From the Concept of Being “the Boss” to the Idea of Being “a Team”: The Adaptive Co-Pilot as the Enabler for a New Cooperative Framework

Featured Application

The design and implementation of an intelligent and adaptive co-pilot for driver–automation cooperation in automated vehicles. The implementation consists of a lateral vehicle controller based on shared control, with the novelty of having an adaptive level of authority, with stability considerations. The benefits of the implementation are shown with an objective and subjective comparison between the adaptive co-pilot and commercially available solutions, in a use case where a distracted driver requires support from automation.

Abstract

The “classical” SAE LoA for automated driving can present several drawbacks, and the SAE-L2 and SAE-L3, in particular, can lead to the so-called “irony of automation”, where the driver is substituted by the artificial system, but is still regarded as a “supervisor” or as a “fallback mechanism”. To overcome this problem, while taking advantage of the latest technology, we regard both human and machine as members of a unique team that share the driving task. Depending on the available resources (in terms of driver’s status, system state, and environment conditions) and considering that they are very dynamic, an adaptive assignment of authority for each member of the team is needed. This is achieved by designing a technology enabler, constituted by the intelligent and adaptive co-pilot. It comprises (1) a lateral shared controller based on NMPC, which applies the authority, (2) an arbitration module based on FIS, which calculates the authority, and (3) a visual HMI, as an enabler of trust in automation decisions and actions. The benefits of such a system are shown in this paper through a comparison of the shared control driving mode, with manual driving (as a baseline) and lane-keeping and lane-centering (as two commercial ADAS). Tests are performed in a use case where support for a distracted driver is given. Quantitative and qualitative results confirm the hypothesis that shared control offers the best balance between performance, safety, and comfort during the driving task.

1. Introduction

In recent years, intelligent agents have been entering our lives and supporting us in a wider variety of tasks; in particular, AVs (refer to

Table 1. List of abbreviations.

Abbreviation	Meaning	Abbreviation	Meaning
ADAS	Advanced Driver Assistance System	LoA	Level of Automation
ADS	Automated Driving System	MF	Membership Function
AI	Artificial Intelligence	MPC	Model Predictive Control
AV	Automated Vehicle	NMPC	Non-linear MPC
FIS	Fuzzy Inference System	ODD	Operational Design Domain
HMI	Human–Machine Interface	RMS	Root Mean Square
ITS	Intelligent Transportation Systems	SAE	Society of Automotive Engineers
KPI	Key Performance Indicator	SC	Shared Control
LC	Lane-Centering	TLC	Time to Lane Crossing
LK	Lane-Keeping	TOR	Take-Over Request

for all manuscript abbreviations) are becoming an integral part of everyday traffic (and will do so even more in the future), along with the improvement of sensor accuracy, calculation processing speed, and recognition performance through using AI technologies. The main motivations for AVs and ITSs are: (1) safety, under the assumptions that it is possible to “automatize” driving, and that humans can often make errors, (2) providing new mobility services for reducing traffic congestion, energy consumption, and pollution, as well as for people that can no longer drive, and (3) maintaining technological and market leadership.

1.1. The Context and the Problem

Specifically, for the first aforementioned point, human errors account for an estimated 92–96% of traffic accidents [1]. Indeed, human drivers are limited in recognizing, interpreting, understanding, and operating in critical situations; moreover, they are prone to misbehavior, drowsiness, and distraction [2]. In this perspective, vehicle automation promises to improve safety by removing human drivers from the control loop, especially the SAE-L3 [3]. Undeniably, automation systems are capable of faster response times, and can handle greater amounts of information and process it more quickly than human drivers. However, AVs are also subject to faults and misses since there are situations where such systems reach their limits and will not be able to work reliably (automation cannot cope with highly complex traffic situations, e.g., dense urban traffic. Also, the situational understanding and prediction capabilities of vehicles are at the moment far less sophisticated than the capabilities of human drivers). In these cases, the driver must intervene and take over control of the vehicle as quickly as possible and with high take-over quality [4,5]. This can lead to the so-called “irony/paradox of automation” [6,7], in which the designer who tries to eliminate the operator still leaves the operator to perform the tasks which the designer cannot think how to automate, and where the driver is substituted by the artificial system, but is still regarded as a “fallback mechanism” when automation fails or it is outside its ODD (we mean here the usage conditions and the functional boundaries of the AV) [3]. This human–automation interaction represents the concept of being “the Boss” (known as the traded control scheme [8]), where either automation or the human have total control of the vehicle, but in different periods.

In this sense, human drivers are still considered to be in a supervisory role or are asked to remain available for immediate control take-over, often without pre-warning or correct situational awareness [9]. This solution (human drivers are requested to monitor/supervise the artificial system and to take vehicle control back when it fails) will cause out-of-the-loop problems [10], mode confusion [11], and behavioral adaptation [12] issues that need urgent reconsideration to maintain safe driving with AVs [13]. In fact, when vehicles are moving autonomously, human minds begin to wander, starting to mentally switch off from the supervision task (and thus from the driving job). In addition, it is also likely that society will not tolerate automation faults at the same rate it currently tolerates human faults. Indeed, accidents are rare events: one accident per 1.46 billion km [14]. This means that—overall—humans are reliable, with the capacity to handle complex and new situations, with great capability for adaptation as well as for situational comprehension and anticipation. However, we may also consider that if AVs become reliable in all foreseeable and even unforeseeable situations on the road, the driver may easily over-trust the AV, especially when the driver does not clearly understand the ODD [9].

1.2. Our Answer: The Concept of the Adaptive Co-Pilot

Given this picture, together with the fact that people like driving, humans will remain part of the system for a long time, with capabilities for driving a vehicle that are in large part complementary to the capabilities of automation systems. The human driver offers superior perception and judgment, is capable of making high-level decisions, and brings rich prior experience and the ability to generalize from one type of experience to another [9]. Thus, humans still need to recognize performance shortcomings in automated systems, decide whether to adopt or reject decisions recommended by automation, and react to cases not included in the ODD of the automated functions [15].

In this perspective, how to combine the capabilities of human and automatic drivers should be investigated carefully, as the transfer of control from the human driver to the automated driving system and vice versa needs to follow a safe and meaningful process that circumvents or even solves this difficulty. Since a clear division of transitioning control authority is difficult to find, a “simple” trading scheme where the control authority is given to whichever agent outperforms the other (in specific traffic situations or time intervals) cannot be enough. Eriksson and Stanton [16] state that in the aforementioned situations, when the operational limits are reached, the driver must receive support and guidance, necessary to reenter the control loop [17]. However, smooth transfer of control authority between an automation system and a human is notoriously difficult (from the aviation domain, in human–automation teams, there can be errors during transfers of control authority, misinterpretation or misappropriation of responsibility, and loss of situational awareness [9,18,19]). Therefore, various schemes where vehicle control is shared (instead of traded) between the human and the automated system have been proposed [8,20], but it is fundamental to understand how the automated system and the human driver can interact with each other, simply and naturally, requiring that agents can learn when to support and how to mediate joint actions in collaboration, with the long-term vision that automated cooperation among traffic participants can improve traffic efficiency and safety beyond the level attainable by only human drivers or only machine-agents [21].

Rather than complete transfers of control authority at discrete instants of time, the idea of the adaptive co-pilot attempts to form a cooperative “team” that involves the human and automation system working together simultaneously in the same task (known as the shared control scheme [8,22]) with a variable intensity of intervention (i.e., authority) that depends on the driving context (e.g., in a low-complexity maneuver with a driver in proper conditions, the intervention of automation is low in torque amplitude, while in a scenario with a high risk of accident with a distracted driver, the automation intervention is higher). The expectation is that team performance would exceed the performance of either agent acting alone and cognitive workload would be reduced for the human [23].

In other words, the idea hereby developed is that driver and automation are regarded as members of a unique “team” that understand and support each other in cooperatively pursuing the goal of driving safely, efficiently, and comfortably.

In this sense, to counteract the drawbacks present in vehicles SAE-L2 (over-trust, misuse of the system, and expecting something for which the system is not designed) and SAE-L3 (with the out-of-the-loop problems that produce poor drivers’ take-over performance), this paper proposes the intelligent adaptive co-pilot as the enabler for a new cooperative framework between the machine-agent (automation) and the human-agent (driver). Depending on the available resources (in terms of driver’s status, system state, and environmental conditions) and considering that these resources are very dynamic (because they can change over time, they can appear or disappear, etc.), different levels of control authority are defined in the “team” in order to accomplish the given driving task.

1.3. Contributions of the Work

This work is focused on the development, testing, and evaluation of the adaptive co-pilot as the enabler of a new driving cooperative framework, pursuing the idea of being a “Team”. The specific contributions are detailed below:

• Development (Section 2): Three components of the adaptive co-pilot are presented in this work: (1) a novel lateral shared controller, able to assist the driver with different levels of haptic authority, (2) an arbitration module that calculates the authority to be assigned to the controller, designed under two principles (minimal intervention and safety-over-comfort), and (3) an innovative visual HMI for shared control, as the enabler of trust in decisions and actions performed by the co-pilot.
• Testing (Section 3.1): The implementation of the adaptive co-pilot is then tested in a scenario where the driver is asked to repeatedly perform a secondary task, which results in two general driver states (attentive or distracted). Under this scenario, four driving modes are compared (manual as a baseline, and LK and LC as two available commercial ADAS, and the proposed adaptive co-pilot). The last three offer steering support to the driver to keep within the lane in both attentive and distracted states. Tests were carried out in a driver-in-the-loop simulator with five drivers.
• Evaluation (Section 3.2 and Section 3.3): A quantitative analysis of the tests was performed, considering KPIs related to tracking performance, safety indicators, and driving efforts. To complement the study, a subjective evaluation was also performed through questionnaires applied to the participants, with KPIs related to safety, comfort, and overall perception of the system. Results show that when the driver is continuously kept in the loop under the support of the adaptive co-pilot, it provides benefits in regards to the driving task that would help to avoid “automation irony” (as the driver has a sense of being responsible for driving even under automation support). At the same time, drivers benefit from the automation capabilities for intervening during the distraction events and improving driving safety, while reducing driver-required efforts.

2. Materials and Methods

This section presents the design and implementation of the adaptive co-pilot framework (shown in Figure 1). Standard frameworks where automation is the boss are commonly composed of six components (acquisition, perception, communication, decision, control, and actuation) [24]. However, when the human is considered a co-driver, new components are needed. First, the acquisition and perception modules are extended with the information provided by driver monitoring systems. Additionally, three relevant complements need to be defined when the driver is involved in the control loop: (1) a new control modality (shared controller), which is a lane-centering controller, with the ability to assist the driver with an adaptive level of authority (instead of fixed as in common AVs frameworks), either with lower or higher intensity; (2) a new decision-making component (arbitration), to find out how much authority should be given to both the driver and the automated system, based on the driver–vehicle–environment context (particularly, the design for a use case of a distracted driver will be explained in this paper); and (3) a new interaction interface (visual HMI) that complements the system, aiding the driver through visual feedback, increasing situational awareness and giving an indication of the current level of authority. The novelty of this framework also relies on the design considerations of each of these three components as explained in Section 2.1, Section 2.2 and Section 2.3, respectively.

2.1. Adaptive Co-Pilot—Shared Controller

This section describes the design of the shared controller of the adaptive co-pilot, which is in essence a trajectory tracking controller. Nonetheless, on the basis that the driver will interact with the controller through the steering wheel, it needs to meet a series of requirements that are not considered in conventional autopilots (designed to perform the lateral driving task, but without considering humans as a collaborative agent). In this sense, the controller needs to cover the following design aspects.

• The control signal (controller output) is the steering wheel torque, whereas conventional autopilots use the steering wheel angle [25] or even the angular velocity [26]. However, drivers control the steering wheel by applying torque with the arms-hands mechanism, and it has been shown that steering angle control decreases the ease of driver intervention (as it has to deal with the low lever position controller) [27]. Therefore, to couple the control signals of both agents, a torque-based lateral controller is designed, similar to previous works in lateral shared control that have followed the same approach [28].
• The authority of the controller is adaptative to the ever-changing environment and context, whereas conventional autopilots assign a single authority value to the controller, being either activated (authority = 1, or maximum torque applied) or deactivated (authority = 0). In autopilots, the context may change the behavioral planner, but the core controller remains with the same authority, whereas for the driver–automation “team”, the automation support can adapt its intensity according to the conditions of each scenario (changes in driver fit-to-drive conditions, unsafe driver actions, automation failures, and others). This means automation can assist the driver with different levels of intensity (authority), covering the continuous spectrum from “no assistance” to “maximum allowed assistance”. In the literature, this intensity is known as the level of haptic authority [22,29].
• The control method is able to perform optimization of multiple objectives, as the complex interaction between driver and automation creates a series of goals such as tracking performance, driver comfort, driving efforts, and safety, which cannot always be achieved at the same time. Therefore, a controller capable of balancing those objectives efficiently is ideal for the adaptive co-pilot. Whereas classical controllers such as PIDs have been widely used for autopilots, shared control applications are more benefited by optimal control algorithms that allow minimizing functions with multiple objectives, with the additional benefit of managing constraints of vehicle dynamic states and control signals [8].

Based on these design aspects, and within different methods of optimal control, recent works in shared control have promoted the use of nonlinear model predictive control (NMPC), demonstrating positive results in their implementations [30,31,32,33]. These works motivated the use of this control strategy for the adaptive co-pilot, also due to the following benefits offered by this technique: (1) it is a powerful approach for the optimal control of multivariable systems with constraints on the inputs and states, (2) it allows easy integration of predicted information, as well as constraints resulting from traffic predictions or road geometry, (3) it works both as controller and as a trajectory planner because of the ability to predict its states over a future horizon, (4) it is feasible for non-linear systems and can manage complex constraints, and (5) there are microsecond solvers available, making this technique suitable for having a control loop of 1 to 10 ms, as is usual in automated driving controllers. For deep technical background on MPC, the authors refer readers to [34].

Concerning the design of an NMPC controller, it requires two fundamental steps: (1) the definition of the model, and (2) the design of the optimization problem (multi-objective function and constraints). Taking into account the considerations for the adaptive co-pilot, this work presents three additional design steps, (3) the adaptive authority factor will be added to allow the controller to have different levels of haptic authority, (4) the stability criteria will be considered when including the authority in the controller, in order to avoid oscillations and instability while keeping the configuration of the NMPC weight matrices, and (5) the assignment of unit dimensions to the authority will be presented, to deal with the fact that the level of authority is dimensionless, and therefore it is not intuitive to select the appropriate value. The last three represent the novelty added to conventional NMPC controllers found in the literature for shared control in automated driving. The block diagram of the controller is detailed in Figure 2, and the five design steps are detailed below.

2.1.1. The Vehicle Model

The prediction model is generally represented as a first-order differential equation. This work uses the representation for the lateral dynamics of a full-size passenger vehicle, which encompasses three sub-models (vehicle dynamics model, tracking-error model, and steering system model). First, the vehicle dynamics model is represented by the non-linear dynamics bicycle model equations for a front steered vehicle as shown in Equations (1)–(6) of

Table 2. NMPC formulation for adaptive co-pilot (system states).

State Vector $\mathit{x}$	Prediction Model Function $\left(\mathit{x}\left(\mathit{k}+1\right)=\mathit{f}\left(\mathit{x}\left(\mathit{k}\right),\mathit{u}\left(\mathit{k}\right),\mathit{l}\left(\mathit{k}\right)\right)\right)$	Optimization Function ${\mathit{J}}_{\mathit{x}}={\displaystyle {\displaystyle \sum }_{\mathit{k}=0}^{\mathit{N}-1}}\Vert \mathit{x}\left(\mathit{k}\right)-{\mathit{x}}_{\mathit{r}}{\left(\mathit{k}\right)\Vert }_{{\mathit{W}}_{\mathit{x}}}^2$	Constraints ${\mathit{x}}_{\mathit{min}} \le \mathit{x} \le {\mathit{x}}_{\mathit{max}}$	Equation N°
Vehicle Model
X-coordinate	$\dot{X}=v_{x}cos\left(\Psi \right)-v_{y}sin\left(\Psi \right)$	$W_X=50$ (Tracking)	$\pm \infty$	(1)
Y-coordinate	$\dot{Y}=v_{x}sin\left(\Psi \right)+v_{y}cos\left(\Psi \right)$	$W_Y=50$ (Tracking)	$\pm \infty$	(2)
Yaw angle	$\dot{\Psi }=\psi$	$W_{\Psi }=50$ (Tracking)	$\pm \infty$	(3)
Long. speed	$\dot{v_x}=\left(m{a}_x-F_{yf}sin\left(\delta \right)+m{v}_y\psi \right)/m$	$W_{v_x}=$ 0	$\pm \infty$	(4)
Lateral speed	$\dot{v_y}=\left(F_{yr}+F_{yf}cos\left(\delta \right)-m{v}_x\psi \right)/m$	$W_{v_y}=0$	$\pm \infty$	(5)
Yaw rate	$\dot{\psi }=\left(l_f{F}_{yf}cos\left(\delta \right)-l_r{F}_{yr}\right)/I_z$	$W_{\psi }=100$ (Comfort)	$\pm 0.4 \mathrm{rad}/\mathrm{s}$	(6)
Algebraic Expressions for Tire Model
Lat. Force front	$F_{yf}=2C_{\alpha f} \left(\delta -\left(v_y+l_f\psi \right)/v_x\right))$			(7)
Lat. Force rear	$F_{yr}=2C_{\alpha r}\left(v_y-l_r\psi \right)/v_x)$			(8)
Tracking-errors Model
Lateral error	$\dot{e_y}=v_{x}sin\left(e_{\Psi }\right)+v_{y}cos\left(e_{\Psi }\right)$	$W_{e_y}=0$	$\pm 1.5 \mathrm{m}$	(9)
Angular error	$\dot{e_{\Psi }}=\dot{\Psi }-\rho v_x$	$W_{e_{\Psi }}=0$	$\pm \infty$	(10)
Steering Wheel Model
Sw. angle	$\dot{\theta }=w$; $\left(\theta =\delta /k_r \right)$	$W_{e_{\theta }}=0$	$\pm \pi \mathrm{rad}$	(11)
Angular speed	$\dot{w}=\left(-1/J\right)\left(b_{\lambda }w+T_{sat}-T_{mpc}\right)$	$W_w=0.1$ (Comfort)	$\pm 4 \mathrm{rad}/\mathrm{s}$	(12)

$f$: non-linear function representing the road-vehicle model; x: states vector; u: input vector; l: external inputs vector $J_x$: states optimization function; $W_x$: states weights matrix; $x_{min/max}$: min/max states constraints vector.

. This model is suitable for maneuvers at high speeds which will allow increasing the testing speed as compared with previous work where a kinematic model was used [35]. The lateral forces in the front and rear tires ($F_{yf},F_{yr}$) are defined in Equations (7) and (8), where ($C_{\mathsf{\alpha }f},C_{\mathsf{\alpha }r}$) are the front and rear cornering stiffness constants, which are calculated according to the estimation method presented in [36]. Second, the tracking-error model includes two differential Equations (9) and (10), related to the lateral and angular error. This model eases the integration of the lane borders constraints, allowing emulation of the behavior of a lane-keeping system. Lastly, the steering system model relates the steering wheel angle with the applied torque. The inertia ($J$) and damping ($b$) second-order model is used (Equations (11) and (12), where the steering wheel angle is proportional to the steering angle ($\theta =k_r\delta$). It also uses an approximation of the self-aligning $T_{\mathit{sat}}=k{F}_{yf}$. The control torque, $\left(T_{\mathit{mpc}}\right)$, and its rate change, ($d{T}_{\mathit{mpc}}$), are defined in Equations (13) and (14) of

Table 3. NMPC formulation adaptive co-pilot (system control inputs).

Control Input $\left[\mathit{u},\mathrm{\Delta }\mathit{u}\right]$	Input Model Function	Optimization Function ${\mathit{J}}_{\mathit{u}}={\displaystyle {\displaystyle \sum }_{\mathit{k}=0}^{\mathit{N}-1}}{\Vert \mathit{u}\Vert }_{{\mathit{W}}_{\mathit{u}}}^2+{\Vert \mathrm{\Delta }\mathit{u}\Vert }_{{\mathit{W}}_{\mathrm{\Delta }\mathit{u}}}^2$	Constraint ${\mathit{u}}_{\mathit{min}}\le \mathit{u}\le {\mathit{u}}_{\mathit{max}}$ $\mathrm{\Delta }{\mathit{u}}_{\mathit{min}}\le \mathrm{\Delta }\mathit{u}\le \mathrm{\Delta }{u}_{\mathit{max}}$	Equation N°
Control torque (u)	${\dot{T}}_{\mathit{mpc}}=\lambda d{T}_{\mathit{mpc}}$	$W_{T_{\mathit{mpc}}}=0.01$ (Effort)	$\pm {\lambda }_{\mathit{dim}} \mathrm{Nm}$	(13)
Control torque rate of change ($\Delta u$)	$d{T}_{\mathit{mpc}}$	$W_{d{T}_{\mathit{mpc}}}=0.1$ (Effort)	$\pm 0.2 \mathrm{Nm}/\mathrm{s}$	(14)

$\mathsf{\Delta }u$: input rate of change vector; $J_u$: inputs optimization function; $W_u$: input weights matrix; $W_{\mathsf{\Delta }u}$: input rate of change weights matrix; $u_{\mathit{min}/\mathit{max}}$: min/max input constraints vector; $\mathsf{\Delta }{u}_{\mathit{min}/\mathit{max}}$: min/max input rate of change constraints vector.

. Additionally, the values of the NMPC parameters are given in

Table 4. NMPC formulation adaptive co-pilot (system parameters).

Parameter	Value	Parameter	Value	Parameter	Value
Vehicle mass $\left(m\right)$	1650 kg	Motor inertia $\left(J\right)$	0.1 kg·m2	Cornering stiffness front-rear ($C_f,C_r$)	940 × 102 N 118 × 103 N
Vehicle inertia $\left(I_z\right)$	3234 kg·m2	Motor damping $\left(b\right)$	0.65 N·s/rad	MPC horizon (N)	30
Distance to axis front-rear $\left(l_f,l_r\right)$	1.40 m 1.65 m	Steering ratio $\left(k_r\right)$	8.77	MPC sample-time ($T_s$)	0.05 s

.

2.1.2. The Optimization Problem

The optimization function encompasses multiple minimization objectives ($J_x+J_u)$ and system constraints (${\mathit{x}}_{\mathit{min}/\mathit{max}}$, ${\mathit{u}}_{\mathit{min}/\mathit{max}}$, $\Delta {\mathit{u}}_{\mathit{min}/\mathit{max}}$) which are separated into three categories: (1) the tracking performance, to minimize the deviation from the reference trajectory (minimize $\left(X,Y,\Psi \right)$), (2) the driving comfort, looking for low drifting and smooth steering wheel corrections (minimize ($\psi ,w$)), (3) the reduction of driver effort, which minimizes the control command and its rate of change ($T_{\mathit{mpc}}, \mathrm{\Delta }{T}_{\mathit{mpc}}$). Moreover, safety considerations are added by applying a constraint on the yaw rate ($\psi$) to avoid unsafe drifting of vehicle (tested experimentally and congruent with a related work [37]), and also limiting the maximum allowed lateral deviation (defined approximately as half of the lane width, to avoid vehicle departing from the lane). Additional constraints are added to limit the steering wheel behavior ($\theta$, $w,T_{\mathit{mpc}}, \mathrm{\Delta }{T}_{\mathit{mpc}}$) based on subjective feeling of drivers in the simulator.

2.1.3. The Adaptive Authority

Having a variable level of authority ($\lambda$) is one of the requirements for the shared controller, as it needs to have the ability to vary its stiffness around the desired steering wheel angle, which affects the strength with which the driver has to perform to override it. Therefore, the controller may have the same tracking performance, but with a different level of authority. In a preceding work [35], this authority was integrated into the controller as an additional term ($T_{\mathit{mpc}}+\lambda \left(\theta -{\theta }_{\mathit{opt}}\right)$). However, it presented different limitations; for example, (1) the control torque came from two sources, (2) the need for calculating the value of ${\theta }_{\mathit{opt}}$, (3) the possible effect of non-continuity in the term $\left(\theta -{\theta }_{\mathit{opt}}\right)$ which can affect the driver’s feeling at the steering wheel, and also (4) as the authority component was included outside of the NMPC formulation, the constraints could not be guaranteed. This paper improves the design with the inclusion of the authority level as a factor within the torque derivative equation (${\dot{T}}_{\mathit{mpc}}=\lambda d{T}_{\mathit{mpc}}$), such that all the torque contribution (including the effect of the authority) is included in the control signal $T_{\mathit{mpc}}$. In this sense, when $\lambda =1$, it represents the nominal controller. Under this configuration, $\lambda >1$ increases the authority of the nominal controller. However, this inclusion makes the system prone to oscillations and instabilities.

2.1.4. The Stability Criteria

Stability for NMPC has been discussed in the literature [38]; however, in practice, the controllers are generally adjusted via manual tuning, until finding the desired behavior. For the nominal controller ($\lambda =1)$ of Section 2.1.2, those weights are the ones defined in Table 2 and Table 3. Nevertheless, when increasing $\lambda$ the stability is affected (as shown in Figure 3), which would require a new adjustment of the weight matrices, making this methodology tedious by the constant tuning, not to mention the difficulty of finding the proper weights for each value of $\lambda$. In this sense, the novelty of our approach consists of a methodology to assign a level of authority to the controller without losing the stability achieved with the nominal controller. The following analysis was followed.

The second-order system of the steering wheel column is represented by the following differential Equation (15):

$$J\ddot{\theta }+b\dot{\theta }=T_{\mathit{total}}=T_{\mathit{sat}}+\lambda T_{\mathit{mpc}}+T_{\mathit{driver}}$$

(15)

where the self-aligning torque ($T_{\mathit{sat}}=-k_{\mathit{sat}}\theta$) provides the system’s stiffness, $T_{\mathit{mpc}}$ is the automation steering torque, $\lambda$ is the level of authority, and $T_{\mathit{driver}}$ is the torque exerted by the driver’s hands on the steering wheel. For the analysis of the system stability, the equation is solved in its homogeneous form ($T_{\mathit{driver}}=0$) and is linearized around the equilibrium position, rendering:

$$J\ddot{\theta }+b\dot{\theta }+(k_{\mathit{sat}}+\lambda k_{\mathit{mpc}})\theta =0$$

(16)

This approximate representation (with $k_{\mathit{sat}}$ and $k_{\mathit{mpc}}$ being the stiffness added by the self-aligning torque and the NMPC control torque, respectively), makes evident the destabilizing effect of the variable authority, as increasing the authority results in a stiffer system, thus resulting in a smaller damping ratio:

$$\zeta =\frac{b}{2\sqrt{J(k_{\mathit{sat}}+\lambda k_{\mathit{mpc}})}}$$

(17)

The NMPC controller is tuned for the nominal authority $\left(\lambda =1\right)$, with the parameters of Table 2 and Table 3 providing the reference damping ratio considered optimum for a stable system.

$${\zeta }_1=\frac{b}{2\sqrt{J(k_{\mathit{sat}}+\lambda k_{\mathit{mpc}})}}$$

(18)

The proposed strategy to maintain this damping ratio as the authority is varied; it relies on estimating the required damping $\left(b_{\lambda }\right)$ so that:

$${\zeta }_{\lambda }=\frac{b_{\lambda }}{2\sqrt{J(k_{\mathit{sat}}+\lambda k_{\mathit{mpc}})}}={\zeta }_1$$

(19)

Substituting Equation (18) into Equation (19) and considering the NMPC stiffness to be of the same magnitude as the self-aligning stiffness—as can be expected by looking at the equilibrium or quasistatic system behavior—a scaling factor for the system damping can be obtained:

$$b_{\lambda }=b\sqrt{\frac{\lambda +1}{2}}$$

(20)

This variable (scaled) damping can be easily introduced into the system through a linear term in the steering actuator motor controller and has proven to maintain a nearly constant damping ratio. This guarantees stable and comfortable system behavior through the whole variable authority range without the need to retune the NMPC (see Figure 4).

2.1.5. The Authority Dimension

As the authority is dimensionless, it makes it hard to identify the effect of $\lambda$ within the system in terms of torque intensity. For this purpose, after a series of tests with a driver in the loop, a relation between the maximum torque ($T_{\mathit{max}}={\lambda }_{\mathit{dim}}$) and $\lambda$ was observed (under the conditions of being separated 1.5 m from the lane center, emulating a road departure limit condition), such that $\lambda =g\left({\lambda }_{\mathit{dim}}\right)=2.2\times \mathit{max}\left({\lambda }_{\mathit{dim}},3\right)-5.5$. With this relation, ${\lambda }_{\mathit{dim}}$ becomes the constraint of the control input of the NMPC, allowing the user to indicate the level of desired authority in terms of a maximum reference torque given by the controller. In practice, the shared controller can be configured to assist with low authority (e.g., 2 Nm), or high authority (e.g., 10 Nm), which are dimensions that can intuitively be considered in the controller design.

To test this design, various trials were performed with a driver departing the vehicle from the lane center for about 2 m, with five different values of ${\lambda }_{\mathit{dim}}$. The driver was then asked to release their hands from the steering wheel to observe the performance and stability of the controller. Figure 3 shows that the driver effort is equivalent to ${\lambda }_{\mathit{dim}}$, but also that increasing the authority adds oscillations to the system response. Figure 4, on the contrary, shows the effect of the variable damping in keeping the stability and keeping the control performance with low tracking errors.

With this in mind, one of the benefits of the proposed framework is that as the low-level controller based on NMPC can keep the performance, robustness, and feasibility independently of the authority level, then the high-level decision-making (the arbitration system) is given more flexibility and can be adapted for different use cases without the risk of modifying the fundamental controller behavior.

2.2. Adaptive Co-Pilot—Arbitration

Once the main controller has a configurable authority that assures performance and stability, the next step is to design the decision logic that finds the appropriate value of ${\lambda }_{\mathit{dim}}$, to distribute the control authority between driver and automation. For this purpose, an FIS is designed to perform the arbitration process. FIS algorithms have offered a solution for including human knowledge in the design of automated driving functions [26], including applications for shared control [39]. This method uses a set of MFs and linguistic IF-THEN rules that defines the output of the decision logic.

The arbitration module proposed in this section is developed specifically for the use case of assistance for a distracted driver (described in Section 3.1). Similar work on shared control for inattentive drivers [22] proposed a strategy where the authority of the controller increased proportionally to the distraction level. In addition to this consideration, our decision logic also considers the deviation from the lane center as a second condition that helps to calculate the appropriate authority (this will be important in design principle (1)). To summarize, the fuzzy logic system is composed of two inputs (lateral error and level of driver distraction) and one output (level of authority ${\lambda }_{\mathit{dim}}$), as described in

Table 5. Fuzzy inference system for the arbitration module.

Variable	N° of MFs	[Labels] → [Values]	MFs
Inputs
Lateral error ${\mathit{e}}_{\mathit{y}}>0$	4	NONE = [−1.5 −0.57 −0.04 0.33] LOW = [−3.5 −0.01 0.32 1.04] MED = [0.34 1.15 1.52] HIGH = [1.04 1.54 2.54 3.04]
Driver distraction $0<{\mathit{D}}_{\mathit{d}}<1$	3	LOW = [−0.53 −0.21 −0.01 0.87] MED = [0.26 0.68 0.91] HIGH = [0.63 0.94 1.29 1.54]
Outputs
Authority $0<{\mathit{\lambda }}_{\mathit{dim}}<15$	4	MAN = [−1 0 0.5 2] LOW = [0.5 2 6] MED = [2.02 6.02 10] HIGH = [14.3 14.8 24.3 24.8]

. The two inputs are chosen as variables that represent the driver and the automated system.

Concerning the design of the MFs, the values for each label are representative rather than exact values (this is one of the advantages of FIS algorithms, as it resembles how humans define variables). In terms of lateral error, 1.5 m (HIGH) is the distance when the vehicle is at the lane border, while 0.3 m (NONE-LOW) was selected to give the driver some freedom to deviate from the lane center without experiencing intervention by the automated system. On the other hand, the MFs for driver distraction were selected by observing the raw distraction signal of different drivers. With respect to the output (${\lambda }_{\mathit{dim}}$), 15 Nm (HIGH) is the maximum steering motor torque, while the other values were selected experimentally based on subjective driver feeling on the steering: (a) MED, strong but possible to override (10 Nm), (b) MED-LOW, strong guidance with some driver freedom to move (6 Nm), and c) LOW-MAN, soft guidance barely felt at the steering (2 Nm).

Additionally, the design of this arbitration module considers the following two principles: (1) minimal intervention and (2) safety over comfort.

• The minimal intervention principle follows the idea that drivers only need assistance under specific circumstances; on the contrary, automation could create unnecessary conflicts that will produce a feeling for the driver of being controlled all the time, and decrease the driver acceptance rate. Additionally, not intervening when drivers are in suitable conditions to drive aims to increase the sense of responsibility for the driving task, in order to avoid over-trust in automation. Moreover, the inclusion of the lateral error in the logic is part of this principle, as assistance should not be given to the driver only considering the distraction level (as the driver could maintain a safe performance even under some levels of distraction). Therefore, a combination of performance (lateral error) and driver state (distraction level) is needed.
• The safety over comfort principle is based on the fact that safety has a higher priority over the parameters that add comfort to the driving task. In this sense, if the driver is not in a condition to drive, and is also performing an unsafe action, then the system has to intervene even if it overrides the driver or the maneuver creates discomfort (e.g., high lateral acceleration or strong torque at the steering wheel).

Under these two considerations, the IF-THEN rules of

Table 6. FIS for the arbitration module (IF-THEN rules).

IF-THEN Rules
Input ($D_d$)	Input ($e_y$)	Output (${\lambda }_{\mathit{dim}}$)	Design Strategy
LOW	LOW	MANUAL	Min. Intervention
	MEDIUM	LOW	Safety + Comfort
	HIGH	MEDIUM	Safety + Comfort
MEDIUM	LOW	LOW	Min. Intervention
	MEDIUM	MEDIUM	Safety + Comfort
	HIGH	HIGH	Safety over Comfort
HIGH	NONE	LOW	Min. Intervention
	LOW	MEDIUM	Safety + Comfort
	MEDIUM	HIGH	Safety over Comfort
	HIGH	HIGH	Safety over Comfort

are added to the design of the fuzzy logic system and produce a smooth surface of authority (${\lambda }_{\mathit{dim}}$) as shown in Figure 5.

2.3. Visual HMI

As part of the shared control framework presented in this work, a visual HMI is designed to enhance the interaction and mutual understanding between the driver and the automated system. The previous section described how the human and the machine interact through haptic feedback, and this subsection gives the design of the interface for visual interaction.

The topic of designing interaction strategies for partial and highly automated vehicles is strongly debated. Research has often focused on the issues related to the design of TOR, in order to allow easy and smooth transitions of control from the vehicle to the human driver. This approach depicts the human–vehicle system as a “finite state machine”, neglecting the fact that real driving situations require conditions in which the optimal interaction strategy lies in sharing, at a certain level, the dynamic driving task [40]. However, the concept of task sharing implies several ergonomic considerations, e.g., regarding the adaptation capabilities of human drivers and their willingness to trust a system that somehow introduces a limitation in driving, at least at the control level.The efforts made in the research focusing on “relevant driving situations” (e.g., disengagements, requests of take-over, intersections, etc.) have implied limited knowledge of normal scenarios, i.e., when the driving task cannot be completely handled in automated mode (please note that, in every case where LoA is not equal to 5, the driver can never be “a passenger”, so s/he must be in any case involved in the driving task, at least to monitor the situation). In this sense, the overall interaction strategy must be redesigned to make the driver feel, in every moment, part of the team. Even more importantly, the visual HMI (the one more dedicated to direct communication with the driver) should be harmonic with the overall driving system, as a building block of a more articulated interaction system.

The visual HMI proposed as part of this cooperative framework has the scope of complementing the adaptive co-pilot, acting on a distinctive perception level. In this sense, whereas the co-pilot is the actual enabler of the cooperation, the HMI is the enabler of trust in decisions and actions performed by the co-pilot. Without clear, effective, and transparent communication, the human agent may also be misled or, even worse, overwhelmed by complex and blurry information; for this reason, the visual HMI design is focused on increasing the awareness of the driver of the system state and informing him/her about the expected action.

The main concept exploited by the HMI is the level of control authority, intentionally placed in the foreground and depicted as a dynamic progress bar (as shown in Figure 6), to highlight that (1) control of the vehicle is a negotiated asset between the driver and the automated system and (2) cooperation is a dynamic feature. Moreover, the HMI has also been designed to be used as an additional source of information inside the cockpit, providing explanations regarding the actions required of the driver and accurate reconstructions of the surrounding environment.

The HMI design, instead of focusing on critical situations only, also concentrates on more common circumstances of cooperation, to evaluate the ease of understanding and the level of trust in the system. More detailed descriptions and results are reported in [41,42].

3. Results

This section presents the description of the driving performance tests, together with the analysis of the quantitative and qualitative results. First, the testing procedure is explained through the presentation of a user story, followed by the details of the experimental conditions, and closing with the definition of the KPIs. Concerning the results, the quantitative analysis is presented in terms of tracking performance, safety, and driving effort, whereas the qualitative evaluation of the system is obtained via the application of questionnaires, with emphasis on driving comfort, safety, and overall perception of the system.

3.1. Driving Performance Test

To evaluate the benefits of the adaptive co-pilot, various tests were performed with five drivers in a hardware and driver-in-the-loop simulator. The description of the test follows this order: (1) the user story is presented with the description of the use case (UC), (2) the experimental conditions are explained, and (3) the KPIs to compare the different driving modes are described for both quantitative and qualitative analysis.

3.1.1. User Story

To settle the driving conditions in the scope of the test, the following UC has been defined, highlighting a scenario where the driver–automation system would be benefited from their cooperation as a “team”.

UC (Supporting a distracted driver): A mother is driving in a highway/extra-urban road with her baby sitting at the back, in the right passenger seat. From time to time, the baby starts crying and catching her attention. The position of the baby is completely out of her scope, so she has to turn in order to take care of the child. She is driving an automated vehicle with the adaptive cruise control function activated. This implies that she is only taking care of the lateral control of the vehicle (however, she is not allowed to release both hands from the steering wheel).

This driving scenario presents several safety issues regarding vehicle control loss. Nevertheless, automated driving features such as LK, LC, and SC can prevent potential dangers, in cooperation with driver interventions. For this reason, they have been experimentally compared and evaluated.

3.1.2. Experimental Conditions

First, the previous scenario conditions were replicated in the testing platform. Second, the NMPC controller of Section 2.1 was used to reproduce the driving modes. Finally, the experimental procedure consisted of five drivers running the tests, using four different driving modes, under two cognitive conditions (concentrated and distracted).

The driving simulator shown in Figure 7 held the driving tests. The key component is the steering wheel interface, composed of a motor model 130ST with a maximum nominal torque of 15 Nm, with configurable damping and inertia via software (this allows a practical integration of the stability criterion $b_{\lambda }$). It is also equipped with an incremental encoder and a current sensor that is used to calculate the applied torque. Behind the steering wheel, there is a Basler ACE acA1920—40uc camera with a Sony IMX249 CMOS sensor, which performs the driver monitoring task. A Linux PC is used to perform the image processing through a convolutional neural network model to detect the driver’s head position [43]. The automated driving software is an in-house vehicle dynamic simulation tool c (Dynacar [44]) which considers a vehicle’s physical model based on multibody formulation. The control and decision algorithms are developed in MATLAB/Simulink, while the NMPC solver is the ACADO Toolkit [45], capable of obtaining optimal solutions in microseconds. The front screens allow the driver to see the driving environment, while the second task is held in a touch monitor using the right hand.

The driving modes are used to compare different types of assistance when the driver is performing a secondary task. MANUAL mode is used as a baseline, and it represents “no assistance”. Moreover, two commercial ADAS are included: lane keeping assist (LKA, used within this paper as LK) and automated lane centering (ALC, referred to in this work as LC). As the use of these terms by OEMs tends to be misleading, we are using the definition of the National Highway Traffic Safety Administration (NHTSA) [46]. LK actively keeps the vehicle within the lane by intervening as the vehicle approaches the lane boundaries. However, there is a dead band near the center of the lane where the LK system does not provide control. LC, instead, provides continuous lateral control (with a fixed authority) to keep the vehicle on a reference trajectory within the travel lane. Besides these systems, shared control (representing the adaptive co-pilot) is considered an adaptive authority that depends on the driver’s state and the tracking performance, aiding the driver according to his/her needs of support. These modes are summarized in

Table 7. The four driving modes for the experimental tests.

Manual Driving (MANUAL)	Lane Keeping (LK)	Lane Centering (LC)	Shared Control (SC)
No torque is applied by the automation. The driver only feels the self-aligning torque.	When the vehicle approaches the border line, the vehicle intervenes, applying a momentary torque.	A continuous torque is applied to keep the vehicle on a reference trajectory within the lane.	If the driver is attentive, they receive minimal correction torque, which only increases when getting close to the borders. If the driver is distracted, the authority increases and the free moving range is reduced.
${\lambda }_{\mathit{dim}} =0$ Nm $\left|e_y\right| \le \infty$ $\left|T_{\mathit{mpc}}\right|\le {\lambda }_{\mathit{dim}}$	${\lambda }_{\mathit{dim}} =0$ Nm $\left|e_y\right| \le 1.5$ m $\left|T_{\mathit{mpc}}\right|\le 3$ Nm	${\lambda }_{\mathit{dim}} =3$ Nm $\left|e_y\right| \le \infty$ $\left|T_{\mathit{mpc}}\right|\le {\lambda }_{\mathit{dim}}$	${\lambda }_{\mathit{dim}} =FI{S}_a$ $\left|e_y\right| \le \infty$ $\left|T_{\mathit{mpc}}\right|\le {\lambda }_{\mathit{dim}}$	${\lambda }_{\mathit{dim}} =FI{S}_d$ $\left|e_y\right| \le \infty$ $\left|T_{\mathit{mpc}}\right|\le {\lambda }_{\mathit{dim}}$

$FI{S}_a:$ is the authority calculated by the FIS (arbitration module) when the driver is attentive, $FI{S}_d:$ is the authority calculated by the FIS (arbitration module) when the driver is distracted. ${\lambda }_{\mathit{dim}}$: is the control authority given to the automated system (steering wheel stiffness), and is also defined as the maximum torque applied by the automated system (reached when the vehicle is at the lane border) thanks to the following link with the control torque constraint $\left|T_{\mathit{mpc}}\right|\le {\lambda }_{\mathit{dim}}$ (refer to Section 2.1.5 and Equation (13)).

.

In the experimental procedures, the tests are performed by the driver interacting with the vehicle only through the motorized steering wheel, while the longitudinal control is resolved by the adaptive cruise control. They consist of a 6 min highway driving situation (with minimum curvature radio of 420 m), at 85 km/h, with periodic distraction events (each 20 s). During each distraction, the driver removes their gaze from the road and performs a secondary task, turning the head to the right, and interacts with a touch monitor with the right hand, always keeping the other hand on the steering wheel. This task is notified with an auditory alert and takes between 2 to 3 s. The distraction consists of the driver pressing a button on the touchscreen and keeping their attention towards it until the 2 s indication is activated. Then, the driver gets back to the normal driving task. These steps are visualized in Figure 7.

The complete test is repeated four times (one for each of the driving modes in Table 7). The driving scenario remains fixed. To avoid boredom and drowsiness due to the recursive situations, other vehicles and sporadic buildings have been added to the environment. Before the experiments, each participant was allowed to drive freely for 10 min to get used to the simulator environment and the different driving modes. The terms denominating each of the modes were succinctly explained to them during the adaptation session. At the same time, the DMS was calibrated to work properly with each individual.

3.1.3. Key Performance Indicators

KPIs have been selected in the context of the PRYSTINE project [47], by conducting specific project workshops with experts in the field. Previous works in shared control studies [8] were also used as a reference to select the representative measurements of the main fields of evaluation.)

Three types of indicators are used to quantitatively evaluate the performance of the tested driving modes:

• Tracking errors: the ability to follow the expected trajectory is evaluated by the RMS and maximum (MAX) lateral and angular tracking errors.
• Safety indicators: the RMS and minimum (MIN) TLC indicate how close (in time) the vehicle is from departing the lane limits. It is estimated at any given time assuming the steering angular speed would remain unchanged. Additionally, the percentage of the time driven with the TLC below a threshold of 3.8 s (the minimum TLC when the automated system drives alone by the testing route, with the configuration of the nominal controller) provides a measure of the risk exposure.
• Driving efforts: the RMS and maximum torque exerted by the driver provide a measure of the effort applied, which relates to conflict and comfort. The RMS and maximum automation torque provide a measure of the work performed by the system and are related to its efficiency.

Moreover, three types of indicators are used to evaluate the subjective perception of the different driving modes, in the particular test-driving conditions, by the participants:

• Safety-related indicators: evaluate the driver’s sense of being protected, being allowed to perform the secondary task, or being required to continuously monitor the environment.
• Comfort-related indicators: evaluate the driver’s feeling of the system being harmonious or too intrusive in its interaction.
• Overall driver perception: evaluates the driver’s assessment of the system, using its own criteria to ponder safety and comfort behavior.

3.2. Quantitative Evaluation (Experimental Results)

Exploratory studies were performed with five drivers (one woman and four men), aged 21 to 49 years (mean = 30.2, SD = 10.8), with at least 3 years of driving experience (mean = 11.8, SD = 10.9), including occasional (1), frequent (1), and regular (3) drivers. All have some degree of relation with automated driving R&D activities.

Figure 8 shows typical driver behavior using the four driving modes. The lateral error graphic (Figure 8a) shows that in MANUAL and LK modes, the driver repeatedly departs from the lane center during the distraction events, though the LK effect of avoiding the lane departure is efficiently achieved. Results also indicate that the distraction events during higher road curvature sections (Figure 8d) produced larger deviations. On the contrary, LC and SC do not show a significant difference between straight and curved segments, and overall, both seem to behave similarly, achieving the goal of keeping the vehicle close to the lane center. In terms of effort, the driver applied the highest torques when driving in MANUAL and LK modes (Figure 8c). While in MANUAL, most of the torque is applied to return the vehicle to the lane center when large deviations occur; in LK, the driver torque increases by the “bump” effect produced when the vehicle reaches the lane limits (Figure 8f). On the other hand, at first sight, SC seems to produce lower efforts compared to LC (Figure 8c,e), but due to the lack of visible significant difference in terms of effort, the analysis will be performed quantitatively. Figure 8b,e show the signal of the DMS during one distraction event (DE), and the authority calculated by the FIS system.

Figure 9, Figure 10, Figure 11, Figure 12, Figure 13 and Figure 14 show the performance of each driving mode, separating the time spent within the distraction event window (of 10 s as shown in Figure 7) and out of it (normal driving). Figure 9, Figure 10, Figure 13 and Figure 14 compile the tracking (lateral and angular) errors and (driver and automation) driving efforts, respectively. The overall (combining all drivers) RMS values are shown in color, while the respective maximum values are depicted by the white bars. The individual RMS and MAX values for each driver are shown by color and black crosses (+) to evaluate the data dispersion. Note that RMS values are considered deviations from the road center (i.e., they are not standard deviations around the mean), thus, they also reflect the effects of the bias tracking errors. Figure 11 and Figure 12 show safety indicators: Figure 11 shows RMS and MIN TLC; Figure 12 shows the percentage of time spent with a TLC below a 3.8 s (safety) threshold.

Additionally, performance indicators of the LC controller, when allowed to control the vehicle without driver intervention (referred to in graphics as Automation-only), are provided to validate the controller and for comparison purposes. The controller shows efficient lateral and angular tracking performance, with an RMS on the lateral error of 6 cm and MAX value of 11 cm, and an angular deviation below 1.5 deg., which are positive results for a reference tracking controller. In terms of safety, the TLC is always over 3.8 s (this value is used as the safety threshold for the comparison of the TLC under the four driving modes). Concerning the controller efficiency, automation torque RMS is close to 0.5 Nm, and the MAX value is around 1.5 Nm (applied during the highest curvature section).

The lateral and angular errors (Figure 9 and Figure 10) show that all three tested driving aids significantly improve the ability to track the road center trajectory with respect to the MANUAL driving mode. In normal driving, all are acceptable (as the vehicle remains within the lane at all times). Yet, the improvement obtained by both LC and SC is very similar and much better than for the LK. Note that the LK only acts when the vehicle approaches the lane limits, while the LC acts all the time, providing feedback about any deviation from the lane center. The SC, on the other hand, provides some freedom around the centerline, but gives feedback as the deviation increases, before approaching the lane limits. A lower authority in SC (${\lambda }_{\mathit{dim}}\approx$1 Nm) compared to LC (${\lambda }_{\mathit{dim}}=$3 Nm, see Figure 8e) in normal driving, seems to produce a similar tracking performance. This should be further studied, as having the same performance but with less intervention is an important characteristic that could result in positive acceptance of the SC mode.

During the distraction event, the differences are amplified. In general, all driving modes are able to keep within lane boundaries. As shown by the RMS values, even in MANUAL mode all drivers are able to stay within the lane most of the time, which might lead to a false sense of security while performing the secondary task. However, it is also noted that within the 20 events tested in MANUAL mode, all drivers had at least one out-of-boundaries excursion, which is enough to produce an accident. The feedback given by the LK does help to completely avoid these out-of-boundaries excursions during the distraction event and reduces degradation of the ability to stay closer to the center when compared to the MANUAL mode.

On the other hand, the LC and SC driving modes are able to maintain tracking performance during the distraction event. In fact, RMS values for angular and lateral errors are almost identical during the distraction event to those during normal driving, except for the lateral error in SC mode, which shows a reduction consistent with the higher automation authority assigned when the driver is not looking at the road. Note that the RMS lateral error follows the behavior of the automation authority, i.e., as the LC RMS lateral error remains the same, during normal driving, when the SC authority is lower than that of the LC, the SC RMS lateral error is higher, while it is lower during the distraction when the authority is larger. This relationship between the authority and the lateral error found in this exploratory study should be further studied with a larger, more representative driver sample. It is also worth noting that the maximum angular errors for both LC and SC increase similarly during the distraction, while the MAX lateral errors decrease. This might be associated with faster corrections by the automated system, which should be further studied. Overall, when driver and automation are collaborating as a “team”, the tracking performance is improved in comparison with MANUAL, getting closer to the benefits of Automation-only.

The safety indicators of Figure 11 and Figure 12 provide a clearer picture of the system behavior under the different driving modes. As expected, the MANUAL mode had the lowest TLC of all modes both for normal driving and during distraction events, closely followed by the LK mode. The main difference is that during distraction all drivers got to cross the lane (TLC MIN $\approx$ 0) at least once for MANUAL driving, while the LK mode was able to prevent any lane crossing with a minimum TLC of 0.76 s. The benefits of the LK mode are further evidenced by the fact that the time spent in a riskier condition (i.e., with a TLC below a 3.8 s threshold) is noticeably reduced with respect to the MANUAL mode. This effect seems to be enhanced because, when entering a curve (or, more properly, when approaching a curvature change), the NMPC controller predicts the vehicle will approach the lane borders at a future time, providing the driver with an anticipating haptic torque.

Moreover, as expected, all driving modes show a lower TLC during the distraction event than when driving normally. Yet, that difference is much smaller for the LC and SC modes. It is also evident that the portion of time driving with a low TLC increases abruptly during the distraction event for MANUAL and LK modes, but does not increase much for LC and SC modes. Furthermore, for both conditions, the SC mode leads to the highest RMS TLC, with similar MIN TLC excursions to those of the LC mode. A further suggestion of the effect of the curvature anticipating feedback from the LK is depicted by the time spent below the TLC threshold in normal driving. Overall, concerning the safety indicators, SC is the one that moves further away from the drawbacks of MANUAL, and gets closer to the lower TLC of Automation-only, under both normal driving and distraction events. Thus, this highlights the benefits of the “team” approach.

The driving efforts (Figure 13 and Figure 14) provide insight into the driver/automation interaction or conflict. The driver torque is, of course, zero for Automation-only, whereas automation torque is zero for MANUAL driving mode. Then, for both conditions (normal driving and during distraction), the RMS torque of the automated modes is smallest for LK and largest for LC. When the automation is present, the driver torque shows a similar trend to that of the automation, but it must be noted that this similarity is not direct. At points, the automation torque “helps” the driver, pushing in the same direction, while at other times the automation “corrects” the driver with an opposing torque.

Taking the driver torque on manual mode as the reference, the driver effort is reduced by the LK, particularly during the distraction event, notoriously because the major corrections required by the largest excursions when approaching lane borders are supported by the LK strategy. The LC mode, on the other hand, increases driver effort in normal driving, since the conflict when wandering around the centerline produces an automation correction torque. During the distraction event, the LC shows an RMS driver torque similar to that of the MANUAL mode, in this case, to resist the automation guiding torque, which reduces the MAX efforts by bounding the off-center excursions (see Figure 9). The SC mode reduces both the RMS torque and the occasional large excursion corrections in normal driving by reducing the guiding conflict (with a lower authority) and bounding the off-center excursions before approaching the lane limits. Finally, during the distraction event, the SC mode reduces the tracking errors by applying a larger authority as discussed above. These smaller tracking errors also translate into reduced driver efforts compared to LC and MANUAL modes.

To summarize, when attentive, the driver can keep a very small tracking deviation in all modes (see Figure 9). In those cases, the SC mode provides very little support, and the driver feels very close to manually driving, being free to wander within a narrow band around the center. Only when the occasional larger deviation occurs, the SC provides centering feedback. On the other hand, even when the tracking errors are small, the LK will provide feedback indications when the steering is heading towards a possible lane crossing (i.e., when the TLC is small). The LC will always provide feedback even with small tracking errors. Thus, considering tracking performance, LC and SC modes seem to provide the best results. When looking at the safety indicators, SC shows the highest performance, closely followed by the LC mode. Yet, in terms of effort, the lowest driver effort is required by the LK mode, followed by the SC, while the LC presents the highest driver torque conflict. Overall, considering tracking, safety, and effort parameters, SC mode seems to give the best compromise amongst the tested modes, being the farthest of all from MANUAL, and the closest to Automation-only, thus, encouraging the idea of being a “team”. Moreover, it seems worth evaluating a mode combining the benefits of SC with the curve-anticipating torque of the LK mode.

3.3. Qualitative Evaluation (Questionnaires)

After running all tests, the participants were asked to grade every driving mode, in this particular scenario, on the following questions, from 1 (no/bad) to 10 (yes/good):

• Did you have the feeling that you were free to perform the secondary task?
• Did you feel the system required your continuous monitoring of the situation?
• Did you have the feeling that the system was too intrusive?
• Did you feel that your security was ensured by the system?
• Did you feel that your interaction with the system was harmonious?
• Provide an overall evaluation of the system.

Figure 15 compiles participant’s scores for each question and their respective averages. Questions 1, 2, and 4 relate to the perception of the system´s ability to improve safety. Questions 3 and 5 address the issue of comfortable interaction through haptic feedback. Question 6 asks for an overall assessment of the different driving modes, requiring participants to express a balancing criterion.

Questions 1, 2, and 4, correlate very well. The MANUAL mode is absolutely perceived as not providing any safety in the simulated scenario with repeated distraction events. The LK mode is perceived to provide some safety and the LC and SC are almost identically perceived to provide a high level of safety. Curiously, only one driver felt that the SC required less continuous monitoring of the situation than LC, while all others felt as compelled or more compelled to keep monitoring by the SC.

Questions 3 and 5 also correlate well, showing that MANUAL and SC provided highly harmonious interactions and that the SC is not felt to be an intrusive system. On the other hand, the LC is perceived as the most intrusive of all tested modes, in line with the highest conflicting torque discussed above, while the LK is perceived as less intrusive, but also less harmonious, which most likely reflects the freedom to wander within small trajectory deviations that are characteristic of human drivers (low intrusiveness) combined with momentary corrections or “notches” that perturb the harmony of the interaction.

Finally, after having pondered both safety and comfort parameters, the participants were asked to provide an overall score for each mode, forcing them to ponder their system evaluation under their particular criterion. A clear trend favoring SC appears in the answers. Again, a noteworthy answer is attributed to a participant that gave a perfect score to the MANUAL mode, apparently favoring driving independence in this mode, while accepting its inherent inability to provide extra protection during a distraction event. Not surprisingly, this answer came from the driver that never crossed the lane during the tests.

From the driver’s perception information, it also becomes apparent that a combination of SC with LK is worth evaluating. Not only might the anticipating torque of the LK help the already favored SC mode to improve dynamic parameters as discussed above, it could also help it to feel more harmonious and, if needed (depending on the automation capabilities), it could allow a reduction of the authority during normal driving (attentive driver) and compel the driver to keep monitoring the environment and avoid performing secondary tasks without compromising the added safety.

4. Discussion

Research on the trade-off between humans and automation has been conducted in [48], in which the authors claimed that only with a proper design of the cooperative human–machine systems will technological advances make our lives easier, safer, and more enjoyable rather than harder and more uncomfortable. In fact, combining the individual strength of the different partners can create a fruitful symbiosis between humans and technology, where the automated system can play an important role, but still has to serve the human. In [49], Nishimura et al. selected haptic shared control to achieve a smooth collaboration between humans and automated systems in a lane-keeping maneuver, because this channel can facilitate mutual communication [50,51].

Keeping that in mind, we have been inspired by the work of A. Bhardwaj and colleagues [9], since their research also faced the challenge of determining a combination that preserves the best performance features of human and automatic control in a cooperative manner. In this work, the authors used a driving simulator to investigate the ability of human–automation teams to cover for human and automation faults (the goal was to avoid obstacles), developing an MPC and considering two baseline conditions.

In our work, we extended the automation support, considering distracted drivers and also investigating the cooperation of human and automation (that is, of the team) when one of the members has limited resources (e.g., the human driver is inattentive). We have adopted an NMPC approach, considering experiments at a driving simulator with real users. Additionally, the NMPC-based shared controller proposed in this work offers a novel design in terms of stability criteria under different levels of authority (which is no longer dimensionless, but with torque units, which allows a more intuitive selection of its value). Furthermore, we have considered an appropriate methodology for sharing a given task, which is important to achieve effective vehicle control, presenting two design considerations in the arbitration module (i.e., minimal intervention and safety-over-comfort).

Moreover, in comparison with a similar work that also studied shared control for the scenario of a distracted driver [22], the quantitative results show consistency overall. In terms of controller performance without driver intervention, both lateral error RMSs are under 10 cm. In the tests with real drivers, both works show an improvement on lateral error RMS during the distraction event when using SC (adaptive authority). However, our work showed improved performance during normal driving in comparison with MANUAL, while the cited work showed similar performance, which is expected to be caused by a difference in how SC behaves when the driver is concentrating (their work recreates manual driving, while ours gives a low assistance torque up to 1 Nm (see Figure 8e). In terms of driver efforts, the cited work shows the highest effort in SC while performing the secondary task, while our findings indicate lower efforts using SC compared with LC and MANUAL. In addition, we have also drafted a qualitative analysis regarding how drivers perceive this cooperative system, and SC had the higher scores in terms of safety and comfort, which is similar to the subjective results obtained in the aforementioned work.

As an additional point in this discussion, it is important to underline here that—as stated in [52]— humans are constantly assessing trustworthiness, and therefore an effective human–machine system must be trustworthy, because “no trust, no use” [53]. In this paper, trustworthiness is defined as a dispositional and relational property of agents relative to other agents within spatiotemporal bounds. In other words, humans tend to trust (artificial) agents that operate within the bounds of human cognition and are less trusting of systems that operate at superhuman levels. Under this perspective, being a member of the team can help to build trustworthiness towards automated vehicles: this means that the members have to obey the norms of logic, rationality, and ethics under pragmatic constraints, and, in case of disagreement in the team, automation may need sophisticated social identities, including empathy and reputational concerns (in order to facilitate dialogue and argumentation). From a technical point of view, artificial agents must be reliable, incorporating adaptability and redundancy, to assure trustworthiness.

Concerning the future steps, this research goes in three directions:

• Extend the experiments presented in this work, with a larger number of participants, a more realistic scenario with higher curvature sections, other secondary tasks, and additional metrics (e.g., secondary task fulfillment evaluation and take-over performance when automation support is unexpectedly deactivated). In particular, the take-over behavior will be a key aspect in the acceptance of the SC mode in the future, as it is expected to result in better performance in comparison to when the driver is kept out of the loop.
• Extend the scenarios beyond the distracted driver, using the driving simulator again. With reference to the work of Okada and colleagues [54], we will include curves and other road layouts. Moreover, two additional use-cases will be evaluated: (1) support in collision avoidance of sudden obstacles when driving in automated mode, and (2) support in an overtaking maneuver, evaluating transitions from automated to manual, initiated by the driver when the AD cannot perform this maneuver due to—for example—limitations in perception. In such a situation, the system informs the driver and asks for support. Two possibilities can be investigated: cooperation in perception (where the influence of visual HMI presented in this work will be evaluated) and real-time cooperation in action.
• Integration of the HMI: while presented in this work as an initial prototype, the next step is to integrate the visual HMI with real data coming from the simulator, to be used in the experimental test to evaluate its effectiveness as an enabler of trust in decisions and actions performed by the co-pilot.
• Implementation of the co-pilot enabler in a real demonstrator vehicle, using an automated Renault Twizy.

5. Conclusions

This paper deals with the human–computer interaction topic, applied to the ADS in its interaction with a human driver. It is commonly accepted that ADS can bring benefits, mainly in terms of improved safety and enhanced mobility (i.e., for elderly people and persons with impairment). When the ADS approaches the limits of its own ODD, the system issues a TOR, and then the driver is asked to get back into the control loop in the “appropriated” time. This paradigm is unrealistic and difficult to understand because it implicitly depicts the human–vehicle system as a kind of “finite state machine”, but there are some driving situations in which the optimal interaction strategy lies in sharing, at a certain level, the dynamic driving task. Therefore, we claim that a new approach is possible, where human and artificial system together form a team, with the goal to reach the destination in a safe way. In order to achieve that, we designed and implemented an intelligent and adaptive co-pilot, here represented by the arbitration and shared control algorithms, which is the enabler of the cooperation between human-agent and machine-agent: at each time step, it is able to decide the level of authority and thus how the driving task can be shared, depending on the external conditions, the available resources of the system, and the cognitive status of the driver.

Considering the selected KPIs, the results show better performance of the combined team (human–automation), with respect to the baselines we considered (“normal” driving with ADAS and automated system as it is currently): the critical situations are reduced (“critical” means that an accident or near-accident event occurred) and there is also an improvement in the tracking performance and in the driving efforts. The benefits shown in the quantitative analysis have then been reflected in the qualitative analysis, as drivers evaluated the SC modality as the best from the four tested, given statements that categorize the system as safe, harmonious, less intrusive, and also with the sense that the driver had to participate in the driving task to a greater extent than with the LC mode (even with the support given by the SC mode). The last is relevant because one of the major drawbacks of SAE-L2 and SAE-L3 is over-trust in automation and poor take-over performance, respectively. In this sense, SC would improve the interaction by keeping the driver in the control loop, making clear the need for his/her participation in the vehicle control task, while benefiting from improved safety, performance, and comfort.

To sum up, we propose a paradigm shift: from the “boss” (that commands) to the “team” (that cooperates and mutually helps). The first implies a rigid hierarchical structure (i.e., automation is supervised by the human), with separated responsibilities (either the system is in charge, or the human driver) and fixed, precise roles; the second approach instead implies the freedom to cooperate, with accountability towards other members (e.g., two-way communication) and the possibility to share extensive information, authority, and control, so that the decisions are moved to the maximum level of awareness and resource availability. Recalling the title of the paper, we can claim at the end that being a “valuable member of the team” is better than being “the unique boss”: the adaptive co-pilot is the technological enabler of it, providing more accurate results in terms of performance, safety, trustworthiness, and comfort.