Fail-Degraded Control Method for Vehicle Platoons Considering V2V Communication and Radar Failures

Abstract

Failures in vehicle-to-vehicle (V2V) communication and millimeter-wave radar affect connected vehicle platoon operation. This study links an ISO 26262-oriented preliminary risk assessment and Hazard and Operability Study (HAZOP) to role-specific degraded control. Long-distance adaptive cruise control (ACC), variable-speed cruise control (CC), and fixed-speed CC are selected according to the remaining information. Evaluation combines a 16-condition PreScan-Simulink matrix, represented by 12 trajectory files with shared communication-case results, and electric micro-vehicle tests under externally supplied fault labels. Conditional gap and delay inequalities describe forward-clearance requirements under specified motion bounds. The records demonstrate mode switching and spacing responses under the tested conditions, with spacing-target shortfalls in simultaneous-loss bend cases. Each 20 m/s straight-road file contains an unresolved Vehicle 3 acceleration sample near −8.94 m/s² at 20.01 s, and near-identical Vehicle 2 trajectories limit comparison between two cases. The supplied records support output reanalysis; complete controller reproduction and trial-level uncertainty remain unresolved. The results support implementation feasibility at the supervisory-control layer, with safety validation requiring verified motion bounds and end-to-end fault detection.

1. Introduction

Vehicle-to-Everything (V2X) technology has accelerated the development of vehicle platooning, and recent reviews continue to identify platooning as a promising way to improve traffic efficiency, reduce energy use, and enhance road safety [1]. Corridor-scale evaluation has also reported measurable energy and environmental benefits for truck platooning under realistic freight operations [2]. Experimental evidence further shows that a communication topology using the two vehicles immediately ahead can substantially improve traffic capacity and stability in connected autonomous platoons [3]. Recent evaluation studies have additionally compared platooning spacing policies from the perspectives of energy consumption, emission, and efficiency [4].

The safe operation of a platoon depends on reliable V2V communication and onboard perception. Balador et al. reviewed the wireless-communication requirements, standards, and open issues of cooperative truck platooning [5]. Chen et al. examined quantized-feedback cooperative driving for connected and automated vehicle (CAV) platoons under limited channel bandwidth, highlighting the need to balance communication-load reduction with car-following performance [6]. Zheng et al. developed a platooning system with guaranteed stability and robustness against degradation caused by communication disruption [7]. Li et al. designed a reliable cooperative control strategy to maintain platoon string stability under communication cyberattacks [8]. Liu et al. further showed that platoon maintenance strategies should explicitly account for communication failures [9].

In a cooperative adaptive cruise control (CACC) platoon, each following vehicle normally uses both self-state information and messages from surrounding vehicles to reduce time headway and improve string stability. Millimeter-wave radar provides local distance and relative-speed perception, while V2V communication provides motion states that are not directly observable by onboard sensors. The loss of either information source changes the control problem from coordinated platooning to degraded individual following, and the transition must be handled before the safety driver can intervene.

ISO 26262-3 describes item definition, hazard analysis and risk assessment, and the functional-safety concept [10]. This study uses that structure for preliminary design screening. Following the terminology in [11], fail-operational denotes continued nominal performance after a fault; fail-degraded denotes continued functionality at reduced performance while maintaining a safe state; fail-safe denotes discontinuing the intended function while reaching or maintaining a safe state. Here, the intended response retains longitudinal operation but sacrifices cooperative performance and compact spacing while requesting takeover. These objectives define the intended fail-degraded strategy. Its safety performance remains subject to the motion and switching limitations discussed in Section 2.5 and Section 4.

Recent work on diagnosis and tolerant control has improved degraded platoon operation. Wang et al. proposed periodic event-triggered fault detection for safe platooning control [12]. Lopes and Araujo developed an active fault diagnosis method for vehicles in platoon formation [13]. Viadero-Monasterio et al. designed a fault-tolerant robust output-feedback controller that explicitly considers measurement noise and road disturbances [14]. Gratzer et al. reported string-stable and collision-safe model predictive platoon control [15].

More recent studies have also addressed robustness under realistic imperfections. Wang et al. proposed a robust cooperative control strategy against simultaneous sensor and control errors in real-world driving environments [16]. Zhao et al. investigated adaptive fault-tolerant platoon control with prescribed tracking performance [17]. Shen et al. analyzed distributed platoon control under communication delays and packet dropouts [18]. Yang et al. studied robust platoon control with multiple-predecessor following topology under communication loss [19]. Shen et al. further examined cooperative spacing control over analog fading networks [20]. Thormann et al. studied safe and efficient cooperative platooning from a system-level perspective [21].

Recent studies have additionally considered real-time safety assessment and safe-spacing design. Sun et al. proposed a real-time evidence-aware safety assessment method for perception reliability [22]. Ma et al. analyzed time-headway selection for connected automated vehicle platoons under noisy V2V communication [23]. Wang et al. recently combined adaptive spacing policy with distributed sliding-mode control under communication interruption [24].

The present study focuses on the connection between preliminary hazard analysis and information-dependent fallback selection, including simultaneous V2V and radar loss. ISO 26262-3 and HAZOP provide the concept-phase and hazard-identification structures [10,25], respectively. It complements the diagnosis and controller-design approaches reviewed above.

In highway platooning, a failure can change the objective from compact cooperative following to a temporary degraded response pending takeover. The design objectives are increased spacing and limited acceleration variation. The selected controller must use information that remains available, and continued operation without external feedback requires an explicit bound on the duration and surrounding-vehicle motion.

For connected electric vehicles, the method operates at the platoon-management and longitudinal-reference layers: the available radar and V2V information determines the following controller and its reference. The electric micro-vehicle platform evaluates the connection between this supervisory logic and electric actuation.

This study extends the architecture and role-dependent ACC/CC fallback in [26] by linking hazardous information-loss cases to explicit degraded reference policies. Table S5 maps hazards to safety objectives and test cases; Section 2.5 describes policy selection from the remaining V2V and radar inputs; and Equations (1)–(7) define their references, errors and switching rules. Section 2.5.1 gives conditional spacing and delay bounds. Recorded spacing and acceleration responses and electric micro-vehicle switching cases provide the evaluation evidence. Table 1 identifies the inherited elements, while Table S9 compares the technical scope with representative methods. This qualitative comparison does not establish a performance improvement over [26] under matched conditions.

Table 1. Relationship between prior work [26] and the present study.

Aspect	Prior Work [26]	Present Study
Architecture and fallback	Five-layer, role-dependent management with ACC/CC fallback.	Uses the architecture and role-dependent fallback from [26].
Traceability	No HARA/HAZOP safety-goal mapping.	Maps hazards to safety objectives and tests (Table S5), and available inputs to fallback actions (Section 2.5).
Controller detail	Role-dependent V2V/radar failure actions.	Defines three degraded reference/error policies and switching rules; adds conditional spacing and delay bounds.
Evaluation	Maneuver simulation, fault-tolerant examples and a physical joining demonstration.	Fault-specific spacing and acceleration records and electric micro-vehicle switching cases; coverage and dataset reuse are detailed in Section 2.6 and Section 2.7.

The remainder of this paper is organized as follows. Section 2 presents the functional-safety analysis, fail-degraded control strategy, simulation setup, and on-road experimental platform. Section 3 reports and discusses the simulation and experimental results. Section 4 concludes the paper.

2. Materials and Methods

2.1. Fail-Degraded Framework Construction

The framework combines preliminary functional-safety concept analysis with fail-degraded strategy design. Item definition, hazard identification, risk screening and safety objectives organize the design [10,25]. Remaining information then determines the longitudinal controller, as shown in Figure 1. This preliminary assessment guides the controller-selection objectives.

Figure 1. Fail-degraded framework. Gray denotes functional-safety concept analysis; peach and light-blue boxes denote leading- and following-vehicle actions, respectively. The blue outline encloses strategy design, and the blue arrow links the two stages. Colors group the functions and vehicle roles.

2.2. Functional-Safety Analysis Outputs

Table 2 summarizes the analysis boundary. Supplementary Table S5 provides the event-level scenario, severity/exposure/controllability assumptions, conditional classification, safety objective and corresponding test coverage.

Table 2. Preliminary functional-safety analysis and validation boundary.

Phase	Main Output and Limitations
Item definition	Three-vehicle longitudinal platoon; human-driven leader, automated followers, V2V, radar and takeover.
Hazard identification	12 archived hazardous events involving single V2V or radar loss. Simultaneous loss is an additional fallback case, not one of these 12 events.
Risk screening	Table S5 gives conditional classes for H1–H9 and H11. H10 and H12 remain unclassified pending consistent scenario assumptions.
Safety objectives and tests	SG1–SG4 cover the four single-failure families; SG5 addresses following-vehicle simultaneous loss without assigning an ASIL. Only the mapped fault-label scenarios were tested.

The highest conditional classifications concern dry straight-road V2V loss and following-vehicle radar loss. These classifications motivate conservative fallback selection within the preliminary assessment.

The item definition in this study focuses on the longitudinal safety of a three-vehicle highway platoon. The leading vehicle is driven by a human driver, and the following vehicles execute automated longitudinal control. The relevant hardware components include the V2V communication unit, the millimeter-wave radar, the platoon controller, and the roadside unit used for failure injection in the experiment. The functional boundary covers longitudinal platoon driving and the degraded transition after a hardware failure.

The Hazard and Operability Study (HAZOP)-based hazard identification emphasizes deviations of information availability. For V2V communication, the primary deviation is loss of transmitted vehicle state information. For radar, the key deviation is loss of relative distance and relative speed to the preceding vehicle. These deviations may occur in the leading vehicle or in a following vehicle, and the safety impact of these deviations depends on the role of the failed vehicle. A failure in a following vehicle is generally more critical because it directly affects autonomous longitudinal control, whereas a leading-vehicle failure mainly affects the information available to the following vehicles.

The preliminary assessment uses severity (S), exposure (E) and controllability (C). Dry straight-road exposure is assumed to exceed 10% of operating time (E4), with 1–10% assumed for the other listed situations (E3). Severe collision consequences and difficult driver intervention in compact following motivate the stated S and C assumptions. These exposure and controllability assumptions remain unverified. Table S5 retains conditional classes for H1–H9 and H11. H10 and H12 are marked “Not assigned” because their severity and role-conversion speed assumptions, respectively, cannot be reconciled from the available descriptions. Their hazards and safety objectives remain in the assessment, without supporting a definite ASIL conclusion. The conditional classes do not establish verified controller safety capability.

The control architecture implements actions associated with these preliminary safety objectives. The manually driven leader broadcasts fault information only while its communication remains available. Following vehicles retain reduced longitudinal control and request a Dynamic Driving Task (DDT) fallback by the driver. The present tests supply known fault labels and do not evaluate autonomous fault diagnosis.

2.3. Vehicle Platoon Control Architecture

The inherited vehicle platoon architecture [26] contains five layers, as shown in Figure 2. The cloud-based decision layer provides traffic and management instructions; the communication layer exchanges V2V, cloud, and sensor messages; the management layer selects maneuvers, roles, and fail-degraded decisions; the control layer calculates desired velocity and trajectory through CACC, ACC, CC, automatic emergency braking (AEB), and lateral controllers; and the physical layer executes the commands. The present extension adds preliminary hazard-to-action mapping and explicit degraded reference policies to this architecture.

Figure 2. Vehicle platoon software system architecture, adapted from [26]. Gray denotes cloud-based decision-making, peach denotes communication message categories, and light blue denotes the management, control and physical layers. Blue arrows show information or command flow; colors distinguish architectural roles.

SG1–SG4 concern collision prevention after following-vehicle V2V loss, leading-vehicle V2V loss, following-vehicle radar loss, and radar-impaired leading-to-following role conversion, respectively. SG5 adds the objective of managing simultaneous V2V/radar loss in a follower by a limited temporary speed fallback and takeover request; no separate ASIL is assigned to this added case. The validation cases are leading-vehicle communication failure, following-vehicle communication failure, following-vehicle radar failure, and simultaneous V2V/radar failure in a follower. Leading-vehicle radar failure, leading-vehicle simultaneous loss, and several weather/ramp hazards in Table S5 are outside the validation scope.

2.4. Leading-Vehicle Fail-Degraded Strategy

The leading vehicle remains manually driven. When its V2V communication is unavailable, role conversion is inhibited, and no V2V fault broadcast is assumed. When radar fails but V2V remains available, the fault can be broadcast to the platoon and roadside equipment while role conversion is inhibited. Figure 3 shows the actions selected from the supplied status inputs.

Figure 3. Leading-vehicle decision logic for known status inputs; diagnostic acquisition and latency are not represented.

2.5. Following-Vehicle Fail-Degraded Strategy

Table 3 and Figure 4 select a following-vehicle controller from the remaining local information and the known preceding-vehicle fault label. Self-information loss determines which controller is feasible; when both local sources remain healthy, a known preceding-vehicle fault selects long-distance ACC. A takeover request accompanies each degraded mode. The status-label path is described in Section 2.7.2, and conditional duration bounds are considered in Section 2.5.1.

Table 3. Fail-degraded decision logic for following vehicles.

Condition	Degraded Action
No local failure; no known preceding-vehicle failure	Use nominal CACC with V2V state information and radar distance.
Following-vehicle V2V unavailable; radar available	Use long-distance ACC and request takeover.
Following-vehicle radar unavailable; V2V available	Use variable-speed CC, broadcast the local fault, and request takeover.
Following-vehicle V2V and radar both unavailable	Use fixed-speed CC with a held reference and offset; request takeover. Spacing is not actively regulated.
Local V2V/radar available; preceding-vehicle failure known	Use long-distance ACC and request takeover.

Figure 4. Following-vehicle mode selection for known fault labels. The available inputs determine the feasible policy and the associated takeover request.

For follower i, let v_i denote its speed (m/s), a_l the leading-vehicle acceleration (m/s²), and l_des the desired gap (m). In nominal CACC, h₁ (s²) weights leader acceleration, h₂ (s) weights ego speed, and l₀ (m) is the standstill-spacing offset. The predecessor-leader-follower reference is

$$l_{\mathrm{des}}=h_1\cdot a_l+h_2\cdot v_i+l_0,$$

(1)

where l₀ is the standstill-spacing offset. The reference is processed by a proportional-integral-derivative (PID) controller; K_p, K_i and K_d denote its proportional, integral and derivative gains. Section 2.6 and Table S1 describe the documentation limits for these gains and their implementation.

For long-distance ACC, h is the radar-based time headway (s). The desired gap is

$$l_{\mathrm{des}}=h\cdot v_i+l_0.$$

(2)

Let h₀ (s) be the base headway, k_v (s²/m) the relative-speed coefficient, and h_min and h_max (s) the lower and upper bounds. The preceding-vehicle speed is v_p (m/s), and v_r = v_p − v_i (m/s), so negative v_r denotes closing. The saturation function, sat, clips the headway to these bounds:

$$h=\mathrm{sat}(h_0-k_v{v}_r)=\left\{\begin{array}{cc}{h}_{\max }& \mathrm{if} h_0-k_v{v}_r\ge h_{\max }\\ h_0-k_v{v}_r& \mathrm{if} h_{\min }<h_0-k_v{v}_r<h_{\max }\\ h_{\min }& \mathrm{otherwise}\end{array}\right.,$$

(3)

where positive k_v increases headway during closing. The distance-feedback error is the measured gap minus l_des; the PID output is desired acceleration, which is integrated to form desired speed. The archived design specifies enlarged headway/spacing relative to nominal CACC, with the calibration limits specified in Table S1.

For variable-speed CC, v_des is the desired speed (m/s). When radar is unavailable but fresh V2V speed remains available, the reference follows the preceding vehicle:

$$v_{\mathrm{des}}=v_p.$$

(4)

Let e_i (m/s) be the speed-controller input error, Δv (m/s) a positive speed offset, and t₀ (s) its duration. The switch occurs at t_f (s), and τ = t − t_f is elapsed time after that switch. The initial offset then gives

$$e_i=\left\{\begin{array}{cc}{v}_{\mathrm{des}}-v_i-{\mathsf{\Delta }}_v& \mathrm{for}0\le \tau \le t_0\\ v_{\mathrm{des}}-v_i& \mathrm{for}\tau >t_0\end{array}\right.,$$

(5)

where the offset applies only during the initial interval. Its value and duration are speed-band calibration settings, subject to the documentation limits in Table S1. The reference does not directly regulate spacing when radar is unavailable.

For simultaneous loss, v_p,last denotes the last valid received preceding-vehicle speed (m/s). Fixed-speed CC holds this stored reference:

$$v_{\mathrm{des}}=v_{p,\mathrm{last}}.$$

(6)

The corresponding PID input error is

$$e_i=v_{\mathrm{des}}-v_i-{\mathsf{\Delta }}_v.$$

(7)

In Equation (7), Δv remains active throughout the fixed-speed mode until takeover or mode exit; e_i remains a speed error. No external gap or speed update is available for control. This policy was exercised under steady cruising only and cannot guarantee clearance when the preceding vehicle brakes, cuts in, or otherwise changes its motion. Section 2.5.1 states the additional assumptions required even for a conditional forward-gap bound.

Long-distance ACC is selected when radar remains available because it can directly regulate spacing. Variable-speed CC is selected when radar is lost but V2V messages remain available. Fixed-speed CC provides a temporary held-speed reference during simultaneous information loss. Across all modes, PID output is the desired longitudinal acceleration, and integration provides desired speed.

A following vehicle with available radar switches away from tight CACC following when a preceding-vehicle fault label is supplied. Enlarging the commanded gap sacrifices compactness, but whether sufficient clearance remains depends on actual motion, controller response and detection delay. These factors determine the validation needed for a safe operating envelope.

The nominal |a| ≤ 1 m/s² value is a calibration objective, not a demonstrated bound. Reanalysis retains every sample in the 20–90 s post-injection window. Each 20 m/s straight-road simulation file contains a Vehicle 3 absolute peak near 8.94 m/s² at 20.01 s, exceeding this objective. These samples remain in the complete-window statistics. Supplementary Sections S2–S4 report the unfiltered samples and additional consistency checks; the physical cause remains unresolved.

The 70 m target at 20 m/s and 90 m target at 30 m/s are inherited calibration/evaluation settings, equivalent to gap-to-speed ratios of 3.5 s and 3.0 s. Their rationale is to allow additional space for takeover, although a quantitative takeover-time or stopping-distance derivation for these exact values is unavailable. They are evaluation targets rather than minimum safe distances. The initial simulation gaps were approximately 28 m and 35 m, respectively: the enlarged targets cannot be counted as clearance already available at fault onset. Long-distance ACC regulates gap, variable-speed CC regulates speed with a temporary offset, and fixed-speed CC does not regulate an external gap.

2.5.1. Conditional Gap and Delay Bounds

Consider a straight-road follower and its immediate predecessor. Let d₀ (m) be the bumper gap at fault onset, d_clr (m) a specified positive clearance reserve, and c₀ = max(v_i − v_p, 0) (m/s) the initial closing speed. Assume their longitudinal relative acceleration satisfies a_i − a_p ≤ R, with R ≥ 0 in m/s² throughout a chosen duration T (s). Integrating this upper bound gives a sufficient forward-gap condition:

$$d_0\ge d_{\mathrm{c}\mathrm{l}\mathrm{r}}+c_{0}T+{\displaystyle \frac{1}{2}}R{T}^2.$$

(8)

Because the assumed closing bound is nonnegative, Equation (8) protects the reserve throughout the interval, not just its endpoint. It also gives the admissible initial closing speed: c₀ ≤ (d₀ − d_clr − RT²/2)/T for T > 0 and a nonnegative right-hand side. With d₀ > d_clr, the corresponding conditional duration is

$$T_{\mathrm{m}\mathrm{a}\mathrm{x}}=\left\{\begin{array}{ll}{\displaystyle \frac{\sqrt{{c_0}^2+2R(d_0-d_{\mathrm{c}\mathrm{l}\mathrm{r}})}-c_0}{R}}& \mathrm{if}R>0\\ {\displaystyle \frac{d_0-d_{\mathrm{c}\mathrm{l}\mathrm{r}}}{c_0}}& \mathrm{if}R=0,c_0>0\\ \mathrm{no}\mathrm{finite}\mathrm{bound}& \mathrm{if}R=c_0=0\end{array}\right..$$

(9)

The third case describes ideal constant-relative-speed motion. A conservative bound on predecessor braking and ego acceleration must be known before Equation (9) can define an allowable duration. The nominal 1 m/s² objective cannot supply that bound because three retained records violate it. Neither actual human takeover time nor a validated maximum fallback duration can therefore be assigned from these data. The condition concerns forward clearance under the stated one-dimensional assumptions.

Let δ (s) denote fault-onset-to-effective-switch delay, including detection, notification and switching. Let R_d and R_f (m/s²) be nonnegative upper bounds on relative acceleration before and after switching, and let T now denote the duration after switching. Applying the same integration in two stages gives

$$d_0\ge d_{\mathrm{c}\mathrm{l}\mathrm{r}}+c_0\delta +{\displaystyle \frac{1}{2}}{R}_{\mathrm{d}}{\delta }^2+(c_0+R_{\mathrm{d}}\delta )T+{\displaystyle \frac{1}{2}}{R}_{\mathrm{f}}{T}^2.$$

(10)

Equation (10) shows how an unmeasured diagnosis delay consumes the initial gap. For illustration only, with d_clr = 5 m, c₀ = 2 m/s, R_d = 2 m/s², R_f = 0 and T = 3 s, delays of 0, 0.2, 0.5 and 1 s require initial gaps of 11, 12.64, 15.25 and 20 m, respectively. The values illustrate the dependence on the assumed motion bounds. Table S6 supplies additional conditional duration examples and the reproducible calculation.

2.5.2. Communication Loss and Status Availability

Complete V2V exclusion with a supplied fault label is the tested communication fault model. If radar remains available, long-distance ACC can regulate local gap without cooperative messages; if radar is also unavailable, the held-speed fallback loses that feedback. A failed vehicle cannot be assumed to notify followers over the failed V2V channel. The physical tests use a separate external experiment-control/fault-indication channel.

Deployment requires a local timeout or health monitor with a validated delay bound and either stale-message detection in each follower or an independently available notification path. Equation (10) makes the associated clearance cost explicit. Extension to intermittent, asymmetric, delayed and recovering communication requires validation beyond the complete-loss cases tested here, including the availability of the notification path.

2.6. Simulation Scenarios and Parameter Settings

The strategy was evaluated using PreScan 8.5.0 and MATLAB/Simulink R2022b. Four nominal failure cases were crossed with straight/bend roads and 20/30 m/s speeds, giving a 16-condition test matrix. The archived result set contains 12 distinct state-trajectory files: the leading- and following-vehicle communication cases use the same degraded controller assignments for the two followers, so their vehicle-state trajectories are shared rather than duplicated. Failures were injected at 20 s after stable cruising.

Supplementary Table S1 distinguishes documented scenario and vehicle parameters from implementation details that cannot be verified for the reported runs. The available documentation does not include an executable PreScan/Simulink project or a complete, run-specific record of PID gains, reference calibration, initialization, saturation, anti-windup, state transfer and solver settings. The matrices contain time, the accelerations of Vehicles 2 and 3, and their inter-vehicle distances at observed 0.01 s output intervals; this does not establish the solver step or controller update period. Equations (1)–(7) specify the reference-generation and error logic. The supplied data and methods permit independent reanalysis of the recorded outputs; regeneration of the original closed-loop trajectories remains unsupported by the available implementation documentation.

The evaluation assesses implementation feasibility under the specified fault conditions. It examines controller selection, spacing change, and longitudinal response under the archived test conditions. The 30 m/s bend scenario is shown in the main text because it combines high speed with curved-road path following.

The 20 s injection time follows stable platoon formation. Achieved spacing and acceleration are evaluated over the remaining recorded window, including any target shortfalls at its end.

The reported simulation settings and test matrix are summarized in Table 4.

Table 4. Simulation setup and test conditions.

Item	Setting
Platform	PreScan 8.5.0 and MATLAB/Simulink R2022b
Vehicle models	PreScan models: BMW X5 leading vehicle; two Audi A8 following vehicles
Road and speed	Straight road and bend; 20 m/s and 30 m/s
Bend geometry	Two consecutive curves with radii of 800 m and 1500 m
Failure cases	Leading-vehicle V2V failure; following-vehicle V2V failure; following-vehicle radar failure; simultaneous V2V and radar failure in a following vehicle
Failure injection	20 s after stable cruising
Test matrix	16 nominal conditions; 12 distinct archived state-trajectory files
Nominal spacing targets	70 m at 20 m/s; 90 m at 30 m/s
Archived controller calibration	PID gains, time-headway bounds, speed-offset calibration and duration: not verifiable from the available run records (Table S1)

The two road geometries and speed levels define the simulation coverage. The 70 m and 90 m values serve as evaluation targets, subject to the assumptions discussed in Section 2.5.1.

Table 5 lists the vehicle-dynamics parameters used by the corresponding PreScan models.

Table 5. Vehicle dynamics parameters used in the PreScan models.

Parameter	BMW X5	Audi A8
Mass (kg)	2220	1820
Center of gravity (CG) to front axle (m)	1.69	1.77
CG to rear axle (m)	1.13	1.17
Wheelbase (m)	2.82	2.94
Tire rolling radius (m)	0.37	0.34
Aerodynamic drag coefficient	0.36	0.27
Frontal area (m2)	2.83	2.33
Rolling-resistance coefficient	0.01	0.01
Air density (kg/m3)	1.206	1.206

2.7. On-Road Micro-Vehicle Platoon Experiment

2.7.1. Micro-Vehicle Platoon Platform Design

To verify real-time implementation, the strategy was tested on a drive-by-wire electric micro-vehicle platoon platform. The leading vehicle used a four-wheel chassis, and the two following vehicles used tracked chassis; all used brushless direct-current (DC) propulsion. The following vehicles contained perception, communication, and decision-control modules, whereas the leading vehicle was manually controlled. Controllers were compiled in MATLAB/Simulink R2022b and deployed through the platoon controller. Figure 5 presents the hardware architectures of the following and leading vehicles.

Figure 5. Hardware system architecture of the micro-vehicle platoon platform: (a) following-vehicle hardware architecture; (b) leading-vehicle hardware architecture. Arrows indicate information, command or software-deployment flow, as labeled; dashed horizontal dividers separate module headings from their components.

The electric micro-vehicle platform exercises sensing, V2V communication, mode selection, longitudinal-reference generation and electric actuation. The evaluation concerns supervisory switching and scaled vehicle response. Battery state of charge, energy use, regenerative braking and motor thermal behavior are outside the present control and evaluation scope. Extension to full-size electric vehicles requires integration with vehicle-specific torque and braking constraints.

The physical platform includes manually varying leader-speed input and the effects of real sensors, actuators and communication hardware. The demonstrations assess the resulting implementation response under these recorded conditions.

The platform used a Delphi ESR millimeter-wave radar (Delphi Electronics and Safety, Kokomo, IN, USA), a NEBULA-LINK V2V communication device (Beijing Nebula Link Technology Co., Ltd., Beijing, China), a Mobileye 630 monocular camera (Mobileye Vision Technologies Ltd., Jerusalem, Israel), and a vehicle control unit, as shown in Figure 6.

Figure 6. Hardware of the micro-vehicle platform: (a) micro-vehicle modification (1: leading vehicle; 2 and 3: following vehicles); (b) vehicle control unit; (c) millimeter-wave radar; (d) V2V device; (e) monocular camera. Hardware images adapted from [26].

2.7.2. Experimental Scenarios and Settings

Four physical fault-label cases correspond to the nominal simulation cases. Table 6 summarizes their controller assignments and the descriptive statistics of identifiable representative records. The basis for these statistics and the limits on independent-trial identification are detailed below.

Table 6. Controller assignments and unfiltered representative-record spacing deviations.

Failure Case	Assignment and Representative-Record Mean (Temporal SD), m
Leading-vehicle communication failure	Vehicles 2/3: long-distance ACC. Relative to 6 m, mean deviations are −0.085 (0.068)/−0.172 (0.052).
Following-vehicle communication failure	Vehicles 2/3: long-distance ACC. No separately matched representative spacing-statistics record is assigned here.
Following-vehicle radar failure	Vehicle 2: variable-speed CC; deviation from the 6.8 m plotting reference is 0.016 (0.036). Vehicle 3: long-distance ACC; deviation from 6 m is 0.156 (0.087).
Following-vehicle simultaneous V2V and radar failure	Vehicle 2: fixed-speed CC, no gap-error regulation. Vehicle 3: long-distance ACC; deviation from 6 m is 0.082 (0.054).

Statistics use the final 10 s of each original displayed record, with no smoothing. Parentheses contain within-record temporal sample standard deviation, not between-trial variability or a confidence interval. Table S8 specifies files, signals, raw-time windows, sample counts, RMSE and maximum absolute deviations. The Vehicle 2 radar-loss reference is not a controlled gap setpoint.

The roadside unit provided an external experiment-control/fault-indication channel, separate from the V2V data stream under test. At the commanded failure time, it sent a scenario code identifying the affected vehicle and failed hardware: the affected vehicle received a self-failure code, and the rear vehicle received a preceding-vehicle-failure code. The corresponding V2V and/or radar data stream was then excluded from the onboard decision logic, while the remaining devices continued to support logging and analysis. Thus, the tests evaluate controller switching under externally supplied fault labels; fault detection, isolation, and diagnostic latency are outside the present validation scope.

The experiment description reports three executions per case. Duplicate exports and mixed time origins, however, prevent a reliable mapping to independent, equivalently evaluated trials for every case. Trial-level confidence intervals therefore remain unavailable. Table S8 reports temporal descriptive statistics for three identifiable representative records.

The experiment exercises onboard mode selection and physical actuation after an externally supplied scenario label. A radar stream excluded from the controller may still be logged for analysis; its availability to the logger does not imply use by the degraded controller. Section 2.5.1 considers the effect of an assumed delay separately from the physical measurements.

For the plots and new statistics, spacing deviation is measured gap minus the stated reference, positive when the gap is larger. The reference is 6 m for long-distance ACC. In the radar-loss Vehicle 2 record, 6.8 m is the legacy plotting reference, not an actively regulated gap target. The experimental result figures retain the original processed visualization, whose scripts repeatedly smooth the spacing signals. Table S8 instead uses unchanged raw samples over the final 10 s of the original displayed windows. The fixed windows are descriptive and are not a convergence or settling-time criterion.

The test road was approximately 120 m long with clear lane markings, as shown in Figure 7. Leading-vehicle speed was manually controlled rather than prescribed by a repeatable scenario. The recorded variation defines the leader input for these demonstrations. Controlled robustness tests with prescribed speed profiles and varied road conditions are proposed in Section 4. The stable micro-vehicle spacing was set to 5 m under CACC and 6 m under long-distance ACC. Controller-transition signals are provided in Supplementary Figures S5–S8; Section 3.2 presents representative vehicle-state records.

Figure 7. Micro-vehicle platoon testing scenarios: (a) schematic of the approximately 120 m straight test section (not to scale); (b) micro-vehicle platoon.

The experimental spacing values are scaled for the micro-vehicle platform rather than directly using the 70 m and 90 m full-scale takeover distances from the simulation. A 5 m spacing is used for normal CACC operation, and a 6 m spacing is used as the long-distance ACC target. For the variable-speed CC case, the final spacing can differ slightly because the controller adjusts speed through a deceleration–acceleration process rather than direct distance feedback. These scaled distances allow evaluation of the strategy logic and degraded response on the micro-vehicle platform.

Transfer to full-scale operation requires validation of braking capability, highway disturbances and driver takeover behavior, including the motion bounds used in Section 2.5.1.

3. Results and Discussion

3.1. Simulation Results and Discussion

Controller-transition signal plots are provided in Supplementary Figures S1–S4. They document the injected failure-state signals and the corresponding archived mode-code transitions. The main text therefore focuses on representative spacing and acceleration trajectories under the 30 m/s bend scenario.

Representative simulation results are shown in Figure 8, Figure 9 and Figure 10. The simultaneous V2V and radar-loss bend cases have the largest spacing shortfalls: Vehicle 2 ends at 66.93 m in the 20 m/s case and 83.18 m in the 30 m/s case, below the respective 70 m and 90 m targets. The following analysis reports both the achieved responses and these shortfalls.

Figure 8. Representative simulation results under leading-vehicle communication failure: (a) following distance at 30 m/s; (b) acceleration at 30 m/s.

Figure 9. Representative simulation results under following-vehicle radar failure: (a) following distance at 30 m/s; (b) acceleration at 30 m/s.

Figure 10. Representative simulation results under simultaneous V2V and radar failure in following vehicle 2: (a) following distance at 30 m/s; (b) acceleration at 30 m/s.

In Figure 8, after the leading-vehicle communication failure at 20 s, both following vehicles use long-distance ACC. Spacing increases from approximately 35 m to 89.91 m for vehicle 2 and 89.93 m for vehicle 3 at 90 s; the mean values over 85–90 s are 89.95 m and 90.15 m, respectively. Maximum absolute acceleration in the plotted trajectories is 0.30 m/s² for vehicle 2 and 0.65 m/s² for vehicle 3.

Figure 9 is associated with the following-vehicle radar-loss case, whose intended assignments are variable-speed CC for Vehicle 2 and long-distance ACC for Vehicle 3. The archived 90 s gaps are 89.92 and 90.49 m; 85–90 s means are 89.95 and 90.74 m. Comparison of the source arrays for Figure 8 and Figure 9 over 20–90 s finds Vehicle 2 spacing MAE 0.000344 m, maximum difference 0.001266 m and acceleration MAE 0.0000192 m/s². Vehicle 3 differs substantially, with spacing MAE 2.046276 m (Table S7). Thus, the Vehicle 2 similarity already exists in the stored outputs, although the complete files differ. Without corresponding run configurations and controller states, these figures are qualified case records rather than independent evidence of differences between the two policies.

Figure 10 is associated with simultaneous V2V/radar loss, assigning fixed-speed CC to Vehicle 2 and long-distance ACC to Vehicle 3. At 90 s, the recorded gaps are 83.18 and 90.23 m; Vehicle 2 does not attain the nominal 90 m target. Both displayed acceleration magnitudes peak near 0.30 m/s². Safe-duration assessment additionally requires validation of the gap and motion assumptions in Section 2.5.1. Table 7 summarizes the retained trajectories.

Table 7. Trajectory-data summary for the 12 distinct archived simulation trajectories.

Failure Case	Speed	Straight V2/V3 Spacing (m)	Bend V2/V3 Spacing (m)	Bend Max |a|, V2/V3 (m/s2)
Communication failure *	20 m/s	70.32/69.43	70.34/69.65	0.18/0.19
Communication failure *	30 m/s	90.01/88.86	89.91/89.93	0.30/0.65
V2 radar failure	20 m/s	70.02/69.69	69.99/69.90	0.18/0.19
V2 radar failure	30 m/s	89.96/90.44	89.92/90.49	0.30/0.32
V2 V2V/radar failure	20 m/s	75.74/69.90	66.93/69.86	0.06/0.19
V2 V2V/radar failure	30 m/s	89.91/90.09	83.18/90.23	0.30/0.30

* Communication rows share trajectories; slash values are V2/V3. The acceleration column covers bend runs only. In the three 20 m/s straight-road files, the complete-window V3 absolute peaks are 8.9393, 8.9393, and 8.9401 m/s² at 20.01 s; these exceed the 1 m/s² objective. See Supplementary Table S2 for the unfiltered neighboring samples and separately reported later-window statistics.

Across the 12 distinct archived trajectories, most terminal spacings are close to the 70 m or 90 m nominal settings, but exact target attainment is not universal. The largest shortfalls occur for vehicle 2 under simultaneous V2V and radar loss on the bend. Because fixed-speed CC lacks external feedback, this limitation is consistent with its intended use only as a temporary fallback pending takeover.

Table S7 localizes the near-duplicate response to Vehicle 2 but does not establish its cause or independent execution of the intended policies. A controlled comparison of long-distance ACC and variable-speed CC requires separately documented runs with complete configurations.

The six bend-road records have maximum absolute accelerations no greater than 0.650 m/s² over 20–90 s. Each of the three 20 m/s straight-road simulation records contains one Vehicle 3 sample above the 1 m/s² objective, at 20.01 s; adjacent samples are approximately −0.025 and −0.021 m/s² (Table S2). The archived descriptions and plotting scripts identify these as simulation outputs, not measurements from the low-speed micro-vehicle experiments. In separate older seven-column records, a similar transient coincides with a velocity decrement consistent with the recorded acceleration (Table S3); those records are not matched reruns of the current files. A local straight-road kinematic check of the current records also agrees more closely with the recorded spacing when the full acceleration trace is retained (Table S4). These internal consistency checks do not establish physical realizability or distinguish controller-state transfer, solver behavior, and logging. The records do not include the matched independent velocity, actuator-command and controller-state traces needed to distinguish these explanations. The full-window statistics retain these samples and therefore preclude a general smooth-switching conclusion.

Supplementary Figures S1–S4 show the injected-fault and mode-code transitions. Their relationship to the trajectory-file evidence is discussed alongside the source comparison in Supplementary Section S7.

3.2. Experimental Results and Discussion

3.2.1. Leading-Vehicle Communication Failure

For leading-vehicle communication failure, the external roadside channel supplied a preceding-vehicle-failure label to both following vehicles, selecting long-distance ACC. Figure 11 shows the legacy processed representative trace approaching the 6 m reference. In the unfiltered final 10 s of that displayed record, mean gap deviations are −0.085 and −0.172 m, temporal SDs are 0.068 and 0.052 m, and maximum absolute deviations are 0.183 and 0.240 m for Vehicles 2 and 3, respectively (Table S8). Table S8 defines the single-record statistical window.

Figure 11. Experimental results under leading-vehicle communication failure: (a) leading-vehicle speed; (b) following distance; (c) spacing error of the following vehicles.

The record shows the two followers responding to the externally supplied leader-failure label and approaching the long-distance ACC reference under the measured leader-speed input.

3.2.2. Following-Vehicle Communication Failure

When the communication data stream of Vehicle 2 was disabled, the external roadside fault-indication channel sent a self-communication-failure code to Vehicle 2 and a preceding-vehicle-failure code to Vehicle 3. Both vehicles therefore adopted long-distance ACC. Because the degraded controllers and target spacing are the same as those in the leading-vehicle communication-failure case, the vehicle-state curves are not repeated in the main text; the controller-transition signals are provided in Supplementary Figure S6.

This case confirms that the strategy distinguishes the failed vehicle from the rear following vehicle. Vehicle 2 retains radar and can follow its predecessor despite loss of its V2V data stream. Vehicle 3 receives the preceding-vehicle-failure code through the external roadside fault-indication channel and increases its safety buffer. The separate roadside channel supplies the status information used for this response.

3.2.3. Following-Vehicle Radar Failure

For the following-vehicle radar-loss case, the intended assignments are variable-speed CC for Vehicle 2 and long-distance ACC for Vehicle 3. Figure 12 shows the legacy processed representative record. Unfiltered final-window deviations have means of 0.016 and 0.156 m and temporal SDs of 0.036 and 0.087 m for Vehicles 2 and 3, relative to 6.8 and 6.0 m, respectively (Table S8). The 6.8 m reference describes the observed gap plateau, not a distance-feedback objective of variable-speed CC.

Figure 12. Experimental results under following-vehicle radar failure: (a) leading-vehicle speed; (b) following distance; (c) spacing error of the following vehicles.

Radar exclusion prevents Vehicle 2 from using local distance feedback in the control loop, while retained V2V speed supports variable-speed CC. Vehicle 3 retains radar and uses long-distance ACC. This assignment follows the information-availability rules in Table 3.

The corresponding unfiltered maximum absolute deviations are 0.123 and 0.267 m. In particular, the raw Vehicle 2 peak exceeds the earlier 0.06 m summary and the approximately ±0.05 m smoothed-plot description. Table 6 now uses the reproducible raw-data statistics; the original processed curves have different filtering and evaluation conventions.

3.2.4. Following-Vehicle Simultaneous V2V and Radar Failure

For simultaneous V2V/radar loss in Vehicle 2, the roadside channel supplied local-failure and preceding-vehicle-failure labels to Vehicles 2 and 3. The selected modes were fixed-speed CC and long-distance ACC, respectively. Figure 13 retains the processed representative visualization. For Vehicle 3, the unfiltered final-window gap deviation from 6 m has mean 0.082 m, temporal SD 0.054 m and maximum absolute value 0.195 m (Table S8). Vehicle 2 is excluded from regulated-gap error statistics because its fixed-speed policy has no external gap feedback.

Figure 13. Experimental results under simultaneous V2V and radar failure in following Vehicle 2: (a) leading-vehicle speed; (b) following distance; (c) spacing error of Vehicle 3.

The simultaneous-loss record illustrates the temporary held-speed response under the recorded steady-cruising input. The fallback-duration condition in Equation (9) additionally requires justified initial-state and acceleration bounds for changes in surrounding traffic.

The physical records show mode selection and degraded responses on the electric micro-vehicle platform under externally supplied fault labels. The representative-record statistics in Table S8 characterize these responses within the recorded windows.

The platform tests exercise actual sensors, V2V hardware, controllers and actuators. Conditional clearance and delay analysis (Section 2.5.1; Table S6) and signal-consistency checks (Tables S2–S4, S7 and S8) supplement these observations. Further validation should combine formal checks that each selected mode uses available inputs, hardware-in-the-loop tests of delayed, asymmetric and recovering communication, and controlled closed-course trials. Synchronized fault, controller and actuator logs are needed to evaluate the complete switching chain.

4. Conclusions

This study links a preliminary ISO 26262-oriented hazard assessment to three information-dependent degraded reference policies. It extends the architecture and role-dependent fallback in [26] through hazard-to-action traceability, explicit reference/error definitions and dedicated failure-case evaluation.

The 16-condition simulation matrix is represented by 12 distinct state files, with shared communication-case trajectories. The electric micro-vehicle tests demonstrate mode switching under externally supplied labels, and the physical-record statistics characterize the recorded spacing responses. Reanalysis is supported by the supplied data and methods; complete controller reproduction and independent-trial uncertainty remain limited, as detailed in Section 2.6 and Section 2.7.2.

The results include terminal spacings of 66.93 and 83.18 m, below the respective 70 and 90 m targets for Vehicle 2 in simultaneous-loss bend cases, an unresolved acceleration sample near −8.94 m/s² in each 20 m/s straight-road file, and near-identical Vehicle 2 traces in Figure 8 and Figure 9. These observations limit conclusions about target attainment, smooth switching and cross-controller performance. The gap and delay inequalities describe conditional clearance requirements whose motion bounds still require validation.

Further work should resolve the switching and trajectory-provenance anomalies, validate a fully calibrated model, and obtain matched repeated trials with bounded end-to-end diagnostic latency. Longer closed-course tests should use predefined acceleration/deceleration and cut-in scenarios, vary curvature, grade and surface conditions separately, and record the realized leader-speed profile. Full-scale electric-vehicle evaluation should integrate torque and braking limits, delayed takeover and electric-actuation constraints. The present evidence supports implementation feasibility under the tested conditions and defines the additional work needed to establish a safe operating envelope.