I Introduction
Selfdriving car has been regarded as the solution to current transportation problems and has obtained significant improvement in recent years. Nevertheless, from the recent selfdriving car accidents, people understand that safety remains an issue. From car A shown in Figure. 1, it is clear that safety in the sense of collision cannot be guaranteed. The way to circumvent this problem is to redefine the meaning of safe. ShalevShwartz et al. define the safe in the sense of whether to share responsibility in an accident [1]. We adopt this idea of safe and create rules and definitions with mathematical rigors using LTL, the logic syntax often used in fields like automaton and control system to describe their concurrent characteristics with greater precision [2, 3, 4].
Based on our definitions, we propose the concept of safe driving throughput (SDT) and safe driving capacity (SDC). SDT and SDC have more practical uses than the throughput defined conventionally since it guarantees the vehicles being calculated to be blamefree under a lowest speed limit. We analyze various factors that could have impacts on them by studying the longitudinal distance between vehicles. There were several related studies concerning the effects of longitudinal distance; [5] focuses on how it affects the stability of platoons and [6] focuses on passenger comfort affected by it. There were also several studies about rearend collisions; [7] focuses on the role the response of agents play and [8] studies the relation between the warning system and the collisions. We aim to study how longitudinal distance affects rearend collisions under the safe driving presumptions.
The contributions of this paper are twofold.

We formalize the concept of safe in the sense of responsibility using the LTL syntax. Based on it, we propose the concept of SDT and SDC that take both efficiency and safety into consideration.

We show the fundamental differences between PBV and CBV by analyzing their SDC and present a protocol that could achieve such capacity.
We organize the paper as follows. Section II describes assumptions used in this paper and gives definitions needed in the following contexts, followed by our proposed protocol and detailed analysis on the SDC gain it brings to the road comparing to the case which the road is filled with PBVs in Section III. In Section IV, we show the analytic result by figures and discuss them. In Section V, we conclude our work and point out related open issues.
Ii Assumptions and Definitions
Iia Assumptions
IiA1 Vehicle Requirements
All the vehicles we discuss are equipped with a high precision mapping system, navigation system, full autonomous controller, complete perception system, wireless interfaces for communication and high accuracy positioning system. The perception system consists of different types of sensors such as LIDAR, camera, and radar in charge of sensing the parameters of the car in front [9]. The wireless communication interface allows the vehicle to use any of the wireless technology including cellular interfaces like 4G/5G and DSRC [10, 11].
IiA2 Homogeneous
All the vehicles are autonomous vehicles equipped with requirements mentioned above.
IiA3 Reliable
All the messages from other vehicles are presumed to be reliable.
IiA4 Road Requirements
All the vehicles are running on a straight road without any intersection and merging point.
IiB Formalization and Definitions
In this subsection, we give definitions needed to define the safe driving throughput and safe driving capacity. For mathematical rigors, the syntax of LTL is used to help formalizing some of the definitions. In the following context, we assume that there are N vehicles on the road , that is, . Every vehicle has its own finite sequence of states . The subscript denotes the time horizon we care about and it should be systemdependent. The predicate is iff collides with any other vehicle and the predicate is true iff shares responsibility in an accident if any happens.
Definition 1: Longitudinal Distance:
The longitudinal distance of two cars is the distance between their body center measured along the direction of the road.
Definition 2: best effort reaction(BER):
The best effort reaction (BER) of a car is to apply max braking power along the direction of the road until the car halts.
Definition 3: Safe Longitudinal Distance:
Two vehicles are in safe longitudinal distance if , the one in front, makes a sudden change of behavior, the longitudinal distance between them is still sufficient for , the one behind, to react and not bump into . If even applying BER cannot prevent from the collision, such distance is unsafe.
Definition 4: Safe State of a Vehicle :
A vehicle is in a safe state iff performing BER could spare it from responsibility even when an accident happens.
(1) 
Definition 5: Safe State of a Road R:
A road R with N vehicles is in the safe state iff all the vehicles running on it are in safe state.
(2) 
Definition 6: Safe Driving Throughput (SDT) of a road R:
The safe driving throughput of R is the number of vehicles in the safe state that are on R. Noted that SDT(R) and if the road is in safe state .
Definition 7: Conservative Observation:
One observation is more conservative than another if the decision made based on it makes the vehicle more probable to stay in the safe state. We define the function
which takes observation metrics set M as input and return the most conservative one among the set as output.(3) 
Here is the ensemble average of all the observations and B is the set of all the biases of perception system.
Definition 8: Inaccuracy of Metrics: Inaccuracy of metrics due to the perception system is defined as:
(4) 
So that we have:
(5) 
As shown above, the deviation of a metrics M,
, is defined as the ratio of its actual value and its most conservative estimate. We expect a good perception system to have
, i.e., .Definition 9: Safe Driving Capacity (SDC):
We define the safe driving capacity of a road as the number
of vehicles on an MkilometerNlanestraightroad requiring every vehicle to be in the safe state and runs at least V km/hr. We use the default values M=10, N=2, and V=100 unless otherwise specified and denote it as SDC(10,2,100).
Definition 10: Perceptionbased vehicle (PBV):
A perceptionbased vehicle is a vehicle that makes decisions based only on the data obtained from its perception system.
Definition 11: Cooperativebased vehicle (CBV):
A cooperativebased vehicle is a vehicle that makes decisions mainly based on the data obtained through intervehicular communication. Fig. 2 shows the difference between roads with PBVs in definition 10 and road with CBVs in definition 11.
Iii Derivations and Cooperative protocol
Iiia SDC analysis on road with PBVs
Based on the definitions in Section II, we derive the formula of safe longitudinal distance between two vehicles with the variables given in TABLE I. For simplicity, We define:
(6) 
(7) 
(8) 
Here
stands for the time elapsed from the moment it detects a sudden full brake from the car in front till the time
. is the time for the front car to enter full stop from its original speed, i.e. the time . is the maximum velocity the rear car could after the entire response time . With these derived variables, the safe longitudinal distance is given as:(9) 
Proof of equation.9: For , the proof is trivial if we presume both their speed drop at constant rate since it’ll take longer for the front car to halt.
For , Let denote the distance between two vehicles at time . Then
(10) 
As long as two cars are still moving after seconds where , the first four terms on the righthand side of equation 10 will be , meaning the distance between two vehicles after . The last term in equation 10 means the distance moved by the rear car from time to . Now it only requires , we can make sure two cars won’t collide. By rearranging the terms, we conclude the proof.
IiiB Cooperative protocol
In this subsection, we propose a protocol that allows the road with CBVs to achieve its maximum SDT, i.e., SDC.
IiiC SDC analysis on road with CBVs running Algorithm 1
The accuracy of , and could be enhanced by the cooperative intervehicle communication. And since the delay is additive, we have
(11) 
Here denotes the time from the point receives information from till its system starts to brake. To show the clear contrast to the result from road with PBVs, we denote all the variables with subscript C as the actual value corrected by communication. By definition of inaccuracy of metrics defined in Section II, we have:
(12) 
(13) 
(14) 
(15) 
Noted that if the deviations , , and are all 1, it means the PBVs perceive the actual value of all the vehicle arguments needed. Also noted that is not affected by . By the same procedure in subsection A: ; , and . Using these variables, the communicationcorrected version of safe longitudinal distance will be for the trivial case ; for the case ,
(16) 
Lemma 1
If for any metrics , is always more conservative than its actual value, the estimation of the safe longitudinal distance of CBVs is less or equal to the one of PBVs:
Proof of Lemma 1:
It’s the direct consequence of definition 5 and definition 6.
Lemma 2
Let denote the expected value of variable X, The SDC of a road R with PBVs is given as:
Lemma 3
The SDC of a road R with CBVs is given as:
Proof of Lemma 2 and Lemma 3: The term in the fractions denotes the distance from the center of the first vehicle to the center of the last vehicle. Since all the vehicles are asked to keep at least from the vehicles in their front, we have intervehicle spaces. This implies that a single lane can accommodate vehicles. Proof of Lemma 3 is identical to Lemma 2.
Theorem 1
The is upper bounded by the if is always more conservative than actual for any metrics .
Iv Simulation and Discussion
For a vehicle equipped with ABS (Antilock brake system), at the speed of 100 km/h, the maximum acceleration and deceleration are and around respectively [12]. In our analytic simulation, we let sec for the road with PBVs and for the road with CBVs. we evaluate the SDC(10,2,100). Noted that if the lowest speed limit V is not put in the definition, the SDC becomes meaningless since the capacity achieve maximum if all the vehicles stop. From Fig. 3, we can see that even some minute perception inaccuracies could lead to huge differences in the safe longitudinal distance and thus SDC. Fig. 4 shows the effect on SDC from various values of under different inaccuracies of , and . Each here features a specific kind of V2V communication. The latency of DSRC and 5G in V2V applications are supposed to be shorter than the value we adopt [13]. The machine response time we use here lies in the range of ms. This is the around the time needed for an inattentive driver and of an attentive driver [14]. If we compare Figure. 3 with Figure. 4, we can conclude that even some inaccuracy metrics have little impact on the SDC, Their effects become ineligible when all of them are considered.
V Open issues and future work
In this work, we intentionally simplify some of the analysis, especially the parts that are supposed to be probabilistic instead of deterministic due to the stochastic nature of both enroute drivings and intervehicle communications. The scenarios we presumed in Section II might also be too ideal from the perspective of the realworld situation. The SDC we obtained is the one without any concept of platooning but focus on the result of individual car behaviors. Training a selfdriving car is itself a challenging problem but we choose to ignore this issue and presume the vehicles are capable of driving perfectly like an adrift human driver. For the convenience of deterministic analysis, we let the road to be intersectionfree and straight. However, the case with intersections and roads that are not straight might generalize the SDT and the SDC. We leave them as our future work. Another thing worth mentioning is that the concept of SDT and SDC may also apply to human drivers or the heterogeneous situation that consists of mandrive vehicles and selfdriving vehicles with just minor modifications. This fact makes our work even more practical.
Variable (unit)  Description 

is true  
The minimum safe longitudinal distance  
Response time for rear car  
Speed of rear car  
Speed of front car  
The deceleration of full braking power  
Max acceleration of a car  
Length of vehicle, we suppose all the same.  
The time rear car need to enter a full stop  
The time front car need to enter a full stop  
Maximum possible after sec  
The corrected minimum safe longitudinal distance  
Corrected Response time  
Corrected Speed of front car  
Inaccuracy of sensors measuring L  
Inaccuracy of sensors measuring  
Inaccuracy of sensors measuring  
Inaccuracy of sensors measuring  
Corrected max deceleration of front car  
Corrected length of vehicle  
Corrected time rear car need to enter a full stop  
Corrected time front car need to enter a full stop  
Corrected maximum possible after sec  
Random variable of the latency between CBVs  

References
 [1] S. ShalevShwartz, S. Shammah, and A. Shashua, “On a Formal Model of Safe and Scalable Selfdriving Cars,” ArXiv eprints, Aug. 2017.
 [2] A. Sistla, “Safety, liveness and fairness in temporal logic,” vol. 6, 09 1999.
 [3] A. Rabinovich, On Almost Future Temporal Logics. Springer International Publishing, 2015, pp. 261–272.

[4]
D. Sadigh, E. S. Kim, S. Coogan, S. S. Sastry, and S. A. Seshia, “A learning based approach to control synthesis of markov decision processes for linear temporal logic specifications,” in
53rd IEEE Conference on Decision and Control, Dec 2014, pp. 1091–1096.  [5] S. Sheikholeslam and C. A. Desoer, “Longitudinal control of a platoon of vehicles,” in 1990 American Control Conference, May 1990, pp. 291–296.
 [6] L. Hoberock, “A survey of longitudinal acceleration comfort studies in ground transportation vehicles,” vol. 99, 1977.
 [7] B. D. Seppelt and J. D. Lee, “Modeling driver response to imperfect vehicle control automation,” Procedia Manufacturing, vol. 3, pp. 2621 – 2628, 2015.
 [8] F. Bella and R. Russo, “A collision warning system for rearend collision: a driving simulator study,” Procedia  Social and Behavioral Sciences, vol. 20, pp. 676 – 686, 2011.
 [9] R. H. Rasshofer and K. Gresser, “Automotive radar and lidar systems for next generation driver assistance functions,” Advances in Radio Science, vol. 3, pp. 205–209, 2005.
 [10] G. Araniti, C. Campolo, M. Condoluci, A. Iera, and A. Molinaro, “Lte for vehicular networking: a survey,” IEEE Communications Magazine, vol. 51, no. 5, pp. 148–157, May 2013.
 [11] Q. Xu, T. Mak, J. Ko, and R. Sengupta, “Vehicletovehicle safety messaging in dsrc,” in Proceedings of the 1st ACM International Workshop on Vehicular Ad Hoc Networks, ser. VANET ’04. New York, NY, USA: ACM, 2004, pp. 19–28.
 [12] M. Segata and R. L. Cigno, “Automatic emergency braking: Realistic analysis of car dynamics and network performance,” IEEE Transactions on Vehicular Technology, vol. 62, no. 9, pp. 4150–4161, Nov 2013.
 [13] R. Ford, M. Zhang, M. Mezzavilla, S. Dutta, S. Rangan, and M. Zorzi, “Achieving ultralow latency in 5g millimeter wave cellular networks,” IEEE Communications Magazine, vol. 55, no. 3, pp. 196–203, March 2017.
 [14] T. L. Brown, J. D. Lee, and D. V. McGehee, “Human performance models and rearend collision avoidance algorithms,” Human Factors, vol. 43, no. 3, pp. 462–482, 2001, pMID: 11866201.
Comments
There are no comments yet.