Benoit Vanholme

Member, IEEE Dominique Gruyer

Member, IEEE Sébastien Glaser

Member, IEEE Saïd Mammar

A Legal Safety Concept for Highly Automated Driving on Highways

This paper discusses the design of an Advanced Driver Assistance System (ADAS) that ensures safety when traffic rules are respected by all road users. This concept, referred to as legal safety, is proposed as a basis that permits human and automated drivers to share the road infrastructure. It is illustrated for a Highly Automated driving System with speed keeping, distance keeping and lane changing functionalities on highways (HAS). The requirements legal safety places upon HAS components are presented, with a special focus on the co-pilot which calculates a safe trajectory for the vehicle based on perception of lanes and traffic signs and prediction of the trajectories of objects in the environment. A lane coordinate system is proposed as a powerful reference for the trajectory calculations of the co-pilot. The system controls the vehicle and communicates with the driver, according to an automation mode scheme inspired by the horse-rider metaphor (H-metaphor).

I. INTRODUCTION

The physical transport of people and goods has always been an essential part of society. Since the creation of the Internet, digital alternatives exist (e.g. teleworking and teleshopping) [START_REF] Eger | The Internet vs. The Automobile[END_REF] but road transport is still increasing in volume, raising several challenges. Road traffic accidents in the European Union claim around 40000 lives and leave almost 2 million people injured annually. They correspond to an estimated annual cost of around 200 billion euros, or 2 % of the EU's Gross Domestic Product (GDP) [START_REF]Annual statistical report[END_REF]. Accident analysis shows that human-inherent errors by distraction, drowsiness, emotion or miscalculation are almost always amongst the causes of these accidents [START_REF] Neale | An overview of the 100-car naturalistic study and findings[END_REF]. Costs related to road traffic congestion and environmental pollution not only account for 2 % of the EU's GDP but also have an impact on the health of its citizens.

Automated driving systems could be one of the solutions for a safer, more comfortable and cleaner transport in the future [START_REF] Vanholme | Personal mobility in 2050: bicycles or autonomous vehicles? The Young European Arena of Research (YEAR), TRA Conference[END_REF]. One approach is to directly shift to automated driving, as demonstrated by the ARGO experience [START_REF] Broggi | Automatic vehicle guidance: the experience of the ARGO autonomous vehicle[END_REF], the DARPA Challenge [START_REF]The DARPA Grand Challenge[END_REF] and CyberCars [START_REF] Parent | Advanced urban transport: automation is on the way[END_REF]. With expensive, high-tech equipment, automated driving on a separated infrastructure with limited interaction with other vehicles is possible. But for economical, legal and psychological reasons, the approach chosen by most policy makers and France said.mammar@iup.univ-evry.fr car manufacturers is the incremental introduction of simple Advanced Driver Assistance Systems (ADAS). They rely on a limited number of economical, safe and modular hardware components that allow driving on the public road in cooperation with the human driver. Low-level vehicle control assistance with Anti-lock Braking Systems (ABS) and Electronic Stability Control (ESC) are now standard on most vehicles. Customer interest in ADAS has increased significantly due to higher-level systems that combine safety with comfort such as Adaptive Cruise Control (ACC), Intelligent Speed Adaptation (ISA), Lane Keeping Systems (LKS) and Lane Change Assistance (LCA) [START_REF] Moon | Design, tuning, and evaluation of a full-range adaptive cruise control system with collision avoidance[END_REF], [START_REF] Carsten | Intelligent speed adaptation: accident savings and cost-benefit analysis[END_REF], [START_REF] Wu | The heterogeneous systems integration design and implementation for lane keeping on a vehicle[END_REF].

As ADAS trend toward higher levels of automation, the question arises of how an automated driving system should interact with other drivers in the environment. Could traffic rules manage the safety and efficiency of mixed human and automated traffic in the same way as they do for traffic with human drivers? It is the thesis of this paper, referred to as legal safety. The next question is how the system can interact with the human co-driver optimally. The European 7th Framework Program (FP7) project HAVEit (Highly Automated Vehicles for Intelligent Transport) [START_REF] Hoeger | Highly automated vehicles for intelligent transport: HAVEit approach[END_REF], [START_REF]Highly Automated VEhicles for Intelligent Transport[END_REF] proposes a cooperation along different automation modes. This is the context in which this paper develops the Highly Automated driving System for highways (HAS).

This paper is organized as follows. Section II presents the legal safety concept and its application to HAS. Section III discusses the architecture of HAS and the requirements legal safety places upon its perception, co-pilot and control components. Sections IV and V explain how the co-pilot predicts the trajectories of objects and calculates safe trajectories for the vehicle of interest (ego vehicle). The management of the automation mode during normal driving and during system failure is presented in Section VI. Section VII presents results of the system on the use cases defined by HAVEit. Section VIII concludes and provides a perspective on future work.

II. LEGAL SAFETY IN AN APPLICATION ZONE

A. Legal Safety

The word traffic comes from the Arabic taraffaqa meaning slowly walking along together, today certainly not the most common type of road traffic. Today's traffic is complex because of the diversity of its participants (e.g. the personality of the driver, the type of vehicle) and of its infrastructure (e.g. multiple lanes, junctions, intersections, traffic signs). Traffic rules have been developed to promote safety and efficiency.

If future vehicles are to begin driving autonomously, they will likely need to share the infrastructure with humandriven vehicles; a distant future where all vehicles would drive autonomously would be preceded by a transient period where automated and non-automated vehicles coexist. One alternative to sharing the infrastructure, to assign a part of the existing infrastructure (e.g. one lane) exclusively to automated driving, could be difficult to implement as argued in [START_REF] Shladover | Truck automation operational concept alternatives[END_REF]. The other alternative, to create a separate infrastructure for automated driving, would come at a large cost and reduce its application zone (e.g. in rugged environments and cities).

This paper discusses the design of a highly automated system that ensures safety when traffic rules are respected by all road users. In the opposite case, when traffic rules are offended by a road user, the system avoids an accident if it can and does an emergency brake if it cannot. This concept, legal safety, is proposed as a natural way to let human and automated drivers share the infrastructure. The ethical question concerning the acceptability of a lethal accident between a legally safe driving system and a human driver that goes against the traffic rules is left open.

B. The Vienna Convention in the Application Zone

Basic traffic rules are defined by an international treaty under the authority of the United Nations, the 1968 Vienna Convention on Road Traffic [START_REF]Convention on road traffic[END_REF]. It has not been signed by all countries, and local variations in practice can be found among signatories. Many of the local specificities do not directly apply on automated driving (e.g. driving under intoxication, day lighting, the seat belt use, tyre equipment), but some of them do. However, these local rules are not discussed in the paper. Rather, we focus on the application of the Vienna Convention on HAS which integrates speed keeping, distance keeping, lane keeping and lane changing functionalities on highways, excluding entry and exit points, during day and night, as in Fig. 1. This might be the first environment where automated driving will be possible as its simple lane structure and unidirectional flow of large objects facilitate perception, co-pilot and control algorithms. The description assumes that driving is on the right side of the road; translation for left-side driving is straightforward. The environment, the functionalities and additional conditions (e.g. lane changing, speed range, day/ night driving) in which the system ensures safety are referred to as the application zone.

The application of the articles of the Vienna Convention that apply to the application zone of HAS is given below.

The original index of the article in the text of the convention is indicated between parentheses.

Article 1 [START_REF] Parent | Advanced urban transport: automation is on the way[END_REF]: Road users should avoid damage to road infrastructure or to other road users.

Article 2 [START_REF] Moon | Design, tuning, and evaluation of a full-range adaptive cruise control system with collision avoidance[END_REF]: The vehicle should always be controlled by a driver in a fit physical and mental condition.

Article 3 [START_REF] Wu | The heterogeneous systems integration design and implementation for lane keeping on a vehicle[END_REF]: Driving should be on the right-most lane if possible, except for overtaking.

Article 4 [START_REF] Hoeger | Highly automated vehicles for intelligent transport: HAVEit approach[END_REF][START_REF]Convention on road traffic[END_REF]: Overtaking is only on the left, except in congested traffic where right overtaking is also allowed. An overtaking maneuver can only be started if the vehicles in front and in back of the ego vehicle in the same lane have neither indicated nor started to overtake another vehicle, if vehicles in the target lane are not hindered by the maneuver and if continuous lane markings are not crossed. The corresponding indicator of the vehicle must stay on during the entire maneuver.

Article 5 [START_REF] Shladover | Truck automation operational concept alternatives[END_REF]: The speed of the vehicle must be adapted to road and weather conditions (e.g. visibility and road friction), speed limit signs and other vehicles. The distance between vehicles must be such that a collision can be avoided in the case of emergency braking. The driver also must be capable of avoiding collisions with any foreseeable obstacles out of the perception horizon.

Article 6 [START_REF] Polychronopoulos | Integrated object and road border tracking using 77 GHz automotive radars[END_REF]: Braking should only be done for safety reasons and must be indicated with braking lights.

Article 7 [START_REF] Richter | Radar and vision based data fusion -advanced filtering techniques for a multi object vehicle tracking system[END_REF]: Only motor vehicles are allowed on highways. Vehicles on the highway have priority over vehicles entering. If the vehicle is to be stopped for a technical reason, this must be done on the emergency lane, if possible.

Article 8 [START_REF] Flemisch | The H-metaphor as a guideline for vehicle automation and interaction[END_REF]: The lighting of the vehicle should be adapted to the visibility conditions.

Article 9 (34): Priority vehicles are exempt from traffic rules, except from Art. 1 [START_REF] Parent | Advanced urban transport: automation is on the way[END_REF].

Sections III to VI discuss how HAS has been designed to cover the traffic rules described above.

III. SYSTEM ARCHITECTURE

The functional architecture of HAS is shown in Fig. 2. Similar to most ADAS, it imitates human driving functions with perception, decision and action components. The perception module, which processes data from sensors such as cameras, laser scanners and radar, imitates the function of human vision (tracking lanes, traffic signs and objects). The co-pilot module is the decision-making part of the system; it calculates a trajectory that is legally safe with respect to the environment detected by the perception module. The control module commands the actions of the powertrain, brakes and front wheels to maintain vehicle trajectory, or communicates back to the driver using the pedals and steering wheel. The dashed arrows indicate the connection of the automation modules to the Human Machine Interface (HMI) that manages interaction with the human driver.

All information exchanged between perception, co-pilot and control modules is described in a coordinate axis U V attached to the ego vehicle, with origin in the geometric center of the vehicle, U in the longitudinal direction and V in the lateral direction as shown in Fig. 1.

Fig. 2. System architecture

This section focuses on the requirements of legal safety on perception and control components. Sections IV and V will discuss the design of the co-pilot component.

A. Legal Safety of Perception

Perception of the lane of the ego vehicle and the lanes to its immediate right and left is essential as indicated by the articles presented in the previous section, Art. 1, 3, 4 and 7. In this paper they will be referred to as the ego lane, right lane and left lane, labeled A, B and C respectively. The lanes change when the origin of U V crosses the lane marking. The lane description must be available ahead of and behind the ego vehicle, during both night and day. Extensive research has been done on lane detection and tracking using Differential GPS (DGPS) [START_REF] Weigel | Accurate road geometry estimation for a safe speed application[END_REF], laser scanners [START_REF] Kirchner | Integrated obstacle and road tracking using a laser scanner[END_REF], radar [START_REF] Polychronopoulos | Integrated object and road border tracking using 77 GHz automotive radars[END_REF] and vision [START_REF] Siegemund | Curb reconstruction using conditional random fields[END_REF]. Vision seems most appropriate for distinguishing continuous from discontinuous lane markings for Art. 4 and normal lanes from emergency lanes for Art. 7. Robust vision-based perception of a single lane is already available in the market as Lane Departure Warning (LDW) and Lane-Keeping Systems (LKS). Ongoing research is working to enhance perception performance and extend it to multiple lanes [START_REF] Ieng | A new multi-lanes detection using multi-camera for robust vehicle location[END_REF]. The description of highway exit and entry lanes is not required by Art. 7. Art. 5 implies an estimation of road friction without affecting vehicle control, such as in [START_REF] Chen | A review of the applications of agent technology in traffic and transportation systems[END_REF].

Art. 5 also requires the perception of traffic signs (speed limits and lane closures). An approach based on Infrastructure-to-Vehicle (I2V) communication is proposed in [START_REF]Cooperative vehicles and road infrastructure for road safety[END_REF], [START_REF] Vanholme | Fast prototyping of a highly autonomous cooperative driving system for public roads[END_REF]. Legal safety would require the implementation of a robust I2V for all traffic signs in the application zone. A more general approach could be offered by traffic sign recognition by vision, which is commercially available as a part of ISA systems.

The last essential function of the sensor and perception components of HAS is the detection and tracking of objects in the ego, right and left lanes (if existing), both ahead of and behind the ego vehicle, Art. 1, 4, 5, 6, 7, 9. At night it should at least detect the objects which have an appropriate lighting, Art. 8. Object perception is possible using laser scanners, radar [START_REF] Scheunert | Early and multi level fusion for reliable automotive safety systems[END_REF], vision [START_REF] Pfeiffer | Efficient representation of traffic scenes by means of dynamic stixels[END_REF] or a fusion of sensors [START_REF] Richter | Radar and vision based data fusion -advanced filtering techniques for a multi object vehicle tracking system[END_REF].

Additionally, Vehicle-to-vehicle (V2V) communication could provide more information. For information that is critical to the driving task, however, V2V could only be relied upon if integrated in all vehicles in the environment, which might be difficult as discussed in Section II. Though object positions and movements are today most accurately estimated by laser scanners and radar, vision will probably always be a part of the system as indicator detection [START_REF] Fossati | Real-time vehicle tracking for driving assistance[END_REF] is required by Art. 4, at least for objects in the ego lane.

B. Legal Safety of Control

Art. 4 and 5 imply a lateral control component, which corresponds with lane-keeping and lane-changing and a longitudinal control component, which in its extreme case corresponds to emergency braking. Ego vehicle control is probably the area on which research is most advanced. Longitudinal control [START_REF] Minoiu | Composite lyapunov based vehicle longitudinal control assistance[END_REF] is available today on many vehicles as a part of the ACC system. Some of the lateral control algorithms of LKS [START_REF] Chaib | H-infinity, adaptive, PID and fuzzy control: a comparison of controllers for vehicle lane keeping[END_REF] could be used to track a trajectory as in Fig. 1.

C. System Safety

Apart from the traffic rules for assuring legal safety with respect to the vehicle's environment, additional internal rules are imposed upon each component to ensure the integrity of the other components of the system, as listed below.

Specification 1: Within a given range, the lane descriptions are of predefined precision.

Specification 2: Within a given range, object descriptions are of predefined precision, which is such that a correct lane assignment can be made.

IV. PREDICTION OF THE OBJECT AND PHANTOM TRAJECTORIES

A. State of the Art

An important part of the co-pilot is the prediction of the trajectories of objects in the ego vehicle's environment. A common approach in collision avoidance systems is to assume that the object will continue its current movement. A Kalman filter or one of its derivatives in combination with a motion model such as Constant Turning Rate and Acceleration (CTRA) are used in [START_REF] Schubert | Comparison and evaluation of advanced motion models for vehicle tracking[END_REF]. In previous work, the authors proposed to considering the relationship between an object and the infrastructure (e.g. its Time to Lane Crossing, TLC) [START_REF] Glaser | Maneuver-based trajectory planning for highly autonomous vehicles on real road with traffic and driver interaction[END_REF]. By not taking legal driving into account, these approaches might underestimate (e.g. when an object is going straight with its indicators on) or overestimate (e.g. when an object moves to the middle of its lane) the danger an object represents. Section IV describes the prediction of object trajectories according to the legal safety concept.

B. Lane Coordinate System

For the co-pilot, a natural environment for calculating with trajectories (in this and next section) is a curvilinear lane coordinate system XY , with the same origin of the ego vehicle system U V , the X-axis parallel with the lane and the Y -axis perpendicular on X, as indicated in Fig. 3. The first step of the co-pilot algorithm consists of transforming the perceived environment from U V to XY as shown in Fig. 4. This translates the parallel lanes of a highway environment into Y-coordinate lines, allowing a simple description of ego and object trajectories as a combination of transient (polynomial) and permanent (linear) sections in XY . In a final step, presented in Section V, the co-pilot applies an inverse transformation to the ego trajectories from XY to U V for the control and HMI modules. In U V , the permanent section of the trajectories meet the geometry of the lanes, which is usually based on a clothoid model.

C. Trajectory Generation

Fig. 4 presents the possible trajectories for the 8 potential objects (1-8) around the ego vehicle (0), assuming that the objects are driving legally. They are labeled as IJK with I as the index of the object, J as the index of the target lane and K as the index of the variant of two trajectories in the same target lane (only for object 4 and 5). The first trajectory calculated for each object is the one without lane changes (1A, 3C, 4A ′ , 4A ′′ , 5C ′ , 5C ′′ , 6A, 7B, 8C), except for object 2 which is assumed to keep an appropriate distance from the ego vehicle, Art. 5. Because this 2B trajectory has no influence on the decisions of the co-pilot, it is eliminated. According to Art. 4, objects 2 and 7 are allowed to change lanes (2A, 2C, 7A, 7C) when their indicators are activated. The same article stipulates that no object should hinder the ego vehicle when changing lanes, therefore no object trajectories towards lane B are calculated, regardless of the state of the objects' indicators. As explained in the next section, this guarantees that a legally safe trajectory in the ego lane can always be found, corresponding to keeping a safe distance from object 7 according to Art. 5.

The system is more defensive than strictly needed by legal safety by predicting a (non-legal) object trajectory towards lane B when it is crossing a lane mark of B without the activation of indicators, except for objects 1 and 3; as object 2, they are assumed to keep an appropriate distance from the ego vehicle. It is also defensive in the sense that it considers that objects can change lanes crossing continuous lane markings, despite of Art. 4 and that objects can keep driving on the left, despite of Art. 3.

Note that for an object (legally or not) changing lanes, two trajectories (the lane keeping and lane changing trajectory) are predicted as if it were expanding in the future. This reflects the uncertainty whether the lane change will actually take place or not. Moreover, as the dynamism of the lane change cannot be known, a worst-case maneuver (a very fast lane change) is assumed. According to Art. 5 the ego vehicle must be capable of avoiding collisions with potential objects out of its perception horizon. For this purpose, the trajectories of worst-case phantom objects at the edge of the perception zone (Spec. 1, Spec. 2) are calculated, as displayed in Fig. 5. Assuming that driving in the opposite direction is prohibited, the worst-case phantoms ahead of the ego are standing still, indices IV , V and V I. This will let the ego vehicle control its speed so that it is able to stop for a traffic jam, as explained in the next section. In the rear of the vehicle, phantom III is a vehicle traveling at the speed limit, preventing the ego vehicle from changing lanes to the left when its speed and rear perception horizon are too low. Phantom I can be ignored as right overtaking is not allowed by Art. 4, except in congestion where it takes the same trajectory as III. Phantom II is discarded as the ego vehicle has priority over it by Art. 5. The worst-case legal speed profile for the objects (1-8) and phantoms (I-V I) is shown in Fig. 6, with time axis T and speed axis V . Phantoms ahead of and behind the ego vehicle have a constant speed corresponding to standstill and the speed limit, respectively. Objects behind the ego vehicle are assumed to continue accelerating if they were or to hold their speed if they were not (1A, 2A, 2C, 3C). Analogously, objects in the front decelerate (but have a minimum speed of zero) or hold speeds (6A, 7A, 7B, 7C, 8C). Objects 4 and 5 are believed to expand in the future between minimum (') and maximum speed profiles (") according to the uncertainty on their acceleration, as in Spec. 2.

The system is more defensive than needed by legal safety by allowing objects to overtake on the right and exceed speed limits.

D. Mathematical Description of Trajectories and Speed Profiles

The mathematical model of the object trajectories in XY is a combination of a polynomial part and a linear part, for both the X-position p x as a function of time t (1) and the Y -position p y as a function of p x (2), referred to as model A in this paper.

p x (t) = a 4 t 4 + ... + a 1 t + a 0 if t < T p x (t) = b 1 t + b 0 if t >= T (1)
p y (p x ) = c 5 p 5 x + ... + c 1 p x + c 0 if p x < X p y (p x ) = d 0 if p x >= X (2)
The parameters a i , b i , c i , d i , T and X can be found from the initial and final conditions (3)-( 6), with velocities v and accelerations a, as described in [START_REF] Glaser | Maneuver-based trajectory planning for highly autonomous vehicles on real road with traffic and driver interaction[END_REF]. The superscript 0 indicates the initial state, 2 the final state at T or X and 02 the average between these two.

p x (0) = p x0 ṗx (0) = v x0 px (0) = 0 ṗx (T ) = v x2 px (T ) = 0 (3) T = (v x2 -v x0 )/a x02 (4)
p y (0) = p y0 ṗy (0) = 0 py (0) = 0 p y (X) = p y2 ṗy (X) = 0 py (X) = 0

(5)

X = (p y2 -p y0 )/v y02 (6)
The initial values (superscript 0) are known and the values v x2 , a x02 , p y2 and v y02 follow from the discussion on object trajectories in this section. Model A also serves for the calculation of ego trajectories, as described in next section.

V. CALCULATION OF THE EGO TRAJECTORIES

A. State of the Art

The co-pilot computes a safe ego trajectory for each of the three considered lanes (ego, right and left) based both on the description of lanes and traffic signs and on the prediction of object trajectories. In the vast literature of motion planning, most algorithms fall into one of two families. Combinatorial motion planning finds the absolute, best solution (according to a chosen performance metric) in the complete solution space, while sampling-based motion planning finds an acceptable solution by only evaluating a part of the solution space [START_REF] Lavalle | Planning algorithms[END_REF]. As for driving, a wide range of valid trajectories exists (think of drivers with different personalities) and calculation speed is crucial, therefore the algorithm presented is designed according to the latter family.

Heuristic analysis limits the algorithm to the generation and evaluation of a total of ten trajectories. Six of these are for normal functioning of the system; one trajectory per lane with two possible speed profiles, index 0 in Fig. 7 and Fig. 8. Four safe state/ emergency trajectories have a terminal velocity of zero and are to be used during a failure of the system, index F in Fig. 7 and8. In following sections, each of these trajectories is discussed.

B. Heuristics for Sampling

The limitations legal safety places upon the trajectories and speed profiles of the ego vehicle are expressed in the equations of this section, which are applied to each target lane. The exponents R and F correspond to the objects to the rear and front of the ego vehicle respectively, and variables without exponent correspond to the ego vehicle itself. When referring to an object, the one with a trajectory towards the corresponding target lane (according to Section IV) is meant. For objects 4 and 5, R corresponds to variant ′′ and F to ′ . The variables p is indicate position, v velocity and a acceleration. Similar to section IV, the subscript 0 refers to the initial state, 2 the final state and 02 the average value between them.

Art. 4 and 5 refer implicitly to a safety distance to be kept from the objects with the same target lane to the rear and front of the ego vehicle, leading to [START_REF] Parent | Advanced urban transport: automation is on the way[END_REF]. The first equation is for the target position p x2 which includes a safety distance p x S , which is proportional with the object speed with a factor t x S (i.e. a "X-second rule" for safe following distances). The second equation is for the target speed v x2 , which is adapted to that of the objects to maintain the safety distance beyond the evaluation period. Avoiding right overtaking in Art. 4 also gives [START_REF] Parent | Advanced urban transport: automation is on the way[END_REF], now referring to the objects with target lanes left of the target lane of the ego vehicle.

p R x2 + p R x S ≤ p x2 ≤ p F x2 -p F x S v R x2 ≤ v x2 ≤ v F x2 (7)
Art. 5 implies that the target speed v x2 is such that a collision with phantom objects (introduced in Section IV) can be avoided if needed, giving [START_REF] Moon | Design, tuning, and evaluation of a full-range adaptive cruise control system with collision avoidance[END_REF]. Here, the indices R and F refer to phantoms and a E

x is the extreme deceleration or acceleration capacity of the vehicles (in absolute value), which depends on road conditions. The equation expresses that extreme braking of the rear phantom avoids the ego vehicle and that extreme braking of the ego vehicle avoids the front phantom.

v R x0 - 2a E x -p R x 0 ≤ v x2 ≤ v F x0 + 2a E x p F x 0 (8)
The first equation in [START_REF] Carsten | Intelligent speed adaptation: accident savings and cost-benefit analysis[END_REF] shows the adaptation of the target speed v x2 to the speed limit v S x , Art. 5. When a new speed limit v S

x lower than the ego vehicle speed v x0 appears at a distance p S x , the first equation is not sufficient. The second equation indicates that v x S , the speed of the ego vehicle at p S x , must also adopt the speed limit v S x .

v x2 ≤ v S x v x S ≤ v S x (9)
The speed in curves is adapted to keep the lateral acceleration below a maximum value a E y (depending on road conditions, similar to a E x ) in order to avoid loosing vehicle control, as in Art. 5. In [START_REF] Wu | The heterogeneous systems integration design and implementation for lane keeping on a vehicle[END_REF] ,c C x is the maximum curvature (in absolute values) of the lane at a distance p C

x and v x C the corresponding maximum speed of the ego vehicle. Exceeding longitudinal system limits is avoided by bounding the deceleration and acceleration to a

E x .        v x2 ≤ a E y c C x v x C ≤ a E y c C x -a E x ≤ a x02 ≤ a E x (10)
To ensure the integrity of the perception and control modules (Spec. 5) the target speed and average acceleration are bounded by [START_REF] Hoeger | Highly automated vehicles for intelligent transport: HAVEit approach[END_REF], where v H

x and v H y are the maximum longitudinal and lateral speed set by specification or by the human driver and a h

x and a H x are the extreme deceleration and acceleration.

     0 ≤ v x2 ≤ v H x 0 ≤ v y2 ≤ v H y a h x ≤ a x02 ≤ a H x (11)

C. Trajectory Generation

Based on the equations above, the speed profiles are generated. They have a time horizon of 10 s, which is enough for a to decelerate from highway speed to zero if needed. Speed profile 0I ′ in Fig. 8 is built according to model A (a polynomial followed by a linear section), which is defined by the parameters v x2 and a x02 as given in Section IV. For 0I ′ , the parameter v x2 is set to the maximum value allowed by ( 7)-( 11). An upper bound on the parameter a x02 is directly indicated by the third equation of ( 10) and ( 11). An additional upper bound is implicitly set by the first equation of [START_REF] Parent | Advanced urban transport: automation is on the way[END_REF], which is written as a function of a x02 in the first equation of [START_REF]Highly Automated VEhicles for Intelligent Transport[END_REF]. A component related to the error on the safety distance (p F x0 -p F x S ), to the difference in speed between ego and object (v F x2 -v x0 ) and to the acceleration of the object (v F x2 -v F x0 ) can be recognized. The second equations of ( 9) and ( 10) can be written as the second and third equation of ( 12) respectively. If the initial speed is legally safe, then using model A, the conditions on v x2 and a x02 imply that all speeds between the initial and the final state are safe.

             a x02 ≤ 1 2 (v F x 2 -vx 0 ) 2 1 2 (v F x 2 -v F x 0 ) 2 a F x 02 -(p F x 0 -p F x S
)

a x02 ≤ - (vx 0 +v S x ) 2 (vx 0 -v S x ) p S x a x02 ≤ - (vx 0 +v C x ) 2 (vx 0 -v C x ) p C x (12)
A model B for speed profiles is shown by 0I ′′ in Fig. 8. It corresponds to a sequence which consists of a polynomial (from v x0 to v x1 over time T 01 ), a linear section (at v x1 during T 11 ), a second polynomial (from v x1 to v x2 over a time T 12 ) and a second linear section (at v x2 ). Its mathematical description can be easily adapted from ( 1)-( 6) and is defined by the parameters v x1 and v x2 . For parameter v x2 , the upper bound is specified by ( 7)-( 11), as for model A. The value for v x1 is calculated so that the final position of the ego trajectory meets the first equation of [START_REF] Parent | Advanced urban transport: automation is on the way[END_REF]. This results in [START_REF] Shladover | Truck automation operational concept alternatives[END_REF].

v x1 = v x0 + k p (p F x0 -p F S ) + k v (v F x2 -v x0 ) + k a (v F x 2 -v F x 0 ) 2 2a F x 02 k p = -k a = 1 T01/2+T11+T12/2 k v = T01+T11+T12/2
T01/2+T11+T12/2 [START_REF] Shladover | Truck automation operational concept alternatives[END_REF] Similar as for model A, a component linked to the error in safety distance, to the speed difference and to the object acceleration appears. Once the parameters k p , k v and k a are tuned for an optimal object distance control, T 01 , T 11 and T 12 are defined.

Speed profile 0I ′ integrates all conditions in ( 7)-( 11), unlike model 0I ′′ which does not take into account the second equation of ( 9) and [START_REF] Wu | The heterogeneous systems integration design and implementation for lane keeping on a vehicle[END_REF]. While model 0I ′ is wellsuited for adapting a certain speed and approaching a slower object, distance keeping to an object is only possible with 0I ′′ . A correct solution is always given by one of both speed profiles (the one corresponding with the lowest value of v x2 ).

Note that the conditions that depend on objects and phantoms R (behind the ego vehicle) in equations ( 7) and ( 8) are not integrated in the generation of the speed profiles 0I ′ and OI ′′ . If the trajectory evaluation step (discussed in next section) shows a collision with these objects or phantoms, the trajectory is excluded. As Section IV shows, no object R has a legal trajectory that ends in the ego lane; therefore, at least for the ego lane a legally safe trajectory is guaranteed.

The safe state speed profile F I ′ and emergency speed profile F B ′′ in Fig. 8 use model A with a target speed v x2 of zero and a moderate or extreme acceleration a x02 . They protect against unexpected object behavior or system failure, as will be described in Section VI. Fig. 7 shows the trajectories OI, F I ′ and F B ′′ which are calculated with the speed profiles 0I ′ , 0I ′′ , F I ′ and F B ′′ according to the lateral component of model A described in Section IV. The parameter p y2 depends on the target lane and v y02 is found in [START_REF]Convention on road traffic[END_REF]. This equation specifies that the ego vehicle should be on the linear section of the trajectory (in the middle of the lane target) when it is in the same position p x G as the object F .

py 2 -py 0 px G ≤ v y02 with p x G = p F x (14)

D. Evaluation of Trajectories

After trajectory generation, the aspects of legal safety that were not already explicitly integrated in ( 7)-( 14), are evaluated. Driving in the right-most lane, Art. 3, is encouraged by a positive performance indicator (a negative performance cost) for the right target lane. Medium performance costs are attached to trajectories that correspond to crossing a continuous lane marking (Art. 4) or that correspond with an emergency lane (Art. 7).

The integrity of each trajectory is verified by a collision analysis between the ego and object vehicles for each of the states between the initial and final state. If a collision is detected, a high performance cost is attributed, which is proportional to the speed difference between the two vehicles at the time of collision.

In legal driving scenarios, there is always a safe trajectory 0B in the ego lane which corresponds to a zero performance cost, as discussed in Section V-C. When an illegal object behavior leads to a positive performance cost for 0B (indicating a collision), the emergency trajectory F B ′′ is chosen. The trajectory towards the right lane 0A is proposed by the copilot if it has a target speed which is not lower than that of the trajectory in the ego lane and no collision cost. The trajectory to the left lane 0C is suggested if it allows an increase in target speed without performance cost.

In a last step, the co-pilot converts the ego trajectories from the lane coordinate system XY (Fig. 7) to the ego vehicle coordinate system U V (Fig. 1).

VI. MANAGEMENT OF AUTOMATION MODE

The design of the interface between the human driver and the driving system is crucial for legal safety. Art. 2 stipulates that a physically and mentally fit driver should always be present. In HAS, the driver can be the automated driving system (in the application zone), the human driver or the combination of both. This last option is extensively studied in the HAVEit project [START_REF]Highly Automated VEhicles for Intelligent Transport[END_REF] as well as in [START_REF] Flemisch | The H-metaphor as a guideline for vehicle automation and interaction[END_REF], [START_REF] Norman | The design of future things[END_REF] which describe the interaction between the human driver and driving system along the horse-rider metaphor (H-metaphor). An essential aspect in the interaction between rider and horse is the distinction between loose-rein and tight-rein control. Under tight reins, the rider controls the horse directly. The horse can, however, resist the commands of the rider and balk when it judges a maneuver too dangerous. In loose-rein riding the horse has more autonomy, but the rider still gives some high-level instructions and corrects when necessary.

In HAS, this type of two-way communication is implemented along four automation modes. In the human mode, the human driver maintains contact with the steering wheel and pedals, giving direct control over the vehicle. When there is contact with the pedals, the speed mode is activated, engaging an automated speed control (including ACC and ISA functionalities) with a maximum speed set by the human driver. High-level driving is offered in the cruise mode where the driver loosens his grip on the steering wheel and HAS performs speed control, distance control, lane keeping and, if acknowledged via an indicator, lane changes. When the auto mode is activated, lane changes are done without this acknowledgement.

As between the rider and horse, this automation mode can be changed by the human driver or the driving system. The human driver must take over the control of the vehicle if the application zone is left during normal functioning (e.g. for taking an exit) or because of system failure (e.g. due to a hardware problem). If the human driver does not respond as requested by HAS, the system brings the vehicle to standstill along the safe state or emergency trajectories presented in Section V, as stipulated by Art. 6 and 7. Similarly, HAS takes over control when a maneuver performed by the human driver is considered dangerous, e.g. it applies hard braking if that is the only way to prevent a collision, it provides feedback to the steering wheel when a lane change is unsafe and stiffens the gas pedal when a speed limit is reached.

VII. RESULTS

Fig. 9 shows a simulation result of HAS in cruise mode along the use cases defined in the HAVEit project, with v x the speed of the ego vehicle, p y its lateral position with respect to the right-most lane and p x the position of an object vehicle. The use case driving in a lane with obstacles is shown from 1 to 2. The system converges to a constant safety distance to the object. It proposes a lane change which is acknowledged at 2 and finished at 3, corresponding to the driving with lane change use case. From 3 to 4, driving with speed limit change is shown, causing the object to become closer to the ego vehicle again. The speed limit is increased and at 5 a lane change to the original lane is made, while accelerating to the maximum speed allowed by the driver 6. The system reduces its speed at 7 in preparation for the curve from 8 to 9. From 6 to 9 it controls the vehicle in the middle of the lane, normal driving in a lane without obstacles. This paper proposes legal safety as a natural way to let human drivers and automated driving systems interact. The concept was developed for the HAS system for speed keeping, distance keeping, lane keeping and lane changing on highways. The requirements legal safety places upon its components were described, with a focus on the co-pilot and HMI during normal system functioning and system failure.

Future work will be on migration from the simulator towards the demonstration vehicles of the HAVEit project. In parallel, the application zone of HAS will be enlarged to highway entries and exits.

  This work was funded by the HAVEit project of the European Commission and the ABV project of the French National Research Agency (ANR) B. Vanholme, D. Gruyer and S. Glaser are with Laboratoire sur les Interactions Véhicule-Infrastructure-Conducteur (LIVIC, IFSTTAR), Versailles, France benoit.vanholme@ifsttar.fr, dominique.gruyer@ifsttar.fr, sebastien.glaser@ifsttar.fr S. Mammar is with Université d'Evry-Val-d'Essonne (UEVE), Evry,

Fig. 1 .

 1 Fig. 1. Highway environment with ego vehicle (0), lanes (A, B, C), traffic signs (a, b) and object vehicles (3, 7)

Specification 3 :

 3 The ranges in Spec. 1 and 2 change at a predefined rate.Specification 4: The objects in the environment are reduced or clustered to a maximum of eight as shown in Fig.3: six of which are the nearest objects ahead of and behind the vehicle in each of the three lanes, and two of which are the objects on either side of the vehicle.Specification 5: The position, orientation, velocity and acceleration of the ego vehicle proposed by the trajectories of the co-pilot are within a predefined range.Specification 6: The control component maintains vehicle trajectory and speed profiles with a predefined error.

Fig. 3 .

 3 Fig. 3. Highway environment with ego vehicle (0), lanes (A, B, C), traffic signs (a, b) and object vehicles (1-8)

Fig. 4 .

 4 Fig. 4. Prediction of object trajectories

Fig. 5 .

 5 Fig. 5. Prediction of phantom trajectories

Fig. 6 .

 6 Fig. 6. Prediction of object and phantom speed profiles

Fig. 7 .Fig. 8 .

 78 Fig. 7. Calculation of ego trajectories

Fig. 9 .

 9 Fig. 9. Calculation of ego speed profiles

IX. ACKNOWLEDGEMENTS

The authors would like to thank the HAVEit project of the 7th Framework Program (FP7) of the European Commission and the ABV project of the French National Research Agency (ANR) for funding this work and the anonymous reviewers for their constructive comments.


Sébastien Glaser

Olivier Orfila

Lydie Nouveliere

Roman Potarusov

Sagar Akhegaonkar

Frédéric Holzmann

Sebastien Glaser

Frederic Holzmann

Volker Scheuch

Sebastien Glaser

Frederic Holzmann

Smart and Green ACC, adaptation of the ACC strategy for electric vehicle with regenerative capacity

de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

I. INTRODUCTION

Daily traffic congestion or long trip on a highway are problems that the driver must face during his driving experience. However, these tasks may generate anger and stress. Automation, and automated driving seem to be one possible answer to these problems, by delegating partly or totally the driving task. Many projects during the 80's and 90's, have proved the feasibility of automated driving systems. Eureka Prometheus project in Europe, or the US National Automated Highway System consortium conducted experiments on real road of automated driving or platoon. Even if the concepts were not fully transmitted to car manufacturers, current vehicles benefit greatly from these research: since 10 years, the driving assistances are booming.

The driving assistances help the driver to manage the driving task at different levels. Tom M. Gassner [START_REF] Tom | BASt-study: definition of automation and legel issues in Germany[END_REF] defined several automation level specifically applied to the driving task, which are:

• Driver only: the driver controls the full driving task • Assisted: the driver controls one dimension and monitors the other one. He must be prepared to take over the complete control at any time.

• Partially automated: the system controls the driving task, but the driver monitors the system and may also take over the complete control at any time

• Highly automated: the driver no longer need to permanently monitor the system, but he may still take over the control with a certain time buffer.

• Fully automated: the system is able to fully monitor itself and in case of a takeover request that is not realized within the time buffer, the system may return to the minimum risk situation by itself. In today situation, driving assistances already address the assisted level, as the Adaptive Cruise Control, which is one of the most relevant. They do not aim at higher level of automation, mainly because of reliability and legal aspect.

With an Adaptive Cruise Control system, the driver delegates the longitudinal control task. When the system is active, the vehicle speed is controlled automatically either to maintain a given clearance to a forward vehicle, or to maintain the driver desired speed, whichever is lower. Since 1997, car manufacturers propose this system on their highend cars. However, the research is still active. Researchers aim at evaluating the impact of the ACC on traffic, under congested situation [START_REF] Marsden | Towards an understanding of adaptive cruise control[END_REF] or with improved strategies [START_REF] Kesting | Extending adaptive cruise control to adaptive driving strategies[END_REF]. They also extend the range of possible speeds, driver comfort, safety or road capacity [START_REF] Vahidi | Research advances in intelligent collision avoidance and adaptive cruise control[END_REF], [START_REF] Moon | Design, tuning,and evaluation of a full-range adaptive cruise control system with collision avoidance[END_REF]. In 2006, the introduction of a vehicle to vehicle communication (cooperation ACC, C-ACC) allows to decrease drastically the clearance to a forward vehicle [START_REF] Naus | Cooperative Adaptive Cruise Control[END_REF] and also to create stable vehicle platoon. The evaluation of the C-ACC [START_REF] Van Arem | The impact of cooperative adaptive cruise control on traffic flow characteristics[END_REF], [START_REF] Nowakowski | Cooperative Adaptive Cruise Control: Testing Drivers Choices of Following Distances[END_REF] shows promising results on road capacity and safety. An ISO norm now defines the intended performance of the ACC [START_REF]Intelligent transport system, Adaptive Cruise Conrol system, performance requirements and test procedures[END_REF].

In parallel, navigation devices became popular. They allow to have access to longer range information on the road and its status, especially with systems that include communication with a traffic management center. Two main families of Advanced Driving Assistance Systems (ADAS) appear. The first one provides warning to the driver, or limit the speed of the vehicle, according with the legal context. This is the Intelligent Speed Adaptation (ISA) system. They prove to be efficient [START_REF] Carsten | Intelligent Speed Adaptation: Accident Savings and Cost-Benefit Analysis[END_REF], and acceptable. Large scale studies have been done or are currently conduct around the world [START_REF]LAVIA French project[END_REF], [START_REF]EuroFOT EU project[END_REF]. the second one uses the map and the geometric description of the road to define a safe speed. These systems are named Curve Warning System, CWS. The driver is warned if his speed is higher than the profile defined previously, he can even be limited or the vehicle can be controlled [START_REF] Glaser | Vehicle Infrastructure Driver Speed Profile : Towards the next Generation of Curve Warning Systems[END_REF], [START_REF] Aguilera | An advanced Driver Speed Assistance in Curves : risk function, cooperation modes, system architecture and experimental Validation[END_REF]. These systems now include communication with a traffic Fig. 1. General use case of the ACC management center to define legal or safe limit according with dynamic event [START_REF]SAFESPOT EU Project[END_REF].

At the same time, the energy consumption became one of the major topic in car industry and for the car users: the oil price has skyrocketed and the greenhouse gas emissions must be reduced. The electric vehicles can provide an efficient solution, especially for the commuting. However, they are still limited by their operating range, which can greatly vary with the driver behavior or traffic conditions. The solution that we choose, is to use the ACC in order to have the longitudinal control of the vehicle and to optimize it with energy efficiency consideration. The system will manage short range interaction, with other vehicles, and long range information, on road and possible event. In [START_REF] Akhegaonkar | Modeling and Simulation of Battery Electric Vehicle to Develop an Energy Optimization Algorithm[END_REF], a driving assistance is developed using a dynamic programming (DP) approach. However, the DP is quite slow and requires a huge computation. We present here a direct computation method, meaning that we compute directly the speed from a differential equation rather than exploring possible state.

In the following, we develop this solution. Section II presents the notation and the ACC, its performance and its limitation. Section III develops the consumption model that is used to evaluate the solution and the motor characteristic. Section IV shows the optimization process that is define and presents the first results. Finally, section V concludes this article.

II. SAGA DEFINITION

In this section, we will firstly describe the notations that are used in the following, next the behavior and requirement of an ACC system, and the extension to the Low Speed Following and Full Speed Range ACC, and finally we present the architecture of our system.

A. Notation

With respect to the longitudinal control, the driver is either on a free driving situation, without any forward vehicle, or constrained by a forward vehicle. This case is shown in the figure 1. The variables describing the state of each vehicles are defined in the table I. Moreover, the driver may also select the desired speed, V driver and the desired time headway, T driver

B. ACC behavior and performance

The common ACC systems [START_REF]Intelligent transport system, Adaptive Cruise Conrol system, performance requirements and test procedures[END_REF] use two low level functions:

• Speed Regulation: the system must control its speed around a driver-desired speed. This function is enable when no vehicles are detected in front of our vehicle

• Vehicle Following: the vehicle controls its speed according to the speed of the lead vehicle. The switch between each mode is decided using the following criteria (figure 2): The detection, or not of a forward vehicle, the relative speed and the clearance, and finally the driver desired speed. Moreover, [START_REF]Intelligent transport system, Adaptive Cruise Conrol system, performance requirements and test procedures[END_REF] also defines the operating range of the driving assistance. The assistance can not be activated below a given speed V min , which must be higher than 7m/s. The average automatic deceleration of ACC systems shall not exceed 3.5m/s 2 , while the acceleration is limited to 2m/s 2 . the average rate of change of an automatic deceleration (jerk) shall not exceed 2.5m/s 3 . The ISO norm also defines the minimal performance of the perception system according with the possible value of the speed and of the time gap. The iso norms [START_REF]Intelligent transport system, low speed following systems, performance requirements and test procedures[END_REF] and [START_REF]Intelligent transport system, Full speed range adaptive cruise control system, performance requirements and test procedures[END_REF] complete the description of the longitudinal control respectively for the low speed following and the full speed range adaptive cruise control (Fig. 3). C. SAGA architecture

The aim of the Smart and Green ACC is to provide a longitudinal driving assistance that is safe, comfortable and also efficient. We have to make the distinction between two main subfunctions of the system: the speed regulation and the vehicle following. For this article, we will focus on the problem of speed regulation. The vehicle following task will be discussed in the conclusion.

The speed regulation task needs to define a speed profile that is safe, according with the environment, and efficient. In order to make the system as comfortable as possible, we must define the speed enough in advance. So, the system must know the future of the road, using the vehicle localization (from a GPS) and the geometric description of the road and its limitation (from a digital map). In the following, we will describe the process to achieve a safe and efficient speed profile, and the requirements.

III. ELECTRIC VEHICLE CONSUMPTION MODEL

A. Consumption and regeneration model

In order to accelerate, decelerate, or even keep a constant speed, the vehicle motor, or braking system, must generate a torque on the driven axle. This torque must overcome all resisting forces and generate the acceleration. It could be defined as:

T e = R w 1 2 ρSC x V 2 + M gC rr + M g sin φ r + M γ (1
) where R w is the wheel radius, ρ the air volumetric mass, SC x the air drag coefficient, V the current vehicle speed, M the vehicle's mass, C rr the rolling resistance coefficient, φ r the slope and γ the vehicle acceleration. The engine speed, supposing without sliding, is w e = V /R w . Finally, we evaluate the kinetic energy and the electric energy that is either consumed or regenerated during a time dt, depending on the value of the torque, in the table II.

Where η g is the transmission efficiency, η b is the battery's efficiency and η(T e , w e ) the motor's efficiency. This last parameter strongly depends on the motor type. For the evaluation, we will use this simple model to compare the impact of the SAGA system.

B. Regenerative braking area and acceleration limit

We must also describe the deceleration area where a regenerative braking is possible, depending on the vehicle speed. As a very first approximation, an electric motor is defined by its specific power P e = T e w e (T e is defined in 1, we consider the slope, the rolling resistance, the aerodynamic forces and the desired acceleration). We can link the torque to the acceleration and the engine speed to the vehicle speed. The regenerative deceleration domain could be approximated by a maximal deceleration γ dec below a given value of the speed V 1 . For speeds that are higher, the deceleration is limited by the power of the motor:

γ d (V ) = γ dec : V < V 1 A V : V ≥ V 1 ( 2
)
where A is a negative constant that depends on the motor and drive train characteristics.

At the opposite, we also limit the possible acceleration to a maximal value γ acc . Figure 4 summarizes the possible acceleration domain, limited by the regenerative capacity.

In the Figure 5, we present a real characteristic of regenerative deceleration that is obtained on the first version of the prototype of the EU project eFuture [START_REF]eFuture EU project[END_REF]. The simple model that is developed previously, matches the shape of the real curve for speeds that are higher than 8m/s. Below 8m/s, the regenerative deceleration drops quickly. The main reasons are technological choices and to avoid that the engine generates a torque that is too strong on the wheel and blocks them. This could generate dynamic instability or increase the braking distance.

Moreover, at low speed, the electric energy that could be regenerated is lower than at higher speed because: the mechanic energy is small because the engine speed and possible torque are lower. At lower speed, it is more effective to brake using the conventional braking system: the benefit in term of regeneration is small and we can have stronger braking forces.

IV. OPTIMIZATION PROCESS AND INTEGRATION

CONSTRAINTS

A. Rules for defining a safe speed profile

The driving rules availability relies on the data included in the digital map. The minimal set of attributes does correspond with the legal speed. In order to define the maximal speed profile, we include the following rules:

• Safety, the vehicle speed profile must comply with these rules:

-Speed is limited by the legal speed limit, -At the position of a stop sign, the vehicle speed must be zero

• Comfort, the following rules may be extended. A test must be done to evaluate the driver acceptance:

-When crossing an intersection, on a main road, the maximal speed is decreased by 10km/h -When crossing an intersection, on a secondary road, the maximal speed is decreased by 20km/h -When approaching an intersection with a traffic light, the maximal speed is decreased by 10km/h

B. description of the optimization process

When the driver, or an automate, controls the vehicle, he mobilizes a given road friction at the level of the tire road interface:

µ mob = F xy F z = F 2 x + F 2 y F 2 z ( 3
)
where F x , F y and F z are respectively the forces at the tire road interface in longitudinal, lateral and vertical direction, which can be either on the front (labeled f ) or rear (r) axle. The tire road forces can be defined using the desired acceleration (longitudinal γ lon , lateral γ lat and vertical γ vert ) and the road attributes (slope φ r , banking θ r , and curvature ρ r ):

                   M γ lat = F yf + F yr -M g sin θ r I ψ = L f F yf -L r F yr M γ vert = F zf + F zr + M g cos φ r I y θ = HF e -L f F zf + L r F zr M γ lon = F e + M g sin φ r (4)
M is the vehicle mass and F e is the force that is generated by the engine to achieve a given acceleration, I y and I z are the inertia of the vehicle body along the y and z axle respectively, L r , L f and H are the distance of the center of gravity to the rear axle, front axle and the height, respectively. Moreover, we can express the lateral acceleration to follow the trajectory defined by the road and the longitudinal acceleration as the desired speed variation:

γ lat = ρ r V 2 M γ lon = V dV ds (5)
By limiting the longitudinal and lateral maximal mobilized friction to λ lon µ max and λ lat µ max , the expression of the speed is given by the following system1 :

                       V 2 = g ρr 1 + H Lr φ r . . . . . . 1 - φr λ lon µmax 2 λ lat µ max -θ r 1 = 1 λ lat µmax ρr V 2 g +θr 1-H Lr ( V g dV ds -φr) 2 + . . . . . . V g dV ds -φr λ lon µmax 2 (6)
As we limit the deceleration domain, it has an impact on both maximal safe speed and on the differential equation to compute the speed profile: the parameter λ lon µ max evolves with the speed for the deceleration phase (see eq. 2):

λ lon µ max = γ d (V ) g (7)

C. Optimization and integration constraints

In the frame of the EU project eFuture, the proposed ADAS must be integrated in the vehicle on an automotive ECU. The ECU is limited both in term of computational power and also in term of memory size. These two constraints limit us for a real optimization process.

The CWS, described previously [START_REF] Glaser | Vehicle Infrastructure Driver Speed Profile : Towards the next Generation of Curve Warning Systems[END_REF], aims to optimize the use of the road friction, both on acceleration / deceleration phase and during the curve following. It integrates a GPS to localize the system and a map to define the electronic horizon. This electronic horizon does contain the geometric description of the road, including the curvature, the slope and the superelevation. By integrating the deceleration limit to the regenerative deceleration (see figure 5), we can say that the speed profile is the fastest possible according to the safe criteria, that allows the battery regeneration.

However, in [START_REF] Glaser | Speed profile optimization for electric vehicle with regenerative capacity[END_REF], we have compared the method to generate the speed profile with existing optimization process, using Dijkstra and A * theories. The cost function CF for the optimization process is:

CF = C 1 E norm elec + C 2 t norm (8)
Where E norm elec and t norm are the normalized values of E elec and t, respectively. t is the time needed to reach the speed profile starting from the current vehicle speed V . C 1 and C 2 are the weight coefficients. The method that we present here is very close to front of the Pareto space representation of the optimization using the Dijkstra or A * algorithms.

D. Simulation results

In order to demonstrate this approach, we have defined the following road profile presented in the Figure 6. The road superelevation is correctly define, given the sign of the curvature. The legal speed limit is 90km/h from 0 to 700m, and then drops at 70km/h. At 1000m, there is a stop, the legal speed is 0km/h.

We compare the speed that is generated by [START_REF] Glaser | Vehicle Infrastructure Driver Speed Profile : Towards the next Generation of Curve Warning Systems[END_REF] and the speed from SAGA. In the Figures 7 and8, the two versions of the generation of the speed profile and the state of charge are presented. We can see that the 1km trip needs 48, 9s for [START_REF] Glaser | Vehicle Infrastructure Driver Speed Profile : Towards the next Generation of Curve Warning Systems[END_REF] and 55.7s for the SAGA, a 7s difference. The deceleration phase differs between the two profiles, but we choose to keep the acceleration at the same level. Then, the two curves are parallel in the acceleration phase (for instance, before ). This choice leads to a same variation of the state of charge (see before t = 20s). For the State of Charge, the first speed profile will consume around 0.1kW, while the SAGA regenerate 0.02kW . At the end of the curve, the energy that is generated is very low: the motor efficiency is small and the mechanic energy that needs to be absorbed is also small. Moreover, the braking force is not high, according with the Figure 5. Then, we choose to enhance the system by stopping the regenerative deceleration below a given speed threshold and switching to a conventional braking that allows a higher deceleration. For the following, we choose a switching speed of V s = 10m/s 2 . Using this threshold, we gain about 5s on the trip duration (50.8s). At the same time, the energy that is regenerated, remains equivalent.

Figure 9 shows the result's graph for the A * algorithm using the cost function described in eq. 8 on the same road profile. Each point does correspond with a selection of costs in the eq. 8. A Pareto front is clearly visible as an hyperbolic function. Our process generates a speed profile that achieves the trip in 50.8s, with an energy consumption of -0.02kW . We are close to the Pareto front in the graph.

V. CONCLUSION

A. SAGA as an energy efficient driving assistance

We have presented, in this article, an efficient way to supervise longitudinal driving assistance, such as an ACC or FSRACC, with the consideration of legal speed limit, safety and consumption. The proposed method defines a speed profile that can override the maximal speed defined by the driver. The computation of the speed profile takes into account the road geometry provided by a map, the possible regenerative deceleration during braking from the motor definition and a set of traffic rules. Following this speed profile, the trip duration is slightly increased but it allows a regeneration. In term of efficiency, the resulting profile is close to the best results of an A * algorithm. In term of computation time, the speed profile is directly computed and does not need an exploration as for the optimization method: it does not require a lot of computation or memory space. However, the system can not be tuned as an optimization method where the user can select the desired weight for the cost function. The next step will be to integrate this version of a Smart and Green ACC (SAGA) on an embedded ECU in a car.

B. Extension to the vehicle following case

In this article, we limit the SAGA to the speed regulation case, and we keep the vehicle following case as it is described in the ISO norm. This solution allows to have a safe behavior of the driving assistance regarding the other vehicle. In order to allow a regenerative braking, while being in a vehicle following mode, the driving assistance must either take a larger inter vehicular distance or rely on a secondary driving assistance that can generate a braking force that is stronger than conventional ACC, in order to ensure the vehicle safety and no collision on the operating range.

Fig. 3 .

 3 Fig. 3. Operating area of an longitudinal ADAS : Low Speed Following (LSF), Adaptive Cruise Control (ACC) and Full Speed Range ACC (FS-RACC)

Fig. 4 .

 4 Fig. 4. Possible acceleration domain, considering also regenerative capacity

Fig. 5 .

 5 Fig. 5. Real regenerative deceleration capacity of an electric vehicle

Fig. 6 .Fig. 7 .

 67 Fig. 6. Road geometry (left: curvature, right: superelevation)

Fig. 8 .

 8 Fig. 8. Resulting battery State of Charge variations

TABLE I VEHICLE

 I

DYNAMIC RELATED VARIABLES FOR THE ACC FUNCTION Variable Name Unit d Distance to the forward vehicle m V Speed of the ego vehicle m/s γ Acceleration of the ego vehicle m/s 2 T Time Headway (T = d/V ) s V i Speed of the forward vehicle m/s γ i Acceleration of the forward vehicle m/s 2 ∆V Relative speed (∆V = V i -V ) m/s Fig. 2. Strategy of ACC, the ACC switch to an activated mode with a driver request

More details on the hypothesis and developments could be found in[START_REF] Glaser | Vehicle Infrastructure Driver Speed Profile : Towards the next Generation of Curve Warning Systems[END_REF]

*Research supported by the European Community Seventh Framework program as part of the eFuture project (GA 258133)