U.S. Department of Transportation, Federal Highway Administration

Publication No. FHWA-RD-96-051, January 1996

Note: This report was a product of the Federal Highway Administration’s Automated Highway System (AHS) Precursor Systems Analyses (PSA) studies. More detail about these studies is available on-line. This page includes only Part I of this report, the Introduction and Summary. Parts II and III provide details that make up the rest of this 65 page report.

INTRODUCTION AND SUMMARY

It is frequently assumed that an Automated Highway System (AHS) will require lanes exclusively

dedicated to automated operation, and that operation in mixed traffic is either not safe or not practical.

Since these assumptions preclude automated vehicles from sharing existing lanes with manual traffic,

they imply the introduction of an AHS will require either new construction or diversion of existing lanes

from their current use, and at a time when there are likely to be few vehicles equipped to use them.

If these assumptions are indeed valid constraints, they make the initial deployment step a very steep one.

First, there would be the need to justify investment in infrastructure well before there are compensating

benefits. At least as serious is the prospect of the heat that will be generated by drivers who must

continue to endure the unrelieved, or possibly worsened, congestion in full view of this underutilized

An Automated Highway System is much more likely to be brought into being if the operational concept

and the system that supports it are compatible with a gradual and nondisruptive introduction into the

existing freeway system operational environment.

Here we describe and broadly analyze an evolutionary scenario in which the vehicles equipped for

automated operation are assumed to be capable of safely operating in mixed traffic with unequipped,

manually operated vehicles. We assume a gradual evolution of incremental change, both in the scope

and capability of the automated features, and in the vehicle fleet as new, equipped vehicles replace old

ones.

We believe the scenario described is both technically and operationally feasible, and offers the prospect

of an essentially seamless and nondisruptive path to an Automated Highway System - and beyond.

Our first step has been to hypothesize what is believed to be a sensible technical evolution for an AHS,

using our best judgment and knowledge from already available analyses. Since every technical step does

not necessarily constitute the basis for a saleable product, we have also defined a sequence of

deployment steps for bringing the hypothesized system into operational use. There has been no intent to

carry out a detailed system analysis; if the results are judged to be promising, that can be done in a later

stage of the program.

In our hypothesized scenario, the initial AHS is designed for operation where our current congestion

problems are most obvious: on urban freeways. In addition to the freeway analysis, the scope of the

potential usefulness of the particular function for operation in other venues is briefly addressed: arterials

and other surface streets, interstates, other rural highways, and intersections of various types.

There are experimental cars on our highways today that are already taking the first steps toward an

AHS: these are cars with their Cruise Control units augmented by a forward looking sensor that detects

when one might be getting too close to the car in front and lets up on the throttle perhaps even down-shifts.

This adds a kind of minimum gapfunction to the normal speed-hold function to produce what is being

called Intelligent Cruise Control.

We can raise the IQ of this Intelligent Cruise Control (ICC) by letting this same sensor - actually a

somewhat better one - also provide automatic emergency braking. Now our much smarter ICC would be

capable of two functions, automatic emergency braking (Autobrake) and automatic use of both throttle

and brake to maintain a safe gap behind the car in front (Autogap).

It is purely a conjecture, but we suspect the reason the first versions of Intelligent Cruise Control are of

the low IQ variety - that is, without Autobrake, using throttle control only - is, first, that the more

capable system does represent a more difficult technical problem, and, second, the specter of product

liability is a much greater concern.

We will henceforth use Intelligent Cruise Control (ICC) to refer to the smarter version, including both

the Autobrake and Autogap functions. From the driver's perspective it will operate much like Cruise

Control today, except that when his or her car overtakes another vehicle, the system will automatically

revert from holding speed to holding a fixed-but-driver-adjustable distance behind that vehicle. Thus at

some moderate transition distance the speed controls become position controls, varying the gap between

the vehicles in response to the driver's desires. Like Cruise Control today, a tap on the brakes or the

throttle gives drive-train control back to the driver.

The autobrake feature operates at all times, invisible to the driver. In fact if the driver is alert enough to

never have a lapse in concentration and lucky enough to never have someone going slower cut directly in

front of him, the system will never be actuated, because the driver's braking will always occur before the

point that emergency response is needed. In addition to sensing when emergency braking is needed, the

system will also be designed to recognize when it is not needed, such as in sharp turns when objects may

suddenly appear dead ahead, but are not threats to safety.

We anticipate that these systems will incorporate a complete self-testing and self-diagnostic capability;

and will be designed to be completely fail safe and fail soft. We believe this to be possible, but it will

require extensive design effort and verification testing. We suspect that the major portion of the

developmental engineering and much of the testing will be focused on providing and verifying these

features.

Given this self-check capability; these systems create no special requirements for entering the freeway;

the driver behaves as he or she does today. If there had been a malfunction in the system, the self-test

would have already indicated it, and the driver would know that auto-operation was precluded until the

system was repaired. The system will have been designed to fail softly if a malfunction occurred during

operation.

There are at least two powerful motivations for Intelligent Cruise Control. The first is safety. Artificial

sensors don’t get tired or fall asleep, and their attention doesn't wander. lapses in attention are the largest

source human accidents; automated Systems could virtually eliminate these. This one trait of almost

eternal vigilance is worth a large investment itself.

freeway, is relief from the constant brake-throttle-brake jockeying needed to hold position in heavy

traffic.

There is a third benefit that may or may not turn out to be important: the potential for increased

throughput. Automated controls are potentially very fast, it is reasonable to expect that automated

systems could react to emergencies on the order of five to ten times faster than a human driver. This

capability offers the potential to increase the effective throughput of the freeway, because it enables

vehicles to drive closer together safely.

There will be acceptance problems to overcome. For example, because of the potential for shorter

headways, some drivers will perceive themselves to be the victims of uncomfortably close tailgating.

This new driving behavior will need to be made acceptable to fellow drivers. Simple techniques may be

enough. Perhaps a small green light visible in a rear view mirror could tell drivers that the vehicle behind

them has automatic braking. Information programs could help drivers understand what is going on.

Time and gradualism should help.

purchase are improved safety and more relaxed driving in freeway traffic.

The next major function is automatic lane holding (Autolane). Autolane will require on-board sensors

that can accurately determine vehicle position relative to the roadway lane. This implies the need for

sensing the road itself, perhaps by tracking the white lines, or perhaps guiding on embedded markers

such as the magnetic "nails" being used in the PATH program experiments. There may be other

techniques. We conjecture that an operational system will combine several such methods to enhance

robustness and failsoftness.

We also conjecture that lane modifications such as painting brighter lane demarcations or installing

magnetic nails will be sufficiently inexpensive and practical that all lanes in a freeway can be modified.

This would enable drivers with equipped vehicles to operate in the lane that matches his or her speed

preference.

It is our current opinion that Autolane will be used only in conjunction with Autogap and Autobrake, not

alone. With this combination, the driver would manually enter the freeway as he or she does today, drive

to the lane desired, and activate these modes, perhaps with a single control. Now the vehicle is under

completely automatic control.

The vehicle would remain in this mode until the driver indicates his intent to take control by turning the

system control back to "Off", and actually disengaging the system by grasping the steering wheel and

introducing some small manual input, overriding the automatic steering.

We suggest that a submode of Autolane is automatic lane departure warning. This could be used during

manual control to prevent accidental drifting out of the lane, a significant safety feature for the sleepy

driver.

These new capabilities need not be restricted to just freeway use. Since the infrastructure modifications

needed to support the Autolane feature should be relatively inexpensive and nondisruptive, its use could

readily be expanded to interstates and many lesser rural highways. The payoff would be a marked

improvement in both safety and in driver convenience. It should be a particular boon on long intercity

cruising on urban freeways and intercity trips.

made 100 percent safe in all circumstances. That is an impossible criteria for man or machine. It seems

much more rational to set the standard in relation to what happens today; for example, we could that the

automated system must be twice as safe as manual control, or five times as safe, but not 100 percent

safe. The perfect is the enemy of the good.

The next step in our hypothesized evolution is the augmentation of Automatic Cruise Control with the

capability to platoon. We have hypothesized an approach in which the platooning takes place

spontaneously. In this mode, the individual vehicles under full Automatic Cruise Control (Autobrake

plus Autogap plus Autolane) will be sensing and deducing the state of the traffic: is there plenty of

capacity in the lane or is more capacity needed to accommodate additional vehicles desiring entry

into the lane? If a vehicle senses the need for more capacity, and if it is next to a vehicle also

under autocontrol, it will spontaneously move up to platoon with that vehicle. This creates more

space in the lane for other vehicles. Possible techniques for implementing this capability are discussed

in the Autoplatooning Section in Part II (not included here).

Autoplatooning is envisioned to also work in reverse: deplatooning occurs when there is no longer need

for it to increase lane capacity. It also occurs when the driver signals that he wants to assume manual

control, probably in order to move out of the lane and exit the freeway.

The sole purpose of planning is to increase the effective capacity of the freeway. It is dubious that

people will like it for themselves, but purchase may be motivated by the recognition that it enhances the

prospects of a free-flowing freeway, or by partial government subsidy of ACCs equipped with this

feature. If absolutely necessary it could be by decree.

This evolution would continue into the future, although our crystal ball begins to get much cloudier.

Probably the next step is to provide automatic lane change. This enables the entire freeway trip to be

automated: entry into the freeway, movement to the desired lane, then subsequent exit from the freeway.

This is fairly ambitious technically, but in a decade should appear much less so. Fully automating the

freeway portion of a trip may have considerable appeal to our growing contingent of elderly drivers.

An additional possibility is very high speed intercity travel. It seems likely that this step would require

the dedication of special lanes, but whether they would require permanent physical separation to the

normal speed lanes is an open issue.

Somewhere in this evolution the step will be taken that we believe will he the true watershed in surface

transportation: the integration of the Automated Vehicle with the Traffic Management System, the

Smart Car with the Smart Road. This will begin to happen when we first start to introduce the

automated vehicle to surface streets. The first steps may be undramatic, but they will open the door to

the fully automated origin-to-destination vehicle.

Once the automated system can permit hands-off operation on surface streets, we can begin to think in

terms of total trip automation, probably with the basic navigation coming from the vehicle's own

Somewhere in the more advanced stages of this evolution of the Automated Vehicle we can expect

another important metamorphosis. We will review the steps so far to better lay out the overall logic.

Beginning with Autobrake and Autogap, we have modified the vehicle so that the steering and drivetrain

controls are actuated by electrical signals, not muscle: we have replaced drive-by-muscle with

signal to the actuators, not a mechanical movement.

We have then progressively taken the control of these actuation signals away from the human eye-brain

system and substituted, function-by-function, a " computerbrain" system fed by artificial sensors. We

have built into that computerbrain all the responses to keep the vehicle safe in a very wide variety of

driving situations.

The next logical step is to use the computerbrain system to insure safety during manual driving. Now

when the driver wants to manually control the vehicle he does so not by sending electrical signals to the

steering and drive-train controls, but by sending his signals to the computerbrain system - he drives

through the artificial system, not around it. The vehicle follows his gross steering signals, but doesn't

permit him to do anything unsafe. This will be a boon for the elderly portion of our population - and for

the people who share the road with them.

This broad pattern of evolution is illustrated in Figure 1.

We can be almost sure, however, that it will not happen in the three neat steps we have laid

out; rather, like everything else, it will happen in bits and pieces, in small, almost experimental steps.

For example, once we are comfortable with Intelligent Cruise Control - fully debugged by millions of

hours of operational experience - we may well see some new cars whose throttles are inputs to the ICC

unit, not the engine.

All of these steps are treated in more detail later in Parts II and III (not included here).

A NOTIONAL BASIS FOR DESIGN: EMULATE THE HUMAN

Consider how a human drives in a freeway lane. He or she gets most of their information on the state of

traffic around their vehicle through their own eyes, and they keep track of the location of their vehicle on

the road the same way. They use all the visual cues available: lane markers, "road curves ahead", et

cetera. They look most closely at the relatively few vehicles that could endanger their own vehicle, like

the one in front of them if it stops suddenly, or the one in the next lane if its turn signal is on or if it

decides to pull in front of them.

Second, the driver is continuously interpreting all this information. The driver decides what is a safe

following distance. He has some "rules" for deciding, like it is safe to follow closer at low speeds than at

high speeds. In wet weather the braking is not as good, so the gap - the following distance -should be

larger. And so on. (It is apparent that not all drivers subscribe to the same rules.)

Drivers also have rules for taking action. If he is gaining slowly on the car in front, he backs off slightly

on the accelerator (or thinks about passing). If he is closing a bit faster, he applies gentle braking. If he

has glanced down to retune his radio, and looks back up to see the car in front of him suddenly closer

and closing rapidly, he slams on his brakes and stimulates his adrenaline.

If we set out to automate this "gap control" function, and do it entirely on-board the vehicle, then

emulating this pattern of sensing and interpretation, decision, and action seems a sensible approach to

mechanization.

The human eye, along with the brain that interprets its signals, is far more capable and versatile than any

artificial sensor-plus-interpreter that could be built today. But gap holding does not require all that

capability; nearly all that is needed is an unambiguous measure of the distance to the car ahead and to

the few vehicles in the immediate vicinity that might move into the intervening gap, thus becoming the

new target.

The point is that if we deal with just a few functions at a time, it is only necessary to emulate very

specific and limited functions of the eye-brain, not duplicate its total capability.

This is not intended to imply that the job is easy, nor that we wont want even more information for more

capable systems in the future. Even now, just to get unambiguous range, the system must be smart

enough to not unintentionally measure the distance to the car in the next lane because the road is curved.

It should also be able to recognize when another vehicle (or motorcycle) starts moving into the lane. Or

to react appropriately when the car ahead moves out of the lane. The actual range measurements can be

made by man-built sensors with greater accuracy than a human can estimate it; the more complex part is

interpreting the sensor outputs.

It is still to be determined if the best way to handle this general sensing function is with vision-based

sensors, radar, radar, or some combination. And the best approach to interpretation of the output of

these sensors is also yet to be defined, and is, in fact, the most difficult technical challenge facing these

The decision rules that govern vehicle responses are easier to visualize. Compared to "expert Systems,,

that can substitute for human decision making in general areas like law and medicine, the area of our

interest is comparatively limited: it seems well within current capability to devise a set of rules, probably

couched in "fuzzy" terms, that adequately decide when and how vigorously to put on brakes or change

the throttle setting.

So while the versatility of the eye or the data processing capability of the brain will never be matched in

its entirely, for very specific functions it may be possible to actually improve upon it. We can measure

distances and rates of closure with great precision. We can have "eyes-in-the-back-of-our -head" - and

wherever else we want them. In time we should be able to see through fog.

This perspective on system mechanization is consistent with the notion of incremental evolution just

described. The start is with simple functions. As sensor-interpretation capabilities grow, and our ability

to define behavioral rules for more complex control situations improve, the scope of automation could

be expanded a step at a time within the same basic mechanization framework. As the need for

information broadens beyond that which can be acquired by vehicle-mounted sensors, then

communication links to infrastructure intelligence can be introduced; we have conjectured that this will

occur when auto-operation on suffice streets is introduced.

While the "eyes-and-brains" of the system we have been discussing are the key challenge, it is obvious

that it will also be necessary to replace human muscle in the operation of the vehicle's throttle, brakes

and steering: we will require vehicles designed for drive-by-wire. This is relatively straight-forward

engineering.

The idea of an autonomous vehicle is not new, and appears to have been the primary focus of automated

logically the philosophy and the broad mechanization.

If no one is willing to develop the system and offer it for sale, then all is for naught.

In our judgment, there are two areas of risks that could seriously inhibit private sector investment in the

program. The first is product liability risk: we can be fairly sure that fault for all future rear-enders will

be shifted from drivers to the deeper pockets of the manufacturers of the ICC system. This prospect

must give a potential supplier of the equipment considerable pause for thought.

The second is the uncertainty in predicting the cost of development and validation. Costs are very

much a function of the technical difficulty of the tasks being undertaken. We view the technical problem

of devising a sensor and sensor interpretation system that can provide the performance desired, keep

false alarms to an acceptably low level, and incorporate the self-verification and failsafe features

required as one that will require considerable innovation and ingenuity And it will be necessary to

produce the product at a cost that will sell. Not only are these development costs hard to predict with

confidence, but in this case the difficulty is compounded by the ever-present possibility of unanticipated

regulatory mandates.

COST AND PRICES.

This is just an explicit statement of the risk just discussed. Unless prices are low enough to attract

buyers, the potential benefits of the system will not be realized. Prices may be purely a function of

actual costs, or they may be reduced by possible subsidies that may be justified by the public benefits

the system brings.

SYSTEM ROBUSTNESS AND FAILSAFETY

This is an issue, perhaps more properly considered a risk, that is common to all functions.

As noted, an automatic self-test and self diagnostic system would be an essential part of any system

design. We believe that the engineering development of this Integrity Verification Subsystem and the

testing required to insure its proper functioning will be a major element of development cost.

SAFETY CRITERIA

Another issue is the choice of safety criteria. The choice made will drive both the performance and

the cost of the system. As we have noted, there is an almost a knee-jerk reaction to demand perfection,

which is, of course, not attainable. We suggest a more rational criteria might by set by comparison to

what is now obtained with human drivers. Perhaps something like twice as good, or even five times as

good. The final criteria should not be selected until we have a better understanding of the cost of

attainment.

The remaining issues have features that are unique to individual functions.

AUTOBRAKE - OBSTACLE DETECTION REQUIREMENTS.

A serious performance issue arises in determining the obstacle detection requirements for the initial

systems. It will be easier and cheaper to build a system that just tracks vehicles in ones own lane out to,

say, 100 feet than to simultaneously track vehicles in adjacent lanes, or see out to 300 feet. There is the

issue of the size of the objects that must be detected (and broadly identified?): motorcycles?, bicycles?,

people: adults, children?, dogs and cats?, trash cans?.

Another dimension of this issue is the level of permissible degradation with weather: fog, rain,

snow...

The choices made here could have a substantial impact on both system capability and system cost,

and it would be wise to defer final decisions until the trades are thoroughly understood.

AUTOBRAKE - BRAKING CRITERIA

This design issue is a particular of the safety criteria issue: the determination of the criteria for a

safe following distance. This involves assumptions about relative braking capabilities, road surfaces,

AUTOGAP - SENSOR INTERPRETATION PERFORMANCE

There is the general issue of just how good the sensor and sensor interpretation system have to be in

assessing the tactical driving situation. We want the system to be able to behave as a prudent and

defensive driver would. How close do we need to come, and how do we articulate the requirement? It is

our suspicion that we will discover that we ultimately need a sensor interpretation system that is far

better than we will settle for in initial systems as sensor interpretation is at the heart of both system

This issue applies in differing degrees to autobrake and the other functions. It will leap in

importance when we reach automatic lane change, which has not been analyzed here.

A specific detail: do we need to be able to read turn-signals. If the answer is yes, then a radar only

system will be inadequate.

AUTOGAP - COMMUNICATION WITH THE TRAFFIC MANAGEMENT SYSTEM

We initially assumed that Intelligent Cruise Control is completely autonomous. There is the issue of

whether a communication link to the Traffic Management System is worth the cost. It may be desirable

to permit speed commands directly to the vehicle "Computerbrain" rather than to the driver as we do

AUTOLANE AND AUTOMATIC CRUISE CONTROL -DRIVER ALERTING

Automatic Cruise Control removes the motivation - if not the need - for driver vigilance. The

implication is that the driver may not only take longer to react to an emergency or an unusual situation,

but may also be in a mental state that is not conducive to an immediately rational response. This

problem will require attention. If communication with the TMS was not made a requirement for ICC,

it will have to be reexamined here.

PROXIMITY

We do not know if or how quickly people can adjust to the very close spacing of vehicles at speed

that platooning involves. The transition itself may be disturbing. This is a significant human factors

issue.

PLATOON-DEPLATOON DECISION

SUBSEQUENT EVOLUTION - SYSTEM ARCHITECTURE

Heretofore there has been minimal interaction between the essentially autonomous AHS and the

Traffic Management System - just the ability for the TMS to issue occasional stream speed commands,

and receive emergency transmissions from vehicles in distress. The AHS architecture was almost

entirely independent from the infrastructure system architecture.

This is no longer true when automated operation is extended to surface streets: now an intimate

integration of the two systems is required. This should be the primary focus of the 20 year version in the