ACC design for safety and fuel efficiency: the acceptance of safety margins when adopting different driving styles

For adaptive cruise control (ACC) systems to be accepted and used safely, the transitions from cruise control mode to necessary driver intervention need to be obvious to the driver. Previous research shows that drivers have natural boundaries for acceptable values for time headway and time to collision to a car in front, which define at what point they are likely to step on the brake pedal. These boundaries can define an intuitive limit for ACC engagement. However, such boundaries may not be the same for all drivers, and not even for the same driver, whose goals may vary. The present research aimed to measure mental model boundaries in the context of different goals with a motorway cut-in scenario in a driving simulator. Participants drove in three conditions, after being asked to ‘drive safely, ‘drive fuel-efficiently’ and after no specific instructions. The results show that both the safe and eco-driving instructions led drivers to brake at longer safety margins. These findings indicate that, as drivers follow different goals, e.g. as they are reminded to drive safely or eco-friendly, their preferences for operational limits of ACCs may change. This needs to be taken into account for design decisions, e.g. using ‘safe’ and ‘eco’ modes when driving.


Introduction
An ever-increasing number of vehicles is equipped with functions automating a part of or the entire driving task. Longitudinal safety systems include lower level automation such as forward collision warning (FCW) and adaptive cruise control (ACC). For FCW and ACC systems to be accepted and used safely, the point of the warning, and transitions from cruise control mode to manual driving, respectively, need to be obvious to the driver, so they are able to intervene effectively. For instance, many ACC systems do not perform emergency braking, but drivers tend to rely on such functionality and thus may fail to brake in critical situations (Itoh 2012;Park et al. 2006). When the car also takes over the latitudinal control, drivers may forego their attentive duties and perform non-driving-related tasks such as turning around to passengers and drinking coffee (Banks et al. 2018). In the case of full automation, similar considerations apply, as drivers benefit from understanding the intentions and actions of the vehicle. Hence, it is important to design interfaces such as displays that inform the driver of the state and intentions of the vehicle (Seppelt and Lee 2007). One design philosophy is to adjust the automation limits according to natural boundaries between mental models (Goodrich and Boer 2003). This may not only help drivers understand the vehicle's behaviour, but also increase comfort, acceptance and trust (Beggiato and Krems 2013). For example, driving simulator studies using platoons have shown that, when automation maintains headways that are too low, they can be perceived as uncomfortable (Levitan and Bloomfield 1998). Conversely, if drivers are exposed to low safety margins for several minutes, they may display lower headways themselves after resuming manual driving (Brandenburg and Skottke 2014;Skottke et al. 2014), which can pose a safety risk.
1 3 Michon (1985) divided the driving task into strategic, tactical and operational levels. Humans consciously make decisions at the strategic level, such as choosing their route, and automatically control the operational level to manipulate the accelerator pedal or steering wheel, for example. At the tactical level, decisions need to correspond with the choices at the strategic level, and then appropriate mental models at the operational level are activated. According to the satisficing decision theory (SDT, Goodrich et al. 1998b), such choices at the tactical level are based on a simple heuristic. In SDT, an action is undertaken when it is satisficing, which means 'good enough'. For example, the mental model for car-following (pressing and releasing the accelerator pedal to maintain a constant headway) may be satisficing, or acceptable, as long as the distance to the front car is sufficiently large. When the distance lowers below a certain threshold, nominal car-following may become unacceptable and the driver decides to step on the brake pedal instead. SDT assumes that humans usually do not make optimal decisions, because making an optimal choice at the tactical level may be impossible or require too many resources and, therefore, too much effort. Instead, they search through the alternatives available to them and settle for the first one that meets a certain set of criteria, or is within a boundary. Previous research (Goodrich and Boer 2003) shows that drivers have natural boundaries for acceptable safety margins to a car in front. Such safety margins can be defined by the time headway (T h ) and time to collision (T C ) (Lee 1976). T h is the difference between the time when the front of the front vehicle arrives at a point on the road and the time the front of the participant vehicle arrives at the same point. Time to collision (T C ) is defined as the remaining time until a collision between the front and participant vehicles would occur if both vehicles maintained their current speed (cf. Minderhoud and Bovy 2001). The boundaries define at what point drivers are likely to step on the brake pedal. These boundaries can define intuitive points for triggering FCW, limits for ACC engagement, or changes in fully automated longitudinal driving behaviours. However, such boundaries may not be the same for all drivers, and not even for the same driver, whose goals may vary on different journeys. Depending on their motivation and available time, for example, drivers may decide to apply fuel-efficient driving behaviours or focus on safety. Previous research (Pampel et al. 2015(Pampel et al. , 2017 has shown that people apply different behaviours, simply after being asked to drive safely or fuel-efficiently. Hence, in the face of such driving styles, it can be expected that drivers adjust their boundaries, in this example, between car-following and active braking.

Objectives
The present research aimed to measure mental model boundaries in the context of different goals such as safe and ecodriving. Specifically, the mental models for car-following and active braking are of interest. When the T h and T C to the vehicle in front are within certain limits, car-following is satisficing, which means appropriate for the situation. Here the mental model for car-following is activated. When certain thresholds are crossed, say the front car brakes and the distance become too short, car-following ceases to be satisficing and the corresponding mental model is deactivated. Instead, the driver switches to active braking by stepping on the brake pedal to avoid a collision. The principal hypothesis was that drivers accept lower safety margins during ecodriving compared to safe driving, as drivers aim to maintain a constant speed and thus avoid braking during eco-driving (cf. Mensing et al. 2013Mensing et al. , 2014).

Participants
A total of 16 participants were recruited to the study. Their age was between 26 and 43 years (mean = 33.8 years, SD = 5.7 years). Eight drivers were male (mean age = 37.0 years) and eight of them female (mean age = 30.6 years). Participants were required to drive at least 5000 miles per year (mean annual mileage = 8750 miles), to have UK driving experience and to have held a full EU license for at least 2 years (mean driving experience = 13.3 years).

Apparatus
The participants drove a desktop driving simulator at the University of Leeds equipped with a Logitech G27 Racing Wheel for steering. Placed on the floor were accelerator and brake pedals. A sound system with a speaker mimicked the sound of the vehicle's engine and other road noise. The simulator collected data at 60 Hz, which included T h and T C to preceding vehicles.

Design
A within-subject design was employed, with one factor (three levels): the participants were asked to 'drive safely' (Safe), 'drive fuel-efficiently' (Eco) and received no specific driving style instructions (Baseline). The sequence of the Safe and Eco drives was counterbalanced to control for carry-over effects. Each drive lasted about 10 min.

Driving scenario
The drivers encountered a motorway scenario with surrounding traffic driving 70 mph (113 km/h) in the right lane, 65 mph (105 km/h) in the middle lane and 60 mph (97 km/h) in the left lane. The participants were instructed to remain in the middle lane throughout the drives, shown in Fig. 1. Because the study investigated natural human driving behaviour, automation systems such as ACC and FCW were not engaged at any point.
Each drive involved ten events, in which cars were cutting in front of the participant vehicle at a specified range of values for T C , as illustrated in Fig. 2, resulting in a variety of T h . At the end of the session, the purpose of the experiment was explained to the participants and they were entered into a prize draw as a gesture of appreciation.

Analysis
For validating the differences in driving style, the fuel consumption was modelled for the entire motorway sections with the microscopic Passenger car and Heavy-duty Emission Model PHEM (Rexeis et al. 2005). With the fuel consumption values of the three drives, a within-subject ANOVA with Bonferroni corrected post hoc pairwise comparisons was performed.
The main part of the analysis was based on SDT. For this, critical decision points were identified, which were either rejectable (BRK: pressing and releasing the brake pedal) or acceptable (NOM: no braking). For the first step of the analysis, the observed NOM and BRK decision points were treated separately, and for each experimental condition. Each set of points was shaped into a cumulative distribution function, giving each point a cumulative probability for not braking µ, and this probability ranged from 0 to 1. There were two types of cumulative distribution functions, the accuracy (μ A ) function for the NOM cases and the rejectability (μ R ) function for the BRK cases. Because it is assumed that the relative speeds between the vehicles are relevant in acceptable car-following situations (Goodrich and Boer 2003;Lee 1976), the accuracy function depends on T C . The concept of rejectability (μ R ) corresponds to the value of the rejection of a set of propositions (cf. Johnson-Laird 1988). It is an antiutility, or cost for the driver, such as accident risk and delays. Hence, the inverted time to collision (T C −1 ) is used, because the more beneficial to the driver the smaller it is. In braking situations, T h is considered important (Goodrich and Boer 2003), making it an independent variable in the rejectability function. These equations include the design parameters a and b, which will be specified in the present experiment. The functions are shown below: Using the values for T h for BRK cases and T C −1 for the NOM cases, the coefficients a and b were determined for both functions. This computation was performed using a least squares fit. The coefficients resulting from the fit were compared with paired-samples t tests to examine whether the means over the participants are significantly different from each other. Statistical significance was accepted at p < .05.
Subsequently, the coefficients a and b were utilised for a classification of all NOM and BRK measurement points, leading to a boundary function. In SDT, the probabilities have been quantified representing the underlying principle of utilities (cf. Levi 1983). For nominal behaviour, the satisficing set ( S b ) is the set of states, where the accuracy function is larger than or equal to the rejectability function, because the benefits outweigh the costs (cf. Goodrich and Boer 1998): For braking behaviour, the opposite equation applies, as in the non-satisficing states ( S C b ), the rejectability function is larger than the accuracy function (cf. Goodrich and Boer 1998): Combining the equations for nominal and braking behaviour, the following expression marks the line, where behaviour is switched from nominal to braking (cf. Goodrich and Boer 1998). Hence, the function represents the line separating the NOM and BRK points: The next step of the analysis involved the classification of all observed NOM and BRK points by drawing the boundary line based on the function above, dividing these points as correctly as possible. Therefore, the classification was performed using the three equations listed below, which describe the amount of misclassified data points, e.g. by classifying a BRK point as a NOM point or vice versa (cf. Goodrich et al. 1998a). Separately, for each drive, the parameter b was determined, so that the maximum outcome (the largest value of J 1 , J 2 and J 3 ) was minimised. The first function (J 1 ) represents the share of all incorrectly classified analysis points. The second one (J 2 ) stands solely for the incorrectly classified acceptable points (NOM classified as BRK). The third equation (J 3 ) accounts for the incorrectly classified rejectable points (BRK classified as NOM). The functions representing the mental model boundaries between car-following and active braking, in the Eco, Safe and Baseline drives, were then visually compared and discussed:

Results
No collisions with the front vehicle were observed. The analysis of the modelled fuel consumption resulted in a main effect [F(2,24) = 8.99, p = .001, η 2 = .428]. Pairwise comparisons found that, during the Eco condition compared to the Baseline condition, 2.8% less fuel was consumed (p = .008).
The parameters a and b for the accuracy functions based on the NOM cases in the present study are displayed in the upper two rows of Table 1. The probability of the driver not braking decreases as T C −1 increases, which means that they are more likely to brake at a shorter T C . Accordingly, the slopes of the functions in Table 1 are negative. On the left side of the function, T C −1 is considered small enough (T C is large enough), so the driver does not brake. As one moves towards the right, the probability of not braking decreases with a higher T C −1 . This probability is smaller for the Eco drive compared to the Safe drive, indicating that, during ecodriving, the drivers were more likely to brake at a given T C −1 . The differences were significant between the Baseline and the Eco drive for both a and b coefficients [a: t(183) = 7.56, p = .003, r = .488, b: t(183) = 3.92, p = .003, r = .278].
Coefficients a and b for the rejectability functions based on the BRK cases are displayed in the two lower rows in Table 1. Similar to the accuracy functions, the tendency suggested by coefficient a can be interpreted for the rejectability functions as well. With a negative a, the probability of the driver braking decreases as T h increases. With the largest value for a in the Eco driving rejectability function, this effect is much less pronounced for the Eco drive compared to the Safe drive. The slope of the Eco driving rejectability function is the least steep slope, visible in part c in Fig. 3, which means that some of the participants tended to brake at much larger headways in the Eco condition. This behaviour can indicate more anticipation during eco-driving, with the goal to retain larger headways to avoid stronger braking later on. For the a and b coefficients, the differences are significant between the Baseline and the Eco drive The classification of all observed points resulted in the lines presented in Fig. 4. These lines separate the NOM points (below the lines) from the BRK points (above the lines) as correctly as possible. This shows where behaviour switched from nominal car-following to active braking as the safety margins reduced (cf. Goodrich and Boer 1998). The optimal coefficient b is .50 for the Safe condition, .49 for the Eco condition and .59 for the Baseline drive. The area below a boundary represents the combinations for T C and T h in which car-following is satisficing and the driver does not step on the brake pedal. If these measures change, for instance, in the event of a close cut-in, and cross the boundary, the situation ceases to be satisficing and the driver is likely to brake actively. The grey area in this figure is not defined, because there the time to collision is larger than the T h . The results mean that for very low values of T h, the boundaries between acceptable and unacceptable states are similar for the Baseline, Eco and Safe drives. For larger and safer values of T h (cf. Lee 1976), the slope of the boundary function is a lot less steep for the Eco drive compared to the other drives. This can mean that T h had less influence on braking behaviour during eco-driving. However, the result    can also stem from the large values of T h in the Eco condition, which provided the measurement points for this model.

Discussion
The present research aimed to measure mental model boundaries in the context of different goals such as eco-and safe driving with a motorway cut-in scenario in a driving simulator. Modelling the fuel consumption showed that participants achieved moderate fuel savings in the Eco drive. Because the potential for eco-driving is limited on the motorway (Knowles et al. 2012), it can be assumed that the instructions were effective and that significant differences between the conditions can be traced back to the driving styles. In all drives, no collisions with the front vehicle were observed, and participants were stepping on the brake pedal sufficiently often in each condition. Hence, the experimental setup was suitable to discriminate between natural car-following and active braking mental models, without subjecting the participants to dangerous situations. The analysis shows that, compared to the Baseline condition, drivers maintained larger headways and also braked at larger headways to facilitate safe and eco-driving. This implies that they braked early on, possibly to avoid harsher braking at closer margins and resulting accelerations afterwards. This steady-speed driving is called 'coasting' and is commonly used as one attempt to avoid slowing down too much in situations such as crossings with red traffic lights (Johansson et al. 2003). Indeed, there is some certainty that pushing the accelerator pedal excessively is inefficient (Ericsson 2001;Johansson et al. 1999;Birrell et al. 2014;El-Shawarby et al. 2005). Hence, the participants braked, but possibly with less effect and might still have accepted lower safety margins temporarily during eco-driving to retain a steadier speed (Young et al. 2011). However, the data show that, contrary to expectations, the drivers did not accept temporarily lower safety margins for eco-driving. It has been shown that drivers tend to prioritise safe over ecodriving in critical situations (Dogan et al. 2011), which is also reflected in the absence of crashes in the present study. This also implies that these two driving styles do not need to oppose each other. When other vehicles drove into the participants' lane, and the values for time headway and time to collision became very small, the participants tended not to compromise their driving safety and braked using similar safety margins for their judgements.
These findings indicate that, as drivers follow different goals, e.g. as they are reminded to drive safely, or motivated to eco-drive, the boundaries between the mental models of car-following and active braking can shift. This suggests that the assumption of constant natural mental model boundaries (e.g. Boer 1998, 2003) is too simplified. As Michon (1985) stipulated, decisions on the tactical level need to correspond to the strategic level, where conscious choices for driving styles are made. Because automated systems may take over entire tasks such as car-following, this also means that people's preferences for operational limits of longitudinal safety and automation systems may change. Automation systems such as FCW, ACC, and even full longitudinal automation functions operate within certain conditions. Design decisions for these systems and their human-machine interfaces can be crucial for their safe use and acceptance. For instance, ACC may require drivers to intervene, in sometimes critical situations. It is suggested to emphasise the nature of the user, as in User-Centred Design (Abras et al. 2004), and adjust such automation limits according to natural, intuitive boundaries between mental models, in this example the boundary between car-following and active braking. Design according to such natural boundaries may increase the predictability of the system's behaviour and limits, and thus possibly prevent mode confusion. Sharples et al. (2015) stress that it may be more effective to provide information, rather than telling drivers what to do, and making a system's limits obvious provides such information. To design safer systems, Muslim and Itoh (2018) do not only suggest clear and understandable boundaries for automation, but also for the automation to observe the user, e.g. monitoring their response to critical events.
This study has several limitations. First, the sensitive nature of the desktop simulator controls could have caused the participants to drive in more erratic ways than they would in more realistic vehicles (Jamson and Jamson 2010). Regarding the validity of the findings, it needs to be kept in mind that this study was conducted with a small sample of 16 participants. Its findings have to be validated with a larger sample size and more realistic driving conditions. The motorway scenario was suitable for collecting a large amount of decision points in a reasonable amount of time, but other critical scenarios may add to the understanding of the acceptance of behaviours of automated systems. For example, Vanderhaegen (2017) implemented a scenario in a driving simulator study, in which an ACC stopped, as designed, responding to a slowing front car. However, this 'correct' system behaviour meant in that particular situation that the car stopped on a railway crossing, which made it unacceptable. Lastly, the present study investigated natural human behaviours, which may be different when it comes to acceptable behaviours in driver assistance systems or automated cars. For example, it has been shown that drivers may be more accepting of lower safety margins when an ACC is engaged compared to when controlling their speed manually (Nilsson et al. 2013).

Conclusions
This current study shows that intra-individual mental model boundaries between car-following and active braking may change with the driving style, while drivers maintain minimum safety margins in all cases. Such differences need to be taken into account for design decisions for FCW, ACC and other systems that automate entire tasks. For example, the findings can be applied to ACC systems by implementing the found parameters from the present study in an 'eco' mode with earlier and gentler deceleration. The boundaries can also be applied for autonomous cars to make their behaviour easier to understand and more acceptable for the passengers. Future research can consider such boundaries in the context of the systems discussed, in particular an ACC or fully autonomous vehicle, and investigate the different 'driving styles' in these contexts.
Open Access This article is distributed under the terms of the Creative Commons Attribution 4.0 International License (http://creat iveco mmons .org/licen ses/by/4.0/), which permits unrestricted use, distribution, and reproduction in any medium, provided you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons license, and indicate if changes were made.