Safe Platooning in Automated Highway Systems Part I: Safety Regions Design

Transcription

1 Vehicle System Dynamics, , pp r99r $15.00 q Swets & Zeitlinger Safe Platooning in Automated Highway Systems Part I: Safety Regions Design LUIS ALVAREZ ) and ROBERTO HOROWITZ SUMMARY This paper addresses the problem of designing safe controllers for vehicle manuevering in Automated Highway Systems Ž AHS. in which traffic is organized into platoons of closely spaced vehicles. Conditions to achieve safe platooning under normal modes of operation are investigated. The notion of safety is related with the absence of collisions that exceed a given relative velocity threshold. State dependent safety regions for the platoons are designed in such a way that, whenever the state of a platoon is inside these safety regions, it is guaranteed that platoon maneuvering will be safe and follow the behavior prescribed by the finite state machines that control vehicles manuevers. It is shown that it is possible to design control laws that keep the state of the platoons inside these safety regions. The results obtained allow one to decouple the controllers for the regulation of the manuevers and the finite state machines that detere their proper sequence in AHS architectures. The overall complexity of the design and verification of the AHS as an hybrid system is therefore greatly reduced. 1. INTRODUCTION Automated Highway Systems Ž AHS. is a concept proposed to increase capacity and safety in current surface transportation systems wx 1. The increment in highway capacity in the AHS architecture presented in wx is achieved by organizing traffic into platoons of closely spaced vehicles. The tight spacing between vehicles within a platoon prevents intraplatoon collisions at high relative velocities, while the large gaps between platoons prevent interplatoon collisions. The relative motion between platoons during the join and split maneuvers, that allow to form and brake platoons, increases the risk of high relative velocity collisions and therefore compromises a safe operation. The architecture in wx abstracts the AHS in five hierarchical layers: network, link, coordination regulation and physical layer Ž see Fig. 1.. In the physical and regulation layers, the abstraction is a continuos time model of the closed loop controlled vehicle dynamics. In the coordination layer, the execution of maneuvers ) Instituto de Ingenierıa, UNAM, Apdo Postal 70-47, Coyoacan D.F., Mexico. alvar@pumas.iingen.unam.mx Department of Mechanical Engineering, University of California at Berkeley, Berkeley CA , USA. horowitz@me.berkeley.edu.

2 4 L. ALVAREZ AND R. HOROWITZ is modeled through finite state machines that incorporate the structured communication protocols between vehicles. The link layer uses a flow model to abstract macroscopic highway vehicular density and traffic flow. The network layer uses nonlinear system of differential equations to abstract the input-output traffic demands in a network of highways. For a more detailed description of the different abstractions the reader is advised to consult, for example, w3,4,5,6,7 x. Fig. 1. Hierarchical architecture of AVHS in the PATH program. This paper addresses one important control problem in the AHS hierarchical architecture of the California PATH program in wx : the design of safe controllers for the regulation layer maneuvers. The PATH AHS design in wx envisions fully automated lanes. A safe operation of these lanes is of primary concern. All the tasks that directly involve the control of the motion of vehicles are executed by the coordination and regulation layers. For this reason, when the safe operation of the PATH AHS hierarchical architecture has to be guaranteed it is necessary to study the interaction between these two layers. Originally, the coordination and regulation layer design and verification for safety were performed independently w3,8 x. The underlying assumption was that, once the performance of each layer was verified, the properties achieved would survive after interconnection. Early simulations in SmartPath wx 9 indicated that this was not the case. High speed collisions between platoons were reported in w10 x. As a consequence, safe operation could not be guaranteed. In an attempt to properly

3 SAFE PLATOONING IN AHS: SAFETY REGIONS 5 model the interaction between the coordination and regulation layers, the use of hybrid systems tools was proposed in w11,1,13 x. Two complementary approaches have been taken to guarantee a safe operation of the AHS architecture in wx 1. One approach is to design the regulation layer control laws in such a way that a safe operation of the AHS is guaranteed in the normal mode of operation w14,15 x. The other approach, in w16 x, is to extend the original set of normal mode maneuvers to handle degraded conditions of operation that could imply a safety risk. The design and implementation of the coordination layer finite state machines and the regulation layer control laws for these degraded modes of operation is in progress. This paper presents results that are based on the first approach mentioned above. As in w14,5,15 x, the notion of safety is related with the absence of collisions between platoons that exceed a given relative velocity threshold. The safety of platoons in an AHS under this notion is analyzed. The aim is to effectively allow the decoupling of the design and verification analysis of the regulation and coordination layers. Conditions to design regulation layer feedback based control laws are derived which guarantee that the state in the discrete event system that constitutes the coordination layer evolves according with design specifications. In essence, these conditions allow the control laws of the continuos dynamical system that constitute the regulation layer to be designed so as to make the discrete event system that constitutes the coordination layer verifiable and predictable. In this way, the safety of the hybrid system composed by the coordination and regulation layers can be guaranteed. As the behavior of a platoon is detered by the control law that is applied to its er, the results presented focus on the control laws that are applied to platoon ers. The safety analysis of the follower law, that applies to non-er vehicles in a platoon was carried out in w17,18 x. Relevant prior work is analyzed below. The controller designed in wx 8 relied on the use of noal open-loop trajectories that the platoon executing the control law attempted to track. Control laws were safe and comfortable for passengers under normal circumstances. However, when the platoon that is ahead of the one perforg the maneuver undergoes large accelerations or decelerations, comfort and safety can be compromised. If the acceleration capabilities of the platoon tracking the trajectory are lower than expected, the maneuvers may not complete at all. In w14,5x the design of feedback based control laws that allow a safe operation of the regulation layer in the normal mode of operation was presented. The controllers used a finite-state machine that switched among feedback laws, in order to keep the velocity of the platoon within a safety limit. The controllers also kept the jerk and acceleration within comfort boundaries, except when safety was not compromised. Completion of the maneuvers in this design did not depend on meeting a desired open-loop acceleration trajectory. The control laws even prevented low-speed collisions in all but the most extreme cases of platoon deceleration. If the platoon ahead applied and hold maximum braking, a collision could still occur, but the relative velocity at impact would be within a specified

4 6 L. ALVAREZ AND R. HOROWITZ acceptable limit. The control laws were designed under the assumptions that all platoons had the same acceleration capabilities and that the linearized platoon dynamics can be represented using a second order model with a pure delay. In w15x the safety of the regulation layer control laws designed in w14,5x was rigorously proved, under the same assumptions described above. A unified control strategy for the single lane control laws: er, merge, split and decelerate to change lane was presented. The controller design was realized in two stages. In the first stage, for each control law, a desired velocity profile for the platoon er was derived. This profile guarantees that high speed collisions will be avoided under single lane disturbances. Whenever safety is not compromised, the platoon will attempt to achieve a target velocity and separation from the platoon ahead in imum time and by using acceleration and jerk within comfort limits. In the second stage, a nonlinear velocity tracking controller was designed. This controller allows the platoon to track the desired velocity within a given error bound. As in w14 x, the cost of improved safety and comfort is in the increased time that a maneuver takes to be completed. The results obtained in w15x were independently confirmed in w19x under similar assumptions. In w0x the decoupling approach for the design of the regulation and coordination layers is presented in a more general setting for hybrid systems. A game-theoretic approach is used to formulate the problem of AHS safe operation. Controllers for the regulation layer are assumed to be derived from the optimal solution of a two players, zero sum game. However, in some of the maneuvers, such as the join or split, no explicit feedback controller design is presented that guarantees safety performance, when the parameters that detere the behavior of platoon ers during the maneuvers are fixed. These parameters include, for example, acceleration capabilities, braking delays, relative impact velocity threshold, etc. In this paper the results in w15x are extended. The case when two platoons involved in a maneuver have different braking capability is now considered. This situation was first discussed in w0 x, where some simulation examples showed that the difference in acceleration capability may require a different control strategy under extreme conditions. The results presented here show that, in order for the operation of AHS to be safe under all normal mode operating conditions, it is necessary to establish bounds on the parameters that detere the vehicle s behavior during the execution of the regulation layer maneuvers. The effect of these bounds is to rule out the cases reported in w0x in which safety can be compromised because of the platoons different braking capabilities. It is also shown that, if joins and splits are to be executed, it is not possible to guarantee the existence of feedback based solutions for the optimal control in w0x unless the maneuvers satisfy a set of safety related constraints presented in this report. Moreover, under these safety related constraints, the optimal safe strategy for the vehicles joining or splitting consists in applying full brakes when the vehicle ahead applies and holds maximum braking, as originally presented in w14,19,15 x. Collision propagation in the highway is analyzed. It is concluded that, with a similar approach to the one used for the join and split control laws, this collision

5 SAFE PLATOONING IN AHS: SAFETY REGIONS 7 propagation can be avoided by constraining the behavior of platoons executing the er control law. The results for safe platooning are also analyzed for the case when no collisions are to occur during the execution of AHS maneuvers. It is found that it is possible to avoid collisions when platoons are maneuvering if vehicles braking deceleration is controlled. The goal is to make the braking capability of any vehicle larger than the braking capability of the vehicle ahead in the same platoon. Interplatoon distance is designed so as to keep safety between platoons when this controlled braking is applied. Following the ideas of w17x and the results derived for the safety of the er law, expressions to constrain the braking capability of vehicles involved in a maneuver are presented. If the requirement of safe operation of AHS in normal mode of operation is to have meaning, it cannot be separated from the requirement of high performance that these systems are expected to deliver. An empty AHS is always safe. While the approach presented in w0x also addresses the problem of safe operation of AHS, the results presented do not allow to draw conclusions on the performance of the system. This occurs because of the hierarchical structure of cost functions that was adopted in w0 x. In this structure safety has, as expected, the top priority. Whenever safety is compromised, the other lower priority cost functions, normally related to system performance, are ignored. This situation, in which safety is the only cost function that is considered, can happen even in absence of disturbances. The procedure that is suggested in w0x to overcome this problem is to allow multiple interactions between the regulation and coordination layers. There is not, however, any indication of the implications of this interaction on the overall safety and performance. In the approach presented in this paper it is proposed to constrain the behavior of the PATH AHS regulation layer in the normal mode of operation in such a way that both the safety and performance requirements are considered simultaneously. In this framework, safety and performance are always guaranteed in the absence of single lane disturbances. Safety is always guaranteed, even in the presence of this kind of disturbances. This paper is divided in six sections. Section contains the safe platooning analysis when the relative motion of only two platoons in analyzed, while Section 3 extends the design for an arbitrary number of platoons. Section 5 derives the conditions under which join and split manuevers can be executed with no collisions. Section 6 applies these condition to establish bounds on the inter-platoon spacing. Finally, Section 7 contains the conclusions of the paper.. TWO PLATOONS AT A TIME.1. Safe control In this section conditions to guarantee the safety of two adjacent platoons in the same lane are derived. Results will be extended to the general case in the

6 8 L. ALVAREZ AND R. HOROWITZ following section. The notion of safety is similar to the one used in w14,15,0 x: the platoon perforg the control law will not collide with the platoon ahead at a relative velocity greater than a prescribed limit, Õ allow. Assumption 1 Safe control laws analysis is accomplished under the following assumptions: 1. Single lane maneuõers.. Bounded acceleration of Õehicles in the highway. 3. PositiÕe Õelocity of Õehicles, i.e. reõerse motions will neõer occur. 4. Maximum braking acceleration can be achieõed d seconds after a full braking command is issued. 5. Bounded maximum Õelocity of Õehicles in the highway. Fig.. Notation for two platoons on the highway. Consider two platoons traveling on the automated highway as shown in Fig., the platoon is moving behind the platoon in the same lane. Let x ) t be the position at time t of the platoon s back and x ) t be the position at time t of the platoon s front. Let x ) t, x ) t, x ) t and x ) t denote the first and second time derivatives of these positions at time t. x ) t and x ) t will also be denoted by Õ ) t and Õ ) t respectively. Let the accelerations of the platoon be wt ) and that of the platoon be ut. ) If an inputroutput linearization procedure is applied to a dynamic model of the vehicles, as in w17 x, the dynamics of the platoons motion become x Ž t. swž t., Ž 1. x Ž t. suž t., Ž. ) w x ) w where wt g ya, a and ut g ya, a x max max for all time t, a,a,a,a )0; wt ) and ut ) are such that x ) t and x ) max max t remain positive for all t.

7 SAFE PLATOONING IN AHS: SAFETY REGIONS 9 Define the relative distance between the platoons to be DxŽ t. sx Ž t. yx Ž t.. Ž 3. For the analysis of platoon collisions, the relevant dynamics are independent of the absolute positions, x or x. Hence, the dynamics of the relative motion between the and platoons is given by Dx Ž t. sx Ž t. yx Ž t., Ž 4. Dx Ž t. sx Ž t. yx Ž t. swž t. yuž t., Ž 5. Õ Ž t. swž t., Ž 6. where D xt ) and D xt ) denote the relative velocity and the relative acceleration between the platoons. Eq. Ž. 6 is necessary to account for the independence of wt ) and ut. ) ) Definition 1 Unsafe impact An unsafe impact is said to happen at time t if DxŽ t. F0 and ydx Ž t. GÕ, Ž 7. allow with ÕallowG 0 being the maximum allowable impact Õelocity. 3 The set X ;R denotes the set of all triples Ž Dx, Dx, Õ. such that Ž 7. M S is not satisfied, Dx)0 and 0FÕFÕ max, where Õmax is the maximum highway Õelocity for the platoon. Definition Safe control) A control law for the acceleration of the platoon, u) t, is said to be safe for an initial condition ŽDxŽ 0,. Dx Ž 0,. Õ Ž 0.. if the following is true: For any arbitrary platoon acceleration wž t.; tg0 such w that w t g ya, a x and 0FÕ Ž t. FÕ, Ž Dx t, ) Dx t, ) Õ t)) max max g X for all tg0. MS The notion of safety is therefore given by the condition that the platoon will not collide with the platoon at a relative speed greater than the prescribed ÕallowG0, regardless of the behavior of the platoon. The choice of Õallow depends on the particular maneuver, the braking capabilities of vehicles and the maximum velocity of vehicles in the highway. The selection of Õallow is also detered by the tradeoffs between the time the maneuver takes to complete and the risk of injuries. For example, for a join law Õallow is set to be a positive number for the maneuver to be completed in a finite reasonable time; whereas in a er law, Õallow is set to 0, since no impacts are expected to happen for platoons in this case.

8 30 L. ALVAREZ AND R. HOROWITZ.. Safety feasible region Define the regions and ½ R 1Ž Dx. s Ž Dx,Dx.: 0FyDxFy a qa max d q ÕallowyŽ a ya. Dxq Ž amax qa. d Ž 8. ½ 5 R Ž Dx,Õmax. s Ž Dx,Dx.: 0FyDxFy a max qa dyõmax q adxqa ÕmaxqÕallowqa amax qa d, Ž 9. with max MS 5 asa ra )0, Ž 10. and Ž Dx, Dx, Õ. g X. Fig. 3 shows some examples of these regions for different selections of a and a given value of Õ max. As will be shown subsequently, the role of these regions is crucial to detere the existence of safe control laws. To understand the rationale behind the definition of these regions, assume the platoon is traveling at maximum speed Õmax and suddenly it applies full braking. The platoon is also assumed to apply full braking after the delay d has passed. The lower boundary of R Ž Dx,Õ. max corresponds to the case in which the platoon is far enough from the platoon so that this maximum deceleration will stop the platoon before the platoon hits it at Õ. The lower boundary of R Ž Dx. allow 1 represents the case in which the platoon is still in motion and is hit by the platoon at Õ allow. Assume Ž Dx, Dx, Õ. F F F is the final state for a join or split maneuver. The following definition establishes a link between the this final state and the regions R Ž Dx. and R Ž Dx,Õ.. 1 max Definition 3 Safety feasible region) A safety feasibleregion is said to exist for a final state Ž Dx, Dx, Õ. if Õ FÕ, R Ž Dx. and R Ž Dx,Õ. F F max 1 max are F F connected and Ž Dx, Dx. g R Ž Dx. j R Ž Dx,Õ. F F 1 max The safety feasible region has some important properties that will be introduced in the following lemmas. This region is defined to constrain the behavior of platoons perforg single lane maneuvers. For the moment it is enough to say that, when a safety feasible region exists, the initial and final states for all the trajectories generated by all safe control laws are such that, when plotted in the phase plane Ž Dx, Dx., these states will necessarily be above the lower boundary of the safety feasible region, for any choice of velocity of the platoon. Lemma 1 Assume that R Ž D x. and R Ž D x,õ. are connected then R Ž D x. 1 max 1 and R Ž Dx,Õ. are also connected for all Õ FÕ. max

9 SAFE PLATOONING IN AHS: SAFETY REGIONS 31 Fig. 3. Regions R 1 D x, and R D x,õ max. Plots obtained with Õallows 3mrs, a s5 mrs, ds0.03 s, a s.5 mrs and Õ s3 mrs. a. a F1. b. a G1. max max

10 3 L. ALVAREZ AND R. HOROWITZ Proof: For af1 it suffices to show that R Ž Dx,Õ.;R Ž Dx,Õ. max. Take an arbitrary Dx. Let Dx Ž Dx,Õ. and DxŽ Dx,Õ. max denote the imum values of Dx that satisfy Eq. Ž. 9 for Õ and Õ, respectively, and a given Dx. Then max y Dx Ž Dx,Õ. ydx Ž Dx,Õ. max sõ yõ q c qa Õ y c qa Õ max 1 1 max y Dx Ž Dx,Õ. ydx Ž Dx,Õ. max GÕmaxyÕq c1 qõ y c1 qõ max )0, Ž. with c1 s a DxqÕallowqa amax qa d. Thus Dx Ž Dx,Õ.-Dx Ž Dx,Õ. R Ž Dx,Õ.;R Ž Dx,Õ.. max max For a)1 the result follows from the fact that the lower bounds of R Ž Dx. 1 and R Ž Dx, P. monotonically decrease with D x for any Õ. Remark: Lemma 1 assures that the existence of a safety feasible region is a property that depends on Õ. max Lemma Assume that Õ -Ž a q a. allow max d and a- 1, then there is no safety feasible region. Proof: First notice that a-1 Ža ya. )0. In this case there are two possibilities for the expression inside the square root in Eq. Ž. 8. If the argument is negative, R Ž D x. is not defined and therefore cannot be connected to R Ž D x,õ. 1 max. When the argument is positive Ž. amax qa d)õ allow) Õallowy a ya Dxq amax qa d, 1 1 max thus Dx is negative. Hence R Ž Dx. sø and therefore R Ž Dx. and R Ž Dx,Õ. cannot be connected. Remarks: 1. To perform a join maneuver, the velocity of the platoon has to be greater than that of the platoon. This allows the distance between platoons to decrease with time. Lemma states that if no collisions are allowed during a join maneuver ŽÕ s0-ža qa. d. allow max, then it is not possible to design a safe control law for the platoon with a safety feasible region, when a- 1, i.e., when the platoon has less braking capability than the platoon. This conclusion can be extended to the split maneuver, as disturbances from the platoon can make the distance between platoons to decrease instead of increasing, as it is normally the case in the split maneuver.. Assume that the platoon is perforg a join maneuver, i.e., the relative distance is decreasing, and that a-1. If no collision is to take place in a

11 SAFE PLATOONING IN AHS: SAFETY REGIONS 33 join, then during the approaching process the imum distance between platoons D x should satisfy Dx G Ž. max max a qa dqõ ya Õ ya a qa d a a-1. Ž 11. Lemma 3 Assume ag1 and Õ GŽa qa. allow max d, then there is always a safety feasible region. ; Proof: ag1 Ža ya. F0, therefore the argument in the square root of Eq. Ž. 8 is always positive. The choice of Õallow guarantees that yd x) 0. Hence R Ž D x. 1 always exists and its lower bound is monotonically decreasing with D x. From here it follows that R Ž D x. and R Ž D x,õ. are always connected. Lemma 4 GiÕen Õ max 1 max, if the Õalue of a is such that Ž a qa max. dyõallow a-a Ž Õ. s q1, max then there is not a safety feasibility region. Õ max Proof: The intersection of the lower boundaries of R Ž D x. and R Ž D x,õ. 1 max is given by the curve with R3Ž Õmax. s Ž ay1. Õmaxyc qõ allow. Ž 1. c s Ž a qamax. d. Set R Ž Õ. s0 and solve Eq. Ž 1. 3 max for a. This is the value of a. For any value of a- a the intersection of the lower boundaries of R 1 Ž D x. and R Ž Dx,Õ. occurs below the Dx axis; from here it follows that R Ž Õ. max 3 max -0 and R Ž Dx. sø and therefore R Ž Dx. and R Ž Dx,Õ. are not connected. Remarks: 1 1 max 1. If a - 1 then the imum distance during an approaching process is Dx s0.. Otherwise, if a G 1, this imum distance is c yõallowqõmax c d Dx s Ž c qõallow. y, tral a

12 34 L. ALVAREZ AND R. HOROWITZ.3. Safety theorem Assumption 1. For the giõen set of parameters and final state there exists a safety feasible region.. The relatiõe motion of the and platoons is giõen by Eqs. )) The full state is obserõable. The following theorem establishes a subset of XMS such that, when the given set of parameters and final state has a safety feasible region, a control law exists which is safe for any initial conditions ŽDxŽ 0,. Dx Ž 0,Õ. Ž 0.. that lies in this subset. It is necessary first to define the auxiliary curve SŽ Dx,Õ. smax R Ž Dx., R Ž Õ. Ž Theorem 1 Let X ;X ;R be the set of Ž Dx, Dx, Õ. safe MS g XMS that satisfy: where RŽ Dx,Õ. ; RŽ Dx,Õ. )SŽ Dx,Õ., ydx- Ž 14 ½. R Ž Dx.; R Ž Dx,Õ. FSŽ Dx,Õ., 1 ay1 R1Ž Dx. sycq Õallowq a Ž Dxqc d., a R Dx,Õ sycyõq adxqa ÕqÕallowqa c d, R3Ž Õ. s Ž ay1. Õmaxyc qõ allow, SŽ Dx,Õ. smax R Ž Dx., R Ž Õ., 1 3 c s Ž amax qa. d. Under assumptions 1 and, there exists a control law that is safe for any initial condition ŽDxŽ 0,Dx. Ž 0,Õ. Ž 0.. g X safe, in the sense of Definition. MoreoÕer, any control law that applies maximum braking wheneõer Ž D x) t, Dx ) t, Õ ). t f X is safe for any initial condition ŽDxŽ 0,Dx. Ž 0,Õ. Ž 0.. safe g X. Under such control law, Ž Dx) t, Dx) t, Õ ). safe t g X bound ; X MS ; R 3. The elements of X satisfy bound BŽ Dx,Õ. ; BŽ Dx,Õ. )T Ž Dx,Õ., ydx- Ž 15 ½. B Ž Dx.; B Ž Dx,Õ. FT Ž Dx,Õ., 1

13 SAFE PLATOONING IN AHS: SAFETY REGIONS 35 where ay1 B1Ž Dx. s Õallowq adx s Õallowy Ž a ya. Dx, a B Dx,Õ syõq adxqa ÕqÕ allow, B3Ž Õ. s Ž ay1. ÕmaxqÕ allow, T Ž Dx,Õ. smax B Ž Dx., B Ž Õ Notice that X safe ; X bound ; X MS. The relations between X MS, Xsafe and Xbound are illustrated in Fig. 4, when Õ is constant. Fig. 4. Relationships between X, X and X. Notice that the vertical axis is - relative MS bound safe velocity, i.e. yd x. Proof: Consider a control law that would apply maximum braking whenever ŽD x,. Dx, Õ f X safe. By assumption, the platoon will decelerate, at ya, d seconds after the maximum braking is applied. If maximum braking is applied at time t, the acceleration of the platoon at time tgwt,tqdx can take values in w ya, a x max. Suppose that ŽDxŽ 0,Dx. Ž 0,Õ. Ž 0.. g X safe, It will be shown that under the proposed control law, ŽDxŽ t,. Dx Ž t,. Õ Ž t.. g Xbound for all tg0. Firstly, notice that since X g X, this is true if ŽDxŽ t,. DxŽ t,. Õ Ž t.. safe bound g Xsafe for all t G 0. Because ŽD xž t,. Dx Ž t., Õ Ž t.. is continuous in t, if ŽD xž t,. DxŽ t,. Õ Ž t.. f X for some time t)0, then there exists T, tgt )0 safe 1 1

14 36 L. ALVAREZ AND R. HOROWITZ when ŽDxŽ T., DxŽ T., Õ Ž T.. lies on the boundary of X. For tgw safe T 1, T qd x, 1 H t Õ Ž t. s wž s. ds q Õ Ž T., 1 T 1 H t Õ Ž t. s už s. ds q Õ Ž T., 1 T 1 t t t t HH HH T T T T DxŽ t. s wž s. ds dty už s. ds dtqdxž T.Ž tyt. qdxž T Consider the following function that is the separation of D x from the velocity boundary of X bound where b Ž Dx,Dx,Õ. 1 g Dx,Õ,Õ sdxyb Dx,Dx,Õ, 1 Õy adxqa ÕqÕ allow ; BŽ Dx,Õ. )T Ž Õ., y Õ y a ya allow Ž. Dx ; B Ž Dx,Õ. FT Ž Õ.. s~ is the relative velocity boundary of the set X bound. Hence, for DxG0, the triple Ž Dx, Dx, Õ. g X if and only if gž Dx, Õ, Õ. bound G0 and DxG 0. The time derivative of gž Dx, Õ, Õ. is E g Ž Dx,Õ,Õ. E g Ž Dx,Õ,Õ. g Ž Dx,Õ,Õ. s Dxq Õ EDx E Õ E g Ž Dx,Õ,Õ. q E Õ E g Ž Dx,Õ,Õ. s Dẋ EDx E g Ž Dx,Õ,Õ. q E Õ Õ wž t. E g Ž Dx,Õ,Õ. q už t., Ž 16. E Õ

15 SAFE PLATOONING IN AHS: SAFETY REGIONS 37 Ž. Ž. after substitution of 1 and. Notice that E g Ž Dx,Õ,Õ. E Õ E g Ž Dx,Õ,Õ. E Õ G0, Ž 17. F0. Ž 18. From the existence of a safety feasible region it follows that Dx,Dx,Õ gx yx DxF0. Ž 19. bound safe ) w From relationships 17 y 19 into 16 and since wt gya, a x max and ) w ut g ya, a x, for any t g wt, T qdx max 1 1 it follows that E g Ž Dx,Õ,Õ. g Ž D xž t.,õž t.,õž t.. 4s ½ D x wž. t,už. t EDx.5 E g Ž Dx,Õ,Õ. E g Ž Dx,Õ,Õ. q w Ž t. q u Ž t E Õ E Õ E g Ž Dx,Õ,Õ. E g Ž Dx,Õ,Õ. s Dxy a EDx E Õ q E g Ž Dx,Õ,Õ. a max E Õ Notice that the combination of Ž 17. -Ž 19. implies uniqueness in the choice of wt ) and ut. ) Define for t g wt, T qd x, 1 1 Õ t sõ T1 y tyt1 a, Õ t sõ T1 q tyt1 a max, Ž tyt1. DxŽ t. sy Ž a qamax. qdx Ž T1.Ž tyt1. qdxž T 1.. Thus, for t g wt, T q d x, 1 1 Ž. Ž. Ž. g DxŽ t.,õ Ž t.,õ Ž t. Gg DxŽ t.,õ Ž t.,õ Ž t. Gg Dx d,õ d,õ d. It will be shown that gsgž DxŽ Tqd., Õ Ž T q d., Õ Ž T qd G0. At tst, since ŽDxŽ T., Dx Ž T., Õ Ž T.. is on E X, then either safe Õ T1 sycq adx T1 qa Õ T1 qõallowqa c d, 0

16 38 L. ALVAREZ AND R. HOROWITZ or Ž. Õ T1 sõ T1 ycq Õallowy a ya Dx T1 qc d. 1 Suppose Ž 0. is true, then the bound gsgždxž Tqd., Õ Ž T qd.,v Ž 1 1 T1 q d.. is given by: Ž 1. Ž 1. Ž 1. Ž 1. Ž 1. allow g s Õ T y Õ T yc y Õ T q a d q a Dx Tq d q a Õ T q d q Õ Ž 1. Ž 1. allow g sy a Dx T q a Õ T q Õ q a c d Ž 1. Ž 1. allow q a dq a Dx Tq d q a Õ T q d q Õ Ž 1. Ž 1. allow d Ž 1. Ž 1. Ž Ž 1.. allow g sy a Dx T q a Õ T q Õ q a c dq a d ž / q y a c y Dx T dy Dx T q a Õ T y a d q Õ Ž 1. Ž 1. allow g sy a Dx T q a Õ T q Õ q a c dq a d y Ž a Dx Ž T 1. q a Õ Ž T 1. q Õ allow q a c dy a d. s0. If, on the other hand 1 is true, then defining Ž. c3 t s Õallowy a ya Dx t q amax qa d, gsõ T1 yõ T1 ycq Õallowy a ya Dx T1qd gsõž T1. yõž T1. qcyc3ž T1. yc ž / d qallow Õ yž a ya. yc qc dyc3ž T1. dqdxž T1. Ž. gsy a ya dyc3ž T1. q c3ž T1. q a ya d s0. w x Thus, if either 0 or 1 is true, then for any t g T, T qd, 1 1 g DxŽ t.,õ Ž t.,õ Ž t. GgG0. ) 1 For tgt qd, full braking is achieved i.e., utsya. It is now shown that if gžždxž Tqd., Õ Ž T qd., Õ Ž T qd F0, then gždxž t,. Õ Ž t., Õ Ž t.. F0 for all tgt qd. From relationships Ž 17. and 1

17 SAFE PLATOONING IN AHS: SAFETY REGIONS 39 Ž 19., gždxž t,. Õ Ž t., Õ Ž t.. is imized if Õ ) t is imized. This is ) achieved if wtsya for t g w T qd, `. or until Õ Ž t. 1 s0. Under this worst case scenario, for the first choice in the argument of gždxž t,. Õ Ž t., Õ Ž t.. g DxŽ t.,õ Ž t.,õ Ž t. sdxž T qd. yõ Ž T qd. qa Ž tyt yd q a DxŽ t. qa Õ Ž t. qõ allow sdx Ž T1 qd. yõž T1qd. qa Ž tyt1yd. ) adx T1qd q adx T1qd tyt1yd qa Õ T1 qd q y a ÕŽ T1qd.Ž tyt1yd. q a Ž tyt1 yd. qõallow sdx Ž T1 qd. yõž T1qd. qa Ž tyt1yd. ) a DxŽ T1 qd. qa ÕŽ T1 qd. qõallow q y a Õ Ž T qd.ž tyt yd. q a Ž tyt yd W h e n Ž D x, D x, Õ. f X b o u n d, Õ t r a i l G adx T1 qd qa Õ T1 qd qõallow sc 4, then g DxŽ t.,õ Ž t.,õ Ž t. FDxŽ T qd. yõ Ž T qd. qa Ž tyt yd Ž 1. Ž 1. q c y a c tyt yd q a tyt yd sdx Ž T1 qd. yõž T1 qd. qa Ž tyt1 yd. Ž. q c4 ya tyt1 yd sdx Ž T1 qd. yõž T1qd. qc4sgž T1qd. F0. or, for the second choice in the argument of gždž t., Õ Ž t., Õ Ž t.. g DxŽ t.,õž t.,õž t. sdxž T1 qd. y a ya Ž tyt1 yd. q ÕallowyŽ a ya. DxŽ tyt1 yd. ) sdx Ž T1 qd. y Ž a ya. Ž tyt1 yd. ž 1 ÕallowyŽ a ya. DxŽ T1 qd. y Ž a ya. q Ž tyt yd. qdxž T qd.ž tyt yd /

18 40 L. ALVAREZ AND R. HOROWITZ When Ž Dx, Dx, Õ. f Xbound it follows that Hence ydx T1 qd G Õallowy a ya Dx T1qd sc 5. g DxŽ t.,õ Ž t.,õ Ž t. FDxŽ T qd. y a ya Ž tyt yd. 1 1 Ž q c q a ya Ž tyt yd. sdxž T qd. qc sgž T qd. F0. Remarks: 1. Theorem 1 will be used to guarantee that a control law for a maneuver is safe. In the control laws that are proposed in this paper, whenever ŽDxŽ t,. Dx Ž t,. Õ Ž t.. f X safe, maximum braking is applied. Hence, by Theorem 1, if ŽDxŽ 0,. Dx Ž 0,Õ. Ž 0.. g X safe, the safe control laws maintain the relationship, ŽDxŽ t., Dx Ž t., Õ Ž t.. g X bound ; XMS for all tg0. Thus, an unsafe impact will not occur.. The fact that the final state Ž Dx, Dx, Õ. F F is required to be inside X F safe for all maneuvers guarantees that, as long as the trajectory generated by a safe control law remains inside X safe, it will not be necessary to apply full brakes in the absence of disturbances, i.e., full braking of the platoon. 3. Notice that when the delay ds0, i.e. maximum braking can be achieved instantaneously, the sets Xsafe and Xbound are the same. Thus, when d s 0, X bound, the closure of Xbound is invariant if the control law consists of applying maximum braking whenever Ž D x, D x, Õ. lies outside X. bound Since X bound ; X MS, an unsafe impact will not occur. However, since maximum braking cannot be achieved until after a delay of d seconds, the condition to apply maximum braking is more stringent Ž outside X. safe. Indeed, the relationship between the boundaries E Xsafe and E Xbound of Xsafe and X, respectively, is such that if maximum braking is applied at time bound safe t when ŽDxŽ t,. DxŽ t,. Õ Ž t.. g E X, and for tg w0, d x, the worst case scenario which is w t sya and u t s amax takes place, then ŽDxŽ tqd., DxŽ tqd., Õ Ž tqd.. g E X. bound.4. Lack of a safety feasible region The existence of a safety feasible region on assumption rules out the cases reported in w0,1x in which the platoon is assumed to have more acceleration or deceleration capability than the platoon. The existence of a safety feasible region guarantees that the sign of Dx in E Xsafe is always negative. The solution to the imization of gždxž t,. Dx Ž t,. Õ Ž t.. is then unique. To discuss in more detail the implication of the lack of a safety feasible region, consider the example discussed on page 9 of w1x in which a split maneuver is attempted. Fig. 5 shows the regions R Ž D x. and R Ž D x,õ. that corresponds to 1

19 SAFE PLATOONING IN AHS: SAFETY REGIONS 41 the given parameters: a maxsa max s3 mrs, a s8 mrs, a s5 mrs, Ž. Õ s3 mrs Dxs0.01 m, Dxs3 mrs, a 0 s3 mrs, a Ž. 0 s mrs. A jerk of "r- 15 mrs 3 is used as control. It can be noticed that the regions R Ž Dx. and R Ž Dx, Õ. are not connected. 1 Fig. 5. Effect of the lack of a safety feasible region. To illustrate the situation depicted in this example, define the extended region R Ž Dx. 1 E. This region is obtained by considering the symmetry of the original R 1 Ž Dx. region about the the Dx axis. The initial position of the platoon at the beginning of the maneuver, marked as P in Fig. 5, is inside R Ž Dx. 1 E. If the state of the platoon can be kept inside this region, no collision above Õ allow will occur with the platoon. Two remarks are necessary: 1. Notice that if the platoon is to complete the split maneuver, the trajectory of the split will have to eventually leave the region R Ž Dx. 1 E. Once this happens, if the platoon applies and holds full brakes an unsafe impact will occur. Therefore, it is not possible to safely perform the split maneuver under this kind of disturbance.. In the absence of a safety feasible region, there are multiple possibilities for the platoon to leave the region R Ž Dx. 1 E. One possibility corresponds to the case reported in the example under analysis, in which the platoon

20 4 L. ALVAREZ AND R. HOROWITZ initially applies full acceleration. This acceleration increases the relative velocity Dx and drives the point P out of the region R Ž Dx. 1 E. A similar situation would happen if the platoon applies initially full brakes. The only way in which the platoon can remain inside R Ž Dx. 1 E is to keep a short separation from the platoon. In the example considered, the car initially applies full acceleration. Even when the platoon applies full positive jerk to try to remain inside R Ž Dx. 1 E, the given parameters are such that there is no possibility for the platoon to catch up with the platoon and to avoid being driven out of R Ž Dx. 1 E. Once this happens, if the car applies and hold full brakes an unsafe impact will occur. This is exactly the situation in the example of w1 x. In wx a similar safety theorem is derived for the case in which the relative motion of platoons is described by a third order model. 3. AN ARBITRARY NUMBER OF PLATOONS AT A TIME Collisions in a highway produce instantaneous changes in the velocity of the vehicles involved in them. If, for example, the interplatoon distance in the highway is too small, these changes in velocity can, in turn, produce other collisions. If collisions in an AHS can be confined to the two platoons involved in a join or split maneuver, then the overall safety of the AHS can be guaranteed. In this section, conditions on the state of platoons executing the er law that avoid the propagation of impacts are derived. Consider a one lane highway in which platoons are distributed as is shown in Fig. 6. Assume that platoon a1 is colliding with platoon a and that, at the same time, platoon number a4 is also colliding with platoon a3. An important design problem is to set the state of the er law of platoon a3 in such a way that these two collisions do not cause a collision between platoons a and a3. The following theorem establishes a new region X er; X safe, such that when the initial state of a platoon executing the er law belongs to this region, no impact propagation occurs in the highway. Fig. 6. Distribution of platoons in a highway. Assumption 3 Platoons organization in an AHS satisfies: 1. No front impacts are allowed for Õehicles executing the er control law.. Vehicles executing the join or split control laws are allowed to haõe collisions equal or below Õ. allow

21 SAFE PLATOONING IN AHS: SAFETY REGIONS No adjacent platoons can simultaneously perform a join or split maneuõer. 4. Collisions at relatiõely low speed behaõe like perfect elastic impacts [ 3,0] 5. The braking capability of the Õehicles inõolõed in a low relatiõe Õelocity impact is preserõed after the impact. 6. The masses of Õehicles inõolõed in a collision are equal. 3 Theorem Let X ; R be the set of Ž Dx, Dx, Õ. that satisfy: er ydx- yž amax qa. dyõyõallow allow max q a Dxqa Õ yõ qa a qa d, and 0FÕFÕ max. Under assumptions 1-3, i. There exists a er control law that is safe for any initial condition Dx 0, ) Dx ) 0,Õ Ž 0.. g X er, in the sense of Definition. ii. There is no impact propagation on the highway, in the sense that no front collisions occur in platoons perforg the er control law. Safe front collisions on the highway occur only between platoons perforg the join and split control laws and their respectiõe platoons. MoreoÕer, any control law that applies maximum braking wheneõer ŽD xt, D xt, Õ Ž t.. f X is safe for any initial condition Ž D x0, ) D x0, ) er Õ 0)) g X. Under such control law, Ž Dx t, ) Dx t,õ ) t)) er g X bound1; R 3. The elements of X satisfy with 0FÕFÕ max. bound 1 ydx- yõq adxqa Õ, Proof: Take an arbitrary platoon on the highway whose er is executing a er law. Several cases of collisions have to be considered. Case a: Consider first the case in which, at time ts0 there are two collisions. The platoon collides with the platoon in front of it at a relative speed of Õ allow and the platoon also collides with the platoon behind it at a relative speed of Õ allow. If ts0 y and ts0 q respectively, denote the times just before and after the collisions, the discontinuities in the velocities can be expressed as: ÕŽ 0 q. sõž 0 y. yõ allow, Ž. ÕŽ 0 q. sõž 0 y. qõ allow. Ž 3.

22 44 L. ALVAREZ AND R. HOROWITZ If ŽDxŽ0 y., Dx Ž0 y., Õ Ž0 y.. g Xer then ydxž 0 y.- y a qa dyõ Ž 0 y. yõ max allow y allow max q a Dxqa Õ 0 yõ qa a qa d. Ž 4. From Eqs. and 3 in inequality 4 it follows than ydxž 0 q.- y a qa dyõ Ž 0 q. max q a Dxqa Õ Ž 0. qa a qa d. Ž 5. q max Define, at ts0 -, the auxiliary set X > X whose elements satisfy bound er y y y ydx Ž 0.- yõž 0. yõallowq a Dxqa ÕŽ 0. yõ allow. Using again Eqs. and 3 in inequality 6 Ž 6. q q q ydx 0 - yõ 0 q a Dxqa Õ 0. 7 From inequalities 5 and 7 it follows that and Ž DxŽ 0 y.,dx Ž 0 y.,õ Ž 0 y.. ge X Ž DxŽ 0 q.,dx Ž 0 q.,õ Ž 0 q.. er ge X safe Ž DxŽ 0 y.,dx Ž 0 y.,õ Ž 0 y.. gx Ž DxŽ 0 q.,dx Ž 0 q.,õ Ž 0 q.. bound gx. bound 1 The safety of the er law follows from theorem 1 with Õ s0. allow Case b: Consider now the case in which the platoon collides with the platoon in front of it at time ts0 with a relative speed of Õ allow. The discontinuities in the velocities can be expressed as: ÕŽ 0 q. sõž 0 y. yõ allow, Ž 8. Õ Ž 0 q. sõ Ž 0 y.. Ž 9. From Eqs. 8 and 9 in Eq. 4 it follows that ydxž 0 q.- y a qa dyõ Ž 0 q. yõ max allow q a Dxqa Õ Ž 0. qa a qa d. Ž 30. q

23 SAFE PLATOONING IN AHS: SAFETY REGIONS 45 er It should be noticed that ŽDxŽ0 q., DxŽ0 q., Õ Ž0 q. f X and therefore at ts0 q full brakes are applied. Two possibilities are analyzed. The first one corresponds with no collision happening between the platoon executing the er law and the platoon at the back after full brakes are applied. Substituting Eqs. Ž 8. and Ž 9. in inequality Ž 6. and using similar arguments as in theorem 1, it can be concluded that for q tg0 qd the state Ž Dx, Dx, Õ. g X whose elements satisfy bound 3 q ydx- yõyõallowq a Dxqa Õ ; ;tg0 qd. 31 It is clear that X bound ; Xbound and therefore the safety of the er law 3 1 follows from theorem 1. The second possibility is that at some time tst1 Gd)0 the platoon at the back collides with the platoon at relative speed of Õallow while applying full brakes. Then if T1 - and T1 q denote the time just before and after this second collision, respectively, the discontinuities in velocities are given by Ž 1. Ž 1. Õ T q sõ T y, Ž 3. Õ T q sõ T y qõ. Ž allow From Eqs. 3 and 33 in inequality 31 it follows than q q q ydx T1 - yõ T1 q adxqa Õ T From inequality Ž 34. it follows that Ž DxŽ T1 y.,dx Ž T1 y.,õž T1 y.. gx bound3 Ž DxŽ T1 q.,dx Ž T1 q.,õž T1 q.. gx bound. The safety of the er law follows again from theorem 1 with Õallows0. The other case in which the platoon does not collide, the argument is straightforward. It can be concluded that ŽDxŽ0 q., Dx Ž0 q., Õ Ž0 q.. g Xer ; X and ŽDxŽ0 q., DxŽ0 q., Õ Ž0 q.. safe g X bound ; X bound. 1 From assumption 3 and considering that the selection of the platoon executing the er law is arbitrary, it follows that no platoon executing the er law can have a collision with the platoon in from of it, provided ŽD xž0 y., D x Ž0 y., Õ Ž0 y.. g X, and therefore no impact propagation occurs. Remarks: er 1. The structure of the region Xer in theorem is different from the one presented in w0x in which the safety regions for the er law would be obtained by a translation in the direction of the relative distance axis, Dx, of the safety region Xsafe in theorem 1. The translation of the safety region Xsafe in theorem 1 along the Dx axis produces a region equal to the region Xer only for the case in which the accelration capabilities of vehicles are the same.

24 46 L. ALVAREZ AND R. HOROWITZ. The region X in theorem is a conservative estimate when the two er possible neighbor platoons are also executing the er law. It is possible to derive another region for these other cases X > X, X > er er er 1 Xer and X er > Xer under the assumptions of one collision in 3 front in the case in which the platoon in front is involved in a jointrsplit, on collision at the back, in the case when the rear platoon is attempting a joinrsplit, or zero collisions when both the front and rear platoons are not attemping joinsrsplits. However, the implication of having three different safe regions for platoons executing the er law will be that before any join can be attemped by the neighbor platoons, the platoon would have to increase its relative distance with the previous platoon in order to prevent collisions. This increment of relative distance could be propagated downstream producing a generalized decrement in the velocity of the platoons, when spacing is tight. The case considered in theorem guarantees that this propagation will not happen and therefore a steadier behavior of platoons velocity in the highway can be achieved. 3. It is possible to think of extending the results in theorem to the case in which the masses of the vehicles involved in a collision are not equal. If f is the maximum ratio of the masses of any two vehicles in a given lane, then the region X er has to be modified to ydx- yž a max qa. dyõyf Õallow allow max q a Dxqa Õ yf Õ qa a qa d, and 0FÕFÕ max. The notion of safety, however, has also to be modified because the difference in the mass of vehicles can produce a velocity increase after a collision. Õallow would have to be lowered to prevent for such increases. A more careful analysis of this case is still needed. 4. JOIN AND SPLIT WITH NO COLLISIONS In the previous two sections, conditions for safe platooning in AHS were established. The state of the relative motion of platoons is Ž Dx, Dx, Õ. and the set of parameters is arbitrary. It is concluded that the join and split maneuvers implied risk of low speed collisions, when the ratio of braking capabilities satisfies a as -1. a Ž max On the other hand, according to Lemma 3, when a G 1 and ÕallowG a qa. d, there is always a safety feasibility region for Theorem 1. This result

25 SAFE PLATOONING IN AHS: SAFETY REGIONS 47 can be refined to establish a bound on the value ofa such that the value of Õ allow can be decreased to zero. The following lemma defines a value a m )1 such that whenever agam joins and splits can be completed with no collisions, i.e., with Õallows0. Lemma 5: If the final state for a joinrsplit maneuõer is giõen by ŽDx F, Dx F, Õ. g X with Õ FÕ, Õ s0 and a satisfies F safe F max allow a Ž Dx Fq Ž a qamax. d. Ž. Ž. aga s a Dx q a qa d y a qa dydẋ m F max max F then there is always a safety feasibility region. )1, Ž 35. Proof: Eq. Ž 35. follows directly from the intersection of the curve R Ž D x. 1 with the point Dx,Dx when Õ s0. F F allow In this section, conditions to perform maneuvers with no collisions are investigated. The problem is to establish additional assumptions under which it can be guaranteed that a satisfies Ž 35.. This problem is related to the problem of intraplatoon behavior that was studied extensively in w17 x, where the string stability for different follower control laws was analyzed 1. There are two concluw17x of relevance for the problem of join and split maneuvers without sions in collisions. 1. To guarantee robust string stability performance it is necessary to broadcast the vehicle acceleration and velocity to all the vehicles that conform a platoon. When vehicle relative position information is also broadcasted, performance is enhanced.. Given an acceleration profile for the er of a platoon, the magnitude of the acceleration increases with the distance to the er of the platoon, although the rate of increment decreases with the same distance. Two approaches are presented that allow join and split maneuvers with no collisions. For the first approach it is considered that the measurements available to the platoon are the same as those in Assumption and that the acceleration in a platoon propagates according to the results reported in w17 x. In the second approach it is considered that during the join and split maneuvers the acceleration of the er of the platoon can be broadcasted to all the vehicles in the platoon. If this is the case, then the results on robust string stability performance that can be obtained with the use of this acceleration can be applied to the and platoon simultaneously. For the first approach consider the following additional assumption. 1 Roughly speaking, by string stability it is meant that the tracking errors within a platoon are bounded and are not amplified.

26 48 L. ALVAREZ AND R. HOROWITZ Assumption 4 1. There exists a finite ratio mg1 such that if a er is the magnitude of the imum acceleration of the er of a platoon, then the magnitude of the imum acceleration of the last Õehicle in the platoon, a, last satisfies a last Fma er. Ž 36.. The magnitude of the maximum deceleration for all the Õehicles in the highway has an oõerall maximum A. MIN Lemma 6: If the magnitude of the maximum deceleration of the er of the platoon in a join or split maneuõer satisfies A er MIN a F, 37 ma m then, under assumption 4, it is possible to perform the join and split maneuõers without collisions. Proof: Apply 36 to the platoon, then 37 becomes a AMIN A er MIN Fa F a F. Ž 38. m ma ma Applying now Ž 36. to the platoon it follows that, if AMIN is the magnitude of the maximum deceleration of the last vehicle of the platoon, then From 39 in 38 Hence m A Fma. Ž 39. MIN AMIN a a F F. Ž 40. ma a a m m saga. Ž 41. a m m The lemma follows directly from Lemma 5 and Theorem 1. Remark: Lemma 6 sets the imum acceleration for the er of the platoon involved in a joinrsplit in such a way that whenever the maneuver is executed, the last vehicle in the platoon is able to accommodate for the braking requirements in terms of string stability and safety of the maneuver. The second approach considers the following additional assumption regarding the acceleration of the er of the platoon.

27 SAFE PLATOONING IN AHS: SAFETY REGIONS 49 Assumption 5 1. The acceleration and Õelocity of the er of the platoon inõolõed in a join or split maneuõer is broadcasted to all Õehicles in the platoon.. The number of Õehicles, N of the platoon is broadcasted to all vehicles in the platoon. 3. GiÕen the position of a Õehicle inside a platoon, n, there is a positiõe non-decreasing function, r) n, such that the magnitude of the maximum deceleration of the n-th Õehicle in the platoon, a n satisfies a n Fr Ž n. a er, Ž 4. where a er is the magnitude of the maximum deceleration of the er of the platoon. Lemma 7: If a satisfies a Gam rž N. a er Ž 43. and the magnitude of the maximum deceleration of the er of the platoon in a join or split maneuõer satisfies A er MIN a F, 44 ma m then, under assumptions 4 and 5, it is possible to perform the join or split maneuõers without collisions. Proof: If a satisfies Ž 43. then, from assumption Ž 5., Lemma 5 and Theorem 1, it can be concluded that the join or split maneuvers can be performed without collisions. Eq. Ž 44. and assumption 5 guarantee that the maximum deceleration for the er of the platoon is set in such a way that the last vehicle in the platoon will decelerate within its maximum deceleration capabilities. Remark: Lemma 7 states that if the velocity and acceleration of the er of the platoon are known to all vehicles of the platoons involved in a join or split maneuver, then all the vehicles perforg the follower law in the platoon will use this information in their followers law. String stability for the and platoons combined follows from the results in w17 x. 5. PLATOONING WITH NO COLLISIONS This section presents the calculations to detere a steady state headway that must be kept by a platoon er executing the er law, when no collision are desired in the AHS. The intention of these calculations is to illustrate the use of the safety results contained in this chapter in other safety and capacity analysis tools. This headway, or interplatoon distance, is an important factor in detering the AHS capacity, when vehicles are traveling organized in platoons w4 x.