Control Transitions in Level 3 Automation: Safety Implications in Mixed-Autonomy Traffic

Abstract

Level 3 automated driving systems could introduce challenges to traffic systems as they require a specific lead time in their procedures to ensure the safe return of vehicle control to the driver. These processes, called ’transitions of control’, may particularly pose complications in accelerating traffic flows when regulations mandate control transitions due to an operational speed limitation of 60 km/h as established in recent certification processes based on UNECE regulations from 2021. To investigate these concerns, we conducted a comprehensive simulation study to examine potential safety implications arising from control transitions within mixed-autonomy traffic. The simulation results indicate adverse safety impacts due to increased safety-relevant interactions between vehicles caused by transitions of control in dynamic traffic flow conditions. Our findings also reveal that those effects could become stronger once string unstable ACC controllers are deployed as well.

1. Introduction

With Level 3 automated driving systems at the verge of entering today’s market [1,2], questions concerning traffic safety inevitably arise due to impending Level 3 disengagements that result in so-called ’transitions of control’ (ToCs) [3]. Whereas contemporary research primarily emphasizes human factors in Level 3 conditional driving [4], an often neglected aspect is the potential macroscopic impact of ToCs on traffic safety caused by procedural effects in automated driving systems. As automation levels increase, so do the demands on human drivers in transition situations to ensure safe vehicle operation, since Level 3 operation permits drivers to divert their attention from present traffic situations (cf. SAE levels of automated driving [5]). Similarly, the technical prerequisites on the automation side must guarantee that handover situations are triggered within an appropriate time frame and under safe traffic conditions. UN Regulation 157 from 2021 initially approved Level 3 operation up to 60 km/h [6] for so-called ’Automated Lane Keeping Systems’ (ALKS). Within these speed limitations, the first market-ready Level 3 systems have already been approved in Germany. Today’s amended UNECE version from 2023 lays the regulatory foundation for certifying fully operational Level 3 ALKS even up to 130 km/h [7]. Prospectively, this opens up the opportunity for manufacturers to have their automated systems certified in stages, e.g., up to 80 km/h or, if the technical requirements and capabilities allow for it, for the full speed range up to 130 km/h. This raises the question of how such an Operational Design Domain (ODD) considering a speed limitation could impact traffic safety and whether interim approval up to a level like 60 km/h poses risks regarding mandatory control transitions. Therefore, we have conducted an extensive simulation-based safety analysis to examine basic, scalable effects, yielding the following contributions:

(1)

We elaborate on our approach to model, parameterize, and simulate control transitions in a traffic scenario, encompassing the implications stipulated by the current UNECE regulations considering Level 3 systems that adhere to mandated speed limitations.

(2)

We introduce a comparative method for evaluating surrogate safety measures (SSMs) based on histogram distributions, which can be visually represented in a heatmap.

(3)

We present findings from three distinct use cases exploring fundamental ToC effects. The results from the main use case indicate ToC-induced safety impacts for high demand that is close to capacity limit in mixed-autonomy traffic with Level 3 shares ≥20%. The safety impacts assessed in the second use case can be attributed as negligible when taking an anticipatory property for the ToC preparation phase of Level 3 automation into consideration. The third use case shows increasingly detrimental traffic safety implications with ACC-related string instabilities in traffic flow.

Presently, comprehensive analyses concerning safety implications of ToCs are limited. We attribute this fact to deficiencies and constraints in existing ToC modeling. This study aims to provide more precise results with the help of a novel ToC model introduced by [8,9].

The rest of the paper is structured as follows: In Section 2 we elaborate on the control transition process, discuss simulation and modeling aspects, and review the latest research results assessing large-scale implications of ToCs. Moreover, we present selected SSMs that are relevant for our further investigation. Section 3 details our simulation experiment and the proposed methodology to assess the selected safety metrics. In Section 4, we present the simulation results and engage in a discussion of the findings. At last, in Section 5, we draw our conclusions from this study.

2. Literature Review

2.1. Transitions of Control

Control transitions, or transitions of control, delineate procedures that regulate the transfer of authority between the human driver and the automated vehicle (AV). The SAE taxonomy for driving automation systems [5] defines five different levels (cf. Figure 1); within such, ToCs constitute the transitions between those levels, typically from higher levels to zero or vice versa. In the case of upward ToCs, the driver cedes control to the AV within its predefined ODD. This transfer is facilitated through the activation of its automated driving systems, relinquishing the execution of longitudinal (acceleration/deceleration) and lateral (steering) driving tasks to those systems. For automation Levels 1–2, the human driver keeps monitoring the driving environment, whereas for Levels 3 up to 5, those monitoring tasks shift to the automation. Up to Level 3, the human driver poses as the fallback entity to ensure safe driving performance.

In instances for which the vehicle automation, due to a range of potential external or internal factors, cannot operate safely within its ODD anymore or is requested to disengage, a downward ToC is initiated. This prompts the AV to request the driver’s intervention in order to continue manual control of the vehicle. The mechanism employed to inform the driver of the need to re-engage in primary driving responsibilities, which may involve auditory, visual, or haptic signals or combinations thereof from the vehicle automation, is termed a ’take-over request’ (ToR). A successful downward ToC is considered complete once the driver has re-engaged and continues normal operation with fully restored situational awareness and driving skills. However, if the downward ToC fails, meaning the driver does not respond to the ToR within the specified lead time, the AV will perform a minimum risk maneuver (MRM) to come to a safe stop.

Particularly, the topic of takeover times in AVs in urgent situations has been researched in great detail over the past decade in human sciences, mostly in driving simulators aimed at specifying criteria for the appropriate design of human–machine interfaces for takeovers [10]. A comprehensive overview of such experimental studies is provided by [11]. Another motivational factor behind those research studies was to derive indicators of how to conceive takeover strategies in simulation models and automated driving systems with respect to lead times and post-ToC behavior. Recently, studies have focused on human responses to prototypical Level 3 automated driving systems in terms of physiological effects, risk acceptance, comfort level, trust, and various other aspects from the perspective of being in a passenger role during Level 3 operation [12,13,14,15,16,17,18]. An extensive literature review examining various influential factors on takeover performance is given by [19]. A notable approach of a generic multi-level framework for microscopic simulation by [20] incorporates human factors such as task demand, task capacity, and situational awareness. Based on this model, ref. [21] presented a detailed simulation study to investigate vehicle interactions, alluding to detrimental effects of accumulated ToCs in their analysis. However, most of the related research focuses on individual driving performance and local effects (collision avoidance, lateral and longitudinal safety, and risk tolerance) and is often conducted in driving simulators, small-sample-sized real-world tests, or sub-microscopic simulations. Thereby, the simplified state machine model developed by [8] for the microscopic traffic simulation SUMO [22], designed to efficiently capture potential disruptions in traffic caused by ToCs and to facilitate large-scale simulations, is further elucidated in the following paragraph.

Figure 2 presents an illustration of the model, with panel (a) depicting a generic velocity timeline a for successful transition and panel (b) showing a failed transition with a differing timeline. In both variants, a preparatory ToC phase is initiated after a ToR has been triggered, after which automated operation continues for a limited time span (referred to as the available lead time). Yet, the AV’s automation system takes safety precautions during the preparatory ToC phase, i.e., increasing its headway, lane change avoidance, and acceleration abstinence, and continues operation until either re-engagement from the driver (successful ToC) or expiration of the available lead time (failed ToC), at which point it starts an MRM. For the latter case of a failed ToC, the model assumes a constant deceleration rate for the MRM, which can occur in the vehicle’s current lane or the right-most lane (via a autonomous lane change maneuver) depending on traffic conditions. In the case of successful control transition, the post-ToC phase’s driving performance is determined by a driver state model that considers perception errors for imperfect driving, as detailed in [8], which was partly adapted and based on action point models developed by [23,24,25,26].

While previous research on ToCs so far has predominantly focused on individual consequences of failed transitions by analyzing crash incidents or disengagement reports [27,28,29,30], the examination of ToCs’ large-scale effects on traffic has only gained attention in recent years. Among the first studies addressing complications induced by ToCs and exploring potential traffic management countermeasures is the work by [9]. This study identified adverse impacts on both traffic efficiency and safety. In a small simulation study emphasizing traffic efficiency performance, Ref. [31] developed a simplified ToC model that restricts lane changes during control transitions while approaching a bottleneck. Although the study discussed safety-related aspects of ToCs, their analysis solely focused on traffic efficiency. Another very insightful study conducted by [32] assessed the potential impact of ToCs through a comprehensive simulation study for all of Japan. They analyzed variations in crash rates and highlighted the role of overconfidence or distrust in detrimental ToCs, which diminish the accident reduction effects they previously identified. The study generally observed an overall positive impact of vehicle automation on crash rates, particularly when the market penetration of AVs exceeded 50%. Furthermore, ref. [33] re-simulated specific motorway scenarios, such as ‘cut-in’ situations, based on accident data from the GIDAS dataset provided by the Federal Republic of Germany. This analysis focused on the severity of changes in these driving scenarios and derived potential benefits from automated driving functions by projecting the results to a national scale. In a simulation-based case study aimed to propose potential traffic management countermeasures to mitigate adverse impacts induced by control transitions [34], our earlier research focused on traffic efficiency performance, deferring an in-depth analysis of safety ramifications from ToCs. Therefore in Section 3, we introduce a new case study dedicated to investigating these safety effects in greater detail, and we share our findings in Section 4.

2.2. Surrogate Safety Measures

Surrogate safety measures are an important and helpful tool for evaluating traffic safety, particularly when crash events in data are rare or nonexistent, as in mixed-autonomy traffic scenarios. A good categorization, including mathematical definitions of relevant SSMs, can be found in a survey in [35]. Another comprehensive and quite deliberate literature review is given in [36], which details state-of-the-art SSMs in mixed-autonomy traffic research. Particularly, the authors critically discuss certain shortcomings of SSM-based safety assessments and point out inadequacies in simulation-based safety evaluations, which concentrate on automated driving without calibrated vehicle models. They also highlight underestimation of criticality and risk due to inadequacies in vehicle modeling, consideration of reaction times, and the interpretation of solitary SSMs with fixed but non-validated thresholds.

Typically, SSMs are categorized into two main classes: (I) SSMs for identifying individual conflicts and (II) SSM-based models for estimating crash risks or probabilities. Common sub-categories for (I) can be further divided into (i) time-based, (ii) deceleration-based, or (iii) energy-based, or combinations thereof. The time-based SSM we refer to hereafter in this work is the well-established Time to Collision (TTC) [37], which is defined as:

$$TTC=\left\{\begin{array}{cc}\frac{d}{v_2-v_1},\hfill & \mathrm{if}{v}_2>v_1\hfill \\ \infty ,\hfill & \mathrm{otherwise}\hfill \end{array}\right.$$

(1)

with d denoting the space gap and $v_2-v_1$ being the speed difference between the leading and the following vehicles. Another representative deceleration-based SSM, denoted as the Deceleration Rate to Avoid Crash (DRAC), dates back to a concept introduced by [38] (although not yet fully formalized as a metric in that paper). It is defined as:

$$DRAC=\left\{\begin{array}{cc}\frac{{(v_2-v_1)}^2}{2d},\hfill & \mathrm{if}{v}_2>v_1\hfill \\ 0,\hfill & \mathrm{otherwise}\hfill \end{array}\right.$$

(2)

For an energy-based SSM, we reference [39] as an example, which presents an interesting, novel approach called ’extended delta-V’, which estimates the crash severity of potential conflicts. Since this work does not delve deeply into SSM-based models or other related approaches, we refer the interested reader to [35,36] for more comprehensive information. However, we want to allude to a few notable papers that helped us develop a feasible approach for our own case study (see Section 3.3). In their study, ref. [40] employed an approach for assessing the impact of connected automated vehicles on traffic safety by evaluating the distributions of TTCs rather than using a specific threshold for counting critical events. Even though their analysis is mostly descriptive, the histogram-based approach circumvents the utilization of non-validated criticality thresholds. Such so-called ’surrogate safety histograms’ (SSHs) have also been used for completely different contexts, i.e., analyzing traffic safety based on vehicle trajectories for individual vehicle conflicts, and has proved to be helpful for comparing TTC results for different conditions [41,42].

As pointed out by [35,36], the absence of human perception–reaction times (PRT) or response times (RT) is a noted concern. In response to this issue, we introduce the Modified Deceleration Rate to Avoid Crash (MDRAC), which was developed by [43] as an enhancement over the traditional DRAC. The MDRAC takes into account a perception–reaction time (PRT) and is devised as follows:

$$MDRAC=\left\{\begin{array}{cc}\frac{v_2-v_1}{2(TTC-PRT)},\hfill & \mathrm{if}TTC>PRT,v_2>v_1\hfill \\ \infty ,\hfill & \mathrm{otherwise}\hfill \end{array}\right.$$

(3)

When [44] introduced their novel SSM, Deceleration Rate to Avoid a Crash using Constant Initial Acceleration (DCIA), they utilized the MDRAC for verification purposes. Their work inherently presented compelling data that underscored the superior sensitivity of the MDRAC compared to the traditional DRAC. (For their analysis, they used PRTs of 1.3 s and 2.02 s. We elaborate on our rationale for using a PRT of 1 s in Section 3.3.) The DCIA model was developed with the aim of accounting for the relative acceleration between two vehicles. Similar considerations were also explored by [45] but with a different analytical approach involving the design and introduction of a modified TTC, referred to as ‘MTTC’. Both publications emphasize the limited expressiveness of the TTC when considered individually, motivating them to develop SSMs that incorporate relative decelerations. In a thoroughly performed study, ref. [46] validated bivariate SSM threshold pairs based on crash data, concluding that only a combination of conflict indicators can reliably estimate crashes. Their research also indicates that the DRAC, in particular, seems to systematically underestimate potential crash events.

Taking into account the previously mentioned considerations, we utilize two SSMs in our subsequent safety analysis: (1) the TTC and (2) the MDRAC. In a scenario-based simulation study, we investigate safety implications of ToCs, as specified in the following sections.

3. Simulation Experiment

3.1. Use Case Definition

Based on the principles set forth in UN Regulation 157 from 2021 [6] that led to first automated system approvals adhering to a speed limitation, we define a use case to investigate the impact of ToCs on traffic flows in mixed-autonomy driving conditions. Those regulations permit these approved Level 3 systems to currently operate up to 60 km/h in ODD compliant conditions, e.g., on unidirectional infrastructure such as highways. Therefore, on a two-lane highway, we split the speed limit into a sub-60 section, where AVs can drive in automated mode, and a downstream section with a higher limit of 100 km/h (cf. Figure 3a). Consequently, vehicles will accelerate to their desired or allowed speed (up to 100 km/h) when entering the latter section, requiring AVs to perform a ToC when their own current speed and also the perceived speeds of the surrounding vehicles exceeds the 60 km/h limit for Level 3 ODD operation.

The speed profiles for two traffic flows in this use case are shown in Figure 3b and present the mean speeds for a traffic mix without AVs (cf. blue line, Mix 0) versus a traffic mix with a high AV share (cf. orange line, Mix 5). Comparing these two profiles, we see that due to consecutive ToCs, disruptions in the traffic flow delay the overall speed increase in the high-AV case.

Therefore, we define two scenarios:

• Base: AVs do not perform ToCs based on ODD limitations. Consequently, AVs continue to drive fully automated without speed limitations, accelerating up to 100 km/h in the second section of the road. All vehicles operate in their respective automation modes.
• Level 3: AVs operate within the ODD limitations. Therefore AVs are required to perform a ToC in the second section of the road, where surrounding traffic allows for driving at higher speeds beyond 60 km/h.

In this main use case, we investigate the principle safety implications caused by control transitions when the ToC model operates with the default parametrization: that is, emulating a preparatory ToC phase that actively increases a safe gap from its leading vehicle until the transition to the human driver is successful (cf. Section 3.2). UNECE regulations state that the automation may reduce the vehicle’s speed during the transition to ensure safe operation. We discuss alternative approaches and potential countermeasures to avoid active deceleration by the vehicle automation in Section 4.2, but we also argue the technical requirements and difficulties that Level 3 automated vehicles face in such heterogeneous conditions.

3.2. Parametrization and Simulation Setup

We constructed traffic compositions with a broad range of vehicle shares, including AVs, manual vehicles (MVs), and heavy and light goods vehicles (HGVs and LGVs), as presented in

Table 1. Traffic compositions with vehicle shares for six different mixes.

Traffic Mix	Vehicle Type
	AV	MV	HGV	LGV
Mix 0	0%	85%	5%	10%
Mix 1	20%	65%	5%	10%
Mix 2	40%	45%	5%	10%
Mix 3	60%	25%	5%	10%
Mix 4	80%	5%	5%	10%
Mix 5	85%	0%	5%	10%

. Each vehicle enters the simulation with its respective parametrization scheme as a manual or automated vehicle. LGVs and HGVs are considered to be manually driven trucks. AVs that do not perform a ToC in the Base scenario keep their ACC model throughout the simulation. For the Level 3 scenario, AVs continue their operation as MVs after performing a ToC, which means they switch from the ACC to SUMO’s default model.

Table 2. Vehicle types in the simulation represented by SUMO model combinations. The Krauß model is SUMO’s standard model. The ACC model is part of SUMO’s car-following model selection.

Driving Mode	SUMO Model	Vehicle Type
		MV/HGV/LGV	AV
Car-Following	Krauß	o	-
	ACC	-	o
Lane Change	Default	o	-
	Parameterized LC	-	o
Control Transition	ToC	-	o

summarizes the deployed models. Parametrization schemes for vehicles, lane changes, and ToC model(s) were adopted from [47]. The parameters used for defining the ToC models’ preparatory phase are shown in

Table 3. Parametrization of SUMO’s ToC model.

Parameter	Description
ogNewSpaceHeadway = 5.0 m	Target additional space headway during the preparatory phase before a ToC
ogNewTimeHeadway = 10.0 s	Target time headway during the preparatory phase before a ToC
ogChangeRate = 1.0	Change rate of headway adaption during the preparatory phase before a ToC
ogMaxDecel = 1.0 m/s2	Maximum deceleration rate due to headway adaption during the preparatory phase before a ToC
$t_{\mathrm{lead}}=10$ s	Available lead time for AVs

. The simulations were performed with SUMO version 1.19.

In regard to parameterizing $t_{\mathrm{lead}}$, and also the other parameters in Table 3, it is important to note the lack of reliable information available from the manufacturers. In recent EC projects like L3Pilot or Hi-Drive, the manufacturers explicitly stated their restrictive data disclosure: referring to a competitive customer market. Recent technical reports from the Hi-Drive project [48,49] suggest a specification range from 5–20 s but without further details on when ToRs will be triggered. Moreover, in a press release, [1] stated 10 s as a lead time for their Drive Pilot system.

In order to compare both scenarios accurately, based on volume/capacity ratios, we determined the capacities individually for each scenario and each traffic mix. This was deemed necessary since the six distinct traffic compositions defined in Table 1 entail different capacities due to differing lane utilization caused by the vehicle model’s longitudinal and lateral driving behavior (including capacity-diminishing effects caused by ToCs). To identify the respective capacity for each traffic mix, we ran simulations with increasing demands until a surge in the vehicle insertion backlog could be detected, which means that SUMO cannot insert more vehicles per time step in a fully populated network (SUMO delays vehicle departures to ensure safe gaps between consecutive vehicles if the minimum gap would be violated).

Table 4. Measured lane capacity c $(veh/hour)$ per traffic mix in SUMO for both scenarios.

	Traffic Mix
	Mix 0	Mix 1	Mix 2	Mix 3	Mix 4	Mix 5
Base	1700	1600	1550	1500	1450	1450
Level 3	1700	1500	1350	1250	1230	1170

following summarizes the measured lane capacities for both scenarios.

Vehicles randomly enter a 5000 m, two-lane road network with a Poissonian distribution, while the demand is determined for a volume/capacity ratio range from [25–100%] per parameter combination traffic mix/percentage. To represent the vehicle types (cf. Table 2) with a heterogeneous fleet, we created random distributions for each type, wherein SUMO randomly picks vehicles for insertion from a type-specific set of 1000 differently parameterized vehicles each time step.

For the Level 3 scenario, in order to emulate the necessary return of vehicle control from the automation to the human-driver, ToRs are triggered for AVs through the SUMO API TraCI in the second road section. ToRs are issued based on the current ego vehicle speed and the average speed of the surrounding road section. A simplified abstraction of the mechanism is shown in the following pseudo-code:

• while simulation = true do
•    monitor speedLevel
•    add AV to pendingVehiclesList
•    for AV in pendingVehiclesList: do
•       if (AV.speed && speedLevel > 16.7  m/s) then
•          issue ToR
•       else if AV.pos ≥ endOfSection then
•          issue ToR
•       end if
•    end for
• end while

For the Base scenario, no alteration to vehicle behavior through TraCI is necessary. To model individual human driver takeover times to ToRs, a Gaussian probability distribution was created as in [47] with an expectation of 7 s and a variance of 2.5. This distribution results in about 10% short MRMs: i.e., driver reaction times exceeding the available lead time of 10 s but only with durations of less than 3 s. MRMs with longer durations up to causing the standstill of a vehicle, thereby blocking a full lane, are not considered in this study. A concept of how to handle long MRMs with infrastructure assistance deploying V2X messages can be found in [9,50].

Takeover time distributions are often analyzed in controlled driving simulator studies such as, e.g., [51], but clear evidence of the distribution pattern (normal, skewed, platykurtic,…) in regard to Level 3 related ToCs remains inconclusive, which is why we refer to the stated normal distribution. The mean takeover time is set seemingly high compared to takeover times often referenced in studies for urgent ToCs with rather short takeover time budgets. A range of 7–8 s as a common time budget for supposedly urgent ToCs with a respective range of approximately 2–3.5 s for takeover times is stated by [19] in their review. Similar ranges were previously identified in a survey by [52], but their own research also focused on non-urgent, normal ToCs, which showed notably increased takeover times with secondary task involvement (median: 6 s). Since we consider the ToCs mandated in our described use case as non-urgent, planned ToCs, we regard the referenced mean takeover time of 7 s as adequate for our parametrization.

All parameter combinations run with 10 different seeds for at least 1 h simulated time. In total, we conducted 6 mixes × 6 ratios × 10 seeds × 2 scenarios = 720 simulations for the main evaluation (plus an additional 1440 simulations for the two extra use cases: cf. Section 4).

3.3. Method for Assessing SSMs

We assess the safety ramifications with two SSMs: TTC (time-based) and MDRAC (deceleration-based). Typically, theses metrics are count based: meaning the number of events within a specific time period is accumulated. Therefore a dedicated threshold needs to be specified to define an event as critical. These thresholds, which differentiate events between critical and non-critical, have a wide range in the literature and also depend on the context of real-world, driving simulator or simulated traffic data. Based on crash evaluations from naturalistic driving studies (NDS), ref. [53] suggests a TTC range 0.7–1.4 s, whereas [54] states a range of 2.6–3 s from driving simulator tests. Reference [55] summarizes its findings as a range of 1.5–5 s for TTCs. For MDRACs, usually the same range from 3.0–3.4 m/s² as for the DRAC is utilized [44,46]. (A basic evaluation with what we found to be two illustrative thresholds each (i.e., TTC with 1.75 s and 3.0 s; MDRAC with 3.0 m/s² and 3.4 m/s²) is shown in Section 4).

On the other hand, we note the quite limited expressiveness of such a threshold-based evaluation since it is bound to the validity of the specified thresholds that define the criticality. For SUMO, no validated set of thresholds exists for any of the established safety metrics since those would also have to be calibrated for each car-following model individually. Due to no available real-world data with Level 3 automated vehicles on a large scale, we see no feasible option to find a valid set of criticality thresholds in SUMO, at least for our scenarios.

Thus, we offer a complementary analysis with the selected SSMs that aims to provide better comparability between the two defined scenarios by exposing differences more robustly than a count-based evaluation could, at least for our use case. Figure 4 exemplarily shows the histograms and density distributions for TTC and MDRAC data of one simulation set (i.e., 10 seeds), comparing the two defined scenarios: Base vs. Level 3. In this case, the histograms illustrate rather substantial differences between the distributions (orange vs. blue) for both metrics. Consequently, distinguishing between critical vs. non-critical events by appointing a distinct critical threshold might be obvious and robust for identifying safety issues. On the contrary, when data points are sparse or roughly similar, noticing safety issues from the data might be more inconclusive because even small differences in an appointed criticality threshold may have great impacts on the total number of count-based events. (We consider it impractical to include all 72 histograms from our primary simulation case. The presented heatmaps encapsulate these histogram data.)

The proposed steps to evaluate a full dataset per SSM are listed as follows:

• Include all data points within a range of interest of the SSM (i.e., TTC events between 0–8 s and MDRAC events > 0.2 m/s²) and calculate the surface integral of the histogram. This results in one condensed value for the total number of TTC or MDRAC events, respectively, for a full simulation set
• In order to compare both scenarios against each other, calculate the difference between the surface areas derived from the histograms: Total = Level 3 − Base.
• Draw a colored heatmap for all parameter combinations for each metric. Also, normalize the data for better comparability to other (alternative) scenarios.

All events are weighted equally when calculating the integral. Inherently, events with higher TTC values occur more often than those with lower TTC values in traffic flows; thus, the surface value holds greater emphasis on more frequent but potentially less critical events (and vice versa for MDRAC events). Additional tests with weighted results showed negligible impact on the final heatmap visualizations, supporting the robustness of our approach when sufficient data are available.

Note, that for each traffic mix defined in Table 1, there is a corresponding capacity limit referenced in Table 4. As described before, these different capacities entail that in order to isolate the impact of ToCs within each traffic mix, all parameter combinations of traffic mixes and v/c ratios have to be simulated with and without the occurrence of ToCs. This is why scenarios Base and Level 3 were defined in Section 3.1 and why calculating the difference between those respective results, as denoted in Point 2, is deemed necessary. To further highlight the safety impact of ToCs, we include traffic Mix 0 in all following representations of the results as a reference traffic share without AVs (and consequently, no ToCs).

Additionally, Figure 4 shows cumulative density distributions on the the second y-axis (see dashed lines). Those distributions can also be used for non-parametric statistical tests, such as Kolmogorov–Smirnov [56] or Cucconi [57]. Although both tests were carried out on the result data to test for statistical significance, we do not present these explicitly, since non-parametric tests usually are sensitive to the sample size. Note, that we ran those tests for accumulated results (high sample size) as well as separately on each seed (relatively small sample size) for all parameter combinations of mixes and v/c ratios. In most of the cases, the tests showed highly significant differences that are in line with the presented heatmap results shown in Section 4. Nevertheless, we refrain from including these statistics since we cannot determine a suitable sample size due to the nature of our simulated data from the scenario at hand. Moreover, for evaluating the MDRAC, we implemented the necessary code for the SSM device in SUMO (see https://github.com/eclipse-sumo/sumo/pull/13352, accessed on 1 November 2023) and parameterize it with a PRT value of 1 s. For simplicity, we keep this value constant throughout the entire evaluation. As [58] stated in his extensive analysis, there is no exact value to estimate the reaction time for human drivers to brake, since it depends on the level of expectancy. The author provides a range from 0.75 s up to 1.5 s for mean response times. Note also, that in this context, this means we only assume a PRT to analyze the SSM. SUMO does not model a PRT in its car-following models per se. The parameters stepLength and actionStepLength for all simulations are set to 0.1 s; accordingly, the vehicle models react in each time step. Even though decoupling theses two parameters can emulate aspects of a PRT, it would still not resemble a true model of a perception–reaction loop. This topic is worth a comprehensive study itself, but this is not the main focus of this work.

4. Results and Discussion

In the following section, we analyze and discuss the main results from the simulation experiments (cf. Section 4.1 as well as two alternative use cases (cf. Section 4.2 and Section 4.3)—which examine different premises for simulating Level 3 automation—in order to disclose further potentially beneficial and detrimental safety ramifications.

4.1. Safety Analysis

Table 5. Comparison of critical TTCs/h for Level 3 scenario with v/c ratio range from [25–100%] for traffic Mixes 0–6. The critical thresholds chosen for the measurements are: TTC ≤ 1.75 s and TTC≤ 3.00 s. Note that for all parameter combinations in the Base scenario, no critical events were detected.

		Traffic Mix
		Mix 0		Mix 1		Mix 2		Mix 3		Mix 4		Mix 5
		≥1.75	≥3.00	≥1.75	≥3.00	≥1.75	≥3.00	≥1.75	≥3.00	≥1.75	≥3.00	≥1.75	≥3.00
v/c ratio [%]	100	0	0	6.5	29.1	6.4	36.6	6.8	37.6	7.3	44.8	7.1	39.7
	85	0	0	3.5	18.4	4.1	20.5	5.0	25.9	4.5	30.2	2.6	23.2
	70	0	0	2.7	9.6	3.2	14.8	3.1	14.8	4.1	22.3	2.7	16.8
	55	0	0	1.4	4.9	1.6	7.9	1.7	8.0	2.3	10.5	0.9	6.9
	40	0	0	0.2	1.9	0.4	1.9	0.6	3.7	0.4	3.4	0.7	3.1
	25	0	0	0	0.2	0	0.2	0.2	0.8	0.1	0.5	0.1	0.7

and

Table 6. Comparison of critical $MDRACs/hour$ for Level 3 scenario with v/c ratio range from [25–100%] for traffic Mixes 0–6. The critical thresholds chosen for the measurements are: $MDRAC\ge 3.4$ m/s² and $MDRAC\ge 3.00$ m/s². Note that for all parameter combinations in the Base scenario, no critical events were detected.

		Traffic Mix
		Mix 0		Mix 1		Mix 2		Mix 3		Mix 4		Mix 5
		≥3.40	≥3.00	≥3.40	≥3.00	≥3.40	≥3.00	≥3.40	≥3.00	≥3.40	≥3.00	≥3.40	≥3.00
v/c ratio [%]	100	0	0	3.3	5.1	3.8	5.7	6.5	7.8	6.0	8.9	7.1	8.9
	85	0	0	2.5	3.4	2.6	3.4	4.0	4.8	3.7	4.7	2.8	3.6
	70	0	0	1.7	2.2	2.1	2.8	3.6	4.1	4.4	5.3	2.6	3.2
	55	0	0	1.2	1.5	0.6	1.0	1.7	1.9	2.1	2.8	1.3	1.7
	40	0	0	0.2	0.4	0.2	0.3	1.1	1.5	0.7	0.8	1.0	1.2
	25	0	0	0.1	0.1	0	0	0.1	0.1	0.1	0.1	0.3	0.3

present the count-based evaluation for critical TTCs/hour and MDRACs/hour with two different thresholds for each metric. Both tables only show values for the Level 3 scenario since no critical events could be detected for the Base scenario.

Focusing on Table 5, we observe that for either threshold, with very low demands i.e., v/c ratios below 55% and without automated vehicles in the traffic composition, i.e., Mix 0, zero or only very few events per hour can be noted. With increasing demand (>55%), critical events occur more frequently, even with lower automation shares for Mix 1 and Mix 2. In comparison, we notice obvious discrepancies in the number of critical events depending on the threshold (i.e., 1.75 s and 3.0 s). Nevertheless, for both thresholds, similar trends for mixes ≥ Mix 2 and demands closer to capacity limits ≥70% can be identified. For the maximum values, the critical event rate increases from zero to either 7.3/h or up to 44.8/h depending on the threshold. Considering MDRACs in Table 6, we observe a less distinct discrepancy between the events for both MDRAC thresholds. Comparable trends to those stated for TTCs can be observed, with absolute values overall being closer to their corresponding TTC value pairs for the critical TTC threshold ≤ 1.75 from Table 5. Maximum values for increased critical event rates are 7.1/h and 8.9/h, respectively.

Correspondingly, Figure 5 visualizes these tabular data exemplarily for critical thresholds TTC ≤ 1.75 s and MDRAC ≥ 3.4 m/s² in a normalized heatmap. We observe rather dissimilar coloring comparing both heatmaps, which makes it hard to clearly identity trends, particularly across traffic composition. For that reason, as proposed in Section 3.3, we present additional heatmaps that are detached from specific criticality thresholds and that aim to constitute more coherent results across both metrics. The heatmaps in Figure 6 provide more subtle insight into the distribution for increased TTC and MDRAC rates. Firstly, we observe reasonably matching coloring between both heatmaps: TTC vs. MDRAC. Second, to check for plausibility, we would expect for Mix 0 (which has no AVs in the fleet mix) to show no differences between the results, which the minimum light-green coloring in the heatmaps confirms. Similar coloring is to be found for v/c ratios with lower demands, i.e., 25–40%, displaying no noteworthy differences. Third, maximum values appear on capacity limit in Mixes 2 and 4, as opposed to Figure 6, which shows Mixes 4 and 5 at maximum. Fourth, slightly more pronounced highlighting of MDRAC events—particularly for Mix 4/85% and Mix 5/100% but also seen as moderately darker colors for medium-demand levels—can be observed. This accentuation compared to the TTC coloring might hint at stronger sensitivity for the MDRAC versus the TTC.

Nevertheless, the results seem to indicate adverse safety implications close to the maximum v/c ratio starting with traffic Mix 1 for both SSMs. Overall, these heatmaps showcase, from our point of view, more consistent trends regarding safety impacts of ToCs across the stated parameter combinations of demand/traffic mix than the threshold-based results alone could do (cf. Table 5 and Table 6). (We conducted additional simulations with a similar use case that mandates a different speed limitation (80 km/h) for a Level 3 automated system. In this case, the network speed limit allowed speeds up to 130 km/h in the second road section. The overall trends shown in Figure 6 remain about the same for such a use case, even though the absolute numbers are lower due to considerably different capacities, which also lead to varying interactions between vehicles).

4.2. Open Gap Prediction

As previously discussed in Section 3.1, we acknowledged that the ToC model in SUMO is intentionally designed and parameterized to actively increase the gap to its leading vehicle during the preparatory ToC phase. This design objective is aimed at ensuring a safe gap when the human driver takes back control. Considering that in this use case the automated Level 3 operation is only allowed to go up to 60 km/h before a ToC is mandated, numerous hypothetical factors could be listed on why traffic is moving below this threshold, e.g., speed limits, construction sites, accidents, weather conditions, infrastructure limitations, or high traffic density, to name a few.

Hence, when the factors causing the traffic slowdown subside and overall traffic conditions permit higher driving speeds, a Level 3 automated system could potentially anticipate the acceleration of the vehicle ahead. As a result, this assumption about surrounding traffic’s acceleration would enable the AV, during a ToC preparation phase, to wait for the gap to naturally increase by maintaining its current speed—without the need for active deceleration—while the preceding vehicle accelerates. This mechanism may temporarily deviate from the minimum safe gap assumption of the ACC model for a few seconds until the gap becomes sufficiently large. Assuming that a Level 3 AV can accurately predict the behavior of the leading vehicle over a short time span, this approach might be considered an acceptable risk. It is important to note that current ACC systems permit users to manually set a desired minimum gap below a safe distance level. However, this is because human drivers are expected to continuously monitor the traffic situation and be prepared to regain control immediately (cf. SAE levels 1 and 2, Figure 1). In contrast, Level 3 automated systems must be capable of autonomously monitoring surrounding traffic conditions and reliably predicting a safe driving status within their ODD conditions. (A typical approach often discussed in research to have better predictability is the deployment of vehicle-to-vehicle communication (V2V), which is not in the scope of this work. Although, SUMO provides a respective CACC vehicle model, we keep the ACC model throughout our simulations for coherent comparability across the use cases.)

Therefore, to investigate potential benefits to the traffic flow presuming the discussed advanced Level 3 capabilities, we define another use case for which we perform reruns of the previous simulations but with different parametrization for the ToC model’s preparation phase. The scenario is denoted as OG for the following evaluation. It is important to clarify that we do not explicitly model the advanced predictive capabilities of an AV in SUMO directly. Instead, we emulate the AV’s predictive mechanism by adjusting the ToC model’s parametrization. Specifically, the maximum deceleration during the headway adaption is set to ogMaxDecel = 0 m/s², thereby preventing any deceleration during the preparatory ToC phase. This approach aligns with our assessment since none of our vehicle models or individual vehicles in the scenario configurations are determined to engage in unpredictable or abrupt braking maneuvers.

In line with our previous evaluation, Figure 7 presents heatmaps for both safety metrics. In order to compare the new open gap effects with the main use case results, we kept the coloring scale from Figure 6. Consequently, when observing the uniform light-green coloring of both heatmaps, it becomes evident that all detrimental control transition effects vanish completely compared to the main use case. Although this use case here represents a simplified version of the discussed predictive mechanism, the results highlight the potential of advanced Level 3 automation that not only accounts for individual safety but also the effects on overall traffic as long as it adheres to the criteria set by UNECE regulations to ensure safe control transitions. In our assessment, this requirement poses a significant technical challenge from an engineering and manufacturer perspective, making it a crucial topic for future research and real-world testing in the context of high-level automated driving.

4.3. String Stability

One aspect about deploying the ACC model as a proxy for Level 3 automated driving in SUMO that has not been discussed yet is the issue of string stability vs. instability. Although [59] discusses the possibility of parameterizing their originally proposed ACC controller for string stability, they presented calibrated gain factors (k₁ = 0.23 s⁻² and k₂ = 0.07 s⁻¹) based on real-world experimental data. Notably, these gain factors resulted in unstable ACC string behavior (cf. [59] Figure 12). As shown in Figure 8, we conducted simulations in SUMO to replicate the driving maneuvers from the experiments presented in [59]. The speed oscillations of the subsequent vehicles clearly illustrate the string instabilities for the ACC model when parameterized with the previously stated control gains.

In order to ensure a stable controller, [60] presented a modified ACC model with additional driving modes: adding a gain factor k₀ = 0.4 s⁻¹ for a speed control mode plus a new mode called ’gap-closing’, which tunes the gain factors k₁ and k₂ to 0.04 s⁻² and 0.8 s⁻¹. SUMO’s implementation of the ACC model is based on this paper, but the model is extended with another fourth mode based on [47]. This mode is named the ’collision-avoidance’ mode, and it tunes the gain factors to k₁ = 0.23 s⁻² and k₂ = 0.8 s⁻¹. All these modes and tuned gain factors aim to ensure that the ACC vehicle can brake hard enough to avoid collisions and therefore provide a crash-free simulation while resulting in a string-stable ACC parametrization.

However, other studies such as as [61,62] are based on experimental campaigns with ACC-equipped, commercial vehicles currently deployed to the customer market and demonstrate string instabilities in vehicle platoons. As the traffic compositions utilized in this work contain increasing AV shares, we would also expect a ToC-related safety impact in the presence of string unstable behavior. Therefore, in order to investigate potential detrimental ToC-related effects in string unstable traffic flow conditions, we conducted reruns of the main use case, deploying the parametrization scheme for string unstable ACC behavior, as depicted in Figure 8. Accordingly,

Table 7. Measured lane capacity c $(veh/hour)$ per traffic mix in SUMO for both scenarios with string unstable ACC parametrization.

	Traffic Mix
	Mix 0	Mix 1	Mix 2	Mix 3	Mix 4	Mix 5
Base	1700	1600	1550	1500	1450	1450
Level 3	1700	1600	1550	1500	1450	1450

shows the updated measured lane capacities for this parametrization. (Considering the numerous collisions observed in these simulations, it is likely that the actual capacities are lower, but nonetheless, we assess those numbers as an adequate approximation. The differences in capacity between both scenarios cannot be discerned without more compartmentalized measurement because the strong string instability effects of the ACC model obscure the underlying ToC effects.)

Consistent with our proposed evaluation method, we created heatmaps for both SSMs (cf. Figure 9). For comparison, the coloring is normalized to the notably lower scale of Figure 6. The black tiles highlight the data points (which are, as a reminder, the difference between the surface integrals of the histograms) that exceed the data from the main use case discussed in Section 4.1. We observe a significant spike in TTC and MDRAC events with increasing demand and AV shares: essentially for all mixes from Mix 1 to Mix 5 and v/c ratios greater than 40%. Although there is a notable difference between the absolute values between both SSMs when comparing these heatmaps, the overall trend towards higher demands and AV shares persist. Again, as noted before in Section 4.1, the MDRAC metric seems to be more sensitive to escalating safety events. Overall, we think this use case vividly demonstrates potential adverse ToC effects for unstable ACC controllers that may need to be carefully addressed in mixed-autonomy scenarios presuming Level 3 systems will reach significant market penetration under the considered regulations that mandate speed limitations.

4.4. Limitations of the Study

However, we want discuss various limitations of the study concerning the interpretation of the presented results.

4.4.1. Validation

As previously mentioned, SSM-based evaluations in traffic simulations often suffer from insufficient calibration to real-world data. Likewise, traditional count-based SSM analyses that employ specific thresholds to distinguish critical from non-critical events lack proper validation within microscopic traffic simulations like SUMO. Considering the limited deployment of Level 3 automated driving systems in the market, data are scarce due to manufacturers in a competitive customer market tending to withhold detailed information about automated driving operations, including parametrization schemes for ToC procedures. Unfortunately, this issue appears to be difficult to address in the short term. Yet, a promising option for better calibration, at least for SUMO’s current ACC model, is the database OpenACC described by [63], which provides large experimental datasets on state-of-the-art Level 2 systems.

4.4.2. Safety Metrics

Our analysis relies on SSMs that are suitable for identifying safe longitudinal distances or time gaps, i.e., the TTC and the MDRAC. These SSMs have their limitations, particularly in terms of expressiveness, as they assume constant speed or deceleration. The TTC, e.g., is often inherited in modified metrics to account for such deficiencies. On the other hand, the MDRAC incorporates the PRT to address human response delays. However, we lack information about a sensitivity analysis for a feasible distribution of PRTs calibrated for a microscopic simulation like SUMO. Another aspect that we have not yet discussed is the interdependency between longitudinal and lateral traffic effects. Increased longitudinal dynamics resulting from ToCs could potentially lead to increased lateral maneuvering by following vehicles. Measuring diverging lane change rates may provide further insights into ToC-related safety effects.

4.4.3. Quantification

By evaluating safety effects based on SSMs as TTC or MDRAC, we find it hard to quantify the potential increase or decrease in traffic safety compared to other, more conclusive indicators such as, e.g., definite collisions. This is again due to the limited validity of such safety measures in simulations without calibration to real-world data. Even though our findings indicate safety-related effects of ToCs, we cannot say anything about the severity of these impacts without assessing the results further, e.g., with the help of an energy-based SSM as in the previously mentioned extended delta-V [39]. Another limiting aspect we want to mention might be that the selected SSMs do not account for possible speed dependencies. Their expressiveness might also depend on individual vehicle types (cf. MVs, AVs, HGVs, and LGVs), which we did not factor in.

4.4.4. Modeling

We previously discussed certain aspects of ACC parametrization in relation to evaluating ToC implications in Section 4.3. In a broader context, we do not consider the ACC model to be an ideal proxy for simulating Level 3 automated systems. This is because the ACC model was originally developed to emulate a Level 2 adaptive cruise controller. Level 3 systems are expected to exhibit different gap control and gap-closing behavior due to distinct safety criteria outlined in the SAE levels for automated driving (cf. OEDRs, Figure 1 and [5]). A driver model worth considering might be the fuzzy logic model called ’FSM’ that has been successfully proposed by [64] to be included to the current Regulation 157 for evaluating safety performance of the relevant critical scenarios. Regarding the parametrization of the ToC model, we acknowledge that the current model does not account for situationally variable lead times. Such variability could be attributed to a performant Level 3 system that can adjust its lead time based on current traffic conditions. Also, the distribution of human takeover times in Level 3 systems is an ongoing research topic, and our approach could be improved with better tailoring of the distribution form to suitable experimental data.

5. Conclusions

With consideration of an operational speed limitation up to 60 km/h as stated for today’s approved Level 3 automated driving systems, we conducted a comprehensive simulation study comprising three different use cases to investigate potential safety implications of ToCs. Each use case demonstrates fundamental mechanisms and effects of control transitions in traffic flow, with the premise being that ToCs are mandatory in those circumstances. In our simulations, distinct parametrizations regarding ToC and ACC modeling serve as proxies for various considerations of what we believe to be potentially influential factors in future Level 3 capabilities. This research aims to address safety-critical aspects of Level 3 automated driving, including control transitions with the help of SSMs (TTC and MDRAC) in a field with limited large-scale data from real-world testing due to negligible market penetration of Level 3 systems thus far. The results can be summarized as follows.

(1) The main use case presents traditional threshold-based SSM results that may indicate adverse safety effects of ToCs for high demands and increasing AV shares, but clear trends remain inconclusive since both metrics diverge across the parameter combinations of v/c ratio and traffic mix. Our proposed analysis based on histogram data provides more coherent trends for both SSMs that hint at potentially detrimental ToC impacts starting with AV shares of 20% and v/c ratios ≥ 70%.

(2) When considering advanced capabilities of Level 3 systems to perceive and predict the disintegration of continuous operation within an ODD under accelerating traffic conditions, we emulated these capabilities with an anticipatory ToC preparation phase that does not actively increase its gap distance to a preceding vehicle. Our results show that adverse safety effects completely dissipate under such a premise.

(3) Considering that nowadays deployed ACC controllers in automated driving systems might induce string instabilities in traffic flow for higher market penetrations rates, we reran simulations with a string unstable parametrization scheme for AVs. The results show significant spikes in TTC and MDRAC events for mixes ≥ Mix 1 and v/c ratios ≥ 40%, indicating negative safety impacts due to ToCs in heterogeneous traffic conditions.

(4) In Section 4.4, we address several limitations of our study. The primary limitations stem from the lack of validation due to limited real-world data and calibrated simulations, as well as potential shortcomings in vehicle and ToC modeling for Level 3 automation. These factors collectively reduce the generalizability of our findings.

Our study is mainly based on a simple, decentralized approach to address this particular occurrence of control transitions. Smarter solutions are possible and should be deployed. At least two come to mind: (i) the vehicle may issue a ToR when still within the ODD so that the ToC can take place just at the end of the ODD (if this is known in advance by the vehicle), or (ii) traffic management in combination with vehicle-to-infrastructure communication (V2I) can provide an optimal schedule for AVs to performs their ToCs at specific times and positions. Our previous study [34] considered some of those aspects, especially with the objective to maintain automated driving as long as possible. Clearly, such management considerations could also apply in terms of traffic safety, but these were not specifically addressed in this work.

Finally, it is essential to emphasize that the use case presented in this study focuses solely on limited Level 3 operations up to 60 km/h, which was motivated by system approvals in accordance with UNECE regulations from 2021. The safety implications addressed in our analysis pertain to mandatory control transitions in accelerating dynamic traffic conditions, thus amplifying adverse ToC effects in such heterogeneous mixed-autonomy traffic conditions. The duration for which these potential safety implications will persist and realistically materialize in real traffic with higher AV shares remains challenging to predict from our perspective. A certification of Level 3 systems up to 130 km/h will supposedly come in a few years ahead, as UN Regulation 157 has been amended in 2023 [7]. However, it should be acknowledged that the requirements for automation to reliably ensure a safe control transition at such high speeds are significantly more challenging to achieve. Previous simulation studies have already indicated potential safety risks on high-speed motorways. Nevertheless, we believe that further research is imperative to comprehensively assess the safety implications of control transitions in large-scale, mixed-autonomy traffic.