Road Capacity and Throughput for Safe Driving Autonomous Vehicles

Safe driving is a relatively new concept that focuses on solving the responsibility attribution problem for autonomous vehicles (AVs), claiming that once the AVs follow a series of pre-defined safe driving policies, it is free from liability even when accidents happen. In this work, we propose safe driving policies for traffic configurations, including straight road, intersection, and Manhattan-like city. Base on the defined safe driving policies, we offer the concepts of safe driving capacity (SDC) and safe driving throughput (SDT) to measure the safe efficiency of the traffic configurations. The former measures the maximum AVs a traffic configuration could accommodate, and the latter measures the maximum throughputs of safe AVs of a traffic configuration. The values obtained are the fundamental limits of the traffic efficiencies for liability-free AVs under the defined conditions. The theoretical performance bounds give people insights on the potential limitations of the safe traffic efficiencies. Finally, this work provides analytical results of SDC and SDT on all the traffic configurations mentioned with explanations, implications, and trade-offs on the issues that may have effects on them.


I. INTRODUCTION
The concept of safe driving is first proposed by the Intel Mobileye group [1] under the name of responsibility-sensitive safety (RSS). It uses the formal method to define the safeness of an autonomous vehicle (AV). Unlike the convention definition of safety, RSS defines the safeness of AVs upon whether it's liable when an accident happens and the liability attribution is based on a set of rules. In this work, we name these rules safe driving policies. If these rules are properly, reasonably, and completely defined, the AV-related constitutional issues studied by Merchant and Lindor in [2] and the concerns on the relations between AVs and pedestrians [3] may to some extent be relieved. The original work focused on the logic, the conditions, and the liveness of the safety rules. It covered a variety of scenarios and traffic configurations an AV might encounter but mentioned very little on the efficiencies of AVs based on such rules.
Theoretic performance bounds provide fundamental understating of systems. Shannon's work [4] lay the The associate editor coordinating the review of this manuscript and approving it for publication was Baozhen Yao . foundation of communications systems and gives theoretic bound on their efficiencies through the proposition of information entropy. Gupta and Kumar [5] investigated the theoretic capacity of two types of N-node wireless networks, Random Networks and Arbitrary Networks. In this work, motivated by these works, we aim to investigate the theoretic performance bound for safe-driving vehicles on the roads. We first formalize the concept of efficiency under the safe driving context and proposed two metrics, SDC and SDT, as the measure of safe driving efficiency. The former measures how many AVs that do not violate the safe driving rules an area (a traffic configuration) could accommodate, and the latter measures the number of safe AVs to pass through the traffic configuration within a fixed time. As there are hundreds of traffic configurations, in this work, we focus only on the following three types for their simplicity in theoretical studies and their universality. They are straight road, intersection, and Manhattan-like city, as shown in Fig. 1. Many related studies of vehicle behaviors in these traffic configurations, depends on the focus, have been done. For the straight road, Zhang et al. focused on the over-riding mechanism and proposed the idea of time-to-last-second-braking [6]. Wu et al. focused on the linear stability required for platoon safety in emergent situations on a straight road. Ayumu et al. studied the relationship between rear-end collision and automatic brake control [7]. Nunen et al. and Solyom et al. discussed the safety and limitations of truck platooning [8], [9]. Aoki and Rajkumar design algorithms for vehicle merging when two straight roads are merged [10]. Wang and Wei showed the efficiency limitation of straight road base on safe driving mechanisms proved that the enabling of V2V communication is positive to the overall efficiency [11].
For the intersection, depends on whether there is centralized signaling, the study of intersection could be classified into the signalized one and the non-signalized one. And ways of managing them varies. For the non-signalized intersection, which is the setting of this work, Chen and Englund [12] did a complete survey and categorize the studies according to the algorithm design philosophy into the following three classes: resource reservation, trajectory planning, and collision avoidance (CA). The first class treats the intersection as a resource to contend and reserve for and provide analysis and heuristics, aiming to improve passing efficiency [13], [14]. The second class designs trajectory planning algorithms to find the optimum route with minimum risk for AVs [15]. The third class focuses on avoiding collisions with brakings and steerings and, at the same time, manage to enhance the passing efficiency [16]- [20].
In general, intersection management without further restrictions is a multi-agent, and thus NP-hard problem [21]. In order to obtain an analytic result, problem relaxation is required. The approaches we used to relax the problems are motivated by the following works: The worst-case study from the work of Nilsson et al. [22]; The constant spacing strategy from the work of Darbha and Hedrick et al. [23]; The rear-end collision avoidance with brake control and emergency braking from Ayumu et al. and Segata et al. [7], [24]; The idea to quantify the DoF of AV by Rodrigues de Campos et al. and the safety assessment from the Ph.D. thesis of Althof [25].
The major distinction between our work and all the ones mentioned above is clear. We are the first group to propose the idea of SDC and SDT that measures the safe AVs on roads. And we are also the first group to study the fundamental efficiency limits in the context of safe driving with precise analytic results. The trade-off of the precision comes from our relatively idealistic presumptions made comparing to the rest that tries to make their work as practical as possible but could only give heuristics.
To conclude, the major contributions of this paper are: 1) We are the first group to analyze the traffic efficiencies under the context of safe driving. 2) We formalize the concept of safe driving efficiencies in both space and time domain and obtain their achievable analytic upper-bounds under the provided conditions; furthermore, some direct corollaries are given.
We organized the rest of this paper as follows. In section II, we give an overview of the problem and elaborate settings and requirements needed for later analysis. In section III, we first define the safe driving policies with math and some modal languages. Then we set the metrics SDC and SDT as the indications of the efficiencies under safe driving policies.
In section IV, we analyze the traffic efficiencies of several traffic configurations and their behaviors. In section V, we discuss the direct results from the theorems proven in Section IV. We conclude the work in Section V. Most proofs of this work are left in the Appendix section.

II. PROBLEM OVERVIEW AND SETUP A. VEHICLE REQUIREMENTS AND CAPABILITIES
In the following contexts, All AVs are presumed to have identical physical characteristics and capabilities (Same vehicle length, width, response time, acceleration, and deceleration). The maximum accelerations and decelerations are presumed to be constant. The AVs are equipped with high-precision mapping, navigating, positioning, and perceiving systems along with the wireless V2X interfaces like 4G/5G and DSRC. The perceiving system consists of all the available visual sensors such as LIDAR, camera, and radar. The inter-vehicle communication is presumed to be free from attack and is always reliable as long as received. All the traffic configurations are signal-free, and roads are orthogonal to one another if intersected, as shown in Fig. 1. All the traffic configurations have the same speed limit [V min , V Max ]. No traffic facilities nor pedestrians unless otherwise specified, and no AVs would form platoons. Each of the AV makes decisions following identical decision process characterized by a four tuple < S, A, T , R >. S denotes the state space, which is the collection of all possible situations the vehicle might encounter while driving. A denotes the action space representing all the possible actions the agent is capable of apply under the current state. In general context, it could be referred to actions such as brake, change the heading, lane, speed, etc. However, in this work, it is confined to brake with maximum braking power for tractable analysis. T is the transition function with domain and co-domain S ×A×S → [0, 1]. R: S × A → R is the reward function to evaluate the goodness of a chosen action.

B. PRESUMPTIONS AND DEFINITIONS OF SAFE DRIVING POLICIES
We denote the trace of states for the i th AV on the road as σ i = <s i0 , s i1 , . . . , s iŤ >, where the subscript 0 and subscripť T denote the current instant and a finite system-dependent time horizon, respectively. Also, let W and L be the width and length of the AVs. To address the policy-based safety, We define a set that is a sub-set of A and call the set best effort reaction (BER). It contains only those a t ∈ A that minimize the probability of leading to an accident.

BER(s
In the following context, taking a t ∈ BER(s t ) should lead the AVs to accident with probability 0 almost surely, that is, no collision is allowed. Also, we only consider the scenarios that the BER within the time horizon never becomes empty for the logical liveness issue. Furthermore, we presume that the larger the deceleration, the better the reward. Briefly speaking, ∀a t ∈ BER(s t ), the following three equations always hold The t 0 in the last equation denotes the current instance. Now we could define the safe state of an AV. We say an AV, ω r , is safe, or is in safe state, if and only if there would be no collision between the rear AV ω r and the front AV ω f , when ω f applies any possible action abruptly, and ω 1 responds to the action with the action in its BER. For straight road analysis, we define the longitudinal distance (inter-vehicle distance) of AVs on the same lane as the distance of their body center measured along the direction of the road parallel to the ground. With the safe definition given, we say a longitudinal distance is safe if and only if it's sufficient to make the rear AV stay within safe states no matter what the front AV does.
For the intersection, we define the concept of intersection distance and exposure time. The intersection distance of an AV is the euclidean distance measured along the direction parallel to the ground from the AV center to the intersection center. The red arrows in Fig. 2 illustrates the intersection distances of ω 1 , ω 2 and ω 3 . If the intersection distance of an AV is sufficient for it to remain in a safe state when applying its BER right after a fixed response time τ from the first time an emergency happens, it's safe. The exposure time is the first time point when vehicles from two intersected lanes of an intersection notice the coming of each other through either their perception system or the V2V communication when they are within the communication range D comm . When first exposed, the AV closer to the intersection would be the prioritized vehicle, and the other one would be the yielding vehicle. The priority is relative, i.e., ω 2 might be the prioritized vehicle to ω 3 but is the yielding vehicle to ω 1 , as shown in Figure.  the time between an AV is exposed and the time it passes through the intersection, it's not allowed to decelerate if it's the prioritized vehicle, and it's not allowed to accelerate if it's the yielding vehicle. If an AV is both prioritized to one AV and yielding vehicle to another, it should keep constant velocity between the time of its second exposed (that make it prioritized) to the time it pass through the intersection. Now we close this section by the definition of safe driving capacity (SDC) and safe driving throughput (SDT ). The SDC of a traffic configuration is the maximum number of safe state AVs that could drive within. The SDT of a traffic configuration is the number of safe AVs that could pass through a cut of the traffic configuration within a given amount of time T.
If not otherwise specified, we set the T to be a second.

III. ANALYSIS ON SDC AND SDT
In this section, we will derive the two safe driving efficiency metrics: Safe Driving Capacity (SDC) and Safe Driving Throughput (SDT) in the following three scenarios.

1) Straight Road 2) Intersection 3) Manhattan-Like City
The straight road and the intersection are the building blocks for the analysis of the city. With the given definitions and policies, we first analyze the safe efficiencies of the two in terms of SDC and SDT. Base on the result, We then derive the SDC and SDT of a city.

A. STRAIGHT ROAD
The overall derivation of SDC and SDT for a straight road R is based on the concept that the longitudinal distance kept between two AVs should be no less than the minimum safe longitudinal distance inf d R LS . Such distance should be sufficient so that even the front vehicle ω f applies maximum braking power without early warnings and the rear vehicle, ω r , without knowing the emergency, applies maximum acceleration u throughout the response time τ , ω r would not collide with ω f if it performs the action in its BER (Maximum braking power here). Let v r and v f be the velocity of ω r and ω f respectively and a max be the maximum deceleration of the vehicle, then for ω r not to collide with ω f , their longitudinal distance should always be greater than L. Let d R LS (v r , v f ) be the longitudinal distance between ω r and ω f at the moment ω f starts to brake with a max , then until ω r fully stops, it is VOLUME 8, 2020 required that The LHS of inequality is the sum of initial inter-vehicle distance and the distance ω f would forward throughout the deceleration. The RHS is the distance ω r would forward before it stops. Re-organize the terms, we have Adding the condition that the inter-vehicle distance should never be less than L that corresponds to the trivial case that ω f stops after ω r stops, we have the general form Since the worst case only happens at either the moment ω f starts to brake with a max or the time that ω r stops, we can be sure the correctness of (3).

1) SDC R AND SDT R
To find the SDC R and SDT R of aṄ -lanesṀ -meter road measure within the time T , we first index the AVs along the road from rear to front in increasing order. Then by definitions, we have The λs on the RHS of (4) and (5) are the KKT multipliers correspond to the constraints that the results are measured within the specified space rangeṀ and time range T . d R LS [ω i ] is the longitudinal distance between the i th AV and the (i + 1) th AV in its front. This primal form of the problem is intractable due to its multi-agent nature and its non-convexity in the feasible set shown in Fig. 3. We define the concept of steady-state to relax the problem. We say a road is in steady-state if all the AVs within are driving with constant velocity v for which V min ≤ v ≤ V Max and each of the inter-vehicle distance is (6) states the minimum safe inter-vehicle distance between different AVs, when R is steady, are independent. For R that is initially unsteady, one could have it steady by letting every AV in R to keep a constant safe distance with the AV in its front except the AV at the very front of R that has no front AV to follow and keep distance with. This procedure would terminate within finite time if the conditions in the following lemma hold. The proofs of the lemmas and theorem follows are left in the Appendix. Lemma 1: If all the AVs in R with |R| < ∞ are safe initially with u > 0 and a max > 0, then the procedure described above terminates within finite time.
Here |R| stands for the number of AVs in R. Lemma 1 states that there exists a finite time way to make R steady. The following lemma holds true when R is steady.
Lemma 2: When a R is steady and V min ≤ v ≤ V Max , the following relations hold Base on lemma 2, (4), and (5), we have the following theorem Theorem 1: The SDC R of R withṀ -meter length anḋ N -lanes in the steady-state is And the SDT R of R withṄ lanes in the steady-state is The results are shown visually in Fig       intersection distance is sufficient for it to avoid the collision with AVs on the contrary lane with higher priorities by applying maximum braking power when they make emergent moves. To achieve the optimum safe efficiencies in the intersection, we presume that there are always AVs accessing the intersection. Since the two intersected roads l1 and l2 are of equal importance in our setting, If the ith AV from l1 to access the intersection be labeled as ω 2i−1 and the ith AV to access the intersection in l2 be ω 2i . For fairness, ω i would prioritized ω j on the counter lane if j < i. Under this setting, finding the SDC I of twoṀ -meter roads l1 and l2 could be written as ). (11) The SDT I measured within time T could be expressed as ). (12) Here d I LS [ω i ] stands for the inter-vehicle distance between the ith AV and (i−2)th AV on the same lane. As shown in (11) and (12), even though we have greatly simplified the problem by considering only single lane on each intersected road and also have we reduced the action space of AVs by only allowing them to accelerate or decelerate, (11) and (12) still fall in the category of multi-agent problem, which is intractable in general. To solve this issue, similar to how we relax the straight road efficiency problem, we define the steadiness of an intersection as follows: An intersection is steady if and only if both l1 and l2 are steady. By lemma 1, we know that there exists ways to make l1 and l2 steady if they are treated independently. However, they are not always independent now since they are intersected. Suppose AVs in l1 keep identical safe inter-vehicle distance d H with steady-state velocities v H and AVs in l2 keep d V in between with velocities v V , the following lemma states that only if d H , d V , v H and v V satisfy certain conditions could the intersection be steady.
Case A to case D in Fig. 9 illustrate all possible relations between v H , v V , d H and d V . The figure also shows the intuition on its proof, which is left in the Appendix. For fairness reason and to simplify the original problem, v H = v V is required since none of the roads should work at higher velocity. The following lemma states that under such a setting, the efficiency is optimized when the passing pattern is symmetric, i.e., every AV splits equally the inter-vehicle distance of another road when it's at the intersection point, as shown in Fig. 10 and case E and case F in Fig. 9.
Lemma 4: Let d H < ∞ and d V < ∞ be the current least safe inter-vehicle distance of the horizontal road and the vertical road of an intersection, respectively. Then if v V = v H and the intersection is steady, it achieves optimum efficiency at velocity v if and only if . Furthermore, any AV, when at the intersection point, splits the inter-vehicle distance of another road equally. Lemma 3 guarantees that when the conditions in lemma 4 are met, the intersection could be steady sincem andñ in this case are both 1. Thus under the condition that v H = v V and all the inter-vehicle distances on the same road are identical, according to lemma 4, to obtain the optimum safe efficiency of an intersection, it suffices to decide how close the safe distances between AVs on the same road could be. Such distance should be sufficient for the yielding AV to claim its safeness by applying BER whenever the pure prioritized AV has any emergency moves. In the following, we analyze the least safe inter-vehicle distance inf d I LS (v, ·) when AVs in the intersection are driving at velocity V min ≤ v ≤ V Max .

1) SAFE LONGITUDINAL DISTANCE (d I LS )
By the symmetric setting, let the pure prioritized vehicle ω p have the intersection distance d c , and the yielding vehicle with the least intersection distance has the intersection distance d c + d p 2 . For d c belongs to each of the zones (Z I , Z II , and Z III ) shown in Fig. 8, we find the least d p 2 so that d p could serve as d I LS for the yielding vehicle. In Z I , if the prioritized vehicle ω p applies maximum braking power a max , it stops before the intersection, and so we do not need to set any constraint on the action space of the yielding vehicle ω y . Thus the d c corresponds to Z I has the range For the Z II case where the prioritized vehicle ω p stops within the intersection so that the yielding vehicle ω y should stop before the intersection. Thus d c should satisfy the following inequality Therefore, the range of d c is The inter-vehicle distance for ω y should be sufficient so that after the response time, it could stop before the intersection. For simplicity, we replace W + L with e.
Plugging-in the d c range for Z II , we have For ω p in Z III , which corresponds to that even it brakes with a max , it will still slide through the intersection and so that as long as ω y arrives at the intersection later than ω p , there will be no collision. There are two sub-phases here: The first one is that d c is still sufficient so that after τ , ω y is still before the intersection. Let the time ω y arrives at the point (W + L)/2 before intersection be t y and the time ω p arrives at the point (W + L)/2 after the intersection be t p , we have Solving the valid range of d p , it suffices to have t p ≤ t y , Let k be d m − vτ − e 2 and β = d c + e 2 , we have Squaring both sides and re-arranging the terms, we have Squaring both sides again, we get By β − k = − 1 2 d p + e + vτ and d c − d m = − 1 2 d p , we have Expanding and re-arranging the terms, we have Solving the quadratic inequality of d p , we get Since d c ≤ v 2 2a max − e 2 and τ > 0, we have This is the second sub-phase for Z III . In this sub-phase, ω y will access the intersection during its response time. Similar to the previous analysis, for ω y , we have and .
By the requirements of this sub-phase, we have For the first inequality, we have Comparing the result with (20), since 2vτ − 2 d c + e < 2(vτ + e), we know that the d p result in this sub-phase would be dominated by the result in Z II as the case in Z III − 1.

2) WORST CASE ANALYSIS AND GENERALIZED FAIRNESS
Safe driving requires the responding vehicle to take actions according to the worst possible actions the AV in its front or the AV on the contrary-lane of the intersection with prioritized status may take. In both Z II and Z III , it makes sense to say that ω p with braking power a max is the worse than with any other a < a Max . Suppose it brakes with an a < a max , we have t p (a) < t p (a max ), and thus t y > t p (a max ) > t p (a). It means that the d p derived in (20) and (27) are sufficient to guarantee the safeness of ω y . In Z I , the worst action to be presumed is not a = a max but 0 < a < a max because braking with less a would force ω y to respond to the action instead of doing nothing as discussed in Case Z I . However, the derived d p in Z II is still sufficient for the safeness of ω y since d c (Z I ) ≥ d c (Z II ). We plug-in this inequality into (18), we can see that the inequality for d p still holds. In our intersection settings, we let an AV from one lane to access the intersection after the AV from the contrary-lane has accessed it, and so on so forth. In this 1-1 manner, we say the intersection is fair since the priority level is only determined VOLUME 8, 2020 by the intersection distance when two AVs are exposed. When both lanes are full of vehicles, AVs from both lanes will take turns accessing the intersection. Now we generalize the fairness concept as follows. Let AVs crossing the intersection in a similar inter-laced manner, but now, M AVs after M AVs. Here M ≥ 1 is a positive integer. In the long run, the intersection is still fair in terms of the AVs passing through it from both lanes. Now we analyze the efficiency of the generalization. From (35), we are able to treat the M AVs on the same lane as a larger vehicle with identical width W but longer length L = (M − 1)(vτ + L) + L. Let's call the M -consecutive AVs a M -group. By the intersection results obtained, in order to achieve SDT, the inter-group distance should at least be 2(vτ + L + W ). The average time required for a M-group to pass through the intersection is We can analyze the SDC similarly. Since the average inter-vehicle (inter-group) distance increases for M > 1. That is, for integers M 1 and M 2 with the relation 1 ≤ M 1 < M 2 , the safe efficiencies of M 1 -group always outperforms the M 2 -group provided the measuring time T of SDT and the measuring distanceM of SDC be sufficient. For insufficient measuring time or distance, there may be cases where the efficiency of M 2 -group is better than the M 1 -group's. In this case the intersection is degenerated into a road and not the scenario that we would liked to focus on.
Finally, by combining (20), (27), and inf d R LS . One could discover that 2(vτ + e) > 2vτ + 2e − a max τ 2 . The minimum inter-vehicle distance to keep in a steady intersection is (31) means that for any ω i with current intersection distance d c , the AV on the contrary-lane, ω j , with intersection distance greater than d c + 1 2 min d I LS , could be in safe state before ω i crosses the intersection. And similar argument could be applied to ω k , the AV in ω j 's front which has intersection distance d c − 1 2 inf d I LS (v, ·) ≥ 0. To ω i , since ω k is its prioritized vehicle. The difference in their intersection distance, 1 2 inf d I LS (v, ·), is sufficient, and thus ω i is safe. Now by (7), (8) and (31), we have the following lemma.
Lemma 5: When an intersection is steady, we have and By (11), (12), and lemma 5, we have the following theorem.

Theorem 2: The SDC I of an steady intersection intersected by 2Ṁ -meter single-lane roads is
and similarly, the SDT I of the intersection is The SDC I and SDT I under different V min , V Max , and τ , is given in Fig. 11 and Fig. 12. As the figures indicate, the lower response time τ results in higher safe efficiencies. Also, at v = V min , the SDC I is achieved for all τ . At v = V Max , the SDT I is achieved for all τ . We extend the measure of safe efficiencies to Manhattan-like city, as illustrated in Fig. 13. Since a city is a combination   of intersections and straight roads, as in the previous cases, we first define the steadiness of a city. We say a city is steady if all the roads and intersections within the city are steady. By maximum flow min cut theory, if all of them are steady with maximum safe driving efficiencies, the city achieves its optimum efficiency. However, the inter-intersection distance may bring dependencies to the intersections. We use the following lemma to state the condition required to make all the intersections steady as if there are no dependencies.
Lemma 6 (Achievability): If all the AVs in a city are driving with velocity v and their inter-vehicle distances are identically d C ≥ inf d I LS (v, ·), then it could always be steady. If the conditions specified in lemma 6 is met, we could have the following theorem for SDC C and SDT C . Theorem 3: If all the inter-intersection distance of a city is greater than the constant spacing inter-vehicle distance and its SDT C . (37) Lemma 6 and Theorem 3 state that if all the AVs keep the constant spacing between one another and this spacing distance is greater than the minimum safe inter-vehicle distance required for the intersection to work in steady-state, also, the inter-intersection distance is sufficient. We could always make the city steady, and the SDC and SDT of the city could be acquired from the modification of the result of a single intersection. The resulted SDC C represents the maximum number of AVs driving within the valid velocity range that could be safe in terms of responsibility. In other words, when any of the AV brakes with maximum braking power, there would be no collisions. The resulted SDT C gives the number of AVs that could pass through the city with the same safety guarantee.

IV. DISCUSSIONS
We organize the SDC and SDT results in Table 3. These results imply that the upper and lower-speed limits set by the roads (V min and V Max ) have a direct impact on the safe driving efficiency bounds. Furthermore, the results obtained show a clear relationship on how the parameters of an AV affect the overall safe efficiencies. These equations not only answer the safe efficiencies of the traffic configurations but also reveal the AV requirements when a city is asked to reach certain safe traffic efficiencies. The following corollaries are the immediate consequence of Theorem 3, and thus their proofs are omitted.
Corollary 1: Given a city of size (m c (L cV ), n c (L cH )) and all the AVs driving within to have maximum braking a max > 0 and maximum response time τ . If the city is required to have throughput no less thanρ C , the upperspeed limit V Max set by the city should be no less than 2ρ C (L+W ) (m c +n c )T −2ρ C τ ; On the other hand, if the city is required to have a capacity of no less thanC, the lower-speed limit set  . Corollary 1 shows that if a certain safe traffic efficiency is to be achieved, then the speed limits set by the traffic configurations would have some requirements. Corollary 2 states similarly but in a reverse way: When the speed limits and vehicle capabilities except the maximum response time τ are fixed, if the city is required to achieve a certain level of efficiency in terms of either capacity or throughput, then there exists a minimum requirement on the response time of AVs so that only when all the AVs could respond to emergencies in a sufficiently short time that is less than a threshold could the required efficiencies be achieved.

V. CONCLUSIONS
In this work, the concepts of SDC and SDT are proposed. They measure the capacity and throughput of AVs base on the safe driving policies that guarantee all the abiding AVs to be free of liability even when an accident happens. We circumvent the multi-agent difficulty by defining steady-state of the traffic configurations so that closed-form results of SDC and SDT under several traffic configurations could be obtained. They are organized in Table 3. We also show the implication of the derived results in the discussion section that these formulae not only reveal the optimum safe efficiencies but also give the least requirements on either velocity constraints of the traffic configurations or the least response time required for the AVs. To conclude, this work shows that, on the one hand, to maximize safe transportation efficiency, the AVs should drive as fast as possible and drive as close to other AVs as possible. On the other hand, the AVs need to keep the minimum distance to other AVs for driving safety base on the responsibility settings. Given a road R with |R| AVs ω 1 , ω 2 , . . . , ω |R| within with velocities V min ≤ v 1 , v 2 , . . . , v |R| ≤ V Max . Suppose the very first AV that has no front vehicle is ω |R| with velocity v |R| = V Max , and the road R has length L R . We sequentially make ω i for i from 1 to |R|−1 to do the following: , it has the velocity v i+1 . When this procedure terminates, all the AVs would have velocities v |R| . The time required to terminate, T steady , could be written as t steady [i] is the time required for the ith AV to finish the procedure and the inequality comes from the fact that the time for a procedure might overlap with another. Now it suffices to bound each t steady [i] in the summation term. Since for all ω i and ω i+1 , their speed difference would be no more than V Max −V min , each t steady [i] would be bounded by 2(V Max −V min ) max{a,u} . So the LHS of (38) could be bounded as Thus we complete the proof.

B. PROOF OF LEMMA 2 AND THEOREM 1
For (7), to check whether at v = V Max would be the supremum, we differentiate is minimized and its recipro- It's clear that Since SDT R is proportional to this reciprocal, we know that SDT R is maximized when v = V Max and thus we complete the proof of (7) and (10). For (8), the first inequality is simply by the fact that local optimum would not be better than the global optimum. For the equality part, since all the AVs have identical velocity for R is steady, they have identical least safe inter-vehicle distance. This distance is a function of their steady-state velocity v. To check whether at v = V min would be the infimum, we differentiate d R And thus it's true that at v = V min , the infimum is achieved for (8). Base on (43), for velocity V min ≤ v i ≤ v j ≤ V Max and any positive constant c, we have Thus (9) could be proved by substituting c withM , the length of measure of SDC R . Now we complete all the proofs.
is not an integer, also without loss of generality, we assume at t = t 0 = 0, there is an AV belongs to the horizontal road at the intersection point. Since If d [2] H (t = d H v H ) ≥ 0, then it indicates such distance is not sufficient to claim the safeness. Now shall we abuse the notation by allowing the intersection distance of an AV to be negative if it has passed through the intersection. Then if (γ − 1)d V < d [2] H (t = d H v H ) < 0, it must mean that the second AV on the vertical lane who is at the intersection point at  (14), the proof above could also be applied by simply swapping all the subscripts V with H . Since only the integer cases could result in steady-state, the only if direction is proved and the lemma is proved.

D. PROOF OF LEMMA 4
When v V = v H , ifm > 1 is an integer, then with d V = d Ṽ m , one could enhance the efficiency of the vertical road while still keep all the AVs safe in responsibility. Ifñ > 1 is an integer, then with d H = d H n , one could similarly enhance the efficiency of the horizontal lane. If none ofm,ñ is an integer, then by the previous lemma, the intersection won't even stay steady. Base on the result, now we have d H = d V as the necessary condition for optimality. For symmetry, let δ l and δ r be the distance between itself and the AV at its left and right respectively when it's at the intersection point. Suppose an AV doesn't split equally the inter-vehicle distance of another road, then we have δ l + δ r = d H = d V but δ l = δ r . If in the steady-state δ l > δ r could make AVs be safe, then it implies that δ r is sufficient to be the difference in intersection distance of two AVs on intersected roads of the intersection. Thus the symmetric setting with inter-vehicle distance 2δ r is sufficient to be safe while keep steady. Similarly for the case δ l < δ r . Thus if δ l = δ r , the one with smaller value indicates a way to enhance the traffic efficiency and only when δ l = δ r = 1 2 inf d I LS (v, ·) could the optimum efficiency be reached.

E. PROOF OF LEMMA 5 AND THEOREM 2
For (33), to check whether at v = V Max would be the supremum, we differentiate Thus is minimized and its reciprocal, v inf d I LS (v,·) , is maximized. Since SDT R is proportional to this VOLUME 8, 2020 reciprocal, by (12) and (47), we complete the proof for SDT I in (35). For (32), the first inequality is simply by the fact that local optimum would not be better than the global optimum. For the equality part, since all the AVs have identical velocity for the intersection is steady, they have identical least safe inter-vehicle distance. This distance is a function of their steady-state velocity v. To check whether at v = V min would be the infimum, we differentiate d I and thus it's true that at v = V min , the infimum is achieved for (32). Base on (11), for velocity V min ≤ v i ≤ v j ≤ V Max and any positive constant c, we have Thus (34) is proved by simply substitute c withM , the length of measure of SDC I . Now we complete all the proofs.

F. PROOF OF LEMMA 6
Since we know the AVs entering I ij comes from I i−1 j and I ij−1 . If both I i−1 j and I ij−1 are in steady-state, then I ij must satisfy some constraint so that all the AVs from I i−1 j and I ij−1 could still pass through I ij without changing their behaviours.
To prove the lemma, we introduce the concept of phase.
Noticing that for every m c ≥ 2 by n c ≥ 2 roads city, we could always split the city into ((m c − 1) × (n c − 1)) 2 by 2 blocks as shown in Fig. 15. There would be 4 intersections in any of the block: I 11 , I 12 , I 21 , I 22 as shown in Fig. 14. We define the phase of I 11 as Hered s represents half of the constant spacing between AVs that should be greater or equal to inf 1 2 d I LS (v, ·), and d (11) iH is the intersection distance of the first AV in the horizontal lane that's going to pass through I 11 . Without loss of generality, let d (11) iH =d s and so (I 11 ) = (d s −d s ) d s π = 0. Now we extend the definition of intersection distance so that the AV, which has passed the intersection, has a negative intersection distance. By lemma 4, we know that in order to achieve optimum efficiency, the first AV in the vertical road to cross I 11 should have its intersection distance d iV = 0. Similarly, we have the equivalent phase representation measuring from the vertical intersection distance d iV where D H is the distance between I 11 and I 12 . D H is presumed to be greater than 2d s . By (50), we have Suppose d (21) we have where D V is the distance between I 11 and I 12 so that d (22)  With similar procedure, we can have the phase of I 12 Here ζ * we have d (12) We have d (22) iH = D H + d (12) iH − 2ζ * (1222)d s .
iH + 2ζ *  Since the phase derived in (56) should meet with the one in (60) to have the city steady, equating (56) and (60), we have Similarly, if we consider different conditions in (53) and (58), that is, the other 3 possible conditions: d (21) iH ≥d s and d (12) iV ≥ d s ; d (21) iH ≥d s and d (12) iV <d s ; d (21) iH <d s and d (12) iV ≥d s , following the similar procedure by equating their phase at I 22 , we have the following two more results: and Since (61), (62), and (63) cover all the possible results of ζ * (1112) − ζ * (2122) + ζ * (1222) − ζ * (1121) and they're all irrelevant to D H and D V , we can conclude that for any 2 by 2 case as shown in Fig. 14. If I 11 , I 12 and I 21 are and could be properly controlled so that they are all steady, then as long as D H and D V are greater than the constant spacing kept by the AVs, I 22 would always be steady. Now in order to generalize the result into any m c by n c city where m c ≥ 2 and n c ≥ 2, we first label all the intersections in the similar manner as in Fig. 14. Then for any intersection I ij , ∀ i, j s.t. 1 < i ≤ m c and 1 < j ≤ m c , if I i−1 j , I i j−1 , and I i−1 j−1 are steady, I ij is steady according to the result above. For those boundary intersections I ij where at least one of i or j is 1, they could always be made steady since we can control the time the AVs enter the city. Thus, as shown in Fig. 15, we can finish the generalization simply by induction and we complete the proof.

G. PROOF OF THEOREM 3
By lemma 6, when all the intersections are steady with optimum efficiency, they have identical inf d I LS (v, ·) and thus the SDC C and SDT C could simply be written in the form that treat all the roads within the city as if they are independent with inter-vehicle distances inf d I LS (v, ·).