A Modeled Approach for Online Adversarial Test of Operational Vehicle Safety
Abstract
The scenariobased testing of operational vehicle safety presents a set of principal other vehicle (POV) trajectories that seek to force the subject vehicle (SV) into a certain safetycritical situation. Current scenarios are mostly (i) statisticsdriven: inspired by human driver crash data, (ii) deterministic: POV trajectories are predetermined and are independent of SV responses, and (iii) overly simplified: defined over a finite set of actions performed at the abstracted motion planning level. Such scenariobased testing (i) lacks severity guarantees, (ii) is easy for SV to game the test with intelligent driving policies, and (iii) is inefficient in producing safetycritical instances with limited and expensive testing effort. In this paper, the authors propose a modeldriven online feedback control policy for multiple POVs which propagates efficient adversarial trajectories while respecting traffic rules and other concerns formulated as an admissible stateaction space. The proposed approach is formulated in an anchortemplate hierarchy structure, with the template model planning inducing a theoretical SV capturing guarantee under standard assumptions. The planned adversarial trajectory is then tracked by a lowerlevel controller applied to the fullsystem or the anchor model. The effectiveness of the proposed methodology is illustrated through various simulated examples with the SV controlled by either parameterized selfdriving policies or human drivers.
I Introduction
A scenariobased evaluation method ”attacks” the test subject through enforcing it into a safetycritical situation and observes the subject response and testing outcomes. For operational vehicle safety evaluation, especially concerning Advanced Driver Assistance System (ADAS) [20] and Automated Driving Systems (ADS) [24], the design and execution of test scenarios have raised wide attention from the research community [9], automotive industry, and government sectors for policy making [24, 25, 19]. Typically, one first extracts initialization conditions and vehicle maneuvers inspired by the statistical observation of human driver crash data. The scenario is then specified with a given initialization state for all vehicles and a set of predetermined POV trajectories. Note that the POV trajectory is generated through a series of highlevel planning commands and is often independent of the SV response. For example, one can refer to Fig. 0(a) that shows a Lead Vehicle Lane Change and Braking (LVLCB) scenario [25] for ADAS safety evaluation.
The problems of the aforementioned scenario designs are threefold. First, the current scenarios lack severity guarantees. The assumption that a scenario extracted as described above and brought to a test track will generate similar SV responses, similar safetycritical situations, and similar outcomes ignores the significant differences in sensing, control algorithms, control authority and implementation on the different SVs being tested. Second, the predetermined POV trajectories defined over simplified action space is easy for the SV to game the test, especially given that the SV is operating with intelligent decision making both longitudinally and laterally (e.g., Fig. 0(b)). Finally, the current approach does not create sufficient safetycritical instances within the limited and expensive realworld testing effort. While virtual simulations have provided the opportunity to enhance autonomous vehicle testing efficiency, the simtoreal gap remains a challenge in general. Furthermore, the simplified action space is incapable of creating agile, dynamic maneuvers, which confines the scenario propagation to relatively simple configurations. This also limits the testing efficiency in both realworld tests and simulations.
Inspired by the problems mentioned above, the adversarial adaptive testing scheme has become a natural alternative. Existing approaches mostly focus on learning inspired methods [13, 5, 6], which typically require the algorithm to interact with a fixed SV driving algorithm for many iterations. These are sampling inefficient and would only be applicable in virtual simulations. Some also seek for guided sampling from an offlinebuilt scenario library [9]. The approach resolves the traditional scenariobased testing approach’s problem by making SV more difficult to game the test, but the other two problems as mentioned above remain valid.
To address the aforementioned problems of both the traditional scenariobased testing methods and the adaptive adversarial testing approaches, the proposed methodology is inspired by investigating the following two questions.

Q1: If we can predict the SV motion trajectory with sufficient accuracy, can we design the POV motion to reach a safetycritical scenario?
In general, if the infinitetime future planning of the SV is perfectly known and the POV is sufficiently capable in terms of its admissible space for control, the POV can guarantee to capture the SV at least asymptotically. This is achieved by taking the known SV motion trajectory as a motion tracking reference for the POV, which naturally leads to a minimization problem closely related to the Model Predictive Control (MPC) formulation [3].

Q2: If the SV motion trajectory is unknown or difficult to predict, can we design the POV motion to arrive at a safetycritical scenario?
The reachability analysis from differential games [10] and optimal control has answered the above question analytically. In general, the capture of the SV cannot be guaranteed if the SV’s policy is unknown. However, suppose the SV and POV are sufficiently close such that the relative state belongs to the maximal backward reachable set (see equation (6) in [17]). In that case, there exists a feedback control policy for the POV such that for all possible motion trajectories of the SV, the policy renders a motion trajectory that guarantees the capturing of the SV. By assigning such a worstcase policy to the POV, one can ensure the generation of a safetycritical scenario.
In practice, one should also factorize the admissible action constraints, operable domain allowed by traffic rules, and other concerns to propagate a ”reasonable” dangerous scenario. Combining the solutions for the above questions, we propose an online feedback control policy for POVs that allows rendering adversarial paths without breaking traffic rules or responsibility agreement. The contribution of this work is threefold:
A Modeled Approach The proposed framework is modeldriven and induces theoretical guarantees for a certain safetycritical level of the derived scenario under standard assumptions.
Adaptive Scenarios The derived motion trajectory of each POV varies adaptively based on the SV response throughout the propagation of a testing scenario. This creates more challenging testing instances within the same amount of testing effort than many of the current ADS testing scenario designs [19, 25] where the POV actions are independent of the SV behavior. The proposed adaptive framework acts on the POV control level, which also creates agile motion trajectories that are more difficult for the SV to game the scenario.
Online Execution The proposed method formulates an anchortemplate hierarchy control structure [27], with the simplified template planning naturally leading to a series of quadratic programming problems with computationally tractable solutions. This is, to the best of our knowledge, the first introduction of an online path planning algorithm for POVs which constructs adversarial testing scenarios.
Furthermore, we extensively evaluate the proposed framework’s performance in a multilane straightsegment environment with parameterized SV driving policies and human drivers of various levels of aggressiveness. We observe that the adaptive framework enforcing the SV into various safetycritical situations. One particularly interesting observation is that the SV typically remains collisionfree if (i) the driving policy is conservatively safe, or (ii) the SV is willing to take extreme evasive maneuvers that are beyond the expectation of the modeled formulation (see Fig. 0(d)).
The remainder of this paper is organized as follows. Section II introduces the background setting of this work, including the problem formulation. Section III presents details on the proposed method. Section IV explains the experimental settings and the results analysis and finally, section V presents conclusions and future work.
Ii Preliminaries
We present the problem formulation of operational vehicle safety evaluation through the scenariobased test. We also revisit the basics of the anchortemplate hierarchy control framework.
Iia Problem formulation
Consider a heterogeneous multivehicle system of one subject vehicle (SV) and principal other vehicles (POVs). Each vehicle’s motion is subject to a certain ordinary differential equation in general. Without loss of generality, for the th agent (),
(1) 
For the remainder of this section, the subscript is omitted for general discussions of vehicle motion. We consider that the map is uniformly continuous, bounded and Lipschitz continuous in for fixed control . Hence, given a measurable control action , there exists a unique trajectory solving (1) for a given .
Let a snapshot be the combined states of all vehicles at a time instance [26]. We then have the following definition of a testing scenario:
Definition 1.
A scenario is a automaton denoted by a tuple of , where

is the set of snapshots, with each snapshot containing one SV and POVs as specified above.

is the ”alphabet” of the automaton, in particular, the control action space of all vehicular participants in the scenario, i.e., .

is the motion transition function as defined in (1).

specifies the initial condition.

is the subset of deemed acceptable.
The acceptable set of snapshots is mainly concerned with safety and is defined as follows:
(2) 
where denotes the position states and is referred to as the capture diameter. Note that only the SV safety is concerned. Correspondingly, the unsafe set of states is obtained as
(3) 
Given a string of control input, we designate the run of a scenario be a chronological sequence of snapshots from initial to final time .
Most of the elements that define a scenario are given, with only the initial condition and the automaton alphabet subject to various possibilities of configurations. Given that SV control is part of the testing subject, only the POV control actions are of interest for scenario designs. Intuitively, one seeks to derive a feedback control policy
(4) 
for the group of POVs such that the SV is forced into a sufficiently dangerous situation. Although the POV control is specified through a general class of functions that could be statedependent and timevariant, it is worth emphasizing that the typical implementation of the POV control in practice remains fairly simple. POV action trajectories are mostly independent of state propagation, as shown in Fig. 0(a).
In general, the multivehicle system is subject to highly nonlinear motion dynamics and complex stateaction constraints. From the model point of view, it remains a challenge to derive agile motion planning algorithms for multiple POVs to cooperate in forcing the SV into dangerous situations. In this paper, we consider an anchortemplate framework, as introduced in the following section.
IiB Anchortemplate framework for vehicle motion planning
When a full system model or anchor model is too complex to design an appropriate controller, it is possible to use a simplification or template model that still captures the anchor model’s essential characteristics and properties. Such a framework has been widely adopted in bipedal locomotion [28] and vehicle control [22].
A typical template model captures the motion feature of the anchor model with lower dimensional state space and simplified dynamics. In this paper, the complex anchor model state is replaced with the simpler template state of discretetime locally linearized motion equation formulated as
(5) 
with timestep and system matrices
(6) 
The state vector for each vehicle consists of the Cartesian coordinates of the position , the speed and the heading angle . For the linearization, a constant speed is also used. The control action includes the longitudinal and lateral accelerations .
The model above is adapted from [12, 26] assuming small course angles and small changes in speed for local linearization. Theoretically, the control input is subject to the Kamm’s circle [8] induced bounds. The state constraints are typically determined by speed limits, road topology, and other concerns regarding the admissible operable domain of vehicles. In this paper, we approximate the stateaction constraints with a linear architecture in the form of and .
Iii Method
Fig. 2 presents a general overview of the proposed framework. The adversarial scenario propagation starts with an initial snapshot of the system . The test ends if a certain termination condition is satisfied (e.g., encountering a collision); otherwise, one executes the templatebased planning stage. For adversarial motion planning, one first seeks to create safetycritical scenarios assuming the SV policy is unknown. If the POVtoSV distances are not sufficiently small, such a worstcase planning algorithm may not be applicable. One then moves on to the predictive planning stage, where the POV’s adversarial policy is derived based on a certain assumed predicted behavior of the SV. The planned reference trajectory is then tracked by a lowerlevel controller such as MPC.
For the remainder of this section, we introduce the worstcase planning and predictive planning in a pairwise manner with one POV and one SV. Without loss of generality, let the subscript denote the adversarial POV and the SV. Finally, we will extend the idea to multiple cooperative POVs.
Iiia Worstcase planning
Intuitively, the worstcase planning stage seeks to derive the POV adversarial trajectory without knowing the SV intentions. By the definition of unsafe snapshots as specified in (3), starting from a safe initial condition at time , if the pair of control strategies renders the trajectory converging to at some finite time, we denote such a capture time as . The pairwise SV and POV form a zerosum game, wherein the SV seeks to maximize and POV seeks to minimize . Correspondingly, we have the minimax optimal feedback strategy and satisfying the saddle condition as
(7) 
with referred to as the minimal capture time. Theoretically, exists if and only if the initialization condition is inside the maximal backward reachable set [17], i.e., there exists a POV control strategy such that regardless of the SV responses, one can ensure the capturing of the SV. In practice, for a general nonlinear system, can be obtained through a discrete approximation of the HamiltonJacobianBellman partially differential equation (HJBPDE) [2]. In this paper, we seek to derive the , if applicable, within a local lookahead time horizon up to seconds. With the simplified template dynamics, one can approximate by iteratively solving a series of minimax quadratic programming problems as discussed in [26]. One can also derive the function of mapping a snapshot to the corresponding offline. Given the minimal capture time , we can then formulate the optimal feedback policy for the POV as
(8a)  
s.t.  (8b)  
(8c)  
(8d)  
(8e) 
In practice, the above optimization is solved at each planning stage presenting the current snapshot as the initialization condition. The instantaneous reference motion trajectory is then obtained by propagating the templatemodel motion for seconds with the sequence of optimal actions .
Note that the capturing guarantee at the templatemodel level is subject to some assumed state constraints of (8c) and action constraints (8d) of the SV. That is, the capturing will undoubtedly fail if the SV is willing to perform extreme evasive maneuvers that are beyond its assumed capability. While such an outcome may be deemed aggressive in terms of passenger comfort and vehicle dynamic stability, it is still technically a safe choice of action from the operational safety perspective. Furthermore, consider that the definition of safety is induced by the 2norm distance between vehicles as indicated by (2), which is not necessarily equivalent to vehicletovehicle collisions in realworld driving. This leads to a tradeoff phenomenon when determining the capture diameter of . That is, a larger choice of results in a larger maximal BRS and hence increases the likelihood of deriving a minimal capture time . However, a wide choice of also makes it difficult for a real vehicletovehicle collision to occur, leading to snapshots that are not sufficiently safetycritical. A more detailed comparison regarding this tradeoff will be presented in Section IV between Fig. 5 and Fig. 6.
IiiB Predictive planning
If the worstcase planning is not applicable (i.e., one cannot find a qualified minimal capture time ), this implies the current snapshot is not severe enough to enable a guaranteed capturing. We propose to consider an alternative based on the assumed predictive motion of the SV.
Historically, vehicle motion prediction has been studied extensively [11, 14]. The various selfdriving algorithms that are modelbased [21, 4, 18] and learninginspired [1, 30] are also applicable to serve as the SV motion predictor. In this paper, we predict the SV motion based on the steadystate assumption. The traditional steadystate assumption assumes fixed velocity and heading (i.e. control ). It is also the fundamental assumption for various vehicle safety related methodologies including TimetoCollision [15] for safety analysis and human driver behavior characterization such as gap acceptance [29] and leadvehicle following distance [23]. In most of the examples presented in the Section IV, we adopt a modified steadystate assumption which assumes that the SV is maintaining the current control action up to the assigned time horizon. Let such a predictive policy for the SV be , one can then take the predicted motion of the SV as the tracking reference for the POV. With the running cost and termination cost determined by and respectively, and considering , we have the following optimization problem for the predictive planning:
(9a)  
s.t.  (9b)  
(9c)  
(9d)  
(9e)  
(9f) 
The reference trajectory for the POV is generated following a similar procedure as discussed in the worstcase planning section.
Finally, an MPC is used as the navigation controller that allows the POV to follow the reference path obtained from the planning stage. It is worth emphasizing that although both MPC for vehicle motion tracking and the templatemodel based planning rely on a certain linearized motion equation, the two formulations are not necessarily the same. In our case, the templatemodel adopts the formulation in (6) with the control action specified as accelerations, which are easier to identify through perceivable states with quantifiable constraints. On the other hand, the MPC adopts the formulation from [22] with the control action defined as acceleration and steering wheel angle , which is easier to implement for direct vehicle control tasks. The various stateaction constraints deployed in the planning stage as specified in (8a) and (9a) are also included in the MPC formulation. Therefore, even if mild discrepancies may occur between the templatemodel used for planning and the anchormodel adopted for motion tracking, the constraints remain valid.
IiiC MultiPOVs
With the adversarial pairwise interactive scenario presented through sections above, we are now ready to extend the framework to work with multiple POVs. In practice, it is overly aggressive to assume that all POVs present in the snapshot will cooperatively attack the SV. The absolute cooperative POV planning also proposes an extra challenge to the scenario design given none of the POVs are supposed to crash into each other during the scenario propagation. On the other hand, some existing work [26] considers the partially noncooperative assumption, which assumes at most one adversarial POV with the rest of the POVs complying with the SV for collision avoidance. Although this assumption simplifies the analysis significantly and enables a pairwise study between the SV and each POV, the partial noncooperativeness is still conservative.
In this work, we propose a multiPOV scenario generation scheme which allows multiple POVs propagating cooperative safetycritical scenarios in a controlled manner. This is done by assigning each POV a dedicated set of stateaction constraints which ensures the noninteractive motion between POVs. Section IV will present more detailed examples for multiPOV adversarial scenarios propagated with the proposed method.
Iv Experimental results
We illustrate the performance of the proposed approach with two types of simulations. We first demonstrate the adversarial testing scheme against a series of parameterized selfdriving policies in a customized simulation environment. We then expand the test to humandriven SVs performed in the CARLA simulator [7]. Throughout all simulations, we have for the planning and MPC horizon limit. We also assume an identical admissible action space for all POVs and the SV with . Considering the straightsegment environment we are studying, the cost matrices in (9a) are defined to emphasize the lateral tracking accuracy satisfying .
Iva Testing parameterized selfdriving policies
The parameterized selfdriving policy is a combination of the Intelligent Driving Model (IDM) and a set of customized lanechange heuristics. The IDM formulation is adapted from [16]. The lane change heuristics consist of two stages, decision making and lanechange execution. The lanechange decision is determined by the current SV velocity and the leadlag gap acceptance with parameters adopted from the naturalistic behavioral study of [29]. The lanechange execution is divided into two parts. The longitudinal velocity is adapted from the IDM model. The lateral motion is controlled by a parameterized PD controller subject to yawrate constraints. We first present a set of pairwise interactive scenarios with one POV and one SV. We then extend to the multiPOV settings.
Pairwise Interactions
Throughout the pairwise interactive scenarios presented in this section, we consider the same initialization condition inspired by the standard Crash Imminent Brake (CIB) system test as shown in Fig. 3. Both SV and POV are confined to the threelane operable domain, with extra state constraints for restricting the POV to initiate a rearend collision against the SV within the same lane. The admissible velocity range is confined to . Vehicles are assumed identical with a length of and a width of . Lane width is set to . The adversarial planning algorithm and all vehicle motion controllers are executed at Hz. A scenario terminates at seconds after the initialization, or earlier if a vehicletovehicle collision is detected. Unless stated otherwise, the mentioned configurations remain the same for all other examples. Simulation results with various selfdriving policies of different hyperparameters are shown in Fig. 4, Fig. 5, and Fig. 6. Here it is worth emphasizing the performance comparison between Fig. 5 and Fig. 6. The SV policy, initialization conditions and stateaction constraints are all set identically in both tests with the only difference lying in the choice of the capture diameter . In Fig. 5 we use a smaller value of . The POV switches from the predictive planning mode to worstcase planning mode about seconds after the test initialization and the collision occurs seconds later. On the other hand, in Fig. 6 we take a larger value of , which makes it easier to initiate the worstcase planning mode ( seconds earlier than the case in Fig. 5). However, the relatively large capture space makes the scenario run less severe than the example in Fig. 5 and fails to force a vehicletovehicle collision. Furthermore, note that the SV performs an abrupt acceleration of at during a single lanechange stage to its left. This behavior is significantly outside the expectation as the worstcase planning algorithm assumes the maximum longitudinal acceleration of SV is only . As we have mentioned in Section III, although such an extreme evasive maneuver is deemed aggressive by common sense, it leads the SV to a lowerrisk driving status in terms of collision avoidance. Hence, the proposed online adversarial framework succeeds in creating a sufficiently dangerous scenario such that the proper response of SV can be tested.
MultiPOV scenario
We further present three multiPOV scenarios as shown in Fig. 7, Fig. 9, and Fig. 8. Throughout all the examples, each POV is assigned with a unique operable space that does not overlap with other POV’s. The capture diameter is set to for all examples. Admissible velocity range is modified to . The assumed admissible action space for SV and all POV’s are identical during the adversarial trajectory planning stage, but in practice, the SV is often more capable than POV both longitudinally and laterally. This is particularly obvious in Fig. 7 where the worstcase planning transits back to the predictive planning stage 7 times for POV1 before the SV colliding to POV2 from the rear side. Intuitively, one can refer to Fig. 6(c) where the SV is performing active single lanechange and double lanechange maneuvers before the collision occurs. Fig. 9 and Fig. 8 give two other examples of how adversarial POV’s can cooperate to enforce safetycritical scenarios.
IvB Testing human drivers
The proposed method is also implemented in the CARLA simulator. We replicate several of the initial test runs in the previous subsection with similar parameters. Fig. 10 shows a top view in the simulator from the initial condition shown in Fig. 3, where the trajectory followed by both the SV (blue) and the POV (red) is shown onscreen. The waypoints from both vehicles for a time horizon of 2 seconds are also drawn. Additionally, this implementation allows a human driver to take over the SV control while the POV is dynamically reacting to the SV’s actions. It is shown that the predictive planning has allowed the POV to react appropriately to provoke nearcollision situations even when the SV’s policy is completely unexpected (human driver).
V Conclusions
This paper presents an online adversarial framework for the scenariobased testing of operational vehicle safety. The proposed method generates sufficiently dangerous testing scenarios in an efficient and controlled manner. It is applicable for the safety evaluation of humandriven, as well as ADS and ADAS equipped vehicles. Various simulated examples are also presented to show the empirical effectiveness. It is of future interest to extend the method to different environment configurations such as intersections, roundabout, and parkinglot. We will also improve the methodology with realworld experiments in proving ground tests.
Acknowledgment
This work was funded by the United States Department of Transportation under award number 69A3551747111 for Mobility21: the National University Transportation Center for Improving Mobility.
Any findings, conclusions, or recommendations expressed herein are those of the authors and do not necessarily reflect the views of the United States Department of Transportation, Carnegie Mellon University, or The Ohio State University.
References
 (2016) End to end learning for selfdriving cars. arXiv preprint arXiv:1604.07316. Cited by: §IIIB.
 (2010) Reachability and minimal times for state constrained nonlinear problems without any controllability assumption. SIAM Journal on Control and Optimization 48 (7), pp. 4292–4316. External Links: Document, ISSN 03630129 Cited by: §IIIA.
 (2013) Model predictive control. Springer Science & Business Media. Cited by: §I.
 (202006) Optical flow based visual potential field for autonomous driving. Proceedings of the 31st IEEE Intelligent Vehicles Symposium (IV’20). Cited by: §IIIB.
 (2020) Adversarial evaluation of autonomous vehicles in lanechange scenarios. arXiv preprint arXiv:2004.06531. Cited by: §I.
 (2020) Learning to collide: an adaptive safetycritical scenarios generating method. arXiv preprint arXiv:2003.01197. Cited by: §I.
 (2017) CARLA: an open urban driving simulator. arXiv preprint arXiv:1711.03938. Cited by: §IV.
 (2015) Shared vehicle control using safe driving envelopes for obstacle avoidance and stability. Ph.D. Thesis, Stanford University. Cited by: §IIB.
 (2020) Testing scenario library generation for connected and automated vehicles, part i: methodology. IEEE Transactions on Intelligent Transportation Systems. Cited by: §I, §I.
 (1965) Differential games and optimal pursuitevasion strategies. IEEE Transactions on Automatic Control 10 (4), pp. 385–389. Cited by: §I.
 (2013) Vehicle trajectory prediction based on motion model and maneuver recognition. In 2013 IEEE/RSJ international conference on intelligent robots and systems, pp. 4363–4369. Cited by: §IIIB.
 (2018) Criticality metric for the safety validation of automated driving using model predictive trajectory optimization. In 2018 21st International Conference on Intelligent Transportation Systems (ITSC), pp. 60–65. Cited by: §IIB.
 (2019) Generating critical test scenarios for automated vehicles with evolutionary algorithms. In 2019 IEEE Intelligent Vehicles Symposium (IV), pp. 2352–2358. Cited by: §I.
 (2017) SPOT: a tool for setbased prediction of traffic participants. In 2017 IEEE Intelligent Vehicles Symposium (IV), pp. 1686–1693. Cited by: §IIIB.
 (1976) A theory of visual control of braking based on information about timetocollision. Perception 5 (4), pp. 437–459. Cited by: §IIIB.
 (2012) Driver intent inference at urban intersections using the intelligent driver model. In 2012 IEEE Intelligent Vehicles Symposium, pp. 1162–1167. Cited by: §IVA.
 (2007) Comparing forward and backward reachability as tools for safety analysis. In International Workshop on Hybrid Systems: Computation and Control, pp. 428–443. Cited by: §I, §IIIA.
 (2013) A game theoretic approach to controller design for cyberphysical systems: collision avoidance. In 2013 ACM/IEEE International Conference on CyberPhysical Systems (ICCPS), pp. 254–254. Cited by: §IIIB.
 (2010) Crash imminent braking (CIB) first annual report. Technical report DOT HS 811 340. Cited by: §I, §I, Fig. 3.
 (2016) Advanced driver assistance systems. Technical report SAE Technical Paper. Cited by: §I.
 (2008) Model based vehicle tracking for autonomous driving in urban environments. Proceedings of robotics: science and systems IV, Zurich, Switzerland 34. Cited by: §IIIB.
 (2011) Vehicle dynamics and control. Springer Science & Business Media. Cited by: §IIB, §IIIB.
 (2001) A review of constant time headway policy for automatic vehicle following. In ITSC 2001. 2001 IEEE Intelligent Transportation Systems. Proceedings (Cat. No. 01TH8585), pp. 65–69. Cited by: §IIIB.
 (2018) A framework for automated driving system testable cases and scenarios. Technical report United States. Department of Transportation. National Highway Traffic Safety. Cited by: §I.
 (2019) Traffic jam assist (TJA) system confirmation test. Technical report DOT HS 812 759. Cited by: Fig. 1, §I, §I.
 (202006) Model Predictive Instantaneous Safety Metric for Evaluation of Automated Driving Systems. In Proceedings of the 31st IEEE Intelligent Vehicles Symposium (IV’20), Cited by: §IIA, §IIB, §IIIA, §IIIC.
 (2017) Template models for control. Bioinspired Legged Locomotion. Elsevier, pp. 240–266. Cited by: §I.
 (2006) Trajectory free linear model predictive control for stable walking in the presence of strong perturbations. In 2006 6th IEEERAS International Conference on Humanoid Robots, pp. 137–142. Cited by: §IIB.
 (2019) Examining lane change gap acceptance, duration and impact using naturalistic driving data. Transportation research part C: emerging technologies 104, pp. 317–331. Cited by: §IIIB, §IVA.
 (202006) Integrating deep reinforcement learning with modelbased path planners for automated driving. Proceedings of the 31st IEEE Intelligent Vehicles Symposium (IV’20). Cited by: §IIIB.