid all pedestrian crashes, the flow of traffic is greatly compromised. What should be the balance between these two ambitions? What level of safety do we accept? What is the traffic flow we are not willing to compromise? The HAV could e.g., calculate its speed so that is able to make a full stop before the crash with a certain deceleration which would also be acceptable from the HAV's passenger's point of view. It could also calculate that in case of pedestrian crash the impact speed would be below a threshold value (e.g., 10 km/h), but even with a low impact speed preventing fatal consequences is not certain. By accepting some other level than zero fatalities, we are not fulfilling vision zero, which sets the target of no deaths or serious road injuries, and thus is in conflict with the vision adopted in many countries and e.g., a long-term strategic goal of the EU [34]. In addition to safety and traffic flow, there are many other objectives in traffic and the whole transport system which need to be considered and discussed to form a compromise about.

Conclusions
Different ambitions, e.g., prioritizing pedestrian safety and ensuring efficient traffic flow, related to automated driving are a challenge to the realization of high-pitched hopes on HAVs' safety potential. This study complements the discussion on aspects to be considered in the development of highly automated vehicles in relation to pedestrian traffic by the developers of HAVs, authorities, decision makers, and others. The 40 case-by-case analyzed fatal pedestrian crashes from 2014-2016 in Finland reveal the complexity of pedestrian safety in relation to HAV development.
Of the 40 fatal crashes analyzed in this study, 28 would likely have been avoided if HAVs had been involved instead of driver-managed cars, and the HAVs operated according to the prioritizing efficient traffic flow approach. If, instead, pedestrian safety would be prioritized, nearly all analyzed pedestrian crashes (37 of 40 crashes) would likely be avoided. The result in the pedestrian safety approach is also comparable to the study of Detwiller and Gabler [15], which evaluated that 95% of the pedestrian injury crashes could be avoided by the HAVs. Although pedestrian safety is clearly better in this approach, this is not an obvious choice to implement as such, because e.g., the flow of traffic would be affected. Traffic is a compromise of many factors and hence, safety cannot be prioritized over other ambitions without proper considerations. In different traffic environments (e.g., urban areas and rural roads), the different ambitions are likely to lead to diverse solutions, e.g., where there is a large number of pedestrians or vehicles.
The analysis is based on a relatively small number of crashes and on the hypothetical evaluation of HAVs' possibilities to prevent crashes. This presents uncertainty in the numbers presented in this analysis, but simultaneously highlights many important aspects, which affect the potential and limitations of HAVs. It should be noted that the assessment of crash avoidance is hypothetical as all factors cannot be considered and we do not know how the HAV would be able to operate in different crash scenes. For instance, in some likely unpreventable or unclear crashes, fatal consequences could potentially have been avoided due to smaller impact speed. Additionally, the assumptions made in the study, especially that the HAVs are able to operate faultlessly and reliably in all circumstances, e.g., poor weather and darkness, require developing HAV technology and should be acknowledged and studied further in future.
This study shows that the potential safety effects of highly automated vehicles are dependent on many factors, of which other road users' behavior is one of the most important. Regardless of the approach and policy that HAVs adopt, crash prevention should consider a wide array of issues. Further studies should carry on the research and discussion involving the interaction between HAVs and other road users, indicate potential challenges, and propose solutions in these encounters. A larger amount of studied crashes would probably raise more issues into awareness, and with a quantitative approach also statistical analysis could be applied. Future studies should also address other ambitions besides safety and traffic flow, which need to be considered in addition to approaches discussed in this study. Studies should also look into the wider impacts on transport systems, besides pedestrian safety.