Abstract
Very high levels of automation in road traffic are accompanied by the need for teleoperation. If the driverless autonomous vehicle is not able to solve a complex driving situation, then the problem should be solved by a teleoperated intervention by getting a human into the loop. Such a system is highly complex, interacting in a socio-technical system. Therefore, in addition to the empirical research of user-centered development of teleoperated driving, an analytical and systemic approach is crucial in the first place to understand the interrelationships between the subsystems and to optimize a teleoperated driving system. This work provides a base for the systemic consideration by taking two different perspectives focusing on the work organization and vehicle operation dealing with how many vehicles can be monitored and serviced by one operator. First, a brief analytical perspective of human reliability is taken, emphasizing the appropriate definition of the operational design domain and knowledge of its variability. Second, a comprehensive systemic, socio-technical perspective is applied using the functional resonance analysis method (FRAM) for a reflexive and computational purpose highlighting effects on operator workload and traffic performance. Finally, the implications of the research results are discussed and integrated into socio-technical interactions in everyday teleoperated driving between blunt- and sharp-end factors from a safety and reliability perspective to demonstrate the complex leverage of the work organization. Overall, the insights contribute to an enhanced understanding of the complex socio-technical interactions in teleoperated driving.
Zusammenfassung
Ein sehr hoher Automatisierungsgrad im Straßenverkehr geht mit der Notwendigkeit der Teleoperation einher. Wenn das fahrerlose autonome Fahrzeug nicht in der Lage ist, eine komplexe Fahrsituation zu lösen, dann sollte das Problem durch einen teleoperierten Eingriff gelöst werden, indem ein Mensch in die Schleife eingebunden wird. Ein solches System ist hochkomplex und interagiert in einem sozio-technischen System. Daher ist neben der empirischen Forschung zur nutzerzentrierten Entwicklung des teleoperierten Fahrens in erster Linie ein analytischer und systemischer Ansatz entscheidend, um die Zusammenhänge zwischen den Teilsystemen zu verstehen und ein teleoperiertes Gesamtfahrsystem zu optimieren. Diese Arbeit liefert eine Grundlage für die systemische Betrachtung, indem sie zwei unterschiedliche Perspektiven einnimmt, die sich auf die Arbeitsorganisation und den Fahrzeugbetrieb konzentrieren und sich mit der Frage beschäftigen, wie viele Fahrzeuge von einem Bediener überwacht und operiert werden können. Erstens wird eine kurze analytische Perspektive der menschlichen Zuverlässigkeit eingenommen, wobei der Schwerpunkt auf einer angemessenen Definition des betrieblichen Gestaltungsbereichs und der Kenntnis seiner Variabilität liegt. Zweitens wird eine umfassende systemische, soziotechnische Perspektive unter Verwendung der funktionalen Resonanzanalysemethode (FRAM) zu einem reflexiven und rechnerischen Zweck angewandt, wobei die Auswirkungen auf die Arbeitsbelastung des Bedieners und die Verkehrsleistung hervorgehoben werden. Abschließend werden die Implikationen der Forschungsergebnisse diskutiert und in soziotechnische Interaktionen im teleoperierten Fahralltag zwischen Blunt- und Sharp-End-Faktoren aus einer Sicherheits- und Zuverlässigkeitsperspektive integriert, um die komplexe Hebelwirkung der Arbeitsorganisation aufzuzeigen. Insgesamt tragen die Erkenntnisse zu einem besseren Verständnis der komplexen sozio-technischen Interaktionen beim teleoperierten Fahren bei.
1 Introduction: autonomous vehicles and teleoperation
The realization of autonomous vehicles (AV) describes the highest level of vehicle automation. At this level, an operator would no longer be required in the vehicle since the driving task in the so-called operational design domain (ODD, defined as the specific conditions under which a given driving automation system is designed to function [1]), is performed entirely by the vehicle. These complex technical systems must nevertheless be monitored by a remote operator (RO), as system limits can be reached or system errors can occur. These situations include, e.g., obstacles, bottlenecks, or incorrectly recognized so-called “ghost targets”. For example, recent reports exist about “robotaxis” of Cruise in San Francisco blocking traffic for extended periods of time by stopping at intersections and requiring human assistance before continuing their assigned route [2]. Therefore, remote monitoring becomes necessary in the operational concept and, in the cases mentioned above, also temporary guidance of the AV from a distance. Permanent and continuous guidance of the AV is also conceivable [3]. These scenarios describe a new role of human in the loop in the context of automated driving.
The SAEJ3016 [4] defines the terms remote assistance (RA) and remote driving (RD). RA refers to the strategic and tactical level of the driving task. The RO provides information or advice (e.g., waypoints, path planning, or object classification and modification [5], [6]) to an automated vehicle operating in driverless mode to assist in continuing the ride. Instead, in RD, a RO performs parts or all of the dynamic driving task (DDT) in real-time (slow speeds up to 15 km/h) that are part of the operational driving task, such as steering and acceleration. According to Majstorovic et al. [6], three different concepts can be differentiated: direct control, shared control, and trajectory guidance. In addition to RA and RD, the literature also frequently refers to remote monitoring or remote management (RM) (e.g., [5]–[9]). According to Amador et al. [7], RM should be considered separately because a RO can only act as an observer. It is a mode of operation in which there is no direct influence of the RO on the performance of the DDT, except, for example, performing system diagnostics or monitoring task status via a screen. Nevertheless, a RO could potentially intervene if necessary and switch to either RA or RD. Amador et al. [7] set the three modes structurally in relation to the SAE level of driving automation. It becomes clear that the modes partially overlap and cannot be clearly separated, and that regular and short-term transitions are necessary.
Thus, AVs create a working situation according to the classical model of telemonitoring and teleoperation. The principle is also described as early as 1992 by Sheridan in the requirements for designing the human-machine system: “Robot teleoperation makes the execution of different tasks in remote or hazardous environments possible” [10].
It is obvious that the requirements for the overall system and its subsystems should be derived from comparable applications (e.g., aviation, space travel, exploration, telemedicine) for which long-term experience is already available. The difference to the applications considered so far lies in the fact that AVs move in public spaces and encounter a large variety of road users. Therefore, it is important to distinguish continuous teleoperation from intermittent teleoperation representing different task settings for the human operator.
Usually, it is assumed that in the case of a handover to a human, a deficit in technical reliability shall be compensated by an action with high human reliability [11]. Autonomous driving under human supervision or with human actions can be understood as a task to be performed by a highly reliable human-technology system so that a defined risk is not exceeded in different traffic situations. In a multitude of research activities (e.g., [12]–[14]), attempts have been made to quantify the risks of manual vehicle guidance. These considerations also repeatedly provide a rationale for introducing automated vehicle guidance to compensate for human error. Again, studies (e.g., [15], [16]), show that automation alone does not per se lead to increased road safety and that the delegation of vehicle control back to humans in critical situations can and must also be assigned a risk value [17].
Starting from the manual driving task, the consideration leads via driver assistance and automation to teleoperation. While the role distribution between human and vehicle changes fundamentally, the traffic environment remains the same in its static and dynamic characteristics and, above all, complex. For evaluating human reliability, at least two relevant constellations come into play. One is the possible reduction of reliability due to underload during monitoring and overload in the context of takeover actions in critical situations.
Therefore, an increase in the Level of Automation does not necessarily lead to an increase in the overall reliability of the human-machine system or, moreover, the traffic system. Most importantly, increasing the Level of Automation does not mean decreasing the challenges in interaction design.
The research report about Research Questions on Highly Automated Driving [18] provides an interesting insight related to the questions that arise in the context of Level 3. Some of the questions addressed should be similarly answered for teleoperation. Examples are adequate interaction design, human reliability in takeover situations, and staffing requirements.
Overall, teleoperated driving is a complex process embedded into a socio-technical system that often involves several parallel factors such as the ODD, control level (operational, tactical, strategic), type of task, HMI, operator skills and training, and type of organization [19]. These fundamental dimensions are also interconnected, resulting in interactions that influence the design decisions of teleoperation systems. In particular, decisions in one area can have far-reaching consequences in another area.
However, although individual research has been carried out on teleoperated systems in recent years, the big picture is still incomplete as the report of the Federal Highway Research Institute Germany [20] about extensive research needs in teleoperated driving has shown. The report identifies five basic levels in the complex area of teleoperated driving:
Vehicle, area of operation, and functional safety
Ergonomics and occupational safety
Communication technology
Driving suitability, skills, and personnel requirements
Social aspects and road safety
A wide range of empirical but isolated human factors research has been accomplished in issues such as telepresence (e.g., [21], [22]), latencies (e.g., [23]–[25]), state/operational changes [19], situational awareness (e.g., [26]–[30]), workload (e.g., [23], [31]–[34]), control concepts (e.g., [6], [35]), user requirements [36] and driving qualification & training [19]. However, this research lacks a synthesized and analytical view without being clear of the relationships and interactions between the fundamental dimensions and their emergent effects on the overall system as mentioned above. For example, a valid answer on how many AVs a RO can reliably supervise and according to which principle the AVs should be assigned, is still lacking. To answer these fundamental questions, the authors propose using more analytical approaches in addition to further empirical studies. This creates the basis for more targeted empirical research. In this way, analytical approaches benefit from empirical data and vice versa. Thus, an analytical and systemic approach is crucial in the first place to understand the interrelationships between the subsystems and optimize a teleoperated driving system.
The objective of this paper is to identify the main critical success or leverage factors and their influence in the teleoperated driving system to derive implications focusing on the work organization. Therefore, two different perspectives are taken: a brief human reliability perspective to describe basic considerations and a comprehensive systemic, socio-technical perspective using the functional resonance analysis method (FRAM) [37] to provide complex considerations. In particular, FRAM is used for a reflexive and a computational purpose to provide an improved system understanding covering the intricate interdependencies and to predict the emergent system behavior through the dynamic influence of potential critical success factors, respectively.
The remainder of this paper is structured as follows. Section 2 describes a brief analytical perspective of human reliability, emphasizing the appropriate definition of the ODD and knowledge of its variability. Section 3 provides a comprehensive systemic, socio-technical perspective using the FRAM method for a reflexive and a computational purpose highlighting effects on operator workload and traffic performance. In Section 4, the implications and limitations of the research results are discussed and integrated into socio-technical interactions in teleoperated driving between blunt- and sharp-end factors from a safety and reliability perspective. Finally, a brief conclusion and outlook for future research are given in Section 5.
2 Human reliability perspective
For reliability analysis, describing the task in more detail is useful. According to Schwindt et al. [38], the tasks can be divided into the following categories: monitoring, release and deactivation, indirect control, direct control, coordination, communication, and other tasks. Further, the tasks are categorized depending on the frequently mentioned roles in the literature. A key finding is a split into the roles of dispatcher (DP) and RO: the DP’s role includes monitoring, coordination, communication, and other tasks, while the RO is responsible for release and deactivation, assuming indirect and direct control, and capable of communicating with the passengers inside and other road users outside the AV. In the rest of the paper, RO is used as a synonym for RO and DP unless otherwise indicated.
In this context, the issue quickly arises regarding the supervision ratio between RO(s) and AVs. Initial research already tackles this issue. For instance, Goodall [39] used the queuing model to estimate the number of DPs or ROs needed for a fleet of AVs. Here, the minimum number of ROs is calculated based on the fact that the probability that no free RO is available for a support request is less than the probability that a driver of a conventional vehicle is medically incapacitated. Waymo reports one takeover situation every 17,847 km [40]. Thus, with a turnaround time of one to ten minutes per request, 3.9 million Uber drivers could be replaced by fewer than 400 ROs, according to Goodall [39]. Ottopia Technologies [41] and Einride [42] take a more pragmatic approach with the golden ratio of a technical supervisor to an AV and assume that one RO can be responsible for ten AVs.
However, individual skills, general working conditions, and many influencing factors must be considered. Past activities related to teleoperation in other domains can be used as a starting point, but unfortunately, a simple transfer is impossible. First of all, the question arises whether one person should look after n AVs or, if necessary, m persons should look after n AVs. In any case, it should be true that in the case of RD, there will be a 1:1 relation due to system limits or errors. Furthermore, it is helpful to distinguish error types and to know the associated takeover scenarios. Above all, the estimation of load peaks needs to know which probability faults occur independently of each other on different AVs or under which circumstances chaining or accumulation can occur. This could be the case in the event of column driving or large-scale weather events.
From field tests and reliability observations, values may be available for a single AV as event/km, allowing a first estimation and planning. To estimate human reliability, it is crucial to determine which task is to be solved teleoperatively after a handover. Here, the reliability varies significantly between a decision task, which would consist of releasing the AV again, and AV guidance on the stabilization or maneuvering level.
Before these considerations, some considerations can be made for a human-machine system that is to perform a continuous transport function with the highest possible reliability. For the estimation of the expected human reliability, in the absence of suitable values, the figures of Swain & Guttmann [43] are first used. For an intervention on the maneuver level or the decision between alternative trajectories, estimated error probabilities of 1 × 10−2 to 3 × 10−1 would result.
The following considerations are based on notions described in VDI 4600 Part 1 [44] and VDI 4600 Part 2 [45]. Basically, it is significant if the teleoperation of a single AV should tie up the entire capacity of a RO. This would affect the availability of the other AVs of this RO. This is because if it holds that monitoring must be permanent, then the availability of a system that establishes autonomous mobility is calculated as follows:
This would mean that in a takeover scenario, the availability of the remaining AVs can be ensured by redistributing – either the teleoperation or the surveillance tasks – which requires that at least one operator is available. The probabilities-based view of availability is helpful for basic considerations and estimations. A time-based analysis would be more helpful to investigate the permanent working and operational situation. Especially the number of critical events per hour is significant for evaluating the workflow. They do not yet represent a fault situation but already require the separate attention of an AV.
In addition to considering technical and human error probabilities, a temporal consideration in the sense of Mean Time Between Failures (MTBF) is valuable and necessary. Essential for this is the estimated number of events per time and the required duration and quality of the intervention. Basically, MTBF is calculated as the sum of times between operation and failure related to the number of failures:
It should be as high as possible and is determined also by the non-operation time and the mean time to repair (MTTR). The MTBF of a serial teleoperated human-machine system (i.e., both subsystems must be available for the overall system to function) is thus calculated by:
Assuming an MTBFAV for a failure of 20 min that requires an MTTR of 5 min and an MTBFRO of 60 min (assuming a human error probability of 0.3 for the handling of only these operations) the overall system MTBF would result in 14 min.
Since it is primarily the duration of the corrective action by the RO that enters into the availability, speedy and error-free handling of events is of particular value. The human reliability or the probability of a human error cannot be considered a constant here but depends on the required actions, their duration, and especially the present time pressure. These values presumably increase if the error condition persists or occurs more frequently, thus increasing the duration of activities under these conditions. It matters whether the technical reliability is reduced by randomly distributed or systematic, temporary or permanent external events, obstacles, or vehicle systems. There is a clear difference between a single obstacle that must be bypassed compared to a sensor defect that must be permanently monitored until a possible stopping point. For permanent AV guidance at the stabilization level, the MTBFRO could, therefore, become shorter as the human reliability for this task could decrease. Therefore, technical reliability should be considered in conjunction with the MTTR, and the RO should be supported in correcting the undesired condition if possible.
Against the background of these considerations, a requirements-oriented estimation is also possible. This can provide important information for the design of the technical system or the definition of the ODD. An alternative consideration arises if one takes the perspective of a mobility provider or user who desires the highest possible acceptable MTBF of the human-machine system. Furthermore, a high MTBF is essential for traffic flow in road traffic. The considerations above show that for a high MTBF of the overall system, extraordinarily high reliability of the technical system is crucial since human actions could only reduce the occurring downtimes by preventive interventions if considering a parallel teleoperated human-machine system (i.e., only one of the subsystems must be available for the overall system to function). So far, however, this has not been provided for. Therefore, the appropriate definition of the ODD and knowledge of its variability is a critical success factor.
3 A socio-technical systems perspective
These simplified considerations on human reliability and system availability show that it is reasonable to consider a systemic approach to understanding the interrelationships between the subsystems and optimizing a teleoperated mobility system. Concerning this systemic perspective, there has already been research by Hoffmann & Diermeyer [46], who carried out a System-Theoretic Process Analysis (STPA) of the teleoperated system to systematically identify and assess the potential hazards with a strong focus on the operational level of the various structural system components. Furthermore, Parr et al. [47] used operator sequence diagrams to assess different teleoperation types in relevant scenarios and to draw conclusions about the RO’s role and tasks.
To characterize teleoperated driving in a multidimensional and holistic manner, however, a socio-technical and systemic approach that focuses on the interaction of people, technology, and organization leading to emergent system behavior should be chosen. In general, systemic methods and models such as Accimap [48], Systems-theoretic accident model and processes (STAMP; [49]), or FRAM are most suitable for this purpose in the context of the road system complexity (cf. [50], [51]). However, FRAM is considered the most recent and promising step to understanding socio-technical systems [52]. Moreover, FRAM was already successfully applied by Grabbe et al. [50], [53] to compare the road traffic system performance between automated vehicles and drivers in an overtaking scenario which demonstrates FRAM’s huge potential. Thus, FRAM is chosen for the socio-technical system analysis of teleoperated driving.
In this work, FRAM is used to provide two distinct epistemological perspectives (cf. [54]). First, a phenomenological perspective (reflexive FRAM) is applied to gain an improved system understanding that underlies the functional interactions between system elements. Especially, a generic FRAM model is created to enable a synthesis of a diverse set of knowledge, experiences, and interpretations for future research distinguishing different purposes and contexts. Second, a realist perspective (computational FRAM) is taken to quantifiably predict the emergent system behavior through the variable influence of potential critical success factors. It should be noted that the integration of the metadata functionality (i.e. quantitative simulation) is quite complex. Therefore, we reduced the complexity of the reflexive FRAM model into a smaller one named computational FRAM model as a starting base. In the future, it is planned that the quantitative simulation will be increased step by step aligned to the reflexive FRAM model and also beyond.
3.1 The functional resonance analysis method
This section provides a brief overview of the theory and application of FRAM based on Hollnagel [37]. In general, FRAM is used as a generic, agnostic method to create a representation – a so-called model – of how work is actually done. The purpose of the model is to describe and understand what happens in a socio-technical system in terms of functions and not components. These functions describe activities or processes whose produced outputs are coupled to achieve a system goal. It is explicitly described for each function in the form of “production rules” (internal processes) and how these outputs are generated is defined by the coupled aspects. This enables to create a white-box model to understand the inner workings of a system rather than a black-box model that focuses on the outcome of the input-output relation. A FRAM model focuses on interactions and interdependencies between activities and agents in the system, as well as everyday performance adjustments that typically help keep things going right. In rare cases, the performance adjustments aggregate and propagate in unexpected ways, leading to functional resonances, with accidents being the worst consequence. This approach helps to identify potential conflicts in the flow of interactions in complex systems. Due to its high flexibility and capacity to unify a wide variety of data sources (qualitative and quantitative), FRAM is a good starting point for systemic modeling on which further methods and models can be built. Ultimately, a FRAM model gives insights into where to look in a system by better defining what the problem actually is and asking better questions.
FRAM is based on four principles (equivalence of success and failure, approximate adjustments, emergence, and functional resonance) and follows four steps (modeling the system by identifying its functions, identifying the performance variability of the functions, aggregating the variability, and managing the variability). In the first step, the fundamental functions of a system are identified to construct a model. Each function is characterized by six key aspects – input, output, precondition, resource, control, and time – which couple each function to several others, forming a specific instantiation of the model typically represented graphically as hexagons. The second step involves specifying the performance variability of each function, which can be simply described using two phenotypes: timing and precision. In the third step, this variability is aggregated to analyze how it propagates through the system, identifying where functional resonance occurs and leads to adverse outcomes. This is done by defining upstream-downstream couplings, where variability in upstream functions, such as variable outputs used as inputs or resources, influences the variability of downstream functions. The fourth and final step focuses on monitoring and managing the identified performance variability to ensure the system’s safety and performance. More details concerning the theoretical background or the state of the art can be found in Hollnagel [37] and Patriarca et al. [55], respectively.
3.2 Application of FRAM on teleoperated driving
3.2.1 Methods
This section provides a comprehensive description of the applied methods starting with the scope of analysis and then following the four steps of FRAM and their adaptations implemented in this work. Overall, two different FRAM models are developed: a sophisticated model for the reflexive purpose and a simplified model for the computational purpose. Each step provides information for both models.
3.2.1.1 FRAM step 0: Description of scenario – setting the scope of analysis
The sophisticated, reflexive FRAM model presents a generic FRAM model describing a teleoperated level 4/5 AV in public ODD with mixed traffic, considering various agents in general. It represents teleoperation in an abstract form as a complex socio-technical system that is generally valid and usable as a generic “toy-model” for expansion, quantification, and further deepening concerning specific purposes and contexts. The model strives for both, on the one hand, to formally describe and better understand the complex socio-technical interactions and, on the other hand, to better define the problem space and to identify the most relevant leverage points in the system to optimize the system performance concerning safety, efficiency, and satisfaction for all agents. Based on this, final requirements and guidelines for the system design can be defined and used for standardization. The model will be available for other researchers and their contributions to refine the model structure for future research (Supplementary Materials).
Instead, the simplified, computational FRAM model represents the sophisticated FRAM model by reduced complexity. It exhibits explicit, quantifiable assumptions and parameters about the influence of supervision ratio, takeover probabilities, and RO roles on workload, execution times, traffic, and other performance metrics, which will be described in more detail below. It replicates the ride of one or up to ten autonomous shuttles (SAE Level 4/5) in urban road traffic (see Figure 1). The shuttles transport passengers from a starting point to their destination, covering a distance of 20 km. The ride would take 60 min without any takeover request, given an average speed of 20 km/h for buses [56]. Teleoperation takeover requests by RO and DP can appear as RA, RD, and proactively from RM. Also, the interaction between the AV and other road users is included.
Schematic overview of the use case for the computational FRAM model.
3.2.1.2 FRAM step 1: Function identification – Literature review and interviews
Both FRAM models are based on a comprehensive literature review on teleoperated driving following a light PRISMA procedure resulting in a total of 77 sources. The goal was to identify essential agents and functions in the system. In addition, semi-structured interviews were used to enrich information for developing a FRAM model of teleoperated driving. The interview guide (see Appendix A) consists of a general entry question, three main question blocks addressing specific issues, and a general outro question. The broad entry question allowed participants to share their experience and knowledge of the teleoperation process which can reveal valuable information about the agents, functions, aspects, and likely variability related to the FRAM model (cf. [57]). The first question block was about use cases, takeover scenarios, and their frequency. The second block of questions focused on the RO tasks and splitting them into different roles. The last block of questions was dedicated to the RO performance and its variability. The interview concluded with an open question about further information and aspects from the expert that might not have been covered and are important for the research.
Seven participants, two females and five males, were interviewed for this study. All participants received comprehensive information about the study’s scope and interview content in advance and signed a consent. Five participants worked in academia and research, while the remaining two worked for industrial companies working on teleoperation solutions. All participants had experience in teleoperated driving rather from the perspective of the system design engineer than the operational dimension of the RO, ranging from one to four years.
The interviews were held online allowing the recording of the audio to transcribe the interview and lasted 60 min. The transcription was implemented by using the software Condens. Finally, a qualitative content analysis, according to Mayring [58], was conducted to create a set of categories that serve as an essential means of analysis. This resulted in the following categories: process of teleoperation in road traffic and associated requirements involving all agents, teleoperation use cases and takeover scenarios, frequency and reasons for teleoperation takeovers, tasks of the RO and their distribution into different roles, remote monitoring, performance variability of ROs, and challenges of teleoperation in road traffic.
Both FRAM models were produced using the software FRAM Model Visualiser (FMV) [59] Pro 2.1. Furthermore, the models were verified by checking and adjusting for consistency and completeness about the syntactical and logical correctness using the FRAM Model Interpreter (FMI) [60]. Finally, the models were facely validated by subject matter experts. The recent addition of metadata in the software (cf. [61]) was used in the simplified FRAM model to model quantitatively the emergent system behaviour.
3.2.1.3 FRAM step 2: Describing performance
The sophisticated FRAM model does not include any description or data of performance. However, the simplified FRAM model covers explicit parameters about the influence of the three independent variables supervision ratio, takeover probabilities, and RO roles on the following dependent variables: workload, execution times, traffic, and system performance metrics, i.e. efficiency, traffic flow, passenger satisfaction, and safety. The independent variables are explained in the next third step, whereas the dependent variables, implemented as metadata, represent the performance variability and are thus described below in Table 1. It should be noted that the basic functioning of the computational FRAM model is explained in Section 3.2.2 providing more details about the functions and couplings.
Overview of dependent variables assigned to functions of agents in the simplified FRAM model.
| Agent | Function | Variable (metadata) | Variable output (Value) |
|---|---|---|---|
| Remote operator (RO)/Dispatcher (DP) | to monitor remotely (RM) | Workload | −2/−4 (no takeover) +3 (DP handover to RO) |
| to takeover proactively | Workload | +3 | |
| Execution time | 0–1 min | ||
| to assist remotely (RA) | Workload | +5 | |
| Execution time | 2–4 min | ||
| to drive remotely (RD) | Workload | +15 | |
| Execution time | 3–5 min | ||
| Autonomous vehicle (AV) | to drive | Speed | 0.16–0.33 km/min |
| Execution time | 1 min | ||
| Other road users | to provide traffic | Traffic influence | 0.5–1 |
| All | System performance metrics | Efficiency | Arrival time (1–10) |
| Passenger satisfaction | Arrival time & number of takeovers (1–10) | ||
| Traffic flow | Mileage/time (1–10) | ||
| Safety | Workload & number of takeovers (1–10) |
3.2.1.3.1 Workload
The workload of the RO and DP ranges from 0 % to 100 % and is assumed to start at 50 % in the model. Levels below 30 % and above 70 % are generally associated with a decline in performance, according to Cummings et al. [62]. Thus, workload levels lower than 30 % and greater than 70 % are linked to increased execution times required for an RA or RD takeover request, or a proactive RM takeover. In the model, workload levels of 0 % (considered ‘boring’) and 100 % (considered ‘stressful’) are assumed to have the same negative effect on RO performance. The ideal range is between 30 % and 70 %, resulting in the best possible execution time for a respective takeover. Although the time needed for a takeover varies with RO’s workload, the model assumes that the workload demand added by the takeover is constant. According to the interviews, RD takeovers result in a significantly higher workload for the RO than RA or proactive takeovers through RM. Therefore, the workload added is assumed to be 5 % for RA, 15 % for RD, and 3 % for proactive takeovers. The workload of the RO increases during takeovers but decreases when no takeovers are required. When no takeovers are necessary the RO workload is estimated to decrease by 2 % per minute of operation if roles are not split and by 4 % per minute of operation if roles are split into RO and DP. For every takeover request handed over to the RO, the increase in DP workload level is assumed to be 3 %. The DP workload is estimated to decrease by 2 % per minute of operation when no takeovers are necessary.
3.2.1.3.2 Execution times
The takeover times for RA and RD range between two to 4 min and three to 5 min, respectively, depending on the current RO workload. This includes the time needed for a minimal-risk maneuver (MRM) before the takeover, which is assumed to be 1 min. When the RO or DP proactively takes over from RM, the time for the MRM can be reduced in relation to the current workload. The range for this takeover is assumed to be between 0 and 1 min.
3.2.1.3.3 Traffic influence
Another dependent variable to consider is the effect of AVs on traffic (i.e. other road users) along the ride. Due to RA or RD takeovers, traffic flow decreases when an AV reaches a standstill. An uninterrupted ride, on the other hand, increases traffic flow with every minute passed. It is important to note that if several remote takeovers occur within a short time, traffic flow will be worse than if the same number of takeovers arise over a more extended period. The AV drives at lower speeds than the assumed 20 km/h with worse traffic flow. Additionally, the minimum AV speed is set to 10 km/h.
3.2.1.3.4 System performance metrics
Additionally, the system’s efficiency, passenger satisfaction, traffic flow, and safety are quantified using a scale of one to ten, with ten being the best possible value and one the worst. The metrics are measured as follows.
Efficiency depends on the time required for the final AV to complete its 20 km ride. This metric worsens the later the AVs finish their trip than the 60 min without needing a teleoperation takeover. The metric reaches its lowest possible value when the ride time exceeds 90 min.
Passenger satisfaction depends on the system’s efficiency because passengers desire to arrive at their destination on time. Additionally, it is assumed that after a certain number of RA, RD, and proactive RM takeovers, passenger satisfaction is negatively impacted, regardless of punctuality. To illustrate, if there are more than four takeovers but the efficiency metric is ten, it follows that passenger satisfaction cannot be better than nine.
Traffic flow is calculated by dividing the mileage covered by the time taken every minute during the ride. This dynamic metric decreases traffic flow when the AV reaches a standstill due to RA/RD takeovers and increases traffic flow with every minute of an uninterrupted ride.
Safety depends on the current workload of the RO and the total number of takeovers. It is important to note that this metric is based on these two variables and cannot be considered a direct measure of road traffic safety in general. Safety is optimal when workload levels are between 30 % and 70 %, and it degrades as the workload approaches 0 % or 100 %. In addition, if a certain number of takeovers occur during the trip, this metric may not reach the optimal value even if the workload remains between 30 % and 70 % until the ride’s end.
Overall, the operational use case illustrates an everyday scenario not including any edge cases. Therefore, several general assumptions had to be made to enable a quantitative analysis by limiting system complexity:
No passenger emergencies during the ride
Maintenance and bluelight organizations are not considered
No issues in transmission quality (e.g., latency)
The remote workstation is fixed and well-designed with no influence on RO workload or takeover quality and times
Regardless of takeover requests, the AV drives error-free
Communication of AV and RO (internal/external HMI) with passengers or other road users is not considered
The standstill is only resolved after the takeover request has been successfully resolved by the RO due to short interventions in terms of time and mileage
Other road users are affected by takeovers and standstill time of the AV but not by the performance of the RO
Well-qualified and highly trained RO with no performance errors, but varying execution times and adding or subtraction of workload
Multiple takeover requests can occur simultaneously, but the RO can only process the takeovers sequentially one after the other
No differentiated prioritization strategies in case of queuing such as first in and first out, late arrival, task difficulty and duration, or urgency
Large fleets including shift work and flexible workers supporting in peak times are not considered, thus, the RO is responsible for a fixed group of vehicles, not switching to another fleet
3.2.1.4 FRAM step 3: Performance aggregation – Quantitative analysis using metadata
The performance aggregation in the sophisticated reflexive FRAM model is achieved through the consideration of interactions of functions in the system. The interactions are represented by the number of up- and downlinks, as well as the number of coupled agents for each function.
The quantitative analysis of performance aggregation for the simplified computational FRAM model is implemented by the impact of the three independent variables of supervision ratio, takeover probabilities, and role model on the teleoperation ride, specifically on the RO and DP workload, which is described below.
3.2.1.4.1 Supervision ratio
The first variable to consider is the number of AVs one RO can supervise. The model will use three ratios (RO: AV(s)): 1:1, 1:5, and 1:10. The highest ratio, 1:10, is chosen as it is discussed as the golden ratio in teleoperation (see Section 2). The supervision ratio affects the number of takeovers and potential standstill times of the AVs due to queuing if more than one AV has a takeover request simultaneously.
3.2.1.4.2 Takeover probabilities
The second variable is related to different takeover scenarios, which describe how often an AV needs an RA, RD, or RM proactive takeover. The scenarios are divided into three categories based on findings from interviews, as no data is currently available on this matter. The numbers can, therefore, be seen as a current estimation from the experts interviewed and are related to the current capabilities of automated driving systems in urban road traffic. Scenarios differ in how often a particular takeover will be needed on average from the AV over 60 min. They range from ‘Low’ to ‘Base’ to ‘High’. Table 2 depicts the average hourly takeover events implemented in the model, resulting from combining the supervision ratio and takeover scenarios.
Average of takeover events per hour for the combination of supervision ratio, operator mode, and number of takeovers.
| Supervision ratio (RO: AV(s)) | ||||
|---|---|---|---|---|
| Operator mode | Takeover scenario | 1:1 | 1:5 | 1:10 |
| Remote Assistance (RA) | Low | 2 | 10 | 20 |
| Base | 4 | 20 | 40 | |
| High | 6 | 30 | 60 | |
| Remote Driving (RD) or Proactive Takeover from Remote Monitoring (RM) | Low | 0.5 | 2.5 | 5 |
| Base | 1 | 5 | 10 | |
| High | 1.5 | 7.5 | 15 | |
Examining the combination of the takeover scenario labeled ‘Base’ and a supervision ratio of 1:1, for instance, would result in an average of four RA takeover requests and one RD/RM request each per hour. Based on the interviews, it is evident that RA takeovers occur more frequently than RD/RM takeovers. RA is less stressful for the RO and has less stringent transmission and latency requirements. Therefore, if the takeover request is not time-critical, RA should be the primary takeover mode. This assumption is also supported by Andersson et al. [63]. Furthermore, proactive takeovers from RM are assumed to have the same probability as RD takeovers.
3.2.1.4.3 Remote operator roles
The third variable is whether the tasks of the RO are split into different roles. This work follows the approach of Schwindt et al. [38], who divided the roles into the RO and DP. When roles are split, the RO is responsible for RA and RD takeovers. At the same time, the DP takes over the RM task and assigns the RO with incoming takeover requests from the AV. If roles are not split, the RO is responsible for all mentioned tasks. The role model affects the workload as described above.
Combining the variables results in 18 possible instantiations. All instantiations are iterated through 1,000 runs by using Monte-Carlo simulation to approximate values as realistically as possible.
3.2.1.5 FRAM step 4: Performance monitoring
In the reflexive FRAM, a simple analysis of the number of up- and downlinks, as well as the number of coupled agents, is helpful in showing crucial functions for system success and resilience. It is assumed that the more interactions, the higher the importance of the function for system success because such functions represent potential candidates for undesirable functional resonance.
In the computational FRAM model, first, the different instantiations are analyzed to determine how they affect the workload of the RO or DP. Based on this, feasible instantiations resulting in a manageable workload for the RO over 60 min are identified. Here, workload levels staying between 30 % and 70 % over the first 60 min are assumed to be feasible. Finally, all feasible instantiations are evaluated in terms of the system performance metrics as mentioned above. Here, values on the scale of above seven for each metric are aspired.
3.2.2 Results
This section provides the results for the reflexive and computational FRAM model. In both cases, first, the resulting model and its functioning is explained, and, second, the analysis results are shown and interpreted.
3.2.2.1 Reflexive – A generic FRAM model of teleoperated driving
3.2.2.1.1 Model structure and functioning
Figure 2 illustrates the generic and reflexive FRAM model of teleoperated driving. Basically, an operational (blue) and an abstract level (orange) are distinguished. The operational level represents the actual holistic process of teleoperation. In contrast, the abstract level depicts potential influencing factors (lower part) on the teleoperation process or societal and functional system goals (right part). Table 3 provides an overview of the various agents distinguished by color.
The reflexive generic FRAM model of teleoperated driving distinguishing an operational and abstract level.
Overview of agents distinguished by color and assigned to operational or abstract level in the reflexive FRAM model.
| Operational level | Abstract level |
|---|---|
| Passengers (yellow) | Societal aspects/functional purpose (purple) |
| Autonomous vehicle (AV) (blue) | Teleoperation service provider (red) |
| Communication technology/workstation (orange) | Original equipment manufacturer (OEM) (grey) |
| Remote operator (RO) (green) | Environment (light green) |
| Other road users (pink) | |
| Blue light organizations (brown) | |
| Maintenance service (light blue) |
The model aims to demonstrate the achievement of a well-performed ride from place A to B in terms of safety, efficiency (time), traffic flow, and passenger satisfaction. The operational level can be divided into three basic phases:
Start from place A
Riding from place A to B:
Ride/Remote operation
Ride
Remote operation
Approaching place B as the destination
During the ride, the AV operates the vehicle. Instead, in remote operation due to an incident and request by the AV, the RO is operating the vehicle. The functions can belong to either one phase or to both. The following explains the operational process and its functions in more detail following the different agents and their interdependencies.
Passengers enter the AV and enter a desired destination, enjoy the ride, and exit the vehicle when the destination arrives. In case of an emergency, passengers can communicate with the RO.
The AV completes the ride from A to B, preferably without any intervention of the RO, and eventually reaches destination B. There are three possibilities for an interruption: system limit, system error, or an emergency (detected by AV or reported by passengers). In case of interruption, the AV performs a minimal risk maneuver (MRM), braking into a standstill, and requests a RO via remote connection. In addition, the AV can communicate with other road users utilizing external communication or with passengers using internal communication. The AV also provides real-time information about the ride to the RO, including environment, vehicle, system, and passenger status.
The RO monitors the ride and decides whether to intervene prematurely or, if there is a request or interruption, to assist, drive, or deal with an emergency. The RO evaluates and prioritizes takeover requests based on urgency and context. To provide RA, the RO must first gain situational awareness of the takeover situation. Then, the RO can guide and instruct the AV, such as selecting a suggested trajectory or classifying an unknown object. To provide RD, the RO must first gain situational awareness of the takeover situation. Then, the RO must perform driving tasks, including steering, acceleration, and communicating with other road users if necessary. These tasks are performed in parallel and are interconnected. During driving maneuvers, the RO must continuously observe traffic and follow the rules. In an emergency, the RO communicates with the passengers and notifies blue light organizations. These then resolve the emergency and, in turn, notify the RO. If an incident cannot be resolved, the RO contacts a maintenance service that resolves the problem on-site with assistance from the RO. When an incident is resolved, the RO signals the AV to proceed with the DDT. The RO uses communication technologies, including a remote workstation, a remote connection, infrastructure/environmental data (sensors on site), and the data from the vehicle to perform its activities.
At the abstract level, various organizational functions, e.g., the determination of the ODD, ensuring functional safety, or providing internal and external communication by the OEM and selection processes and training measures for the RO invented by the teleoperation service provider, can influence the entire teleoperation process. In addition, certain functions of the operational process determine the functional goals or societal aspects (safety, time efficiency, efficient traffic flow, passenger satisfaction), which influence each other.
3.2.2.1.2 Analysis results
In the following, some insights based on the FRAM model are presented. First, starting at the operational level. It becomes evident that the performance of the AV is the most crucial factor in reaching the destination by striving for incidents (i.e., system limits and errors or emergencies) as low as possible. This is in line with the requirement by the human reliability perspective formulated in Section 2 that, for a high MTBF of the overall system, an extraordinarily high reliability of the AV is crucial. This underlines the appropriate definition of the ODD and knowledge of its variability.
However, the RO becomes a crucial role by remotely monitoring the AV’s driving performance to anticipate potential incidents, which is decisive in reducing the occurring downtimes through preventive interventions. This fact emphasizes the need for good coordination and communication between the DP and RO. In general, every incident represents a hazard to destabilize the system. Therefore, the DP and RO should perform a proactive role in addition to the reactive role.
Figures 3 and 4 depict the interaction analysis at the operational and abstract levels, respectively. Several functions on the operational level are highly connected (e.g., more than 15 up- and downlinks in sum and at least 4 coupled agents) and, therefore, represent potential candidates for undesirable functional resonance:
to drive the vehicle physically (AV)
to provide remote connection (Remote system)
to operate remotely (RO)
to monitor remotely (RO)
to inform vehicle (RO)
The number of uplinks, downlinks, and coupled agents of functions on the operational level. The respective color in the background highlights the agent of the functions.
The number of uplinks, downlinks, and coupled agents of functions on the abstract level. The respective color in the background highlights the agent of the functions.
Here, again, the crucial roles of the AV’s driving performance and the proactive monitoring of the RO become evident. In addition, the remote connection stability (e.g., delay), the RO’s remote operation (RA, RD, RM, emergency handling, or maintenance assistance), and informing of the vehicle (solved incidents or anticipative actions) are decisive factors. Furthermore, these functions are highly interdependent as the AV’s driving performance evokes potential interventions by the RO, and in turn, the RO’s monitoring and operation impact the riding progress of the AV. Moreover, the remote connection represents the linkage between the functions of both interacting agents. It must be emphasized that the remote-control station’s HMI also constitutes an essential role in the linkage but to a lower extent than the aforementioned functions.
At the abstract level, the following applies. The environment (e.g., infrastructure, weather) may have a strong influence, in particular, affecting the AV’s driving performance and the stability of the remote connection. This underlines the importance of the ODD. Additionally, the teleoperation service provider can have a strong impact by providing proper training for the RO, selecting appropriate ROs, and organizing the working conditions (i.e., RO-AV ratio, e.g., 1:1, 1:N, or M:N). Moreover, the functional goals of safety, time efficiency, and efficient traffic flow have a higher interaction effect on the performance of the teleoperation service than passenger satisfaction. Also, these partly contradicting goals influence each other, where an appropriate trade-off must be identified. Interestingly, the three main interacting goals all have the same four upstream functions: the AV’s performance of the DDT and execution of a potential MRM, the RO’s operation in case of incidents or anticipative interventions, and the behavior of other road users. This shows that, in addition to the supposed main actors, AV and RO, the integration into the overall traffic in interaction with other road users is essential. In particular, communication and interaction during teleoperation is vital to ensure safe and efficient overall traffic. That is why the interactions between different HMIs in automated driving (cf. [64]) must be synchronized with the teleoperation control station’s HMIs.
3.2.2.2 Computational – emergent system behavior modeling
3.2.2.2.1 Model structure and functioning
Figure 5 shows the simplified computational FRAM model for a 1:1 supervision ratio. It consists of seven foreground functions and four background functions representing the essential functions of three agents: AV, RO, and other road users.
The computational FRAM model of teleoperated driving.
In the following, the basic reasoning is explained. The detailed dependent and independent variables representing the performance variability and aggregation were already described previously in Section 3.2.1.
The AV (blue functions) is divided into driving and the possibility of reaching a system limit/failure. The output of the driving function is mileage per time and the outputs of the system limit/failure function are no takeover required or takeover required by a proactive intervention, RA, or RD. A system limit/failure can only occur while driving. Until the AV reaches its destination after 20 km, the ride is ended.
The other road users (pink function) represent the traffic and are influenced by the AVs performance in terms of required takeovers by the RO resulting in a traffic flow. In turn, the traffic can affect the speed of the AV.
The RO (green functions) is monitoring the AV resulting in four possible outputs: no takeover required leading to a continued drive of the AV or takeover required resulting in a proactive intervention, RA, or RD. In case of a takeover, the AV is in a standstill mode and cannot drive until the RO has solved the issue.
All foreground functions except the system limit/failure function affect the system performance metrics. Overall, the model runs through the functions iteratively until the end of the AVs ride is reached at 20 km. This results in a dynamic system behavior over time. In principle, two different loops can be distinguished: a drive loop (top) and a takeover loop (bottom). Once the ride begins, the drive loop is activated and the AV starts driving. Every minute, the vehicle has a probability of requesting an RA, RD, or proactive takeover. If a takeover is not required, the drive loop will return to the drive function and add mileage to the journey. However, if a takeover is necessary, then the takeover loop is activated. This starts the RA, RD, or proactive takeover functions corresponding to the required takeover mode. Once the takeover is completed, the drive loop is activated, and the AV continues its ride.
The takeover probabilities and the role model do not affect the functional structure of the model, instead, some metadata values are changed as described in Section 3.2.1. In terms of the supervision ratio of 1:5 and 1:10, the computational FRAM model changes in such a way that the drive loop including the functions of the AV and other road users is duplicated according to the numbers of supervised AVs. All other functions remain the same. This has two consequences: first, from the perspective of the RO the accumulated takeover probability for all AVs increases, and, second, as the RO can only manage one takeover request, multiple simultaneous takeover requests result in queuing and therefore lead to standstill times of the AVs. The following simple and fixed prioritization strategy is applied based on the consecutive numbering of the AVs from one to ten: the lower numbers are preferred to the higher numbers. More differentiated strategies are discussed in Section 4.
3.2.2.2.2 Analysis results
The results highlight RO’s and DP’s workload level changes based on the different instantiations to identify feasible instantiations. In addition, the system performance metrics are compared between feasible instantiations. Two out of the 18 possible instantiations were excluded beforehand. This was due to the 1:10 supervision ratio and the ‘High’ takeover probability, which would result in a guaranteed takeover every minute, leaving no opportunity for the operator to rest. The remaining 16 instantiations were analyzed to determine the RO’s and DP’s workload levels in percent over 60 min (see Figure 6). The results are based on an average of the 1,000 iterations for each instantiation using the Monte Carlo simulation. Workload levels above 70 % and below 30 %, leading to decreased performance due to boredom or overload, are highlighted in red. While levels between 30 % and 70 %, leading to optimal performance, are highlighted in green. This allows for better visualization of feasible instantiations where the workload constantly varies within the optimal workload range over 60 min.
Results of remote operator and dispatcher workload levels in percent for each instantiation.
It can be seen that in most instantiations a workload level in the red zone is reached before 20 min or before 40 min at the latest, from which the operator does not recover. Also, all 1:1 supervision instantiations result in boredom. Finally, only three instantiations result in a manageable workload level over 60 min, given the parameters and assumptions used in the model:
1:5 | Low | No split of roles (RO)
1:5 | Base | Split of roles (RO & DP)
1:10 | Low | Split of roles (RO & DP)
Figure 7 illustrates the potential variance of workload levels for the three feasible instantiations by visualizing the dispersion of all iterations for each instantiation. It is shown that variance increases over time and that minima and maxima of workload levels may fall outside the manageable range.
Variance of the workload for the three feasible instantiations over 1,000 runs.
Figure 8 presents the workload levels continuously over time for the three feasible instantiations (labeled 1–3) and two non-feasible instantiations (labeled 4 and 5) depicting low and high workloads. For each instantiation, one sample dataset was selected from the 1,000 iterations. It shows a well-balanced increase in workload due to takeovers and a decline in workload when no vehicle requests an issue. As a result, RO and DP workload levels range between 30 % and 70 %. However, the graphs labeled 4 and 5 display demonstrate how the operators quickly become bored when no takeovers occur or overloaded when there is insufficient time between takeovers to recover.
Continuous changes of the remote operator and dispatcher workload levels over 60 min.
In addition to the workload analysis, the system performance metrics are compared between the three feasible instantiations and the instantiations leading to boredom (see Figure 9). These are included because the workload could be increased artificially by non-driving related tasks to shift the workload into the manageable zone. The four system performance metrics are evaluated over 60 min and at the time when the last AV arrives at the destination. Also, the concrete arrival time is given. The color scale for the metrics is as follows: green (10–7), yellow (7–4), and red (4–1) depicting optimal, acceptable, and critical values.
Results of the system performance metrics for 1:1 instantiations and for the three feasible instantiations.
For the feasible instantiations, it can be observed that during the first 60 min of the ride, all metrics are optimal. However, when examining the metrics after the last AV has reached its destination, it is evident that all metrics, except for traffic flow, are critical. This can be attributed to a high number of takeovers and high standstill times of AVs due to queuing. Instead, the instantiations with a 1:1 supervision ratio demonstrate better values in the long-term in terms of the system performance metrics. The safety metric still drops into a red scale for every instantiation due to the low workload levels of the operator. But this could be prevented by artificially increasing operator workload levels. It is essential to analyze the remaining metrics to evaluate whether the combination of variables would be feasible. Traffic flow, passenger satisfaction, and efficiency are optimal over 60 min, and also in the long-term for the ‘Low’ takeover scenario. However, the medium and high takeover scenarios still lead to a drop in performance.
4 Discussion
4.1 Summary of research findings and derivation of implications
The human reliability perspective shows that for a sequential teleoperated human-machine system (i.e., only reactive takeovers and no preventive interventions by a RO) targeting a high MTBF of the overall system, extraordinarily high reliability of the technical system is still crucial even if a human operator is in the loop. This requires an appropriate definition of the ODD and knowledge of its variability as well as fleet size. However, to reduce occurring downtimes by preventive interventions of a RO, a parallel teleoperated human-machine system must be considered. Such a system design requires permanent monitoring by the RO which affects the operator workload, supervision ratio, and role model. The sequential or parallel teleoperated human-machine system should mainly be used for a small or large ODD and high or low AV reliability, respectively.
The socio-technical perspective shows the following complex insights. At the operational level, it becomes evident that the performance of the AV in terms of takeover probability is the most crucial factor in reaching the destination by striving for incidents (i.e., system limits and errors or emergencies) as low as possible. This underlines the appropriate definition of the ODD and knowledge of its variability. In general, every incident represents a hazard to destabilize the system. Therefore, the DP and RO should perform a proactive role in addition to the reactive role. Here, the RO becomes a crucial role by remotely monitoring the AV’s driving performance to anticipate potential incidents. This fact emphasizes the need for a role split into tasks for the RO and DP at least with regard to higher supervision ratios to prevent high workloads. This is in line with a study by Kalamkar et al. [65] showing a 27 % increase in task miss rates when combining monitoring and control tasks into one role. However, the role split requires good coordination and communication between the DP and RO. Also, the transition between different remote operation modes bust be seamlessly designed. In general, the RO’s operation performance (RA, RD, RM, emergency handling, or maintenance assistance) is a decisive factor in minimizing standstill times. Moreover, the remote connection represents the linkage between the interplay of the AV and the RO which can result in cascading effects in case of transmission quality issues such as latencies. It must be emphasized that the remote-control station’s HMI also constitutes an essential role in the linkage but to a lower extent than the aforementioned functions. In addition to the primary agents, AV and RO, integration into overall traffic and interaction with other road users is crucial. Particularly, communication and interaction during teleoperation are essential for ensuring safe and efficient traffic flow. Therefore, it is vital to synchronize the interactions between different HMIs in automated driving (cf. [64]) with the teleoperation control station’s HMIs. The authors propose to access and use existing communication channels between the AV and passengers or other road users by the teleoperation control station’s HMIs.
At the abstract level, the teleoperation service provider plays a pivotal role by selecting appropriate ROs, providing proper training for the RO, defining tasks and roles of the RO, and organizing the working conditions.
In terms of the dynamic influence of the intricate interplay of takeover probability, supervision ratio, and role model on operator workload and traffic performance, the following applies. Instantiations with 1:1 supervision lead to boredom regardless of the investigated number of takeovers which is even exaggerated by role splitting. This finding is consistent with the results of a simulator study conducted by Andersson et al. [63] where participants described the work in a 1:1 supervision situation as boring. However, the resulting underload can be prevented by inducing non-driving related tasks to increase and shift the workload artificially into the manageable workload zone. Instantiations with a 1:5 supervision are only feasible in the low takeover scenario when the roles are not split or in the base takeover scenario if roles are split. The 1:10 supervision instantiation is only manageable in the low takeover scenario when the roles are split. This shows that a low takeover probability with a maximum of three takeover requests per hour must generally be aimed for and that a division of roles into RO and DP is necessary with higher supervision ratios to avoid a high workload and adverse overall traffic performance. The three feasible instantiations in terms of workload result in a good traffic flow but perform worse in the longterm due to a high number of simultaneous takeovers, long queuing and standstill times, and high delayed arrival times resulting in reduced traffic safety, and low efficiency and passenger satisfaction. Thus, it is essential to consider parallel requests and develop optimized prioritization strategies for handling them with the available resources. The prioritization can follow fixed or variable rules. The variable rules could be based, for example, on the period of delay, urgency, waiting time, and task complexity and duration. Moreover, for example in larger fleets, it might make sense to introduce a flexible “on standby” role for a RO who can help out as needed during load peaks to reduce queuing times. In addition, it would also be conceivable that a RO is not permanently allocated to the same ten vehicles but is variable for ten different vehicles. Also, it is important to note that the majority of requests must be resolved with RA, as these can be carried out much more quickly and sometimes in parallel compared to RD, which further reduces overall standstill times (cf. [66]). Even, possible proactive interventions by monitoring must be considered in dependence of the context to prevent standstill times. Therefore, RD should only be used rarely, for example, in edge cases or emergencies. However, RA and RM have not received as much attention in the research field [7, 67]. Also, these modes require well-qualified and highly trained personnel. Instead, the instantiations with a 1:1 supervision ratio demonstrate better values in the long-term in terms of the system performance metrics. Traffic flow, passenger satisfaction, and efficiency are optimal over 60 min, and also in the long-term for the low takeover scenario. However, the medium and high takeover scenarios still lead to a drop in performance. To conclude, there is a discrepancy between the 1:1 and 1:N supervision ratios in terms of economy and system performance metrics. Both constellations are manageable in terms of workload depending on the takeover probability and role model. However, the 1:1 instantiations lead to good system performance but low economic benefit, whereas the 1:N instantiations lead to bad system performance but high economic benefit. Thus, an appropriate trade-off has to be found in relation to the context with possible adaptive and temporary switches between supervision ratios in the form of “rebalancing”. For instance, a 1:1 supervision ratio should be used temporarily or preferred in edge cases and emergencies. Instead, a 1:10 supervision ratio should be used in a permanent manner necessitating frequent use of RA, optimized queuing and highly trained operators familiarised with the ODD. Thus, in the future, requirements in terms of prioritization strategies, an “on standby” RO role, and tasks and modes must be developed.
4.2 Socio-technical interactions in teleoperated driving between blunt- and sharp-end factors from a safety and reliability perspective
Based on the findings and derived implications, the major socio-technical interactions of the main blunt- and sharp-end factors shaping the operational performance to achieve the societal goals in everyday teleoperated driving are captured from a safety and reliability perspective in order to demonstrate the intricate leverage of the work organization (see Figure 10). In general, the sharp end represent practitioners directly interacting within the actual operation process, whereas the blunt end of the system is the source of the resources and constraints forming the environment in which practitioners work.
Socio-technical interaction of the main blunt- and sharp-end factors shaping the operational performance to achieve the societal goals in everyday teleoperated driving from a safety and reliability perspective.
These interactions illustrate a shuttle transporting passengers from A to B for an everyday use case excluding edge cases such as emergencies which is why passengers, blue light organizations, and maintenance are not considered agents. Also, the AV’s driving performance is assumed to be error-free but not fail-safe and thus is not considered because the focus is on the leverage point from the perspective of remote operation. Therefore, only the part of the AV’s performance leading to the necessary involvement of a RO is relevant. Overall, the interactions do not claim to be exhaustive but represent the main interactions and leverage points examined in this work.
During operation, the performance is mostly composed of the interplay of the AV, RO, and other road users. The sharp-end leverage factors are as follows:
V: number of takeovers, speed, queuing and standstill time.
RO: monitoring quality, and takeover quality and time based on human factors such as the workload.
Other road users: traffic flow.
The operational performance can be separated into two phases in terms of the tasks and the state of the AV: autonomous ride and remote operation. The remote operation is only active when the autonomous ride is paused due to an issue or takeover request. Both phases shape the arrival quality and time of the AV which in turn influence the overall traffic performance including the society goals of safety, efficiency, passenger satisfaction, ecology, and economy. During the autonomous ride, the number of takeovers by AV, the monitoring quality of RO, and the traffic flow by other road users contribute to the arrival quality, instead, the speed of AV and the traffic flow affects the arrival time. During remote operation, the takeover quality of the RO and the traffic flow shape the arrival quality, instead, the queuing and standstill time of the AV, the takeover time of the RO, and the traffic flow impact the arrival time.
In the following, the interactions between the sharp-end factors are explained. It should be noted that the causal relationships represent positive or negative relations. Therefore, a positive causal link can be said to lead to a change in the same direction and an opposite link can be said to lead to a change in the opposite direction, i.e. if the causal variable increases, the effect variable decreases and vice versa. The number of takeovers is decisive for operational performance and is the biggest setting lever. It increases the queuing and standstill times of the AV, and the workload of RO and decreases the traffic flow. The queuing time increases the standstill time, which in turn, decreases the traffic flow. The workload of RO in the form of under- or overload decreases the monitoring and takeover quality as well as increases the takeover time. The monitoring quality and takeover time decrease or increase the standstill time, respectively. The takeover quality increases the traffic flow. The traffic flow increases the speed of AV.
The sharp-end factors are influenced by resources and constraints controlled by blunt-end factors including regulators, administrators, policy makers, technology suppliers, and the environment. The blunt-end leverage factors are:
Autonomous vehicle operation and functional safety
Work organisation
Type of task and mode
Operator qualification and training
Communication technology
Control station
Dynamic environment
Static infrastructure
The blunt-end factors indirectly affect society’s goals through their direct influence on the sharp-end factors but also influence the economy directly in terms of financial costs. It should be noted that in this work, only the main and investigated interactions between the blunt- and sharp-end factors are considered and explained. In general, the static and dynamic environment affects all agents at the operational performance. The control station and communication technology, provided by technology suppliers, impact the workload and performance of the RO. Also, the operator’s qualification and skills contribute to this. However, the autonomous vehicle operation and functional safety, work organization, and type of task and control mode represent the highest leverage on the blunt-end side forming the basic work structure, and thus, are explained in more detail in the following. The vehicle operation and functional safety include the ODD, AV reliability, and fleet size determining the number of takeovers. The work organization consists of the supervision ratio, role model, and prioritization strategies. The role model comprises different roles like RO and DP or flexible allocations in terms of an “on standby” role. The type of task and control mode includes a permanent task like RM and reactive or proactive temporary tasks like RA and RD. The number of takeovers stand and fall with vehicle operation and functional safety. The reason is that the choice of ODD, which is also strongly related to the static and dynamic environment, influences AV reliability: the larger the ODD, the lower the reliability. The AV reliability and AV fleet size determine the number of takeovers: the smaller the reliability and larger the fleet size, the higher the number of takeovers. Moreover, the AV reliability and fleet size affect the work organization in terms of the choice of the supervision ratio and role model: the higher the number of takeovers, the higher the supervision ratio which requires role splitting. The supervision ratio, role model, and task and control mode characteristics affect the workload of RO. Furthermore, these factors influence the queuing and standstill time. In particular, the supervision ratio increases, and the role model decreases the workload creating a balanced loop.
4.3 Limitations
Some methodological limitations are discussed in the following. First, the FRAM model and its parameters are based on assumptions made by the experts in the interviews and findings in the literature. Thus, they do not reflect empirical real-world or simulator data concerning takeover probabilities and RO’s performance in terms of quality and time. Furthermore, the sample size of the interviews is rather low which may lead to uncertainties and variances in the context of the parameterization of the FRAM model. Also, the FRAM model must be viewed as Work-as-Imagine rather than Work-as-Done as the RO’s behaviour could not directly be observed. This must be improved in the future to identify adaptations in behavior related to the context. Second, the quantitative results are only valid for the presented everyday scenario excluding edge cases under the simplified assumptions described in Section 3.2.
5 Conclusions
This work contributes to the essential adoption of a socio-technical system perspective as claimed by Aramrattana et al. [66] and Gasser et al. [20], wherein each human-automation sub-system in teleoperated driving is considered in conjunction rather than in isolation. In conclusion, it can be said that the three blunt-end factors of autonomous vehicle operation and functional safety, work organization, and type of task and control mode set the foundations of the work structure in which the AV, RO, and other road users operate at the sharp-end. The contributing parameters are the ODD, fleet size, supervision ratio, role model, prioritization strategies, monitoring, and different takeover modes as well as proactive interventions. The remaining factors such as operator qualification and training, HMI design of the control station, and transmission quality of the communication technology play a minor role in the sense of fine-tuning. However, past research primarily focused on technical feasibility or fine-tuning human factors such as HMI issues in the control station and effects of latencies rather than the intricate interdependencies between the vehicle operation reliability, work organization, and task types and control modes which are the crucial leverage in system design. Overall, concerning the work organization, a 1:10 supervision ratio is manageable from the perspective of workload in the context of low takeover probability and divided roles into RO and DP. However, shortcomings in queuing time leading to adverse system performance exist necessitating adaptive and temporary switches between supervision ratios in the form of “rebalancing” or further countermeasures.
Thus, future research is needed to extend the FRAM model by developing, for example, differentiated prioritization strategies and flexible “on standby” roles for a RO supporting at load peaks to minimize queuing. Further, edge cases, communication between the AV or RO and passengers or other road users, and the effects of transmission latencies should be explored. Also, tailored requirements for qualification and training must be researched. Moreover, from a methodological perspective, it is worthwhile to compare the workload impacts modeled by FRAM with those of the Simulator of Humans and Automation in Dispatch Operations developed by Duke University [68].
Finally, some key messages are formulated distinguishing between general, vehicle operation domain, work organization, and task type and control mode:
General:
Foundational Factors: The three blunt-end factors – autonomous vehicle operation and functional safety, work organization, and task type and control mode – form the basic work structure for autonomous vehicles, remote operators, and other road users at the sharp-end. The interplay of these factors is crucial for system design but is underexplored in current research.
Vehicle Operation Domain:
Teleoperated Human-Machine System: A sequential or parallel teleoperated system should be considered, with the choice depending on the operational design domain and AV reliability.
Takeover Probability: Aim for low takeover probabilities, with a maximum of three takeover requests per hour.
Work organization:
1:1 Supervision: Leads to underload, which can be mitigated by introducing non-driving related tasks.
M:N Supervision: Manageable workload at low takeover probabilities with a necessary role split. Can cause queuing issues, necessitating adaptive switches between supervision ratios, prioritization strategies, and flexible standby roles to support load peaks.
Task type and control mode:
Proactive Role of RO: Consider a proactive role with permanent monitoring in addition to the reactive role of temporary takeovers, allowing for proactive interventions based on context to minimize standstill times.
Control Mode Preference: Remote assistance should be preferred as the main control mode for takeover requests over remote driving to reduce queuing and standstill times and provide resilience at adverse transmission qualities.
Funding source: The joint research project STADT:up (German Federal Ministry for Economic Affairs and Climate Action [BMWK])
Award Identifier / Grant number: 19A22006x
About the authors
Since 2024 Niklas Grabbe has been a postdoctoral researcher at the Chair of Ergonomics of the Technical University of Munich (TUM). The research interests focus on human factors of automated and teleoperated driving, driver and mobility systems behavior modeling, complex socio-technical systems modeling, and resilience engineering.
Stefan Brettschneider received 2024 his Master's degree in Mechanical Engineering at the Technical University of Munich (TUM). He wrote his Master's thesis “Systemic, socio-technical analysis of teleoperated driving in road traffic using the Functional Resonance Analysis Method” at the Chair of Ergonomics and is now working for E.ON Drive in the field of electric mobility.
Since 2009 Klaus Bengler has been the head of the Chair of Ergonomics at the Technical University of Munich (TUM). He is active in research areas such as human-machine interaction, driver assistance and automated driving, anthropometrics, human-robot cooperation, and human reliability.
Acknowledgments
The author is solely responsible for the content of this publication.
-
Research ethics: The study was conducted according to the guidelines of the Declaration of Helsinki, and approved by the Institutional Review Board of the Ethics Committee of the Technical University of Munich (protocol code 2023-18-NM-KH and date of approval 18 December 2023).
-
Informed consent: Not applicable.
-
Author contributions: Conceptualization, N.G., K.B.; methodology, N.G., S.B., K.B.; software, N.G., S.B.; validation, N.G., S.B., K.B.; formal analysis, N.G., S.B., K.B.; investigation, N.G., S.B.; resources, N.G., K.B.; data curation, N.G., K.B.; writing—original draft preparation, N.G., K.B.; writing—review and editing, N.G., K.B.; visualization, N.G.; supervision, K.B.; All authors have read and agreed to the published version of the manuscript.
-
Competing interests: The authors have no relevant financial or non-financial interests to disclose.
-
Research funding: This work is a result of the joint research project STADT:up (19A22006x). The project is supported by the German Federal Ministry for Economic Affairs and Climate Action (BMWK), based on a decision of the German Bundestag.
-
Data availability: The raw data can be obtained on request from the corresponding author.
An interview guide
Intro
Can you explain the process of teleoperated driving of an automated shuttle in inner-city traffic (or a use case of your expertise) from your point of view/experience? In your opinion, what are the prerequisites for this?
A: Scenarios in road traffic and their frequency
In your opinion, which scenarios occur particularly frequently that require the intervention of a teleoperator in inner-city road traffic?
System limit or system error of the vehicle, what do you think will be the more frequent reason for the teleoperator to take over?
In your opinion, how often on average will the teleoperator intervene when operating in urban traffic?
How do you estimate the frequency of the following two scenarios? How would you rate these scenarios in terms of intervention by the teleoperator?
Unusual object is misclassified (plastic bag, cyclist is recognized as a motorcycle, police officer controls traffic) and stops the journey
Deadlock scenario: Due to incorrect or missing communication, the traffic flow or the movement of the ego vehicle comes to a standstill (intersection or threading situations)
B: Tasks and functions in teleoperation scenarios in road traffic
In your opinion, what tasks does the teleoperator perform when taking over the vehicle in urban traffic?
In your opinion, what tasks does the teleoperator have in the following scenarios? Are there any time restrictions or requirements for the teleoperator?
Unusual object: Teleoperator solves by remote assistance (indirect control)
Deadlock scenario: Teleoperator triggers by remote driving (direct control)
In addition to remote assistance and remote driving, the term remote monitoring is also frequently mentioned in teleoperation. How do you rate the relevance of proactive monitoring in teleoperation applications in road traffic?
How do you see the importance of the division of tasks in terms of different roles, e.g., operator and dispatcher? Which tasks would then differ?
C: Performance/exercise of functions by the teleoperator
How do you assess the influence of time pressure on the performance of the teleoperator?
How do you assess the variability of the performance of teleoperators? What could be possible reasons for this, and are there any “trade-offs”?
In your opinion, which agents are important players in teleoperation in road traffic in addition to the teleoperators? What are their functions and dependencies?
What do you think are the biggest obstacles and is there an optimal way to overcome them?
Miscellaneous
Do you have any comments, important aspects, or questions to add?
References
[1] ISO Standard 21448, “Road vehicles – safety of the intended functionality,” 2022. Available at: https://www.iso.org/standard/77490.html.Search in Google Scholar
[2] M. Herger, “Three Cruise Robotaxi Stall in San Francisco,” 2022. Available at: https://thelastdriverlicenseholder.com/2022/11/29/three-cruise-robotaxi-stall-in-san-francisco/ Search in Google Scholar
[3] Federal Ministry for Digital and Transport, “Verordnung zur Regelung des Betriebs von Kraftfahrzeugen mit automatisierter und autonomer Fahrfunktion und zur Änderung straßenverkehrsrechtlicher Vorschriften,” 2022. Available at: https://bmdv.bund.de/SharedDocs/DE/Anlage/K/presse/008-verordnung-automatisierte-autonome-fahrfunktion.pdf.Search in Google Scholar
[4] SAE International, Taxonomy and Definitions for Terms Related to Driving Automation Systems for On-Road Motor Vehicles (J3016), USA, SAE International, 2021.Search in Google Scholar
[5] D. Bogdoll, S. Orf, L. Töttel, and J. M. Zöllner, “Taxonomy and survey on remote human input systems for driving automation systems,” in Future of Information and Communication Conference, Cham, Springer International Publishing, 2022, pp. 94–108.10.1007/978-3-030-98015-3_6Search in Google Scholar
[6] D. Majstorović, S. Hoffmann, F. Pfab, A. Schimpe, M. M. Wolf, and F. Diermeyer, “Survey on teleoperation concepts for automated vehicles,” in 2022 IEEE International Conference on Systems, Man, and Cybernetics (SMC), Prague, Czech Republic, IEEE, 2022, pp. 1290–1296.10.1109/SMC53654.2022.9945267Search in Google Scholar
[7] O. Amador, M. Aramrattana, and A. Vinel, “A survey on remote operation of road vehicles,” IEEE Access, vol. 10, pp. 130135–130154, 2022. https://doi.org/10.1109/access.2022.3229168.Search in Google Scholar
[8] S. Beiker, Unsettled Issues in Remote Operation for On-Road Driving Automation (No. EPR2021028), Warrendale, USA, SAE Technical Paper, 2021.Search in Google Scholar
[9] J. Vreeswijk, A. Habibovic, O. Madland, and F. Hooft, “Remote support for automated vehicle operations,” in Automated Road Transportation Symposium, Cham, Springer International Publishing, 2021, pp. 149–164.10.1007/978-3-031-11112-9_12Search in Google Scholar
[10] T. B. Sheridan, Telerobotics, Automation, and Human Supervisory Control, Vereinigtes Königreich, MIT Press, 1992.Search in Google Scholar
[11] C. Marberger, H. Mielenz, F. Naujoks, J. Radlmayr, K. Bengler, and B. Wandtner, “Understanding and applying the concept of “driver availability” in automated driving,” in Advances in Human Aspects of Transportation: Proceedings of the AHFE 2017 International Conference on Human Factors in Transportation, N. A. Stanton, Ed., Los Angeles, California, USA, Springer International Publishing, 2017.10.1007/978-3-319-60441-1_58Search in Google Scholar
[12] H. Gstalter and W. Fastenmeier, “Reliability of drivers in urban intersections,” Accid. Anal. Prev., vol. 42, no. 1, pp. 225–234, 2010. https://doi.org/10.1016/j.aap.2009.07.021.Search in Google Scholar PubMed
[13] G. Reichart, “Menschliche Zuverlässigkeit beim Führen von Kraftfahrzeugen–Möglichkeiten der Analyse und Bewertung,” Doctoral dissertation, Dissertation am Lehrstuhl für Ergonomie der TU München, Munich, Germany, 2000.Search in Google Scholar
[14] H. Taga, K. Furuta, and T. Kanno, “Human reliability analysis of car drivers in urban intersections,” Cogn. Technol. Work, vol. 14, pp. 365–377, 2012. https://doi.org/10.1007/s10111-011-0185-4.Search in Google Scholar
[15] S. Shladover, D. Su, and X. Lu, “Impacts of cooperative adaptive Cruise control on freeway traffic flow,” Transp. Res. Rec.: J. Transp. Res. Board, vol. 2324, no. 1, pp. 63–70, 2012. https://doi.org/10.3141/2324-08.Search in Google Scholar
[16] B. Van Arem, C. Van Driel, and R. Visser, “The impact of cooperative adaptive Cruise control on traffic-flow characteristics,” IEEE Trans. Intell. Transport. Syst., vol. 7, no. 4, 2006, pp. 429–436. https://doi.org/10.1109/TITS.2006.884615.Search in Google Scholar
[17] K. Bengler, H Winner, and W. Wachenfeld, “No human – No cry? Automatisierungstechnik,” Methoden und Anwendungen der Steuerungs-Regelungs- und Informationstechnik, vol. 65, no. 7, pp. 471–476, 2017. https://doi.org/10.1515/auto-2017-0021.Search in Google Scholar
[18] T. M. Gasser, et al.., “Bericht zum forschungsbedarf. Runder tisch automatisiertes fahren–AG forschung,” 2015. Available at: http://www.bmvi.de/SharedDocs/DE/Anlage/Digitales/bericht-zum-forschungsbedarf-runder-tisch-aut omatisiertes-fahren.pdf.Search in Google Scholar
[19] A. Habibovic, J. Andersson, M. Castor, L. Meiby, and D. Rizgary, Human Factors Related to Remote Control of Automated Heavy Vehicles, Sweden, SAFER Prestudies: Final Report, 2020.Search in Google Scholar
[20] T. M. Gasser, et al.., Technical Report of the Working Group “Research Needs in Teleoperation”, Federal Highway Research Institute Germany, 2024. Available at: https://www.bast.de/DE/Publikationen/Fachveroeffentlichungen/Fahrzeugtechnik/Downloads-Links/TO-en.html.Search in Google Scholar
[21] L. Almeida, B. Patrao, P. Menezes, and J. Dias, “Be the robot: human embodiment in teleoperation driving tasks,” in The 23rd IEEE International Symposium on Robot and Human Interactive Communication, Edinburgh, UK, IEEE, 2014.10.1109/ROMAN.2014.6926298Search in Google Scholar
[22] F. Tener and J. Lanir, “Driving from a distance: challenges and guidelines for autonomous vehicle teleoperation interfaces,” in Proceedings of the 2022 CHI Conference on Human Factors in Computing Systems, New Orleans, USA, ACM, 2022, pp. 1–13.10.1145/3491102.3501827Search in Google Scholar
[23] F. E. Chucholowski, M. Sauer, and M. Lienkamp, “Evaluation of display methods for teleoperation of road vehicles,” J. Unmanned Syst. Technol., vol. 3, no. 3, pp. 80–85, 2016. https://doi.org/10.21535/just.v3i3.38.Search in Google Scholar
[24] J. Davis, C. Smyth, and K. Mcdowell, “The effects of time lag on driving performance and a possible mitigation,” IEEE Trans. Robotics, vol. 26, no. 3, pp. 590–593, 2010. https://doi.org/10.1109/tro.2010.2046695.Search in Google Scholar
[25] S. Neumeier, P. Wintersberger, A.-K. Frison, A. Becher, C. Facchi, and A. Riener, “Teleoperation: the holy grail to solve problems of automated driving? Sure, but latency matters,” in Proceedings of the 11th International Conference on Automotive User Interfaces and Interactive Vehicular Applications – AutomotiveUI 19, Utrecht, Netherlands, ACM, 2019.10.1145/3342197.3344534Search in Google Scholar
[26] M. Bout, A. P. Brenden, M. Klingegård, A. Habibovic, and M. P. Böckle, “A head-mounted display to support teleoperations of shared automated vehicles,” in Proceedings of the 9th International Conference on Automotive User Interfaces and Interactive Vehicular Applications Adjunct – AutomotiveUI 17, Oldenburg, Germany, ACM, 2017.10.1145/3131726.3131758Search in Google Scholar
[27] A. Hosseini and M. Lienkamp, “Enhancing telepresence during the teleoperation of road vehicles using HMD-based mixed reality,” in 2016 IEEE Intelligent Vehicles Symposium (IV), 2016.10.1109/IVS.2016.7535568Search in Google Scholar
[28] C. Mutzenich, S. Durant, S. Helman, and P. Dalton, “Situation awareness in remote operators of autonomous vehicles: developing a taxonomy of situation awareness in video-relays of driving scenes,” Front. Psychol., vol. 12, p. 4943, 2021a. https://doi.org/10.3389/fpsyg.2021.727500.Search in Google Scholar PubMed PubMed Central
[29] C. Mutzenich, S. Durant, S. Helman, and P. Dalton, “Updating our understanding of situation awareness in relation to remote operators of autonomous vehicles,” Cogn. Res.: Princ. Implic., vol. 6, no. 1, pp. 1–17, 2021b. https://doi.org/10.1186/s41235-021-00271-8.Search in Google Scholar PubMed PubMed Central
[30] J. Wojtusch, D. Taubert, T. Graber, and K. Nergaard, “Evaluation of human factors for assessing human-robot interaction in delayed teleoperation,” in 2018 IEEE International Conference on Systems, Man, and Cybernetics (SMC), Miyazaki, Japan, IEEE, 2018.10.1109/SMC.2018.00641Search in Google Scholar
[31] T. W. Haduch and B. T. Mitchell, A Human Factors Approach to Unmanned Ground Vehicle Operator Control Unit Interface Research, San Diego, USA, SAE Technical Paper Series, 1995.10.4271/951482Search in Google Scholar
[32] R. Liu, D. Kwak, S. Devarakonda, K. Bekris, and L. Iftode, “Investigating remote driving over the LTE network,” in Proceedings of the 9th International Conference on Automotive User Interfaces and Interactive Vehicular Applications -AutomotiveUI 17, Oldenburg, Germany, ACM, 2017.10.1145/3122986.3123008Search in Google Scholar
[33] S. Lu, M. Y. Zhang, T. Ersal, and X. J. Yang, “Workload management in teleoperation of unmanned ground vehicles: effects of a delay compensation aid on human operators’ workload and teleoperation performance,” Int. J. Human–Comput. Inter., vol. 35, no. 19, pp. 1820–1830, 2019. https://doi.org/10.1080/10447318.2019.1574059.Search in Google Scholar
[34] P. Wintersberger, S. Neumeier, A.-K. Frison, A. Becher, C. Facchi, and A. Riener, “Teleoperation,” in Proceedings of the 11th International Conference on Automotive User Interfaces and Interactive Vehicular Applications – AutomotiveUI 19, Utrecht, Netherlands, ACM, 2019.Search in Google Scholar
[35] A. Schrank, F. Walocha, S. Brandenburg, and M. Oehl, Human-centered design and evaluation of a workplace for the remote assistance of highly automated vehicles. Cogn. Tech. Work, vol. 26, pp. 183–206, 2024. https://doi.org/10.1007/s10111-024-00753-x.Search in Google Scholar
[36] G. Graf and H. Hussmann, “User requirements for remote teleoperation-based interfaces,” in 12th International Conference on Automotive User Interfaces and Interactive Vehicular Applications, Virtual Event, USA, ACM, 2020, pp. 85–88.10.1145/3409251.3411730Search in Google Scholar
[37] E. Hollnagel, FRAM, The Functional Resonance Analysis Method: Modelling Complex Socio-Technical Systems, Farnham, England, Ashgate Publishing, Ltd, 2012.Search in Google Scholar
[38] S. Schwindt, A. Heller, N. Theobald, and B. Abendroth, “Who will drive automated vehicles? – usability context analysis and design guidelines for future control centers for automated vehicle traffic,”in Human Factors in Transportation. AHFE (2023) International Conference. AHFE Open Access, vol. 95, G. Praetorius, C. Sellberg, and R. Patriarca, Eds., USA, AHFE International, 2023.10.54941/ahfe1003796Search in Google Scholar
[39] N. Goodall, “Non-technological challenges for the remote operation of automated vehicles,” Trans. Res. Part A: Policy Pract., vol. 142, pp. 14–26, 2020. https://doi.org/10.1016/j.tra.2020.09.024.Search in Google Scholar
[40] M. Herger, “UPDATE: disengagement reports 2018 – final results,” 2019. Available at: https://thelastdriverlicenseholder.com/2019/02/13/update-disengagement-reports-2018-final-results/.Search in Google Scholar
[41] Ottopia Technologies, “One operator, many vehicles,” 2021. Available at: https://ottopia.tech/products/ [accessed: Aug. 26, 2023].Search in Google Scholar
[42] Einride, “Einride showcases one operator, multiple vehicle capability at a customer site,” 2020. Available at: https://www.einride.tech/press/einride-showcases-one-operator-multiple-vehicle-customer-site [accessed: Aug. 26, 2023].Search in Google Scholar
[43] A. D. Swain and H. E. Guttmann. Handbook of Human Reliability Analysis with Emphasis on Nuclear Power Plant Applications, NUREG/CR-1278, 1980.Search in Google Scholar
[44] VDI 4600 Part 1, Human Reliability – Ergonomic Requirements and Methods of Assessment, Düsseldorf, Germany, VDI, 2015.Search in Google Scholar
[45] VDI 4600 Part 2, Human Reliability – Methods for Quantitative Assessment of Human Reliability, Düsseldorf, Germany, VDI, 2017.Search in Google Scholar
[46] S. Hoffmann and D. F. Diermeyer, “Systems-theoretic safety assessment of teleoperated road vehicles,” in Proceedings of the 7th International Conference on Vehicle Technology and Intelligent Transport Systems – VEHITS, Virtual Event, USA, Springer, 2021, pp. 446–456.10.5220/0010438900002932Search in Google Scholar
[47] H. Parr, C. Harvey, and G. Burnett, Investigating Levels of Remote Operation in High-level On-road Autonomous Vehicles using Operator Sequence Diagrams, PREPRINT (Version 1) Available at Research Square, 2023.10.21203/rs.3.rs-2510863/v1Search in Google Scholar
[48] I. Svedung and J. Rasmussen, “Graphic representation of accidentscenarios: mapping system structure and the causation of accidents,” Saf. Sci., vol. 40, no. 5, pp. 397–417, 2002. https://doi.org/10.1016/s0925-7535(00)00036-9.Search in Google Scholar
[49] N. Leveson, “A new accident model for engineering safer systems,” Saf. Sci., vol. 42, no. 4, pp. 237–270, 2004. https://doi.org/10.1016/s0925-7535(03)00047-x.Search in Google Scholar
[50] N. Grabbe, A. Kellnberger, B. Aydin, and K. Bengler, “Safety of automated driving: the need for a systems approach and application of the Functional Resonance Analysis Method,” Saf. Sci., vol. 126, p. 104665, 2020. https://doi.org/10.1016/j.ssci.2020.104665.Search in Google Scholar
[51] P. Larsson, S. W. Dekker, and C. Tingvall, “The need for a systems theory approach to road safety,” Saf. Sci., vol. 48, no. 9, pp. 1167–1174, 2010. https://doi.org/10.1016/j.ssci.2009.10.006.Search in Google Scholar
[52] C. Nemeth, “Erik Hollnagel: FRAM: The functional resonance analysis method, modeling complex socio-technical systems,” Cogn. Tech. Work, vol. 15, no. 1, pp. 117–118, 2012.10.1007/s10111-012-0246-3Search in Google Scholar
[53] N. Grabbe, A. Gales, M. Höcher, and K. Bengler, “Functional resonance analysis in an overtaking situation in road traffic: comparing the performance variability mechanisms between human and automation,” Safety, vol. 8, no. 1, p. 3, 2022. https://doi.org/10.3390/safety8010003.Search in Google Scholar
[54] M. Sujan, et al.., “Operationalising FRAM in Healthcare: a critical reflection on practice,” Saf. Sci., vol. 158, p. 105994, 2023. https://doi.org/10.1016/j.ssci.2022.105994.Search in Google Scholar
[55] R. Patriarca, et al.., “Framing the FRAM: a literature review on the functional resonance analysis method,” Saf. Sci., vol. 129, p. 104827, 2020. https://doi.org/10.1016/j.ssci.2020.104827.Search in Google Scholar
[56] RBB, “Berliner Trams und Busse verlieren an Geschwindigkeit,” 2022. Available at: https://www.rbb24.de/panorama/beitrag/2022/05/busse-trams-berlin-geschwindigkeit-fahrplan-bvg.html.Search in Google Scholar
[57] A. McGill, R. McCloskey, D. Smith, V. Salehi, and B. Veitch, “Building a functional resonance analysis method model: practical guidance on qualitative data collection and analysis,” Int. J. Qual. Methods, vol. 22, 2023, Art. no. 16094069231211145. https://doi.org/10.1177/16094069231211145.Search in Google Scholar
[58] P. Mayring, “Qualitative inhaltsanalyse,” in Handbuch qualitative Forschung in der Psychologie, 1. Auflage G. Mey and K. Mruck, Eds., Wiesbaden, VS Verlag für Sozialwissenschaften, 2010, pp. 601–613.10.1007/978-3-531-92052-8_42Search in Google Scholar
[59] E. Hollnagel and R. Hill, “Instructions for use of the FRAM model visualiser (FMV),” 2020. Available at: https://functionalresonance.com/onewebmedia/FMV_instructions_2.1.pdf [accessed: Jul. 17, 2023].Search in Google Scholar
[60] E. Hollnagel, “FRAM model interpreter,” 2020. Available at: https://functionalresonance.com/onewebmedia/FMI%20basicPlus%20V3.pdf [accessed: Jul. 12, 2023].Search in Google Scholar
[61] R. Hill and D. Slater, “Using a metadata approach to extend the functional resonance analysis method to model quantitatively, emergent behaviours in complex systems,” Systems, vol. 12, no. 3, p. 90, 2024. https://doi.org/10.3390/systems12030090.Search in Google Scholar
[62] M. Cummings, V. Nneji, and S. Li. Predicting Workload of Dispatchers Supervising Autonomous Systems, 2023. Available at : https://www.researchgate.net/publication/375633230_Predicting_Workload_of_Dispatchers_Supervising_Autonomous_Systems.Search in Google Scholar
[63] J. Andersson, D. Rizgary, M. Söderman, and J. Vännström, “Exploring remote operation of heavy vehicles—findings from a simulator study,” Human-Intell. Syst. Integ., pp. 1–10, 2024. https://doi.org/10.1007/s42454-024-00051-x.Search in Google Scholar
[64] K. Bengler, M. Rettenmaier, N. Fritz, and A. Feierle, “From HMI to HMIs: towards an HMI framework for automated driving,” Information, vol. 11, no. 2, p. 61, 2020. https://doi.org/10.3390/info11020061.Search in Google Scholar
[65] S. Kalamkar, V. Biener, F. Beck, and J. Grubert, “Remote monitoring and teleoperation of autonomous vehicles – Is virtual reality an option?,” in 2023 IEEE International Symposium on Mixed and Augmented Reality (ISMAR), IEEE, 2023, pp. 463–472.10.1109/ISMAR59233.2023.00061Search in Google Scholar
[66] M. Aramrattana, et al.., “A roadmap towards remote assistance: outcomes from multidisciplinary workshop at the 2023 intelligent vehicles symposium,” in International Conference on Human-Computer Interaction, Cham, Springer Nature Switzerland, 2024, pp. 175–185.10.1007/978-3-031-61963-2_16Search in Google Scholar
[67] I. Skogsmo, J. Andersson, C. Jernberg, and M. Aramrattana, One2many: Remote Operation of Multiple Cehicles, Sweden, Statensvägoch transportforskningsinstitut, 2023.Search in Google Scholar
[68] Duke University, “Simulator of humans and automation in Dispatch operations (SHADO),” 2024. Available at: https://apps.hal.pratt.duke.edu/shado-webdev/index.html.Search in Google Scholar
Supplementary Materials
The reflexive and computational FRAM models are available online at https://doi.org/10.1515/auto-2024-0089.
© 2024 the author(s), published by De Gruyter, Berlin/Boston
This work is licensed under the Creative Commons Attribution 4.0 International License.
