Cognition, Technology & Work (2019) 21:657–670

https://doi.org/10.1007/s10111-019-00559-2

ORIGINAL ARTICLE

Driver–vehicle cooperation: a hierarchical cooperative control

architecture for automated driving systems
Chunshi Guo1,2   · Chouki Sentouh1 · Jean‑Baptiste Haué2 · Jean‑Christophe Popieul1

Received: 31 July 2017 / Accepted: 6 April 2019 / Published online: 27 April 2019
© Springer-Verlag London Ltd., part of Springer Nature 2019

Abstract
The concept of automated driving changes the way humans interact with their cars. However, how humans should interact
with automated driving systems remains an open question. Cooperation between a driver and an automated driving sys-
tem—they exert control jointly to facilitate a common driving task for each other—is expected to be a promising interaction
paradigm that can address human factors issues caused by driving automation. Nevertheless, the complex nature of auto-
mated driving functions makes it very challenging to apply the state-of-the-art frameworks of driver–vehicle cooperation
to automated driving systems. To meet this challenge, we propose a hierarchical cooperative control architecture which is
derived from the existing architectures of automated driving systems. Throughout this architecture, we discuss how to adapt
system functions to realize different forms of cooperation in the framework of driver–vehicle cooperation. We also provide
a case study to illustrate the use of this architecture in the design of a cooperative control system for automated driving. By
examining the concepts behind this architecture, we highlight that the correspondence between several concepts of planning
and control originated from the fields of robotics and automation and the ergonomic frameworks of human cognition and
control offers a new opportunity for designing driver–vehicle cooperation.

Keywords  Driver–vehicle cooperation · Human–machine cooperation · Shared control · Hierarchical architecture ·

Automated driving

1 Introduction
Automation systems have been around automobiles for a
long time. For example, the first cruise control system was
introduced by Chrysler in the 1950s (Weltmore 2003).
Research on automated driving technologies has also been
carried out from way back, including the European project
PROMETHEUS (Dickmanns 1986) and the American pro-
ject PATH (Shladover et al. 1991) during the 1980s and
1990s. But it was not until recently that the demonstra-
tions of DARPA Urban Challenge (Buehler et al. 2009) and
Google Car (Markoff 2010) have spurred significant inter-
est in automated driving. Driving automation engenders a
shift of functions to the system that significantly changes
* Chunshi Guo
chunshi.c.guo@renault.com
1
LAMIH-CNRS UMR 8201, University of Valenciennes,
Mont Houy, 59313 Valenciennes, France
2
Cognitive Ergonomics and HMI, Technocentre Renault, 1
Avenue du Golf, 78280 Guyancourt, France
the role of the human driver. What should be the appropri-
ate interaction paradigms between the driver and the system
constitutes a key question, since a large body of research has
pointed out that potential problems with the automation are
often related to human factors (Bainbridge 1983; Endsley
and Kiris 1995).
The taxonomy of SAE international (SAE 2016) speci-
fies the allocation of driving tasks between the driver and
the system at each level of automation. In the scope of the
taxonomy of SAE, many studies on human–machine inter-
action of automated vehicles have focused on the transition
from automated to manual control (Blanco et al. 2015). Par-
ticularly, the transition initiated by a level 3 system when
it reaches the limit of its operating conditions has received
a great degree of attention (Gold et al. 2013; Lorenz et al.
2014; Walch et al. 2015). Nevertheless, the taxonomy of
SAE which is elaborated from an engineering point of view
oversimplifies the interaction between the driver and the sys-
tem by considering it as an “all-or-nothing” function alloca-
tion, i.e., the system performs the entire driving task when it
is engaged and the driver drives manually when he/she takes

13
Vol.:(0123456789)

658
over the control. In the literature, few works proposed new
interaction paradigms for automated driving systems1 other
than the “all-or-nothing” function allocation presumed by
the taxonomy of SAE.
The idea of forming a cooperation teamwork between the
human operator and the automation has been proposed since
the introduction of automated systems in various domains
(Hoc et al. 1994). In the context of driving automation,
driver–vehicle cooperation (also referred to as cooperative
guidance and control by Flemisch et al. (2014)) is gaining
recognition as a promising interaction paradigm for in-car
automated systems. According to Hoc, a human operator and
an automated system can attain cooperation if they meet two
minimal conditions:
1. Each one strives towards their own goals and can inter-
fere with the other one’s goals, resources, procedures,
etc.
2. Each one tries to manage the interference to facilitate
the individual activities and/or the common task when
it exists (Hoc 2001).
Studies have demonstrated that driver–vehicle coopera-
tion is beneficial for the driver’s performance in circum-
stances such as situation awareness and control performance
during the interaction with the system. We argue that the
driver–vehicle cooperation can also contribute to user expe-
rience and system performance in the case of automated
driving. According to a recent online survey on the accept-
ance of autonomous vehicles with 1000 German respond-
ents, “the possibility of reassuming control of the vehicle
or terminating the automated driving procedure at any time
is one of the central needs” of the respondents and “only
a minority would wish to cease paying attention to traffic
and completely cede control of the vehicle to the automated
system” (Wolf 2016). Driver–vehicle cooperation enables
the system to share vehicle control. Instead of disengaging
the system, the driver can directly modify vehicle’s behav-
ior exerting control at the same time. On the human side,
driver–vehicle cooperation could satisfy potential user needs
and enhance the user experience. On the system side, the
system could benefit from the help of the driver to better
handle interactions with other road users, particularly con-
sidering that these interactions sometimes exhibit strong
social patterns, e.g., cues like eye contacts and hand ges-
tures, which are difficult for a machine to interpret (Färber
2016).
1
  According to SAE’s taxonomy, automated driving systems refer to
those systems that are capable of performing all driving tasks without
human’s monitoring, covering the highest three levels of automation
(from Level 3 to Level 5).
13
Cognition, Technology & Work (2019) 21:657–670
These considerations motivate us to apply driver–vehi-
cle cooperation to the design of automated driving systems.
Theoretical models and frameworks from the domain of
human-centered automation can be employed to guide the
design of driver–vehicle cooperation. For instance, shared
control has been successfully applied to driver assistance
systems. How to apply these general frameworks which
usually take an ergonomic viewpoint to an automated driv-
ing system is not trivial, because the latter is composed of
sophisticated functions covering from perception, planning
(or decision making) to control, in contrast with a driver
assistance system, e.g., lane-keeping assist, where coopera-
tion usually occurs at the control level. Therefore, a func-
tional architecture of automated driving system is necessary
to modularize complex system functions. However, most
architectures found in the literature have been designed for
full automated driving and do not support a human–machine
interaction on a cooperative basis. A main goal of this paper
is to propose a hierarchical cooperative control architecture
for an automated driving system that can cooperate with a
human driver. Through this architecture, we intend to inves-
tigate how to adapt planning and control approaches through
shared control (Abbink et al. 2012) and human supervisory
control (Sheridan 1992) to achieve cooperative driving.
Another research question concerns how to apply principles
and guidelines for driver–vehicle cooperation proposed from
the community of human-centered automation to system’s
planning and control function design which is rather techni-
cally orientated.
To reach these goals, Sect. 2 reviews several shared con-
trol frameworks, human supervisory control implementa-
tions and ergonomic frameworks for driver–vehicle coop-
eration. By discussing the benefits and limitations of these
frameworks, we point out the need for a general functional
architecture that describes how to involve automated driving
functions in a desired cooperation framework. In Sect. 3,
we propose a hierarchical cooperative control architecture
to accommodate this need. At each level, we propose new
approaches to achieve the proposed cooperation form. Sec-
tion 4 presents a case study in which we instantiate this
architecture in a use case concerning highway merging
management. Finally, we conclude this paper by summariz-
ing the contributions of this architecture and discussing its
limitations in Sect. 5.
2 Prior work on driver–vehicle cooperation
2.1 Shared control
A shared control framework first emphasizes that both the
human operator and the system perform control simulta-
neously, thus making it possible to realize a seamless and
Cognition, Technology & Work (2019) 21:657–670 659
smooth shift of authority. It represents an important advan-
tage compared with the paradigm of “switch on/off” result-
ing in a binary shift. Another feature of shared control is
that the human and the system can communicate their goals
directly on the control interface. As pointed out by some
theoretical works (Flemisch et al. 2010, 2016), the concept
of shared control is coherent with driver–vehicle coopera-
tion (from this perspective, shared control can be referred to
as cooperative control) considering that the driver and the
system share their control to reach a common goal.
Depending on the type of control interface, shared control
approaches can be classified into two categories (Abbink
and Mulder 2010): blended shared control and haptic shared
control. Blended shared control is implemented on a drive-
by-wire interface allowing a mechanical decoupling of the
control interface and the controlled plant. Therefore, the
driver’s control, in form of electronic signal, can be blended
with that of the controller flexibly. Andersen et al. (2013)
used a weighting function of the front tire slip angle to blend
the control inputs of a driver and an automatic steering con-
troller such that more authority is allocated to the control-
ler when the vehicle begins to lose stability. Sentouh et al.
(2013) developed a shared steering assist controller which
blends driver’s control based on a metric characterizing the
conflicts between the driver and the system. Erlien et al.
(2016) formulated a blended shared control problem in the
framework of model predictive control (MPC). The control-
ler seeks to identically match the human’s control in normal
conditions and adapts its control to prevent hazards only if
the predicted vehicle trajectory goes out of a safety zone.
In a blended shared control framework, the driver may
not be aware of the system’s activity, because the blending
occurs in the system controller. To overcome this limit, a
haptic shared control scheme emphasizes that the driver and
the system exert forces on the control interface such that the
driver can continuously feel the activity of the system (Abbink
et al. 2012). The control force of the controller can be used
as a guidance force (Mulder et al. 2011) or as a channel to
convey the environmental hazards to the drive (Takada et al.
2013; Guo et al. 2015). With these design perspectives, the
system’s control force is usually computed in the framework
of impedance control (Hogan 1985), to achieve the desired
characteristics of impedance, e.g., a target stiffness of the con-
trol interface. There are also studies focusing on the author-
ity allocation. Saleh et al. (2013) and Soualmi et al. (2014)
formulated a predefined compromise between lane-keeping
quality and control sharing as an optimization objective of an
optimal automatic steering controller. Petermeijer et al. (2015)
performed experiments to compare continuous versus band-
width haptic steering guidance on driver’s lane-keeping perfor-
mance. Nguyen, Sentouh, and Popieul (2016) modulated the
torque of an automatic steering controller based on the driver’s
involvement level and drowsiness state. Thus, the controller
increased its control when the driver was in underload and
overload conditions.
Although haptic shared control has been proved to enhance
driver’s control performance, it suffers from potential conflicts
between the driver and the system, which could increase driv-
er’s physical efforts and even result in accidents (de Winter
and Dodou 2011). Haptic shared control methods proposed in
the literature today mitigate the conflicts in a reactive manner,
i.e., by reducing the controller’s control input when conflicts
arise or by applying a kind of arbitration, i.e., deciding whose
control input finally acts on the controlled object (Kelsch
et al. 2006; Baltzer and Flemisch 2017). However, this limit
of haptic shared control is due to the controller that relies on a
specific path and needs a specific goal. When the driver has a
different goal, the two enter into a conflict situation. As shown
later in this paper, high-level functions in an automated driving
system can be used to address this problem.
2.2 Human supervisory control
In a human supervisory control framework, the human
operator provides specific goals or waypoints for the system
(Sheridan 1992). In contrast with shared control scheme
where human input is continuous, a human supervisor inter-
mittently intervenes in the control process to give a new
goal. Widely applied for telerobotic and process control,
human supervisory control is gaining interest in the auto-
motive community following the progress of driving auto-
mation. A representative example is the so-called “Active
Lane Change Assist” application which has already become
commercially available (Quain 2016). In this application,
the driver can initiate a lane change maneuver performed
by the system by switching the turn signal. The project of
Conduct-by-Wire (Geyer 2013) proposed and implemented a
new concept that the driver assigns maneuver commands via
a so-called maneuver interface that enumerates all possible
maneuvers in the applied use cases, and then the system
performs the assigned maneuvers automatically.
Human supervisory control scheme offers convenience
for the driver by allowing him/her to express directly his/her
intention to the system through symbolic command. How-
ever, a main issue in human supervisory control is human’s
out-of-the-loop performance problem (Endsley and Kiris
1995). What’s more, drivers may still have the need to subtly
control vehicle’s trajectory by turning the steering wheel or
pressing pedals, which cannot be met by human supervisory
control.
2.3 Frameworks for driver–vehicle cooperation
from a cognitive perspective
If shared control and human supervisory control can be
viewed as frameworks for human–machine cooperation
13

660
Fig. 1  A typical functional Percepon
& situaon assessment
architecture of AD systems
(solid-border blocks for func-
tions, while dash-border blocks • Digital map
• Traffic informaon
for interfaces)
• Traffic rules
SENSOR • Context informaon
LAYER • Spaal awareness
• Scene evoluon predicon
• Road geometries
• Object states
• Safe travel field
that stem from the application of conventional control
theory, then such frameworks put emphasis on the cogni-
tive aspects (perceiving, internal representation, decision
making) of the human operator and aim to cover the gen-
erality of human–machine cooperation.
The framework proposed by Hoc (2001) views
human–machine cooperation as an activity of interfer-
ence management. It also emphasizes the role of a shared
representation of the task environment maintained by the
actors in cooperation. Flemisch et al. (2014) proposed a
“cluster concept” englobing a list of attributes that char-
acterize the quality of cooperation. These two frameworks
provide the following important principles in driver–vehi-
cle cooperation design: dynamic task distribution, inter-
ference management (arbitration of conflicts) and main-
taining a shared representation (inner compatibility).
Beyond the above-mentioned frameworks that intend
to define what “cooperation” is, some works decom-
pose cooperation into hierarchical levels to reduce the
complexity of the cooperation design (Hoc et al. 2009;
Flemisch et  al. 2014; Pacaux-Lemoine and Flemisch
2016). These hierarchical models commonly inherit the
hierarchy of the model proposed by Michon (1985) which
decompose the driving task into strategical, tactical and
operational levels. Recently, efforts are underway to unify
these tri-level hierarchical models and to propose consist-
ent terms (Flemisch et al. 2016).
These ergonomic frameworks provide a variety of
qualitative characterizations of driver–vehicle coopera-
tion. However, they do not provide a technical solution
to implement these frameworks into the development
of functions of automated driving system. A functional
architecture that bridges the gap between these conceptual
frameworks and the technical development of a coopera-
tive system is still needed.
13
Cognition, Technology & Work (2019) 21:657–670
Planning & control
Route
planning
Replan Route
request segment
Strategical level
Maneuver
planning Taccal level
Operaonal level
Replan
Maneuver plan
request
Reference Actuator inputs
trajectory Vehicle
Moon ACTUATOR
planning control LAYER
3 Proposition of a hierarchical cooperative
control architecture
An automated driving system consists of three main func-
tionalities—perception, planning and control (Taş et al.
2016). To interact asynchronously in real time with an
uncertain and dynamic driving environment, automated
driving systems commonly adopt layered system archi-
tecture in which each layer operates at a characteristic
frequency with a certain level of task abstraction (Korten-
kamp and Simmons 2008). An interesting finding is that
most of the layered architecture of automated vehicle pro-
totypes shares the same hierarchy with the hierarchical
model of Michon. Examples are the PRORETA 3 project
(Bauer et al. 2012) and PROUD project demonstrators
(Broggi et al. 2015) and Audi’s A7 concept car (Ulbrich
and Maurer 2015). Figure 1 illustrates a typical layered
architecture for automated driving systems in which func-
tions are mapped into the tri-level hierarchy of Michon.
The hierarchical models of driver–vehicle cooperation
(cf. Sect. 2.3) reveals the possibility of decomposing coop-
eration. We also notice that the planning and control func-
tions used for automated driving share similar principles
with models for driver–vehicle cooperation in the litera-
ture. This aspect makes it possible to extend the planning
and control bloc at each level of the system architecture
(Fig. 1) to achieve a specific cooperation form. In this
way, a new architecture for planning and control function,
referred to as hierarchical cooperative control architec-
ture, is derived, as shown in Fig. 2. The system’s planning
function at either the strategical or tactical level is usually
designed to arbitrate a plan (route segment or maneuver)
from multiple alternatives, i.e., only one plan selected at
a time will be executed by the control level for a period
Cognition, Technology & Work (2019) 21:657–670 661

Percepon Hierarchical cooperave control HMI

& situaon assessment

Route
• Digital map Route alternaves Route Route alternaves Navigaon
• Traffic informa on planning arbitraon interface
Arbitraon Desnaon /
result Selected route
Replan Route fragment
Maneuver plan
request

Maneuver Maneuver Mulmodal

• Traffic rules
alternaves alternaves feedback
SENSOR • Context informa on Maneuver Maneuver Maneuver
LAYER • Spa al awareness planning arbitraon interface
• Scene evolu on predic on Arbitraon Driver’s plan Driver
result commands DRIVER
Replan Maneuver plan Maneuver
request intenon
Reference
• Road geometries trajectory Hapcs Vehicle
Moon Shared
• Object states control
planning control
• Safe travel field Predicted Driver’s control interface
trajectory

Actuator inputs
Strategical level
ACTUATOR
LAYER
Tac cal level
Opera onal level

Fig. 2  Architecture of the hierarchical cooperative control within an AD system (solid-border blocks for functions, while dash-border blocks for
interfaces)

of time until another plan is selected (Pirjanian 1999). A
similar principle of “arbitration” has also been proposed
for conflict management in the scope of driver–vehicle
cooperation (Kelsch et al. 2006). Hence, we propose an
arbitration form for the cooperation at the strategical and
tactical levels. Given the continuous nature of the control
input (whether it comes from the system or the driver)
and the success of shared control in managing the shift of
control authority, the cooperation issue in the operational
level of this architecture is formulated as a shared control
problem.
The driver’s commands or control enter the architecture
via a proper HMI at each level. Without the driver’s inter-
vention, the system’s own decision and control at each level
are passed directly to its subordinate level, i.e., the system
operates in the same way as in a classical architecture as
shown in Fig. 1. This architecture offers a generic descrip-
tion of system modules and inter-module communications
involved in driver–vehicle cooperation. In the following sec-
tions, we propose new approaches to achieve the cooperation
form at each level.
3.1 Cooperation at the strategical level
At the strategical layer, the driver and the system cooperate
to plan a route to a destination. Similar with nowadays in-car
navigation systems, route planning searches multiple route
candidates based on criteria such as time saving, energy
economy and available time for using the automated driv-
ing mode. Whereas the arbitration on the route alternatives
can simply follow driver’s selection (or his/her recorded
preference) before the trip, but the arbitration should take
into account more factors if the driver intervenes in the
vehicle control loop during the trip. The driver can directly
change into a new route or a new destination via the naviga-
tion interface that is shown in Fig. 2. The route arbitration
can also be influenced by cooperation at lower levels. For
instance, when the driver intervenes at the operational or
tactical level to make the vehicle move towards a direction
not planned by the system at a highway split, the system
needs to re-plan a route or ask the driver whether he/she
wishes to change to another destination.
Strategical decisions on route usually take place in min-
utes during the trip. Moreover, such decisions are much less
relevant to the immediate safety compared with those at the
other two levels. Perhaps for these reasons, cooperation at
the strategical level has been scarcely investigated in the
framework of driver–vehicle cooperation.
3.2 Cooperation at the tactical level
The tactical level generates maneuver plans not only to
follow the planned route but also to handle local driving
situations, e.g., to overtake a slow vehicle or to yield at an
interaction. This task on the system side is referred to as
maneuver planning. It is interesting to view that several

13

662
maneuver planning techniques applied to automated driv-
ing can be explained by a cognitive model proposed by
Johannsen and Rouse (1979) for human operator’s plan-
ning activities. In this model, a rational planning process
was broken down into four steps: (1) generating feasible
alternatives, (2) imaging the consequences, (3) valuing
(or evaluating) the consequences of the alternatives, (4)
choosing an alternative as the plan. To generate feasible
alternatives in step (1), there exist principally two groups
of approach in the field of robotics. The first group fol-
lows the behavior-based paradigm that highlights which
maneuver to perform strongly depending on the current
situation (Matarić and Michaud 2008). Therefore, basic
maneuvers are usually designed a priori considering the
situations to be addressed and the goal to be attained by
each behavior. For example, finite state machine, a behav-
ior-based formalism that was overwhelmingly used by the
autonomous vehicle porotypes in the DARPA Challenge to
model maneuver planning strategy (Buehler et al. 2009).
The second group relies on sampling-based planning tech-
niques which were originally applied to motion planning
and obstacle avoidance. Approaches of this group decom-
pose a feasible trajectory space into discrete subspaces (or
homotopies) in real time (Bender et al. 2015; Park et al.
2015; Gu et al. 2016). Each subspace can be viewed as a
maneuver alternative. Step (2) corresponds to predicting
the trajectories of the detected dynamic objects. In step
(3), the values of the consequences of the alternatives can
be modeled by costs, risks or utilities using correspond-
ing mathematical tools. Step (4) corresponds to maneuver
arbitration, i.e., to select that alternative with the conse-
quences with the greatest positive value.
Since a driver may have a different anticipation (step 2)
of the driving situation or different value criteria (step 3)
than that of the system, he/she may interfere with the system
on the maneuver plan (Löper and Flemisch 2009). In this
hierarchical architecture, two means of interaction can be
exploited to manage this interference.
The first one is offering the driver a means to directly
indicate his/her maneuver plan at the tactical level, which
follows a human supervisory control scheme. This kind of
maneuver-based interaction has been explored, e.g., in the
project HAVEit where the system recommended maneuvers
to the driver through a “maneuver–grid” interface (Glaser
et al. 2010) or in the concept of “Conduct by Wire” in which
the driver was supposed to be a supervisor to routinely gen-
erate or update a plan for the system (cf. Sect. 2.2). However,
a recent study which compared four maneuver interaction
concepts suggested user’s preference to transfer as many
as tasks as possible to the system (Albert et al. 2015). To
relieve the driver from the supervising task, a possible inter-
action way could be that the automation shows its intended
maneuver and plausible alternatives to the driver, while the
13
Cognition, Technology & Work (2019) 21:657–670
latter can select an alternative if he/she is not satisfied with
the system’s intention.
The second one to realize maneuver cooperation exploits
the inter-level communication of the architecture. The sys-
tem infers the driver’s intention when he/she acts on the
control interface (steering wheel or pedals) on the opera-
tional level. In this sense, this method integrates shared
control in maneuver cooperation. Different techniques for
the inference of the driver’s maneuver intention exist in
the literature based on cues from vehicle dynamic states,
driver’s behavior, road configuration and traffic information
(Kumagai 2006). Once the driver’s intention is inferred, the
system can adapt the maneuver plan to that inferred one in
maneuver arbitration. This cooperation method ascends the
interference at the operational level to the tactical level.
3.3 Cooperation at the operational level
The driving task at the operational level is to conduct vehi-
cle steering and speed control to execute the maneuver plan
generated from the tactical level. On the system side, this
task is usually performed by motion planning and trajectory
control. Motion planning first plans a trajectory or a path as a
realization of a maneuver plan (usually as end vehicle poses
or states). With the driver’s intervention, a shared control
is employed to determine the final control input on vehicle
actuators.
In addition to the classical shared control techniques
presented in Sect. 2.1, the introduction of motion planning
can inspire new approaches to implement shared control.
Assuming that the conflict between the driver and the sys-
tem is mainly due to the mismatch of the system’s reference
trajectory with that of the driver, the first approach aims at
developing a motion planner that adapts the planed trajec-
tory to driver’s control. This approach was explored in the
work of Brandt et al. (2008) where a path planner places a
series of elastic band nodes to an extrapolated vehicle path
based on the driver’s current steering angle. In the recent
French project CoCoVeA, Benloucif et al. (2017) developed
a model that predicts the driver’s desired lateral displace-
ment within a lane for a motion planner.
Over the last decade, MPC has been applied to motion
planning and vehicle control in the application of automated
driving. Two features of MPC make it appealing as a frame-
work to accommodate shared control. First, it is possible
to unify motion planning and trajectory control to a single
constrained finite horizon optimal control problem. In this
way, a MPC controller can compute commands toward a
desired terminal state (maneuver plan) while respecting the
constraints. In this sense, the strategy of MPC is closed to
human driving behavior assumed by Gibson and Crooks
(1938), that humans tend to control the vehicle within a field
of safe travel rather than obsessively track a single path.
Cognition, Technology & Work (2019) 21:657–670 663
Fig. 3  A typical driving scene
on highway entry section
AD
Second, MPC iteratively resolves an optimization problem
online. Thus, integrating the driver’s actual control into the
optimization problem, MPC can achieve dynamic allocation
of control authority.
Here we present a novel MPC framework to accommo-
date shared control for vehicle trajectory tracking. Consider
such a constrained optimal control problem:
Minimize:JNp (𝐱(0), U(0)) = 𝜌Jout + Jin (1a)
Subject to:
̇ + 1) = f (𝐱(k), 𝐮(k)),
𝐱(k k = 0, … , Np − 1, (1b)
𝐱(k) ∈ , k = 0, … , Np − 1, (1c)
( )
𝐱 Np ∈ Xf , (1d)
𝐮(k) ∈  , k = 0, … , Nc − 1. (1e)
The cost function JNp (1a) incorporates two competing
objectives—small output deviation Jout and small control
efforts Jin . The parameter 𝜌 gives the relative weighting
between Jout and Jin , and can be used to leverage the alloca-
tion of the control authority between the system and the
driver. The smaller 𝜌 is, the more the MPC controller can
tolerate the deviation from the reference and the more it can
penalize using control authority. Consequently, more control
authority is left to the human driver to adjust the trajectory.
Inversely, when 𝜌 becomes bigger, the controller will employ
more control authority to penalize the deviation from its
reference. (1b) is the plant model used for prediction with
Np as the prediction horizon. To formulate a haptic shared
control problem, we choose steering torque as the control
input 𝐮(k) . The control interface is hence the steering system
whose dynamics can be modeled as
Tal
Ieq 𝛿̈f + ceq 𝛿̇ f = is 𝐮(k) −
kp
𝐮(k) = Td + Tctrl , (3)
where Ieq is the equivalent moment of inertia of the steer-
ing system, 𝛿f the front steering angle, ceq the equivalent
・Ego vehicle ・Lead vehicle
・Merging vehicle
damping, is the steering ratio, Tal the total torque of auto-
alignment of two front wheels and kp the steering assist coef-
ficient which is a simplified representation of the electric
motor’s assistant steering torque (Mitschke and Wallentow-
itz 2004). Equation 3 means that the driver’s torque ( Td )
and that of the system ( Tctrl ) are superposed on the steering
wheel.
The sets , f and  denote the constraints on states,
terminal states and input, respectively. These constraints
can also be exploited in a shared control scheme. The state
constraints can be set on the vehicle’s position to define a
field of safe travel such that the MPC will enforce its control
to constrain the vehicle’s trajectory. If the control input is
steering torque, it can also be used as a channel to convey
the potential hazard to the driver. If the final authority is
accorded to the driver, the control constraint  ensures that
the driver can always override the system’s control (steering
torque). Together with the state constraints, such a control
constraint can implement the so-called “soft protection”
concept proposed by Itoh and Inagaki (2014). Otherwise,
the control constraint can be set high enough that the driver
cannot overrule the maximal system’s control to realize the
“hard protection” concept.
MPC can also be adapted to implement blended shared
control. One example is the work of Erlien et al. (2016)
which is briefly presented in Sect. 2.1.
4 Case study: highway merging
management
4.1 Use case and concept for cooperation
In this section, we explain how this general hierarchical
cooperative control architecture can be used to drive the
(2) design of a cooperative control system (as a sub-system of an
automated driving system) through a case study. We define
a use case in which the driver and the system cooperate to
handle a merging situation at a highway entry. As shown
by Fig. 3, the ego vehicle (automated vehicle) encounters a
merging vehicle at a highway entry section. Studies on traffic
13

664 Cognition, Technology & Work (2019) 21:657–670

Situaon assessment Hierarchical cooperave control HMI

Maneuver
Mulmodal
Maneuver alternaves Maneuver feedback
alternaves cooperaon
• Context informaon Maneuver
Transion Driver’s selecon interface Driver’s
• Spaal awareness state
• Scene evoluon predicon Arbitraon supervisor selecon
machine result
Driver’s
SENSOR intenon
LAYER detecon Driver’s
Replan Maneuver Detected steering torque
request plan intenon
DRIVER
• Road geometries Steering Steering torque
• object states
MPC-based shared steering control
System’s wheel feedback
steering torque
Steering torque of
angle auto-alignment
ACTUATOR
Driver’s control System’s control Cooperaon result LAYER

Fig. 4  Functional architecture of the cooperative control system proposed for the use case of highway merging management

management (Hidas 2005) showed that merging–yielding
interaction between vehicles on merging section exhibits
social patterns. As usually observed in daily life, a mainline
vehicle may change to its left lane to yield to a merging
vehicle with courtesy. Sometimes, the driver in a merging
vehicle may invite a mainline vehicle to pass by deceler-
ating a little or by eye contact. If it appears difficult for a
“machine” to interpret those social cues, the driver could
help the system handle this kind of social interaction via
driver–vehicle cooperation.
In this use case, we designed two ways allowing the driver
to cooperate with the system to handle a merging vehicle.
The first way to cooperation which was proposed in our pre-
vious work (Guo et al. 2017a) occurs at the tactical level.
When the system detects a vehicle whose merging may influ-
ence ego vehicle’s current state, it initiates cooperation by
showing its intended maneuver and plausible alternatives to
the driver. The driver can select an alternative if he/she does
not agree with the intention of the system. In the absence of
the driver’s indication, the system will execute its intended
maneuver if the current situation allows it. In the second
way, cooperation arises from the operational level. If the
driver anticipates a merging situation earlier than the system,
he/she can directly turn the steering wheel to initiate a coop-
erative lane change without waiting the system to indicate
its intention. If a lane change is not feasible, e.g., due to the
presence of a traffic vehicle in the target lane, the system
renders resistance on the steering wheel to warn the driver.
4.2 System architecture and function design
process are highlighted. Note that the driver and the system
cooperate on vehicle steering control at the operational level
in the current design.2 Therefore, automatic vehicle longitu-
dinal control functions are not shown in Fig. 4 for clarity. We
present the development of each function briefly as follows.
4.2.1 Situation assessment
A highway merging situation is contextual and dynamic,
thus it is crucial for the system to understand and assess the
current situation. As shown in Fig. 4, the situation assess-
ment function generates two levels of abstraction of the
external environment. At the tactical level, a high precision
digital map is first used to give contextual information. Next,
the system maintains a matrix-form spatial representation in
which the surrounding traffic vehicle is mapped into matrix
cases with semantic meanings, e.g., “left leader” (Xiong
et al. 2016). In this way, the system can easily identify target
vehicles for maneuver planning. Lastly, once the target vehi-
cles are identified, the trajectories of these vehicles are pre-
dicted in a long-term prediction horizon (Guo et al. 2016).
The predicted trajectories are used to assess the risk of each
maneuver plan. At the operational level, the states of traffic
vehicles and the ego vehicle are represented in the Frenet
frame (Willmore 2012) to decouple vehicle’s longitudinal
motion and lateral motion.
From the perspective of driver–vehicle cooperation, the
contextual information generated by situation assessment
will be fed to the HMI to maintain a shared representation
with the driver.

As this use case concerns a local driving situation, the strate-

gical level which is relevant to global planning is not treated
here for simplicity. Figure 4 shows the functional architec- 2
  The driver and the system can of course cooperate in vehicle lon-
ture of the cooperative control system derived from the gen- gitudinal control in this use case as presented in our previous work
eral architecture. The information flows in the cooperation (Guo et al. 2015).

13
Cognition, Technology & Work (2019) 21:657–670 665
(a)
AD
AD AD
Fig. 5  Lane-based constraints on vehicle’s lateral offset: a the constraints are placed on the outermost lane borders to prevent road departure; b if
the merge in an adjacent lane causes potential dangers, the border to this lane is set as constraint
4.2.2 Cooperation at the tactical level
The first way of cooperation involves maneuver state
machine and transition supervisor, two standard techniques
to realize maneuver planning and maneuver arbitration in
the general architecture.
Maneuver state machine is a hierarchical finite state
machine (HFSM) that provides a simple and structured
approach to model system’s tactics in this use case. The first-
level states represent two phases in the interaction with a
merging vehicle. In the “intention phase”, the system adjusts
the ego vehicle’s relative positions to the merging vehicle
to manifest its intention, while the “decision phase” sys-
tem engages an action to terminate this interaction. At the
second level, each state represents a maneuver plan—a tar-
get state for motion planning and control at the operational
level. There are three maneuver plans in “highway merging
management”—“pass”, “yield” and “lane change”.
Transitions among system states are modeled in transition
supervisor. While the system is designed to adopt conserva-
tive tactics, i.e., transition supervisor triggers the transition
to a “maneuver plan” with the lowest risk in the “intention
phase”, the driver can trigger the transitions to other maneu-
ver plans through the maneuver cooperation interface. In this
way, potential interference between the driver and the system
on maneuver plan can be resolved. Note that this cooperation
method is only available in the “intention phase”, since the
system transitions to the “decision phase” when the situation
is clear and the change of maneuver plan is either infeasible
or could hinder the immediate safety.
The driver can also trigger transitions among maneuver
plans via cooperation at the operational level as presented
in the next section.
4.2.3 Cooperation at the operation level
At the operational level, motion planning and shared con-
trol functions of the general architecture are combined into
a single MPC-based shared steering control framework.
Moreover, driver’s intention detection at the tactical level
(b)
AD
is responsible for detecting driver’s lane change intention
from his/her steering actions.
The MPC-based shared steering control framework
originally presented in (Guo et al. 2017b) formulates the
steering control sharing as the constrained optimal control
problem as presented in Sect. 3.3. The control authority
allocation is governed by the weighting parameter 𝜌 (1a)
and the state constraints (1c) of the MPC framework. The
variation of 𝜌 is formulated as
{
𝜌 = 0, if 𝛾sw > 0 ∧ ||Tdr || > Tthre
. (4)
𝜌 = 1, if 𝛾sw = 0 ∨ 𝛾ma = 1
The first “if” condition signifies the detection of the
driver’s presence in the control loop. The variable 𝛾sw is the
output of a steering wheel hand position sensing system
with a positive value for the detection of at least one hand
on the steering wheel. Tdr is the measure of the driver’s
steering torque and Tthre is a threshold constant accounting
for the situation where the driver puts his/her hands on the
steering wheel while loosely following wheel’s rotation.
The second “if” condition determines whether the sys-
tem exerts full control. There are two cases. The first one
is when the driver releases the steering wheel ( 𝛾sw = 0 ).
The second case corresponds to the cooperation method
through which the driver initiates a lane change maneuver
by turning the steering wheel. Driver’s intention detection
at the tactical level places a detector on the driver’s steer-
ing torque and vehicle’s lateral and heading deviations to
the lane center. Once the detection of driver’s lane change
intention is declared and this lane change is deemed as
feasible by situation assessment, the flag 𝛾ma is set to one
which enables the system to exert control. Meanwhile, at
the tactical level, the transition supervisor will trigger a
corresponding lane change maneuver for the MPC.
The ego vehicle’s position needs to be constrained in a
safe navigational zone for collision avoidance. In this use
case, we use lane-based constraints as a simplified form.
The outermost lane borders are used as default lateral con-
straints. As illustrated in Fig. 5a, this placement allows the
driver to perform a change lane. However, if an adjacent
13

666
Highway merging context
The HMI indicates:
• Merging scene representaon
• AD intended maneuver: yield
(blue triangles)
• Available alternaves: pass &
le lane-change (green triangle)
Fig. 6  HMI design for driver–vehicle cooperation in the use case of highway merging management
lane is occupied by vehicles and merging in this lane may
result in collisions with in-lane vehicles, the constraint is
temporally set on the border of the occupied adjacent lane,
as shown in Fig. 5b. The decision for constraint placement
is made during the assessment of the lane change feasibil-
ity by situation assessment. If the driver intends to steer
the vehicle out of the constraints on lane border, the MPC
enforces its control to constrain the vehicle’s trajectory
within this zone. Meanwhile, the driver can feel the resist-
ance on the steering wheel.
4.3 HMI design
In addition to the interaction logic, HMI plays a crucial role
in efficient cooperation between the driver and the system.
In this use case, we designed and prototyped a set of HMI.
For the cooperation at the tactical level, we update the
maneuver cooperation interface previously designed in (Guo
et al. 2017a) to integrate the display and command for lane
change maneuver. The prototyped interface consists of three
elements (Fig. 6):
• Highway merging context: this HMI graphic represents a
highway merging scene with the ego vehicle (blue vehi-
cle) and the merging vehicle (abstracted yellow bloc). In
this representation, the intended maneuver of the system
is symbolized by three blue arrows and available alterna-
tives are symbolized by a single arrow. Considering that
the driver may not supervise the driving in automated
driving mode, a sound is transmitted when the system
displays the highway merging context.
• Simulated augmented reality: when the system detects
the merging vehicle, a yellow semi-transparent rectangle
tracking the merging vehicle appears to inform the driver
that the system is handling this vehicle.
13
Cognition, Technology & Work (2019) 21:657–670
Simulated augmented reality
The merging vehicle is highlighted
Buon command interface
The green-twinkling buon
indicates the availability of
the alternaves
• Button command interface: four capacitive backlit but-
tons allow the driver to express his/her intended maneu-
ver to the system. These buttons are organized in four
directions with up/down buttons for “pass/yield” and
left/right for “left/yield lane change”. If a maneuver is
available, the corresponding button twinkles in green and
remains active. Pressing on an active button will trigger
a transition to the alternative in the HFSM. As for an
acknowledgement, the pressed button will become blue
(lasting 2 s). If the user presses when the green light is
off, this button will temporally become red to signify a
refusal.
Thanks to the haptic shared control scheme at the opera-
tional level, the driver can directly feel system’s activity
and the potential dangers through the controller’s steering
torque at the steering wheel. As a justification of the poten-
tial resistance at the steering wheel due to the presence of a
traffic vehicle in the vicinity in an adjacent lane, a warning
indicator like in the blind spot warning system is activated
in the corresponding side view mirror.
4.4 Preliminary results
These two cooperation methods have been separately
evaluated in our previous work. In (Guo et al. 2017a), we
evaluated the maneuver cooperation method via a 22-user
study on a driving simulator. The results suggest that the
system yielded higher performance in a highway merging
situation with cooperation than when it handled the situa-
tion alone. In terms of cooperation performance, users had
a less error rate in average when they had the possibility to
choose any of the alternatives than when they could only
choose an alternative other than the system’s intention.
This is mainly because users tend to give a confirmation if
they share the same intention with the system, whereas this
Cognition, Technology & Work (2019) 21:657–670 667
confirmation has no effect on system’s behavior accord-
ing to the current interaction logic. Concerning the HMI
design, the shared representation concept helped users to
understand system’s intention, however, dispatched HMI
components increased the user’s cognitive demand.
The MPC-based shared steering control—a cooperation
method at the operational level was evaluated in a simula-
tor study with 12 participants (Guo et al. 2018). The test
results show that the shared control scheme allowed users
to take over the control with ease and at the same time
ensured a smooth transition. Subjective evaluation based
on questionnaire suggests that users in general felt safe,
comfortable and in control when they steered simultane-
ously with the system. However, a large variance of steer-
ing wheel reversals among the participants was observed
when the system exerted control to assist participants in
lane change maneuvers, which suggested that some par-
ticipants tended to correct the trajectory during the lane
change.
These user studies do not only reveal the utility of such
cooperation methods for future users of automated driving
systems, but also demonstrate the strength of this hierar-
chical architecture in supporting the design and analysis
of driver–vehicle cooperation for automated driving. First,
the decomposition of cooperation allows one to focus on
the processes involved in the cooperation occurring at
one level while ignoring processes at other levels, thus
facilitating the analysis of such a complex human–machine
system. For example, test results on the maneuver coop-
eration method imply that the system needs to initiate the
cooperation with a sufficient lead time so that the driver
has time to assess the situation and to participate in the
cooperation. This observation is coherent with the assump-
tion that decisions on maneuver take place in seconds at
the tactical level given by Michon’s driver model. Thus,
we can focus on the situation assessment function and the
HMI at the tactical level to ensure a long enough time
window for driver to cooperate while not bothering with
the shared control function. Second, viewing this archi-
tecture as a whole, one can study interactions between the
processes at different levels while ignoring the details of
subsystems at a level. In the MPC-based shared steering
control framework, when the system adapts its maneuver
plan to that of the driver at the tactical level, it is crucial
to ensure a smooth torque change rendered by the sys-
tem to inform the driver of the change of system’s plan.
Otherwise, an intrusive torque on the steering wheel risks
frightening the user rather than reassuring him/her that the
system intends to cooperate with him/her.
In the future work, in addition to addressing the issues
exposed in the previous user tests, it is of interest to com-
pare these two cooperation methods in terms of, e.g., user’s
performance and preference in a single user study.
5 Discussion and conclusion
This paper presented a hierarchical cooperative control
architecture that extends existing architectures of auto-
mated driving systems towards cooperation between a
driver and an automated driving system. To derive this
architecture, we first decomposed driver–vehicle coop-
eration using the tri-level hierarchy proposed by Michon.
At each level, we implemented either human supervisory
control or shared control to resolve interferences between
driver’s control and system’s control. We not only identi-
fied functions involved in each level’s cooperation process,
but also provided new approaches to achieve human super-
visory control and shared control based on these func-
tions. In the case study part, we showed how to design a
cooperative control system with HMIs based on this gen-
eral architecture within a use case. We also reported the
preliminary results of the current design and discussed the
issues exposed by user tests.
This study demonstrated the correspondence between
technical concepts of automated driving and theoretical
models of human cognition and control. This correspond-
ence constitutes a source of new ideas and methods to
design driver–vehicle cooperation. In this work, the cor-
respondence between the hierarchy of the layered archi-
tectures of automated driving system and that of the driv-
ing task lays a basis for our architecture. We also showed
that maneuver planning process on the system side can be
described by the model proposed by Johannsen and Rouse.
Note that the “situated” concept of the behavior-based par-
adigm which is widely applied for robotics can also find
its equivalence in the field of human–machine interaction
(refer to the hypothesis of “situated action” proposed by
Lucy Suchman (1987) to explain human cognitive pro-
cess). Lastly, the concept of “safe travel field” proposed
by Gibson and Crooks to describe human driving behavior
corresponds to the formulation of a constrained optimal
control problem from the perspective of automatic control.
This correspondence results in the proposed MPC-based
shared control framework.
The scope of the current architecture was limited to
achieving driver–vehicle cooperation within the system
limits. In other words, the cooperative control methods
proposed in this architecture address the interference
between the driver and the system in driving tactics and
behaviors and concern only system normal use. However,
driver–vehicle cooperation should also cover the usage at
and beyond exceeding system limits. How to extend this
cooperative control architecture to those critical situations
in which the system reaches its limit is one of the axes of
our future work. Another aspect that is not addressed by
the current architecture is the final authority issue. If the
13

668
system is allowed to resist the driver to prevent potential
danger at the operational level, the two actors may enter
into conflict situations and a fundamental question needs
to be answered: who has the final authority? If this ques-
tion has not yet reached a consensus from an engineering
perspective (refer to the two contrast designing philoso-
phies of Boeing and Airbus for their auto-pilot systems
(Billings 1997), human factors deliberation provides new
insights to address this question. Flemisch et al. (2012)
highlighted the tight relation between the “ability” and
the “authority”, i.e., the distribution of authority between
human and machine should be based on the ability of each
agent. Therefore, it is interest to explore the distribution of
the authority perhaps at a new higher level in the hierar-
chical cooperative control architecture in the future work,
e.g., using driver monitoring techniques to estimate the
driver’s current ability to handle the situation.
References
Abbink DA, Mulder M (2010) Neuromuscular analysis as a guideline
in designing shared control. In: Hosseini M (ed) Advances in Hap-
tics. InTech, London
Abbink DA, Mulder M, Boer ER (2012) Haptic shared control:
smoothly shifting control authority? Cogn Technol Work 14:19–
28. https​://doi.org/10.1007/s1011​1-011-0192-5
Albert M, Lange A, Schmidt A et al (2015) Assessment of interaction
concepts under real driving conditions. Procedia Manuf 3:2832–
2839. https​://doi.org/10.1016/j.promf​g.2015.07.767
Anderson SJ, Karumanchi SB, Iagnemma K, Walker JM (2013) The
intelligent copilot: a constraint-based approach to shared-adaptive
control of ground vehicles. IEEE Intell Transp Syst Mag 5:45–54.
https​://doi.org/10.1109/MITS.2013.22477​96
Bainbridge L (1983) Ironies of Automation. Automatica 19:775–779.
https​://doi.org/10.1016/0005-1098(83)90046​-8
Baltzer M, Flemisch F (2017) Arbitration: When Time for Interaction
Mediation in a Human Machine System is running out. Cogni
Technol Work, Special Issue “Shared and cooperative control of
safety critical systems” (in preparation)
Bauer E, Lotz F, Pfromm M et al (2012) PRORETA 3: an integrated
approach to collision avoidance and vehicle automation. Automa-
tisierungstechnik 60:755–765
Bender P, Taş ÖŞ, Ziegler J, Stiller C (2015) The combinatorial aspect
of motion planning: Maneuver variants in structured environ-
ments. In: 2015 IEEE Intelligent Vehicles Symposium (IV). pp
1386–1392
Benloucif MA, Nguyen AT, Sentouh C, Popieul JC (2017) A new
scheme for haptic shared lateral control in highway driving using
trajectory planning. In: 2017 IFAC World Congress. Toulouse,
France. https​://doi.org/10.1016/j.ifaco​l.2017.08.2223
Billings CE (1997) Aviation automation: the search for a human-
centered approach. Lawrence Erlbaum Associates Publishers,
Mahwah
Blanco M, Atwood J, Vasquez H, et al (2015) Human factors evalu-
ation of Level 2 and Level 3 automated driving concepts. Tech-
nical report. Washington, DC: National Highway Traffic Safety
Administration
Brandt T (2008) A predictive potential field concept for shared vehicle
guidance. Dissertation, Universität Paderborn
13
Cognition, Technology & Work (2019) 21:657–670
Broggi A, Cerri P, Debattisti S et al (2015) PROUD–public road
urban driverless-car test. IEEE Trans Intell Transp Syst
16:3508–3519. https​://doi.org/10.1109/TITS.2015.24775​56
Buehler M, Iagnemma K, Singh S (2009) The DARPA urban chal-
lenge: autonomous vehicles in city traffic, 1st edn. Springer,
Berlin
de Winter JCF, Dodou D (2011) Preparing drivers for dangerous situ-
ations: a critical reflection on continuous shared control. In: 2011
IEEE international conference on systems, man, and cybernetics
(SMC). pp 1050–1056
Dickmanns ED (1986) Computer Vision in Road Vehicles—Chances
and Problems. In: ITCS-Symposium on Human Factors Technol-
ogy for Next-Generation Transportation Vehicles. pp. 16–20
Endsley MR, Kiris EO (1995) The out-of-the-loop performance prob-
lem and level of control in automation. Hum Factors J Hum Fac-
tors Ergon Soc 37:381–394. https​://doi.org/10.1518/00187​20957​
79064​555
Erlien SM, Fujita S, Gerdes JC (2016) Shared steering control using
safe envelopes for obstacle avoidance and vehicle stability. IEEE
Trans Intell Transp Syst 17:441–451. https​://doi.org/10.1109/
TITS.2015.24534​04
Färber B (2016) Communication and communication problems
between autonomous vehicles and human drivers. In: Maurer
M, Gerdes JC, Lenz B, Winner H (eds) Autonomous Driving.
Springer, Berlin, pp 125–144
Flemisch F, Heesen M, Kelsch J, Schindler J, Preusche C, Dittrich J
(2010) Shared and cooperative movement control of intelligent
technical systems: Sketch of the design space of haptic-multi-
modal coupling between operator, co-automation, base system and
environment. In: The 11th IFAC/IFIP/IFORS/IEA Symposium on
Analysis, Design, and Evaluation of Human-Machine Systems,
Valenciennes, France
Flemisch F, Heesen M, Hesse T et al (2012) Towards a dynamic bal-
ance between humans and automation: authority, ability, respon-
sibility and control in shared and cooperative control situations.
Cogn Technol Work 14:3–18. https​://doi.org/10.1007/s1011​
1-011-0191-6
Flemisch F, Bengler K, Bubb H et al (2014) Towards cooperative
guidance and control of highly automated vehicles: H-Mode
and Conduct-by-Wire. Ergonomics 57:343–360. https​: //doi.
org/10.1080/00140​139.2013.86935​5
Flemisch F, Abbink D, Itoh M et al (2016) Shared control is the sharp
end of cooperation: towards a common framework of joint action,
shared control and human machine cooperation. IFAC-Pap 49:72–
77. https​://doi.org/10.1016/j.ifaco​l.2016.10.464
Geyer S (2013) Maneuver-based vehicle guidance based on the con-
duct-by-wire principle. In: Maurer M, Winner H (eds) Automotive
systems engineering. Springer, Berlin Heidelberg, pp 111–132
Gibson JJ, Crooks LE (1938) A theoretical field-analysis of automobile-
driving. Am J Psychol 51:453–471. https:​ //doi.org/10.2307/14161​
45
Glaser S, Vanholme B, Mammar S, Gruyer D, Nouvelière L (2010)
Maneuver-based trajectory planning for highly autonomous
vehicles on real road with traffic and driver interaction. IEEE
Trans Intell Transp Syst 11(3):589–606. https​://doi.org/10.1109/
TITS.2010.20460​37
Gold C, Damböck D, Lorenz L, Bengler K (2013) “Take over!”
How long does it take to get the driver back into the loop? Proc
Hum Factors Ergon Soc Annu Meet 57:1938–1942. https​://doi.
org/10.1177/15419​31213​57143​3
Gu T, Dolan JM, Lee JW (2016) Automated tactical maneuver discov-
ery, reasoning and trajectory planning for autonomous driving. In:
2016 IEEE/RSJ International Conference on Intelligent Robots
and Systems (IROS). pp 5474–5480
Guo C, Sentouh C, Popieul JC, et al (2015) Shared control frame-
work applied for vehicle longitudinal control in highway
Cognition, Technology & Work (2019) 21:657–670 669
merging scenarios. In: 2015 IEEE International Conference on
Systems, Man, and Cybernetics (SMC). pp 3098–3103
Guo C, Sentouh C, Soualmi B, et al (2016) Adaptive Vehicle Longi-
tudinal Trajectory Prediction for Automated Highway Driving.
In: 2016 IEEE Intelligent Vehicles Symposium (IV)
Guo C, Sentouh C, Popieul JC et al (2017a) Cooperation between
driver and automated driving system: Implementation and eval-
uation. Transp Res Part F Traffic Psychol Behav. 5:6. https​://doi.
org/10.1016/j.trf.2017.04.006
Guo C, Sentouh C, Popieul JC, Haué JB (2017b) MPC-based shared
steering control for automated driving systems. In: 2017 IEEE
International conference on systems, man, and cybernetics
(SMC). https​://doi.org/10.1109/smc.2017.81225​90
Guo C, Sentouh C, Popieul JC, Haue JB (2018) Predictive shared
steering control for driver override in automated driving: a
simulator study. Transp Res Part F Traffic Psychol Behav. https​
://doi.org/10.1016/j.trf.2017.12.005
Hidas P (2005) Modelling vehicle interactions in microscopic simu-
lation of merging and weaving. Transp Res Part C Emerg Tech-
nol 13:37–62. https​://doi.org/10.1016/j.trc.2004.12.003
Hoc J-M (2001) Towards a cognitive approach to human–machine
cooperation in dynamic situations. Int J Hum-Comput Stud
54:509–540. https​://doi.org/10.1006/ijhc.2000.0454
Hoc J-M, Cacciabue PC, Hollnagel E, Cacciabue PC (eds) (1994)
Expertise and technology: cognition and human-computer coop-
eration. Psychology Press, Hillsdale
Hoc J-M, Young MS, Blosseville J-M (2009) Cooperation between
drivers and automation: implications for safety. Theor Issues
Ergon Sci 10:135–160. https​: //doi.org/10.1080/14639​2 2080​
23688​56
Itoh M, Inagaki T (2014) Design and evaluation of steering protec-
tion for avoiding collisions during a lane change. Ergonomics
57:361–373. https​://doi.org/10.1080/00140​139.2013.84847​4
Johannsen G, Rouse WB (1979) mathematical concepts for mod-
eling human behavior in complex man-machine systems. Hum
Factors J Hum Factors Ergon Soc 21:733–747. https​: //doi.
org/10.1177/00187​20879​12210​610
Kelsch J, Flemisch F, Löper C, Schieben A, Schindler J (2006) Links
oder rechts, schneller oder langsamer? Grundlegende Frages-
tellungen beim cognitive systems engineering von hochau-
tomatisierter Fahrzeugführung. In: DGLR Fachauschusssit-
zung Anthropotechnik “Cognitive Systems Engineering in der
Fahrzeug- und Prozessführung”, Karlsruhe, Germany
Kortenkamp D, Simmons R (2008) Robotic Systems Architectures
and Programming. In: Prof BS, Prof OK (eds) Springer hand-
book of robotics. Springer, Berlin Heidelberg, pp 187–206
Kumagai T (2006) Prediction of human driving behavior using
dynamic bayesian networks. IEICE Trans Inf Syst E89:857–860.
https​://doi.org/10.1093/ietis​y/e89-d.2.857
Löper C, Flemisch F (2009) Ein Baustein für hochautomatisiertes
Fahren: Kooperative, manöverbasierte Automation in den Pro-
jekten H-Mode und HAVEit. In: 6th Workshop Fahrerassisten-
zsystem, Löwenstein Germany
Lorenz L, Kerschbaum P, Schumann J (2014) Designing take over
scenarios for automated driving How does augmented real-
ity support the driver to get back into the loop? Proc Hum
Factors Ergon Soc Annu Meet 58:1681–1685. https​: //doi.
org/10.1177/15419​31214​58135​1
Markoff J (2010) Google cars drive themselves, in traffic. N.
Y. Times. Accessed July 05, 2017. http://www.nytim​
es.com/2010/10/10/scien​ce/10goo​gle.html
Matarić MJ, Michaud F (2008) Behavior-Based Systems. In: Prof
BS, Prof OK (eds) Springer handbook of robotics. Springer,
Berlin Heidelberg, pp 891–909
Michon JA (1985) A critical view of driver behavior models: what
do we know, what should we do? In: Evans L, Schwing RC (eds)
Human behavior and traffic safety. Springer, US, pp 485–524
Mitschke M, Wallentowitz M (2004) Dynamik der Kraftfahrzeuge,
4th edn. Springer, Berlin
Mulder M, Abbink DA, van Paassen MM, Mulder M (2011) Design
of a haptic gas pedal for active car-following support. IEEE
Trans Intell Transp Syst 12:268–279. https​://doi.org/10.1109/
TITS.2010.20914​07
Nguyen AT, Sentouh C, Popieul JC (2016) Driver-Automation Coop-
erative Approach for Shared Steering Control under Multiple
System Constraints: Design and Experiments. IEEE Trans Ind
Electron. https​://doi.org/10.1109/tie.2016.26451​46
Pacaux-Lemoine M-P, Flemisch F (2016) Layers of shared and coop-
erative control, assistance and automation. IFAC-Pap 49:159–
164. https​://doi.org/10.1016/j.ifaco​l.2016.10.479
Park J, Karumanchi S, Iagnemma K (2015) Homotopy-based divide-
and-conquer strategy for optimal trajectory planning via mixed-
integer programming. IEEE Trans Robot 31:1101–1115. https​
://doi.org/10.1109/TRO.2015.24593​73
Petermeijer SM, Abbink DA, de Winter JCF (2015) Should drivers
be operating within an automation-free bandwidth? Evaluating
haptic steering support systems with different levels of author-
ity. Hum Factors 57:5–20. https​://doi.org/10.1177/00187​20814​
56360​2
Pirjanian P (1999) Behavior Coordination Mechanisms—State-of-the-
Art. Report (No. IRIS-99–375). University of Southern California,
Institute for Robotics and Intelligent Systems
Quain JR (2016) How to use tesla’s autopilot (and how not to). In:
Toms guide. http://www.tomsg​uide.com/us/how-to-use-tesla​
-autop​ilot,revie​w-3870.html. Accessed 9 Feb 2017
SAE (2016) Taxonomy and definitions for terms related to driv-
ing automation systems for on-road motor vehicles. Standard
J3016_201609. SAE International
Saleh L, Chevrel P, Claveau F et al (2013) Shared steering control
between a driver and an automation: stability in the presence
of driver behavior uncertainty. IEEE Trans Intell Transp Syst
14:974–983. https​://doi.org/10.1109/TITS.2013.22483​63
Sentouh C, Soualmi B, Popieul JC, Debernard S (2013) Cooperative
steering assist control system. In: 2013 IEEE international confer-
ence on systems, man, and cybernetics. pp 941–946
Sheridan TB (1992) Telerobotics, automation, and human supervisory
control. MIT Press, Cambridge
Shladover SE, Desoer CA, Hedrick JA et al (1991) Automated vehicle
control developments in the PATH program. IEEE Trans Veh Tech
40(1):114–130. https​://doi.org/10.1109/25.69979​
Soualmi B, Sentouh C, Popieul JC, Debernard S (2014) Automation-
driver cooperative driving in presence of undetected obstacles.
Control Eng Pract 24:106–119. https​://doi.org/10.1016/j.conen​
gprac​.2013.11.015
Suchman LA (1987) Plans and situated actions: the problem of human-
machine communication. Cambridge University Press, Cambridge
Takada Y, Boer ER, Sawaragi T (2013) Driving assist system: shared
haptic human system interaction. IFAC Proc 46:203–210
Taş ÖŞ, Kuhnt F, Zöllner JM, Stiller C (2016) Functional system archi-
tectures towards fully automated driving. In: 2016 IEEE Intel-
ligent vehicles symposium (IV). pp 304–309
Ulbrich S, Maurer M (2015) Situation assessment in tactical lane
change behavior planning for automated vehicles. In: 2015 IEEE
18th International conference on intelligent transportation sys-
tems. pp 975–981
Walch M, Lange K, Baumann M, Weber M (2015) Autonomous driv-
ing: investigating the feasibility of car-driver handover assistance.
In: Proceedings of the 7th international conference on automotive
user interfaces and interactive vehicular applications. ACM, New
York, NY, USA, pp 11–18
13

670 Cognition, Technology & Work (2019) 21:657–670

Wetmore JM (2003) Driving the dream-the history and motivations International Conference on Intelligent Transportation Systems
behind 60 years of automated highway systems in America. Auto (ITSC). pp 13–18
History Rev 7:4–19
Willmore TJ (2012) An introduction to differential geometry, Reprint Publisher’s Note Springer Nature remains neutral with regard to
edn. Dover Publications, New York jurisdictional claims in published maps and institutional affiliations.
Wolf I (2016) The interaction between humans and autonomous agents.
Autonomous driving. Springer, Berlin, pp 103–124
Xiong Z, Dixit VV, Waller ST (2016) The development of an Ontology
for driving Context Modelling and reasoning. In: 2016 IEEE 19th

13