Emergency Pull-over Algorithm for Level 4 Autonomous vehicles Based on Model-Free Adaptive Feedback Control with Sensitivity and Learning Approaches.

This paper presents an emergency pullover algorithm for fail-safe systems designed for level-4 autonomous vehicles. The proposed algorithm utilizes feedback gain adaptation, based on sensitivity estimation, and cost-based learning. Vehicle failure within this paper does not encompass every type of failure and refers only to any situation where the upper controller or communications from the upper controller shuts down. When this type of failure occurs, the algorithm performs an emergency pullover maneuver. This maneuver does not require any form of independent control from the driver to be performed successfully. However, the highest control priority is still given to the driver if the driver intervenes during the maneuver. The feedback gain adaptation is comprised of two sections: Sensitivity Estimation and Gradient Descent (GD) based Adaptation. For Sensitivity Estimation, a relationship function has been designed with feedback gain, from the feedback gain adaptation, and changes in state error. The sensitivity of state error with respect to feedback gain can then be estimated. This estimation is done through the Recursive Least Squares (RLS) method with multiple forgetting factors through the directional forgetting method. For GD based Adaptation, state errors are applied with parameters for the cost-based learning to give Adaptation Gains. These Adaptation Gains are used in tandem with the estimated sensitivity to update the feedback gain. To reduce the number of tuning parameters required in the GD method, an additional distance condition has been proposed. This condition utilizes feedback change rates and state errors, obtained from the multi-dimensional plane of the feedback gain’s change rates. A proportional coefficient is also required as a tuning parameter for this condition. This parameter is tuned by a cost-based learning algorithm, also designed in this study. Resultantly, these methods allow the adaptive feedback controller to forgo any system information such as mathematical models and system parameters. This indicates that the vehicle model is not expected to hinder performance. Hence, controllers that do not require system information are indeed a preferable algorithm for fail-safe modules. Performance evaluations for the controller has also been conducted with actual vehicle tests, under longitudinal and lateral autonomous driving scenarios.

In recent years, various advanced control strategies and techniques have been developed for autonomous vehicles with sensing and artificial intelligence technologies. Autonomous driving plays an important role in improving driving comfort, efficiency and, most importantly, safety. Therefore, research and commercialization work for autonomous vehicles have been conducted by universities, governments, and automotive industries through control architecture developments. Studies on the fail-safe system are crucial in ensuring autonomous vehicle safety. However, each autonomous vehicle developer builds a separate failsafe system. Hence, a unified fail-safe system development methodology does not currently exist. Therefore, each autonomous driving system must be designed with its own separate fail-safe system. Studies and research regarding: 1. Autonomous Driving and safety standards 2. Hardware and Software Configurations 3. Motion Planning 4. Fault Detection 5. Model Uncertainty Compensation Will be discussed in this section.
To start off, an in-depth review of current autonomous driving safety standards is necessary. Recently, the National Highway Traffic Safety Administration (NHTSA), the Federal Motor Vehicle Safety Standard (FMVSS), and SAE International have released safety standards and automation levels for autonomous vehicles. NHTSA released the two reports: Automated Driving Systems: A Vision for Safety (AV 2.0) and Automated Vehicle 3.0: Preparing for the Future of Transportation. Both reports provided voluntary guidance on the fail-safe system (also known as fallback system) of an automated vehicle in 2017 and in 2018 respectively [1,2]. SAE International released a technical paper describing vehicle driving automation systems that perform part, or all, of the dynamic driving tasks (DDT). This document provides a taxonomy with detailed definitions for six levels of driving automation. The levels range from level 0 to level 5, a standard released in 2014, actively used till now [3].
The next few sub-sections discuss previous studies and research performed in regards to H/W and S/W configurations, Motion Planning, Fault Detection and Model Uncertainty Compensations.
In previous studies of fail-safe systems, several automakers have released safety reports that explain, albeit briefly, their systems on an autonomous vehicle. Through these reports, a rough inference the H/W design, S/W structures, and functions can be made. Relevant literature studies on fail-safe systems are discussed below.
The Waymo autonomous driving company, formerly known as the Google self-driving car project, has their own autonomous vehicle fallback system. Their system comprises of a backup brake, backup steering, a backup computer, and backup power [4]. Tesla has built a processer chip for its self-driving capabilities, also known as FSD (Full Self-Driving). Two main computers are built into one processer chip. This allows for one computer to take over and continue, should the other fail. The processor chip has a system where both computers monitor each other simultaneously. The chip also has a dual configuration for power supply and communications [5]. Baidu's Apollo autonomous vehicle team has developed a 'guardian module' with features similar to a fail-safe module. The Apollo guardian module is equipped with relatively simple fail-safe system functions comprised of detection and control parts [6]. As for GM, the GM Cruise's safety reports show that their vehicles consist of a backup computer, a backup actuator, and redundant signal communication in terms of hardware. Software-wise, an environment sensor replacement methodology exists, should one of the sensors fail [7].
Many researchers have devised fail-safe motion planning algorithms for autonomous vehicles using various methodologies. Among these, a notable one is a verification technique ensuring autonomous vehicles do not cause collisions when using fail-safe trajectories. The intended trajectories provide fallback solutions in safety-critical situations where safety is achieved by maintaining an emergency maneuver [8,9,10]. A fail-safe priority-based intersection approach was proposed for an intersection without signals in [11].
Emphasis needs to be placed on fault detection and fault-tolerant control in autonomous vehicles as well. Findings from various research suggest utilizing fault detection in environmental sensors for autonomous vehicles. A fault detection, isolation, and identification architecture for multi-faults in multi-sensor systems has been introduced in [12]. Functional perspective-based fault detection and a diagnostic algorithm were proposed for autonomous vehicle fail-safe systems in [13][14][15][16]. This research focuses on LiDAR, Radar, and vehicle chassis sensor faults. A fault detection and identification approach were also suggested for autonomous vehicle sensors. Various sensor faults were first assumed, including vehicle chassis sensor faults [16,17], environment sensor faults [13-16, 18, 19, 20, 21], and actuator faults [22,23,24]. These were then validated through simulations and vehicle tests. Following fault detection, fault-tolerant controls and safety controls with limited information were also proposed in [13,14,17,21,22,23]. Some studies suggested the utilization of environmental sensors in autonomous driving to correct the error information of other sensors. [18,19].
A thorough review of strategies and regulations on level 4 targeted autonomous vehicles was done by our team. We considered hardware and communication structures inclusive of appropriate software implementation. Essential This work is licensed under a Creative Commons Attribution 4.0 License. For more information, see https://creativecommons.org/licenses/by/4.0/ This article has been accepted for publication in a future issue of this journal, but has not been fully edited. Content may change prior to final publication.  [25]. It was designed such that the controller calculates an optimal parameter that allows lateral error to track the zero without overshooting as fast as possible. Petrillo et al. suggested a longitudinal control algorithm for autonomous vehicle platoons to deal with adverse vehicleto-vehicle communication environments. For their adaptive controller design, the kinematic model with the first-order acceleration response assumption was used as a longitudinal drivetrain model [26]. Guo et al. proposed a novel adaptive hierarchical control framework to supervise the lateral motion of autonomous four-wheel independent drive electric vehicles. The framework deals with the trajectory following control problem of a class of uncertainties and disturbances [27]. Hou and Xiong presented the theoretical analysis of the bounded-input bounded-output stability. They also showed the internal stability of the full form dynamic linearizationbased model-free adaptive control scheme through the contraction mapping principle [28]. The authors conducted a simulation-based evaluation, which yielded results that verified the effectiveness of the proposed approach. Hou and Zhu developed a new type of model-free adaptive control algorithm with the compact-form-dynamic-linearizationbased controller and partial-form-dynamic-linearizationbased controller for a class of discrete-time single-input and single-output nonlinear systems [29]. Zhao et al. introduced a data-driven model-free adaptive control algorithm based on the iterative feedback tuning method for parafoil systems using only input/output data [30]. The construction process of the model-free control algorithm and its stability analysis were explained. Yuan and Wang designed a data-driven model-free adaptive control method based on the improved sliding mode control algorithm [31]. The main advantage of this algorithm is that the algorithm does not depend on a precise dynamic model of the quadrotor. An adaptive law was introduced, and a saturation function was used to improve the sliding mode control based on the dynamic characteristics of the quadrotor. Xu et al. developed modelfree adaptive discrete-time integral sliding-modeconstrained-control for autonomous 4-wheel mobile vehicle parking systems. In order to design an integral sliding mode controller, a dynamic constraint unit with an anti-windup scheme was used to address integral saturation along with a steering angle constraint to compensate and maintain a safe range [32]. A lateral motion control method has also been proposed to improve handling performance and yaw stability through the use of a backstepping variable structure. The basic concept is based on the Lyapunov stability theory and the radial basis function neural network. Artificial neural networks were designed to approximate arbitrary nonlinear functions [33]. A. Safaei et al. proposed a model-free control policy for tracking problems in robotic manipulators with any degree-of-freedoms. An assumption that the dynamics of manipulators contained bounded unknown nonlinearities and external disturbances was made [34]. M. Roohi et al. designed an adaptive model-free control method to synchronize a class of fractional-order neural networks with vast engineering and industrial applications. The adaptive model-free method-based new crypto-system algorithm was proposed for the encryption/decryption of color images from unmanned aerial vehicles [35]. R. Roman et al. proposed a novel mix of two data-driven algorithms. The approach exploits the main advantage of a data-driven virtual reference feedback tuning algorithm. This is achieved through the automatic computation of the optimal parameters [36]. A distributed model-free adaptive iterative learning control scheme was designed with a transformation technique. This ensured that all agents could keep their desired deviations from the reference trajectory over the whole-time interval. N. Wang et al. created an adaptive universe-based fuzzy control scheme with retractable fuzzy partitioning in the global universe of discourse to achieve global asymptotic modelfree trajectory-independent tracking [37]. Based on the developed control scheme, tracking errors and their derivatives globally and asymptotically converge to the origin, and all other signals of the closed-loop system were bounded. L. Zhao et al. introduced a novel real-time modelindependent control method named the model-free adaptive control method. The method was able to effectively eliminate inaccurate models' influence on trajectory tracking. The stability of the control method was deduced theoretically, and the robustness of the approach was analyzed with the Monte Carlo method [38]. Y. Ren et al. proposed a modelfree adaptive iterative learning perimeter control scheme to improve the perimeter controller's performance [39]. The controller had been tested with various control methods for a multi-region traffic network. The tests were inclusive of modeling errors, measurement noise, demand variations, and time-changing macroscopic fundamental diagrams. Simulation-based evaluation results showed that the proposed controller presented a great potential and was more resilient against errors than the standard perimeter control methods such as model predictive control and proportionalintegral control.
However, it is to be noted that these previous studies on model-free and adaptive control algorithms showed that the developed methods still required mathematical system models, parameters, and dynamics. A linear first-order delay model was used for longitudinal control in [26]. A sixdegree-of-freedom (six-DOF) dynamics model was designed for the parafoil systems in [30]. A Six degree-of-freedom model for four actuators was used for the multi-input, multioutput, strong coupling, and under-drive system in [31]. The simple kinematic and two-degree-of-freedom (2DOF) vehicle dynamics models were used separately for path tracking in [31,32,33]. Single Input-Single Output (SΙSΟ) system for arm angular position motion with nonlinear state equations was proposed in [36].
In contrast, our proposed control algorithm does not require any system parameters or mathematical models. This paper proposes a hardware and communication structure along with an appropriate software for a fail-safe emergency pullover module in a vehicle. For ease of reference, the failsafe emergency pullover module/system will simply be referred to as the fail-safe module.
The remainder of this paper is divided into four sections and organized as follows. An overview of the proposed failsafe system and a brief introduction of the controller are described in section II. Detailed explanations of the proposed controller are introduced in section III. Evaluation results of the control performance are described in section IV. Finally, the conclusion and future works are provided in section V. The main contributions of this work are summarized as follows: 1) A framework of the fail-safe emergency pullover system for the autonomous vehicle, proposed and implemented in a developed automated vehicle 2) The proposed control algorithm working on redundant hardware corresponding to autonomous level 4 3) The novelty of this study in which the proposed adaptive feedback controller does not require system parameters and a mathematical model, suitable for failsafe systems targeted at autonomous level 4 4) The performance evaluation of the system, proposed in this study conducted, under various scenarios such as an emergency stop and road shoulder parking(pullover) on an actual automated vehicle

II. OVERVIEW OF THE PROPOSED FAIL-SAFE SYSTEM IN AUTONOMOUS VEHICLES & CONCEPT OF THE PROPOSED ADAPTIVE FEEDBACK CONTROLLER
An overview of the fail-safe module for autonomous level 4 is introduced in this section. The proposed module is comprised of the hardware and the proposed algorithm. This paper will mainly focus on the algorithm. This section describes the Hardware Configurations, Failure Definitions, and the proposed algorithm. The fail-safe control is composed of two parts in terms of hardware. Under normal autonomous driving circumstances, the normal control input is calculated from the IPC (Industrial PC) and the Autobox. The input is then entered into the vehicle, as shown on the left side of Fig.1. A failsafe control input (written in bold in Fig. 1) is fed into the vehicle in the event of a failure.

B. FAILURE DEFINITION
It is to be noted that the proposed module does not encompass every possible type of vehicle failure. It has been designed to perform under communication failures between the IPC and Autobox. A detailed definition of vehicle failure for this paper is given as follows: 1. A shutdown of the upper controller resulting in the inability of the upper controller to make rational control inputs. 2. Any situation that results in a physical disconnection of CAN or Ethernet communication, where no information exchange occurs between the IPC(upper controller) and Autobox (the lower controller) Vehicle failures mentioned beyond this point in the paper will refer to the definition given above.

C. THE PROPOSED CONTROLLER
In this paper, the system hardware, communication, and algorithm are configured such that they correspond to AV level 4. Firstly, in hardware, the upper and lower controllers are divided. This division helps in responding to errors in the upper controller. Secondly, both upper and lower controllers operate on a dual decision algorithm to respond to a fault in the upper controller.
Additionally, two scenarios proposed in this paper are shown on the right side of Fig. 1. When a fault occurs, the longitudinal and lateral safety distances are obtained from the last scene information (CAN network). Control is then carried out within safe distances. The errors 1 e to 4 e have values less than the safety distance obtained from the last scene.
Evaluated vehicle test scenarios are also depicted in Fig.  1. Under normal circumstances, the normal control inputs (desired SWA and acceleration) control the vehicle. The failsafe control module in Autobox controls the vehicle when vehicle failure occurs. A functional schematic diagram of the fail-safe module introduced in the paper is shown in Fig. 2.
A previous paper conducted the vehicle tests with the fail-safe module to evaluate the applicability of the algorithms in the real world. The red regions of Fig. 2 show the module tested by our research team [13,14,15,16,22,23]. The blue region indicates an algorithm, a Lidar point cloud de-noising for adverse weather. Further details can be found under the future works section.
The main content of this paper is indicated by the green region. The proposed algorithm in this paper shows a control strategy in response to the previously defined vehicle failure situations. This algorithm does not require any mathematical models or system parameters from the upper controller (IPC), satisfying the definition of level 4 set by J3016_202104(SAE International). This fail-safe module is able to perform dynamic driving tasks, even if a driver is unable to respond to an intervention request [1,2,3,40,41].
The adaptive feedback control algorithm proposed in this study has been designed with sensitivity-based feedback gain adaptation, a cost-based learning algorithm, and sliding mode control algorithms. Referring to Fig.3, it can be seen that the control input into the vehicle is comprised of the inputs from the Sliding Mode Control block and the Feedback Control block. The Feedback Control Input is computed using the Feedback gain and State error. The gain adaptation block consists of two sub-blocks: the feedback gain block and the adaptation gain block. The feedback gain adaptation block is designed to determine the feedback gains using sensitivity and adaptation gain from the adaptation gain block with the GD method. The sensitivity estimation block's sensitivity estimates are based on the recursive least squares (RLS) method with multiple forgetting factors. Adaptation gains are identified based on distance conditions designed using state error and the time-derivative of the feedback gains with parameters from the cost-based learning block. The design is such that these parameters are determined by a map-based selection rule using the cost value computed by a cost function. The map consists of error states and parameters used for adaptation gain determination. The proportional gain η is updated using the stored data in a finite map when the change rate of the cost value has a negative value. This ensures reasonable control performance. If the change rate of the cost value is greater than or equal to zero, η is updated based on the GD method. The parameter for adaptation gains determination is adjusted using the cost-based learning algorithm. The total control input is computed by adding control input from the sliding mode control block to the feedback control input. Section III explains the detailed adaptive model-free feedback control algorithm.  Fig. 3 shows the detailed model schematics for the sensitivity-based adaptive model-free feedback control algorithm proposed in this study. Two algorithms for RLS with multiple forgetting factors have been designed for the overall adaptive model-free feedback control algorithm: RLS-1 and RLS-2. RLS-1 has been designed to estimate sensitivity using time-derivatives of state error and feedback gains. RLS-2 has been designed to determine adaptation gains based on distance conditions with proportional parameters. This proportional parameter has been tuned through a cost-based learning algorithm. The cost-based learning algorithm has been designed with a map-based selection rule and a cost value updating algorithm using cost value. The next sub-section describes the adaptive feedback control algorithm designed for this study in detail.

A. ADAPTIVE FEEDBACK CONTROL ALGORITHM
The mathematical expression of the total control input using error states and feedback gains based on feedback control law and sliding mode control input is shown below.

1) FEEDBACK GAIN ADAPTATION
In order for the adaptation of each feedback gain, the GD method has been adopted in this study. The cost function includes weighing values and error states, shown below in equation (2).
The GD method is a scalar adaptation law, based on the partial derivative of the cost function with respect to the adaptation gain, requiring adaptation gain γ . The GD method used for the adaptation of the feedback gains is as follows.
Based on the cost function defined in equation (2), equation (3) can be rewritten as follows.
The partial derivative of the state error with respect to the feedback gain is needed to determine the time derivative of feedback gain as shown in equation (4). The partial derivative in equation (4) has been defined as sensitivity S in this study. As seen in equation (4), the value of the sensitivity has an influence on the value of the feedback gain change rate. In order to ensure strict autonomous driving control stability, boundary conditions for the feedback gains have been derived. These conditions are based on an eigenvalue analysis using mathematical error dynamic models. The mathematical error dynamic models used for eigenvalue analysis are longitudinal and lateral error models for autonomous driving.

2) SLIDING MODE CONTROL
In order to compute the sliding mode control input described in equation (1), N RLS algorithms have been designed to estimate virtual coefficients in error dynamics. An assumption that the value of N is equal to two and that the input size is one by one is first made. This helps determine longitudinal acceleration and steering angle for autonomous driving. The error dynamics can be defined as follows. A and B represent virtual coefficients in error dynamics and are estimated by the RLS algorithm. The timederivative of the cost function in equation (2) can be derived by using the error dynamics in equation (5).
The disturbance boundaries 1 L and 2 L have been defined as follows to derive the sliding mode control inputs.
If 1 ε and 2 ε are positive constant values, the absolute values of the disturbances described in equation (7) are always less than or equal to the disturbance boundaries. In order to derive individual sliding mode control inputs, the following equations have been defined using injection.  (8), the time-derivative of the cost function in equation (6) can be rewritten as follows.
If the magnitudes of injection terms in equation (9) have greater or equal disturbance boundaries, the time-derivative of the cost function is always less than or equal to zero. In this study, the magnitudes of the injection terms have been defined as follows to ensure the controller's stability. 1 1 1 1

3) OVERALL CONTROL INPUT
Referring back to equation (1), the total control input can be written as follows based on the adaptive feedback control input and sliding mode control input. The total control input has been used to derive the longitudinal acceleration and steering angle.
The next sub-section describes the sensitivity estimation method using RLS with multiple forgetting factors. Proof for the stability of the proposed adaptive feedback control algorithm is also included.

B. SENSITIVITY ESTIMATION AND PROOF OF STABILITY
In this study, the defined sensitivity and adaptation gain described in equation (4) have been estimated and determined by the RLS algorithm with multiple forgetting factors [25]. For sensitivity estimation, the relationship function representing the relation between change rates of state errors and feedback gains has been proposed as follows.
represents sensitivity defined in this study, i.e. the partial derivative term in equation (4). The multiple exponential forgetting method has been adopted for sensitivity estimation as the number of sensivities is equal to . If left and right sides of equation (12) are multiplied by a small time difference dt and divided by the i-th feedback gain, equation (12) can be rewritten for the sensitivity function shown below.
( ) 1 , 1, 2, , With the assumption that the change rate of the i-th error Equation (14) is then used to estimate sensitivity. Fig. 7 shows the model schematics for RLS estimation, where  is the forgetting factor used for estimation and the number of forgetting factors is equal to N. Based on equation (14), the definition for output , regressor  and estimates  for RLS-based estimation can be given as follows.
i i y e = It was proved in a previous study that the persistent excitation (PE) condition should be satisfied for estimation error stability [26,27]. As observable in equation (16), the defined regressor  contains time derivatives of the feedback gains and thus the PE condition cannot be satisfied if the elements have zero values. However, if all elements have zero values, all state errors can be considered to have converged to zero. The directional forgetting (DF) method has been adopted for sensitivity estimation with a specific reason: it can stabilize the estimation error regardless of the PE condition [42]. The following equations define the estimates  , estimation gain , covariance , and forgetting factors s  based on the DF method. . From the RLS estimation process using equation (18)-(21), the estimates are used for feedback adaptation. Stability analysis of the proposed adaptive feedback control algorithm has been conducted using the Lyapunov direct method. For the stability analysis, the cost function in equation (2) has been used, and its time-derivative has been analyzed with the adaptation rule in equation (4). The following equation is the time-derivative of the cost function defined in equation (2).
If the time-derivative of the error is replaced with the relationship function shown in equation (13) using the feedback gain adaptation rule, equation (22) can be rewritten as follows.
( ) 1 1 By replacing the time-derivative of the feedback gain in equation (23) with the feedback adaptation rule in equation (14), equation (23) can be rewritten as follows.
( ) Equation (24) shows that the time-derivative of the cost function is always nonpositive if the weighting values and adaptation gains are positive definite. However, parameter  still needs to be designed. In this study, the adaptation gains  is determined through a method proposed based on a distance condition with RLS. It is to be noted that adaptation gains  can influence the change rate of the feedback gain.
The next sub-section describes the adaptation gain determination method using RLS with the distance condition.

C. RLS-BASED ADAPTATION GAIN DETERMINATION AND COST-BASED LEARNING ALGORITHM
For automatic adaptation gain determination, a distance condition in the feedback gain change rate is proposed in this study. This is based on the idea that the change of the feedback gain is no longer required if the value of the error state is nearly zero. The distance is the vector norm defined in the Euclidean space which represents the distance between the origin and the current point. The condition is designed such that the distance of the feedback change rate is proportional to the distance of the error state. The distance condition is derived using the adaptation rule described in equation (5) and the weighting factor used for the cost function design. The following equation shows the distance condition. Fig. 8 shows the distances defined for adaptation gain determination with weighting value in this study. η represents the proportional gain that has a positive definite value. Based on equation (4), equation (25) can be rewritten as follows for adaptation gain determination using recursive least squares with forgetting.
( ) In order to determine the adaptation gain in equation (26), the RLS-based estimation method, described in the previous section, has been used with multiple forgetting factors. If values of all error states are close to zero, a squared value of the adaptation gain can be determined to be zero. This is due to the boundary condition that the adaptation gain is non-negative. Since the feedback gain's change rate is equivalent to zero, feedback gain can be considered to have no variations. The determined adaptation gain can thus be used to compute the feedback gain change rate shown in equation (16).
In this study, the cost-based learning algorithm has been designed to determine the proportional gain η using the GD method and finite map data. Fig. 9 shows the overall flow chart of the cost-based learning algorithm. current J  and map e represent the change rate of the cost value and error states in the map respectively. From Fig. 9, it can be observed that the updating methods are determined from the sign of the change rate of the cost value.
These methods include map data-based updating and GD method-based proportional gain updating. If the change rate of the cost value is greater than or equal to zero, the determination logic of the proportional gain chooses the gain tuned with the GD method based perceptron learning algorithm [43]. If the change rate of the cost value is negative, η is updated using the error between current error and the stored error in the map with the threshold value ε . Based on the aforementioned algorithm, proportional gain can now be determined for adaptation gain estimation. Computing proportional gain when change rate of the cost value is greater than or equal to zero can be achieved by computing η using error states, learning weight, and a parameter for determining the magnitude of η . A sigmoid function has been used as an activation function for the calculation of η , shown below in equations (27) and (28). λ , dire η and η ∆ represent the learning rate, and two parameters used for the computation of learning weights respectively. C η , estimated through the RLS algorithm, represents the coefficient for determining the update direction of the proportional gain. All in all, the above equations show the process of updating η using the GD method when the change rate of the cost value is greater than or equal to zero. On the other hand, the map data is used to determine the proportional gain if the change rate of the cost value is negative. Fig. 10 shows the concept of the cost-based updating and selection process designed in this study, for this condition. As shown in Fig. 10, the size of the map is 3 N  , where N and k represent the number of rows of the map and current instance respectively. In the algorithm, comparisons and searching processes are conducted to find the used proportional gain in the map to obtain reasonable control performances. The map is then updated again using the final output  . The next section describes the performance evaluation results of the adaptive feedback controller-based fail-safe system proposed in this study.
For future research regarding the learning and selection of  , obtaining and applying the optimal activation function will be included. We also plan to develop an algorithm with an optimal parameter map that stores and updates learning based parameters while adaptively taking in the size(N) of the matrix.

IV. PERFORMANCE EVALUATION
The performance of the control strategy been evaluated via actual vehicle tests. The evaluation scenarios considered are the pull-over and emergency deceleration tests in various test tracks, as shown in Fig 15. When the predefined vehicle failure occurs, either or both of the system parameters and the vehicle mathematical model normally received from the upper controller cannot be used. In such a case, the lower controller (Autobox) is instructed to perform safety controls. Additionally, in the event of an IPC failure, the vehicle is unable to receive sensor information (e.g. Environmental sensor data). Results from autonomous driving decisions and control algorithms also cannot be retrieved. Therefore, the proposed H/W systems and the model-free controller proves to be appropriate and desirable in an autonomous vehicle aiming for autonomous level 4. The test result data was logged in the lower controller (Autobox) where the proposed algorithm was run. The detailed hardware configuration will be explained in the following subsections.

A. ACTUATOR SYSTEM MODEL IDENTIFICATION
An explanation of the actuator model and its characteristics helps provide a clearer picture of the results. The test vehicle's longitudinal control input is applied to an actuator system, known as a Polysync controller, connected to the Autobox. The Polysync controller receives a desired longitudinal acceleration command and then calculates the appropriate pedal values. In this process, possible deterioration of the control performance may occur as the vehicle is controlled through the Polysync actuator rather than a direct input of the acceleration values. Consequently, an analysis of the actuator system is required. It is to be noted once again that the controller proposed in this paper does not use vehicle dynamics or parameters. The longitudinal control performance of the vehicle will be introduced in the next subsection, which will aid in understanding the test results. As depicted in Fig. 11, the vehicle actuator system consists of the Autobox and Polysync actuator systems. The desired acceleration value is given as the input, and the brake/accelerator pedal values are the output for the actuator system.
From a vehicle control perspective, immediate vehicle responsiveness is a significant factor to consider. In an ideal actuator system, there should be no delay present between the time of the acceleration input value and the time of actual acceleration of the vehicle. Even with a delay, the delay time should be short. However, in actual vehicle actuator systems, response delays exist due to the vehicle's inherent characteristics. In this paper, the response characteristics of the actuator system are represented in a First Order Plus Dead Time (FOPDT) model, and is defined as follows:

1) VEHICLE AND EVALUATION TEST SETUP
The processor is divided into an upper controller and a lower controller: A commercial-industrial PC (IPC) is designed as the upper controller, and a MicroAutobox II (dSPACE) is used as the lower controller, considered to be more robust than the IPC.
The fail-safe module control algorithm introduced in this paper has been implemented in the lower controller(MicroAutobox II). The lower controller calculates and applies the appropriate control inputs to the vehicle actuator system (Polysync controller), shown in Fig. 13. The Polysync controller is connected to the MicroAutobox II, and the output value of the Polysync actuator controls the vehicle directly. The control output types of the two controllers are not the same, evident in Fig. 13. For the lateral control, the SWA command bypasses the Polysync actuator and directly controls the vehicle. However, for the longitudinal control, the Polysync receives the acceleration command and generates the vehicle's brake/accelerator pedal value. Information regarding surrounding obstacles is received through the 3d Lidar environment sensors. Four Velodyne 16-channel Lidar sensors are mounted on each corner of the vehicle, and one Robosense 32-channel Lidar sensor is installed to detect frontal obstacles.
The proposed algorithm has been validated through vehicle tests at the Future Mobility Technology Center (FMTC) in Gyeonggi-do Siheung-si Seoul National University. The testbed is shown in Fig.14. In the FMTC testbed, the main path and pullover path area were specifically selected to validate the longitudinal and lateral tracking control performance during the emergency pullover scenario. The designed test scenario simulated a situation where the fail-safe module was activated due to driver inaction during a vehicle failure situation.
Aforementioned in Fig. 1, the map information of the testbed contains a Safety Lateral Distance. Safety Longitudinal Distance is determined when the vehicle's upper controller fails. In other words, real-time driving distance is calculated using perception information, map information, and localization information from the upper controller. When the upper controller fails, it drives with the last fixed value of the CAN bus communication. Hence, in such a case, the Safety Longitudinal Distance would be the last value at the moment of the upper controller's (Industrial PC) failure. A detailed diagram of the hardware is depicted in the left part of Fig. 1; the crux concept of level 4 Autonomous vehicles. The AV system should respond to the fail situation, even if a human driver fails to respond appropriately to a request to intervene. [3,41] The testbed environment includes an overall path and a designed path, shown in Fig. 14. The automated driving failsafe scenario data has been collected at the FMTC test track. The straight road, gently curved road, and right-turn road scenarios were designed as shown in Fig. 14. In consideration of the complex urban road conditions, the maximum speed was set to 40 kph. In total, 622,880 samples of data were obtained from 302 fault scenarios, and the control performance was evaluated. The portion of the FMTC track tested consisted of 2 lanes : A main lane and a pullover lane. The distance between the centerline of these two lanes was measured to vary between 3.5m and 3.7m. With this information, the emergency pullover maneuver could be characterized through a lateral error indicating the lateral distance of the car to the centerline of the pullover lane. Fig. 15 (a) to (c), and Fig.16 (a) to (c) show the vehicle test results from the controller during the pull-over scenario. The figures include steering wheel angle commands, lateral errors, coefficients, feedback gains, tuning eta, and the cost function. The results of the controller's desired SWA and vehicle actual SWA are shown in Fig.15 (a). The left axis denotes the SWA value, and the right axis represents the yaw-rate value.

2) EVALUATION RESULTS
The red marker shows the initiation time of the fail-safe control. As shown in Fig. 15 (a), the proposed controller was able to track the desired SWA successfully. Fig. 15 (b) represents the lateral position error history of the subject vehicle with respect to the pull-over path. The lateral error is shown as a black line in Fig. 15 (b). Fig. 15 (c) shows the estimated coefficient results. Fig. 16 (a) shows adapted feedback gains based on adaptation rules, where no considerable variation of the feedback gain values after 5 seconds of the evaluation process could be found. The selftuning parameter is displayed in Fig. 16 (b), where chattering can be observed until the 10 second mark. Beyond that, it could be observed that a constant value was chosen by the selection algorithm proposed in this study. The cost function values for control are shown in Fig. 16 (c). The value shows a tendency to peak at the 10sec mark, maintaining a relatively constant value beyond that point. Fig. 17 (a) to (e), and Fig.18 (a) to (b) show the vehicle test results from the controller during emergency braking scenarios. The data shows longitudinal acceleration commands, distance errors, relative velocity errors, coefficients, adaptation gains, feedback gains, tuning eta, and the cost function. The results of the controller's desired longitudinal acceleration and vehicle's actual acceleration are shown in Fig.17 (a). The desired and actual results present a time delay issue previously mentioned in Fig. 12 of section IV. However, the proposed error-based methodologies take this issue into consideration. The algorithm recognizes that the error does not decrease accordingly and adaptively sets the appropriate gain values. The red marker shows the initiation time of the fail-safe control shown in Fig. 17 (a) and (b). Fig. 17 (b) shows the distance error and relative velocity error results during tracking. The left axis denotes distancer error in meters, while the right axis denotes velocity error in km/h. Fig. 17 (c) shows the adapted feedback gains according to adaptation rules, where no considerable variation of the feedback gain values after 3 seconds of the test process could be found. Fig.  17 (d) shows the estimated coefficients' results. After analyzing numerous vehicle test results, it was found that the estimated coefficient had a sizeable absolute value under longitudinal control compared to that of lateral control. However, this has no physical meaning, being only a numerical comparison. Fig. 17 (e) shows adaptation gains; the adaptation rule has been introduced in equations (26) and (27). The self-tuning parameter is displayed in Fig. 18 (a), where chattering could be observed for a small range. The cost function values for control are shown in Fig. 18 (b). The value shows a tendency to decrease and converge to zero.
In Figures 15(c), 17(d), and (e), a noticeable spike in RLS estimates can be seen with the error values remaining near 0. The RLS with the exponential forgetting method needs to satisfy the PE (Persistent Excitation) condition for stability. In order to satisfy the PE condition, significantly meaningful data needs to be sent to the RLS. However, when rich data is not sent as an input (e.g., chattering due to error values being near 0), a wind-up the phenomenon may occur. This explains the occasional spikes in data. Because these spikes can affect the stability of the control algorithm, an adaptive gain, gamma, is estimated depending on the absolute value of the error. All in all, these spikes can affect The test results of 302 fail-safe control scenarios with 622,880 total samples have been acquired and analyzed statistically. The density and frequency histogram of both errors is depicted in Fig. 19. The left axis denotes the density, i.e., the relative probability of errors, where the sum of all bars is 1. The right axis indicates the frequency, which represents the number of cases in each bin. The frequency histogram is normalized to display "relative" frequencies. As mentioned above, the longitudinal acceleration results are spread out over a wide range of error values due to the controller hardware structure. However, the longitudinal control shows desirable results for control in case of a failure situation. The second graph of Fig. 19 shows the steering controller result with a centralized distribution. The steering controller output of the proposed algorithm directly controls the vehicle without any additional controllers. As shown in Fig. 20, the proposed controller shows similar results when compared to that of the conventional sliding mode control-based algorithm in all aspects. A detailed description of the conventional SMCbased algorithm is introduced in [22,23]. Table I describes the statistical results, including the steering wheel angle error and the longitudinal acceleration errors. The statistical results show that the lateral control results are more zero-centralized than that of the longitudinal control. Derivations for the error statistics in terms of Mean Absolute Error (MAE), Standard Deviation (STD), and Root Mean Square Error (RMSE) for the vehicle test can be found in [44,45,46,47]. Meanwhile, both errors are bounded within the reliable level. The error statistics show that the proposed model-free adaptive feedback control, with sensitivity and learning approaches, is suitable for implementation in the failsafe modules for autonomous vehicles. The proposed algorithm shows similar results compared to that of the conventional SMC-based algorithms about Mean, Standard Deviation (STD), Mean Absolute Error (MAE), and Root Mean Square Error (RMSE). Despite the lack of a mathematical system model, we were able to demonstrate a reasonable performance through a model-free adaptive controller.
Numerous papers perform statistical analysis through the use of MAE, STD and RMSE [44,[50][51][52][53]. In this paper, these statistical methods were used to obtain the MAE, STD and RMSE to show the tendencies of 2 types of error. MAE characterizes the absolute mean of the difference between values predicted by the model and the actual values. Because the absolute of the mean is taken, MAE stands as an intuitive indicator. When compared to MSE, MAE is more robust to outliers. STD shows the non-negative square root of variance.  A smaller STD indicates that variabilities of the data are closer to the mean. RMSE shows the root of the sum of squared errors (Predicted Value -Actual Value), divided by sample size. The concept of RMSE is identical to that of the sum of squared errors in variance analysis. Since MSE refers to the Sum of squared errors divided by the degrees of freedom, RMSE represents the square root of MSE. In simple terms, RMSE shows how concentrated the data is around the line of best fit.
i.e. it shows the difference between the actual values and the linear model used for prediction. It can be understood as a similar concept to precision.
Reference material [48] shows how the proposed algorithm and the SMC-based algorithm is used in the test vehicle. The material shows how each algorithm is run and the methodology for switching between each algorithm in the test vehicle.
It is to be noted that in Table 1, the test scene and sample number is different for the SMC-Based algorithm and the proposed algorithm. The same tests were conducted in identical environments for both algorithms by switching between each algorithm in the test vehicle. It is indeed true that the number of tests conducted for the SMC-based algorithm is significantly smaller in comparison to the proposed algorithm. However, the 20-34 tests and the 40000 to 70000 data points collected and analyzed for the SMC-Based algorithm are by no means a small number. This is further validated in [49] which shows a Youtube video that aids in understanding Table  1 Table 1.
The novelty of the approach shows possible applications of the fail-safe module to various vehicle types. In contrast to our approach, SMC-based metrics require extensive parameter tunings to readjust to different vehicle types with differing dynamic systems to be used effectively.
The proposed controller is designed to minimize errors 1 e to 4 e rather than to directly control longitudinal acceleration error and steering wheel angle error. Therefore, a larger control performance degradation may exist when compared to a controller designed to reduce longitudinal acceleration error or SWA error directly. However, it is to be noted that the controller was designed to reduce errors numerically without the use of any vehicle dynamics. The proposed algorithm showed an overall satisfactory performance. Our research team deemed this performance good enough to be run at all times within the fail-safe module, whenever the vehicle is in use.
The width of a typical lane was assumed to be between 3.6m~4m, and a vehicle with a width of 1.8m was used as the test vehicle (The Kia Niro vehicle has 4,375mm long, 1,805mm wide). Therefore, it was reasonable to assume that the vehicle would be within the lane after the pull-over strategy was executed. Figure 20 and Table 1 show that the SWA and acceleration errors obtained were appropriate for utilization in autonomous fail-safe control.
Again, this method does not require tuning that is dependent on vehicle type. It also responds to the deterioration of actuator functions such as aging of the vehicle actuator. Therefore, we plan to further test the algorithm by targeting multiple vehicles in future research. Additionally, we plan to compare the necessity and performance of the proposed adaptive algorithm by conducting tests on actuator wear and performance degradation. Additionally, the safety evaluations of the control performance will be considered in the future through the use of safety indexes, such as TTC (Time to collision), TTC inverse, clearance.

V. CONCLUSION
In this paper, a newly designed emergency pullover algorithm for fail-safe systems in level 4 autonomous vehicles was proposed. This algorithm was developed through a sensitivity estimation-based feedback gain adaptation and cost-based learning. Under predefined vehicle failure situations (refer to section II), the algorithm was designed to take over and perform an emergency pullover maneuver. The autonomous vehicle's fail-safe module framework and control algorithm were further validated in a developed automated vehicle. Hardware, communication, and algorithm structures were proposed in accordance with autonomous level 4, as shown in Fig. 2. In the control section, sensitivity estimation and gain adaptation with the GD method was proposed. The relationship function could estimate the sensitivity of state error through the use of state error change rates and feedback gains. Sensitivity was estimated through a recursive least squares method with multiple forgetting factors using the directional forgetting method. The feedback gains are adapted by estimating the sensitivity using the GD method with state errors and adaptation gains. An effort to reduce the adaptation gain parameters was also designed in the GD method. The concept of a distance condition has been proposed, which utilizes feedback change rates and state errors in the multidimensional plane of the feedback gains' change rates.
The vehicle test results show that the proposed longitudinal and lateral control algorithm safely controls the vehicle in case of vehicle failure. The controller has been implemented in the automated vehicle to evaluate the applicability of the proposed adaptive algorithm in the real world. The testbed environment includes a straight road, a gently curved road, and a right-turn road where scenarios were designed, as shown in Fig. 14. In total, 622,880 samples of data have been obtained from 302 fault scenarios, and the control performance of the algorithm was evaluated. The control results show that the proposed sensitivity estimation-based model-free control algorithm is able to significantly reduce errors in the event of a vehicle fault. Additionally, because the proposed algorithm was designed to be model-free, the vehicle model is not expected to adversely affect the results in any significant manner.
In future research, the fail-safe module in our automated vehicle will be further developed in two aspects. Firstly, the fail-safe module perception aspect seeks to be further developed. In this aspect, we aim to detect a Lidar sensor's raw-data performance degradation through a fail-safe perception module algorithm [54][55][56][57][58]. Secondly, the fault situation aspect seeks to be further developed. In this aspect, we aim to develop a tolerant control method to cover fatal cases of an autonomous vehicle fault, excluding actuator faults.
Validating the estimation of the virtual coefficient in error dynamics for different types of vehicles will be performed in future works as well. An improvement in RLS performance seeks to be achieved in future works through the use of directional or adaptive forgetting methods to minimize the aforementioned spikes in errors.