A Novel Maneuver-Based Driving Envelope Generation Approach for Driving Safety Assessment

: It is of utmost importance for advanced driver assistance systems to evaluate the risk of the current situation and make continuous decisions about what kind of evasive maneuver can be initiated. The purpose of this paper is to establish efﬁcient indicators to evaluate the risk of candidate driving maneuvers for a human-in-the-loop vehicle. A novel safe driving envelope generation method is proposed, which takes various constraints into consideration, including the human operation, vehicle motion limits, and collision avoidance with road boundary and obstacles. The efﬁciency of the proposed method is validated by simulation experiments and real vehicle tests. The results show that the feasibility of candidate driving maneuvers can be efﬁciently determined by computing the driving envelope, and the proposed driving envelope method can be easily implemented for real-time applications.


Introduction
The advanced driver assistance systems (ADAS) are expected to reduce the risk of accidents and enhance driving comfort. The driving states can be classified into five types: normal driving state, warning state, collision avoidable state, collision inevitable state, and post-collision state. With a human-in-the-loop, it is necessary to establish safety indicators for situation assessment to determine whether the vehicle is in a safe state and whether the driver can avoid potential collisions.
Generally, the driving situation assessment modular estimates the current driving state, predicts the future driving state, and evaluates the collision risk. The single threat metric includes time-related metrics, acceleration-related metrics, and distance-related metrics, etc. Given the current speed of the host vehicle, the Inter-Vehicle-Time (IVT) indicates the time required for the host vehicle to travel the relative distance to the obstacle [1]. The time-to-collision (TTC) denotes the collision time under the assumption that the vehicle will follow a specific trajectory in the future time-domain [2]. Time-to Maneuver (TTM) is the remaining time to avoid a collision by a specific driving maneuver, such as Time-to-Brake (TTB), Time-to-Steer (TTS), and Time-to-Kickdown (TTK) [3,4]. The Brake Threat Number (BTN) and the Steering Threat Number (STN) are acceleration-related metrics introduced in [5,6]. The STN is used to evaluate the risk of the steering maneuver to avoid a collision. The BTN is an indicator for evaluating the risk of braking to avoid a collision. The minimum safe distance in [7] is calculated under the assumption that the leading vehicle will maintain a constant deceleration until it comes to a stop, and the host vehicle starts to brake at a constant deceleration after reaction time. The minimal safe distance (MSD) is the safe distance required for two vehicles to keep minimal safety [8]. The Minimum Longitudinal Safety Spacing (MLSS) represents the safe distance to start a lane-change maneuver [9]. However, the above methods have not considered the current input of the driver. Due to the driving limits and driving comfort, the curvature of the evasive path should have an upper bound.
In some works, path planning methods are used to determine whether there is a safe obstacle avoidance trajectory. In [10][11][12][13][14][15], the motion planner generates a bundle of candidate trajectories, and the safety of each trajectory is determined by collision detection. In [16][17][18][19][20], the handling envelope and the environmental envelope at each time step are taken into account. Whether a safe trajectory exists or not is identified by solving the optimization problem of trajectory generation. However, these methods consume massive computing resources.
For a human-in-the-loop system, the human and the machine are complicatedly coupled. The driver's input and the vehicle's driving safety need to be considered at the same time. The Inevitable Collision State (ICS) is defined as a state that ultimately ends in a collision, regardless of what the input is selected [21][22][23]. In [24], the reachable occupancy without collision utilizing the concept of ICS is calculated at discrete time steps. However, determining the set of ICS is computationally expensive. Owing to the consumption of computing resources, it is difficult to apply ICS in real-time, and the time horizon is often very short. In [25][26][27], a kind of reachable set is mentioned, where the current input of the driver can be considered. The data-driven reachable set is built to represent the probability distribution of the future trajectories considering individual driver steering behavior. The probability distribution of future position is highly related to the curvature of the road. The data-driven method needs to learn the distribution on roads with different curvatures. The extreme trajectory bound for obstacle avoidance is not generated, and the existence of collision avoidance trajectories is determined by checking the collision area of the obstacles and the reachable set of the ego vehicle. Inspired by their work, we propose a driving envelope for a human-in-the-loop vehicle considering the various constraints including human operation, vehicle motion limits, and collision avoidance with road boundaries and obstacles.
The main contributions of our work are two-fold. First, the safe distance considering uncertainty for collision avoidance with obstacles is derived. The lateral motion and the longitudinal motion are considered. The extreme boundary trajectories for collision avoidance are obtained based on the derived safe distance. Second, a novel driving envelope is proposed. The driving envelope considers the constraints including steering input of the driver, vehicle motion limitation, the boundary of road, and the safe distance for collision avoidance. Using the proposed driving envelope, the safety and the intervention time of candidate driving maneuvers can be determined. Motion planning algorithm can be applied considering the proposed driving envelope.
The safe distance in this paper is inspired by the MLSS [9], which is the safe distance to start a lane-change maneuver, the safe distance during the lane-change process is not derived. In this paper, the safe distances during the lane-change process and for the lanechange abortion are derived. The driving envelope in this paper is different from that in [27], where the sub-reachable-set generation method did not consider the collision avoidance behavior with obstacles on the road. In this paper, the collision avoidance maneuver is considered for the driving envelope generation method. The proposed driving envelope in this paper is also different from that in [16][17][18][19][20], where the environmental driving envelope is the unoccupied area at each prediction step. In the above papers, whether safe trajectories exist or not is identified by solving the optimization problem of trajectory generation. The driving envelope proposed in this paper is the non-collision area during the whole time domain of lane-change maneuver and lane-change abortion maneuver. The existence of non-collision trajectories can be identified based on the proposed driving envelope conveniently. In the future, with the help of V2X technology [28,29], the uncertainty of perception and prediction will be reduced, and the driving envelope will be more reliable. Furthermore, the proposed driving envelope can be used for guiding the search of an underlying planning algorithm to find a solution and determining the time for intervention. The remainder of this paper is organized as follows. The motion constraints for human-in-the-loop vehicles are introduced in Section 2. The driving envelope for candidate maneuvers is described in Section 3. The applications of the proposed driving envelope are discussed in Section 4. The experiment results and the discussions are shown in Section 5. The conclusions are drawn in Section 6.

The Motion Constraints
The motion of a vehicle is constrained by the vehicle kinematic limitation, and should not collide with road boundary or obstacles.

The Constraint of Vehicle Kinematic
The maximally allowed acceleration is limited by the friction force, which can be represented by a friction circle on a g-g diagram [30]. Factors including weight transfer, bank and grade of the road will affect the shape of the friction circle. These factors can be considered to obtain accurate vehicle dynamic models under different road conditions [31]. The permissible speed v lim is limited by the road curvature κ and the maximum allowed speed v max . The longitudinal and lateral motion in the reference frame is limited by the ability of accelerating and decelerating and the friction force.
where a lat is the lateral acceleration, a lon is the longitudinal acceleration, a max ,lon represents the maximum longitudinal acceleration, a min ,lon represents minimum longitudinal acceleration, a max ,lat represents the maximum allowed lateral acceleration.

The Evasive Motion Model
Motion planning in a dynamic environment involves many aspects, such as collision avoidance, the drivability of the planned trajectory, and the motion of the other traffic participants in the future, etc. In [32], the minimum distance required for avoiding the front dynamic obstacle was analyzed. However, the paper only considered avoiding obstacles with a constant steering angle. The constraints on the terminal state of the host vehicle after avoiding obstacles have not been considered. It is not guaranteed to adjust the state of the vehicle in the lane boundary after a collision-avoidance maneuver. In a real traffic scenario, after an evasive maneuver or lane-change maneuver, the vehicle should adjust the heading angle to avoid collision with the road boundary. In this paper, we utilize an evasive motion model in [9]. The motion of the host vehicle is decomposed into lateral movement and longitudinal movement in the reference frame. The lateral motion model in the reference frame is described as follows.
where a lat is the lateral acceleration in the reference frame, t lat is the required total time to finish the lateral motion, H is the total lateral moving distance of the evasive maneuver, y 0 is the starting lateral position in the reference frame, y target is the terminal lateral position in the reference frame. As mentioned in [33], the comfort zone of lateral acceleration should be within a ∈ [−2,2]. The longitudinal motion model in the reference frame can be defined as follows.
x lon (t) =v lon (0)t + 1 2 The lateral acceleration, curvature, and lateral velocity of the motion model are differentiable. Assuming that H is 3.5 m, the values of lateral acceleration a lat , lateral velocity v lat , lateral position y lat , curvature k, and derivative of curvature k can be obtained, as shown in Figure 1. Given the maximum lateral accelerations a max ,lat and the total lateral movement distance H, the required time t lat to finish the evasive maneuver can be obtained.
According to natural driving data, the longitudinal and lateral accelerations of the human driver are typically smaller than physically feasible accelerations. For most drivers, the maximum longitudinal and lateral acceleration is around 3~4 m/s 2 at low speed, and can be reduced to 1~2 m/s 2 at high speed [34]. The heading angle in the reference frame can be obtained using longitudinal velocity and lateral velocity.
The position of the center of the rear axis can be calculated by the evasive motion model. Thus, the position of each vertex as shown in Figure 2 can be obtained.
(x f l , y f l ) =(x − w h sinϕ + l a cosϕ, y lat + w h cosϕ + l a sinϕ); (6a) (x f r , y f r ) =(x + w h sinϕ + l a cosϕ, y lat − w h cosϕ + l a sinϕ); where, w h is the half width of the host vehicle, l a and l b are the distances from the rear axis to the front most and rear most of the vehicle. (x f l , y f l ) represents the front-left vertex, (x f r , y f r ) represents the front-right vertex, (x rl , y rl ) represents the rear-left vertex, and (x rr , y rr ) represents the rear-right vertex. As shown in Figure 2, the vehicle moves laterally from y 0 to y target , the total lateral motion distance is H. At time t ϕ , the heading angle in the reference frame is ϕ. If a starting lateral position y 0 and a target lateral position y target in the reference frame is determined, the time t ϕ can be obtained based on the motion model.

The Constraint of Collision Avoidance with Obstacle
The vehicle should avoid collision with static and dynamic obstacles. In this paper, the safe distances for the cases of the lane-keep maneuver, the evasive maneuver, the lane-change maneuver and the lane-change abortion maneuver are studied. For the lateral motion, the evasive motion model in Section 2.2 is utilized.

The Case of Lane-Keep Maneuver
In this paper, the notion of Responsibility-Sensitive Safety (RSS) model [35] for lanekeep maneuver is utilized. If the driver is driving in the lane-keep mode and has no lane-change intention, the safe distances can be obtained for the vehicle following scenario, as shown in Figure 3. Assuming that the longitudinal velocities of the leading vehicle and the following vehicle at t 0 are v f and v r . The leading vehicle brakes at acceleration a f ,brake . The following vehicle drives with the acceleration a accel during the driver's reaction time t δ , then the following vehicle decelerates with the acceleration a r,brake until stop. During the whole process, the two vehicles should not collide. The safe longitudinal distance between the front-most point of the following vehicle and the rear-most point of the front vehicle at t 0 is obtained as follows.
In addition, to make sure that D sa f e, f ollow is greater than zero, v f follows the condition of v f ≤ v 2 r + 2v r t δ a accel . If a static obstacle is in front of the host vehicle, we can obtain the safe distance by setting the speed v f as zero.

The Case of Evasive Maneuver for Static Obstacle
Assuming that there exists a static obstacle in front of the host vehicle, as shown in Figure 4. The heading angle in the reference frame is ϕ, the lateral position is y(t 0 ), the chosen target lateral position is y target . There are three main steps for calculating the minimum longitudinal safe distance D sa f e,static for avoiding the front static obstacle.  Step I, given the longitudinal acceleration, the current and target lateral position in reference frame, the t ϕ and y 0 for lateral motion are obtained according to the evasive motion model described in Section 2.2. By sampling the starting lateral position y 0 of the evasive motion model, the t ϕ for each y 0 can be obtained using Equation (7). By comparing y(t ϕ ) (Equation (2c)) with the current lateral position y(t 0 ), the final y 0 is determined when |y(t 0 ) − y(t ϕ )| is less than an error threshold.
Step II, the time t c that the vehicle moves from current lateral position ( Figure 4a) to the critical lateral position (Figure 4b) is obtained. Assuming the host vehicle follows the evasive motion model, the critical position is defined as the lateral position when the rear-right vertex of the host vehicle just contacts the rear vertex of the convex bounding box of the static obstacle.
Step III, given the longitudinal acceleration a, the longitudinal safe distance for the current lateral position is calculated. Since the time for lateral motion is equal to the time for longitudinal motion, the longitudinal safe distance can be obtained based on the time t c of lateral motion.
where v M (0) is the current speed of the host vehicle, ε is a constant that compensates for the distance error of the motion model.

The Case of Lane-Change Maneuver
In [9], the longitudinal safe distance to start a lane-change maneuver is derived. However, the longitudinal safe distance during a lane change maneuver is not derived. Inspired by [9], the safe distance during the lane-change process and the lane-change abortion process have been discussed in our previous work [36]. In this paper, the prediction uncertainty is considered to obtain the safe distance for lane change. A lane-change scenario is shown in Figure 5  If considering the uncertainty of prediction, the occupancy area of traffic participants at each prediction step can be obtained. The constant acceleration lane keeping (CALK) model [37] can be used to represent the motion of lane-keep considering uncertainty.
where w as ∼ N(0, σ 2 as ), w an ∼ N(0, σ 2 an ). Since the vehicle is in lane keeping mode, the lateral position is bounded in the lane.
The critical situation for calculating the longitudinal safe distance considering uncertainty is defined as Figure 6. The vertex of the host vehicle just touches the vertex of the occupancy set of the traffic participant. The time it takes for the host vehicle to move from the current lateral position to the lateral position defined in Figure 6 can be obtained according to Section 2.2. First of all, we calculate the time to arrive at the lateral position defined in Figure 6. Then, the longitudinal safe distance for each vehicle is obtained based on the time to arrive at the critical time. The minimum longitudinal safe distance D Fd,s , D Ld,s , D F0,s , D L0,s for vehicles F d , L d , F 0 , L 0 during the process of the lane-change maneuver can be derived as Equation (11).
where t c,Fd , t c,Ld , t c,F0 , t c,L0 are the time it takes for the host vehicle to move from current state to the defined critical lateral position in Figure 6. a M is the acceleration of the host vehicle, a Fd , a Ld , a F0 , a L0 are the accelerations of the vehicles F d , L d , F 0 , L 0 . By Substituting the motion model in Equation (10) into Equation (11), the minimum safe distances during the lane change process considering prediction uncertainty are obtained.
If the host vehicle is preparing for lane-change or is under the lane-change process, s min is the minimum safe longitudinal position, s max is the maximum safe longitudinal position, shown as the shadowed red vehicles in Figure 7. The safe longitudinal position s should satisfy the constraint s min ≤ s ≤ s max . If the host vehicle starts lateral motion at s max , it will arrive at the critical position with the front vehicle L 0 or the front vehicle L d , as shown in Figure 6b,d. If the host vehicle starts lateral motion at s min , it will arrive at the critical position with the rear vehicle F 0 or the rear vehicle F d , as shown in Figure 6a x min,sa f e = max(s F0 + D F0,s , s Fd + D Fd,s )    In the second case, at time t 1 , the left lane-change abortion scenario in Figure 8b is the same as a right lane-change scenario. Considering the uncertainty of prediction, the defined critical lateral position for a right lane-change maneuver is shown in Figure 9.
where, t 1 is the time it takes to adjust the lateral velocity to zero, t c,x is the time it takes to move laterally from the lateral position y(t 1 ) to the lateral position defined in Figure 9. a Ld , a Fd , a L0 , a F0 are the accelerations of vehicle L d ,  Figure 10. If the host vehicle cancels lane-change maneuver at s min , it will arrive at the critical position with rear vehicle F d or F 0 (shown in Figure 9b and Figure 9d). If the host vehicle cancels lane-change maneuver at s max , it will arrive at the critical position with front vehicle L d or L 0 (shown in Figure 9a,c).

The Driving Envelope for Candidate Driving Maneuvers
We propose a novel driving envelope, which is a collision-free area for the host vehicle.
Since the evasive motion model is used, the safe area during the entire phase of a lanechange maneuver can be obtained quickly. The constraints of the vehicle motion, the limit of steering of the driver, and avoiding collision with road boundary and obstacles are considered.

The Reachable-Set Considering Driver's Input
The reachable-set is a useful tool for human-in-the-loop systems to determine the boundary of executable trajectories [27]. For a system f , the system dynamic isẋ(t) = f (x(t), u(t)) under an allowable control signal u. Given an initial state x 0 , an input signal u(t), and the system dynamicsẋ(t) = f (x(t), u(t)), the reachable set R(t) is defined as the set of all states that can be reached from an initial set X 0 at time t.
Due to the constraint of the machinery steering structure, the curvature of the trajectory should not exceed the maximum boundary κ mech,max . To avoid severe sideslip, the curvature is limited by maximum lateral acceleration a lat,max .
Considering the driving characteristics, the steering maneuver should not be too hasty, and the path curvature should changes smoothly.
where k rate represents the change rate of curvature as the trajectory length increases, κ 0 represents the initial curvature, and it is influenced by the front wheel angle. s represents the arc length of the trajectory.
If the vehicle moves at constant acceleration a, then the length s can be calculated by the uniform acceleration motion formula.
The curvature and the change rate of curvature are limited in a reasonable range, κ ∈ [−κ max , κ max ], k rate ∈ [−κ rate,max , κ rate,max ]. By discretizing the curvature rate k rate , the executable trajectory range of the vehicle in the finite time domain can be obtained, as shown in Figure 11.

The Driving Envelope with Road Constraint and Steering Limitation
Given the initial state and the maximum curvature rate k rate,max of the vehicle, the reachable-set can be obtained shown as the orange area within the dashed lines in Figure 12. This reachable set considers the initial vehicle states, driver's input, and steering limitation. However, avoiding collision with the lane boundary has not been considered. The evasive motion model can guarantee safe motion avoiding collision with obstacles and lane boundaries. However, the initial steering angle and steering limitation are not considered. We combine the evasive motion model and the boundary of reachable-set to overcome the disadvantages. Considering the road boundary constraint, we set aside a safe distance ∆y to the road boundary to get the target lateral position. By utilizing the evasive motion model in Section 2.2, a path arriving at the target lateral position can be obtained. We connect the boundary of the reachable-set (Section 3.1) and the path following the evasive motion model to obtain the boundary paths of driving envelope, denoted as τ outside,le f t and τ outside,right in Figure 12. On the connection point, the curvatures of the two paths are equal, so that the continuity of curvature at the connection point could be guaranteed. The τ outside,le f t and τ outside,right can be treated as the boundary path of driving envelope considering the constraints of lane boundary and steering limitation. The green area R s between τ outside,le f t and τ outside,right is the driving envelope considering road boundary. No safe trajectory exists when τ outside,le f t and τ outside,right partly coincides with each other.

The Driving Envelope Considering Collision Avoidance with Obstacles
Given the initial vehicle state, the longitudinal acceleration a lon , the maximum lateral acceleration a lat,max and the target lateral position y target , the minimum longitudinal safe distances for avoiding static obstacle and dynamic vehicles have been deduced in Section 2.3. Figure 13, the path τ outside represents the boundary path of the driving envelope to arrive at the outermost safe lateral position, discussed in Section 3.2. Path τ evasive represents the boundary path of the evasive maneuver to arrive at the innermost left lateral safe position. If the longitudinal position of the host vehicle is in range [x min,sa f e , x max,sa f e ], we can get the trajectory τ evasive which follows the evasive motion model, choosing the innermost safe lateral position as the target lateral position, and reaching the critical position defined in Section 2.3. If a dynamic front vehicle is driving forward, the extreme situation is defined as 13b,c,d. The τ evasive is considered as the most extreme trajectory that avoids collision with obstacles. The area R s under the constraint of steering limitation and road boundary has been obtained in Section 3.2. If no safe trajectory exists which meets both obstacle avoidance safety constraints and the steering limitation, the driving envelope does not exist. The driving envelope for evasive maneuver of a static obstacle is shown in Figure 13a. The driving envelope for lane-change maneuver is shown in Figure 13b,c. The driving envelope for lane-change abortion is shown in Figure 13d, the boundary path τ evasive is composed of three parts, adjusting the lateral velocity to zero, following the direction of road, then performing evasive maneuver to arrive at the critical position.

Intervention Time
The proposed driving envelope can be utilized to determine the intervention time for semi-autonomous vehicles. The collision probability is used to determine the intervention time in [20]. The collision probability is computed by randomly generating N particles and computing the number of particles that collide with the traffic participants. Inspired by their work, we determine the intervention time for a human-in-the-loop shared driving system by calculating the probability of violating the safe driving envelope, We predict the future occupancy set of the host vehicle at each time step by randomly generating N particles based on the driver's input and vehicle state. The Constant Turn Rate and Acceleration (CTRA) kinematics motion model [38,39] is used to predict the state of the host vehicle in a short prediction horizon. By adding uncertainty to the control input, the possible occupancy set of each time step can be obtained. For example, the generated particles at 1.5 s are shown in Figure 14. The driving envelope is generated considering the prediction time horizon. If one particle is outside of the generated driving envelope, then it can be treated as an unsafe state. The greater the probability of locating outside the driving envelope at a future time step, the greater the probability of arriving at an unsafe state. The probability of locating outside the driving envelope at each time step can be obtained by counting how many particles are outside of the driving envelope. 20) where N is the total number of generated particles, N outside is the number of particles distributed outside of the driving envelope. As shown in the Figure 14, the boundary paths of the proposed driving envelope are τ 1 and τ 2 . If the lane is not straight, we convert the discrete points on boundary paths of the driving envelope from the reference frame into the cartesian coordinate, and connect the discrete points into line segments. Whether the point exceeds the safety zone is determined by judging which side of the line the point is on, as shown in Figure 15. When p outside at a future prediction time step reaches a predefined threshold, the shared driving system can provide warning or intervention. An advantage of this method is that it can guarantee the exist of collision avoidance trajectories when the system intervenes, and the system will not intervene too early.

Motion Planning
The driving envelope can be utilized in motion planning. The polynomial method is used to generate trajectories with kinematic constraints. Each trajectory is evaluated according to a cost function, which is designed considering the cost of path smoothness, safe distance to obstacles, etc [4,40]. The proposed driving envelope has been combined with the polynomial methods to generate a set of trajectories in our previous work [41]. The fifth-order polynomial for the lateral motion and the longitudinal motion in a reference frame is used to generate the trajectories.
The coefficients c i (i = 0, 1, ...5) and a i (i = 0, 1, ...5) can be obtained according to the initial and terminal states in the reference frame. The points on each trajectory is generated according to Equation (21). When the sampling time is determined and the vehicle moves at a high speed, the distance between the generated points may be too far away for checking collision with obstacles, as shown in Figure 16. This problem can be avoided by decreasing sampling time, but the cost for generating the trajectories will increase. If the safe driving envelope is generated according to the obstacles, and trajectories are generated in the driving envelope, this problem will be solved. An important parameter in the polynomial methods is the total time T used to move from the initial state to the terminal state. For each trajectory, the each component is generated by sampling the time t in total T. Generally, the T is also sampled, the invalid trajectories are deleted if the trajectories violate kinematic constraints, or collide with obstacles. Collision checking is time-consuming, which influence the computational efficiency of the polynomial methods [42]. In the worst case, collision check with every traffic participant and obstacle during all prediction horizon for each trajectory is needed. In the proposed driving envelope, the kinematic constraints and collision avoidance are already considered. By using the driving envelope, the time for collision check and constraint check will be reduced. In this paper, the motion model in Section 2.2 can be used to get the range of time T ∈ [T min , T max ] for generating trajectories.
where t max is the predefined maximum time for T, E is a constant for tuning time T. Given the longitudinal velocity profile and the longitudinal distance d bound from the current position to the boundary path of the driving envelope, t bound is the time for longitudinal motion to arrive at the boundary path of the driving envelope. t arrive is the time to move laterally to the target lateral position.
According to the relationship of the heading angle in reference frame and the target lateral position, there are three cases of calculating t arrive , as shown in Figure 17.
(1) Case I, the host vehicle is under the process of driving towards the target lateral position, and the host vehicle faces the direction of the target lateral position, as shown in Figure 17a. Given the current state in the reference frame, we can obtain the total time t lat of lateral motion and the time t ϕ , which has been discussed in Section 2.3.2. The remaining time to finish the lateral motion is t arrive = t lat − t ϕ .
(2) Case II, the host vehicle is under the process of driving away from the target lateral position, and the heading of the host vehicle faces the opposite direction of the target lateral position, as shown in Figure 17b. This case is similar to lane-change abortion maneuver discussed in Section 2.3.4. The evasive trajectory can be divided into two parts, τ adj and τ eva . In the first part τ adj , we assume that the vehicle moves at a constant lateral acceleration a lat,adj . The used time to adjust the lateral speed in the reference frame is t 1 = v lat /a lat,adj . In the second part, we assume that the trajectory follows the motion model in Equation (2). The H can be obtained, thus we can get the time t lat using Equation (4). The total time to finish the lateral motion is t arrive = t lat + t 1 .
(3) Case III, the host vehicle is preparing for an evasive maneuver and has not started lateral motion, as shown in Figure 17c and Figure 17d. We assume that the trajectory follows the evasive motion model in Equation (2). Given the starting and target lateral position, the total lateral distance H can be obtained, thus we can get the time t lat to arrive at the target lateral position using Equation (4), t arrive = t lat . After the range of parameter T is determined, the trajectories can be generated. The trajectories can be evaluated according to a cost function to obtain the suboptimal trajectory. The cost function is designed considering the smoothness of the trajectory, the distance to obstacles, the stability, etc. We have utilized the trajectory generation and evaluation method in a semi-autonomous driving system [41]. One advantage of the method is that the range of parameter T is determined, the motion planner can generate fewer trajectories. Another advantage of the method is that with the help of the driving envelope, the problem of missing collision checking with obstacles shown in Figure 16 can be solved.

Experiments
(1). The Longitudinal Distance Error of the Evasive Motion Model The evasive motion mentioned in Section 2.2 is decomposed into lateral motion and longitudinal motion. To obtain the applicable scope of the evasive motion model, the longitudinal distance errors at different constant speeds have been calculated. We set H as 3.5 m, and t lat as 5 s. The maximum lateral velocity can be obtained, which is about 1.4 m/s, so the velocity should be higher than 1.4 m/s. As shown in Figure 18a, when the vehicle moves at a constant speed, the longitudinal distance error decreases as the velocity increase. When velocity equals 2 m/s, the distance error is about 1 m. As shown in Figure 18b, the minimum speed is set 2 m/s, when the vehicle moves at a constant longitudinal acceleration, the distance errors at different initial longitudinal speeds and accelerations are calculated. When the longitudinal speed is higher than 2 m/s, the longitudinal distance errors are lower than 1 m, and the longitudinal distance error decreases as the speed increases. As is shown in Figure 19, the red bounding box represents the host vehicle, the green bounding box represents the vehicle L 0 . The red solid line represents the safe positions at the different lateral positions with the minimum safe distance proposed in Section 2.3, the maximum acceleration of the evasive model in Equation (2) is set as 0.9 m/s 2 . The proposed method can reflect the influence of the lateral motion on the safety distance. The closer the vehicle is to the right lane marking, the farther the safe distance is required for the evasive maneuver. The vertical black dashed line represents the safe positions determined by TTC, the TTC threshold is set as 4 s. The TTC is obtained by dividing the relative distance by the relative speed. As shown in the figure, the TTC method cannot reflect the influence of the lateral motion. The green solid line represents the safe positions determined by the constant lateral acceleration motion model in [6], the constant lateral acceleration is set as 0.9 m/s 2 . The shape of the green solid line is similar to the proposed method in this paper. However, the method in [6] is only used to calculate the safe distance to the front obstacles, the rear dynamic obstacles are not considered. In this paper, the distance to the rear dynamic obstacles can also be calculated.
(  Figure 20, we can see that the driving envelope considers not only the safe distance to obstacles, but also the input of the driver. The driving can reflect the safety margin in the future.
In a dynamic traffic scenario with four traffic participants F d , L d , F 0 and L 0 , the driving envelope for a lane-change maneuver and a lane-change abortion maneuver is obtained as shown in Figure 21. The red bounding box represents the host vehicle, the green bounding boxes represent the traffic participants F d , L d , F 0 and L 0 . The maximum lateral acceleration is set as 0.9 m/s 2 for evasive maneuver. When all vehicles are driving at 15 m/s, the driving envelope of continuing lane-change is shown in Figure 21a, the driving envelope of lane-change abortion maneuver is shown in Figure 21b. When the speed of vehicle L d is 5 m/s and other vehicles drive at 15 m/s, the safe distance constraint of lane change cannot be satisfied. Therefore, the driving envelope of continuing lane-change maneuver cannot be obtained. The safe distance constraint of lane-change abortion is satisfied, it's safe to cancel lane-change, and the driving envelope of lane-change abortion is shown in Figure 21c.
The simulation is carried out in C++ using Intel I7-3520 CPU. In the traffic scenario shown in Figure 21, the CPU runs at 2.9 GHz, the average total time used to calculate the safe distance and generate the driving envelope for each driving maneuver is about 1 ms. The drivable area in [24] is represented as connected collision free convex sets. Owing to the consumption of computational resource, the computation time is 75 ms for time horizon 3 s on a 2.6 GHz Core, which is not enough for lane change in dynamic traffic flow. For the driving envelope generation method in [43], lots of points are generated, and the safety regions are computed using a Hamilton-Jacobi approach. When there are 70 longitudinal sampling points and 8 lateral sampling points, the calculation time is 34 ms. The above methods are very time-consuming. In order to use the methods in real-time applications, the time horizon has to be reduced.
In the experiment scenarios, the average total time for driving envelope generation is about 1 ms. The boundary paths of the reachable-set are generated to reflect the influence of the driver's input and the steering limitation. The algorithm complexity of generating the boundary paths of the reachable-set is O(n). In order to restrict the driving envelope within the road boundary, the evasive path to avoid collision with the road boundary, and the boundary paths of reachable-set are connected, as shown in Figure 12. The algorithm complexity for this path generation part is O(n). The connection point is determined by searching the points on the two paths. The algorithm complexity for determining the connection point is O(nlog 2 n). The safe distances for collision avoidance with obstacles are calculated. The path representing the boundary path of the obstacle evasive maneuver is generated from the minimum safe distance to the obstacle, as shown in Figure 13. The algorithm complexity for calculating the safe distance and generating the evasive path with the minimum safe distance to the obstacle is O(n). Finally, the algorithm complexity of the driving envelope generation method is O(nlog 2 n).
(4). The Real Vehicle Experiment A modified Red Flag EHS3 based experimental platform was used to test the proposed driving envelope method. In the experimental driving scenario, a dummy was placed in the middle of the lane. A human drove the vehicle at about 20 km/h towards the dummy, as shown in Figure 22a. The driving envelope is used to determine the time for intervention and motion planning. The code is implemented in C++ using Intel I7-3520 CPU running at 3.3 GHz. The average total time used for calculating the safe distance and generating the driving envelope for both left side and right side evasive maneuver is about 1 ms. The generated driving envelope is shown in Figure 22b,c. As shown in Figure 22b,c, the interval between the marks on the longitudinal axis is 10 m; the gray parts represent obstacles detected by Lidar; the black part is the non-obstacle area; the dark blue line denotes the reference path. The driving envelope is generated in the reference frame based on the reference path. The yellow lines denote the boundary paths to arrive at the outermost safe target lateral position, the red lines denote the boundary paths to arrive at the innermost safe target lateral position. The green line indicates the predicted trajectory for the next 3 s using the constant angular velocity and constant acceleration motion model without considering uncertainty. Given the input and the state of the host vehicle, the feasibility of candidate evasive behavior can be identified quickly. At time t 1 shown in Figure 22b, the host vehicle can avoid collision from both the left side and the right side, and the driving envelopes for evasive maneuver from the both sides exist. At time t 2 , only the driving envelope for the left side evasive maneuver exists, as shown in Figure 22c. The distance for right side evasive maneuver is not enough, it is not safe to drive from the right side of the dummy after t 2 . When the probability of violating the driving envelope at the future time 1.5 s reaches 60 %, the semi-autonomous driving system intervenes. The generated trajectories and the suboptimal trajectories for the left-side and the right-side evasive maneuvers are shown in Figure 23. The yellow lines represent the generated trajectories, the red lines represent the selected trajectories for left-side and right-side evasive maneuvers. More detailed information on trajectory generation and evaluation methods are introduced in [41].

Conclusions
This paper introduced a novel driving envelope generation method for human-in-theloop driver assistance systems. The driving envelope can be utilized to determine the safety of candidate driving maneuvers in real-time. The driver's operation, the constraints of steering limitation, motion limitation, and collision avoidance are taken into consideration. The driving envelope can clarify the safe drivable area in the whole lateral evasive maneuver process. The efficiency of the proposed method is validated by simulation experiments and real vehicle tests. For the tested scenarios, the average total time to generate the driving envelope is about 1 ms. The driving envelope generation method proposed in this paper can be used in real-time applications. For future work, we will continue to study the method of combining decision-making and motion planning with the driving envelope.