Vehicle Platooning Systems: Review, Classification and Validation Strategies

This paper presents a systematic literature review of platooning systems with a special focus on the strategies which have been adopted to validate platooning algorithms. We collect the existing studies in the platooning field. The proposed algorithms are compared based on some


INTRODUCTION 1.Motivation
The increase in vehicle numbers has resulted in the growth of traffic jams in cities and highways, thereby raising various issues on fuel consumption, environmental pollution, and traffic safety [1].Platooning is an Intelligent Transport System (ITS) [2] application which has emerged as a promising solution for the traffic management in highways.The main idea of vehicle platooning suggests that a set of vehicles travel together while maintaining a small distance between each other.This can lead to an increase in traffic capacity and then an improved traffic management and a reduced travel time.Moreover, the comfort and the safety of passengers are enhanced since the scenarios of extreme acceleration or deceleration are eliminated and the platoon vehicles are considered as a single unit.Furthermore, the emission performance and the fuel economy are significantly improved.A vehicle platoon (also called "convoy") can be seen as a group of vehicles that travel in close coordination through a headway control mechanism.These vehicles maintain a short spacing between them and a relative velocity.The vehicle in the front position, called leader, represents the trajectory and velocity reference.It controls all the following vehicles in the platoon.Each vehicle of the platoon receives orders from the leader that may be communicated either directly or by the preceding vehicle.
As platooning system is a critical system, safety is an important issue.However, safety is exposed to several challenges if the system does not achieve its goal without any disturbance.For instance, it is important to ensure that vehicles do not get too close and react within a certain time frame during emergencies.Then, platooning systems need to be validated to ensure a reliable behaviour.For that, it is necessary to clearly define validation strategies (formal verification, simulation, etc.) as this has already been used in critical fields like healthcare [3] and avionics [4].That is why, we make emphasis in this paper on the works that deal with validation methods and techniques for platooning systems.

Related Surveys and Scope of the Paper
There are several useful surveys which have been conducted to deal with some aspects related to platooning algorithms.
In Kavathekar and Chen [5], the authors introduce several existing algorithms which focus on vehicle platooning.Besides, they detail some methodologies for obstacle detection and collision avoidance.Furthermore, they are interested in inter-vehicle communication techniques which allow vehicles to share some information such as the velocity, acceleration and detected obstacles.In the same context, the survey of Jia et al. [6] provides a valuable insight about platoon-based vehicular systems.The main issues related to these systems are analysed such as the platoon management and the communication inter-and intra-platoon.
The study of Kulla et al. [7] presents a survey in which they introduce a classification of vehicular communication methods which aim to control vehicles.Moreover, the authors introduce the different platooning operations which can take place to enhance the driving efficiency and increase safety.
In another review study, Bhoopalam et al. [8] provide a survey of the existing approaches interested in truck platooning.They discuss various characteristics of platoon planning.The authors also focus on the different levels of human involvement in the proposed solutions.
Finally, a recent survey paper on truck platooning is presented in Zhang et al. [9].The scope of this paper is limited to the perspective of fuel economy.In fact, the authors introduce the essential factors that can influence the fuel saving.Additionally, different coordination methods are discussed to check when and how the platoon formation can enhance fuel consumption.
To position the contributions of this research paper with regard to the existing published surveys, we present a comparison table (Table 1) based on some criteria including platooning operations, communication modes, validation strategies, etc.The symbol "±" indicates that only some operation types or some aspects of communication have been discussed.No doubt other criteria can be considered, but the presented ones are sufficient for the scope of this research.Based on this overview of the existing survey studies, we notice that the literature is missing a Systematic Literature Review (SLR) [10] that identifies the strategies adopted to validate platooning algorithms.This paper introduces a thorough, comprehensive, and systematic review of platooning systems with a special focus on validation strategies.It also compares the selected papers (ranging from 2010 to March 2020) based on the platooning operations and the communication modes taken into account.Finally, it explores the open issues that can be studied in the future.

Organization of the Paper
The remainder of this paper is organised as follows: In Section 2, we describe the research methodology applied to our survey paper.Section 3 describes the different operations which are essential for the platooning management.In Section 4, we outline the communication modes for vehicular platooning.Section 5 reviews some selected papers by classifying them according to the adopted validation strategies.Section 6 provides a rich analysis of the existing approaches.In Section 7, we identify a set of possible challenges and open issues for future works.Finally, the last section sums up the paper.

RESEARCH SELECTION METHOD
In this paper, we follow the guidelines of systematic reviews in software engineering research proposed by Kitchenham et al. [10].Following these guidelines, a SLR consists of three main steps as shown in Figure 1.A clear description of each step will be described in the rest of this section.

Planning the Review
The first step of a SLR consists of defining the research questions, specifying the search strategy, and identifying the inclusion and exclusion criteria.

Research questions
The purpose of the present paper is to identify the relevant publications which focus on platooning systems.To do so, we have defined a set of Research Questions (RQs): • RQ1: Which operations are implemented to manage the dynamicity of vehicles?
• RQ2: What are the different communication modes that have been implemented for vehicles platooning?
• RQ3: Which strategies are used to validate the proposed platooning algorithms?
• RQ4: What are the research directions and open perspectives for platooning systems?
Obviously, various other questions can be posed, but we believe that these are sufficient to expose a vast variety of research in the studied field.

Search strategy
In this stage, we describe the search strategy adopted for selecting the relevant publications from several sources.We have conducted an extensive search about vehicle platooning algorithms.Our search consists in using the known scientific databases: ACM Digital Library † , IEEE Xplore ‡ , Springer § , Elsevier Scopus ¶ , and Wiley ǁ .Based on this stage, we collect only the papers published between 2010 and March 2020.

Inclusion and exclusion criteria
In the second stage, we have refined the studies already collected using a manual search in order to identify those related to our research questions.To this end, we have determined the inclusion and exclusion criteria which are required to assess each study.In what follows, we present the list of these criteria: • Studies presenting reviews and survey papers were excluded.
• Only long publications written in English from peer reviewed journals and conferences were considered.
• Studies in the form of short papers, book chapters, tutorial papers, and poster papers were discarded because they did not give sufficient information.

Conducting the Review
This step involves two main phases: search for studies and study selection.

Search for studies
Through the search strategy already presented, we retrieved a new set of papers.After that, we removed duplicated papers as they appeared in different databases.

Study selection
The selected papers were analyzed based on their titles, abstracts, and keywords.The remaining papers were fully examined after a complete text reading.
Finally, we ended up with a new set of candidate papers for the next step of the SLR.

Reporting the Review
In this step, we use the four research questions already presented.
The first question RQ1 is so useful as it aims to identify the operations which are implemented to manage the dynamicity of vehicles.
To respond to RQ2, we cite the different communication modes of vehicle platooning.The answer to RQ3 presents the strategies enacted by the researchers to validate their proposed algorithms.These strategies can be classified into four main types: simulation, formal verification, real experimentation, and software testing.Finally, in the last research question RQ4, we identify the challenges to be addressed in the future.

PLATOONING OPERATIONS
The platooning process consists of a set of operations that are essen tial to ensure safety and driving efficiency.We can classify these operations into two types.There are operations which are performed within the platoon and others which can change the platoon structure.

Operations Performed within the Platoon
These operations are the most conventional behaviours in driving and they are performed within the same platoon.In what follows, we list some of these operations: • Acceleration/deceleration: The purpose of each vehicle in the platoon is to control acceleration/deceleration in order to stabilize the distance between vehicles.
• Braking: This operation can be initiated by the leader or another platoon member.In such a situation, it is necessary to avoid collisions between platoon vehicles.
• Changing lane: If the driver of the first vehicle is confronted with a desired gap in the current lane, he may change from this lane to the next one.In this case, the following vehicles of the platoon have to follow the lane change.

Operations Making Change in the Platoon Structure
These operations include the following ones: • Join platoon: It is performed when one vehicle wants to become a member of a platoon.
• Merge platoon: It consists in merging two platoons which have the same destination to form a single platoon.
• Leave platoon: It takes place when one vehicle wants to exit the platoon.In this situation, the vehicles in the head and behind this vehicle open a space for security reasons.When this vehicle leaves, they return back to the platoon distance.
• Split platoon: It takes place when several vehicles want to exit the platoon and create a new one having another leader.
• Cut-in/Cut-out: Cut-in operation is a specific lane change maneuver, in which a vehicle moves closely in front of a platoon vehicle in the adjacent lane.In the case of cut-out operation, the vehicle entering the platoon decides to leave it.So, the other vehicles have to cover the cut-out vehicle gap.
In the following, we explain some existing works while focusing on the operations considered in the platooning process.
Amoozadeh et al. [11] develop a platoon management protocol based on Cooperative Adaptive Cruise Control (CACC) [12] vehicles and Vehicular Ad-hoc Networks [13].This protocol considers three basic platooning operations: split, merge, and lane change.
In the first operation, one platoon containing at least two vehicles divides into two smaller platoons at a particular position.In the merging operation, two platoons traversing the same lane merge to create one large platoon.The third operation allows a platoon vehicle to modify the lane.
In Maiti et al. [14], concentrate on modelling different objects, properties, and operations of platooning using the Web Ontology Language (OWL) [15].The authors distinguish two types of platoons: a degenerated platoon which contains only one vehicle that represents the leader and a proper platoon which includes more than one vehicle.In this work, the merging operation includes three specializations.The first one (single front merge) consists in merging a degenerated platoon at the front of a platoon.The second operation (single tail merge) aims to merge a degenerated platoon at the end of a proper platoon.The third operation (create) allows to merge two degenerated platoon and form a proper platoon.In addition, the authors deal with two types of split operation depending on whether the first part or the last part of the platoon will achieve the split operation.
Ledbetter et al. [16] introduce a protocol for dynamic platooning with different type of vehicles.Using Blockchain [17], this protocol guarantees that unauthorized users work together with related to the smart contract, avoiding unneeded overhead and harmful behaviour.In the proposed protocol, the authors develop three platooning operations through smart contracts.The joining operation consists of several steps.First, the user sends the identifier of the platoon it wants to join.Each vehicle can perform the joining if it owes too much money and wants to accommodate its debt or its reputation score is negligible.Once the user is accepted, the payments for the platoon followers will be made to the leader and the reputation scores will be adapted correctly.The second operation occurs when a user likes to quit the platoon.According to the position of the leaving vehicle, it can apply a set of merges and/or splits to securely exit.The third operation aims to combine two platoons.
It will be authorized if the reputation score of every vehicle in the obtained platoon is important enough.The purpose of the fourth operation is to split the platoon.This is achieved by a user who will become the leader of the new platoon.
In Basiri et al. [18], introduce a distributed system which aims to control a dynamic platoon with unidirectional topologies.Moreover, it can handle both cut-in/cut-out operations and avoid collisions.This is achieved by tracking the velocity and ensuring the safe distance between any two consecutive vehicles.

COMMUNICATION FOR VEHICULAR PLATOONING
In vehicular networks, there are two basic modes of communication: Vehicle-to-Infrastructure (V2I) communication and Vehicleto-Vehicle (V2V) communication.

V2V Communication
It is the primordial requirement for the platooning operation.It is adopted for ensuring direct communication between vehicles or platoons.Vehicles driving in a platoon communicate together to keep a distance to the vehicle in front of them.The exchanged messages are disseminated very quickly, such that the vehicles can react in time in case of dangerous situations.We classify the V2V communication into three categories: • Intra-platoon communication: It focuses on the communication between the platoon members.It has much requirements than the one between normal vehicles.
• Inter-platoon communication: It consists in exchanging messages between vehicles of different platoons.
• Communication between platoon vehicles and normal vehicles: It focuses on exchanging information between platoon members and normal vehicles.

V2I Communication
This mode of communication is adopted to ensure the exchange of information between vehicles/platoons and the infrastructure.It provides a further value for the platoon like traffic prediction.The devices installed along the road, called Road Side Units (RSUs), represent an example for V2I communication.The infrastructure collects data from vehicles and other information sources, handles it, and makes it accessible to the platoon members in order to facilitate their coordination.
In the rest of this section, we detail some existing platooning algorithms while emphasizing on the communication mode which has been considered.
In Böhm and Kunert [19], the authors introduce a framework for timely and reliable communication both within a platoon and between platoons.Each platoon contains a leader and one or more followers preserving a gap between vehicles and a speed that secure operations of the platoon at the current conditions (such as radio, weather, road, etc.).The communication associated to platoons is ensured using a dedicated Service Channel.The exchange of information between non-platoon vehicles takes place on a separate Control Channel (CCH) without interference.The announcements platoon on the CCH allows the platoon to notify its presence to its neighbours.
The contribution of Maiti et al. [20] introduces three merge operations, called middle, front, and tail.It analyses the impact of these operations in terms of merge distance, merge time, and merge success rate.In order to perform the merge operation, the vehicle speed and the platoon speed are adapted to have the required intra-platoon gap.
Another trend [21] aims at proposing a communication protocol which relies on the standard ITS-G5 [22].This protocol considers the communication between platoon vehicles as well as packet collisions between these vehicles.To minimize the packet collisions, the authors introduce a protocol of message transmission, in which the leader of the platoon sends information at each time interval.
In Hu et al. [23], introduce a trust-based platoon service query protocol which aims to distinguish the badly-and well-behaved vehicles when selecting platoon leaders.It adopts a hybrid architecture including a server, RSUs, and vehicles.The server provides the trust table which contains reputation scores and satisfaction levels for all platoon leaders and vectors of vehicle driving parameters.The RSUs are connected to the server through secured channels and wired lines.They are considered as relays of data between server and vehicles.

VALIDATION STRATEGIES
The validation strategies point out how a proposed algorithm is validated in terms of correctness and performance criteria.This consists in ensuring whether an algorithm is operating as expected.
As shown in Figure 2, we classify the validation strategies into four categories.In addition, we embed the references of the most relevant papers in each category.In what follows, we provide an overview of each strategy and a brief description of some related works.

Simulation
Simulation is a widely used validation strategy.It provides a free environment which can imitate the system behaviour and the conditions of a real environment.Simulation scenarios can be easily replicated and controlled.A large number of works have been conducted based on this strategy.
In Aramrattana et al. [24], propose a simulation framework which includes a manually driven vehicle through a driving simulator interacting with a communication and a traffic simulator.Based on the proposed framework, the authors present simulation results of two CACC controllers in a cut-in scenario using Plexe simulator ** .The latter extends both Veins [25] and Simulation of Urban MObility (SUMO) [26] to ensure a more realistic simulation of platooning scenarios.
In another proposal, Paranjothi et al. [27] introduce a platoonmerging algorithm for cooperative driving which allows to select an unintended vehicle penetrating the platoon gap.The proposed algorithm is implemented in SUMO and Ns-3 [28] simulators.SUMO is adopted to simulate the trace of vehicle movements.The obtained output is the input of the Ns-3 simulator.The performance of the algorithm is demonstrated by evaluating the packet ratio transmitted in the platoon and the network throughput.
The obtained results show a significant performance compared to two existing approaches [29,30].
The work presented in Guériau [31] tackles the problem of controlling dynamic platoons using a multi-agent based approach.Indeed, the set of vehicles on the road network are modeled as a multi-agent system.Every agent has several parameters.It can have one of these roles: (1) The towing vehicles are elected by their neighbours and they behave as leaders for a period of time.
(2) The follower vehicles interact with towing vehicles.Their behaviour is defined based on a physics inspired model.The performance of the proposed approach is evaluated using the VIPS simulator [32] which allows capturing the dynamic behaviour of platoons.The presented results show that the proposed model can smooth trajectories, accelerate decision, and check the lateral error.

Real Experimentation
It is an important strategy which consists in using real experiments based on a dedicated physical testbed to evaluate the behaviour of a system.In the following, we highlight some research studies adopting this strategy.
The contribution of the approach cited in Wang et al. [33] introduces a vehicular platooning framework based on Zynq/SoC architecture [34].This architecture incorporates a Programmable Logic (PL) and an integrated Processing System (PS).The proposed framework contains one leading-vehicle and five following vehicles, where each vehicle is designed based on the adopted architecture.Whenever the leading-vehicle encounters an obstacle, the PS calculates the expected speed and direction using data from photo-electric and ultrasonic sensors.Then, it notifies the following vehicles using ZigBee networks [35].The conducted experiments illustrate the performance of the proposed framework.
In fact, the Zynq/SoC architecture can enhance information interaction as well as the real-time processing of cooperative platoons.
Additionally, the approach presented by Omae et al. [36] aims to control the behaviour of vehicles while considering creating and splitting a platoon.The authors introduce a control architecture which enhances the behaviour of the platoon and vehicles without raising the complexity of the system.The performance of the proposed system has been shown using three small electric vehicles.In each vehicle, a velocity sensor, an optical gyrosensor, Real Time Kinematic Global Positioning System (RTK-GPS), a laser radar are installed.In order to control the steering angle, an AC servomotor is fitted.The different presented scenarios illustrate that the platoon can prevent obstacles.

Formal Verification
The use of a formal foundation to describe a system is very useful for checking its correctness.Indeed, the formal verification provides an effective way for the designer to evaluate the behaviour of a system and prevent errors before the implementation.It consists in specifying the properties to be proven without worrying about the possible scenarios.We identify three types of formal verification methods: handwritten proofs [37], model checking [38], and theorem proving [39].We depict in Table 2 a comparison of the existing studies in terms of some criteria including the formal method, verification tool, and proved properties.In the rest of this section, we give an overview of each formal verification method and we review some selected papers associated to each one.

Handwritten proofs
These proofs are done based on mathematical analysis using paper and pencil.
In Jin et al. [40], propose an interesting model of traffic flow with platoons.In this model, they focus on the inter-platoon coordination over a generic highway to avoid local congestion.Indeed, they suppose that platoons are travelling in the same time with no connected-autonomous vehicles.In addition, the authors study the relationship between the stability and the throughput in their model.They specify and manually prove sufficient conditions and control laws through several scenarios (uncontrolled system, uncoordinated scenario, etc.).Based on the theory of Markov processes, they identify bounds for the throughput to avoid congestion propagation, maximize throughput, and minimize the delay.
The work presented in Liu et al. [41] aims to achieve a reliable vehicle platooning in a traffic scenario.In fact, the authors propose an adaptive communication protocol for vehicle platooning.To do so, they consider hybrid traffic which means platooned and individual non-platooned vehicles are running side-by-side.These vehicles can transmit periodic beacon messages and event-based safety messages.Moreover, the authors present a theoretical analysis to manually prove that the proposed protocol guarantees the local stability (i.e., the state errors between the vehicle and its neighbours are bounded by some factors).

Model checking
It is a powerful verification method which relies on automated techniques for proving the correctness of hardware and software systems.We distinguish different model checking based languages such as Timed-automata [42] and Petri nets [43].
The approach proposed in Karoui et al. [44] investigate and evaluate the safety of a linear vehicular platoon under normal and degraded operational modes.When no disturbances occur, the platoon runs under the normal mode, otherwise, a degraded mode is activated.They model the platoon as a multi-agent system which includes two types of agents: a leader agent and a follower agent.
They consider an auto-reconfiguration model based on the operational state of the platoon.In addition, they use V2V communication in addition to perception sensors for increasing reliability of the model.To ensure the correctness of the proposed model, the authors formally verify some safety properties of a reconfigurable platoon.This is performed using Timed-automata language and UPPAAL tool [45].
A compositional verification approach for vehicle platooning is presented in El-Zaher et al. [46].In this work, the authors are interested in linear platoons.Their approach consists in considering a platoon as a reactive multi-agent systems [47] where each vehicle Basiri et al. [18] Handwritten proofs -Stability of the platoon and safety properties embeds an autonomous agent.Two types of vehicle are introduced: the leader and the follower.The authors focus only on the follower vehicle and specify its reactive behaviour by a physics inspired interaction model.The unique safety property considered in this work is the non-collision of any follower vehicle with its preceding vehicle.Vehicle in a platoon has a constant speed and follows a linear trajectory.The verification approach consists in decomposing the system into small components.Then, each system component is formally verified separately using the SAL toolkit tool [48].
The obtained results show that the number of explored nodes in the compositional verification is relatively constant compared to the non-compositional verification.
In another proposal, Peng et al. [49] propose a timed automata model to prove the safety of a platoon.They verify that no crash and no deadlock occur in the platoon.Also, the proposed model allows finding a minimum safe distance between two vehicles under variable speed.To avoid state explosion, the authors consider the formal verification problem only from a local point of view.They specify only one vehicle at the time and then the entire platoon is considered safe if all its members are safe.Besides, they focus only on the safety property of the longitudinal control problem in a platoon system.

Theorem proving
It is a verification method based on mathematical logic and it can deal with complex formalisms.The most popular languages based on the theorem proving are Coq † † , Z [50], B method [51], and Event-B [52].
In Simonin et al. [53], propose a formal pattern based on situated multi-agent systems and expressed by the Influence/Reaction model [54].The authors adopt the B method to specify the pattern and to prove its correctness.The pattern is then illustrated by an application of a platoon composed by unmanned land vehicles.
Using the B-method, the authors prove basic safety properties which verify that no collision can take place in the platoon.
The contribution proposed in Rashid et al. [55] introduces a framework for analyzing the platoon control strategies.In addition, it presents a formalization of the platoon controller and its stability using Higher-Order Logic (HOL) [56].The stability is an essential property of a vehicle platoon.It expresses the capability of a platoon to decrease the oscillations presented by the leader or other vehicles in the platoon.The authors also prove the use of stability theorems for several control strategies in order to allow monitors to detect the violation on a system execution.

Testing
Software testing is a process which consists in executing a system with the intent of detecting errors which can induce software failure.In this context, we have identified only few works which have addressed this strategy.
In André et al. [57], the authors introduce an approach which assists the test of service-based component models.To this end, the tester selects the components and the services to test.The proposed approach is realised using COSTO tool ‡ ‡ .It is illustrated by a simple motivating example of a platoon of vehicles.However, no platoon management operations have been considered.
In another proposal, Mottu et al. [58] are interested in comparing the test implemented on the generated code and the test generated from the model level.Besides, they study an example of a platoon system which is modelled by services and components.To transform the system model into the generated code of the system under test, the authors use the COSTO tool.

DISCUSSION
In this section, we introduce a detailed analysis related to the studied approaches of platooning algorithms in vehicular networks.For that, we present the observations that we have made about the research questions introduced in Section 2. Next, we show in Table 3 a comparison of some reviewed papers in terms of various criteria.
To answer to RQ1, we identified two basic types of platooning operations that have been implemented to manage the dynamic aspect of vehicles.The first type focuses on the operations performed within the same platoon such as acceleration, deceleration, braking, etc.These operations represent conventional behaviours in driving.The second type deals with the operations making change in the platoon structure.We notice that great attention of algorithms has been interested in vehicles staying in the platoon during the journey.In practice, vehicles have several sources and stations.So, platoons have to be split and merged and some vehicles need to enter or exit platoons.In this context, many works have taken into account some operations making change in the platoon structure which are split, merge, leave, and join.Nevertheless, the cut-in and cut-out maneuvers are rarely considered.
With regard to RQ2, we distinguished two main communication modes (V2V and V2I) that have been implemented in platooning systems as shown in Section 4. We observe that considerable attention has been given to the V2V communication.However, only few works have taken into account the V2I communication.This communication type remains a very theoretical concept in terms of technical standard and physical implementation.Indeed, it is costly to implement and it cannot be adopted for most of the existing roads.
Regarding to RQ3, we distinguished four types of validation strategies as illustrated in Section 5. We remark that a vast amount of works [24,27,31,59] have adopted simulation to imitate the behaviour of vehicles and evaluate a set of performance criteria.Despite experimentation can show solutions efficiency in a real world, it suffers from the expensive technologies requirement.For this reason, only some research attempts have been validated based on real experiments.Additionally, a little consideration has been given to the formal verification of the proposed platooning algorithms.Only some papers [41,60] have adopted handwritten proofs method which does not require time and effort to master a formal language.Nevertheless, it is error-prone especially in the case of complex systems.So, a minor error can have serious consequences on the system operation.Most of the reviewed papers [44,46,49,61,62] have used the model checking method to ensure the correctness of the proposed algorithms.In fact, this method is easy for developers to understand and it relies on automated techniques that can perform a fast evaluation.We also notice that only few works [53,55] adopt theorem proving despite the effective correctness of this method that can deal with complex formalisms and handle infinite state spaces.The main drawback of this method is the need of the user's interaction such as using proof tactics and adding invariants.
Testing is another strategy which has been rarely used to validate platooning systems.In fact, it can detect errors only for a limited number of scenarios.Finally, we identified some research studies that are based on two strategies to validate their works.For instance, Kamali et al. [62] and Karoui et al. [44] have adopted simulation and formal verification.

RESEARCH CHALLENGES
Vehicles platooning has become a topic of intensive research.Despite many experimental and theoretical results have been provided, this research field still faces several challenges to be addressed.In this section, we introduce a list of open research issues on platooning systems to answer the fourth question (RQ4).

Adopting Theoretical Models
Platooning algorithms are so complex due to the dynamic behaviour of vehicles and the diversity of the operations that can take place (platoon merge, platoon split, platoon join, etc.).Thus, enacting theoretical models to design these algorithms and the evolution of the network topology still an open issue that needs to be addressed.The goal of these models is to represent platooning systems at a high level of abstraction.This can reduce specifying and proving efforts [63,64].For example, in order to design a dynamic network, different models have been proposed in the literature such as evolving graphs [65], random graphs [66], etc.

Testing Platooning Algorithms
Few attempts have adopted testing as a validation technique to detect errors in platooning algorithms.One of the limitations faced by the existing works is the use of specific test infrastructures such as the COSTO tool which is intended for Java language.Vehicular environments are characterized by a strong mobility and a high dynamicity of vehicles.So, using the runtime testing [67] is a more efficient solution to validate the studied systems.Also, adopting a generic test standard like TTCN-3 [68] for the specification or the execution of runtime tests remains an essential issue that has to be performed.

Proving the Correctness of Platooning Algorithms
As platooning is adopted in an extremely critical environment, a minor error can have catastrophic and costly results.Thus, formal verification is so relevant for preventing design errors in platooning algorithms and ensuring the correctness of the properties defined by the designer.Although few works, such as [44,55], addressed the correctness of these algorithms, they still in very early stages.So, more efforts need to be made for specifying and verifying the different operations that can take place during platooning.In addition, timing constraints related to platooning have to be considered to ensure the safety of conductors and vehicles.Achieving this need will require an efficient modelling method and a tool that can specify and verify time-related properties.

Verifying Security Solutions for Platooning
Although platooning is an efficient solution that can reduce travel time and fuel cost, it has different security issues.Several works [69][70][71][72] are interested in detecting security attacks in platoons and mitigating their impacts.Nevertheless, the literature still lacks an effective solution to verify the correctness of these works.Therefore, using formal methods to prove security solutions will be the trend of future research.

CONCLUSION
Vehicle platooning has become a topic of considerable interest in the field of modern transportation systems.In this paper, we have conducted an SLR based on a set of selected papers in the last ten years.First, an overview of the possible operations aiming to manage platoons has been presented.Second, a description of the communication types for vehicular platooning has been introduced.Moreover, a holistic view about the validation strategies attempting to check the accuracy and the correctness of the reviewed proposals has been shown.The benefits and the drawbacks of these strategies have been examined.This survey paper also provides a rich discussion related to the studied approaches based on the defined research questions.Finally, a set of open issues that can significantly enhance the existing platooning systems have been listed.

Figure 1 |
Figure 1 | Description of the SLR process.

Table 1 |
A comparison of our paper with the existing surveys

Table 2 |
Comparison of the formal verification approaches

Table 3 |
Summary of some platooning systems

Year References Platooning operations Communication types Validation strategies Within the platoon Platoon structure V2V V2I Simulation Experimentation Verification Testing
https://costo.univ-nantes.fr/