Dynamic Safety Analysis of Longitudinal Motion Planning for Autonomous Vehicles

Full text

February 27, 2019 22:0 RPS/Trim Size: 221mm x 173mm for Proceedings/Edited Book esrel2019˙ID101
DYNAMIC SAFETY ANALYSIS OF LONGITUDINAL MOTION PLANNING FOR
AUTONOMOUS VEHICLES
Antoine TORDEUX
Division Traffic Safety and Reliability, University of Wuppertal, Germany. E-mail: tordeux@uni-wuppertal.de
Basma KHELFA
Division Traffic Safety and Reliability, University of Wuppertal, Germany. E-mail: khelfa@uni-wuppertal.de
The main motivations for driving automation of road vehicles lie in safety aspects. Indeed, most road accidents
are due to human errors that could be avoided by using driving automation systems. Yet accident rates by unit of
distance traveled in conventional traffic are extremely small quantities. The demonstration of safety enhancement by
automation of the driving is currently actively debated. Even basic longitudinal motion planning, i.e. adaptive cruise
control (ACC) systems, require rigorous demonstration of their safety. Classical linear speed planners are feedback
and relaxation processes for the time gap, based on the distance ahead and the speed of the preceding vehicle.
Their active safety is tackled thanks to stability analysis. Generally speaking, stability occurs if the relaxation is
sufficiently strong. Unfortunately, the acceleration rates and jerks with stable classical speed planners can exceed
the bounds recommended by the ISO standard and lead to unsafe dynamics. We propose a novel nonlinear speed
planner for ACC systems. The model provides safe and comfortable speed regulations for various driving situations.
Reasons are stability properties of the new planner, that hold for any relaxing order. We discuss applications of the
car-following model for ACC systems and the robustness of the stability property to mechanical and computational
latencies or noise and measurement errors.
Keywords: Autonomous and connected car, Adaptive cruise control, Nonlinear planner, Dynamic safety analysis,
Stability analysis, Robustness analysis, Noise and latency.
1. Introduction
Nowadays, the driving automation of road vehi-
cles is going well. Advanced driver-assistance
systems (ADAS) allow partial driving automation
under driver supervision and in particular driv-
ing situation (mainly on highways), while au-
tonomous or self-driving cars start to be tested in
real situations (see Verband der Automobilindus-
trie e.V. (2015a) and Fig. 1). The main motiva-
tions for driving automation of road vehicles lie
in safety aspects. Indeed, more than 90% of road
accidents are attributed to driver errors (among
which 41% recognition error, 33% decision error,
11% performance error, 7% sleeping/distracted
driver, see Singh (2014)) that could be avoided by
using driving automation systems. Other motiva-
tion factors for driving automation come from per-
formance and economic arguments (with short-
spacing driving, platooning and optimal use of the
road networks), or gain of mobility (for children,
old persons and persons without driving license)
and the development of car share-use models (Lit-
man, 2018).
The driving automation of road vehicles is clas-
sically classified in six levels (SAE International,
2018). The automation has no vehicle control
at level L0, but it may issue warnings. Level
L1 corresponds to assistance systems (e.g. adap-
tive cruise control, lane keeping). Level L2 is
an automation of longitudinal and lateral motion
including lane changing for specific situations
(mainly on highways). The levels L0, L1, and L2
operate under driver supervision. Further levels
are L3 for conditional automation (human driver
may have to respond appropriately to a request),
L4 for automation in defined use cases and L5 for
full automation for all roadway and environmental
conditions. The levels L3 to L5 operate without
driver supervision and the system is responsible
in case of hazard, unexpected events or failures.
Accident rates by distance traveled in conven-
tional traffic are extremely small quantities. Con-
sequently, empirical demonstrations of the safety
of autonomous vehicles are difficult to carry out
(Kalra and Paddock, 2016). The demonstration of
safety enhancement by driving automation with-
out supervision is currently actively debated. In-
deed, driving is highly dynamic, and the driv-
ing situations are extremely various, especially in
urban situations. Exhaustive static listing of all
driving situations and hazards in urban and peri-
urban contexts at automation levels L3, L4 or L5
are in practice not possible (Bergenhem et al.,
Proceedings of the 29th European Safety and Reliability Conference.
Edited by Michael Beer and Enrico Zio
Copyright c
2019 by ESREL2019 Organizers. Published by Research Publishing, Singapore
ISBN: 981-973-0000-00-0 :: doi: 10.3850/981-973-0000-00-0 esrel2019˙ID101 1

February 27, 2019 22:0 RPS/Trim Size: 221mm x 173mm for Proceedings/Edited Book esrel2019˙ID101
2Antoine Tordeux, Basma Khelfa
Connectivity
ADAS
Models
Notable projects
LEVELS 0 & 1 LEVEL 2
1950 1970 1990 2000 2010 2020
1965
Radio traffic
information
1989
Navigation system
1991
Cell phone
2002
Bluetooth
2003
Mobile internet
2007
Car-To-Car Consortium
2009
3G network
2015
WLAN ITS G5
1996
2G network
2019
5G network
2020
HD map
1956
Power
steering
1965
Cruise control
1977
ABS
1987
Traction
Control
1994
ESP
1995
Braking
assistant
1998
ACC/FSRACC
2002
Lane dep. warning
2001
Emergency
braking
2005
Parking assistant
2007
Lane keeping
2009
Sign recognition
2015
Highway
driving
2007
Blind-spot
2015
Park assist
2015
Traffic jam driving
··· −→
Levels 3, 4, 5 ?
1952
Wardrop’s
Equilibria
1980
Dynamic traffic assignment
(Merchant & Nemhauser)
TA stability (Smith)
1955
LWR
1963
Follow-the-leader (Pipes)
Linear stability (Kometani)
1971
Payne-Whitham
1968
Multi-ant. (Bexelus)
1988
Lane changing
1990
Optimisation
(Papageorgiou)
1995
OVM
2000
IDM
2000
Nonlinear stability
(Komatsu, Sasa, Wilson)
2002
Micro-Macro derivation
(Aw, Rascle)
2002
Multi-class LWR (Wong & Wong)
2007
GSOM (Lebacque)
2014
Homogenisation
(Monneau, Forcadel)
··· −→
Safe and performant
driving models ?
1984
Navlab
1991
EUREKA
Prometheus
1997
NAHSC
2004
DARPA
Challenges
2010
Google-Car
VIAC Challenge
2016
GCDC ···
Fig. 1. Historical review for the driving automations: Development of communication tools and networks and driver-assistance
systems in the industry in parallel to the development of traffic models and research projects (Verband der Automobilindustrie e.V.,
2015a; Gonz´
alez et al., 2016).
2015; Koopman and Wagner, 2016; Johansson,
2016) Even basic longitudinal motion planning,
i.e. adaptive cruise control (ACC) systems, require
rigorous demonstrations of their safety.
In this article, we first highlight the current
need for development of dynamic approaches to
demonstrate the safety of automated driving. In-
deed, the driving is a movement while road traffic
is a complex system of interacting agents. The
driving automation requires knowledge from com-
plex dynamical systems to demonstrate its safety.
We focus then on the longitudinal motion planning
of the automated vehicle (i.e. ACC and full speed
range ACC systems). We propose a new nonlinear
planner and demonstrate active safety by means of
stability analysis.
2. Safety analysis for autonomous
driving
2.1. Static safety analysis
Classical safety analyses of road vehicle com-
ponents are generally tackled thanks to static
approach such as hazard and operability study
(HAZOP) or failure mode and effects analysis
(FMEA). The functional safety is formulated in
the international ISO standard 26262-2,3:2018
(International Organization for Standardization,
2018b) as a completeness and consistency prob-
lem. One has for all items and all driving situa-
tions to determine for all possible hazards, risk as-
sessments and corresponding functional and tech-
nical safety concepts (safety goals, see Fig. 2).
The exhaustive listing of potential hazards can be
carried out by means of FMEA and classification
of the driving situations. For instance, the driv-
ing can be classified according to the road (road
type, surface type, curving or slope), the vehicle
(i.e. speed, direction, state, mode, maneuver), the
neighborhood (infrastructure, vehicles, pedestri-
ans, obstacles) or the environment (weather, lumi-
nosity, temperature). See Warg et al. (2016); Jang
et al. (2015); Verband der Automobilindustrie e.V.
(2015b) for detailed classifications.
The Automotive Safety Integrity Level (ASIL)
is used to assess and classify the risk of the haz-
ards related to the driving (International Organiza-
tion for Standardization, 2018b). ASIL classifica-
tion is a scheme depending on severity,exposure
and controllability factors, each of these factors
being categorised in different levels. The func-
tional and technical safety concepts recommended

February 27, 2019 22:0 RPS/Trim Size: 221mm x 173mm for Proceedings/Edited Book esrel2019˙ID101
Dynamic safety analysis of longitudinal motion planning for autonomous vehicles 3
Hazard Analysis & Risk Assessment
P1a: Abstraction
Functional architecture
Operation analysis
Driving situation classification
P1b: Risk assessment
System failure, accident
HA&RA, FMEA, FTA, ...
ASIL Risk assessment
Severity, Exposure, Controllability
Safety Concept (SC)
P3: Technical SC
Redundance, failure-detection
Emergency-protocol, ...
P2: Functional SC
Collisions avoidance techniques
Safety
Goals
Fig. 2. ISO 26262-2,3 Standard: Definition of technical and functional safety concepts for all possible hazards, item and driving
situation (completeness and consistence static problem, International Organization for Standardization (2018b)).
by the ISO 26262:2018 Standard aim to improve
the controllability part of the ASIL risk classifi-
cation (active safety). Possible technical safety
concepts for autonomous vehicles are:
•Emergency protocols (e.g., failure de-
tection, emergency braking, emergency
avoidance procedure, reactive control,
see Binfet-Kull et al. (1998));
•Driving situation analysis (e.g. setting of
safe conditions for each maneuver by
mathematical criteria based on distances,
speeds and kinematic capacity);
•Redundancy (in the sensing: sensor,
camera, GPS and map fusion (SLAM),
see Dissanayake et al. (2001); Bailey
and Durrant-Whyte (2006); in the mo-
tion planning: redundant use of several
types of planners; in the actuation phase:
for instance by steering through stereo-
breaking).
Driving situations and potential related hazards
are numerous and varied. They can only ex-
haustively be described in simple conditions, for
instance, the driving in highways which consists
mainly in following, lane keeping or lane chang-
ing situations. Driving situations in urban or peri-
urban are more complex. Furthermore driving is
highly dynamic and poorly structured. Unsuper-
vised automation systems have to respond appro-
priately in case of hazards, unexpected events or
failures. Yet the exhaustive listing of all driv-
ing situations and possible hazards is in practice
not possible for the autonomy levels L3, L4 or
L5 without driver supervision. Such emphasis is
largely debated and investigated in the literature of
traffic safety and safety engineering (Warg et al.,
2016; Bergenhem et al., 2015; Johansson, 2016;
Koopman and Wagner, 2016; Kalra and Pad-
dock, 2016). Indeed autonomous driving requires
knowledge from traffic engineering, safety engi-
neering, automation engineering and also from
mathematics and physics (see Fig. 3) System-
atic methods adapted to dynamical systems under
kinematic constraints and dynamic safety analysis
have to be developed to demonstrate the safety and
reliability of automated driving strategies.
Automation
– Closed-loop
feedback
– Optimal
control
Mathematics
– Dynamical system
– Coupled ODE
SDE, DDE systems
Physics
– Complex system
– Collective dynamics
Traffic Engineering
– Traffic model and
algorithm
– Intelligent traffic
system
Safety Engineering
– Safety / Reliability
analysis
– Robustness
CAV
Fig. 3. Connected and autonomous vehicles (CAV) require
knowledge from traffic engineering, safety engineering, au-
tomation engineering and also from mathematics and physics.
2.2. Dynamic safety analysis
Automated vehicles are mission-based and have
a functional architecture (Behere and T¨
orngren,
2016; Paden et al., 2016).Classical components of
autonomous driving are listed below (see Fig. 4).

February 27, 2019 22:0 RPS/Trim Size: 221mm x 173mm for Proceedings/Edited Book esrel2019˙ID101
4Antoine Tordeux, Basma Khelfa
Time-dependency
Virtual world
Reference-trajectory
Perception
Data collection
Radar, Lidar, Ultrasonic sensor
Camera, Infrared camera
Inertial navigation system
Global positioning system
V2V & V2I communications
Data
Interpretation
Data fusion (SLAM)
Objects identification
(Machine learning, clustering
filtering, ... )
Actuation
Control planning
Stable reference-trajectory
Feedback (PID, Anti-windup)
Regulation
Vehicle’s control
Steering
Braking
Accelerating
Motion planning
Routing
Shortest path problem
Dijkstra’s algorithm
Heuristic (A*, hierarchical, ... )
Route
Behavior planning
Manneuver planning, Roadmap
Collision avoidance technique
Heuristic (NN, probabilistic)
Path
Local Planning
Continuous interpolation
Holonomic condition, Slipness
Longitudinal Planning
Fig. 4. Illustrative scheme for the functional architecture of automated vehicles. Three mains phases are distinguished: The
perception, the motion planning and the actuation. Such steps are repeated into a loop making the system dynamical (Behere and
T¨
orngren, 2016; Paden et al., 2016).
(1) The perception phase, consisting in the col-
lection, fusion and interpretation of the sensor
(radar, lidar or camera) and communicated
(V2V, V2I) data, fusion to high definition
map (SLAM), understanding, interpretation
and forecast of the driving of situations. Such
last step is generally tackled thanks to com-
putational vision, artificial intelligence, and
machine learning techniques.
(2) The motion planning phase, operating at
strategical (i.e. route choice), technical (ma-
neuver planning) and operational scales (lo-
cal lateral and longitudinal motion planning).
Such plans are generally done thanks to intel-
ligent traffic models and algorithms borrowed
from traffic engineering.
(3) The actuation phase, for determination of sta-
ble commands for the reference trajectory to
follow and the control of the vehicle (steering,
braking, and acceleration). Here control tech-
niques by feedback borrowed from automa-
tion engineering are used.
The three phases of perception, motion plan-
ning and actuation are repeated into loop making
the system dynamical. Indeed, the driving au-
tomation is a complex dynamical task implying
many electronic components, sensors, communi-
cation tools and algorithms. The demonstration of
the safety of automated driving strategies require
systematic approaches and specific tools taking
into account for the various dynamical aspects of
the driving and the complexity of the architecture.
The ISO/PAS 21448:2019 Standard for the safety
of the intended function (SoTIF) is especially de-
voted to such a task (International Organization
for Standardization, 2019). Examples of algo-
rithms and methods for the dynamic safety anal-
ysis of automated vehicles are
•The stability analysis of the homogeneous
streaming and the development of stable and
robust collision-free models (Darbha and Ra-
jagopal, 1999; Kikuchi et al., 2003; Zhou and
Peng, 2005; Paden et al., 2016);
•The dynamic evaluation of the safety, with
e.g. temporal indicators such as Time-
to-Collision, Time-to-React or Time-Gap
(Tamke et al., 2011; Berthelot et al., 2012);
•The dynamic detection of unusual events
or potential conflictual manoeuvres (Lef`
evre
et al., 2014);
•Real-time trajectory predictions by simulation
and model predictive control (MPC) (Falcone
et al., 2007; Eidehall and Petersson, 2008;
Ammoun and Nashashibi, 2009; Chen and
Chen, 2010; Prial´
e Olivares et al., 2016).

February 27, 2019 22:0 RPS/Trim Size: 221mm x 173mm for Proceedings/Edited Book esrel2019˙ID101
Dynamic safety analysis of longitudinal motion planning for autonomous vehicles 5
3. Longitudinal motion planning
3.1. Car-following model
The longitudinal motion planning of autonomous
vehicles in normal driving situations is regulated
through adaptive cruise control (ACC) or full
speed range ACC (FACC) systems. ACC systems
control the acceleration rate and speed of a vehicle
according to the distance ahead and the speed of
the preceding vehicle (Winner et al., 2015; Paden
et al., 2016) (see Fig. 5). The distance is generally
measured thanks to radar or lidar sensors, while
the speed is obtained by differentiating in time
the distance measurements. Two driving situa-
tions can be distinguished. The automation sys-
tems aim to keep a constant desired speed in the
free case when there is no vehicle ahead (cruise
control system), while speed and the spacing are
simultaneously regulated in the pursuit situation
(adaptive cruise control system). In this last case,
a classical pursuit strategy consists in keeping a
constant time gap Twith the predecessor, the
time gap being the distance to the vehicle ahead
divided by the current speed. The constant time
gap pursuit strategy is the one recommended by
the ISO 15622:2018 Standard for ACC and FACC
systems (with desired time gap Tvarying from
0.8 to 2.2 s, see International Organization for
Standardization (2018a)).
˙xn˙xn+1
xnxn+1
xn+1 −xn
T × ˙xn
Fig. 5. Main variables for a pursuit situation. The parameter
T>0is the desired time gap.
Technical kernels of ACC and FACC systems
are car-following models. Such a modeling ap-
proach is largely developed in traffic engineering.
Car-following models are generally second order
differential equation systems describing the accel-
eration rate of a vehicle according to the spacing
ahead, the speed and the speed of the predecessor
¨xn(t) = F∆xn(t),˙xn(t),˙xn+1(t),(1)
with ∆xn(t) = xn+1(t)−xn(t),xn(t)being
the position of the considered vehicle nat time
t, while xn+1(t)is the position of the predecessor
(see Fig. 5). Classical ACC planners are linear
feedback and relaxation processes such as the full
velocity difference (FVD) model (Jiang et al.,
2001)
¨xn(t) = 1
T1∆xn(t)−`
T−˙xn(t)
+1
T2˙xn+1(1) −˙xn(t),
(2)
`being the vehicle length and a minimal spacing
distance, Tthe desired time gap and T1and T2
relaxation times. Nonlinear models such as the
intelligent driver model are also used as ACC
systems (Kesting et al., 2007; Derbel et al., 2013).
In the adaptive time gap (ATG) car-following
model (Tordeux et al., 2010) that we propose for
ACC and FACC systems, it is the time gap
Tn(t) = ∆xn(t)−`
˙xn(t)(3)
that is, in accordance to the ISO:15622 Standard,
relaxed by a factor λto the constant desired time
gap T:
˙
Tn(t) = λT − Tn(t).(4)
Supposing that the time gap is not zero, the result-
ing nonlinear acceleration model is
¨xn(t) = λ˙xn(t)1−T
Tn(t)+∆ ˙xn(t)
Tn(t)(5)
with ∆ ˙xn(t) = ˙xn+1 (t)−˙xn(t). The pursuit
behavior in transient states (i.e. when the time
gap is not the desired time) is controlled for both
FVD and ATG models by the relaxation time and
factor parameters, the behavior being as smooth as
the relaxation is slow. Note that the models may
also include a desired (maximal) speed parameter
to deal with the free state (cruise control).
3.2. Stability analysis
The active safety of ACC and FACC systems is
tackled thanks to local and global stability analy-
sis (Darbha and Rajagopal, 1999; Zhou and Peng,
2005; Paden et al., 2016). A single vehicle with
assigned speed of the leader is considered for local
analysis (see Fig. 6), while a flow of vehicles is
investigated for global (or collective) analysis (see
Fig. 7). Local over-damped stability conditions
Fig. 6. Scheme for the local stability analysis. A single
vehicle with assigned speed of its leader is considered.
allow ensuring collision-free properties of the ac-
celeration planners. Global stability conditions

February 27, 2019 22:0 RPS/Trim Size: 221mm x 173mm for Proceedings/Edited Book esrel2019˙ID101
6Antoine Tordeux, Basma Khelfa
Fig. 7. Scheme for the global (or collective) stability anal-
ysis. A flow of vehicles with periodic or infinite boundary
conditions is investigated.
guaranty the homogenization of the flow in time
and the absence of well-known stop-and-go be-
haviors (Orosz et al., 2010; Treiber and Kesting,
2013). Stability properties allow to systematically
demonstrate the safety of ACC and FACC sys-
tems.
Generally speaking, stability occurs if the re-
laxation is sufficiently strong for both linear and
nonlinear models (Darbha and Rajagopal, 1999;
Kesting et al., 2007; Kikuchi et al., 2003; Zhou
and Peng, 2005; Paden et al., 2016; Derbel et al.,
2013). For instance, the local (over-damped) and
global stability analysis of the FVD model Eq. (2)
are respectively
0<T1
(1 + T1/T2)2<T
4(6)
and
0<T1T2
2T1+T2
<T
2(7)
(see, e.g., Treiber and Kesting (2013)). Indeed, the
stability conditions constraint the viable domain
of the parameters and limit the use of the models.
The ATG model Eq. (5) falls under the excep-
tion. The model is systematically over-damped
locally and globally stable for any value of the
relaxation and desired time gap parameters
λ, T>0.(8)
Reasons are the first order relaxation operating for
the time gap in the ATG model (see Eq. (4)) that is
by construction intrinsically stable. Such property
makes the ATG model a robust candidate for ACC
and FACC systems.
4. From car-following models to robust
ACC systems
Local over-damped and global stability are ex-
pected properties for ACC and FACC systems.
However, in practice, many factors may affect
the stability and generate traffic waves and unsafe
behaviors even for stable models. For instance,
latency in the automation process induces non-
negligible response times. Furthermore, the mea-
surements of the distance and speed are subject to
noise, interference or recognition error, especially
when the environmental conditions are unfavor-
able. The challenge for robust ACC and FACC
systems lies in improving the stability properties
in the presence of latency, uncertainty or again
lane changing.
The perception phase, i.e. measurement, inter-
pretation and understanding of the environment,
the determination of the reference route, maneu-
ver and trajectory, and the actuation and control
of the vehicles, require calculation and application
times. Such mechanical and computational re-
sponse times of the ACC systems, similar in con-
ventional traffic to the reaction time of the driver,
are well-known factors of instability. Indeed, a
delay in basic models alters the stability result-
ing in stop-and-go waves (Treiber et al., 2006;
Tordeux et al., 2012). Latency-induced instability
can be controlled by reducing the delay, for in-
stance using fast algorithms for calculation of the
reference trajectory and efficient feedback process
in the automation. Connected vehicles and an-
ticipation process including several predecessors
in front also allow compensating for the delay
and improving the stability (Kesting and Treiber,
2008; Gu´
eriau et al., 2016).
The autonomous driving is subject to uncer-
tainties in the measurements of the environment.
Such uncertainties are noise, measurement error,
or even recognition error, generally due to bad
weather conditions, light effects or again interfer-
ence. Lane-changing (cutting in or cutting out)
can also be considered as discontinuous pertur-
bations. Stochastic noise can affect the stability
of homogeneous streaming and “kick” a system
out of the stable state. Such effects are related as
noise-induced stop-and-go waves or sub-critical
instability in the literature (Tordeux and Schad-
schneider, 2016; Treiber and Kesting, 2017). The
vehicular dynamics are also affected by kinematic
constraints, due e.g. to inertia and limited accel-
eration and braking capacities, as well as comfort
bounds recommended by ISO 15622:2019 Stan-
dard (International Organization for Standardiza-
tion, 2018a).
In summary, the safety analysis of ACC and
FACC motion planning systems lies in stabil-
ity and robustness analysis of delayed stochastic
and nonlinear differential equation systems under
kinematic constraints. Simple scenarios can be
analyzed explicitly by stochastic calculus while
real complex situations are generally investigated
numerically by simulation.
Acknowledgment
A.T. acknowledges support from the Eugen Otto
Butz Foundation (Eugen-Otto-Butz-Stiftung).
References
Ammoun, S. and F. Nashashibi (2009). Real time
trajectory prediction for collision risk estima-

February 27, 2019 22:0 RPS/Trim Size: 221mm x 173mm for Proceedings/Edited Book esrel2019˙ID101
Dynamic safety analysis of longitudinal motion planning for autonomous vehicles 7
tion between vehicles. In 2009 IEEE 5th In-
ternational Conference on Intelligent Computer
Communication and Processing, pp. 417–422.
Bailey, T. and H. Durrant-Whyte (2006). Simulta-
neous localization and mapping (SLAM): part
II. IEEE Robotics Automation Magazine 13(3),
108–117.
Behere, S. and M. T¨
orngren (2016). A functional
reference architecture for autonomous driving.
Information and Software Technology 73, 136–
150.
Bergenhem, C., R. Johansson, A. S¨
oderberg,
J. Nilsson, J. Tryggvesson, M. T¨
orngren, and
S. Ursing (2015). How to Reach Com-
plete Safety Requirement Refinement for Au-
tonomous Vehicles. In M. Roy (Ed.), CARS
2015 - Critical Automotive applications: Ro-
bustness & Safety, Paris, France.
Berthelot, A., A. Tamke, T. Dang, and G. Breuel
(2012). A novel approach for the proba-
bilistic computation of time-to-collision. In
2012 IEEE Intelligent Vehicles Symposium, pp.
1173–1178.
Binfet-Kull, M., P. Heitmann, and C. Ameling
(1998). System safety for an autonomous driv-
ing vehicle. In IEEE International Conference
on Intelligent Vehicles, pp. 469–476.
Chen, S. and F. Chen (2010). Simulation-based
assessment of vehicle safety behavior under
hazardous driving conditions. Journal of Trans-
portation Engineering 136(4), 304–315.
Darbha, S. and K. Rajagopal (1999). Intelligent
cruise control systems and traffic flow stabil-
ity. Transportation Research Part C: Emerging
Technologies 7(6), 329–352.
Derbel, O., T. Peter, H. Zebiri, B. Mourllion, and
M. Basset (2013). Modified intelligent driver
model for driver safety and traffic stability im-
provement. IFAC Proceedings Volumes 46(21),
744–749.
Dissanayake, M. W. M. G., P. Newman, S. Clark,
H. F. Durrant-Whyte, and M. Csorba (2001).
A solution to the simultaneous localization and
map building (SLAM) problem. IEEE Transac-
tions on Robotics and Automation 17(3), 229–
241.
Eidehall, A. and L. Petersson (2008). Statistical
threat assessment for general road scenes using
monte carlo sampling. IEEE Transactions on
Intelligent Transportation Systems 9(1), 137–
147.
Falcone, P., M. Tufo, F. Borrelli, J. Asgari, and
H. E. Tseng (2007). A linear time varying
model predictive control approach to the in-
tegrated vehicle dynamics control problem in
autonomous systems. In 2007 46th IEEE Con-
ference on Decision and Control, pp. 2980–
2985.
Gonz´
alez, D., J. P ´
erez, V. Milan ´
es, and
F. Nashashibi (2016). A review of motion plan-
ning techniques for automated vehicles. IEEE
Transactions on Intelligent Transportation Sys-
tems 17(4), 1135–1145.
Gu´
eriau, M., R. Billot, N.-E. E. Faouzi, J. Monteil,
F. Armetta, and S. Hassas (2016). How to assess
the benefits of connected vehicles? A simula-
tion framework for the design of cooperative
traffic management strategies. Transportation
Research Part C: Emerging Technologies 67,
266–279.
International Organization for Standardization
(2018a). Intelligent transport systems – Adap-
tive cruise control systems – Performance re-
quirements and test procedures. Technical re-
port, Standard ISO 15622:2018.
International Organization for Standardization
(2018b). Road vehicles – Functional safety.
Technical report, Standard ISO 26262:2018.
International Organization for Standardization
(2019). Road vehicles – Safety of the in-
tended functionality. Technical report, Standard
ISO/PAS 21448:2019.
Jang, H. A., H. M. Kwon, S.-H. Hong, and M. K.
Lee (2015). A study on situation analysis for
asil determination. Journal of Industrial and
Intelligent Information 3(2), 152–157.
Jiang, R., Q. Wu, and Z. Zhu (2001). Full veloc-
ity difference model for a car-following theory.
Phys. Rev. E 64, 017101.
Johansson, R. (2016). Efficient Identification
of Safety Goals in the Automotive E/E Do-
main. In 8th European Congress on Embedded
Real Time Software and Systems (ERTS 2016),
TOULOUSE, France.
Kalra, N. and S. M. Paddock (2016). Driving to
safety: How many miles of driving would it
take to demonstrate autonomous vehicle relia-
bility? Transportation Research Part A: Policy
and Practice 94, 182–193.
Kesting, A. and M. Treiber (2008). How
reaction time, update time, and adaptation
time influence the stability of traffic flow.
Computer-Aided Civil and Infrastructure Engi-
neering 23(2), 125–137.
Kesting, A., M. Treiber, M. Sch¨
onhof, and D. Hel-
bing (2007). Extending adaptive cruise control
to adaptive driving strategies. Transportation
Research Record: Journal of the Transporta-
tion Research Board 2000, 16–24.
Kikuchi, S., N. Uno, and M. Tanaka (2003).
Impacts of shorter perception-reaction time of
adapted cruise controlled vehicles on traffic
flow and safety. Journal of Transportation
Engineering 129(2), 146–154.
Koopman, P. and M. Wagner (2016). Challenges
in autonomous vehicle testing and validation.
SAE Int. J. Trans. Safety 4, 15–24.
Lef`
evre, S., D. Vasquez, and C. Laugier (2014).
A survey on motion prediction and risk as-
sessment for intelligent vehicles. ROBOMECH
Journal 1(1), 1–14.
Litman, T. (2018). Autonomous vehicle imple-

February 27, 2019 22:0 RPS/Trim Size: 221mm x 173mm for Proceedings/Edited Book esrel2019˙ID101
8Antoine Tordeux, Basma Khelfa
mentation predictions. Technical report, Victo-
ria Transport Policy Institute.
Orosz, G., R. E. Wilson, and G. St´
ep´
an (2010).
Traffic jams: dynamics and control. Philo-
sophical Transactions of the Royal Society A:
Mathematical, Physical and Engineering Sci-
ences 368(1928), 4455–4479.
Paden, B., M. C´
ap, S. Z. Yong, D. Yershov, and
E. Frazzoli (2016). A survey of motion plan-
ning and control techniques for self-driving ur-
ban vehicles. IEEE Transactions on Intelligent
Vehicles 1(1), 33–55.
Prial´
e Olivares, S., N. Rebernik, A. Eichberger,
and E. Stadlober (2016). Virtual stochastic
testing of advanced driver assistance systems.
In T. Schulze, B. M¨
uller, and G. Meyer (Eds.),
Advanced Microsystems for Automotive Appli-
cations 2015, pp. 25–35. Springer International
Publishing.
SAE International (2018). Taxonomy and Def-
initions for Terms Related to On-Road Motor
Vehicle Automated Driving Systems. Technical
report, Standard J3016 201806.
Singh, S. (2014). Critical reasons for crashes
investigated in the national motor vehicle crash
causation survey. Technical report, No. DOT
HS 812 115, NHTSA.
Tamke, A., T. Dang, and G. Breuel (2011). A flex-
ible method for criticality assessment in driver
assistance systems. In 2011 IEEE Intelligent
Vehicles Symposium (IV), pp. 697–702.
Tordeux, A., S. Lassarre, and M. Roussignol
(2010). An adaptive time gap car-following
model. Transportation Research Part B:
Methodological 44(8), 1115–1131.
Tordeux, A., M. Roussignol, and S. Lassarre
(2012). Linear stability analysis of first-order
delayed car-following models on a ring. Phys.
Rev. E 86, 036207.
Tordeux, A. and A. Schadschneider (2016). White
and relaxed noises in optimal velocity models
for pedestrian flow with stop-and-go waves.
Journal of Physics A: Mathematical and The-
oretical 49(18), 185101.
Treiber, M. and A. Kesting (2013). Traffic
Flow Dynamics: Data, Models and Simulation.
Springer-Verlag Berlin Heidelberg.
Treiber, M. and A. Kesting (2017). The Intelligent
Driver Model with Stochasticity – New Insights
Into Traffic Flow Oscillations. Transportation
Research Procedia 23, 174–187.
Treiber, M., A. Kesting, and D. Helbing (2006).
Delays, inaccuracies and anticipation in micro-
scopic traffic models. Physica A: Statistical
Mechanics and its Applications 360(1), 71–88.
Verband der Automobilindustrie e.V. (2015a). Au-
tomation – From Driver Assistance Systems to
Automated Driving. Technical report, VDA
Magazine – Automation.
Verband der Automobilindustrie e.V. (2015b). Sit-
uationskatalog E-parameter nach ISO 26262-3.
Technical report, VDA 702.
Warg, F., M. Gassilewski, J. Tryggvesson,
V. Izosimov, A. Werneman, and R. Johansson
(2016). Defining autonomous functions us-
ing iterative hazard analysis and requirements
refinement. In A. Skavhaug, J. Guiochet,
E. Schoitsch, and F. Bitsch (Eds.), Computer
Safety, Reliability, and Security, pp. 286–297.
Springer International Publishing.
Winner, H., s. Hakuli, F. Lotz, and C. Singer
(2015). Handbuch Fahrerassistenzsysteme.
Springer Vieweg.
Zhou, J. and H. Peng (2005). Range policy
of adaptive cruise control vehicles for im-
proved flow stability and string stability. IEEE
Transactions on Intelligent Transportation Sys-
tems 6(2), 229–237.