Future human-machine collaboration forhuman-centered automation
18 March 2017, Tokyo

Automated Driving:
Are We Heading Down the Right Path?
Toshiyuki INAGAKI
University of Tsukuba, JAPANinagaki.toshiyuki.gb@un.tsukuba.ac.jp

Wide variety of driving automation

Photo: BMV

Photo: Volvo

Photo: Zoox

SAE J3016 (Sep 2016)

SAE J3016 (Jan 2014)

Levels of driving automation- SAE J3016 (Sep 2016) Level 1

Driver AssistanceLevel 2

Partial Driving Automation

Level 3

Conditional Driving Automation

Level 4High Driving Automation

Level 5Full Driving Automation

Dynamic Driving Task (DDT)
1. Lateral vehicle motion control(via steering)
2. Longitudinal vehicle motion control(via acceleration / deceleration)
3. Monitoring the driving environment(via object and event detection, recognition,classification, and response preparation)
4. Object and event response execution
5. Maneuver planning
6. Enhancing conspicuity(via lighting, signaling and gesturing, etc.)

Level 1 - Driver assistance
The sustained and ODD-specific execution by a driving
automation system of either the lateral or the longitudinalvehicle motion control subtask of the DDT (but not bothsimultaneously) with the expectation that the driver
performs the remainder of the DDT.

DDT - Dynamic Driving Task
ODD - Operational Design Domain
The specific conditions under which a given driving
automation system or feature thereof is designed tofunction, including, but not limited to, driving modes.

Level 1 - Driver assistanceThe driving automation system executes either the lateralor the longitudinal vehicle motion control subtask of theDDT (but not both simultaneously) with the expectationthat the driver performs the remainder of the DDT.

System: longitudinal control byusing ACCDriver：lateral control

Level 2 - Partial driving automation
The sustained and ODD-specific execution by a driving
automation system of both the lateral and longitudinalvehicle motion control subtasks of the DDT with theexpectation that the driver completes the OEDR subtask
and supervises the driving automation system.

DDT - Dynamic Driving Task
1. Lateral vehicle motion control
2. Longitudinal vehicle motion control
3. Monitoring the driving environment via object andevent detection, recognition, classification, andresponse preparation
4. Object and event response execution
5. Maneuver planning
6. Enhancing conspicuity

OEDR

Level 2 - Partial driving automation
The driving automation system executes both the lateral andlongitudinal vehicle motion control subtasks of the DDT withthe expectation that the driver completes the OEDR subtask
and supervises the driving automation system.
System: longitudinal and lateralcontrol by using ACC, LCS,ESC, etc.
Driver：Photo: BMV

supervisory control
1) plan2) teach3) monitor 4) intervene5) learn(Sheridan 1992)

Supervisory control is not human-friendly
 Monitoring is boring:– Highly reliable system seldom fails.
– Human has to be prepared in case of system failure.
 Intervention is tough:– Decisions must be made with insufficient information.
– No delay is allowed.
In order to pursuit monitoring and intervention appropriately,
the driver needs to understand: how functions are implemented in automated systems
 functional limitations of automated systems
 possible interaction among automated systems

Example 1

Example 2
LCS failed to track lane markings at an intersection, andthe vehicle entered the oncoming lane.

Example 3
Because of a cutting-in vehicle, LCS failed to track lane
markings, and its steering control became unstable.

Driver monitoring
The driver is assumed in Level 2 driving automation to:perform the remainder of the DDT not performed by thedriving automation systemsupervise the driving automation system and intervene as
necessary to maintain safe operation of the vehicle
Question 1: Is it possible to design a HMI that canmonitor the driver in a natural manner?
Question 2: What the system should do when it
determined that the driver may not be supervising thesystem properly?

DDT Fallback
The response by the user or by an automated driving system
to either perform the DDT or achieve a minimal risk condition
after occurrence of a DDT performance-relevant system
failure(s) or upon ODD exit.

ODD - Operational Design Domain
Minimal Risk Condition
A condition to which a user or an ADS may bring avehicle after performing the DDT fallback in order toreduce the risk of a crash when a given trip cannot orshould not be completed.

Level 3 - conditional driving automation
The sustained and ODD-specific performance by anautomated driving system of the entire DDT with theexpectation that the DDT fallback-ready user is receptive tosystem-issued requests to intervene, as well as to DDT
performance-relevant system failures in other vehicle
systems, and will respond appropriately.

ODD - Operational Design Domain
DDT - Dynamic Driving Task
DDT fallback-ready user
The user (of a vehicle with an level 3 automated drivingfeature) who is able to operate the vehicle and is
receptive to system-issued requests to intervene.
compelling him/her to perform the DDT fallback.

Level 3 - conditional driving automation
The automated driving system performs the entire DDTwith the expectation that the DDT fallback-ready user is
receptive to system-issued requests to intervene and will
respond appropriately.

Question 3: Is it reasonable to assume that a DDT
fallback-ready user is receptive at all times to systemissued requests to intervene and will respond
appropriately?

Level 3 - conditional driving automation
The automated driving system performs the entire DDTwith the expectation that the DDT fallback-ready user is
receptive to system-issued requests to intervene and will
respond appropriately.
“Could you take overcontrol in 10 sec?”“Could you
take overcontrol in10 sec?”?

What happens if thedriver failed to react
to the request tointervene?

Level 3 - conditional driving automation
The automated driving system performs the entire DDTwith the expectation that the DDT fallback-ready user is
receptive to system-issued requests to intervene and will
respond appropriately.

Basic model in J3016
The system disengages an appropriate time after issuinga request to intervene.
Question 4: Is it sensible for the system to disengage“an appropriate time after issuing a request to intervene”?

Levels of automation (LOA) for decision & control
1. The computer offers no assistance; human must do it all.
2. The computer offers a complete set of action alternatives, and3.

narrows the selection down to a few, or4.

suggests one, and5.

executes that suggestion if the human approves, or6.

allows the human a restricted time to veto before automatic
execution, or

6.5

executes automatically after telling the human what it isgoing to do, or

7.

executes automatically, then necessarily informs humans, or8.

informs him after execution only if he asks, or9.

informs him after execution if it, the computer, decides to.

10. The computer decides everything and acts autonomously,ignoring the human.

(Sheridan 1992; Inagaki, Itoh, Moray 1998)

Request to intervene: Design alternatives
Baseline: “Intervene and resume control within 10 sec.”
LOA 5:“Intervene and resume control.
The system deactivates after confirming that you
resume control.”LOA 6:“Intervene and resume control within 10 sec.
Veto if you do not agree with this idea.”

LOA 6.5: “Intervene and resume control at once.
The system is about to deactivate.”
LOA 7:“Intervene and resume control at once.
The system has just deactivated.”

Machine-initiated authority trading can failWhat if no response to the request?
Baseline: “Intervene and resume control within 10 sec.”
LOA 5:“Intervene and resume control.
The system deactivates after confirming that you
resume control.”LOA 6:“Intervene and resume control within 10 sec.
Veto if you do not agree with this idea.”

LOA 6.5: “Intervene and resume control at once.
The system is about to deactivate.”
LOA 7:“Intervene and resume control at once.
The system has just deactivated.”

What if no response to the request?
Baseline: “Intervene and resume control within 10 sec.”
when no response
The system disengages when 10 seconds passed.
Nobody controls the vehicle after that.
LOA 5:“Intervene and resume control.
The system deactivates after confirming that youresume control.”when no response
The system may not disengage, and thus it initiates
DDT fallback to achieve a minimum risk condition.

What if no response to the request?
LOA 6:“Intervene and resume control within 10 sec.
Veto if you do not agree with this idea.”
when vetoed or no response(1) If vetoed, the system initiates DDT fallback toachieve a minimum risk condition.
(2) When no response or the human’s failure to
take over control, the system disengages when
10 seconds passed. Nobody controls the vehicle
after that.

What if no response to the request?
LOA 6.5: “Intervene and resume control at once.
The system is about to deactivate.”when no response
The system disengages immediately.
Nobody controls the vehicle after that.
LOA 7:“Intervene and resume control at once.
The system has just deactivated.”when no response
Nobody controls the vehicle.

Which design alternative is sensible?
Risk (LOA 5) < Risk (LOA 6) < Risk (baseline) <Risk (LOA 6.5)
Risk (LOA 7)

The human may veto when not being
ready to intervene and resume control.
The system initiates DDT fallback toachieve a minimal risk condition.
If no response to the request to intervene,
the system initiates DDT fallback to achievea minimal risk condition.

Value of veto

Level 4 driving automation (2014 ver.)Level 4 driving automation (2016 ver.)Level 4 - high automation (2014 ver)The system performs all aspects of the DDT, even if a humanfails to respond appropriately to a request to intervene.
“Could you take overcontrol in 10 sec?”“Could you
take overcontrol in
10 sec?”?

The system deactivates only
after the driver takes over.
It initiates DDT fallback if
the human does not takeover control.

Level 4 - high automation (2014 ver)“Could you take overcontrol in 10 sec?”“Could you
take overcontrol in10 sec?”?

The system initiates DDT
fallback if the human does
not take over control.

The system performs no effective control (e.g., for 10 sec)
before initiating DDT fallback. Is this safe enough?

Message alternatives issued by Level 4automated driving system (2014 ver)
LOA 5:“Push a button if you want the system to performthe DDT fallback for you.”

LOA 6:“The system initiates the DDT fallback within
10 sec. Veto if you do not agree with this.”

LOA 6.5: “The system is about to initiate the DDT fallback.”
LOA 7:“The system has already started the DDTfallback.”

Level 4 automated driving system (2016 ver)Level 4 - high driving automation (2016 ver)The automated driving system performs the entire DDT
and DDT fallback, without any expectation that a user will
respond to a request to intervene.

Question 5: J3016 (2016) says that “the system may
issue a request to intervene.” How can the human figureout whether a request will be issued or not in a given
situation?

Level 5 - Full driving automation
The automated driving system performs the entire DDT
and DDT fallback unconditionally (i.e., not-ODD specifically)
without any expectation that a user will respond to arequest to intervene.

Photo: Zoox

Question 6: Is there really no need to have a measure
to communicate with the automated driving system?

Design for Driving Automation and Legal
Systems Conforming to Characteristic
Features and Limitations of Cognition and/or
Decision Making of Human Drivers
Grant-in-Aid for Scientific Research (S)Toshiyuki INAGAKI - U. Tsukuba
Makoto ITOH - U. Tsukuba
Yoshihiko IKEDA - Tokai U.
Koji NAKAYAMA - Meiji U.
Shigeru HAGA - Rikkyo U.
Akinori KOMATSUBARA - Waseda U.
Kenji TANAKA - U. Electro-Comm.
Hiroshi TAKAHASHI - Shonan Inst. Tech.
Takahiro WADA - Ritsumeikan U.

Human Factors Research Aspect
Goals(1) to identify human factors in driving automation withsolutions,(2) to formulate guidelines for design of human-machineinterface, and(3) to develop training programs for enhancing driver’s
resilience in cases of unexpected events.

Engineering Design Research Aspect
Goals(1) to develop systematic methods for finding out ‘missing
levels of automated driving’ in the list by SAE, NHTSA,
BASt, etc.
(2) to identify an optimal level of automation for performing
safe and smooth transfer of control authority from theautomated driving system to the human driver when
the system requests, and(3) to develop safety control mechanisms for cases oftraffic conditions which the automated driving systems
may not be able to cope with.

Authority and Responsibility
Research AspectGoals(1) to identify problems of the current legal system when
the automated driving systems are put into the realworld,(2) to develop a new legal theory for analyzing negligenceliability when using driving automation, and(3) to propose a new system for driver’s license in the ageof driving automation.