Foreword. This Test Protocol is new in the VRS 2026 edition and is the Transportation sector’s extension of VRS-GEN-203, the intrinsic demonstration protocol. It is a regulated sector: the lawful-operation status of a road vehicle — its type approval, permit or exemption, and its safety case — is documentary and is scored from the pack; this Protocol does not re-examine it and no mark here is evidence of it. What it witnesses, on a closed course the manufacturer or its test partner provides, is the behaviour that decides whether an automated vehicle is safe among other road users: whether it refuses to operate outside its domain, what it does when it faults at speed, whether it sees a pedestrian target coming out from behind a parked van and a cyclist alongside, in daylight and at the edge of its lighting envelope, how a remote operator can help it and what happens when that link dies, and whether its recorder captured what just happened. Every target is a soft target on a rig; no person is on the course during a moving step other than a declared on-board attendant. The Protocol carries only what the intrinsic steps do not already witness. Steps run between Parts E and F of VRS-GEN-203, in the same session, on the same feed, into the same export. Standards carry no step identifiers; every step here names the VRS-TRN-201 subclause that requires it. As a protocol it is versioned vX.Y.Z (VRS-GEN-004 §5.4). Requirements use “shall”.
Introduction
The Transportation anchor set is the automated-driving safety framework — the UNECE regulations for automated lane keeping, cyber-security management and software updates, the functional-safety and safety-of-the-intended-functionality standards, the operational-design-domain taxonomy — and the closed-course test methods the consumer-rating and research communities have developed with soft targets for pedestrians and cyclists. The regulators and the rating programmes already run tests of this kind; what the Certified tier adds is that the rated model’s behaviour has been witnessed, on the manufacturer’s stock configuration, by an observer who did not build it, and recorded so that a reviewer can score it from the Session Record.
The closed course is the manufacturer’s or its test partner’s; the Protocol sets no speed, distance or target dimension of its own — every value is the manufacturer’s declaration. The vulnerable-road- user steps use soft targets on propulsion rigs, as the established test methods do. The remote- assistance steps use the manufacturer’s own operations console and cut the link with the manufacturer’s own means. The recorder step closes the loop: the manoeuvres just witnessed must appear in the vehicle’s own event data.
1 Scope
This Protocol specifies the Transportation / On-road Autonomous demonstration steps by which the criteria of VRS-TRN-201 Clause 6 are demonstrated at the Certified tier, for every application class of VRS-TRN-201 §7.3 (robotaxi · autonomous truck · low-speed shuttle · sidewalk delivery). It applies to every Certified Transportation / On-road Autonomous assessment, by every Certified route of VRS-GEN-003 §6.9.
It specifies: how this Protocol relates to VRS-GEN-203 (Clause 4); the envelope the manufacturer declares before the session (Clause 5); the steps (Clause 6); and a worked example (Clause 7). Annex A maps every VRS-TRN-201 criterion to its intrinsic steps, its sector steps, or neither.
It does not: repeat any session requirement, step, marking rule or record rule of VRS-GEN-203, all of which apply unchanged; define any criterion, point, ceiling or ladder (VRS-TRN-201); or define the Transportation / On-road Autonomous information pack (VRS-GEN-013). Every moving step is on a closed course; every vulnerable-road-user target is a soft target on a rig; no person is on the course during a moving step other than a declared on-board attendant. Lawful-operation status and the safety case are documentary and are scored from the pack.
2 Normative references
-
VRS-GEN-203, Demonstration Protocol — Intrinsic — session requirements (Clause 4), step rules (Clause 5), marks and scores (Clause 7), Session Record (Clause 8), all of which apply to this Protocol.
-
VRS-TRN-201, Transportation / On-road Autonomous — AR Assessment Protocol — the criteria whose Certified rows this Protocol serves; application classes (§7.3).
-
VRS-TRN-001, Transportation / On-road Autonomous Sector Standard — the declared envelope and class fields.
-
- VRS-GEN-101, Safety — the intrinsic safety criteria the Transportation pool contributes to.
-
- VRS-GEN-102, Reliability & Durability — the intrinsic fault-recovery step that serves part of VRS-TRN-201 §6.6.
-
- VRS-GEN-105, Cyber Posture — the intrinsic steps that witness parts of VRS-TRN-201 §6.5 and §6.7.
-
VRS-GEN-003, Governance Charter and Independence — Certified routes and route parity (§6.9).
3 Terms and definitions
Terms defined in VRS-GEN-001 and VRS-GEN-203 apply. In addition:
3.1 closed course — a road-like test area closed to public traffic, provided by the manufacturer or its test partner, marked with the shoulder, envelope boundary and stopping-distance marks the steps require.
3.2 operational design domain — the declared set of road types, speeds, weather, lighting and geographic conditions within which the vehicle is designed to operate.
3.3 minimal-risk manoeuvre — the declared behaviour on fault, domain exit or link loss: pull-over to the shoulder or stop-in-lane with hazard signalling, within a declared distance.
3.4 soft target — a deformable pedestrian or cyclist target of declared dimensions on a propulsion rig, standing in for a vulnerable road user.
3.5 remote assistance — the declared operations-centre function by which a remote operator guides a stopped vehicle within declared authority limits.
3.6 on-board attendant — a declared safety driver or attendant who may receive a takeover request.
3.7 event data recorder — the vehicle’s declared recorder of the fields captured around a fault, manoeuvre or event, for a declared pre- and post-event window.
3.8 recovery response — the declared time within which a stranded vehicle is cleared from the lane by the declared means.
4 Relationship to the intrinsic protocol
4.1 This Protocol shall be run only as part of a session under VRS-GEN-203. Every requirement of VRS-GEN-203 Clause 4 applies to every step here without repetition or exception.
4.2 Position in the session. The steps of Clause 6 shall run after VRS-GEN-203 Part E and before VRS-GEN-203 Part F, so that one continuous recording and one export cover both protocols. The endurance sample opened in VRS-GEN-203 Part C continues to run through this Protocol.
4.3 Step identifiers. Steps shall carry identifiers of the form TRN-110.nn; they are Session
Record step identifiers under the same rules as VRS-GEN-203 §5.1 and shall never be reused.
4.4 Required by. Every step shall name the VRS-TRN-201 subclause(s) whose Certified row it serves. VRS-TRN-201 carries no reference back to this Protocol.
4.5 Classes and declared subjects. Each step lists the application classes it applies to. A step whose class is not in the assessed envelope shall not be run. A step whose subject the manufacturer has not declared shall be marked not declared and has no effect on any score (VRS-GEN-203 §3.10). Parts 1, 2, 3 and 6 shall be run for every Transportation assessment; the takeover step only where an on-board attendant is declared.
4.6 Bound. The sum of step bounds for one class shall not exceed 120 min. Marks, failure, declined steps, continuation sessions and the Session Record follow VRS-GEN-203 Clauses 5, 7 and 8.
4.7 Criteria witnessed by intrinsic steps. Where a sector criterion’s Certified row is already witnessed by intrinsic steps, Annex A names them and the criterion is scored from those marks together with any sector steps listed. VRS-TRN-201 §6.1 (lawful-operation status and safety case) is documentary and has no step; nothing witnessed under this Protocol is evidence of regulatory standing.
4.8 Course and people. Every moving step shall be run on the closed course; no person shall be on the course during a moving step other than the declared on-board attendant in the declared seat; every vulnerable-road-user target shall be a soft target on a rig (VRS-GEN-203 §4.8). A step so performed shall be marked not achieved and the ground recorded.
4.9 Regulatory standing. Nothing witnessed under this Protocol shall be presented as evidence of, or a substitute for, type approval, permit, exemption or safety-case acceptance, and no mark shall alter the documentary scoring of VRS-TRN-201 §6.1.
4.10 Admissibility of a mark. A step’s mark shall be inadmissible, and the step shall be marked not achieved, where the dimension, mass, speed, force or condition it depends on was not shown on camera, or where the configuration demonstrated differs from the assessed one. The observer shall record the ground.
5 The declared envelope
5.1 Before the session the manufacturer shall have declared, in the information pack and per assessed application class: the application class; the operational design domain and the test input that sets a condition outside it; the declared test speed (km/h) and maximum operational speed; the minimal-risk manoeuvre and its distance (m) for fault and for link loss; the obscuration degree and lighting or weather boundary (lux); the soft-target profiles (adult, child, cyclist — mm) and crossing speeds (m/s); the remote-assistance authentication, authority limits and latency; whether an on-board attendant is declared and the takeover time (s); the update and rollback mechanism; the roles, location-data retention and destinations, and any staged external message; the recovery means, points and response time (min); and the event-data-recorder fields and window (s).
5.2 Every apparatus in Clause 6 shall be sized from those declarations and no other source (VRS-GEN-203 §4.7). A parameter not declared makes the steps that depend on it not declared (4.5); a manufacturer that declares a smaller envelope demonstrates a smaller envelope and is scored against it under VRS-TRN-201.
5.3 The declared envelope shall match the one recorded for the rating (VRS-TRN-001, VRS-GEN-009); a step demonstrated at a value other than the declared one shall be inadmissible (4.10).
6 The steps
Columns: ID — Session Record step identifier · Step — outcome to witness · Classes — application classes the step applies to (4.5) · Witness — means (VRS-GEN-203 §3.13) · Apparatus — manufacturer-supplied, at declared value · Bound — minutes · Required by — VRS-TRN-201 subclause(s) served.
6.1 Part 1 — Operational-design-domain discipline and minimal-risk manoeuvre
The vehicle refuses to work outside its domain and stops safely when it faults inside it — at speed, on the course, against marks.
| ID | Step | Classes | Witness | Apparatus | Bound | Required by |
|---|---|---|---|---|---|---|
| TRN-110.01 | Operation refused outside the operational design domain. On the closed course the vehicle is commanded to start or continue a mission into a condition outside its declared operational design domain (a road type, speed, weather or lighting value set by the manufacturer’s test input or present on the course); it refuses to start, or brings the mission to a stop, and the console shows the domain boundary and the reason. | all | CAM+FEED | Closed course; manufacturer’s test input for the domain condition | 8 min | Required by VRS-TRN-201 §6.2 |
| TRN-110.02 | Minimal-risk manoeuvre on fault. At the declared test speed on the closed course, a fault is induced by the manufacturer’s own means (sensor disconnect, compute fault, declared test mode); the vehicle performs its declared minimal-risk manoeuvre — pull-over to the marked shoulder, or stop-in-lane with hazard signals — within the declared distance marked on the course; the feed shows the fault, the manoeuvre state and the signals. | all | CAM+FEED+APP | Marked shoulder and stopping-distance marks; manufacturer’s fault-injection means | 10 min | Required by VRS-TRN-201 §6.2 |
| TRN-110.03 | Degraded sensing within the domain. With the primary sensors obscured to the declared degree by the manufacturer’s means, or at the declared lighting or weather boundary present on the course, the vehicle enters its declared behaviour (reduced speed, minimal-risk manoeuvre, refusal); the perception-quality state is shown on the feed. | all | CAM+FEED+APP | Obscurant; declared lighting or weather condition where present | 8 min | Required by VRS-TRN-201 §6.2; §6.3 |
| TRN-110.04 | Speed and envelope limits on the course. The vehicle drives the declared course at its declared maximum operational speed; the feed speed matches the declared value; a command or route that would exceed the declared speed or geographic envelope is refused or limited; the envelope boundary marked on the course is not crossed. | all | CAM+FEED+APP | Course marked at the envelope boundary | 6 min | Required by VRS-TRN-201 §6.2 |
6.2 Part 2 — Vulnerable-road-user detection and response
Soft targets on rigs, as the established closed-course methods use: an adult from behind an obstruction, a child profile, a cyclist, and a repeat at the edge of the lighting envelope.
| ID | Step | Classes | Witness | Apparatus | Bound | Required by |
|---|---|---|---|---|---|---|
| TRN-110.05 | Pedestrian target crossing at speed. At the declared test speed, a soft pedestrian target of the declared adult profile is propelled across the vehicle’s path from behind a visual obstruction at the declared crossing speed; the vehicle detects and stops or avoids before contact; repeated with a child-profile target at the declared smaller size; stopping position shown against course marks. | all | CAM+FEED+APP | Soft pedestrian targets (adult and child profiles) on a propulsion rig; visual obstruction; course marks | 12 min | Required by VRS-TRN-201 §6.3 |
| TRN-110.06 | Cyclist target and night or rain case. A soft cyclist target crosses or is overtaken at the declared speeds and the vehicle responds as declared; the pedestrian crossing is repeated at the declared night-lighting or rain condition present on the course (or the manufacturer’s declared low-light boundary, shown on a light meter), within the operational design domain. | all | CAM+FEED+APP | Soft cyclist target; lighting or rain condition where present; light meter | 10 min | Required by VRS-TRN-201 §6.3 |
6.3 Part 3 — Handover and remote assistance
A remote operator can help a stopped vehicle within limits; when the link dies the vehicle stops itself. Extends the intrinsic remote-access and lost-link steps.
| ID | Step | Classes | Witness | Apparatus | Bound | Required by |
|---|---|---|---|---|---|---|
| TRN-110.07 | Remote-assistance session and authority limits. The vehicle stops at a declared scenario it cannot resolve (blocked lane, unmapped obstacle placed on the course); it requests remote assistance; the remote operator connects with the declared authentication; the console shows the round-trip latency; the operator issues a guidance command within the declared authority and an attempt to command beyond it (a speed or manoeuvre outside the authority) is refused; the vehicle proceeds. | all | CAM+FEED+APP | Remote-assistance console; placed obstacle | 10 min | Required by VRS-TRN-201 §6.4 |
| TRN-110.08 | Remote-link loss during assistance. During a remote-assistance session at the declared test speed, the remote link is cut by the manufacturer’s own means; the vehicle performs its declared minimal-risk manoeuvre within the declared distance and time; the link state and the manoeuvre are shown on the feed when the link is restored. | all | CAM+FEED+APP | Means of cutting the remote link; stopping marks | 8 min | Required by VRS-TRN-201 §6.4; §6.2 |
| TRN-110.09 | Takeover request to an on-board safety driver. Where an on-board safety driver or attendant is part of the declared operation, a takeover request is triggered by the manufacturer’s means; the declared visual, audible and haptic request is shown; the attendant takes control within the declared time and the console records the handover; where no attendant is declared, the step is marked not declared. | all | CAM+FEED | — | 5 min | Required by VRS-TRN-201 §6.4 — Run where an on-board attendant is declared |
6.4 Part 4 — Fleet cyber and software-update governance
Extends the intrinsic update, authentication and telemetry steps with fleet control, rollback, location-data handling and rejection of a spoofed external message.
| ID | Step | Classes | Witness | Apparatus | Bound | Required by |
|---|---|---|---|---|---|---|
| TRN-110.10 | Signed update and rollback under fleet control. The fleet console shows the software configuration of this vehicle and the fleet; a signed update is staged and applied to this vehicle through the declared mechanism with verification and the resulting version shown; an unsigned or tampered package is refused where one can be staged; the declared rollback is executed; every event appears in the security log. | all | FEED | Update package(s) | 10 min | Required by VRS-TRN-201 §6.5 |
| TRN-110.11 | Access controls and location-data handling. Vehicle and fleet functions require the declared role login; default credentials are refused; the console shows what location and sensor data is retained, for how long and where it is sent, matching the disclosure; a vehicle-to-everything or external message with a spoofed or unsigned origin, where the manufacturer can stage one, is shown rejected. | all | FEED | Manufacturer’s staged message where declared | 8 min | Required by VRS-TRN-201 §6.5 |
6.5 Part 5 — Stranded-vehicle recovery
A vehicle stopped in-lane is a hazard to everyone behind it; the recovery is walked through and timed.
| ID | Step | Classes | Witness | Apparatus | Bound | Required by |
|---|---|---|---|---|---|---|
| TRN-110.12 | Stranded-vehicle recovery walk-through. With the vehicle stopped in-lane after a minimal-risk manoeuvre, the declared recovery procedure is performed: hazard signalling and the traffic-blocking mitigation shown, the recovery alert reaching the operations centre on the feed, the declared manual or remote mode used to move the vehicle to the marked shoulder or a tow attachment made at the declared points; time from video against the declared recovery response. | all | CAM+FEED+APP | Declared recovery means (tow vehicle or manual-drive mode); marked shoulder | 12 min | Required by VRS-TRN-201 §6.6 |
6.6 Part 6 — Data-recorder completeness
The recorder must have captured what the observer just watched.
| ID | Step | Classes | Witness | Apparatus | Bound | Required by |
|---|---|---|---|---|---|---|
| TRN-110.13 | Event-data-recorder output for a session event. After the minimal-risk manoeuvres of Parts 1 and 3, the event data recorder’s output for at least one of them is exported and shown: the declared fields (time, position, speed, control mode, fault or trigger, remote-assistance state, sensor summary) are present for the declared pre- and post-event window; times match the recording; the export is uploaded with the session export. | all | EXPORT | — | 8 min | Required by VRS-TRN-201 §6.7 |
6.7 Timing budget. All 13 steps sum to 115 min. Per class, with every applicable step declared: robotaxi 115 min · autonomous truck 115 min · low-speed shuttle 115 min · sidewalk delivery 115 min. Every class is within the 120 min bound of 4.6.
7 Worked example (informative)
A manufacturer of a hypothetical low-speed campus shuttle (class: low-speed shuttle) declares: a domain of mapped campus roads at up to 25 km/h in daylight and lit conditions above 15 lux, dry or light rain; a 20 km/h test speed; pull-over to the shoulder within 25 m on fault, stop-in-lane within 15 m on remote-link loss; adult target 1 800 × 500 mm at 1.5 m/s from behind a parked van, child target 1 100 × 300 mm, cyclist target at 4 m/s alongside; remote assistance by named operator with a 600 ms latency display and authority limited to route guidance at walking pace; no on-board attendant; fleet updates through the depot console with rollback; operator and technician roles; location data retained 30 days and sent to the declared operations server; a depot tow within 20 min; and a recorder capturing 30 s before and 10 s after an event.
After VRS-GEN-203 Part E the sector steps run from 12:40 on the test partner’s closed course. TRN-110.01: the route is edited to include an unmapped road; the shuttle refuses to start, console shows “outside domain: unmapped segment” (achieved). TRN-110.02: at 20 km/h the lidar is disconnected by the test mode; the shuttle signals and pulls over, stopping 19 m on against the 25 m mark (achieved). TRN-110.03: camera half-obscured, reduced to 10 km/h with a perception warning; at 12 lux by the meter, refuses to depart (achieved). TRN-110.04: 25 km/h held on the feed; the envelope line is not crossed; a 30 km/h command is limited (achieved). TRN-110.05: adult target from behind the van at 20 km/h, stop 2.1 m short; child target, stop 1.6 m short (achieved). TRN-110.06: cyclist target overtaken with the declared clearance; adult crossing repeated under the course floodlights at 18 lux, stop (achieved). TRN-110.07: a pallet placed in the lane; the shuttle stops and requests assistance; operator logs in, latency 540 ms shown, guides at walking pace; a 15 km/h command is refused (achieved). TRN-110.08: link cut at 20 km/h, stop-in-lane with hazards in 11 m (achieved). TRN-110.09: not declared. TRN-110.10: signed update applied and rolled back, unsigned refused, logged (achieved). TRN-110.11: technician login required; default refused; location retention shown as 30 days to the operations server; no staged message declared (achieved). TRN-110.12: stranded in-lane, hazards on, alert at the operations console, manual-drive mode to the shoulder in 4 min (achieved). TRN-110.13: recorder export for TRN-110.02 shows the 30 s / 10 s window with speed, mode and the lidar fault at matching times (achieved). Sector time 100 min; VRS-GEN-203 Part F follows.
The reviewer scores VRS-TRN-201 §6.2 from TRN-110.01 to TRN-110.04 and TRN-110.08 with GEN-203.14 and GEN-203.15; §6.3 from TRN-110.03, TRN-110.05 and TRN-110.06 with GEN-203.09 and GEN-203.10; §6.4 from TRN-110.07 and TRN-110.08 with GEN-203.15 and GEN-203.35; §6.5 from TRN-110.10 and TRN-110.11 with the intrinsic cyber steps; §6.6 from TRN-110.12 with GEN-203.28; §6.7 from TRN-110.13 with GEN-203.43 and GEN-203.45; §6.1 and §6.8 from the pack. No number in this example is a requirement; every apparatus value came from the manufacturer’s own declaration.
Annex A (normative) — Criterion coverage
Every criterion of VRS-TRN-201 Clause 6 appears once with the intrinsic steps (VRS-GEN-203) and the sector steps (this Protocol) that witness it, or the statement that it has none.
| Criterion | Subclause | Witnessed by |
|---|---|---|
| TRN-1 Lawful-operation status and safety case | VRS-TRN-201 §6.1 | no step — documentary criterion |
| TRN-2 ODD discipline and minimal-risk manoeuvre | VRS-TRN-201 §6.2 | intrinsic GEN-203.14, GEN-203.15; sector TRN-110.01, TRN-110.02, TRN-110.03, TRN-110.04, TRN-110.08 |
| TRN-3 Vulnerable-road-user detection and response | VRS-TRN-201 §6.3 | intrinsic GEN-203.09, GEN-203.10; sector TRN-110.03, TRN-110.05, TRN-110.06 |
| TRN-4 Handover and remote-assistance quality | VRS-TRN-201 §6.4 | intrinsic GEN-203.15, GEN-203.35; sector TRN-110.07, TRN-110.08, TRN-110.09 |
| TRN-5 Fleet cyber and software-update governance | VRS-TRN-201 §6.5 | intrinsic GEN-203.32, GEN-203.33, GEN-203.34, GEN-203.38; sector TRN-110.10, TRN-110.11 |
| TRN-6 Service availability and stranded-vehicle recovery | VRS-TRN-201 §6.6 | intrinsic GEN-203.28; sector TRN-110.12 |
| TRN-7 Data-recorder completeness and reporting compliance | VRS-TRN-201 §6.7 | intrinsic GEN-203.43, GEN-203.45; sector TRN-110.13 |
| TRN-8 Collision, disengagement and incident record | VRS-TRN-201 §6.8 | no step — scored at the Certified tier from the Verified evidence |
Bibliography
- UN Regulation No. 157 (2021, as amended 2023), Uniform provisions concerning the approval of vehicles with regard to Automated Lane Keeping Systems.
- UN Regulation No. 155 (2021), Cyber security and cyber security management system.
- UN Regulation No. 156 (2021), Software update and software update management system.
- ISO 26262-1:2018, Road vehicles — Functional safety — Part 1: Vocabulary.
- ISO 21448:2022, Road vehicles — Safety of the intended functionality.
- ISO 34503:2023, Road vehicles — Test scenarios for automated driving systems — Specification for operational design domain.
- ISO 19206-2:2018, Road vehicles — Test devices for target vehicles, vulnerable road users and other objects, for assessment of active safety functions — Part 2: Requirements for pedestrian targets.
- ISO 19206-4:2020, Road vehicles — Test devices … — Part 4: Requirements for bicyclist targets.
- SAE J3016:2021, Taxonomy and Definitions for Terms Related to Driving Automation Systems for On-Road Motor Vehicles.
- SAE J3197:2020, Automated Driving System Data Logger.
- Euro NCAP, Test Protocol — AEB/LSS VRU systems, v4.5 (2024).
Change history
| Date | Version | Status | Change | Authority |
|---|---|---|---|---|
| 2026-09-16 | 1.0.0 (draft) | Draft | Created for the VRS 2026 edition (rewrite Batch D; sector demonstration protocol). 13 steps in 6 Parts extending VRS-GEN-203 for the Transportation / On-road Autonomous criteria of VRS-TRN-201: domain refusal, minimal-risk manoeuvre on fault, degraded sensing within the domain, speed and envelope limits, soft pedestrian targets (adult from occlusion, child profile), cyclist and night-or-rain case, remote assistance with authority limits, remote-link loss, takeover where an attendant is declared, signed update and rollback under fleet control, access controls and location-data handling with spoofed-message rejection, stranded-vehicle recovery timed, event-data-recorder output for a session event. Closed course only; soft targets only; regulatory standing documentary. Annex A covers all 8 criteria. | Rewrite instructions §6 (VRS-XXX-110); sector traceability matrix (TRN derived demonstration steps); CEO ruling 2026-09-15 that standards carry no catalogue identifiers |