Automated Driving: A Literature Review of the Take over Request in Conditional Automation

: In conditional automation (level 3), human drivers can hand over the Driving Dynamic Task (DDT) to the Automated Driving System (ADS) and only be ready to resume control in emergency situations, allowing them to be engaged in non-driving related tasks (NDRT) whilst the vehicle operates within its Operational Design Domain (ODD). Outside the ODD, a safe transition process from the ADS engaged mode to manual driving should be initiated by the system through the issue of an appropriate Take Over Request (TOR). In this case, the driver’s state plays a fundamental role, as a low attention level might increase driver reaction time to take over control of the vehicle. This paper summarizes and analyzes previously published works in the ﬁeld of conditional automation and the TOR process. It introduces the topic in the appropriate context describing as well a variety of concerns that are associated with the TOR. It also provides theoretical foundations on implemented designs, and report on concrete examples that are targeted towards designers and the general public. Moreover, it compiles guidelines and standards related to automation in driving and highlights the research gaps that need to be addressed in future research, discussing also approaches and limitations and providing conclusions.


Introduction
Vehicles with some degree of driving automation have been anticipated for decades. The series of automated actions that these vehicles perform to transport people or goods make it possible to define them as vehicular robots, since they move between two points without the intervention of humans [1,2].
However, the full automation that characterizes level 5 vehicles requires mastery of the many challenges that pertain to their development and introduction in the market, including the detection of other road users and the monitoring of driver behavior in case manual control needs to reinstated [3].
Even if the absence of human intervention in the control of autonomous vehicles (AV) increases road safety [4], the implementation of AV represents a complex multi-disciplinary problem that has not yet been totally solved. Hierarchical steps have been introduced to define the systems capabilities and address the role of the human and the system with regard to the control, environment monitoring, and fallback control depending on different levels of driving automation [5].
However, the most advanced vehicle functionality currently available on the market (AutoPilot from Tesla [6]) only corresponds to partial automation or level 2.
In conditional automation or level 3, human drivers are required to be ready to resume control in emergency situations, such as a system failure, if a Take Over Request (TOR) from the system has been triggered or where the circumstances exceed the Operational Design Domain (ODD) of the system. In this process, the perception and comprehension of the road and traffic environment information or situational awareness [7] play a fundamental role in deciding imminent actions.
When a TOR is issued, drivers need to deviate their attention from whatever tasks they are performing on the road. To this end, they must process the perceived information from the environment and react by activating the vehicle actuators to perform the dynamic driving task based on their understanding of the present situation. Figure 1 illustrates the process by depicting the components involved in a take over request. Before a TOR is triggered, both internal and external information about the driver's state and the driving situation should be gathered to guarantee a safe outcome. This is particularly important in take over processes that are required in emergency situations. Therefore, it is necessary to develop Driver Monitoring Systems (DMS) that are able to estimate the driver's physical and mental state and can correlate this information with the specific road situation. To this end, DMS collects baseline values of different driver state indicators, such as drivers gaze, pose, and physiological metrics, and calculate a deviation measure with respect to these values, which then allows them to determine the level of the driver's attention [8].
The National Transportation Safety Board (NTSB) promotes the use of DMS in response to system failures as for example the fatal AutoPilot Crash of the Uber car in 2018 [9]. Driver monitoring should assure appropriate driver engagement on all vehicles with at least a level of partial automation (level 2), as drivers are required to resume control at any time [5].
This work compounds and analyzes literature in the field of conditional automation or SAE level 3, focusing on the TOR, while emphasizing concerns, describing theoretical foundations on solution designs, and mentioning concrete examples, particularly highlighting areas in need of further research. It reviews the basic groundwork for an understanding of important human and environmental factors that influence the design and testing of the TOR. Furthermore, it provides referenced information to help practitioners improve systems that trigger TOR.
It is not the aim of this work to provide an exhaustive overview of all guidelines for all possible automated functions in the vehicle, but rather to review concepts and suggest a foundation for an understanding of some important factors that influence the design and testing of TOR systems. It focuses on the major achievements in the field, the main areas of debate, and outstanding research questions.
The next sections are distributed as follows: Section 2 gives an overview of the challenges that are related to the process of the take over request associated with level 3. Section 3 presents concepts that pertain to the design of systems to transfer vehicle control. Section 4 presents a summary of the main points covered in the previous sections. Section 5 highlights the theoretical foundations of solution designs, presents a selection of tested design concepts and findings, and gives concrete examples of how to apply these theories to specific designs. Section 6 outlines guidelines and standards related to specific features of automated driving mentioning as well policies and regulations. Finally, Section 7 recapitulates the main issues described in the paper, uncovers research gaps, and proposes new research questions for further work.

Conditional Automation Challenges and Complexity
The level 3 of automation is the next milestone in developing fully autonomous cars. However, there is an ongoing discussion about whether it is better to simply shift the focus to the development of systems with a level of automation 4 or higher [10]. Companies such as Ford and Toyota are currently developing systems with a level 4 of driving automation [11,12], leaving aside level 3. One of the main reasons for this decision relies on human factors, since level 3 systems must successfully return drivers that are inattentive to the Dynamic Driving Task (DDT) [13]. This interaction between system and driver depends to a large extent on the capabilities of each individual driver, which will be detailed in the sections below. Therefore, even a well-designed information transfer does not ensure that all drivers gain control of the vehicle within the time that is required to ensure road safety. Moreover, the uncertainty that pertains to level 3 regarding liability in case of an accident and the lack of regulatory measures and legal framework supports the decision of avoiding level 3.
According to the information presented so far, we summarize that regaining control of the vehicle after automation is a complex process that requires the driver to be aware of the specific emergency situation, the information provided by the system and at the same time to identify, process, and comprehend the current traffic conditions. Several factors contribute to this complexity and they are listed below.

•
The potential boredom and road monotony associated with higher levels of driving automation might lead to a reduction in driver situational awareness [14,15]. This hypovigilance needs to be taken into account when a vehicle control is expected from the driver [16].

•
The reaction time (RT) to a TOR after the driver has been involved in a non-driving related task (NDRT) does not return to its baseline performance level immediately after the distraction. This means that drivers can be distracted up to 27 s after finishing a highly distracting task and up to 15 s after interacting with a moderately distracting system [17], and secondary tasks may affect the driver even after a task/distraction phase has been completed [18].
According to the complexity classification in objective and subjective by the authors in [19], we have compiled the different factors that determine the complexity of the TOR in Table 1. We additionally describe several concrete examples.

Objective Complexity
Objective complexity or descriptive complexity [20] refers to the inherent properties of novel systems and therefore varies independently of the individuals to which the system is exposed [21]. According to this, there are factors in a TOR that depend not only on what people perceive, but also on objective situational characteristics that are independent of the observer.
The objective complexity of a TOR is determined by factors such as: • traffic density, • road conditions, • environmental conditions, • specific transfer system from automatic to manual driving We describe in the following sections how each of these factors affects the TOR process and the driver's ability to regain control of the driving task.

Traffic Density
Driving is a social activity that demands interaction with other road users and that varies according to the specific environment. Therefore, several works studied the influence of the traffic situation on the TOR, the results of which showed that complex traffic situations negatively affected the quality of the process. The dynamic state of the surrounding vehicles may prevent certain maneuvers from being carried out by the driver, such as a lane change maneuver in a situation of high traffic density. In this case, the number of braking maneuvers might increase.
Under high density traffic conditions, the time to collision was reduced, thereby increasing the probability of collision and augmenting the lateral acceleration of the vehicle [22,23] .
There is also a direct relationship between the time to regain the control of the vehicle and traffic density, with a high density of traffic implying a longer time to regain control (7 s in a situation with 10 to 20 vehicles per kilometer, according to [23]), which therefore presents an increase of collision risk [24].

Road Conditions
Another critical factor that affects TOR is road geometry, as it directly influences driving by imposing inherent speed and acceleration limits. The curvature of the road affects the driver's ability to maintain vehicle position in the center of the lane. At the same time, curvy roads obstruct the visibility of the road regarding upcoming vehicles. Therefore, emergency maneuvers are required in many cases where drivers enter curves at high speed [25].
Vehicles with a high degree of autonomy can adapt their speed to the curvature based on the control algorithms with which they are developed. However, in vehicles with a level 3 of autonomy, road curvature negatively influences TOR performance compared to straight roads by increasing driver reaction time and increasing lateral deviation [26]. Furthermore, road geometry influences driver deceleration patterns when they regain control of the vehicle, deceleration being more abrupt when entering a curve [27]. Furthermore, a relationship between the road conditions and the urgency of the TOR exists, with a longer time required for the driver to control the vehicle in straight lines if the urgency is low. However, in curves, the time that drivers need to control the vehicle is longer if the urgency is high [28].
As a consequence, road conditions play an important role in the design of TOR systems, and they should adhere to predictive algorithms to establish transition protocols. Such an approach would allow the driver to take over control of the vehicle while minimizing lateral deviation.

Control Transfer Systems
There is a time interval for the driver to take control of the vehicle safely after having received the TOR message. In this interval, the driver is required to follow a process of adaptation in the transition from a state of low situational awareness, to a higher one [29]. One of the biggest challenges is to create a system that conveys the message in a clear, explicit way, while at the same time allowing for the possibility of continued automated control of the vehicle in the event that the driver cannot take over [30]. To this end, during the mentioned interval, a shared control between the vehicle and the driver should be guaranteed.
Some approaches rely on guidance systems based on haptic devices that give feedback to the driver through the actuators of the vehicle. This guidance occurs when an action has been performed that differs from the maneuver that the automated system had selected. The use of haptic guidance reduces the cognitive workload of the driver.
Several works in the field developed and tested shared control policies. The studies showed that the use of these systems decreased the lateral error of the drivers, at the same time increasing comfort in the handling of the vehicles [31-33].
In the same context, further studies measured the situational awareness of the drivers by defining three levels of human participation that would determine the specific level of guidance of the vehicle, automated dominance being the lowest level and human dominance the highest level. Using simulations, the authors concluded that their guidance systems were capable of guiding driver collaboration with the automation systems and of resuming manual control safely and smoothly [34,35].

Subjective Complexity
Subjective complexity encompasses the factors that are affected by individual cognition adaptation processes of the driver and their influence on the response to a TOR. This includes the driver's state, such as vigilance, stress level, and cognitive load due to non-driving secondary tasks (NDST) [36]. Human Machine Interface (HMI) establishes the dialog with the driver in order to support the driver's decision-making process, keep their active supervision, and request their intervention. Moreover, automated driving interfaces that are easy to understand and use can create the level of trust required for the driver to feel that the vehicle is functioning correctly [3]. In line with this, adhering to the guidelines described in the work in [4], in the project TrustVehicle [37], different HMI were designed to promote trust by relying on adaptive and intuitive interfaces, measuring the driver state and identifying risky traffic conditions to prioritize information.
Accordingly, one of the most pressing current research questions is how can TOR methodologies take into account subjective complexity.
As previously mentioned in Section 1 and later in Section 3, current approaches rely principally on promoting driver vigilance with regard to the dynamic driving task when the automation system is active. The automated driving regulatory framework currently does not enable the ADS to perform the DDT without human inspection because the limited level 3 automation is extremely dangerous outside ODD limits. Therefore, the techniques oriented to preserve driver vigilance regarding the DDT are crucial for a safe TOR response, and they can make a cognitive reassignment much easier in case of need.
According to the issues exposed above, the two main aspects that subjective complexity covers are: • The assessment of the driver's readiness to intervene after a TOR.

•
The assessment of the appropriate interfaces used for interacting with the driver.
Each aspect is further detailed in the following sections.

Driver's Readiness Assessment
Different approaches enable the assessment of the driver's readiness to interact with the vehicle when a TOR has been issued.

•
Firstly, sensors located on the steering wheel are able to sense periodic interaction. However, the main downside of this approach is the compromised user experience or reduced joy of use [38] that the obtrusive system demands and therefore the high tendency to cheat the system, this being a consequence of overtrust.
To solve the cheating problem, an integrated indicator for interaction assessment such as an applied torque on the steering wheel can ensure a reliable detection of a real steering wheel interaction [34,35].

•
Secondly, an eyes-on-road approach is based on glance analysis in order to determine the regularity of vigilance. These driver glance models allow the assessment of cognitive engagement during the TOR process [39]. During the transition to manual driving after conducting a NDRT, the driver's pupil diameter, glance duration, and the glances to certain Area of Interest (AOI) are used to assess performance and gaze [40,41]. Here, it is crucial to address the need of measures to regulate the privacy issues that arise from the collection of data. It should be clear who will gain access to it, particularly when it concerns personal data.

•
Further studies include facial expression as an aspect for the assessment of TOR quality [42], whereby face changes might indicate an unfit condition for TOR attendance.

TOR Communication Interfaces
As depicted in Table 2, HMI can use different communication ways to transmit the TOR to the driver. Visual displays convey clear information that facilitates the understanding of the messages by the driver [27]. In the same context, auditory warning interfaces are complementary to visual displays. Studies such as [43] assessed how efficient generic warning tones compared to speech warnings were for conveying a TOR, concluding that speech messages improved the response time from the driver.
As for vibrotactile displays, the most relevant aspects of their functioning can be described using several dimensions according to [44].

•
Frequency and amplitude are static aspects, and they are more related with comfort concerns.

•
Location and timing can dynamically adjust, thus encoding different urgency levels.
Different configurations help to determine which set of these aspects have more influence in the transition from automated to manual driving. As a consequence, multimodal combinations that rely on the combination of auditory, visual, and tactile displays have demonstrated an improvement in the driver's perception of urgency [45].
Additional works refer to the trust in the systems that trigger a TOR and show that the response time to a TOR from drivers that had been previously familiarized with the system functioning was positively affected [46,47].
The next sections define the concepts related to TOR and summarize the established metrics that determine a good response from the side of the driver.

TOR Design Concepts
Several works have investigated the transition from automated mode to manual vehicle control, handling the TOR as a process that consists of successive stages that is triggered when the operational limit of the ADS has been reached [23, 48,49].
Vehicle sensors detect whether a need to trigger a TOR exists, and, in affirmative cases, the interaction with the driver occurs through the vehicle's HMI. Drivers, who might be engaged in NDRT, must completely shift their attention back to the road environment and immediately estimate the situation, to be able to regain control of the vehicle actuators in time. According to the authors in [50], this transfer of control can be considered as a task interruption handling process that involves several stages.
The TOR design concepts developed so far address not only how the TOR is issued and presented to the driver, but they also rely on high-level architectures based on vehicle metrics, situational factors, driver state evaluations. Figure 2 illustrates through an example a conceptual framework. In this framework, an ADS controls the vehicle dynamics to perform a DDT, while constantly monitoring the driver. Inside this ADS, a TOR system conveys information to the driver through a HMI depending on whether the ODD boundaries have been reached or an emergency situation has been detected. The information is then received by the driver, through their sensory system. Finally, the driver responds to the TOR through their psychomotor system according to their driver's state and cognitive capabilities.
A TOR can be modeled as a control switch between two systems and define boundaries that establish the security level based on the structure and components of the system [51]. In line with this, a structured catalog of recommendations for user-centered designs was compiled for systems that convey TORs within the AdaptiVe project [52]. The project included an arbitration model to regulate the interaction between the components of the system, namely vehicle, automation, and driver [53]. In contrast to this approach, the work in [35] proposes a TOR system that operates as a shared control model that continuously evaluates driver situational awareness before giving complete control to the driver. To this end, a DMS relies on the driver's physical responses and environment perception to estimate their cognitive state [16,54].
After detecting an upcoming TOR, an HMI conveys a timely message to the driver. The interaction needs to be dynamic depending on the urgency of the request, the message being in a prominent location within the vehicle [4,55] to attract the driver's attention. The way of conveying the message can be classified as follows: • Visual: In a visual HMI, the system relies on images that can either be explicit [56] or using icons [24]. Modern visual HMI can also rely on a vehicle's ambient lights systems to attract driver attention continuously but unobtrusively through a peripheral vision stimulus that is processed subconsciously [38]. This strategy has been proved to create a balanced level of automation and cognitive workload. • Auditory: Regarding auditory signals, HMIs tend to rely on acoustic sounds at different frequencies to convey urgency signals to the driver [57], although there is ongoing research that shows that additional explicit information beyond auditory signals is needed to achieve necessary driver situational awareness [55,58].

•
Haptic: Haptic interaction relies on kinesthetic communication to convey information to drivers through tactors that can be located either on the seat or the seat belt [45]. To provide designers and practitioners with an overview of the different ways to convey TOR-related information, we show in Table 2 the HMI modalities that have been investigated in several research studies. The advantages and disadvantages are outlined and sourced from the literature by analyzing the references where the different modalities were used.  The ideal concept to convey a TOR in level 3 automation is still a pressing issue that needs further research. Several studies agree that multimodal messages consisting of a combination between acoustic sounds, images, and vibrotactile messages are more effective in TOR situations [36,60], but there are still many open questions about how this should be achieved and which is the message that has to be conveyed. To this end, several works have investigated information prioritization and functionality clustering for different modules in Driver Information Systems (DIS) and Advanced Driver Assistance Systems (ADAS) [41,[84][85][86][87] to ascertain where the increasing amount of vehicle information should be located within the vehicle to reduce the drivers' eye time off the road when looking for it. To illustrate several design concepts, Figure 3 shows HMI examples that have been implemented in TOR related studies.

Driver
In addition to the design approaches described so far, we argue that, from a system perspective and the design of the take over, an intuitive support that enables an automated mode disengagement to return to manual mode should be provided. In addition, an instantaneous take back of control performed intentionally by the driver is necessary. For this, two points need to be considered.

1.
First, to filter the actions from the driver that might lead to a disengagement of the system unintentionally, such as touching the steering wheel accidentally.

2.
Second, to secure the transition pressing the pedals should not be sufficient to disengage the lateral control until the driver has recovered the control of the steering wheel.

Take Home Messages and Recommendations
This section presents a summary of the main points covered so far.
• Automation level 3 is the next milestone in developing fully autonomous cars. However, there is an ongoing discussion whether it is better to skip this level and give more attention to the development of systems with driving automation above level 3.
• TOR design concepts rely on high-level architectures that are based on vehicle metrics, situational factors, and driver parameters evaluations. • Conditional automation (level 3) automation enables out-of-the-loop states during which drivers do not need to be aware of the driving functions or roadway conditions while the vehicle operates in its ODD. However, human drivers are required to be ready to resume control in emergency situations or when the system has reached its ODD boundary [5].

•
The lack of human intervention in the control of autonomous vehicles might increase road safety.

•
An HMI conveys timely information to the driver with a dynamic message located in a prominent location in the vehicle to attract the driver's attention.

•
The most common approaches to issuing a TOR rely on visual, auditory and haptic information.

•
The complexity of a TOR is increased due to the boredom and road monotony associated with higher automatism in vehicles, which leads to a reduction in driver situational awareness.

•
The reaction time to a TOR does not return to its baseline performance level immediately after being involved in some NDRT.

•
Complex traffic situations increase the probability of collision.

•
A high density of traffic results in a shorter time to regain vehicle control. • TOR performance is negatively affected by road geometry; road curves increase driver reaction time, lateral deviation, and cause abrupt deceleration after control of the vehicle is regained. • A longer time is required for the driver to control the vehicle in straight lines if the urgency is low.

•
The time that drivers need to control the vehicle in curves is longer if the urgency is high. • Shared control mechanisms between the vehicle and the driver decrease the lateral error of the driver and increase fluidity of vehicle operation. • TOR guidance systems support drivers in resuming manual control safely and smoothly.

•
Driver state, such as vigilance level, stress level, and cognitive load affect the response to a TOR. • Factors such as the driver's readiness to intervene (through sensors and/or eye/facial detection and tracking), as well as the interfaces used for TOR determine the subjective complexity of the system. • Auditory, visual, and vibrotactile and multimodal displays maximize the TOR execution quality depending on the defined urgency levels.

•
Actions from the driver that might lead to a disengagement of the system unintentionally should be considered.

•
Lateral control should only be disengaged when the driver has recovered the control of the steering wheel.

•
The use of haptic guidance reduces the cognitive workload of the driver. Thus, its implementation in the TOR serves as support for drivers to adapt to the current situation. • From a system perspective and the design of the take over, an intuitive support that enables a smooth transfer from automated to manual mode should be provided.

•
Familiarity with autonomy in vehicles is directly connected to trust: when repeatedly proven to function properly, these technologies can build trust and thereby support the use of more complex automated driving tasks.

Theoretical Foundations on Take over Assessment Metrics
This section provides the theoretical foundations behind the TOR concept, referring as well to the metrics used to measure the quality of the process. It outlines its complexity, as already mentioned in Section 2, relying on the classification introduced in [72]. Concrete examples of how to apply these theories to specific designs are also provided.
To improve the performance of the transition from autonomous to manual control, it is necessary to determine the metrics that measure the quality of the action. We briefly introduce these factors in this section, as they are crucial to establish the relationship between a triggered TOR and driver's response.
The correct, complete execution of the TOR in performing a certain maneuver is the most intuitive parameter that measures performance. For example, the actual and successful avoiding of an obstacle collision, either by braking or by performing a lane change.
Driver situational awareness, as mentioned already in different sections, is crucial in the process, since it defines the perception and understanding of humans and allows them to project the future actions necessary to adapt to a dynamic environment [7,58]. Additional parameters to measure TOR are cognitive workload, trust, comfort, and the issue-and reaction times to the TOR, as described in Section 2.
The most commonly used metrics in driving performance studies to measure the quality of the take over are speed metrics. This is a straightforward regulating or monitoring driving performance metric that determines the speed-reducing effects of a specific event [88]. In many cases, the TOR represents an actual event that will cause a braking reaction. Additional driving performance assessment methods and metrics relate to lateral and longitudinal metrics as originally defined in [89] and time to collision. They have been used in TOR-related experiments that investigate different modalities to convey messages such as in [63].
The quality of performance of the transition from automated to manual control also depends on the controllability of the situation by the driver. Related to this, different naturalistic driving data recorded on video, such as longitudinal/lateral control of the vehicle, lane choices, braking response, system operation, and driver facial expressions, could be integrated into a global measure of controllability or rating system, in order to assess TOR situations [42].
Despite previous efforts, there are currently no developed standards for the assessment of the take over, since current solutions lack maturity and are not yet utilized. For example, the exact moment at which a TOR is triggered, the take over time (TOT) as well as the moment at which the take over occurs are decisive in determining the functioning and performance of the system. The section below describes in detail these metrics.

Take Over-Related Definitions
As previously mentioned, the dynamic TOR process is triggered in emergency situations or in situations where the ODD boundary is predicted to be reached. As a consequence, the transition time of vehicle control from automated to manual driving mode, the so-called handover phase, is critical as a sufficiently comfortable transition time is necessary to guarantee road safety [55,90].
Accordingly, the authors in [30] define the Take Over Time (TOT) as the time interval from when the TOR is issued until the driver has successfully taken control of the vehicle and resumed the DDT.
Related to this is the Take Over Reaction Time (TOrt) or the time needed to return control of the vehicle to the human driver [91]. This definition has been later used in different works (e.g., [59]) in combination with the lead-time from a TOR to a critical event (TORlt) to determine the time it takes drivers to resume control from conditional automation in noncritical scenarios. In line with other works, it was concluded that drivers occupied by a secondary task exhibited larger variance and slower responses to requests to resume control [59].
In an additional work, the impact of different TORlt on drivers was studied, the authors concluding that 7 s are required to regain control of the vehicle [24]. While some authors argued that TOrt should be between 2 and 3.5 s [59] (see also [92] for an exhaustive analysis of the related literature), other studies such as [64,93] showed that participants needed less than 1 s to take the wheel.
The TORlt must give the drivers a sufficient time budget to adapt to the current situation [94], but also not be too long, as in some instances it could confuse the drivers due to the lack of an imminent emergency [74,75]. On the other hand, some drivers might check the mirrors or adjust their seating position before taking control of the vehicle [92].
There is no consensus in the literature regarding the exact moment at which the take over occurs (which is used to measure TOrt, but it is not the TOrt). It can be defined as the moment in which the driver first glances back to the road [24]; the time at which the driver begins to brake [57]; the moment the driver's hands move towards the steering wheel [95] or the moment the driver actually touches the steering wheel [93]. The TOrt is a complex parameter that not only depends on the intrinsic ability of the driver to react to sudden events, but also on the situation in which the TOR is issued.
As described in this section, driver reaction time depends on the complexity of the situation, which is determined by factors such as NDRT, as well as the specific definition of how to determine the time. Thus, the reaction times in the literature vary a lot depending on the specific study.
As a consequence, common standard definitions and guidelines are needed to accurately investigate the TOR. To this end, further studies such as those of [49,96] focused on modeling the TOR in order to predict the reaction time of drivers, depending on the characteristics and complexity of each situation.
In order to provide the reader with an overview or the most representative findings regarding the assessment of the take over, Table 3 shows the times to react to a TOR depending on the modality used to convey the message and the type of action that determined that the control handover was successful.

Take Home Messages and Recommendations
We present here a recapitulation of the main points covered in the section. As it has been described above, complex situations and road conditions play an important role in the design of TOR systems and should therefore be taken into account.

•
The most commonly used metrics to determine the performance of a TOR are driving performance metrics such as longitudinal/lateral control, speed, brake, time to collision, and driver physical state.

•
Currently, there are no developed standards for rating systems that assess TOR situations.

•
The vehicle control transition time from automated to manual driving modus, the so-called handover phase, is critical, as a sufficiently comfortable transition time is necessary to guarantee road safety.
Predictive algorithms to establish transition protocols would allow the driver to take over control of the vehicle while minimizing the lateral deviation of the drivers.
Common standard definitions and guidelines are needed to accurately investigate TOR situations. Additionally, more research is needed to predict the reaction time of drivers as it relates to the characteristics and complexity of each situation.
To guarantee a safe outcome, autonomous vehicles will need to leverage road user and passenger safety and other factors including the detection of obstacles along with weather and road conditions [3].
The next sections outline guidelines, standards, and regulations related to automation, summarize the main issues described in this work, and also propose further work.

Standards, Guidelines, Policies, and Regulations
Currently, vehicles with high levels of automation are still under development and are not mature enough to be launched into the market. For example, the Autopilot from Tesla [6] is marketed as a level 2. A level 3 system, the Vision iNext, is currently been developed by BMW [114]. Mercedes-Benz, in association with Daimler, is developing a level 3 concept called Drive Motion [115] as well. Table A1 from Appendix A lists a variety of systems that are provided with automation that are currently being developed by the automotive industry.
Audi intended to commercialize vehicles with limited level 3 capabilities, such as the Audi A8 with its traffic jam pilot system [116], but the project was dropped due the lack of a legal framework to certify level 3 automation features [117]. The goal was to operate within a ODD that was restricted to traffic jams, in which the automation controlled the vehicle at a limited speed, making it possible for the driver to perform NDRT. Although this system has been tested, most countries' regulations prohibit the use of vehicles with driving automation above level 2 systems on roadways. Current regulations demand that drivers are attentive to the road at every moment, prohibiting the execution of tasks other than driving. An example of these regulations is described in [118] for Austria.
Achieving widespread use of driving automation above level 2 is not only being pursued by the automobile industry, but also by other organizations such as the European Union (EU), which recognizes the societal impact that the new technologies might have regarding improved traffic efficiency and reduced emissions and energy consumption [119].
These technologies have the potential to improve traffic flow and road safety as well as create new job opportunities, making related industries more competitive in offering new products in a variety of sectors such as transport convenience stores, fleet, and insurance companies, etc. [120]. Therefore, the EU encourages the investment in automation innovation and promotes the development of autonomous systems through a variety of research calls. A selection of funded research projects related to automated and connected vehicles has been compiled in Table A2.
Nowadays, governmental associations such as the National Highway Traffic Safety Administration (NHTSA) in the United States or the Mobility and Transport branch of the European Commission investigate and issue the future challenges and legislation about driving automation systems in the matter of road safety. Original Equipment Manufacturers (OEMs) and academic researchers contribute to the regulations with their know-how and experience, which is included and represented in the standards and legal framework defined by these regulatory organisms. For example, an extended taxonomy of terms regarding TOR was compiled in [121], covering also its different related scopes such as legislation, insurance industry, as well as technical concepts regarding stakeholders that are interested in this complex process.
To help practitioners improve systems with several levels of automation, we have compiled referenced information that might be useful when considering the design of TOR. We include a selection of standards, guidelines, and European regulations to support the development process of new automation features in Table A3, extending the list with ISO, SAE, IEEE, and ETSI standards that define the characteristics, limits, terminology, technical aspects, and evaluation procedures of automation systems in Table A4.

Research Gaps and Conclusions
After having identified in this work the major achievements in the field and the main challenges and research questions, some research gaps that could improve the TOR process were found. This section will discuss open research steps in the TOR field.

TOR Models
TOR needs to be modeled as a system that consists of the sub-processes that have been introduced in this paper. Works such as those of [30,34,35,51] show the first steps that are required to develop TOR systems. However, in order to cover all the issues that are related to TOR, these models need to be extended. Although previous literature has in great measure formalized the characteristics of the TOR process, validations based on comparisons with naturalistic driving data from field tests using statistical analyses are missing.
Future work should be performed to classify situations in which a TOR is triggered in order to estimate the driver's ability to regain control of the vehicle. For example, predictive models could be developed to determine the type of NDRT, and based on this establish the type of message to transmit to the driver, its urgency, and the suggested driving maneuver.

Vehicle-Driver Cooperation
As mentioned in this work, system information and driver state integration allow for a smooth transition from ADS to manual driving. To this end, TOR-specific driver-system cooperation policies are required. Most of the current literature focuses on the factors that influence driver's response to a TOR, lacking these studies' solutions that address information on shared control policies. The existing works address a driver-system cooperation to perform the DDT assuming that the driver's attention is on the road [122]. Therefore, it is fundamental to consider cooperation in further situations, in which the driver performs NDRT.

Real World Tests
Due to current regulations, the lack of certified systems for road use, and driver safety concerns, most of the studies mentioned in this paper are based on driving simulations with different levels of realism. The use of simulations represents one of the most critical limitations in studying human factors in autonomous vehicles since drivers tend to behave differently in real vehicles and less controlled environments. There are studies such as [93], which use a real platform to determine driver reaction time. However, such works are very limited and a detailed study with a big sample of data needs to be performed to investigate all the different factors that affect TOR in a real road environment.

Additional Factors That Require Further Study
To the best of our knowledge, the study of the relationship between TOR performance and factors such as gender, age, health, road, and weather conditions, number of passengers, or previous knowledge of the driver regarding automated functions is still limited and needs more research.
Additionally, more studies should assess the relationship between physiological measures such as heart rate, eye pupil dilatation, or brain waves and driver behavior under TOR conditions. The establishment of the related relationships would allow the development of models that can predict driver reactions before a fallback. Therefore, there is a growing need for vehicle data sets and driver metrics that could help the research community to train and validate models that consider a TOR.
Additional research gaps that have been identified in this work concern situations in which potential hazards are outside the Field of View of the driver (FOV): • Should a TOR be triggered in situations in which potential hazards are outside the driver's FOV? • How should the warnings be conveyed in this case and would these warnings impact driver behavior even without the driver being able to confirm the threat visually?
An additional concern that could be investigated is how to reduce annoyance and maximize safety benefits. For example, could the measurement of stress levels help determine a better moment to trigger the TOR, i.e., produce a TOR at the most convenient moment given the situation?
Finally, we would like to emphasize the fact that, despite the guidelines and standards mentioned in Section 6, there is a lack of specific standards for TOR. Most of the presented guidelines and recommendations refer to how the TOR should be performed without considering the time to issue and to understand the TOR, the specific road situation, and/or the driver's individual characteristics. Therefore, it is imperative to create standards that are based on the factors that affect TOR, systematically establishing the requirements that must be met to deliver safe control of the vehicle to the driver. Furthermore, these standards must stipulate quantifiable quality measures in TOR that must be met by ADS with level 3.

Conflicts of Interest:
The authors declare no conflict of interest. The first series vehicle not only maintains speed and the distance to the vehicle in front fully automatically, but also changes lanes automatically by overtaking. However, so far, no Audi A8 has been delivered with the corresponding software enabled. The reason is the lack of a legal basis. After an initial euphoria, even in politics, there are still no regulations on the use of automated driving functions in public road traffic.

BMW Vision iNext, level 3 Highway
The vehicle featured two type of modes: -Boost mode: The driver can retain the traditional controls and drive the vehicle.
-Ease mode: The driver can activate the automated driving system and take their eyes off the road to focus on other activities.
First system on US roads to utilize conditional automation according to SAE standards.

Mercedes Benz
Drive Pilot, Intelligent Drive & Highway pilot level 3 Highway The readiness from the driver to take over is continuously monitored. When drivers are requested to take over, the system control is maintained until the take over maneuver and the request time are finished, and the failure mitigation strategy is triggered. Very limited to the geographical areas and working conditions like weather, traffic, lighting and road types.  First connected autonomous prototype, which is close to series production. The vehicle is equipped with an automated Valet Parking System which will allow cars to self-park and be able to be summoned to a location on demand using V2X and 5G systems. Geely Auto Group collaborated with the Ningbo government to establish an autonomous drive test zone in the Hangzhou Bay and transform the district into a smart city.

Project Partners Scope Duration
HAVEit [56] -Continental Automotive GmbH -Efkon AG -Allemann Technologies Sàrl -Volkswagen AG -Stuttgart University Further partners [56] Improving traffic safety and efficiency by the development and validation of ADAS, focusing on the interaction between driver and automated vehicles. The project included the direct and indirect monitoring of the driver to measure the level of attention and optimize the system's feedback strategy February 2008-July 2011 Table A2. Cont.

Project Partners Scope Duration
AdaptIVe [52] -Volkswagen AG -Continental Automotive GmbH -Volvo Technology AB -Robert Bosh GmbH -Daimler AG Further partners [52] Developing automated driving functions that are able to adapt to situation and driver status. This project focused on the study of autonomous driving under situations such as close-distance maneuvers on highway and structured and unstructured urban environment, addressing as well the research of driver-system interactions. Aims the advance of Level 3 Automated Driving functions in adverse and non-adverse conditions. This project seeks to provide solutions that increase automation reliability and trustworthiness following a driver centric approach. Developing software architecture frameworks to help big data developers to distribute data analytics workload along the compute continuum (from edge to cloud). These frameworks integrate the use of big data in critical real-time systems, providing them with enhanced data analytic capabilities for the implementation of new autonomous control applications. Developing holistic virtualized platforms for perception, decision, and control related to ADS dedicated driving to enable mobility as a service for the next generation of highly automated vehicles April 2019-April 2022 Developing of the Automation Level Four+ Reliable Empathic Driver system (ALFRED). ALFRED will be a layer of behavior that will understand the emotions of the passenger on board and will adapt the vehicle features to enhance user experience.

May 2019-May 2022
PAsCAL [142] -Luxembourg Institute of Science and Technology -University of Liverpool -University of Leeds -LuxMobility -Oply Mobility S.A. Further partners [142] Developing of a set of recommendations and guidelines to understand public awareness about connected autonomous vehicles, to measure the degree of acceptance of European citizens towards AV, provide knowledge of how to integrate citizens needs and interest when moving to higher levels of automation and allow the education of future AV drivers, passengers, and those who will share the road. Analyzing the role of Autonomous Vehicles in making urban transport more efficient, by deploying shared, connected, and cooperative fleets of autonomous vehicles in coordinated public transport, demand responsive transport, mobility as a service, and logistics as a service. SAE J941-"Motor Vehicle Drivers' Eye Locations" [147] Warning messages and signals-to clearly perceive and differentiate alarms, warnings and information signals while taking into account different degrees of urgency and combining modalities of warnings ISO 11429:1996 "Ergonomics-System of auditory and visual danger and information signals" [148] ISO/TR 12204:2012 "Road Vehicles-Ergonomic aspects of transport information and control systems-Introduction to integrating safety-critical and time-critical warning signals" [149] ISO/TR 16352:2005 "Road vehicles-Ergonomic aspects of in-vehicle presentation for transport information and control systems-Warning systems" [150] Human centered design principles and activities for computer-based interactive systems ISO 9241-210:2010 "Ergonomics of human-system interaction-Human design for interactive systems" [151] Driver's visual behavior-Assessment of impact of human-machine interaction ISO 15007-1:2014 "Road vehicles-Measurement of driver visual behavior with respect to transport information and control systems-Part 1: Definitions and parameters" [152] ISO 15007-2:2014 "Road vehicles-Measurement of driver visual behavior with respect to transport information and control systems-Part 2: Equipment and procedures" [153] In-vehicle displays, e.g., image quality, legibility of characters, color recognition, etc. and procedures for determining the priority of on-board messages presented to drivers ISO 15008:2017-"Road vehicles-Ergonomic aspects of transport information and control systems-Specifications and compliance procedures for in-vehicle visual presentation" [154] ISO 15008:2009 "Road vehicles-Ergonomic aspects of transport information and control systems-Specifications and compliance procedures for in-vehicle visual presentation" [155] ISO/TS 16951:2004 "Road Vehicles-Ergonomic aspects of transport information and control systems-Procedures for determining priority of on-board messages presented to drivers" [156] Suitability of transport information and control systems (TICS) for use while driving ISO 17287:2003 "Road vehicles-Ergonomic aspects of transport information and control systems-Procedure for assessing suitability for use while driving" [157] [190] ISO 24100:2010-"Intelligent transport systems -Basic principles for personal data protection in probe vehicle information services" [191] IEEE P7002-"Data Privacy Process" [192] IEEE P7006-"Standard on Personal Data AI Agent Working Group" [193] IEEE P7012-"Standard for Machine Readable Personal Privacy Terms" [194] 21