Abstract
This study presents a taxonomy for classifying the limitations of Advanced Driver Assistance Systems (ADAS) based on both system characteristics and cues observable to drivers. The taxonomy includes four dimensions: source of uncertainty, operational domain, constraint mechanism, and cue type. It was developed using existing safety frameworks and applied to two real-world datasets: Tesla crash summaries and selected National Highway Traffic Safety Administration (NHTSA) incident reports. The taxonomy identified eight types of limitations and classified each case based on the type of system limitation involved, such as perception failures due to the environment or control issues during interactions with other road users. Results show differences in limitation patterns across datasets and highlight cases that resist clear classification, such as phantom braking. By linking system limitation types with cues observable to the driver, this taxonomy can support the design of driver interfaces and training materials that help users understand when the system may not perform as expected.
Keywords
Introduction
Advanced Driver Assistance Systems (ADAS) enhance road safety, but they have inherent limits that drivers must understand to use them appropriately. Safety standards, such as ISO 26262 (International Organization for Standardization, 2018), focus on eliminating risks caused by system failures or malfunctions. In contrast, ISO 21448 (International Organization for Standardization, 2022), known as Safety of the Intended Functionality (SOTIF), addresses hazards that may arise even when the system functions as designed but encounters limitations in uncertain environments. These limitations often stem from external factors and cannot always be eliminated through design alone. A structured classification of system limitations may help anticipate and mitigate risks in these unsafe scenarios.
Based on the SOTIF approach, this research develops a taxonomy to classify SAE Level 2 ADAS limitations across four dimensions: uncertainty source (environmental or traffic interaction), operational domain (perception & planning or vehicle control), constraint mechanism (external or internal), and cue type (precursor cue or limitation cue). The proposed taxonomy was applied to two empirical datasets to analyze ADAS limitations, demonstrating its applicability in classifying real-world system behavior.
Background
ADAS limitations arise from various sources during normal operation. While prior research has focused on internal system factors (Kinoshita et al., 2015; Tang et al., 2025), understanding external uncertainties is important for helping drivers respond appropriately when system performance is degraded. This challenge can be addressed from multiple perspectives. The proposed taxonomy integrates three analytical perspectives. Safety analysis examines how external conditions create functional challenges. Control theory focuses on how limitations emerge from control structures and feedback mechanisms. Cognitive systems engineering addresses how environmental and informational constraints shape system behavior. Together, these perspectives capture distinct aspects of ADAS limitations and support a more comprehensive understanding of system performance.
Fault Tree Analysis (FTA) provides a top-down safety perspective by identifying combinations of conditions that lead to system-level limitations. Within taxonomy, it represents the safety analysis dimension. In the context of ADAS, FTA has been applied to identify contributing factors to system limitations (Chen et al., 2023). By decomposing system behavior, it reveals how multiple conditions interact to produce functional limitations, offering insight into how system-environment interactions affect performance.
Systems-Theoretic Process Analysis (STPA), derived from the System-Theoretic Accident Model and Processes (STAMP; Leveson, 2015), views safety as a control problem. It analyzes how inadequate control actions or flawed feedback mechanisms lead to system limitations. When applied to automated vehicles, STPA highlights how misaligned feedback loops and control logic errors contribute to performance issues, underscoring the importance of operational domains in understanding system behavior (Junfeng et al., 2022).
Cognitive systems engineering introduces the concept of “contextual constraints,” referring to how environmental and informational factors limit system behavior (Kandefer & Shapiro, 2008). This perspective within the taxonomy emphasizes that system behavior is influenced not only by internal logic but also by how the environment is interpreted. Contextual constraints are categorized as external (e.g., sensor blocking) or internal (e.g., processing delays or incomplete state estimation). Recognizing these constraints helps explain why some limitations persist despite correct system design.
Each approach addresses a different aspect of system behavior, including external conditions, control structure, and cognitive interpretation. However, existing frameworks do not explain how limitations are recognized by drivers or systematically organized across perspectives. The proposed taxonomy addresses this gap by integrating these frameworks into a structured classification. It also highlights system-level features that may be observable to drivers, enabling future research on how drivers interpret and respond to limitations.
Approach
The taxonomy integrates FTA, STPA, and contextual constraint theory, following the structure of an abstraction hierarchy (Rasmussen, 1985). This hierarchy organizes ADAS limitations across four dimensions, moving from high-level sources of uncertainty to specific ways in which limitations restrict the system’s ability to interact with the environment or execute internal functions. Each dimension reflects a different theoretical perspective. The first three dimensions follow a top-down structure. The source of uncertainty defines the environmental or interactive conditions under which system limitations arise. The operational domain specifies whether the affected function involves perception and planning or vehicle control. The constraint mechanism describes how the system is limited, either through blocked interaction with the environment or insufficient internal processing. This structure reflects a diagnostic approach that begins with the initiating condition, proceeds through the affected domain, and ends with how the limitation constrains system behavior.
The first dimension identifies the source of uncertainty, including environmental factors such as weather, lighting, and infrastructure, and traffic interactions involving other road users. This classification is based on our FTA of selected National Highway Traffic Safety Administration (NHTSA) ADAS incident reports (NHTSA, 2024), which showed that these two sources contributed to scenarios where system limitations emerged (Figure 1). Sources were grouped based on whether the initiating factor was environmental or traffic related. The source of uncertainty indicates where system limitations begin and serves as a logical starting point for the taxonomy’s top-down structure.
Fault tree analysis of ADAS-related unsafe scenarios using NHTSA incident reports. The analysis identifies environmental factors and traffic interaction limitations as high-level contributing factors to ADAS-related crashes.
The second dimension addresses the operational domain, distinguishing between perception and planning feedback limitations (e.g., errors in interpreting external data) and vehicle control action limitations (e.g., difficulties in executing maneuvers). This classification was derived from STPA by modeling the system control structure and identifying unsafe control actions across functions. Actions involving sensing and decision-making were grouped under perception and planning, while those involving longitudinal and lateral control were categorized as vehicle control.
The third dimension characterizes constraint mechanisms, defined as the specific ways in which limitations prevent the system from completing an intended action. Drawing on the concept of contextual constraints from cognitive systems engineering, this dimension distinguishes between constraints that prevent interaction with the external environment and those that disrupt internal processes. Each case was reviewed to determine whether the limitation restricted external interaction, such as through occlusion or traffic obstruction, or internal operations, such as planning or control execution.
The fourth dimension focuses on observable cues, describing how system limitations become perceptible to drivers, rather than the underlying characteristics of the limitations themselves. Unlike the first three dimensions, which define structural aspects of the limitation, this dimension catalogs empirical or hypothetical cues that were identified in each case and reflect what the driver might notice in real time. Cue types are categorized as system or environmental features that are perceptible to drivers. This includes precursor cues that indicate potential limitations (Piccinini et al., 2020; Schwarz et al., 2023) and limitation cues that suggest a limitation has already occurred (Matsuo et al., 2024; Mole et al., 2020). Cues were coded based on their timing relative to the limitation. Those that appeared before were classified as precursors, and those that appeared at or after the onset were classified as limitation cues.
Taxonomy was applied to 36 Tesla accident reports (Wikipedia, 2024) and 20 selected cases from 3,122 NHTSA ADAS incidents (NHTSA, 2024) to evaluate its applicability for classifying real-world system limitations and identifying common patterns. Exclusions included duplicate reports (n = 1,217), non-ADAS cases (n = 204), out-of-domain cases (n = 63), unavoidable crashes (e.g., rear-impact) (n = 298), and narrative-lacking reports (n = 1,282). While the sample size was limited, only cases with a detailed description of system limitations were included. The taxonomy was used to examine both observed and anticipated limitations and to identify recurring system behavior across uncertain real-world conditions.
Results
The proposed taxonomy organizes system limitations into eight types (2 × 2 × 2) by combining the first three dimensions (Figure 2): uncertainty source, operational domain, and constraint mechanism. These types represent distinct ways in which ADAS performance may be constrained during real-world operation. This section describes how each type can be interpreted through scenario-based examples, followed by an application of the taxonomy to classify real-world ADAS incident reports.
Taxonomy for ADAS unsafe scenarios. Solid boxes represent categories within each dimension, and dashed boxes provide illustrative examples. This hierarchical taxonomy categorizes unsafe scenarios based on system limitations, starting from Dimension 1 (Source of Uncertainty) and refining through Dimension 2 (Operational Domain) and Dimension 3 (Constraint Mechanism). Numbers under Dimension 3 indicate the distribution of classified cases from two datasets, with proportions given separately for each dataset. The values in parentheses represent the actual sample sizes. Once a case is classified, Dimension 4 (Cue Type) is used to catalog observable precursor and limitation cues associated with each scenario.
Limitation Types by Scenario
Each of the eight types is illustrated below with brief descriptions and examples that reflect how these limitations may arise in realistic driving contexts (Figure 2; Examples).
Type 1 (Environmental, Perception & planning, External) indicates limitations where environmental factors prevent the system from receiving accurate information for interpretation. For example, dense fog (source of uncertainty: environment) limits the system’s ability to detect external objects such as a crossing gate (operational domain: perception & planning feedback) by blocking access to relevant environmental information (constraint mechanism: external), which prevents a timely system response.
Type 2 (Environmental, Perception & Planning, Internal) indicates limitations where environmental conditions interfere with how the system processes incoming information for interpretation or planning. For example, uncertainty in sensing lane markings on a complex road structure (source of uncertainty: environment) contributes to planning limitations (operational domain: perception & planning feedback) by constraining information processing (constraint mechanism: internal), resulting in incorrect path generation and potential collision.
Type 3 (Environmental, Vehicle control action, External) involves limitations where environmental conditions reduce the system’s ability to execute control actions. For example, icy roads (source of uncertainty: environment) can hinder braking or steering (operational domain: vehicle control action) by physically restricting how the system interacts with the road surface (constraint mechanism: external).
Type 4 (Environmental, Vehicle control action, Internal) refers to limitations where the system detects changes in the environment but fails to compensate with internal constraints. For instance, while driving on a road where lane markings become unclear (source of uncertainty: environment), the system fails to maintain the intended trajectory (operational domain: vehicle control action) with steering adjustments constrained at the control level (constraint mechanism: internal) and crashes into a steel guardrail.
Type 5 (Traffic interaction, Perception & planning, External) involves cases where other road users interfere with the system’s ability to perceive the environment. For example, a passing truck (source of uncertainty: traffic interaction) blocks the system’s view of a crossing pedestrian, preventing the detection entirely (operational domain: perception & planning feedback) by limiting access to external visual input (constraint mechanism: external).
Type 6 (Traffic interaction, Perception & planning, Internal) refers to limitations where the system detects other road users but fails to interpret or process the information correctly. For example, a large truck crossing the road (source of uncertainty: traffic interaction) is detected but not classified as an obstacle or vehicle (operational domain: perception & planning feedback), preventing an appropriate response (constraint mechanism: internal).
Type 7 (Traffic interaction, Vehicle control action, External) describes scenarios where surrounding traffic interferes with the system’s ability to execute control actions. For example, a sudden cut-in (source of uncertainty: traffic interaction) blocks a planned lane change (operational domain: vehicle control action), leaving the system unable to carry out the intended maneuver (constraint mechanism: external).
Type 8 (Traffic interaction, Vehicle control action, Internal) reflects limitations where the system responds (operational domain: vehicle control action) to traffic but produces insufficient control. For instance, the system responds to an imminent collision with other vehicles (source of uncertainty: traffic interaction), but its steering and braking adjustments are limited (constraint mechanism: internal), leading to a collision.
Applying Taxonomy to Incident Data
The analysis revealed patterns in the distribution of limitation types across datasets. The taxonomy was applied to ADAS crashes from Tesla and NHTSA datasets (Figure 2). Among Tesla incidents, 64% were classified as Type 6 (source of uncertainty: environment, operational domain: perception & planning feedback, constraint mechanism: external), highlighting challenges in detecting and classifying road users beyond moving passenger cars. In contrast, 35% of NHTSA-reported incidents were classified as Type 1 (source of uncertainty: environment, operational domain: perception & planning feedback, constraint mechanism: external), involving environmental conditions such as unexpected animal appearances. No cases were classified under Type 7 (source of uncertainty: traffic interaction, operational domain: vehicle control action, constraint mechanism: external). This could be due to reporting bias or the nature of ADAS limitations in real-world scenarios.
Additionally, two sudden lane departures on low-traffic highways in the NHTSA report could not be classified due to a lack of external cues, making it unclear whether they resulted from interactions with other road users or environmental factors. A similar challenge arises with phantom braking, a commonly reported case in which the system brakes without a clear external hazard, though it was not reported in the analyzed dataset. Similar to the unclassified lane departures, phantom braking lacks clear external triggers, making it difficult to classify within the current taxonomy. These system-induced limitations blur the boundary between normal functionality and unexpected system responses, complicating classification. The results indicate that the proposed taxonomy can categorize ADAS limitations consistently across different datasets, providing a structured approach to analyzing system limitations.
In addition to classifying system limitations, the taxonomy also captures how such limitations may become observable to drivers. Dimension 4, which describes cue types, was applied separately to identify signals that might help drivers recognize limitations in real time (Figure 2; Dimension 4. Cue Type). Precursor cues often indicated growing risk prior to a system constraint. For example, complex road markings and broken lane lines were observed in cases involving planning errors, while fog and nighttime visibility preceded limitations in object detection. In contrast, limitation cues reflected constraints already reached. These included irregular steering, traction loss, or the absence of expected adjustments in braking or path control. These patterns suggest that observable cues can help explain how drivers might detect system limitations.
Conclusion
This research develops a taxonomy to classify ADAS limitations and examines its applicability using real-world crash data. The classification differentiates environmental factors and traffic interactions as sources of uncertainty and examines how limitations relate to perception, planning, and control. Perception-related cases often involved occlusions (external constraints) and classification (internal constraints) issues, while control-related cases more frequently included insufficient tire-road friction (external constraints) and execution gaps (internal constraints). These patterns reflect how system behavior varies across environmental and traffic conditions.
The proposed taxonomy can support ADAS human-machine interface design by identifying limitations that may benefit from clear driver communication. For instance, precursor cues related to environmental perception limitations (e.g., unclear lane markings) could be made visible to prompt earlier driver’s attention or preparation for system disengagement. It can also inform driver training by clarifying how different types of constraints affect system performance and by defining operational boundaries more explicitly.
The taxonomy was applied to the dataset using a single researcher supported by AI-based tools. To strengthen its validity, future work should include an inter-rater reliability assessment involving multiple human raters. By structuring system limitations and integrating observable cues, taxonomy aids in analyzing ADAS behavior under uncertainty. Future research should explore how drivers interpret and respond to limitation cues in real-world scenarios. As a next step, a follow-up study will develop a driver expectation taxonomy, which will connect system limitations with driver behavior through the mediating role of cue types.
Footnotes
Declaration of Conflicting Interests
The author(s) declared no potential conflicts of interest with respect to the research, authorship, and/or publication of this article.
Funding
The author(s) received no financial support for the research, authorship, and/or publication of this article.
