31st International Congress of Psychology
25 July 2016, Yokohama

Human-Machine Collaborationsfor Sensible Automated Driving
Toshiyuki INAGAKI
University of Tsukuba, JAPANinagaki.toshiyuki.gb@u.tsukuba.ac.jp

Why automated driving?
Reducing congestion

V2I

GPS
Collision avoidance via V2I

V2V
Collision avoidance
via onboard sensing

Collision avoidance via V2V

Wide variety of automated driving

Photo: BMV

Photo: Volvo

Photo: Zoox

Level 1 automated driving
The driver permanently controls either longitudinal orlateral control. The other task can be automated to acertain extent by the assistance system.
System: longitudinal control byusing ACC
Driver：lateral control

Level 2 automated driving
The system takes over longitudinal and lateral control.
The driver shall permanently monitor the system andshall be prepared to take over control at any time.

System: longitudinal and lateralcontrol by using ACC, LCS,
ESC, etc.
Driver：Photo: BMV

human supervisory control
1) plan2) teach3) monitor 4) intervene5) learn(Sheridan 1992)

Human supervisory control
 Monitoring is boring:– Highly reliable system seldom fails.
– Human has to be prepared in case of system failure.
 Intervention is hard:– Decisions must be made with insufficient information.
– No delay is allowed.
In order to pursuit monitoring and intervention appropriately,
the driver needs to understand: how functions are implemented in automated systems
 functional limitations of automated systems
 possible interaction among automated systems

Dimension of trustFoundation
conform to natural laws and social order
Performance
consistent, stable, and desirable performance or
behaviour can be expected
Process
methods, rule bases, or control algorithms thatgovern the system behaviour are understandable
Purposemotives or designer’s intention is understandable(Lee & Moray, 1992)

Example: Overrating of foundation
Foundation： conform to natural law and social order“ACC should be designed to obey traffic rules.”AB

Vehicle B had been driven with ACC enabled, following thelead vehicle A, and was stuck in the middle of anintersection, because of a heavy traffic jam.

Example: Overrating of performance
Performance: consistent, stable, and desirable behaviour can be expected“LCS has been working perfectly so far. Wherever I go,
it must perform its function correctly and nicely.”

LCS failed to track lane markingsat an intersection, and the vehicle
entered the oncoming lane.

Example: Overrating of process
Process: methods, rule bases, or control algorithms are understandable“I do not know how the function is implemented in LCS.
I am not informed how the task is carried out. However,
it would be quite alright even if I do not know the details.”

Because of a cutting-in vehicle,
LCS failed to track lane markings,
and its steering control became
unstable.

Example: Overrating of purpose
Purpose： motives or designer’s intention is understandable“I do not understand why ACC is doing such a thing.
However, it must be doing what it thinks it necessary andappropriate.”
CCA

BAVehicle B has been driven with ACC enabled, followingvehicle A. The ACC shows no intention to decelerate,
although vehicle C seems to be cutting in.

BWell-designed HMI is vital for
Level 2 automated driving
HMI should provide cues for the human to:– share situation awareness with machines– understand the rationale of machine’s judgement– understand machine’s intention– grasp machine’s limitations– identify machine’s operating condition



HMI with these characteristics would be useful to:– Reduce distrust / overtrust– Reduce overreliance– Reduce loss of mode awareness / automation surprises

Ambiguity under imprecise information

SystemSTOP

A car comingfrom the right!
DriverWhich car?
The car passing now?
Is another carcoming?

Is the warning system trustworthy?

SystemSTOP・・・
DriverNo cars coming?
The warning
system working
properly?

What the driver sees

what the machine seesConflict of intentions can occur even when
what the driver sees = what the machine sees
Agent 1 wants to…

Agent 2 wants to…

Failure to recognize limit of capability

Level 3 automated driving
The system takes over longitudinal and lateral control.
The driver is no longer required to permanently monitor
the system. In case of a take-over request by the system,
the driver must take over control with a certain time buffer.
take-overrequest

Photo: Volvo

Control authority must be
traded from machine tohuman safely and smoothly

Authority trading from machine to human can fail

Levels of automation (LOA) for decision & control
1. The computer offers no assistance; human must do it all.
2. The computer offers a complete set of action alternatives, and3.

narrows the selection down to a few, or4.

suggests one, and5.

executes that suggestion if the human approves, or6.

allows the human a restricted time to veto before automatic
execution, or

6.5

executes automatically after telling the human what it isgoing to do, or

7.

executes automatically, then necessarily informs humans, or8.

informs him after execution only if he asks, or9.

informs him after execution if it, the computer, decides to.

10. The computer decides everything and acts autonomously,ignoring the human.

(Sheridan 1992; Inagaki, Itoh, Moray 1998)

Which take-over request may be sensible?
Take-overrequest

1. “Design conditions shall no longer be
met in 10 sec.” (LOA=4)
2. “Design conditions shall be no longer
met shortly. Could you take overcontrol in 10 sec?” (LOA=5)
3. “Design conditions shall be no longer
met in 10 sec. Automation shall bedeactivated then.” (LOA=6)
4. A message, “Automation has alreadybeen deactivated,” is given afterexecution. (LOA=7)
5. No message is given after execution.
（LOA=9）

Which take-over request may be sensible?
Take-overrequest

1. “Design conditions shall no longer be
met in 10 sec.” (LOA=4)
2. “Design conditions shall be no longer
met shortly. Could you take overcontrol in 10 sec?” (LOA=5)
3. “Design conditions shall be no longer
met in 10 sec. Automation shall bedeactivated then.” (LOA=6)
4. A message, “Automation has alreadybeen deactivated,” is given afterexecution. (LOA=7)
5. No message is given after execution.
（LOA=9）

Which take-over request may be sensible?
Take-overrequest

1. “Design conditions shall no longer be
met in 10 sec.” (LOA=4)
2. “Design conditions shall be no longer
met shortly. Could you take overcontrol in 10 sec?” (LOA=5)
3. “Design conditions shall be no longer
met in 10 sec. Automation shall bedeactivated then.” (LOA=6)
4. A message, “Automation has alreadybeen deactivated,” is given afterexecution. (LOA=7)
5. No message is given after execution.
（LOA=9）

Which take-over request may be sensible?
Take-overrequest

1. “Design conditions shall no longer be
met in 10 sec.” (LOA=4)
2. “Design conditions shall be no longer
met shortly. Could you take overcontrol in 10 sec?” (LOA=5)
3. “Design conditions shall be no longer
met in 10 sec. Automation shall bedeactivated then.” (LOA=6)
4. A message, “Automation has beendeactivated,” is given afterexecution. (LOA=7)
5. No message is given after execution.
（LOA=9）

Which take-over request may be sensible?
Take-overrequest

1. “Design conditions shall no longer be
met in 10 sec.” (LOA=4)
2. “Design conditions shall be no longer
met shortly. Could you take overcontrol in 10 sec?” (LOA=5)
3. “Design conditions shall be no longer
met in 10 sec. Automation shall bedeactivated then.” (LOA=6)
4. A message, “Automation has alreadybeen deactivated,” is given afterexecution. (LOA=7)
5. No message is given after execution.
（LOA=9）

Level 4 automated driving
The system takes over longitudinal and lateral control.
The driver is no longer required to permanently monitor
the system. If human driver does not take over, the system
will return to the minimal risk condition by itself.
“Could you take overcontrol in 10 sec?”“Could you
take overcontrol in10 sec?”?

The system restoresthe vehicle to theminimal risk condition
automatically.

Level 4.5 automated driving
The system takes over longitudinal and lateral control.
The driver is no longer required to permanently monitor
the system. When it is anticipated that design condition
shall not be met a short time later, the system restores thevehicle to the minimal risk condition automatically.
“Control mode isswitched toemergency-mode.”

After telling that,system activates emergency
control mode instantly.
(LOA 6.5)(Inagaki 2016)

Level 5 automated driving
The system performs all safety-critical driving functions andmonitor roadway conditions for an entire trip. Such a design
anticipates that the driver will provide destination ornavigation input, but is not expected to be available forcontrol at any time during the trip. By design, safe
operation rests solely on the automated driving system.
Can we trust in the automated driving system?

Photo: Google

Photo: Zoox