Coordinated Control Design for Ethical Maneuvering of Autonomous Vehicles

Abstract

This paper proposes a coordinated control design method, with which the autonomous vehicle is able to perform ethical maneuvers. The starting point of the provided method is a thorough analysis on the ethical concepts for autonomous vehicle control design methods. Using the results of the analysis, an own concept is provided based on some principles of Protestant ethics. The concept focuses on improving trust in vehicle control through clear rules and predictable vehicle motion, and it is in line with the state-of-the-art ethical vehicle control methods. Moreover, an optimal Model Predictive Control (MPC) design method is formed, in which the provided ethical concept is incorporated. The outputs of the optimal control are steering angle and velocity profile, with which the ethical maneuvering can be achieved. The contribution of the paper is a coordinated control design method, which is able to involve ethical principles. Moreover, the application of Protestant ethics in this context is also a novel achievement in the paper. The effectiveness of the method through different simulation scenarios is illustrated.

1. Introduction and Motivation

Automation of vehicle and traffic management systems step-by-step transforms everyday habits of those involved in transportation, and consequently, the trends in the use of transportation services. Initially, automation only brought about the appearance of individual active safety functionalities of the vehicle (e.g., anti-lock brakes, electronic brake assist), but it has now surpassed the boundaries of the vehicle and reached higher levels of the traffic system, e.g., as route planning via traffic information [1]. The impacts of vehicle automation on the traffic system and on the passengers using transportation services is becoming greater, and this will become even more pronounced with the gradual appearance of higher levels of autonomous driving [2]. Therefore, the automation of vehicles and transportation, especially the use of algorithms based on artificial intelligence applied in them, cannot be considered solely on technical level. For taking into account their social implications [3], aspects of law, politics, economics, and ethics must be considered [4,5]. Thus, handling of ethical problems in autonomous systems, and formulating ethical directives are in the focus of research [6,7].

This paper focuses on some ethical aspects of autonomous vehicles, particularly their control design for achieving ethical maneuvering capability. Similarly to the work of [8], which distinguishes intelligence and intelligent behavior, the goal of this paper is not to provide a method for designing ethical autonomous vehicles. Instead, the goal is to provide a design method, with which the autonomous vehicle is capable to perform ethical maneuvers, i.e., maneuvering is in line with a predefined ethical concept. Nevertheless, the selection of the ethical concept is a human decision, resulted by the ethical conviction of humans.

1.1. Ethical Concepts in the Current Literature of Autonomous Vehicle Control

A recently published review study states that ethical maneuvering issue can be approached in several ways [9]: first, through empirical surveys; second, through ethical considerations in the field of artificial intelligence and robotics; third, through the direct incorporation of ethical requirements into control tasks; and fourth, through direct teaching of human actions to machines. The most well-known research in the first approach is the Moral Machine project, which examines the priorities of human decisions globally with a focus on critical traffic situations. The analysis contributed to the empirical determination of ethical preferences, their priorities, and their dependence on individual, cultural, and demographic characteristics [10]. However, the results of the study can also pose psychological obstacles to the widespread adoption of automated vehicles, as the expectation of vehicle ownership and the need to maximize the number of lives saved in accidents may conflict with each other [11]. Similarly, the public is willing to express more blame for automated vehicles as for human drivers in a mixed traffic crash situation [12]. Moreover, empirical online surveys have strong limitations, because degree of human involvement in the traffic situation has high impact on the decision [13]. Therefore, at least a virtual, or augmented reality environment in the ethical-oriented analysis must be used. A different type of empirical analysis is the application of Turing approach on automated vehicles. Work of Cascetta et al. [8] presents a novel analysis for automated vehicles, in which the passengers had to differentiate human driving and Level 2 automated driving. In most of the cases the passengers were not able to differentiate driving of the vehicles. Thus, it is concluded that if the human driving style can be imitated, the relevance of long-debated ethical questions can be limited.

The second concept is that the ethical principles developed in the robotics field can be well used in autonomous vehicle control, taking into account that we are dealing with similar devices with similar autonomy in a different context. Autonomy of robotic and vehicle systems has been interpreted by [14]. Work of Millar [15] provides a tool for autonomous vehicles and robotic systems, with which their decision making processes can be evaluated. AI-based approaches for learning human decision making process in autonomous vehicle context have been used in [16]. The goal of this work is the fast adaptation to human expectations through a learning process. A recent study has addressed ethical challenges in the context of cyber-physical production systems [17], and another study provides a comprehensive overview of the relationship between technology and ethics from the viewpoint of high education [18].

An important study in the third approach, specific to vehicles, states that certain ethical considerations can be incorporated into autonomous vehicle control through Model Predictive Control (MPC) planning procedures [19]. In the structure of MPC, deontological principles, that is, a rule-based ethical framework, shape the objective function of the control system, taking into account ethical principles, e.g., maximization of human life and minimization of harm. However, it is important to note that the direct incorporation of ethical principles into the control system can pose difficulties in handling conflicts and ethical dilemmas in complex, real-world situations. For example, a problem of formulating cost-based ethical approaches is that some human preferences, e.g., deontological or utilitarist behavior can vary, see [20].

Furthermore, a fourth type of ethical approach is the focusing on trust in technology, instead of embedding ethical frameworks in the vehicle control system. Analysis of responsibility [21] and trust [22,23] are in the focus of these works.In the paper of Martinho et al. [24] high number of available industrial reports on the topic of ethical vehicle control has been analyzed. It has been stated that the viewpoint of industrial companies significantly differs from scholars. The goal of the industrial companies is to facilitate being trust in their products, see, e.g., technical reports of Ford [25], or Intel [26].

The last, fifth group of concept involves the ethical-design methods with theological aspects [27]. In spite of 2000 years old long ethical tradition of Christianity, only few publications can be found which interpret the ethical challenges of autonomous vehicles. Christian theology mainly involves—independently from the own specialties of different churches and confessions—the ethical-oriented topics in the field of systematic theology. Moreover, in recent decades the deep analysis of the different books in the Bible has led to the formulation of Old Testament ethics [28,29] and New Testament ethics, see, e.g., [30,31,32]. Some relationships between technology and theology in the book of [33] are detailed, especially focusing on the problems of artificial intelligence (AI). A systematic approach of AI and religious studies in [34] can also be found. In the literature of bridges between theology and technology, the ethics of the German theologian, Bonhoeffer, in various fields has been applied [35]. For example, in [36] the ethics on responsibility has been used for examining the problem of technical communication. In the field of autonomous vehicles the work of [37] has interpreted the ethics of responsibility. The contribution of the work is that structure of responsibility as formulated by Bonhoeffer, can be used by the designers in the field of automated driving systems to consider ethical aspects. This framework can provide a bridge for cooperation of control engineers and theologians. For example, connections between the values of Protestant ethics and work habits in Swiss regions [38] or in contemporary Germany [39] have been found. Another ethical concept with theological motivations can be found in [40,41]. The methodology of these papers is the finding of analogies between terms of control engineering and of theology. The contribution of these works is that optimal vehicle control solutions may lack of goodness in the sense of divinity and eternity, because perfect operation under real-works operation due to the imperfection of the human design processes cannot be achieved.

1.2. Ethical Modeling Frameworks in the Current Literature of Autonomous Vehicle Control

The design of a control strategy for autonomous vehicles with ethical considerations requires the formulation of ethical models. The goal of the ethical models is to provide a framework, in which the acceptability of various control decisions can be evaluated. Since this paper focuses on coordinated control design of autonomous vehicles, only three selected, i.e., most relevant, frameworks are introduced below.

1.2.1. Trolley-Based Ethical Frameworks

The first ethical framework is the popular trolley-based ethical model. In this model the autonomous vehicle is able to move on fixed routes. Each of the routes lead to different types of crash or emergency situations, i.e., the outputs of the model have different costs. The task of the autonomous vehicle control is to evaluate these outputs, which can be performed through one of the previous ethical concepts. A thorough analysis on trolley problem, i.e., on the evaluation of the ethical model and on the ethical issues beyond it, can be found in [42].

Although trolley-based ethical model is well-known in the literature, several critiques against this framework have already been formed.

• One of the most common critique against trolley problem is based on its unrealistic character [43]. For example, paper of Holstein et al. [43] proposes that ethical analysis must be focused on the ethics of complex real-world engineering problems, instead of unsolvable decision making problems. Similarly, [44] presents an overview on realistic ethical challenges of autonomous vehicle control. Paper Cunneen et al. [45] also argues that more realistic ethical frameworks for handling the ethical problems of autonomous vehicles must be found. One of the possible solution is the focusing on technologies related to human-machine interactions, such as, machine perception, classification, and data privacy, which are some distances from the decisionality framing premise of the Moral Machine experiment.
• In spite of unrealistic character of trolley-based ethical framework, it facilitates the understanding of the ethical problem of autonomous vehicle decisions [13,46]. A possible improvement of the classical framework is the testing of human trolley-based decisions in the context of virtual or augmented reality [47,48], which can improve real feeling character for examining human decision process.
• It is difficult to form one ethical model for human decisions in trolley situations [49]. Human ethics are not clearly deontological or utilitarist, but practical and rationally bounded [20].
• One of the most important criterion of spreading autonomous vehicle technologies is the improving of trust in the technology [50]. Nevertheless, it is not possible to find a general solution on trolley problem, which can be accepted by all participants of the transportation. For example, results of studies in [51] show that vehicle passengers can be more likely to like, use, trust, and communicate with autonomous vehicles programmed to protect self than protect others and be random in a one-passenger-one-pedestrian scenario representing the one-to-one dilemma.
• The starting point in lots of studies is the providing of examinations on human decisions, but the ethical fundamentals of this selection is not straightforward. It can have practical viewpoint, because human-like driving characteristics can improve trust in autonomous driving [8]. Nevertheless, it is related to driving style, and not to the decision itself, see also [52]. Similarly, from the viewpoint of theology, reproducing of human corruption in machines can lead to unethical decisions.

Moreover, from the special viewpoint of autonomous vehicle control strategies, further statements on the limitations of trolley-based ethical frameworks can be given.

6.

In the classical trolley framework the autonomous vehicle can move on few number of fixed routes, similar to trains. Nevertheless, in case of autonomous road vehicles high number of different trajectories can be generated. From the viewpoint of physical-based vehicle modeling process, lateral motion of road vehicle can be described through kinematic constraints, instead of only geometric constraints in railway systems. Thus, there are lots of decisions on trajectories for the autonomous vehicles [53], which variety motivates the improvement of fixed-route trolley model.

7.

Another limitation in the trolley-based ethical frameworks is the omitting of responses on the motion of autonomous vehicle. Thus, the feedback from pedestrian, cyclist or another vehicle in the situation is not considered in the decision process. An improvement possibility of the trolley-based ethical framework is the involving of more participants with freedom in their decisions. For example, in case of critical traffic situations with multiple autonomous vehicles, an ethical modeling framework must be formed, in which the coordinated motion of autonomous vehicles in the ethical design can be handled. Using coordinated control the cost of the optimal solution can be significantly reduced.

8.

The role of uncertainty and random in autonomous vehicle control and decision process is not considered sufficiently. The measured signals of the vehicle, which are used for decision purposes, can contain disturbances and uncertainties [54]. The motion predictions of the participants in the local traffic have stochastic character [55]. Randomness in the learning process for achieving AI-based agents can also have high impact [56]. Moreover, random also have role in the composing of critical traffic situation from the sides of further participants, see [41]. However, trolley-based ethical frameworks are able to operate with deterministic decisions and fixed outputs. Thus, involving stochastic nature in the ethical models can facilitate discussions on ethical vehicle maneuvering. For example, in the context of autonomous vehicles, theology of randomness and chances [57,58,59] and theology of responsibility [35,37] can be connected.

1.2.2. Trust-Focused Ethical Frameworks

The brief overview on the trolley-based ethical modeling framework and on its critiques illustrate that the direct use of trolley model in the control design has limitations. Therefore, the ethical problems of autonomous vehicle control systems have been approached from other viewpoints. The second type of ethical frameworks focus on the improvement of trust in vehicle control solutions, instead of analyzing human injury costs during the dangerous traffic situations [60]. For example, paper [61] moves the focus of the ethical analysis away from trolley problem to risk management, i.e., the problem of integrating ethics into decision-making process of vehicle leads to difficulties, but designing ethical vehicles can be an achievable task for the designer.

An interesting study on finding analogies between autonomous vehicles and rental cars in New Zealand context has been proposed by [62]. The style of the tourist drivers in rental cars generally differs from the style of local drivers, e.g., in keeping the special local rules and driving behavior. Moreover, the ethical codex of autonomous driving in New Zealand has been presented, whose key points are responsibility, safety, transparency and sustainability. Another study, focusing on the Canadian autonomous vehicle policies can be found in [63]. It states that vehicle control designers do not have appropriate ethical code currently, which is able to handle all legal challenges. Avoiding of unethical solutions requires the extending of engineering education with ethical studies, in accordance with federal and municipal Canadian laws. Ethical recommendations regarding to connected and autonomous vehicles by the Independent Expert Group of the European Commission have also been provided, see document [64]. Summary of German Ethical Code, i.e., listing and interpreting it through 20 guidelines, can be found in [65]. This code deals with the challenges of unavoidable situations, accountability, safety and security, data protection, educations, etc. An analysis on the responsibility from the viewpoints of morality and liability can be found in [66]. The ethical aspects of data protection in the focus of paper [67] can be found. It has been shown that the basis for handling personal data by the autonomous vehicle and traffic system is the consent of passenger. It also requires the informing of passenger on the operation of the system, which leads to the concept of Explainable AI (XAI).

The consideration of statistics on accidents in vehicle control design is another way for creating ethical models. This way of thinking is also supported by the Expert Group of European Commission, see [64]. Nevertheless, its result is not a formalized ethics, but a recommendation for the vehicle control, which can make difficulties in the ethical evaluation [68]. Using statistics, the impacts of different types of collisions [69] or human factors [70] in the decision process can be involved. This manuscript presents a data-mining method working on the already existing road accident database records to find the black spots of the road network. As a next step, a further statistical approach is used to find the significant risk factors [71].

Finally, a comparative analysis on trolley-based and trust-focused ethical frameworks can be found in [24]. That paper compares scientific literature and industry reports on ethical aspects of autonomous vehicles. It is stated that scientific literature is dominated by discussions about the trolley problem, but in industrial reports trolley problem is generally not addressed. Instead, industrial participants facilitate lowest liability risk design strategies. In that design process crash and collision avoidance algorithms, rules and regulations or expedite investigations are involved. Another literature overview on the current state-of-the-art on autonomous vehicle ethics can be found in [72]. That paper focuses also on presenting the viewpoints of industry, e.g., safety standards and science, together with ethics of technology. Thus, improving trust in autonomous vehicle control solution is a priority goal of vehicle industry, and the trolley-based ethical frameworks may not relieve distrust of consumers.

1.2.3. Control-Oriented Ethical Frameworks

Due to the control-oriented highlights of this paper, a third group within ethical modeling frameworks is defined, i.e., control-oriented ethical frameworks. In these methods the selected ethical principles or goals on the level of vehicle control are formed, i.e., ethical models to mathematical descriptions are transformed. Depending on the applied trolley-based or trust-focused ethical frameworks, the resulted mathematical descriptions can be rule-based algorithms or optimization problems, see below.

Direct application of ethical principles in the control of autonomous vehicles can be found in [73]. In that proposal the passenger has the capability to select ethical principles, i.e., intervention possibility by the autonomous system. Nevertheless, due to the ethically and rationally bounded human decision process [20] this direct application can have limitations. Further considerations on the preselection of ethical principles in the design process can be found in [74].

In the work of Islam et al. [75] a decision-tree-based algorithm has been provided. The proposed method can be evaluated as an utilitarian approach, but the tree-based scheme using various ethical principles can be composed, i.e., it provides a general framework. Nevertheless, a drawback of the method is that it requires a-priory ethical principles, which are represented by the values of the control designer. A fuzzy-based solution for embedding ethical considerations in the control can be found in [76]. The advantage of the proposed method is that its operation is easily explainable. Nevertheless, due to the evaluation of different vehicle maneuvers to be “good” or “bad”, this method is a special type of the deontological solutions. An evaluation method on the critical situation, which can be taken part of the control, can be found in [53]. One of the contribution of that paper is an ethical trajectory design. Nevertheless, a further task is to embed the proposed trajectory selection method in the control design process.

Model Predictive Control (MPC) structure is a convenient formulation for autonomous vehicle control systems, in which various ethical principles can be embedded. For example, [19] provides a MPC-based optimal control design method, which involves deontological ethical rules in the formulation of constraints and also utilitarian ethical principles in the formulation of objective function. Another MPC-based control design method for achieving ethical vehicle motion can be found in [77]. The ethical rules through a Lexicographic Optimization in the vehicle control are implemented, which method provides a flexible framework for incorporating various rules. The advantage of MPC design is that it is well-known and widespread used in automated vehicle control problems, which can foster improving trust in ethical autonomous vehicle control systems. Moreover, the control structure itself is flexible, which provides various ways for incorporating different ethical concepts in the control system.

1.3. Contributions of the Paper

The goal of this paper is to provide a coordinated control design strategy for autonomous vehicles, with which the vehicle is able to perform ethical maneuvering. The proposed method is based on the MPC design framework, with which the autonomous vehicle is able to control its longitudinal and lateral motion. In this paper the ethical concept is based on theological principles, especially on some principles of Protestant ethics.

The contributions of the paper are as follows. First, it is developed a method for designing coordinated control, which is able to involve ethical principles. The resulted design method falls into the group of trust-focused ethical framework, because its main objective is to facilitate collision-free motion without predefined fixed routes. Due to the general mathematical formulation of the control system, the developed method with various ethical concepts can be used together. Nonetheless, this paper also recommends an ethical concept, which is the second contribution of the work. This concept involves in some advantages of Protestant ethics, which is a novel result in the ethical control design of autonomous vehicles. During the formulation of this ethical concept five statements are taken, and it is presented that the resulted ethical concept is in line with the existing results in the literature.

2. Formulation of Ethical Concept for Autonomous Vehicles

In this section a novel ethical concept for autonomous vehicles is formulated. The concept is based on five statements, which are linked to some traditions of Protestant ethics. These statements in the vehicle control layer are embedded, as a part of the MPC-based optimization problem. Note that in lots of papers the term of Protestant ethics is understood in the sense of the famous book of Weber [78], which focuses on the connection of Protestant ethics and economy. However, in this paper the term of Protestant ethics is understood as principles resulted by the Protestant theological thought.

2.1. Achieving Optimal Vehicle Motion Is an Ethical Requirement

The requirement against vehicle control systems to be safe has been generally known as a control objective. Nevertheless, it goes beyond the mathematical forms and thus, it is a social requirement. Moreover, the task of designing vehicle control systems to be safe can also be approached from Christian, especially Protestant theology, i.e., it is a consequence of the first divine mandate.

Originally, the terms of mandates the world-famous theologian, Dietrich Bonhoeffer in his book Ethics has been formed [35]. He defined four divine mandates based on the systematic analysis of Bible, i.e., work, marriage, government, and church. These terms in wide contexts at the last decades have been interpreted, e.g., in political [79], in social, family [80] and in environmental crisis [81]. Although the term of divine mandate has been defined by Bonhoeffer, its meaning is also close to the term of orders of creation [82], which term has long tradition in Protestant (especially Lutheran) ethics, see, e.g., [83,84].

Divine mandate of work also can be interpreted for control design. Since the work, as divine mandate, is based on the call of God, high-quality profession has legitimacy also in Protestant ethics. Thus, in the work of control design, it leads to the goal of achieving safe and high performance control operation. The theological consequence of this biblical basis is that ethical considerations are expected with regard to systems created by man, with a focus on ensuring a safe operation that protects life, and this is particularly valid for autonomous vehicles. As a result, the effort to achieve a safe, optimal, and energy-efficient operation is not exempt from ethical considerations, which, in addition to the various philosophical influences, include centuries of Protestant ethics.

Consequently, divine mandate of work facilitates designer to provide high performance operation through the control system, which process leads to an optimal control formulation. Thus, achieving optimal vehicle motion is not only a technical requirement, but also an ethical requirement. Fulfillment of this moral and technical requirement is able to enforce consumers’ trust in the developed vehicle control system.

2.2. Clarifying Limitations of Vehicle Control Is an Ethical Requirement

Despite the requirement of optimal vehicle motion, it may not be guaranteed during the entire operation of the vehicle. Optimum solution may not be achievable at high disturbances, loss of measured signals or at critical vehicle dynamic situations. Moreover, in the optimal control problem an objective is defined, which can be evaluated good, or acceptable under predefined conditions. Nevertheless, goodness cannot be evaluated in a universal meaning, i.e., technically good (optimal) solution not necessarily good in ethical sense. For example, in control design typically Pareto-optimal solutions based on multiple performance criteria are searched for [85]. Due to trade-offs between performance criteria, none of the resulted control solution is able to provide high level for all performances in the same time.

From the viewpoint of Protestant theology, the perfection and absolute good are exclusively God’s characteristics [41]. Due to the fall of the human [86], i.e., due to the sin, the creations and works of humans can not be good in a universal, divine sense [87]. On the ethical level, the promise of providing universally good control solutions for autonomous vehicle is ethically unacceptable. Consequently, a trust-improving vehicle control solution requires clarifications on its limitations. This statement fits to the scope of XAI, i.e., providing clear and visible rules on the operation of the vehicle for the customers.

2.3. Being Equivalent Participant in Transportation Is an Ethical Requirement

The participation of autonomous vehicles in a mixed transportation system with human participants pose the challenge of their rights. For example, may the autonomous vehicle have right to break transportation rules for achieving a predicted high-performance operation, which rules must not be broken by humans? The problem of rule breaking presupposes an enhanced operation of the autonomous vehicles, compared to the human participants. Although an autonomous vehicle can have more information on the transportation and can have higher and faster computational methods, responsibility for the consequences of breaking rules cannot be accepted by the vehicle itself, because of the problems of sin and limitations on vehicle control.

From the viewpoint of theology, deliberate breaking rules, i.e., being autonomous vehicle a superior participant to human participants, is in connection with the term hubris. This Greek word is generally translated to pride, but has negative sense, e.g., arrogance, insolence, brutality. It is more than ethical character, it is an universal temptation to human due to the sin. This terminology has also extra-biblical root in ancient Greek tragedies, and it is an important term of Protestant systematic theology. In the interpretation of the German theologian, Paul Tillich: “Hubris is the self-elevation of man into the sphere of the divine” [88]. Main symptom of hubris is that humans do not acknowledge their finitude, and thus, hubris leads to fall, disintegration and decay. Problem of hubris can also be found in Old Testament texts as well. For example, paper [89] presents that a warning against hubris is the message of the tower of Babel story in the book of Genesis, which depicts the downfall of human aspirations to grandeur and world domination. Hubris and injustice are in connection, and it can appear on a large or small scale, and it testifies to the loss of core values and ethical imperatives in society, both in the biblical world and in our own. Moreover, analysis on prophetic literature, explicitly or implicitly relate the descent to the netherworld to pride and hubris, partly even with the tendency of self-deification [90]. The negative term of hubris and its variants can also be found in the New Testament, e.g., in connection with blasphemy [91]. Man with hubris in Epistle to Romans can be defined as man who paid no attention to the wrath of God and committed an offense against the property or the honor of God [92]. The virtue for avoiding hubris can also be found in the texts of Sermon on the Mount, see, e.g., Beatitudes [93].

Consequently, in the design of the vehicle control it is recommended to avoid embedding rules, which bear hubris in themselves. First, it is necessary to avoid embedding in the vehicle control the own ethical prejudices of the designers, as it is declared in the German Ethical Code [65]. Second, it is necessary to design control systems, with which the autonomous vehicles remain equivalent participants in transportation, in relation to human participants. This ethical requirement guarantees the avoidance of self-elevation of the technology. For example, in the practical implementation of the control, the autonomous vehicle must keep traffic rules and they cannot be broken for achieving own-created truths.

2.4. Handling Transportation Participants Equivalently Is an Ethical Requirement

Avoiding unstable motion of autonomous vehicles is a fundamental goal for the control system. Nonetheless, stability can be interpreted not only in vehicle-level technical sense, e.g., on vehicle motion, but also on the context of the entire transportation. Instability using biblical and theological analogies in the context of human life and social behavior can also be interpreted, see [40,94]. In [41] analogies between instability and sin, death are provided, with which the goal of guaranteeing stable operation of systems reaches an extended interpretation. Moreover, the disintegrated terminal state of humans through hubris [88] illustrates also similarity with the process of stability.

Stability in the social context of autonomous vehicles can be interpreted on two ways. First, it is necessary to avoid the increasing of social gap through the application of autonomous vehicles [95]. For example in a crash situation, passengers in autonomous vehicles can have higher chance for survival, as cyclists or pedestrians. Enhanced technological level of autonomous vehicles can lead to higher safety level, but it may not be paid by all humans due to the higher costs of the vehicles. On theological level, it leads to the problem of sin, which also caused social inequalities [96]. The solely solution on the problem is the reconciliation through Christ [30], which is one of the message of some epistles in the New Testament [97,98]. Thus, from the viewpoint of Protestant ethics, it is not allowed to distinguish participants in the transportation based on their social situations. This requirement has been also formed by various ethical codes [63,65], i.e., it confirms the application of Protestant ethical principles during the vehicle control design process.

2.5. Limiting the Number of Participants in a Critical Situation Is an Ethical Requirement

Second, stability in the context of transportation can also be interpreted on the number of participants involved in a given collision situation. For example, in case of a route selection the autonomous vehicle can have decision on involving new participants or not, see, e.g., in [40] the trolley situations for involving pedestrians on the sidewalk or moving toward a jersey barrier. In this example the route selection on moving to the sidewalk can lead to the avoiding of vehicle crash, but pedestrians are taken part of the collision. Moreover, colliding with new participants can have direct impact not only on the participants themselves, but also on their relatives, workplaces, etc. Thus, decision on involving new participants in the critical situation can significantly increase the number of humans affected due to the crash.

Consequently, during the motion of autonomous vehicle it is necessary to facilitate limitation on the number of participants. This requirement is an extension of the classical interpretation of stability in the sens of vehicle motion [40]. This ethical principle is also confirmed by the German Ethical Code [65], i.e., the involvement of new participants into a critical situation must be avoided.

3. Design of Vehicle Control for Achieving Ethical Maneuvering

In this section the process of autonomous vehicle interventions, i.e., velocity profile and steering angle, is presented. In the control design the previously formulated ethical requirements are taken part.

Due to the ethical requirement of achieving optimal vehicle motion, the control design using an MPC formulation is carried out, see also the works of [19,77]. The optimal control problem is built upon the formulation of the objectives in a cost function and of its constraints. The objectives in the control problem are selected as follows [99]: $z_1$ represents the keeping of reference trajectory $y_{ref}$, i.e., minimizing lateral tracking error, the role of $z_2$ is to improve time efficiency, i.e., minimizing velocity tracking, and through $z_3$ the steering control intervention is minimized, such as

$$\begin{array}{cc}\hfill z_{1,k}& ={(y_{ref,k}-y_k(v_{x,k},{\delta }_k))}^2,\hfill \end{array}$$

(1)

$$\begin{array}{cc}\hfill z_{2,k}& ={(v_{max}-v_{x,k})}^2,\hfill \end{array}$$

(2)

$$\begin{array}{cc}\hfill z_{3,k}& ={\delta }_k^2,\hfill \end{array}$$

(3)

where index ${}_k$ represents time step, i.e., $k=1$ is the actual time step. $v_x$ is longitudinal velocity of the vehicle, $v_{max}$ is maximum velocity limit on the given road section and $\delta$ represents steering angle and y is the lateral vehicle position. In the generation of reference trajectory various performance requirements can be involved [100], e.g., comfort-based or energy-based aspects. The cost function is created through the objectives on a finite time horizon with N points, such as

$$\begin{array}{c}\hfill J(v_x,\delta )=\sum _{k=1}^N{Q}_1{z}_{1,k}(v_{x,k},{\delta }_k)+Q_2{z}_{2,k}\left(v_{x,k}\right)+Q_3{z}_{3,k}\left({\delta }_k\right),\end{array}$$

(4)

where $Q_1,Q_2,Q_3$ are preselected design parameters for achieving balance between different objectives [85].

The optimization process of $v_{x,k},{\delta }_k$ contains various constraints, resulted by vehicle dynamics, limitations on control interventions or the formulated ethical principles.

First, the lateral vehicle model [101] provides a constraint on the motion of the vehicle, such as

$$\begin{array}{cc}\hfill J\ddot{\psi }& =C_1{l}_1\left(\delta -\frac{v_y+\dot{\psi }{l}_1}{v_x}\right)-C_2{l}_2\left(-\frac{v_y-\dot{\psi }{l}_2}{v_x}\right),\hfill \end{array}$$

(5)

$$\begin{array}{cc}\hfill m(v_x\dot{\psi }+{\dot{v}}_y)& =C_1\left(\delta -\frac{v_y+\dot{\psi }{l}_1}{v_x}\right)+C_2\left(-\frac{v_y-\dot{\psi }{l}_2}{v_x}\right),\hfill \end{array}$$

(6)

$$\begin{array}{cc}\hfill \frac{dy}{dt}& =v_y,\hfill \end{array}$$

(7)

where J is the inertia around axis z of the vehicle, m represents vehicle mass and $l_1,l_2$ are distances between vehicle center of gravity and front/rear axles, see Figure 1. $v_y$ is the lateral and longitudinal components of vehicle velocity, $\dot{\psi }$ is yaw-rate. $C_1,C_2$ are cornering stiffness values, which are handled as constant parameters in the control design. The vehicle model into a state space form can be transformed, containing the state vector $x={\left[\begin{array}{ccc}\dot{\psi }& v_y& y\end{array}\right]}^T$ and the control input $\delta$ as follows:

$$\begin{array}{c}\hfill \left[\begin{array}{c}\ddot{\psi }\\ {\dot{v}}_y\\ v_y\end{array}\right]=\left[\begin{array}{ccc}\frac{-C_1{l}_1^2-C_2{l}_2^2}{J{v}_x}& \frac{-C_1{l}_1+C_2{l}_2}{J{v}_x}& 0\\ \frac{-C_1{l}_1+C_2{l}_2}{m{v}_x}-v_x& \frac{-C_1-C_2}{m{v}_x}& 0\\ 0& 1& 0\end{array}\right]\left[\begin{array}{c}\dot{\psi }\\ v_y\\ y\end{array}\right]+\left[\begin{array}{c}\frac{C_1{l}_1}{J}\\ \frac{C_1}{m}\\ 0\end{array}\right]\delta ,\to \dot{x}=Ax\left(v_x\right)+B\delta ,\end{array}$$

(8)

which formulation contains the variables of the optimization problem, such as $v_x$ and $\delta$. For describing constraints on the optimization horizon in the MPC structure, the resulted continuous-time model (8) must be transformed to discrete-time model [102]:

$$\begin{array}{c}\hfill x_{k+1}=A_d{x}_k\left(v_{x,k}\right)+B_d{\delta }_k,\end{array}$$

(9)

for a given ${}_k$ time step, where $A_d,B_d$ are system matrix and vector related to the discrete system. In the vehicle control problems the sampling time on the lateral model is usually selected between $0.01s–0.1s$. Using (9) the objective $z_{1,k}$ along the horizon N can be expressed, see the details in [99].

The second types of constraints are resulted by the limitations on the control interventions. The maximization of $v_{x,k}$ is required by the traffic regulations, such as

$$\begin{array}{c}\hfill 0\le v_{x,k}\le v_{max}.\end{array}$$

(10)

Similarly, due to physical limits on the steering actuator, ${\delta }_k$ must be also limited, such as

$$\begin{array}{c}\hfill -{\delta }_{lim}\le {\delta }_k\le {\delta }_{lim},\end{array}$$

(11)

where ${\delta }_{lim}$ represents the value of the physical limit on steering angle.

Thirdly, some of the presented ethical requirements among the constraints are formed. From the viewpoint of constraints, the ethical requirements on the participation of the autonomous vehicle in the transportation are the most important, i.e., being equivalent participant, handling transportation participants equivalently and limiting the number of participants in a critical situation. Using these requirements, constraints on the reachable trajectories of the vehicle are formed.

• The vehicle must strive to stay on the road, e.g., moving on sidewalk is forbidden. This requirement protects pedestrians, who are handled as equivalent participants and they have the right to move freely and safely on the sidewalk. Thus, the constraint on the vehicle motion is formed as:

  $$\begin{array}{c}\hfill y_{min}\le y_k(v_{x,k},{\delta }_k)\le y_{max},\forall k\in [1;N],\end{array}$$

  (12)

  where $y_{min},y_{max}$ are determined by the geometry of the road on the actual k time step, and $y_k$ is resulted by (9). Remark that in critical situations the use of the unoccupied sidewalk may help to avoid collision with participants on the road. Nevertheless, an ethically maneuvering autonomous vehicle—due to the uncertainties in the measurements—cannot undertake the responsibility of avoiding rules, see the interpretation of hubris above.
• The vehicle control must handle all participants equivalently, such as vehicles, cyclists or crossing pedestrians on the road. Moreover, it is not allowed to distinguish between human participants based on their any characteristics (e.g., age, gender etc.), even if these characteristics using sensor measurements can be estimated. Consequently, all of the participants as avoidable objects must be handled, such as

  $$\begin{array}{c}\hfill y_k(v_{x,k},{\delta }_k)\le y_{P_i,min,k}\mathrm{or}{y}_{P_i,max,k}\le y_k(v_{x,k},{\delta }_k)\forall k\in [1;N],i\in [0;N_P],\end{array}$$

  (13)

  where $N_P$ represents the number of objects and $y_{P_i,min,k},y_{P_i,max,k}$ are their physical limits in lateral direction. The calculation of physical limits considering the size of the autonomous vehicle can be found in [103].
• If it is not possible the find a feasible trajectory, the autonomous vehicle must be stopped, i.e., maximum braking must be actuated and $y_{ref,k}=y_{ref,k-1}$ must be tracked. Although it can lead to a collision, but the motion of the autonomous vehicle for human participants is predictable. It creates the possibility for another participants to defend themselves.

Formulation and Solution of the Control Problem

In the rest of this section the MPC-based control problem is formulated and a solution on the problem is provided. The MPC optimization task is composed of the cost Function (4) and the constraints (9)–(13), such as

$$\begin{array}{cc}\hfill \underset{v_{x,1},{\delta }_1\dots v_{x,N},{\delta }_N}{min}& \sum _{k=1}^N{Q}_1{z}_{1,k}(v_{x,k},{\delta }_k)+Q_2{z}_{2,k}\left(v_{x,k}\right)+Q_3{z}_{3,k}\left({\delta }_k\right),\hfill \\ \hfill & \mathrm{subject}\mathrm{to}\hfill \end{array}$$

(14a)

$$\begin{array}{cc}\hfill x_{k+1}& =A_d{x}_k\left(v_{x,k}\right)+B_d{\delta }_k,\hfill \end{array}$$

(14b)

$$\begin{array}{cc}\hfill 0& \le v_{x,k}\le v_{max},\forall k\in [1;N],\hfill \end{array}$$

(14c)

$$\begin{array}{cc}\hfill -{\delta }_{lim}& \le {\delta }_k\le {\delta }_{lim},\forall k\in [1;N],\hfill \end{array}$$

(14d)

$$\begin{array}{cc}\hfill y_{min}& \le y_k(v_{x,k},{\delta }_k)\le y_{max},\forall k\in [1;N],\hfill \end{array}$$

(14e)

$$\begin{array}{cc}\hfill y_k(v_{x,k},{\delta }_k)& \le y_{P_i,min,k}\mathrm{or}{y}_{P_i,max,k}\le y_k(v_{x,k},{\delta }_k),\forall k\in [1;N],i\in [0;N_P].\hfill \end{array}$$

(14f)

Although the proposed formulation of the control problem in (14) has a compact structure, its direct solution may have challenges. First, the vehicle model is parameter-varying, which leads to a nonlinear MPC problem. Second, constraints from (13) are disjunctive, which can require a mixed-integer solver [104]. Therefore, for real-time applications an alternative approach is provided. Due to these challenges on direct solution of (14), an alternative solution on the control problem is presented. The aim of the solution is to divide the optimization problem (14) into two layers, such as trajectory planning and trajectory tracking.

The goal of the trajectory planning layer is to find a trajectory on the road for the vehicle, with which the collision to obstacles can be avoided. Formally, it is necessary to find trajectories, which guarantee keeping constraints (14e,f). Consequently, the problem of disjunctive inequalities from the MPC optimization can be pulled out. A graph-based algorithm for finding these trajectories can be found in [105]. A reachable set-based solution on the given problem is proposed by [106]. Moreover, it is necessary to select one trajectory from the set of feasible trajectories, in which selection process energy, comfort or time performance requirements can be involved [100]. If it is not possible to find a feasible trajectory on this layer, the direction of the vehicle is kept constant and maximum braking is actuated, see above.

The goal of the trajectory tracking layer is to guarantee moving on the selected trajectory through $\delta$ and $v_x$. It leads to a modification of the original MPC-based control problem, i.e., (14) without (14e,f). Although it requires solvers due to the parameter variation, efficient methods in relation to the computation can be found [107].

Finally, in this paper the formulated MPC problem (14) is solved through a separation to the layers above. The trajectory planning is carried out using optimal rapidly exploring random tree method [103] and the trajectory tracking is performed based on the MPC-based methods of [99,108]. In case of both layers, the measurements on the vehicle states, and the detection on the environment are accepted as error-free signals. Analysis on the plausibility of measurement and detection is a further challenge for providing safe autonomous vehicle operation, see, e.g., [109,110].

4. Illustration on the Effectiveness of the Proposed Control Method

In this section the effectiveness of the proposed method through a simulation example is presented. The selected example is a critical situation, in which four participants can be found, such as the autonomous vehicle, an another vehicle, a pedestrian on the road and an another pedestrian on the sidewalk, see Figure 2. In this traffic situation the vehicles move in the opposite lanes, and the pedestrian on the road results in a critical situation, in which the autonomous vehicle has to perform an ethical maneuver. It is considered that the pedestrians are together, and the pedestrian on the road is a child, who had scared of the dog, which has led to child’s unwanted motion.

The presented situation can be discussed from the viewpoint of trolley problem. In this case the autonomous vehicle can have three distinct choices, i.e., moving to the sidewalk, to straight or to the opposite lane. In case of a cost-based utilitarist ethics, the ages of the pedestrians, the predicted severity of injury or the number of passengers in each vehicle and vehicle velocity values can be considered. The selected route can depend on the weighting of different factors, i.e., on the preliminary in-built ethical principles. In case of a deontological ethics, the straight motion of the autonomous vehicle might be kept with maximum deceleration.

In this paper a solution on the given problem based on the predefined ethical concept is provided. Consequently, the motion of the vehicle on the sidewalk is forbidden, which means that a trajectory on the road must be found. Moreover, the participants in the traffic situation is handled equivalently, which means that the another vehicle and the pedestrian are considered to be objects, which only differ in their size and velocity. Three scenarios based on the different positions of the pedestrians are illustrated below.

In the simulation example the parameters of the autonomous vehicle are: $C_1=80,000$ $N/rad$, $C_2=120,000$ $N/rad$, $l_1=2.2$ m, $l_2=2.3$ m the width of the vehicle is $1.7$ m, its mass is $m=1500$ kg and the inertia is $J=2500$ kg m${}^2$. During the simulations, first order proportional systems for modeling steering $\left(G_{st}=\frac{1}{0.06s+1}\right)$ and longitudinal $\left(G_{long}=\frac{1}{0.2s+1}\right)$ interventions are considered. The physical limits on the interventions are ${\delta }_{lim}={15}^{°}$, $v_{max}=40$ km/h and variation of $v_x$ between k and $k+1$ is limited to $\pm 3$ km/h [111].

In Scenario 1 the autonomous vehicle is able to design a trajectory, with which the collisions through a left turn maneuver can be avoided. Figure 3 shows the positions of the vehicles and the pedestrian at different time steps along the rapid maneuvering. In each subfigure the left first blue rectangle represents the actual position of the vehicle and the further blue rectangles are the predicted position along the designed trajectory. The trajectory in each computation step is redesigned for accommodating to the actual traffic scenario. The occupied area of the pedestrian and the another vehicle are represented by the red areas, which are created through an inflation process with circles around their center positions [103], see dark reds point in Figure 3. Similarly, the grey points represent road edges, which guarantee that the autonomous vehicle is not able to move to the sidewalk. The goal of the trajectory design is to guarantee that the center points of the vehicle along its trajectory are out of the inflated areas, such as vehicle, pedestrian and road edge. It can be seen that the autonomous vehicle is able to find a narrow path between the pedestrian and the vehicle, along which the collision can be avoided, i.e., the center points are in acceptable distances from the objects. The control inputs of the coordinated control system are illustrated in Figure 4. It can be seen that the autonomous vehicle must decelerate between 0.7 s–1.1 s, see Figure 4a, i.e., when it moves between the pedestrian and the another vehicle, see Figure 3c,d. The resulted steering intervention can be found in Figure 4b, which shows that rapid and high steering intervention during the first section of the maneuver (0 s–0.4 s) must be performed.

Figure 5 and Figure 6 illustrate two further cases, related to Scenario 1. In both cases the value of $v_{max}$ for the autonomous vehicle has been increased. Figure 5a,b show two critical situations, which require deceleration maneuvers, see Figure 5c. In these situations the autonomous vehicle is close to the pedestrian and the velocity reduction is requested to avoid collision. The same deceleration can also be found in the case of $v_{max}=40$ km/h, see Figure 3c,d and the velocity profile in Figure 4a. Due to the increased $v_{max}$ value a reduced steering control intervention is enough to track the trajectory, see Figure 5d. Figure 6 illustrate the result of the simulation with $v_{max}=80$ km/h. In this case the maneuver can also be performed safely, but a more powerful deceleration is requested, see Figure 6b. Deceleration must be performed when the autonomous vehicle enters to the gap between the pedestrian and the another vehicle, see Figure 6a. The further increased value of $v_{max}$ results a further reduction on $\delta$, see Figure 6c.

Illustration of Scenario 2 can be found in Figure 7. In this scenario the pedestrian is closer to the another vehicle in lateral direction, which results that the autonomous vehicle is able to move right without collision. Moreover, the autonomous vehicle keep the ethical principle of not to move on the sidewalk. The control inputs in Scenario 2 can be found in Figure 8. It can be seen that the maneuver with a slight braking maneuver can be performed, see Figure 8a. Moreover, trajectory tracking requires a varying steering intervention for achieving right motion and than back to the middle of the lane (Figure 8b).

Scenario 3 illustrates a traffic situation, in which both pedestrians are on the road (e.g., the older pedestrian from the sidewalk runs to the younger one) and thus, feasible trajectory cannot be found. It results in that the autonomous vehicle must be stopped, see its final position in Figure 9. Figure 9b shows that if the pedestrians may closer to the autonomous vehicle in their longitudinal position, the collision may not be avoided. The control interventions in Figure 10 can be seen. The result of the proposed coordinated control strategy is that the vehicle actuates maximum braking (Figure 10a) and the steering intervention along the maneuver is not modified, i.e., straight motion is performed, see Figure 10b. This motion of the autonomous vehicle can provide its motion to be predictable, which can help for the pedestrians to run away, if necessary.

5. Conclusions

The presented scenarios of the simulation example show that the proposed coordinated control strategy is able to adapt to the actual traffic situation. The proposed optimal control problem has two layers, such as trajectory design and trajectory tracking. Using these two layers, the coordinated control intervention on longitudinal and lateral motions are carried out. The achieved vehicle maneuver fits to the predefined ethical principles, which principles provide predictable vehicle motion, using an explainable and optimal control strategy, for the purpose of strengthening trust. It is also presented that the proposed theological-based ethical principles are in line with the state-of-the-art ethical vehicle control design methods, e.g., German Ethics Code. Thus, this study also provides further motivation for researchers in theology to develop ethical control design frameworks.

Finally, some challenges to the future research activity are formulated. First, during the practical implementation of the control methods on autonomous vehicles, it can be necessary to consider probability-based characteristics of environment sensing. For example, in the presented simulations all of the participants are considered to be known. Nevertheless, measurements on their positions, velocities and the neural-network-based classification of the participants can contain uncertainties, or e.g., the recognition of false positive misdetections may lead to unwanted vehicle motion. It motivates the further research on involving ethical principles in robust MPC or stochastic MPC control methods.

A second challenge to the research is to involve feedback on the object motion in the control strategy. For example, in the presented methods the motion of the pedestrians are neglected. But, in a real situation, especially under the feeling of danger, the motion of human participants can significantly influence the outcome of the traffic situation. Therefore, safe and optimal motion of the autonomous vehicle through the consideration of pedestrian motion and decision models can be improved.

The third challenge is the improvement of ethical analysis, involving in a broader context, e.g., the liability of all human participants and of the transportation service providers. Furthermore, it is also necessary to find ethical principles to the traffic situations, in which the motion of more autonomous vehicles can be coordinated, i.e., ethics on the individual level can be extended to the ethics on community level.