Design and Implementation of Safety Control for a Class of Stochastic Order Preserving Systems with Application to Collision Avoidance near Intersections MASSACHUSETTS MNB11ITE OFTECHNOLOGY by OCT 16 2014 Mojtaba Forghani LIBRARIES Submitted to the Department of Mechanical Engineering in partial fulfillment of the requirements for the degree of Master of Science in Mechanical Engineering at the MASSACHUSETTS INSTITUTE OF TECHNOLOGY September 2014 @ Massachusetts Institute of Technology 2014. All rights reserved. Signature redacted A uthor ............................. Department of Mechanical Engineering August 25, 2014 I Certified by.......Signature redacted ........ Domitilla Del Vecchio Associate Professor Thesis Supervisor Signature redacted Accepted by........... David E. Hardt Professor of Mechanical Engineering Department Head of Graduate Office 2 Design and Implementation of Safety Control for a Class of Stochastic Order Preserving Systems with Application to Collision Avoidance near Intersections by Mojtaba Forghani Submitted to the Department of Mechanical Engineering on August 25, 2014, in partial fulfillment of the requirements for the degree of Master of Science in Mechanical Engineering Abstract In this thesis, we have designed and implemented a safety control system for collision avoidance near intersections. We have solved the corresponding control problems for a general class of systems that also includes the scenario of the two consecutive vehicles approaching an intersection, which leads to the design of the collision avoidance system. We have gathered the data of behavior of drivers as they approach intersections and have built a stochastic model for that through an optimization problem. The model generates a non-deterministic profile for acceleration of a vehicle which is not equipped with the collision avoidance system and it is used to estimate and predict future stopping profiles of the vehicle in order to take the right control action for avoidance or mitigation of accidents. First we have verified the consistency of the theoretical model with its expected behavior after implementation and then we have implemented the control system on the Prius vehicle in collaboration with TTC (Toyota Technical Center), Ann Arbor, Michigan. Thesis Supervisor: Domitilla Del Vecchio Title: Associate Professor 3 4 Acknowledgments I would like to express my appreciation to my advisor Professor Del Vecchio for her priceless helps and continuous supports during my graduate study. I would like to thank her for her motivation, patience, encouragement and caring about the students and for teaching me how to do research and how to write my thesis. I am very glad that I could have the opportunity to work under her supervision. I would also like to thank Dr. John Michael McNew and Dr. Derek Caveney at Toyota Technical Center (TTC), Ann Arbor, Michigan, for helping me to implement the system on the vehicle. I would like to express my gratitude to Dr. McNew for his invaluable helps during my attendance in Ann Arbor, summer 2013 and 2014. I thank my friends at Professor Del Vecchio's research group, Control Networks Group. I am very thankful to Dr. Daniel Hoehener at Control Network Group for his helps and ideas. I also would like to thank the Graduate Office of MIT MechE. My special thanks to my parents for all the helps, supports and sacrifices that they have made for me. Words can never help me express how grateful I am for their encouragements and prayers, that despite the far distance between us, have always been a motivation for me. I would also like to thank National Science Foundation (NSF) for supporting my work under the award number 1161893. 5 6 Contents 1 Introduction 9 1.1 General Collision Scenario . . . . . . . . . . . . . . . . . . . . . . . . 10 1.2 Related Works . . . . . . .. 11 . . . . . . . . . . . . . . . . . . . . . . . 2 Deterministic vs Stochastic Systems 3 4 13 2.1 Deterministic System . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 2.2 Stochastic System . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Stochastic Model 17 3.1 System Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 3.2 Motivating Example . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 3.3 Problem Formulation . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 3.4 Solution to Problem 1 . . . . . . . . . . . . . . . . . . . . . . . . . . 29 3.5 Solution to Problem 2 . . . . . . . . . . . . . . . . . . . . . . . . . . 37 3.6 Algorithms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 3.7 Simulations and Data Analysis . . . . . . . . . . . . . . . . . . . . . . 43 3.7.1 Experimental Setup . . . . . . . . . . . . . . . . . . . . . . . . 43 3.7.2 Experimental Results . . . . . . . . . . . . . . . . . . . . . . . 45 Conclusions and Future Works 53 7 8 Chapter 1 Introduction The first recorded automobile fatality goes back to 1869 [1]. Today after almost 150 years, with the all developments in the safety technologies of vehicles, still number of injuries and deaths caused by automobile accidents is significant. In 2007 the contribution of intersection related crashes among all types of accidents was reported to be 40% [2]. Among all different possible intersection related crashes one is the rear-end collision that takes place between two vehicles in the same lane. Drivers may have wrong estimation of the decision that driver of their preceding vehicle is making or going to make and this can put both vehicles in the dangerous situation of rear-end collision. Obviously, a vehicle that is crossing an intersection with a high velocity (namely a velocity higher than a maximum value) is the source of a different type of collisions that occurs inside the intersection. Considering these two situations, we are interested in design of a semi-autonomous control system that helps the driver to avoid or mitigate collisions, with the basic assumption that only our vehicle is equipped with the collision avoidance system. In Section 1.1 we provide more details of the general collision scenario that we are considering throughout the thesis and in Section 1.2 we review some of the related works regarding the collision prevention and mitigation. 9 1.1 General Collision Scenario We denote longitudinal position and velocity of the preceding vehicle (PV), if it exists, by x, and v,, respectively. The position and the velocity of the following vehicle (FV), the vehicle that is equipped with the collision avoidance system, are Xf and Vf, respectively. The longitudinal position of the intersection (stop sign) is also denoted by St and the maximum allowable velocity (target velocity) is represented by VT. The minimum allowable distance between the two vehicles is 6. Mathematically, (1) xp - xf < 6 or (2) Vf > VTand xf > St, (1.1) denotes the collision state. The scenario is depicted in Figure 1.1. fs xx (a) (b) Figure 1.1: The collision is defined as (1)- If the distance between the two vehicles becomes smaller than 6, or (2)- If FV passes the intersection with a velocity larger than VT. In Figure (a) none of the two constraints are violated. In Figure (b), the top figure, the first constraint is violated, and in the bottom figure the second constraint is violated. Since no collision avoidance system is implemented on PV, FV must be equipped with a control system that has a reasonable estimation of the current and future decisions of the driver of PV. Note that if any of the two constraints of equation (1.1) is satisfied, at any time, the system will be in the collision state, and since we do not have the information of the future states of PV and FV, the future estimation is essential in order to design the control system. In the next section we focus on different methods that have been employed for the estimation purposes. 10 1.2 Related Works A popular tool to model a set of time series observations, which in our case is the past behavior of drivers of PV as they approach intersections, e.g., x, and vP, collected offline, is Hidden Markov Model (HMM). This method has been employed for similar driver behavior detection purposes in [1]-[11]. HMM captures different observed behaviors through hidden states that their nature is not necessarily clear to us, and consequently any of the hidden states affects the observation through multiple parameters. Although HMM is a powerful tool for estimation of the current state of the system, but it is not good at long term predictions. The accurate predictions of future states of the system are very essential. These predictions must be sufficiently accurate in order that we can make the right decision based on what will happen in future up to almost 30 sec, as the approximate maximum duration that the vehicle is inside the intersection region. In general HMM constructs a model for the system based on the available data and it does not consider the dynamic of the system. This can make HMM a good choice for a highly unknown system, but we already know the full dynamic of model of the two vehicles approaching an intersection. In [3], [12] and [13] multiple noise driven linear systems have been considered as different behaviors of drivers, which themselves are classified based on HMM. This model can tackle the problem of using HMM solely, regarding the prediction of the future behaviors, but this model does not capture the nature of the behavior of PV. The position and the velocity of PV are generated by its acceleration and that is also generated by a driver that even in his/her worst state he/she follows a set of logical behaviors. Therefore a noise driven model while adds complexity to the problem, it cannot capture the nature of PV well. Then the question is that "What is a good model?" We will answer this question in the next chapter. 11 12 Chapter 2 Deterministic vs Stochastic Systems Since we are interested in having an estimation of the future profile of PV, we need a model that outputs a profile until the intersection or until the time that FV stops. The models mentioned in Chapter 1 consist of the discrete states that estimate or predict the most probable action that the driver is making or going to make. These models do not output any profiles for PV and in particular its acceleration, which itself drives the velocity and the position of PV in turn. We present two approaches to the collision avoidance problem. In Section 2.1 we present the deterministic model, and in Section 2.2 we introduce the stochastic model. 2.1 Deterministic System A simple solution to the estimation of the future decision of the driver of PV is to consider a constant acceleration for it until any time that the vehicle stops or cross the intersection. Since we are considering a constant acceleration for PV, we use the term deterministic system for this model, versus the stochastic model in which we do not consider a unique constant acceleration for PV and instead we assume it to be a random variable. In order to guarantee that for the deterministic model none of the inequalities of relation (1.1) are satisfied, we must consider an acceleration 13 value for PV that minimizes the distance between the vehicles, or in other words puts the system in the most dangerous situation. If we can guarantee that the vehicles are safe from the collision for this worst case scenario, then they are also safe for any other inputs of the driver of PV. This acceleration value corresponds to the minimum acceleration that PV can achieve. The minimum acceleration in vehicles is generated by applying the maximum brake force, which can easily be provided for any vehicles. In the deterministic model we check whether the profile corresponding to the minimum acceleration violates the constraint x, - xf ;> 1, and based on that we decide what control input must be provided to FV in order to guarantee the rearend collision avoidance. This method, in spite of being fast and simple, suffers big problems which makes it almost inapplicable, in particular for the semi-autonomous collision avoidance system. If we were confronting a fully autonomous control system, which in particular did not have human in the loop, we could take advantage of the deterministic system and guarantee that no collision will take place as long as the control system is operating properly. Existence of the driver of FV in the system (having human in the loop) does not allow us to design a system that always considers PV as an adversarial agent. While we are aware that the maximum brake or minimum acceleration is applied in rare situations, assuming that PV has always the minimum acceleration for the rest of its path leads to a very conservative system. Briefly, the deterministic system has two major problems; (1): It takes control action very early, meaning that from a considerably large distance to PV, which is not satisfactory for the driver of FV; (2): Since the driver of PV rarely applies the maximum brake constantly, the frequency of the false alarms increases significantly, meaning that the number of the switches between the automatic control input and the driver input increases, which again leads to the dissatisfaction of the driver of FV. From the application point of view these two problems can make the model completely inapplicable and that is our main motivation for considering the stochastic system which does not suffer the above 'Note that the violation of this constraint means satisfying the first inequality of relation (1.1) which represents a collision state. 14 problems. 2.2 Stochastic System The main difference between the deterministic system and the stochastic system is that in the stochastic system, unlike the deterministic system, the acceleration of PV is not assumed to always be its minimum possible value in order to estimate its future profile. Since the decision that the driver of PV makes is related to its current velocity and distance to the intersection 2 , we assume an acceleration as a function of the position and the velocity of the PV3 . Moreover in order to capture the all possible different behaviors, we assume a Gaussian distribution around this function. The details of this model are provided in Chapter 3. With this model it is easier to relate the profile to a safety value. The major problem in the stochastic model is that we cannot guarantee 100% safety, and that is the reason that we have a safety level as an input to the stochastic system. We use stochastic systems to mitigate the rear-end collision instead of completely preventing it from happening as we do in the deterministic model. The driver's satisfaction is the main reason for the transformation from the deterministic model to the stochastic model. In the next chapter, first we introduce a general class of systems and then prove that our collision avoidance scenario is also consistent with this class of systems, and then we solve the corresponding control problems regarding the expected safety of the model. 2 For instance when the speed is higher or the vehicle is closer to the stop sign, we expect a larger required deceleration in order to stop the vehicle at the intersection. 3 1n our work we have assumed a linear function. 15 16 Chapter 3 Stochastic Model In order to tackle the problems introduced in Chapter 2 regarding the conservativeness of the deterministic model, which itself leads to the dissatisfaction of the driver of FV, we take advantage of stochastic systems. In Chapter 3, we first introduce the new model in Section 3.1. In Section 3.2 we prove that the collision avoidance system can be modeled as a motivating example having the property of the class of systems considered in Section 3.1. We then formulate the problems that need to be solved based on the new model in Section 3.3. In Sections 3.4 and 3.5 we will solve the two problems mentioned in Section 3.3. In Section 3.6 we present the general algorithm to solve the relevant problems of Section 3.3, and we will introduce the discrete algorithm for implementation purposes. In the last section, Section 3.7, we will present simulation results along with the required ools to build the model from the available data. 3.1 System Model Before introducing the model that we are considering, we define the strict and nonstrict order preserving properties, which we will use extensively throughout this chapter. Definition 1. A non-strict partial order (or simply partial order) is a set P with 17 a partial order relation "<", which we denote by the pair (P, 5). The partial order (Rn, <) with component-wise ordering is defined as follows. For all w, z ( RE we have that w < z if and only if wi zi for all i E {1, 2,..., n}, in which wi denotes the i-th component of w. We denote piecewise continuous signal on U by S(U) := PC(R+, U). With this notation, for U C R' we define the partial order (S(U), ) by component- wise ordering for all times, that is, for all w, z E S(U) we have that w < z provided w(t) z(t) for all t E R+. Moreover if (P, p) and (Q, Q) are two partially ordered sets, then the map f : P -+ Q is a non-strict order preserving (or simply order preserving) map provided x <p y implies f(x) :Q f(y). Definition 2. A strict partialorder is a set P with a partialorder relation "< ", which we denote by the pair (P, <). The partial order (Rn, <) with component-wise ordering is defined as follows. For all w, z E Rn we have that w < z if and only if wi < zi for all i e {1, 2, ... , n}. We define the strict partial order (S(U), <) by componentwise orderingfor all times, that is, for all w, z E S(U) we have that w < z provided w(t) < z(t) for all t E R+. Moreover if (P, <p) and (Q, <Q) are two strict partially ordered sets, then the map f : P -+ Q is a strict order preserving map provided x <p y implies f(x) <Q f(y). We consider a class of continuous systems that have some order preserving properties. Definition 3. A continuous system is a collection E = (X, U, A, 0, f, h), with state x E X c Rn, control input u E U c R', disturbance input d E A c R", ouput y E 0 C X, vector field in the form of f : X x U x A -+ X, and output map h: X -+ 0. Definition 4. Forthe systems E' = (X', U, A', 01, f , h') and E2 = (X 2 U 2 , A 2 , 02 ,f 2 , h 2 ) we define the parallel composition E = El E2 := (X,U,A,0 f, h), in which X = X1 x X 2, U : XU 2, A:AXA 2 , 0:=01 X0 2,f:=(f 1, f 2) and hW:= (hd, h 2f We denote the flow of a system E at time t E R+ by 0(t, x, u, d), with initial 18 condition x E X, control input signal u E S(U) and disturbance input signal d E S(A). We also denote the ith component of the flow by q5 (t, x, u, d). Definition 5. A continuous system E = (X, U, A, 0, f, h) is called input/output order preserving (or strict order preserving) with respect to the control input, if the map h(q(t, x, u, d)) : U -+ 0 is an order preserving map (or strict order preserving map). Definition 6. A continuous system E = (X, U, A, 0, f, h) is called input/output order preserving (or strict order preserving) with respect to the disturbance input, if the map h(O(t, x, u, d)) : A -+ 0 is an orderpreserving map (or strict orderpreserving map). The system model that we are considering is defined as follows. Definition 7. We consider the parallelcomposition of the systems E' = (X', U, 0, 0, f', h') and E2 = (X 2 1,, 0 2 , f 2, h 2 ), where x1 E X1 C R , x 2 E X2 c Rn u E U = [UM, uM] C Rm with um E R' and uM E Rm , the minimal and the maximal control inputs for El, respectively, d E A = R, y' E 01, y 2 E 02, h'(x') : X' and h2 (x 2) X2 _+ 02. 01 The vector fields are in the form of f 1(x',u) : X 1 x U -+X . and f 2 (X 2 , d) : X 2 x A -+ X 2 We impose the order preserving properties on the flow of the system as follows. Assumption 1. System El2 has input/output order preserving property with respect to the control input. Assumption 2. System EI2 has strict input/output order preserving property with respect to the disturbance input. Assumption 3. The disturbance input term of the system E2 is a constant distur- bance input that can be modeled as a Gaussian distribution, that is d = d N(I, o2). We solve the corresponding control problems for the general class of systems introduced in this section, in Sections 3.4 and 3.5. 19 3.2 Motivating Example Throughout this section first we model the scenario of the two vehicles approaching an intersection, and then we prove that it is consistent with the model that we have defined in Definition 7 and satisfies Assumptions 1-3. We denote the position and the speed of the following vehicle (FV) by Xf and Vf, respectively. Similarly the position and the speed of the preceding vehicle (PV) are represented by x, and Vp, respectively. We denote the control input to the FV by u and the disturbance input term of PV by d. The deceleration due to the road load (rolling resistance) and the slope of the road on the FV are represented by a, and a, respectively, and the drag coefficient is denoted by C. We also impose a condition that the speed of both PV and FV must be non-negative. We use the superscript T to denote the transpose of a vector or matrix, e.g., AT represents the transpose of matrix A. The dimension of a vector space S is represented by dim S. Using these notations for the continuous form of the state space model of the system we have x E X C R 4 ,where x = (Xf, Vf , X,, V,) T , (3.1) u E U c R, where U ={u I u E [um, u]}, (3.2) d E R, (3.3) f : X xU x R-+ X,where = f(x, u, d), (3.4) with f(x, u, d) = (f1 (X',u),f2 (X2, d)), X1 = (xf, vf)T, x 2 = (x rvP)T, (3.5) where fl(x1 u){ f(xiu) 0 f22 d) =. f (2 2 ,d) 0 20 if vf > 0 if Vf 0 if v, > 0 if vP 0 and (3.6) The functions f'(x', u) and f 2 (X2 , d) are also in the following forms: (2,d)= vand f'(x',u)= U - CV2, - a,. - a, P axp + bv, + d (3.7) The term ax,+ bvp+d is the acceleration of PV. We assume that d ~ N(p, O.2 ), which is consistent with Assumption 3. Since we cannot measure the acceleration of PV, we build a model that estimates it from the states of the system, the position and the speed. The parameters a, b, p and a can be extracted through an optimization problem. More details of the acceleration model along with the optimization problem will be provided in Section 3.7. We can write (3.1)-(3.7) as the parallel composition of the two systems El (X 1 ,U, 0, 01, f 1 , h') and E 2 and x 2 = (X 2 , , A, 0 2 , f 2 , h 2 ), where x1 = (xf, vf)T E X C R 2 (xP,v,)T E X 2 C R 2 , with X = X1 xX 2 , u E U = [urn, uM] C R, d E A = R, y =xf E R, y 2 = x, E R, hl(x') = (1, 0)x' and h2 (X2) = (1, 0)x 2 .The vector fields f'(x1 ,u) : x U -+ X1 and f 2 (2 2 , d) : X2 X A -+ X 2 will then take the forms f'(xf1 ,)zU) = f(x ,u) 1 0 if dhl(xl) > 0 (3.8) , if dhl(xl) < 0 and P (X2 P2(X2,7 d) 0 if d2(2,d), dh 2 (X2 dt2(X2> 0 2 (x2 )<0 if jh dth~)< (39 (3.9) with fP(Xi, u) and f 2 (X 2 , d) as defined in (3.7). This model is consistent with Definition 7. Since A' = 0 and U 2 = 0, we represent flow of the systems El and E2 with q 1 (t, x 1 , u) and # 2 (t, X 2 , d), respectively. Throughout the rest of this section we prove that Assumptions 1 and 2 are valid for the scenario of two consecutive vehicles approaching an intersection. Assumption 1 states that El must have input/output order preserving property with respect to the control input signal, meaning that 21 := h'(#1(t, x, u)) = 01(t, x, u) must be order preserving with respect to the Xf(t) control input signal u. We prove that not only xf(t), but also Vf(t) := (t, x, u) has order preserving property with respect to the control input signal. The order preserving property of vf(t) is not necessary for consistency of the model with Definition 7, but it is required in order to satisfy another property that will be discussed in Section 3.3. Proposition 1. The flows 1(t, x, u) = x 1 (t) and q1 (t, x, u) = vf(t) of the system defined in (3.1)-(3.7) are order preserving with respect to-the control input signal u. > u2 , Proof. If we consider two different control input signals ul and u 2 , such that ul then for the velocity of PV at time t corresponding to these two control input signals, with the same initial conditions xf,l(O) Vf (0), we have i'f,1(t) = = Xf, 2 (0) = x1 (0) and vf,1(0) ui(t)-CVj,1(t) 2 -a,-aa and if,2 (t) if both vf,1(t) > 0 and Vf,2(t) = > 0. Let the function g(t) u2 (t)-CV = 2 Vf,2(O) = (t)-ar-a, Vf,2(t). Vf,l(t) - At an arbitrary time t we have = 7(t) fn,1(t) - ')f,2(t) = (ui(t) - u 2 (t)) - C (vf(t) - vf, 2 (t)) . (3.10) - Note that since we have chosen the same initial conditions, we have g(0) = vf,l(0) vf,2(0) = 0. Because of the continuity of flow of the system with respect to time, if order in state vf is not preserved, we must have a time t' E R+ such that g(t') = 0, since otherwise for all t E R+, either g(t) < 0 or g(t) > 0. Therefore we can define t* min{t E R+ Ig(t) = 0}. Since y(0) = u1 (0) -U 2 (0) > 0, 4(t*) = ui(t*) -u 2 (t*) > 0 and g(0) = g(t*) = 0, for the interval t E (0, t*) we have lim g(h) - g(0) NO)- h-+O+ h- 0 - lim g(h) > h-+o+ h since h > 0 : 3 h = hi E (0, t*) s.t. g(hi) > 0, and similarly . gt)= lim h-+- g(t*) - g(t* + h) ==-lim g(t* + h) > 0 = t* - (t* + h) h-+0h 22 (3.11) since h < 0 : - h = h 2 E (0, t*) s.t. g(h 2 ) <0, ( (3.12) and because of the continuity of the flow with respect to time, there is a t E [hi, h 2] such that g(t) = 0, which is in contradiction with the initial assumption that t* min{t E R+ I g(t) that Vf,l(t) > 0 and vf,1(t) - Vf,2(t) = 0}. Therefore there is no such t*, and for all t E R+ such > 0 we have either g(t) = vf, 1 (t) Vf,2(t) Vf, 2 (t) > 0 or g(t) = < 0. From (3.11) we conclude that the former is true. We had assumed initially that vf,1(t) > 0 and t' E R+ we have Vf,l(t') = 0 and and f2 = min{t E R+ and vf,l(t) - - Vf,2(t), then g(t) = Vf,l(t) - I Vf, 2 (t) = vf,2(t') = if t E [f4, oo), then g(t) 0, we let fi := min{t E R+ I Vf,1(t) = 0} 0}. Because of the non-negativity of Vf,l(t), we must have Vf,2(t) > 0. For a case that for some Vf,2(t) > f2 < fl. If an arbitrary time t such that t E (0, t 2 ), 0; If t E [f2, f4), then Vf,1(t) = Vf,l(t) - Vf,2(t) Vf,2(t) - Vf,2(t) = vf,i(t) > 0; And = 0. Therefore, in any case the order of the flow of the velocity is preserved with respect to the control input signal. Since Xf,l(0) = Xf,2(0) = xf(0), then based on equation (3.7) Xf ,(t) - xf,2 (t) = f g(s)ds > 0, which implies that the order preserving property of the flow of xf is also satisfied with respect to the control input signal. In Proposition 2 we will prove that Assumption 2 is also valid for our motivating example, meaning that x,(t) h 2(q 2 (t, x, d)) = #2 (t, x, d) is strictly order preserving with respect to d. Proposition 2. For the system in the form of (3.1)-(3.7) the flow 2(t, x, d) x,(t) is strictly order preserving with respect to d. Proof. Let Xo := (xf,of,o, XO,, vp,o)T be the initial condition, where vf,O > 0 and v,,o > 0. According to Assumption 3 we have d(t) = d where d ~ (p, a2 ). From equations (3.6) and (3.7) we have that the velocity of PV, for v,(t) > 0, satisfies the following differential equation: VP - bp, - avp = 0 where v,(0) = v,,o and i),(0) = axp,o + bvp,o + d. 23 (3.13) The above differential equation has the solution in the form v,(t) = kieAlt A, = + k 2 eA2t 0.5(b + V2 +4a) and A2 = where, 0.5(b - Vb2 +4a). (3.14) Since complex and real values of A, and A 2 reveal different behaviors for vp(t), we consider different possible cases and analyze the behavior of xp(t) with respect to d for each of them. We divide the problem into three different cases; (1): b 2 + 4a > 0, (2): b 2 + 4a < 0 and (3): b 2 + 4a = 0. For each case we consider two disturbance signals d' = d' and d2 = d2 such that d' > d2 and determine the relationship between v (t) and vj(t) and then between 1(t) and x4(t), the velocity and the position of PV at time t corresponding to d' and d2 , respectively. Case (1): If b 2 + 4a > 0, then A, and A 2 in (3.14) are real numbers. The solution of (3.13) then takes the form v,(t ) = A((vpo( - b) - ax,o - d) e lt - (v,o(Al- b) - ax,O - d) eA2t) (3.15) If we replace d in equation (3.15) with d and d2 in order to obtain their corresponding velocities at time t, represented by vo(t) and v (t), respectively, we have _,(t V2 v-(2t -=- _exl3.) 16)t). (eA2t A A Note that (3.16) can become zero only when t = 0. Therefore because of the continuity of flow of the system with respect to time, for all t E R+, either v,1(t) - V (t) > 0 or vi(t) - v (t) < 0. To determine which of these two cases holds, we note that in general for any x E R - {0} we have that if x > 0, then ex - 1 > 0 and if x < 0, then e' - 1 < 0. These two statements together imply that '-I A2 - Al #A 0 and we are considering t E R+, then (A 2 - Al)t 24 > 0. Since in Case (1) # 0. Therefore we can replace x with (A 2 - Al)t. e(A2-A1)t 1 - e(A2-A1)t -> 0 => te*lt d (A2-~ 1 - > 0 => eA2 eA eAt > 0 = IdA-2jtIA2-A -j d'- A2(eA2t _ eXit) > 0 => V (t) > v (t), (3.17) where we have used the facts that t E R+, eAli > 0 and d' - d2 > 0. By integrating both sides of (3.17) to determine the position of PV at time t, we obtain t t fov2 (u) du= 0vP (u) du > Xp,0 + tv,(u)du > xp,, + j0v(u)du xpj(t)> x2(t). (3.18) Case (2): If b 2 + 4a < 0, then A1 and A2 in (3.14) are complex numbers. The solution of (3.13) then takes the form vP() = eat (ax,o + (b - a)v,o+d s with a =.0.5b, and #= t + vO Cos 0.5N/-(b 2 + 4a). (3.19) If we replace d in equation (3.19) with d' and d2 in order to obtain their corresponding velocities at time t, represented by v1(t) and vP (t), respectively, we have ve(t) _v(t) =d at sin ,t. (3.20) We observe that in Case (2), unlike Case (1), we cannot guarantee that for all t E R+, v (t) - v2(t) # 0. Note that V1(t) - v2(t) = 0 for all t such that sin/#t = 0 or alternatively, 3t = k7r, for all k E Z. The smallest t E R+ that satisfies sin #t = 0 is C* = 0. The velocity of PV at time V* corresponding to d' and d 2 , based on equation (3.19), is given by v,'(t*) = at* cos(3 vp,oe~t = -v,oe a* <0<for i E1,2}. (3.21) 25 Since for all t E R+, vp(t) > 0, we must have vp'(t*) = 0, or in other words, for all t E [0,tt*] we have either vp(t) - v2(t) > 0 or vp(t) - v2(t) < 0. determine which case holds, we note that for all t E [0, t*] we have In order to f > 0 and 0 < sin ft < 1. Therefore in any case, for all t E [0, t*] we have 21n3t > 0. Also eat(d' - d2) > 0. These two statements along with (3.20) imply that v (t) -v,(t) > 0. Since in (3.19) we have VP(0) = v,,o > 0 and v2(t*) = -vp,oe*t* < 0, then because of the continuity of flow of the system with respect to time, there is a f E (0, t*) such that f:= min{t E (0, t*) I v (t) = O}. Then we have for all t E (0,), v, (t) - v (t) > 0. For a t E (0, 0, we have x (t) - x (t) = j(v(u) - vp(u))du > 0; (3.22) For a t E [i, t*) we have t x (t) - (t) = x t (v, (u) 0 + J(v (u) - - (v (u) - v (u))du > v (u))du + v (u))du > 0 => 4(t) - x (t) > 0; (3.23) and for a t E [t*, oo), we have X4(t) (t) - (v (u) =J - v (u))du+ f(v (u) - v (u))du = J;* (v (u) - Vo(u))du + 0 > 0 => X (t) - X (t) > 0. (3.24) Case (3): If b2 + 4a = 0, then A, = A2 = A, which is also a real number. The solution of (3.13) then takes the form vp(t) = eA't [vp,o + (axp,o + (b - A)vp,o + d) t], (3.25) and for v (t) - v2(t) we have v (t) - v (t) = t(d' - d2)et > 0, 26 (3.26) which implies I(t) 4(t) (v (u) - v2(u))du > 0. (3.27) We had assumed initially that v (t) > 0 and v2(t) > 0. In general we may - = have a time t* such that v (t*) = 0 and v,2(t*) = 0. In this case, because of the continuity of flow of the system with respect to time, there are times fi and that fi = sup{t E (0, t*) I v, (t) > 0} and f2 f2 such = sup{t E (0, t*) | v (t) > 0}. Since we have proved through Cases (1)-(3) that as long as vo(t) > 0 and v (t) > 0 we have v (t) - v2(t) > 0, then f2 < f. For an arbitrary time r E (0, f2 ) Cases (1)-(3) imply that x (r) - x(r) > 0; If r E [2, [1),then x (r) - X (r) = (v (u) - v2(u))du + J(v (u) - 0)du > 0; (3.28) And if T E [f, oo), then , (r) - x (r) = j (v (u) - vp(u))du+ J (v (u) - 0)du+ L and the proof is complete. 3.3 (0-0)du > 0, (3.29) Problem Formulation Before formulating the problem we define the bad set. Definition 8. For a system with the states x E X, the bad set, B, is a subset of the space of the states, B C X, that the system should never enter, that is, for all t E R+, x(t) B. Because of the restrictions that we have on our control input, u E [um, UM] C Rm, there is no guarantee that if an initial state of the system is outside of the bad set, it will never enter it. Therefore we need to introduce a game between the control input and the disturbance input such that the probability that the control input wins, which means not entering the bad set, is a given value P. Our main goal is to design 27 a control strategy that guarantees success of the control input P% of the time. We use Pr(.) to denote the probability and p(.) to denote the probability density function. . We represent signal of the states of the system by x E S(X), where X := X' x X 2 We denote a static feedback map with 7r : X -+ U. With these notations, the flow of the system with feedback map 7r, initial condition x and disturbance signal d, is represented by #(t, x, u, d) such that u = 7r(x). The complement of a set C C X is denoted by Cc, defined as Cc := {x E X I x V C}. The bad set that we are considering has the following form: Assumption 4. The bad set is in the form 1 1 B=U_ 1 {xEX | G3(x1) >g}U {xEX I Ch (x ) - B1 2 h2 2) > H}, (3.30) B2 where C' and C2 are r x dim(01) and r x dim(02 ) matrices, respectively, with ci,3,c?,3 0. hl(xl) and h2 (x 2 ) are as defined in Definition 7, H is a r-dimensional vector, the functions Gj are such that Gi(x') : X -+ RP' and g9s are p3-dimensional vectors. We impose one more assumption on function Gj before formulating the control problems. Assumption 5. The map G(xl) = G3(q1(t, x1(0), u)) : U -+ RP!, for E {1, ... ,N}, is an order preserving map. The two following problems concerned with the P% safety of the system introduced in Definition 7 must be solved. Problem 1. For the system E = E1||E2, defined in Definition 7, with Assumptions 1-5 and P E (0,1), find the open loop maximal safe set given by W := {x E X 13 u E S(U) s.t. Pr(#(t, x, u, d) V B, Vt E R+ and Vd E R) Problem 2. For the system E = > P}. 1||E2 defined in Definition 7, with Assumptions 28 1-5 and P E (0,1), find the control map ir : X -+ U such that for all x E W we have B,Vt E R+ and Vd E R) > P where u= ir(x). Pr(<b(t,x, u, d) We have proved in Section 3.2 that the scenario of the two consecutive vehicles approaching an intersection is consistent with the system defined in Definition 7 and Assumptions 1-3. The bad set for the scenario of the two consecutive vehicles approaching an intersection, based on equation (1.1), is in the form B = {x B = {x E X I xf > St and vf > vT} U {x E X I x E X I (xf,vf )> (St,vT)T} U {x E X I xf B1 - xf - x, < } => > -- }, (3.31) B2 for given St, VT and 6 representing the position of the intersection, the maximum allowable velocity at the intersection and the minimum allowable distance between vehicles, respectively. The set B1 corresponds to those states of the system that puts FV at the intersection with a velocity higher than VT and the set B 2 corresponds to those states of the system that leads to collision between PV and FV. If we let C1 = C2 = 1, H = -6, G1(xl) = x 1 , g1 = (St, vT) T and N = 1, we observe that the bad set can be written in the form assumed in Assumption 4. We have proved in Proposition 2 that the flows of xf and vf are order preserving with respect to the control input signal, therefore since G'(x') = X1 = (x1 , vf)T, Assumption 5 is also valid for our motivating example. In the next two sections we will solve Problems 1 and 2. 3.4 Solution to Problem 1 Before proposing the solution to Problem 1 we need to define the capture set. Definition 9. For the system defined in Definition 7, with Assumptions 1-5, the Psafety capture set (P E (0,1)) for a given control input signal u 29 E S(U) is the set of states, x E X, defined as C.(P) := {x E X I Pr((t,X, u, d) V B, Vt E R+ and Vd E R) < P}. Lemma 1. The P-safety capture set of a given control input signal u E S(U), for the bad set in the form of (3.30), can be written as Cu(P) ={x E X I Pr (Vt E R+ and Vd E R, C'h(#1(t, x 1, u)) - C 2h 2 ( 2 (t, x 2 , d)) ; H) < P} U Ix E X I 3t E R+, 3j E {l, ... ,7 N} s.t. Gi (#1(t, x1 , u)) > gj Proof. The bad set based on (3.30) is B = B1 UB2 . According to Definition 9 P-safety capture set for input signal u for this bad set is Cu(P) = {x E X I Pr(#(t, x, u, d) #(t, x, u, d) B1 A B2 , Vt E R+ and Vd E R) < P}. (3.32) Let the set S be defined as S := {x E X I 3t E R+ and 3d E R s.t. #(t,x,u,d) E B1 } = Ix E X I 3t E R+, 3j E {Il... N} s.t. Gj(# (t, x1, u)) > gi } . (3.33) We can rewrite (3.32) in the following form in which Sc {x E X I x 0 S} represents the complement of the set S. Vt E R+ and Vd E R) < P} = {x E S V B1 A #(t, x, u, d) I Pr (#(t, x, u, d) Vt E R+ and Vd E R) < P} U {x E Sc 30 VB 2 0 B1 A #(t, x, u, d) 0 B 2 I Pr (#(t, x, u, d) , I Pr(q(t, x, u, d) , Cu(P) = {x E S U SC 0 B1 A #(t, x, u, d) B2 , Vt E R+ and Vd E R)<P}. (3. (3.34) If x E S, since from Assumption 4 for all j E {1, ... , N} the function Gi is not function of the disturbance input d, then from (3.33) we have Pr(#(t, x, u, d) ( B1 , Vt E R+ and Vd E R) = Pr(Vj E {1, ... , N}, Vt E R+, Gi(#(t, x, u)) < gi) = 0. (3.35) Therefore if x E S, from (3.35) we have Pr (#(t, x, u, d) B1 A #(t, x, u, d) B2 , Vt E R+ and Vd E R) = 0 < P, (3.36) which is true for all P E (0, 1). This implies that (3.34) can be written in the following form: C.(P) = S U {x E S' I Pr ((t, x, u, d) 0(t, x, u, d) B1 A B2, Vt E R+ and Vd E R) < P}. (3.37) If x E Sc, then from (3.33) we obtain Pr(#(t, x, u, d) B1, Vt E R+ and Vd E R) = 1, (3.38) which is independent of the event 0(t, x, u, d) E B 2 . This implies that if x E Sc, then B 1 A #(t, x, u, d) V B 2 , Vt E R+ and Vd E R) Pr (#(t, x, u, d) ( B 1 , Vt E R+ and Vd E R) .Pr(#(t, x, u, d) = B2 , Pr (#(t, x, u, d) , Vt E R+ and Vd E R) = Pr (O(t, x, u, d) V B2 , Vt E R+ and Vd E R) (3.39) where to obtain the last equality we have used equation (3.38). From equations (3.37) and (3.39) we have Cu(P) = S U {x E S I Pr(#(t, x, u, d) V B 2 , Vt E R+ and Vd E R) < P}. 31 (3.40) Since we know {x E S I Pr((t,x,u,d) V B 2 , VtER+ and VdER) <P} CS, (3.41) and S U S' = X, then we can write (3.40) in the form Cu(P) = S U {x E X I Pr((t, x, u, d) V B 2 , Vt E R+ and Vd E R) < P}. (3.42) If we replace S with its definition from (3.33) and use the definitions of B1 and B2 from (3.30), we can write equation (3.42) in the form of the statement of the Lemma. 13 Lemma 2. Let Ftxu(d) := Clh'(q1(t, x 1 , u)) -- C 2h 2 ( 2 (t, x 2 , d)), and (Ft",U)-'(s) := {d E R I Fj'x'u(d) = s} with Ft,'U and (Fj'x')-1 denoting the ith component of Ftxu and (Ft*x'u)~, respec- tively, and let the pair (t*, i*) (not necessarily unique) be (t*, i*) = arg min VtER+ ViE{1,...,r} Pr (Vd E R, d > (Fj'x)-1(Hj)), then we have {x E X C2 h 2 (02 (t,x2 , d)) < H) < P} = {x E X H. < F '"(p + -Q- (P)) . Pr (Vt E R+ and Vd E R, Ch(1 (t, x , u))- Proof. Since based on Assumption 2 the function h 2 (X 2 ) = 4 2 (t, x 2 , d) is strictly order preserving with respect to d, then based on Assumption 4 C 2 h 2 (x 2 ) is also strictly order preserving with respect to d and since h'(xl) is not function of d, then Ftx'u(d) = Clhl(xl) - C 2 h2 (X 2 ) is a strictly decreasing function of d and therefore 32 invertible. Using this property we have Pr (Vt E R+, Vd E R, C'h'(O'(t,x', u)) - C 2 h2 (q 2 (t,x2 , d)) H) = H) = Pr (Vt E R+, Vd E R, Fxu(d) Pr (Vt E R+, Vd E R, Vi E {1, ... , r}, Fxu(d) :H) = Pr (Vt E R+,Vd E R,Vi E {1, ... ,r}, d > (Fit")- 1(Hi)) = Pr (Vd E R, d > = (Fj'"tu)~1(H) Pr (d E R, d > (Fit") 1 (Hi)) (3.43) , min VtER+ ViE{1,...,r} max VtER+ and using the definition of (t*, i*) we have min VtER+ Pr (Vd E R,d (Fjt'x'u)-1(H))=Pr VdERd>(Ft.''x')- (Hj) ViE{1,...,r} (3.44) In order to find a relationship between the disturbance input and the desired safety level P, we define the Q function as Q(z) j := Since based on Assumption 3 d = d - 0 0.582 ds. N(p, a2), using (3.45) Q notation and equation (3.44) we have that if Pr(Vd E R, d > (Fj>.*'')-1(Hi.)) < P, then Q (F.*''")-( ) - p < P. (3.46) 01 Since Q(z) = 1 - 4b(z) where 4 (z) represents the c.d.f. (cumulative distribution function) of the standard normal distribution, the 33 Q function is strictly decreasing and also invertible. Therefore equation (3.46) can be written as (*''")-1(Hi*) - I > Q- 1 (P) => (F''"x)-1 (Hi.) > p + oQ'(P), a s (3.47) and since FE.>''" is a strictly decreasing and invertible function, then Hi* < F.t*'XU(p + -Q-1 (P)), (3.48) and the proof is complete. The following theorem provides a solution to Problem 1. Theorem 1. For the system defined in Definition 7, with Assumptions 1-5, x E W if and only if x 0 Cum(P). Proof. (<=) If x V Cum(P) then x E Cucm(P). Therefore Pr(#(t,x, um, d) V B, Vt E R+, Vd E R) > P, (3.49) which implies that x E W. ( (=>) If x E W, then there is control input signal u' E S(U) such that Pr(#(t, x, u', d) B,Vt e R+,Vd e R) > P. If we replace the relation "<" in Definition 9 with the relation ">" and use the results of Lemma 1 and Lemma 2, for x E W we have that there is control input signal u' E S(U) such that Pr (Vt E R+ and Vd E R, Clh(# 1 (t, xI, u')) - C2h 2 ( 2 (t, x 2 , d)) and Vt E R+,Vj E {1, ... , N} G3(# 1 (t, x1, u')) We prove that x gi. H) > P (3.50) C.m (P). Assume that by contradiction x E Cum (P), then we have Pr(#(t, x, um, d) B, Vt E R+, Vd E R) < P. Therefore x E Cum(P) based on Lemma 1 implies 1 Pr (Vt E R+ and Vd E R, Ch (0(t, x, um)) _ C 2 h2 ((t, 34 x2 , d)) H) < P or tER+,j E l, ... N} s.t. Gi(ma(t, x1, um)) > gi, (3.51) which based on Lemma 2 implies that or 3t E R+, 3j E {1, ... ,I N} SAt. Gi (0'(t, x', um)) > gi, (3.52) Pr (Vd E R, d > (F"XzUm)-1(Hi)) (3.53) where min . (t*,i*) = arg VtER+ ViE{1,...,r} If x E Cum(P), then based on equation (3.52) we can consider two cases. Case (1): Hj. < Fjt*,x,um(p + oQ-'(P)); Case (2): There is a time t E R+ and a j E - {1,) ... ,I N} s.t. Gi (#1(t, x1,I um)) > gi Case (1): If x E W then according to (3.50) and Lemma 2 there is a control input signal u' E S(U) such that Hit > F,'''U'(p+ aQ 1 (P)) where min VtER+ Pr (Vd E Rd > (Ft"u')-1(Hi)) (3.54) . (t', i') = arg ViE{1,...,r} Note that the pair (t*, i*) is not necessarily the same as (t', i'), but if Pr(d > P (which is equivalent to RI / > F,'' '"'(p + aQ-'(P)) based (F,'')-(Hi)) on Lemma 2), then according to (3.54) we also have Pr(d > (F*',x'')-1(Hi*)) > P (which is equivalent to H > F.*''"'(p + aQ'(P)) based on Lemma 2). This result along with the equation Hj. < F.*,x,Um (p + aQ- 1 (P)), which is the main assumption in Case 1, imply + aQ-(P)) <; H . < Fit.*:'(p+ oQ- 1 (P)) => dim(0 2 ) dim(Q') *j,lh C*,k) 35 02(* I2 -2 dim(0 1 ) ) dim(02 c,h2 (2(t*2 , 2 ,L + oQl(P))) Cl.,*khk(#1 (t*, X1, Um)) k=1 1=1 dim(01) C .,k [h'(#1(t*, xl, u')) - h'(#1 (t*, xl, um))] < 0. (3.55) k=1 Since um is the minimal control input and based on Assumption 1 h' is an order preserving function of the control input signal u, then for all k E {1, ... , dim(0 1 )} we have h)i(l(t*, 1 , u')) - h h)(#1(t*, x1, um)) > 0. In turn, from Assumption 4 we have that cij > 0. These two statements together contradict (3.55). Therefore we must have Hi. > Fb.*,xum(p+ OQ-1(P)). Case (2): If x E Cum(P), then we must have a time r E R+ and a j E {1, ... , N} such that Gi (#1 (r, x1, um)) > gi. Because of the order preserving property of the function Gi (q1 (r, x 1 , u)) with respect to the control input signal based on Assumption 5, for all u E S(U) we have G (01 (r, x1, um)) Gi (1(T, Gi(1(-, x1 , u)). Therefore if x1, um)) > gi, then we also have G (#1(r, x1, u)) > gi for all u E S(U). Since x E W, based on (3.50) there is also a control input signal u' E S(U) such tlhat Vt E R+,Vj E {1, ... , N} : Gi(#1 (t, x1, u')) 5 g'. (3.56) Since equation (3.56) is for all t E R+, then Gi(# 1 (r, x 1 , u') 5 g3 , which contradicts our previous statement that for all control input signals u E S(U) we have G(1(r, x1, u)) > gi. Therefore there is no j E {1,...,N} and t E R+ such that Gi (1 (-r, x1, u)) > gi. Since none of the assumptions of Case 1 or Case 2 are valid, then we must have Hi. ;> F.*,xum(p + o-Q-1(P)) and At E R+, Aj E {1, ... , N} s.t. Gi(#1 (t, xl, Um)) > gi, therefore x 0 Cum (P). (3.57) E 36 Solution to Problem 2 3.5 We consider the feedback control map r(x)= Cum(P)U .. OCum(P) U if x UM if x E Cum(P)U &Cum(P) and state the following theorem. Theorem 2. For the system defined in Definition 7, with Assumptions 1-5, for all x EW the feedback map r : X -+ U, as defined in equation (3.58), guarantees that Pr(#(t, x, u, d) BVt E R+,Vd E R) P, where u= u([O, t]) =ir(x([O,t))). Proof. We consider two different cases. Case (1): If for all t E R+ we have #(t, x, u, d) Cum (P), where u E S(U) is an arbitrary control input signal, then based on Theorem 1 for all t E R+, x(t) = #(t, x, u, d) E W, and since W n B = 0, then Pr(#(t, x, w(x([O, t))), d) B, Vt E R+, Vd E R) = 1 > P and the statement of the theorem is satisfied. Case (2): If there is a time t* E R+ such that x(t*) = #(t*, x, u, d) E Cum(P), then because of the continuity of flow of the system with respect to time, there is a time f := sup{t E (0, t*) I 4(t, x, u, d) Cum (P)}, where we have also used the fact that based on Theorem 1 x = x(0) E W implies that x #(f, X, U, d) E OCum(P). Assume that by contradiction O(f, x, u, d) Cum(P). We prove that Cu,(P). Since C = Cl(C) n Cl(Cc), where Cl(C) represents the closure of the set C, O(f, x, u, d) Cum (P), #(t*, x, u, d) E Cum (P), and the flow is continuous with respect to time, then there is a time t' E (f, t*) such that Cum (P) is an open set, then t:= sup{t E (0, t*) I #(t', x, u, d) (t, x, u, d) #(t', x, u, d) E Oum (P). Since the set Cum (P), which contradicts the fact that Cum(P)}, therefore #(, x, u, d) E OCum(P)- In order to guarantee that in Case (2) the control feedback map (3.58) provides the minimum P%, we divide Case (2) into two different subcases which we refer to as Subcase (2-a) and (2-b). In Subcase (2-a), for all t > f we have x(t) E Cum(P) U 9Cum(P). Therefore according to (3.58) for all t > i we have u(t) = um. Since x() = O(, x, u, d) 0 Cum(P), then we have Pr(#(t, x(), um, d) V B, Vt > f, Vd E R) > P 37 and for all t < f we have x(t) E W or alternatively Pr(#(t, x, u, d) V B, Vt < t) > P. Therefore for the Subcase (2-a), the following control signal U if t E [0,7t ifte[O=)(39) Uum) U if t E [f, oo) will guarantee the minimum P% safety. In Subcase (2-b), we assume that there is a t > f such that i (f, oo] I #(t, x(t), um, d) inf{t E V Cum(P) U OCum(P)}- According to (3.58), u(i) E U. If for all t > i we have that #(t, x(i), u, d) V Cum(P) U aCum(P) in which u is an arbitrary control input, then based on similar analysis as in Case (1), the minimum P% safety for t > t is guaranteed. Also if there is a time t > t := inf{t > i such that 1O #(f, x(i), u, d) E Cum(P) U aCum(P)}, then based on the similar analysis as in Subcase (2-a) we conclude that the minimum P% safety for t E [t, t) is satisfied and the control map for t E [0, t) will be u(t) U if t E [0, 0~ um if t E [f,) (3.60) U if t E [i, i) Also for t > t we can divide the problem into two subcases as in Subcases (2-a) and (2-b) and then we can guarantee that the minimum P% is satisfied. 3.6 Algorithms In this section we propose the algorithms to calculate the control map suggested in Section 3.5. Theorem 3. Let dim(01) 2 ) dim(0 Ckh1(#1(tx 1 ,um)) - max ViE{1,...,r} L k1 ci,h2(# 2 (t, x 2 ,d)) 1 38 - Hi (3.61) where d = L + uQ- 1(P), then necessary and sufficient conditions for state x E X such that x 0 and GiQ#k(t,x 1 ,um)) Cum (P) is to have Fl''*'"(d) gi for all j E {1, ... , N} andt E R+Proof. From Lemma 2 and Theorem 1 we know that a necessary condition for x Fit*,,um(, + oQ-1(P)), which can be expanded in the form Cum(P) is H . dim(0 2 ) dim(O) -Hi. < ShJ(#1(t*, x 1, um)). (3.62) k=1 If dim(0 2 ) dim(O') mi, VtER+ l2 (02 Ci,kh(1(t , xuum)) 2 + Hi > 0, (3.63) k=1 ViE{1,...,r} then because of the strictly increasing property of the function -Ft,X,um (d) + Hi (the expression inside the bracket) with respect to the disturbance input signal d, we have Vt E R+, Vi E Il, ... ,r}, V d > j: ] dim(0 2 ) dim(02) 2 c 1h (# (t,x , d)) chh1(#1(t, x 1, um)) + Hi - 2 k=1 Therefore if we choose the pair (t*, i*) such that > 0. (3.64) dim(O1) (t*, i*) = arg max ci h1(O1(t,X1, uM))- VtER+ ViE{ 1,...,r} k=1 ) dim(0 2 S,1 C=1 1(02(t, X2,L+ O-Q- (P))) - Hi (3.65) then a necessary condition for an initial condition x to be outside of the capture set is i.*,Xm () = F.*,xUm(d) - Hi* < 0. Another necessary condition for a x E X such that x 0 C um (P), based on Lemma 1, is that for all j E {1, ... , N} and t E R+, we have G (#1(t, x 1, um)) < gi. According 39 to Lemma 1 and Lemma 2, this condition along with Ft*,x,m (d) 0 are also sufficient conditions for a state x e X in order that x 0 Cum(P)- Algorithm 1: Control Feedback Computation + -Q-o1(P) corresponding to P safety using Gaussian z-table [17]. 2: For i E {1, ... , r} calculate F''x,um (d) = maxtER+ [Zdimo =( 2 ) c11 hf(# 2 (t, x 2 , d)) Hi], where x - = C;,khk(# (t, 1 , Ur)) - 1: Calculate d= (x 1 , x 2 )T is the current state of the sys- tem. 3: For j E {1, ... , N} calculate G = Gi(#1 (t, x, um)) - gi. 4: If maxiE{1,...,r} F X (d) > 0 or there is a j E {1, ..., N} and there is a time t E R+ such that Gj > 0 return u = um, otherwise u E [UM, UM]. The domain t E R+ in steps 2 and 4 of Algorithm 1 can be replaced with a finite domain. This replacement will be helpful, in particular for termination of discrete algorithm that we will introduce in Algorithm 2. Assumption 6 states the required condition for this replacement. Assumption 6. The functions f 1 (x', u) and f 2 (x2 , d) of the system model in Definition 7 are in the following form. f 1(X1 , U) = f1( X7d1xU) if lh({) o if dhl(xl) > 0 0 and 2 f (x , d)F ( O and there is a finite time T 2 if h 2 (x 2 ) > 0 ,d) - if Ah2 (x 2 ) 0 E (0, oo) such that r = min{t E R+ I Ah1 (# 1 (t, X, un)) = 0}. Note that the functions f1 (x', u) and f 2 (X 2 , d) of system model of the motivating example, the scenario of two consecutive vehicles approaching an intersection, as 40 defined in (3.6), is in the above form. Moreover for a sufficiently small urn such that for all t E R+, urn - Cvf(t) - a, - a, < 0, since Vf(t) = iVU(t) = Ur - h 1((k(t, x 1 , urn)) and CVo(t) - a, - a,, we can guarantee that r is a finite time. Proposition 3. The interval t E R+ in the second and fourth steps of Algorithm 1 can be replaced with t E (0,r], where r = min{t E R+ | A h($1(t, x1 ,um)) = 01. Proof. Note that based on the system model in Definition 7 along with Assumption 6, for all t > r we have t'(t) = 0 1(t, x 1 , um) = 0, therefore C1-d hl(x(t)) - C2- h2(X2(t)) dt dt = (3.66) C1 JAi(X1 (t))'(t) - C2- h2(X2(t)) = -C2-h2(X2(t)), dt dt . We where Jhl(xl(t)) is the Jacobian of function h' defined as [Jhl(xl(t))]i, = 3 have that jh 2 (x 2 (t)) > 0 and also based on Assumption 4, C2 is a non-negative matrix. This implies that for all t > r, we have djt,,um (d) =-C 2 h2 (2 (t))X2 0 where FtxU- (d) is as defined in (3.61). Therefore Pt,X,um (d) takes its global maximum at a time t < -r and based on definition (3.61), that is what we are looking for to check whether the state of the system is inside the capture set. Also we have Vt > r, Vj E {1, ... , N}: dGi(xl(t)) = JGj(Xl(t))-' = 0, dt (3-67) where JGi (xl(t)) is the Jacobian of function Gj. Equation (3.67) implies that the function Gj, for all j E {1, ... , N}, takes its global maximum at a time smaller than r. Therefore we can replace the interval t E R+ with t E (0, r]. In order to implement the algorithm on a computer, we need the discretized version of Algorithm 1. We use the forward Euler approximation for discretization purpose. We use At to denote the time step size. We also denote the state of the system at step k by x[k] = (xl[k], x 2 [k])T. Therefore x(kAt) = x[k] where x(kAt) is the state of the system in the continuous-time model. All other notations are similar to the continuous-time model. The discrete-time model of the system defined in Definition 41 7, with Assumptions 1-6, is in the following form. x[k + 1] = x[k] + At(f(x[k], u[k], d[kj)), where f(x[k], u[k], d[k]) = (f'(xl[k], u[k]), f 2 (x2 [k], d[k])) T , (3.68) and f1 (x', u) = f 2 (xf2(X22 , d) d) = and ff(xi, u) 0 if h'(xl[k + 1]) - h1 (xl[k]) > 0 if h'(xl[k +1])- h1 (xl[k]) 0 If if h21(2[k + + 1]) - h 2(2[k]) []> > 0 2 2 if h (X [k + 1]) - h 2 (x 2 [k]) 0 M2,,d)d) 0 - (369) (-0 (3.70) . The discrete-time algorithm is in the following form: Algorithm 2: Control Feedback Computation (discrete version) 1: Calculate d = p+uQ-1(P) corresponding to P safety, using Gaussian z-table [17]. 2: For i E {1, ... , r} set Pf''X[01'U"' = C(,hl(xl[0]) - EZim(,02 , c2h2(x dim 2 [0]) - H and for j E {1, ... , N} set Gi = Gi(x 1 [0]) - gi, where x[0] = (Xl[0], X2[0])T is the current state of the system. Set k = 0. 3: Calculate x 1 [k + 1] = x1[k] + At(f1(xl[k], u[0])). 4: While -h1 (x'[k]) = dt [1(xAlk+1 > 0, At-h1(x1[k]) do: 4.1: Calculate x[k + 1] = x[k] + At(f(x[k], urn, j)) 4.2: For i E {1, ..., r}, if '"t +1]) - Hi, then Pf't*'x[O],U' + E =1< k k c1=1 hI(x2[k (01)Ci, hl (X1[k+ 1]) - I 2) c 2 (X2[k+1])- Hi. 4.3: For j E {1, ... , N}, if G = Gi(xl[k +1]) - gi > 0, return u = um and STOP. 4.4: k +- k + 1 5: If maxiE{1,...,,1P x*l',xI'," > 0, return u = ur, otherwise u E U. STOP. 42 3.7 Simulations and Data Analysis This section consists of two subsections. In Subsection 3.7.1, we provide details of the experimental setup including measurements, data gathering, details of location of experiments and etc. In Subsection 3.7.2 we provide details of data analysis and consistency of experimental results with theoretical model. 3.7.1 Experimental Setup In Figure 3.1 the path that is used for gathering data is depicted. This path is located Figure 3.1: The path that is used for experiment. in Ann Arbor, Michigan. The length of this path is 11 km and it consists of 30 study areas. The study area is defined as an area, approximately 300-400 m of the road, that the driver frequently reduces his/her speed in. A study area can be an intersection, a speed bump, or any region that requires reduction in speed. The data of any of these regions is used to construct the model. We use a computer software that after at least five courses of the path depicted in Figure 3.1, learns and saves the study regions in collaboration with GPS measurements, and then it ouputs the relative distance to the 43 stop sign St - xf and the target velcoity VT, whenever the system is inside a study area. We build a model for the disturbance input, the acceleration of PV, a,, as it + approaches an intersection, based on a linear function of the form ap(t) = ax,(t) bvp(t) + d with d ~ N(p, a'). We measure xf from GPS. Vf, a, and a, are also available from on-board sensors of FV. The value of a,, the deceleration due to rolling resistance, is constant and the value of a,, the slope of the road, is the average slope from the current position of FV until the stop sign. If we denote the difference between altitude (height) of the,current position of FV and the position of the stop sign by Ah, then a, is a. = -mg sin arctan St - Xf ), where mg is the weight of the vehicle. The signals Xrel = x, - Xf and (3.71) Vrel = VP - Vf are obtained from the radar. The control input urn is provided through the automatic brake in FV. There are two options to calculate the parameters a, b, p and a. We can either calculate these parameters from the data of FV (our vehicle) as it approaches an intersection and then use this model as the acceleration of PV, or we can use the data of radar, which provides the data of random preceding vehicles as they appear in front of FV. The drawback of using the first set of data is that we have less variety of drivers as opposed to the data of PV obtained directly from the radar which includes more assortments of driving styles. But the advantage of using the data of FV (first option) is that more data of FV are available and more importantly, the measurements of signals of FV are less noisy and more accurate. Since eventually the signals of PV, obtained from the radar, must be used for on-line computations, we will also compare the model built based on the data of FV with the signals of PV. This comparison is necessary, in particular, since the source of the two signals are different. 44 3.7.2 Experimental Results Profiles of FV near the stop signs are depicted in Figure 3.2. From the plots we can conclude that the assumption d - N(p, .2 ) (Assumption 3), the acceleration profile with a constant time independent variance, is reasonable, since the interval of observed accelerations (Figure 3.2-c) does not have a significant dependence on time. I I I I *mama *mowuipVm.Wip (a) (b) (c) Figure 3.2: Plots of profiles of the position, speed and acceleration versus time near stop signs for FV. From Figure (3.2-c) we conclude that the assumption of constant and time independent variance for the acceleration (Assumption 3) is reasonable, while for the position (3.2-a) and the speed (3.2-b) it is not a reasonable assumption, since the dependence of the interval of observed positions and velocities on time, is more significant than the accelerations. We have used the least square method to calculate the parameters a, b, p and o-. If we discretize the state space model of PV defined in f 2 (x 2 , d) of equation (3.7), for vp[k] > 0 we have xp[k + 1] vp[k + 1] 1 [ xp[k] + Atvp[k] vp[k] + At(axp[k] + bv,[k] + d) j (3.72) If we replace xp[k] in the second equation of (3.72) with xp[k - 1] + Atv,[k - 1], we obtain vp[k + 1] = a (Atxp[k - 1] + At 2 v [k - 1]) + (1 + bAt) vp[k] + dAt. 45 (3.73) We define the new parameters a' = a, b' = 1+ bAt and d' = d. Minimizing the mean square error for the speed leads to the following optimization problem: minlICX - D1 2 , where X = (a', b', c)T, (3.74) and C[1, 1] = Atx,[1], C(1, 2) = v,[1], C(1, 3) = At, for k > 2 : C(k, 1) = Atx,[k - 1] + At 2 v [k - 1], C(k, 2) = v,[k), C(k, 3) = At and D(k - 1) = vp[k]. The algorithm that we have implemented on the vehicle is as the following: Algorithm 3: Collision Avoidance Feedback Map (discrete version) 1: Calculate d= I + aQ- 1(P) corresponding to P safety, using Gaussian z-table [17]. 2: Set Pt*,xO],Um = xf[0] - x,[0] + 6 and set 6 = (x1 [0], vf[0})T x[0] = (xf[0], Vf[0], x,[0], VP[0])T - (St, VT)T, where is the current state of the system. Set k = 0. 3: Calculate (Xf[1], vf[1])T = (x[0] + Atvf [0], vf[0] + At(af [0] - CV2[0] - a, - a,))T, where af[0] is the current acceleration of FV. 4: While vf[k] > 0, do: 4.1: Calculate (xf [k+1], vj [k+1])T = (Xf [k]+Atvf [k], vf [k+At(Um-CV [k] -a,a,))T and (xp[k+1],vp[k 1]) T = (x,[k]+Atv,[k],vp[k]+ At(axp[k]+bvp[k]+j))T. 4.2: If Pt*,xIO],Um < xf[k+1]-xp[k+1]+3,then +- xf[k+ 1] -xp[k+1] +6. Ft*,x[O],Um 4.3: If 0= (xf[k + 1], vf [k + 1])T - (St, vT) T > 0, return 4.4: k +- = um and STOP. k+ 1 5: If Pt*,x[O],um > 0, return u = um, otherwise u E U. STOP. The data of FV as it approaches a stop sign is depicted in Figure 3.2. There are 421 trajectories plotted in each sub-figure. We use these data and the optimization problem (.3.74) to construct the model for PV, which includes the calculation of the parameters a, b, 1 and a. In order to verify that Algorithm 3 is consistent with our expectation, meaning that an algorithm designed based on a P% safety can save the vehicles from collisions 46 P% of time, we take advantage of the law of large numbers, according to which for an event x with mean M we have lim Xn Pr(n-+oo p 1 where Xn number of times event x observed in n trials n (3.75) We run an algorithm that generates an initial condition for FV and chooses a trajectory for PV among our available data, randomly, for n times. Based on the equation (3.75) for a large n we expect to observe approximately (100 - P)n number of collisions. The logic diagram of the algorithm is demonstrated in Figure 3.3. The result of running the algorithm for 10000 times is shown in Tables 3.1 and 3.2. In order to analyze the effect of the length of study areas on the performance of the model, we run the algorithm for different effective distances to stop signs, which we refer to as the activation region. The activation region has the unit of length and corresponds to the distance to the stop sign that the collision avoidance system is activated from. We observe that changing the activation region does not affect the safety very much. The average safety for all three cases, 70%, 80% and 90%, for the 100 m activation region model is slightly larger than the corresponding safety level of 400 m activation region. Safety level 70% 80% 90% Number of simulations 10000 10000 10000 Number of collisions 2777 1769 832 Empirical safety level 72.2% 82.3% 91.7% Table 3.1: Result of running the algorithm for 10000 times with activation region = 100 m, meaning that the control system is activated from 100 m before stop signs. Safety level 70% 80% 90% Number of simulations 10000 10000 10000 Number of collisions 2836 1992 1038 Empirical safety level 71.6% 80.1% 89.6% Table 3.2: Result of running the algorithm for 10000 times with activation region 400 m, meaning that the control system is activated from 400 m before stop signs. - In order to verify that the parameters are not overfitted, we must check how a 47 N Yes I Y No - N=0, number of collisions M=O, number of runs n: Number of tests igYs Yes No Figure 3.3: The algorithm to verify safety of the system. The algorithm does not count those randomly generated initial conditions that are inside the capture set, since this is not consistent with x E W which according to Lemma 1 is equivalent to x Cm (P). Also if the control input is never applied during a test, we exclude it, since the performance of the control map is not reflected in such situations that we do not use it. model that is constructed based on a limited set of data will respond to a new dataset. We take advantage of the k-fold cross validation method [18] for this purpose. In particular we use 10-fold cross validation method. In this method we partition our available data into 10 groups and solve the minimization problem of (3.74) for a pool of data that consists of 9 groups and then run the algorithm of Figure 3.3 for the data of the 10th group. We repeat this for all 10 groups and compare their average safety level with the expected safety level as we have done in Tables 3.1 and 3.2. The result is shown in Table 3.3. Since we have built the disturbance model based on the data of FV, we need to verify that it captures the behaviors of PV. Profiles of PV near stop signs are plotted in Figure 3.4. In Tables 3.4 and 3.5 we have shown the result of using the disturbance model constructed from the data of FV on the profiles of PV. From Tables 3.4 and 3.5 we observe that the behavior of PV cannot be captured by the model built based on the data of FV, for farther distances from stop signs. The reason for this can be either lack of sufficient data of PV in farther distances from stop signs or inability of the model to capture different behaviors of PV in farther distances. If the reason for the undesired behavior of the model at farther distances is 48 Safety level Group 1 Group 2 Group 3 Group 4 Group 5 Group 6 Group 7 Group 8 Group 9 Group 10 Average 70% 67.8% 69% 68.8% 72.1% 71.3% 69.8% 71.1% 68.3% 70.4% 70.3% 69.89% 80% 80.3% 79.8% 80.1% 81.3% 80.2% 78.3% 80.3% 79.5% 80% 80.3% 80.1% 90% 88.9% 90.3% 89.2% 92.1% 91.1% 90.5% 93% 92.1% 91.2% 88.9% 90.73% Table 3.3: Result of running the algorithm for 10000 times for all of the 10 groups within the available data. The activation region is 400 m, meaning that the control system is activated from 400 m before stop signs. We observe that the average safety level is close to the expected safety level. I I a ap (a) I (b) (c) Figure 3.4: Plots of profiles of position, speed and acceleration near stop signs for PV. Safety level 70% 80% 90% Number of simulations 5000 5000 5000 Number of collisions 1493 1008 447 Empirical safety level 70.2% 79.8% 91.1% Table 3.4: Result of running the algorithm for 5000 times for PV with the activation region = 100 m, meaning that the control system is activated from 100 m before stop signs. insufficient data, we can tackle this problem by obtaining more data of PV, otherwise the control system must be activated at a distance lower than 400 m from stop signs. 49 Safety level 70% 80% 90% Number of simulations 5000 5000 5000 Number of collisions 1984 1530 1156 Empirical safety level 60.3% 69.4% 76.9% Table 3.5: Result of running the algorithm for 5000 times for PV with the activation region = 400 m, meaning that the control system is activated from 400 m before stop signs. Figure 3.5 shows the plots of the plane ap = axp + bvp + p for 100 mi and 400 m activation region. The significant difference between the two planes indicates that the linear function ap = axp + bvp + d cannot cover all different stopping behaviors for a distance as large as 400 m. Therefore a smaller activation region must be considered for implementation. The diversity of stopping profiles at larger distances to stop signs in Figure 3.4-c also supports this fact. position (i)d Figure 3.5: The plots of the plane a, region. = ax,+ by,+p 1 for 100 m and 400 m activation We have implemented a hybrid control system on the vehicle that apart from Algorithm 3, it guides the driver to take the right control action using multiple levels of warnings and different stopping profiles (other than U =Urn). An important difference between this case and Algorithm 3 is that we must also consider a reaction time Menigthat both the system is activated from 100 m to the stop sign and the parameters are calculated with the data of 100 m before the stop sign. 50 to issue warnings, which consequently leads to larger capture sets and earlier actions (meaning that the warnings will be issued earlier than applying the automatic brake). With this hybrid model we can decrease the frequencies of applying automatic brake and let the driver collaborate with the control system through appropriate HMIs (Human Machine Interface). The frequency of switches between u E U and u = urn (the driver input and the automatic brake), in deterministic model is larger than the stochastic model, and moreover in the stochastc model the average number of switches decreases by decreasing the safety level. Since we are interested in having a higher safety level, we need to find a solution to the problem of frequent switches. We have used a hysteresis time for taking the control action. At any time that the system exits the capture set, instead of setting the control input to u E U, we turn on a counter that keeps the input u = ur, the automatic brake, on, until a certain interval of time is passed. Figure 3.6 shows the control input for the stochastic model with 98.8% safety without the hysteresis counter, and with the hysteresis counter, for the same initial condition and profile of PV. CL 0 5 10 15 20 time (sec) 25 0 30 10 15 20 time (sec) 2 30 Figure 3.6: The plots of the control input for the stochastic model with 98.8% safety without the hysteresis counter (left), and with the hysteresis counter (right), for the same initial condition and profile of PV. We observe that using the hystersis time we could reduce number of switches significantly. In the case of Figure 3.6, we could reduce the number of switches from 46 to 8. 51 52 Chapter 4 Conclusions and Future Works We have implemented Algorithm 3 on the vehicle and we have set the activation region= 100 m. The main advantage of the model that we have introduced in this work over the deterministic model is that it is more desirable for drivers, since it does not take control action from a large distance to the preceding vehicle. Here the large distance corresponds to a distance that is sufficiently larger than what drivers choose to apply brake. The basis of this model is mitigation of collisions in contrast to the deterministic model which is prevention of collisions. The plots of Figure 3.5 imply that some modifications of the model is necessary if we are interested in activating the system from a large distance to stop signs. One modification is changing the disturbance function a, = ax , + by , + d, from a linear model to a more sophisticated function. A piecewise linear function is a good option which can capture a variety of profiles that may not be captured using higher order functions. Unfortunately, in general, the strict order preserving property of x, with respect to the disturbance input d (Assumption 2) cannot be guaranteed with a piecewise linear model. A part of the future works can be investigating the additional constraints on the model that makes the piecewise linear function consistent with Assumption 2, or looking into other possible profiles for acceleration of PV instead of the linear function. According to the model that we have considered in this work, future possible profiles of PV can be uniquely determined of we know the current state of PV, its 53 position x, and velocity v,. In reality we know that there is also a third factor that determines the future profiles of PV, and that is the state of the driver. Not all drivers who are at St - x, distance to the stop sign and have the velocity vp follow the same behaviors for t E R+. A part of future works can be adding an estimator to the model that estimates current state of the driver of PV using the data of the state of the system from a couple of seconds ago until the current time, and according to that predicts the future profiles of PV. There are varieties of Bayesian estimators available that can be employed for this purpose. The study areas that we are considering in this work which we refer to as stop signs, consist of any regions that drivers frequently reduces their speed. A useful modification to the model is to branch the data based on the type of the stop sign. For instance we can build separate models for turning right at intersections, turning left at intersection, going straight at intersections, stopping at intersection, reducing speed due to speed bump and etc. A necessary condition to employ this model is the ability to communicate with stop signs through the available infrastructures. A useful improvement is to solve Problems 1 and 2 for a system that two vehicles are approaching intersections from two different branches of the road. This problem has been solved for deterministic case in [19] and [20]. For this scenario, both the system model and the assumptions will be different from the scenario of two consecutive vehicles approaching a stop sign. 54 References [1] I. Fallon, D. ONeill, The worlds first automobile fatality, Accident Analysis and Prevention, vol. 37, pp. 601603, July 2005. [2] http://safety.fhwa.dot.gov/intersection/ [3] Y.Kishimoto, K.Oguri, "A Modeling Method for Predicting Driving Behavior Concerning with Driver's past Movements", Proceeding of 2008 IEEE conference on Vehicular Electronics and Safety, September 2008. [4] G.S. Aoude, V.R. Desaraju, L.H. Stephens, J.P. How, "Behavior Classification Algorithms at Intersections and Validation using Naturalistic Data", IEEE Intelligent Vehicles Symposium (IV), Germany, June 2011. [5] A.Pentland, A.Liu, "Modeling and Prediction of Human Behavior", Neural Computation, 1999. [6] T. Kumagai, Y. Sakaguchi, M. Okuwa, M. Akamatsu, "Prediction of Driving Behavior through Probabilistic Inference", Proceedings of the 8th International Conference on Engineering Applications of Neural Networks, Torremolinos, Spain, September 2003. [7] N.Oliver, A.Pentland, "Driver behavior Recognition and Prediction in a Smart Car", Proceeding of Intelligent Vehicles Symposium, 2000. [8] H.Berndt, J.Emmert, K.Dietmayer, "Continuous Driver Intention Recognition with Hidden Markov Models", Proceedings of the 11th International IEEE Conference on Intelligent Transportation Systems Beijing, China, October 2008. [9] D. Mitrovic, "Reliable Method for Driving Events Recognition", IEEE Transactions on Intelligent Transportation Systems, Vol. 6, No. 2, June 2005. [10] J.D.Lee, J.D.Li, L.C.Liu, C.M. Chen, "A Novel Driving Pattern Recognition and Status Monitoring System", Advances in Image and Video Technology, Volume 4319, 2006, pp 504-512. [11] N. Kuge, T. Yamamura, 0. Shimoyama, A. Liu, "A Driver Behavior Recognition Method Based on a Driver Model Framework", Society of Automotive Engineers report, 2000. [12] K.Hayashi, Y.Kojima, K.Abe, K.Oguri, "Prediction of Stopping Maneuver Considering Drivers State", Proceedings of the IEEE Intelligent Transportation Systems Conference Toronto, Canada, September 2006. [13] R. Simmons, B. Browning, Y. Zhang, V. Sadekar, "Learning to Predict Driver Route and Destination Intent", Proceedings of the 2006 IEEE Intelligent Transportation Systems Conference, Toronto, Canada, September 2006. [14] A.Pentland, A.Liu, "Toward Augmented Control Systems", Proceeding of Intelligent Vehicles '95 Symposium, 1995. [15] J. Gunnarsson, L. Svensson, E. Bengtssont, L. Danielssont, "Joint Driver Intention Classification and Tracking of Vehicles", Nonlinear Statistical Signal Processing Workshop, IEEE 2006. [16] K. Vogel, "A comparison of headway and time to collision as safety indicators", Accident Analysis and Prevention Volume 35, Issue 3, May 2003, Pages 427433. [17] Cumulative Distribution Function of the Standard Normal Distribution". NIST. 55 Retrieved 5 May 2012. [18] Kohavi, Ron, "A study of cross-validation and bootstrap for accuracy estimation and model selection", Proceedings of the Fourteenth International Joint Conference on Artificial Intelligence (San Mateo, CA: Morgan Kaufmann), 1995. [191 R. Ghaemi, D. Del Vecchio, "Control for Safety Specifications of Systems with Imperfect Information on a Partial Order", IEEE Trans. Automatic Control, 2013. [20] M. Hafner, D. Del Vecchio, "Computational Tools for the Safety Control of a Class of Piecewise Continuous Systems with Imperfect Information on a Partial Order", SIAM J. on Control and Optimization, 2011. 56