1 Introduction↩︎

We are interested in motion planners for autonomous driving that do more than avoid collisions and reach a goal: planners that resolve a priority-ordered rulebook—safety before regulatory compliance, comfort, and efficiency—at the vehicle’s control rate. Such conflicts are routine: a vehicle may briefly cross a lane boundary to pass a stopped obstacle, and braking early for comfort can disrupt following traffic. Planners must also be auditable: after an objective conflict, an engineer should be able to identify which rule was relaxed and by how much [1], [2]. These requirements are difficult to combine. Lexicographic schemes make priorities explicit, and cascaded strict-priority quadratic programs reach kilohertz rates in whole-body control [3], [4]; however, when applied to nonconvex driving NMPC, a sequential formulation requires multiple nonlinear-program solves and tier-freezing at every cycle, increasing latency and disrupting warm starts. Learned planners scale well but expose limited per-rule structure for audit [5]–[7], whereas conventional penalty stacks do not directly reveal how conflicts were resolved.

1.0.0.1 W-SQP.

Our primary contribution is W-SQP, a weighted soft-constrained quadratic-penalty NMPC, also referred to as tiered-slack NMPC. W-SQP compiles nine rule families into a four-tier shared-slack nonlinear program built in CasADi and solved with IPOPT [8], [9]. Strongly separated penalties bias residual violations toward comfort and efficiency and away from safety and regulatory rules, while physical actuation bounds remain hard. This scalar penalty provides a priority bias, not lexicographic priority preservation (Sec. 3). W-SQP replans from its executed state at \(10\) Hz; under a \(90\) ms solver-time limit, IPOPT returns its best iterate, which is projected through the dynamics before execution. Each cycle also records normalized per-rule residuals for audit.

1.0.0.2 Evaluating a non-imitative controller.

Because W-SQP plans from its executed state, it may select a valid path that differs from the recorded human trajectory. Closed-loop benchmarks evaluate executed states against reactive agents [10], [11], but some catalogues also include path-tracking or route-adherence rules defined relative to the human log. Such rules measure imitation as well as driving quality, and aggregating them with physical and regulatory rules conflates “drives like the recorded human” with “drives well”—a form of proxy failure related to Goodhart’s law [12]. As a supporting contribution, Section 5 classifies metrics by their referenced state and decomposes the aggregate deficit into log-independent compliance and an imitation premium.

Taken together, two gaps emerge: a planning formulation that makes the resolution of competing priorities explicit and auditable while remaining computationally viable at the control rate, and an evaluation methodology that measures driving quality without rewarding resemblance to a single recorded trajectory. In this work, we address both.

1.0.0.3 Closed-loop study.

We evaluate W-SQP on \(150\) WOMD scenarios in Waymax [11], [13] against reactive and proposal-and-select baselines. Across the sixteen log-independent safety and regulatory rules, W-SQP has a mean difference of \(-0.04\,\mathrm{pp}\) relative to expert replay, with no systematic group-level deficit. The two log-coupled rules account for a much larger mean difference of \(-10.1\,\mathrm{pp}\); Cohen’s \(d=-0.62\) describes the contrast between these groups. This aggregate result does not imply per-rule parity: non-traversable-surface, speed-limit, and drivable-surface compliance decrease by \(2.9\), \(2.3\), and \(2.1\,\mathrm{pp}\), respectively, primarily in high-divergence scenarios (Table 3).

The contributions are:

• W-SQP control architecture. A rulebook-aware NMPC that maps nine rule families to four shared-slack tiers, retains hard actuation bounds, and logs normalized per-rule residuals every cycle (Sec. 3).

• Real-time and anytime characterization. An analysis of NLP size, sparsity, and solver-time limits: \(28\) ms median and \(104\) ms maximum observed wall-clock time, with dynamics projection of the anytime iterate (Sec. 4).

• Log-independent evaluation protocol. A referenced-state taxonomy and imitation-premium decomposition separating driving quality from resemblance to a logged trajectory (Sec. 5).

• Closed-loop WOMD evaluation. A \(150\)-scenario comparison with reactive and proposal-and-select baselines, with robustness controls and separate reporting of localized safety regressions (Sections 6 and 7).

The remainder of the paper is organized as follows. Section 2 situates W-SQP within rule-aware planning, closed-loop benchmarking, and metric construction. Section 3 presents the controller, Section 4 its real-time characterization, and Section 5 the log-independent evaluation protocol. Sections 6 and 7 present the closed-loop study, Section 8 discusses practical implications and limitations, and Section 9 concludes.

2 Related Work↩︎

Our work sits at the intersection of rule-aware planning and control, closed-loop benchmarking, and compliance-metric construction. We first review the benchmarking literature that motivates the fair-evaluation protocol, then situate W-SQP within rule-aware planning.

2.1 Closed-loop benchmarking and its metrics↩︎

Closed-loop evaluation is now standard because open-loop log matching cannot capture feedback or interaction [5], [10]. nuPlan provides a large-scale planner benchmark with simulation interfaces [10], and Waymax supports efficient JAX-based closed-loop rollouts on WOMD scenarios [11], [13]. These ecosystems standardize planner rollout, but a bespoke scoring catalog may still combine collision, progress, comfort, and trajectory-matching terms without distinguishing driving quality from resemblance to the logged human. PDM [5] demonstrates the limitations of open-loop scores; our complementary concern is that log-alignment terms reintroduce an imitation bias even within closed-loop evaluation.

2.2 Agent realism vs.metric construction↩︎

The closest recent work studies how the reactive agents in the simulator affect benchmark outcomes. [14] replace IDM with a learned reactive policy across many nuPlan planners and find that IDM-based simulation overestimates planning performance, with planner-dependent score declines and ranking shifts; [15] introduce nuPlan-R with diffusion-based reactive agents and observe that learning-based planners look comparatively better under realism. Both vary the agent-realism axis and report aggregate-level effects. We vary a different axis—metric construction—and isolate the effect per rule: a specific, identifiable subset of rules (log-alignment proxies) is structurally biased against non-imitative planners, the bias is present even under plain IDM agents, and it can be removed without changing the simulator. Our finding thus partially explains the score shifts they report rather than competing with them: as agents become more reactive the human log becomes less followable, and any log-coupled sub-metric penalizes that divergence regardless of driving quality.

2.3 Goodhart, the imitation gap, and training–evaluation mismatch↩︎

Treating a proxy as a target is the classic setting of Goodhart’s law [12]: once an imitation surrogate is optimized or scored as if it were the objective, it stops measuring the objective. Log-alignment rules are exactly such surrogates—an expert-replay baseline maximizes them by definition—so aggregating them with physical-compliance rules conflates “drives like the logged human” with “drives well.”

This issue is related to, but distinct from, the imitation gap, which can denote an expert–learner discrepancy caused by different observability [16] or, in driving, a discrepancy between planned motion and its realization by a tracker and vehicle dynamics [6]; neither definition concerns scoring a valid alternative trajectory against a single logged demonstration. IGDrivSim [17] reports log divergence separately from overlap and off-road metrics but studies behavior-cloning policies rather than isolating reference dependence per rule. CLOVER [18] identifies a related training–evaluation mismatch and uses it to improve trajectory generation; we instead analyze the metric construction itself. Causal confusion in imitation learning [19] is also distinct: it concerns what a policy learns, whereas our analysis concerns how a policy is evaluated. Our contribution is the referenced-state taxonomy, per-rule empirical decomposition, and scoring recommendation, not the general observation that imitation and rule compliance can diverge.

2.4 Rule-aware planning and the design of W-SQP↩︎

Rulebooks [1] assign each rule a violation scalar and a priority order, with extensions to assurance [2] and optimal control [20]. Priority intent is encoded in MPC via lexicographic and hierarchical schemes, \(\varepsilon\)-constraint methods, or penalty separation [21]–[25]; formal methods provide temporal-logic semantics, monitors, and repair [26]–[30]; control-barrier-function filters [31]–[34] and Responsibility-Sensitive Safety (RSS) [35], [36] enforce safety feasibility; and learned planners [5], [6] scale well but expose little per-rule structure. Closer to W-SQP, real-time-constrained MPC has been developed specifically for on-road autonomous driving, including collocation-based schemes that embed control-barrier safety constraints while keeping the solve within a closed-loop budget [33], [34]. W-SQP shares its real-time, driving-specific emphasis but differs in its target: rather than certifying a single safety filter, it compiles a priority-ordered, multi-family rulebook into a single tiered-slack program and exposes a per-rule audit of the resulting trade-offs. Against this background, W-SQP uses established weighted-slack NMPC primitives rather than claiming a new planning-theory primitive or a lexicographic priority; its contribution is the integration of these primitives under real-time and auditability constraints. Section 5 then evaluates the resulting controller without treating log alignment as a safety or regulatory requirement.

3 The W-SQP Controller↩︎

We present W-SQP¹, a rulebook-aware receding-horizon controller that maps a heterogeneous driving rulebook to one online nonlinear program. It plans from the current executed state, biases soft-constraint relaxation by rule priority, and logs normalized per-rule residuals at each cycle; the constraints are smooth except for one clamped proximity gate (Sec. 3.4). The four tiers are optimized jointly rather than solved and frozen sequentially, so a sufficiently large lower-priority benefit can be traded off against a higher-priority violation: the formulation provides a penalty bias, not lexicographic priority preservation.

3.1 Model and decision variables↩︎

The ego vehicle follows a kinematic-bicycle model with state \(x_k=[p^x_k,p^y_k,\psi_k,v_k]^\top\in\mathbb{R}^4\) (position, yaw, and speed in the ego-local frame) and input \(u_k=[a_k,\delta_k]^\top\) (longitudinal acceleration and steering). Fourth-order Runge–Kutta integration discretizes the continuous dynamics \(\dot{x}=f_c(x,u)\) at \(\Delta t=0.1\) s, giving \(x_{k+1}=f(x_k,u_k)\) with CasADi-differentiable expressions [8]. At each replanning step, the NMPC optimizes over \(N=30\) steps (\(3.0\) s) with decision variables \(\mathbf{X}=\{x_0,\dots,x_N\}\), \(\mathbf{U}=\{u_0,\dots,u_{N-1}\}\), and \(\mathbf{S}\). The initial state \(x_0\) is fixed to the current executed ego state rather than a logged pose.

3.2 Objective↩︎

The cost has three parts, \(J=J_{\mathrm{base}}+J_{\mathrm{dyn}}+J_{\mathrm{slack}}\). The base term tracks a low-weight reference and penalizes effort and input rate, \[J_{\mathrm{base}}=\sum_{k=0}^{N-1}\!\Bigl(\|x_k-x_k^{\mathrm{ref}}\|_Q^2+\|u_k\|_R^2+\|\Delta u_k\|_S^2\Bigr)+\alpha_T\|x_N-x_N^{\mathrm{ref}}\|_Q^2, \label{eq:Jbase}\tag{1}\] with \(\Delta u_k=u_k-u_{k-1}\); the \(k{=}0\) terms (the input-rate and jerk penalties, and the jerk constraint below) use \(u_{-1}\), the first optimized control of the previous cycle’s solve carried in as a parameter under warm start (reset to zero on a solver fallback). The dynamics-shaping term discourages aggressive transients, \[J_{\mathrm{dyn}}=\sum_{k=0}^{N-1}\!\Bigl(W_{\mathrm{j}}\bigl(\tfrac{a_k-a_{k-1}}{\Delta t}\bigr)^2+W_{\mathrm{a}}\,a_{\mathrm{lat},k}^2\Bigr)+\!\sum_{k=1}^{N-1}\!W_{\dot{\mathrm{a}}}\bigl(\tfrac{a_{\mathrm{lat},k}-a_{\mathrm{lat},k-1}}{\Delta t}\bigr)^2, \label{eq:Jdyn}\tag{2}\] with \(a_{\mathrm{lat},k}=v_k(\psi_{k+1}-\psi_k)/\Delta t\). The reference \(x^{\mathrm{ref}}\) is the expert log, used only as a low-weight stabilizing signal (Table 2); it does not pin the ego to the log, and route adherence enters separately as one soft constraint below. This low weight is what makes W-SQP non-imitative: a representative \(2\) m log deviation costs about as much as a comfort-tier slack, so log alignment sits below the safety and regulatory tiers. “Non-imitative” means exactly this subordination, not the absence of any log reference. The slack term encodes priority through squared, weight-separated penalties, \[J_{\mathrm{slack}}=\sum_{j=1}^{4}\rho_j\sum_{k=0}^{N-1}\bigl(s_k^{(j)}\bigr)^2,\quad \rho_1{\gg}\rho_2{\gg}\rho_3{\gg}\rho_4, \label{eq:Jslack}\tag{3}\] ordering the four tiers safety \(\succ\) regulatory \(\succ\) comfort \(\succ\) efficiency. This scalarization is a feasibility-preserving relaxation that keeps residual violations low and biased toward low-priority families.

We penalize the slacks quadratically (\(\ell_2\)) rather than with the exact \(\ell_1\) penalty of the soft-constrained-MPC literature [37], [38]. The trade-off is deliberate. The \(\ell_1\) form has a theoretical advantage: above a finite weight threshold, it satisfies each tier’s constraints exactly whenever they are feasible, and yields the least violation otherwise. The \(\ell_2\) form gives this up—because \(\nabla(\rho s^2)\to0\) as \(s\to0\), small violations become asymptotically free, and even Tier-1 surrogates settle just below \(100\%\) (Table 4). What \(\ell_2\) buys in return is numerical: it is strictly convex and \(C^2\) in the slacks, it removes the dual degeneracy that \(\ell_1\) shows at its exact-penalty threshold, and it produces a better-conditioned barrier Hessian. Across the \(28{,}131\) warm-started solves at \(10\) Hz this made IPOPT markedly more robust, which is why we chose it. An \(\ell_1\) variant—which would additionally let us check the lexicographic-equivalence conditions per solve from IPOPT’s returned multipliers—is a natural refinement for future work.

3.3 Tiered soft constraints and the NLP↩︎

Fig. 2 shows the mapping from rulebook to program: each priority family maps to one of four tiers, and all constraints in a tier share a single nonnegative slack per step whose penalty weight \(\rho_j\) is separated by orders of magnitude. Each rule surrogate is an inequality \(g_i(x_k,u_k)\le0\), relaxed by a single shared slack per tier per step via a fixed family-to-tier map \(\pi(i)\in\{1,2,3,4\}\): \[g_i(x_k,u_k)\;\le\;s_k^{(\pi(i))},\qquad s_k^{(j)}\ge0 . \label{eq:soft}\tag{4}\] W-SQP solves, at each step, \[\label{eq:nlp} \begin{align} \min_{\mathbf{X},\mathbf{U},\mathbf{S}}\;& J_{\mathrm{base}}+J_{\mathrm{dyn}}+J_{\mathrm{slack}}\\ \text{s.t.}\;& x_{k+1}=f(x_k,u_k),\quad x_0=x_{\mathrm{current}},\\ & g_i(x_k,u_k)\le s_k^{(\pi(i))},\;\; s_k^{(j)}\ge0,\quad\forall i,j,k,\\ & a_{\min}\le a_k\le a_{\max},\;|\delta_k|\le\delta_{\max},\;0\le v_k\le v_{\max}, \end{align}\tag{5}\] where the last line contains hard physical bounds on acceleration, steering, and speed. Collision avoidance and the road boundary are, by contrast, Tier-1 soft constraints: they carry the largest penalty \(\rho_1\) but may in principle be relaxed—the sub-\(100\%\) safety-rule compliance in Table 4 reflects exactly this. The single-slack-per-tier design yields only \(4N=120\) slacks (vs.one per constraint), which is what makes \(10\) Hz replanning tractable; it couples within-tier constraints, so the slack tracks the most binding active constraint in its tier. We solve 5 with IPOPT [9] (MUMPS), warm-started by the time-shifted previous solution.

3.4 Constraint surrogates↩︎

Let \(p_k=[p^x_k,p^y_k]^\top\) and \(p_k^{(m)}\) the position of tracked object \(m\in\{1,\dots,M\}\). The families and their evaluator-rule coverage are in Table 1.

Collision (Tier 1) and road boundary (Tier 1): \[\begin{align} g_{\mathrm{col}}&=d_{\mathrm{safe}}^2-\|p_k-p_k^{(m)}\|_2^2\le s_k^{(1)},\label{eq:collision}\\ g_{\mathrm{edge}}&=n_k^\top(p_k-b_k)-(w_{\mathrm{ego}}+m_{\mathrm{edge}})\le s_k^{(1)}, \end{align}\tag{6}\] with \(b_k\) the nearest road-edge point and \(n_k\) its outward normal.

Speed limit, traffic light, route (Tier 2): \[\begin{align} g_{\mathrm{spd}}&=v_k-v_{\max,k}\le s_k^{(2)},\\ g_{\mathrm{tl}}&=w_R(d_k^{(j)})\,(v_k-v_{\mathrm{stop}})\le s_k^{(2)},\\ g_{\mathrm{route}}&=\|p_k-p_k^{\mathrm{ref}}\|_2-d_{\mathrm{route}}\le s_k^{(2)} .\label{eq:route} \end{align}\tag{7}\] The traffic-light gate uses a clamped proximity weight \(w_R(d)=\max\!\bigl(0,\,1-d/R\bigr)\) for stop distance \(d_k^{(j)}\) and approach radius \(R\); clamping at \(0\) makes the gate inactive beyond \(R\). The clamp is necessary: without it, \(d>R\) gives \(w_R<0\), so the term \(w_R(v_k-v_{\mathrm{stop}})\) decreases with speed and would reward acceleration toward the light. This \(\max(0,\cdot)\) is the one non-smooth surrogate; we pass its \(C^0\) kink to IPOPT as-is, since it sits off the active set whenever the gate is inactive. None of the solver failures behind the \(0.58\%\) open-loop-fallback rate (Sec. 4) localizes at the kink, and traffic-light compliance (\(^{7}r_{1}\)) is at parity (\(+0.3\,\mathrm{pp}\)).

Comfort, jerk, lateral acceleration (Tier 3): \[\begin{align} g_{\mathrm{dec}}&=-a_k-a_{\mathrm{comf}}\le s_k^{(3)},\\ g_{\mathrm{jerk}}^{\pm}&=\pm\tfrac{a_k-a_{k-1}}{\Delta t}-j_{\max}\le s_k^{(3)},\\ g_{\mathrm{lat}}&=\bigl(\tfrac{v_k^2}{L}\tan\delta_k\bigr)^2-a_{\mathrm{lat,max}}^2\le s_k^{(3)} . \end{align}\]

Headway (Tier 4): with a per-agent validity flag \(\nu_m\in\{0,1\}\) (unity for a tracked agent, zero otherwise) and the center-to-center distance to agent \(m\)’s constant-velocity prediction \(p_k^{(m)}\), \[g_{\mathrm{hw}}=\nu_m\bigl(T_{\mathrm{hw}}v_k-\lVert p_k-p_k^{(m)}\rVert\bigr)\le s_k^{(4)} .\] The flag \(\nu_m\) only deactivates absent agents. The surrogate is deliberately simple: it uses the center-to-center distance rather than an along-track projection, so at \(v{=}15\) m/s it activates on any tracked agent within \(T_{\mathrm{hw}}v{=}22.5\) m in any direction—a weak repulsive potential that the lowest (Tier-4) weight keeps benign. We treat this crude proxy, like the constant-velocity prediction it depends on, as an experimental variable rather than tuning it away (Sec. 6).

3.5 Surrogate vs.evaluator↩︎

W-SQP enforces the differentiable surrogates above, not the evaluator’s \(25\) rules directly, and the geometries differ (center-to-center vs.corner-to-corner collision distance; a norm-based route surrogate vs.the evaluator’s position-and-heading thresholds). The evaluator remains authoritative. We examine the surrogate–evaluator mismatch directly in Sec. 7 so that the log-coupling result cannot be an artifact of the controller’s internal geometry.

3.5.0.1 Rules without a dedicated surrogate.

Twelve of the evaluator’s \(25\) rules—including stop-sign compliance (\(^{8}r_{0}\)), crosswalk yield (\(^{8}r_{1}\)), yield-to-priority (\(^{1}r_{0}\)), lane intrusion (\(^{3}r_{6}\)), and the two advisory-only rules—have no dedicated term in the NLP 5 . Where W-SQP scores well on them anyway (Table 4), the reason is one of two. Some are rarely applicable in the scenario set—a stop sign or an occupied crosswalk within range—so their compliance is computed over very few steps and says little about capability. Others are satisfied incidentally: yield-to-priority and lane intrusion, for instance, fall out of the Tier-1/Tier-2 collision, road-boundary, and route surrogates. Either way this is an empirical observation about the evaluated scenarios, not a design property, and we list it among the limitations of Sec. 3.6.

3.6 Controller characterization and limitations↩︎

The per-cycle slack log makes the controller’s relaxation decisions inspectable after the fact. On a single scenario the safety and regulatory tiers stay inactive throughout while relaxation is confined to comfort and efficiency, and this holds across the fleet as well (Fig. 9, Sec. 7)—the priority bias read off the log rather than asserted.

Acknowledged limitations. A single slack per tier tracks only the most binding constraint in that tier, so we audit each surrogate’s normalized residual rather than reading the active rule off the shared slack. Across the fleet, the route surrogate is relaxed on about \(17\%\) of steps, against \(2.5\%\) for collision, \(4.9\%\) for road edge, and \(1.6\%\) for speed (Fig. 9). Constraints within a tier also carry different units—Tier 1 mixes a squared-distance collision residual (m\(^2\)) with a signed road-edge distance (m)—so raw slack magnitudes are neither comparable nor deliberately balanced; nondimensionalizing each surrogate by its threshold, \(\tilde{g}_i=g_i/\tau_i\), would fix this. The remaining limitations are the lack of a lexicographic guarantee, constant-velocity agent prediction, surrogate–evaluator mismatch (including the twelve rules with no surrogate above), and a single-disk collision model that under-covers long vehicles.

4 Real-Time Implementation and Computational Analysis↩︎

Real-time operation is a design requirement for W-SQP. This section reports the controller’s computational cost, the empirical solve-time tail, behavior under a solver-time limit, and the dynamics projection used prior to execution.

4.1 Compute target and problem size↩︎

All timing figures are measured on a single-workstation target—an Intel Core i9-12950HX (16 cores, up to \(5.0\) GHz, \(64\) GB RAM)—running IPOPT single-threaded with the MUMPS linear solver, so the numbers reflect one solver instance rather than a parallel farm. Re-profiling on an embedded automotive target is future work (Sec. 9); the aim here is to characterize the algorithm’s intrinsic cost and tail behavior, not to certify a specific ECU.

The tractability of that cost rests on structure. At the fixed settings of Table 2 (\(N{=}30\), up to \(M\) tracked agents) the transcribed NLP has \(304\) decision variables and \(818\) constraints, and its constraint Jacobian \(\partial g/\partial w\) carries only \(2381\) nonzeros—a density of \(0.96\%\) (Fig. 3). The banded, near-block-diagonal pattern is the multiple-shooting signature: each stage couples only to its neighbor through the dynamics defect, and the tiered soft constraints add sparse rows rather than dense coupling. IPOPT with MUMPS exploits exactly this sparsity, which is why a nominally \(304\)-variable nonconvex program can be solved in tens of milliseconds. The \(10^{8}\)–\(10^{0}\) span of the tier penalties is left to IPOPT’s default gradient-based NLP scaling with an adaptive barrier strategy; the heavy uncapped solve-time tail concentrates in the same hard, high-divergence scenes—those with the worst-conditioned barrier Hessians—in which the anytime cap binds.

4.2 Typical solve time↩︎

Across the \(28{,}131\) closed-loop solves of our \(n{=}150\) evaluation (Sec. 7), warm-started W-SQP solves in a median of \(28.4\) ms—comfortably within a \(100\) ms budget—with a mean of \(77.6\) ms inflated by a heavy tail (p95 \(230\) ms, p99 \(1.08\) s, max \(5.74\) s). The controller therefore typically meets \(10\) Hz, but not worst-case; a gentle open-loop braking fallback covers the \(0.58\%\) of solves (\(163/28{,}131\)) that exceed tolerance or fail, so tail latency degrades gracefully rather than stalling the rollout. The fallback also cannot drive the log-coupled result of Sec. 5: at \(0.58\%\) of solve steps, even if every fallback step maximally violated a log-coupled rule, it could shift that rule’s compliance by at most \({\approx}0.6\,\mathrm{pp}\)—negligible against the \(-10.1\,\mathrm{pp}\) deficit.

4.3 Observed latency under a solver-time limit↩︎

We re-run all \(150\) scenarios with IPOPT’s max_cpu_time set to \(90\) ms. When the limit is reached, IPOPT returns its best iterate and the controller records a budget hit. This option is not a strict wall-clock deadline: IPOPT checks it at iteration boundaries, allowing the current iteration to finish, and it measures CPU rather than wall-clock time. On our single-threaded configuration, the two measures track closely. The limit reduces the observed tail to a \(28.5\) ms median, \(39.6\) ms mean, \(96\) ms p99, and \(104\) ms maximum, compared with a \(5.74\) s maximum without the limit; \(11.9\%\) of solves reach the limit (Fig. 4).

The log-coupling decomposition is nearly unchanged under the solver-time limit (\(\overline{\Delta c}_{\log}=-10.8\,\mathrm{pp}\), \(\overline{\Delta c}_{\mathrm{inv}}=+0.4\,\mathrm{pp}\)), so the fair-evaluation result of Sec. 5 is not an artifact of unbounded solve time. We therefore describe W-SQP as anytime-capable: it usually meets the \(10\) Hz loop period and returns a best iterate when the solver-time limit is reached. A hard-real-time claim would require a platform-level deadline mechanism and worst-case execution-time analysis.

The best iterate retains the hard bounds. The interior-point iterate stays strictly within the hard box bounds on acceleration, steering, and speed (the barrier enforces them, to IPOPT’s default \(10^{-8}\) bound-relaxation tolerance), and the executed pose’s lateral acceleration and jerk are additionally hard-clamped in post-processing (to \(2.8\) m/s\(^2\) and \(2.5\) m/s\(^3\), via a bound on the executed heading increment); “never relaxes hard physical bounds” refers to these actuation and box limits, which hold on every step, cap-hit or not. Longitudinal jerk, by contrast, is governed only by the soft Tier-3 slack, which is why the evaluator’s longitudinal-jerk rule (\(^{1}r_{9}\)) shows a small residual deficit (\(-3.7\,\mathrm{pp}\), Table 4) while the lateral comfort rules stay at parity.

What a non-converged iterate does not guarantee is exact satisfaction of the dynamics equality \(x_{k+1}=f(x_k,u_k)\). Measuring the executed-step defect \(\lVert x_1-f(x_0,u_0)\rVert\) over every cap-hit solve in a dedicated \(50\)-scenario instrumented run (\(9{,}374\) solves, \(1{,}102\) cap-hits at \(11.8\%\)): \(34\%\) of cap-hit iterates are already exactly feasible and the median defect is below \(1\) mm, but the tail is heavy—p95 \(0.20\) m, p99 \(0.74\) m, worst \(15.5\) m—because where the cap binds almost every step, the raw best iterate can be grossly model-inconsistent.

We therefore project the anytime iterate onto the dynamics before execution: the executed pose is \(f(x_0,u_0)\), the applied control rolled through the vehicle model, so every executed pose is dynamically feasible by construction and “never relaxes hard physical bounds” holds for both the box bounds and the dynamics (Fig. 5). Projection is a no-op for converged solves and alters only the \({\approx}11\%\) cap-hit steps. Under it the capped decomposition is essentially unchanged—\(\overline{\Delta c}_{\log}=-9.9\,\mathrm{pp}\), \(\overline{\Delta c}_{\mathrm{inv}}=+0.4\,\mathrm{pp}\), versus \(-10.8/{+}0.4\) raw and \(-10.1/{-}0.04\) uncapped—so the fair-evaluation result is not an artifact of the anytime executor; if anything, projection slightly shrinks the log-coupled deficit by removing the raw iterate’s rare teleport excursions.

4.4 Sensitivity to the solver-time limit↩︎

To assess sensitivity to available compute, we sweep the CPU-time limit over \(\{30,50,70,90,120\}\) ms and include an unlimited condition on a \(40\)-scenario subset (Fig. 6). The log-independent safety/regulatory difference remains near parity throughout the sweep: it is \(-0.14\,\mathrm{pp}\) at \(30\) ms, where \(55\%\) of solves reach the limit. The log-coupled difference changes from \(-11.6\,\mathrm{pp}\) at \(90\) ms to \(-18.5\,\mathrm{pp}\) at \(30\) ms. The budget-hit rate rises smoothly from \(12\%\) at \(120\) ms to \(55\%\) at \(30\) ms. These data indicate graceful degradation on this subset, but they do not replace profiling on an embedded automotive target.

5 A Fair, Log-Independent Evaluation Protocol↩︎

W-SQP may follow a valid trajectory that differs from expert replay. To separate driving quality from resemblance to that replay, we classify closed-loop metrics by the state they reference and decompose aggregate compliance into log-independent and log-coupled terms. Section 7 uses this protocol to report both terms rather than merging them into one score.

5.1 Closed-loop rollouts↩︎

A scenario \(\omega\in\mathcal{D}\) fixes an initial state, a static environment \(e_\omega\) (map and traffic-control state), and a recorded (logged) ego trajectory \(\xi^{\star}_\omega=(s^{\star}_0,\dots,s^{\star}_T)\) with planar positions \(p^{\star}_k\). An ego policy is a causal map \(\pi\colon\mathcal{S}_k\mapsto a_k\). Rolling out \(\pi\) in closed loop with a reactive non-ego policy \(\pi_{\mathrm{NPC}}\) [39] at \(10\) Hz produces the executed state sequence \[\Gamma(\pi,\omega)\;=\;\bigl(\xi^{\pi}_\omega,\;\zeta^{\pi}_\omega,\;e_\omega\bigr), \label{eq:rollout}\tag{8}\] where \(\xi^{\pi}_\omega\) is the executed ego trajectory (positions \(p^{\pi}_k\)) and \(\zeta^{\pi}_\omega\) the executed non-ego trajectories. Because the agents are reactive, \(\zeta^{\pi}_\omega\) depends on \(\pi\): a planner that deviates from \(\xi^{\star}_\omega\) elicits different agent responses. Expert replay is the policy \(\pi_{\star}\) that reproduces the log, \(\xi^{\pi_{\star}}_\omega=\xi^{\star}_\omega\). All metrics below are functionals of \(\Gamma(\pi,\omega)\) alone (evaluation on executed states only), preventing leakage [5], [10].

5.2 Compliance metrics as functionals↩︎

Each rule \(r\) defines a violation predicate \(\phi_r\) and an applicability indicator \(\alpha_r\), both evaluated per step, and a per-rule compliance \[c_r(\pi,\omega)\;=\;100\cdot\Bigl(1-\tfrac{1}{T}\textstyle\sum_{k=0}^{T-1}\alpha_r(\mathcal{S}^{\pi}_k)\,\phi_r(\mathcal{S}^{\pi}_k)\Bigr)\in[0,100]. \label{eq:rule95compliance}\tag{9}\] The indicator \(\alpha_r\) zeroes steps at which the rule does not apply, so the sum counts only applicable violations—but the normalization is over all \(T\) steps. Compliance \(c_r\) therefore blends how often a rule applies with its conditional violation rate, and a rarely applicable rule scores high almost automatically. Under our paired, same-scenario evaluation both policies face nearly identical applicability, so \(c_r\) is a sound relative measure even though it is not an absolute safety rate—which is why some rules flag even expert replay at high rates (Sec. 8.4). All our claims are paired differences, for which this normalization is appropriate. The catalogue has \(|\mathcal{R}|=25\) rules over \(9\) populated priority levels; an aggregate is the weighted mean \(C(\pi,\omega)=\sum_{r}w_r\,c_r\), as used in leaderboards. The evaluator’s geometry is independent of any planner surrogate (corner-to-corner bounding-box distances, signed distance to road-edge polylines), with a fixed strictness multiplier \(\kappa=1.25\) applied identically to both policies. Here “independent” means independent of the planner’s differentiable surrogates; the evaluator is part of the same rulebook framework, not a third-party benchmark.

5.3 A taxonomy by referenced state↩︎

The decisive question for fairness is what part of the world a predicate reads. We split the rollout arguments of \(\phi_r\) into the executed driving \(D_\omega^{\pi}\triangleq(\xi^{\pi}_\omega,\zeta^{\pi}_\omega,e_\omega)\)—everything physically realized—and the recorded log \(\xi^{\star}_\omega\).

A canonical log-coupled rule is the deviation predicate \[\phi_r(\mathcal{S}^{\pi}_k)=\mathbb{I}\!\left[d(p^{\pi}_k,p^{\star}_k)>\tau_r\right],\] where \(\tau_r\) is a threshold and \(d\) is a pose distance. Path tracking (\(^{0}r_{0}\)) and route adherence (\(^{2}r_{2}\)) have this form. In our evaluator, their position thresholds are \(2.4\) and \(4.0\) m, respectively, and route adherence also uses a \(0.4\) rad heading threshold. These values include the strictness factor \(\kappa=1.25\). Route adherence is log-coupled here because our evaluator defines it relative to the logged pose; route adherence defined against a lane graph or assigned corridor would instead be map-defined and log-independent.

Equivalently, a log-independent metric assigns the same score to two rollouts that differ only in which compliant path the planner chose; log-coupled metrics are exactly those that do not.

Log-independent rules subdivide by which part of \(D^{\pi}_\omega\) they read: map-defined (static map/traffic control, e.g.drivable surface, traffic-light, stop sign), interaction-defined (other agents \(\zeta^{\pi}_\omega\), e.g.collision, headway, clearance), and controller-defined (ego smoothness only, e.g.jerk, comfort). For analysis we group the safety/regulatory log-independent rules into the set \(\mathcal{R}_{\mathrm{inv}}\) (\(16\) rules), report controller-defined rules (\(\mathcal{R}_{\mathrm{ctrl}}\), \(7\) rules) separately as an intermediate group, and isolate \(\mathcal{R}_{\log}\) (\(2\) rules). We refer to \(\mathcal{R}_{\mathrm{inv}}\) as log-independent as shorthand for log-independent safety/regulatory: the group’s compliance is invariant to whether the ego imitates the log, not insensitive to interaction—collision, headway, and clearance plainly depend on the other agents. The partition is fixed a priori from each rule’s definition, independent of any result.

5.4 The log-coupling confound↩︎

The following two facts are elementary but underpin the fair comparison of Sec. 7: they show a log-coupled metric measures imitation, not driving quality.

These results motivate a fairness desideratum for quality metrics.

Log-independent metrics are imitation-invariant by Def. 2; log-coupled metrics violate it. In Goodhart terms [12], a log-coupled rule optimizes resemblance to one recorded human rather than the underlying objective. The protocol therefore prescribes how W-SQP is scored in Sec. 7: report compliance over \(\mathcal{R}_{\mathrm{inv}}\) separately from the imitation score over \(\mathcal{R}_{\log}\), so driving quality is not conflated with deliberate divergence from the log. Whether the two are in fact separable in practice—\(\Delta_{\mathrm{imit}}\) large while the log-independent deficit is null—is the empirical question the experiments settle.

5.5 Statistical methodology↩︎

With \(n=150\) paired scenarios under identical configurations, the deterministic simulator makes the ego policy the only configured difference within each pair. Compliance differences are non-normal because many values concentrate near \(100\%\), so the Wilcoxon signed-rank test is primary and the paired \(t\)-test is secondary. Across the \(25\) per-rule hypotheses, Benjamini–Hochberg correction controls the false-discovery rate at \(\alpha=0.05\) [40]. For the contrast between \(\mathcal{R}_{\log}\) and \(\mathcal{R}_{\mathrm{inv}}\), we report Cohen’s \(d\), bootstrap \(95\%\) confidence intervals for group means, and the a priori sample size for \(80\%\) power.

6 Experimental Setup↩︎

Evaluation environment and scope. The validation is simulation-based. Its relevance to urban autonomous driving comes from four properties: (i) every scenario uses road geometry, actor trajectories, footprints, and speeds from WOMD logs [13]; (ii) the ego follows a kinematic-bicycle model with bounded acceleration, steering, lateral acceleration, and jerk (Table 2); (iii) non-ego agents respond through the IDM behavior model [39] rather than replaying fixed logs; and (iv) the same controller implementation is timed during \(10\) Hz closed-loop evaluation. Important deployment effects remain absent: the simulator provides ground-truth state and omits sensing and estimation errors, actuation latency, and low-level tracking error. The results, therefore, characterize closed-loop simulation performance and workstation runtime, not on-road transfer or embedded deployment; hardware-in-the-loop and vehicle tests remain necessary (Sec. 9).

Every reported number is traceable to a fixed scenario, a deterministic simulator, and evaluator output on executed states. The pipeline separates three components: (i) a Waymax [11] wrapper instantiating WOMD [13] scenarios at \(10\) Hz; (ii) an ego policy (expert replay, W-SQP of Sec. 3, or a baseline controller); and (iii) the \(25\)-rule evaluator of Sec. 5, consuming only executed states. At each step the loop queries \(a_k=\pi(\mathcal{S}_k)\), advances to \(\mathcal{S}_{k+1}\) with reactive IDM non-ego agents [39], and evaluates all monitors. For W-SQP the NLP is rebuilt once in CasADi [8] and re-solved every step via IPOPT [9]; solver settings and cost weights are in Table 2, fixed across all scenarios.

Scenario set. We use \(n=150\) WOMD scenarios drawn from shards \(0\)–\(39\) by a complexity-ranked scanner. The ranking combines SDC path length and heading change, agent count and diversity (with additional weight for vulnerable road users), and traffic-control presence. Each scenario lasts approximately \(18.7\) s at \(10\) Hz. This selection favors interaction-rich scenes; Section 7 repeats the decomposition on a uniformly random sample. Each scenario runs paired expert-replay and W-SQP rollouts under the same NPC configuration; determinism makes the ego policy the only configured difference between a pair. The dataset yields \(28{,}131\) NLP solves (approximately \(187\) per scenario); \(0.58\%\) use the open-loop braking fallback after a solver failure.

Exogenous interaction density. The density falsification control (Sec. 7) needs a difficulty measure that is a property of the scene, not the planner. At each step we count the other logged agents within radius \(R\) of the logged ego position and average over the rollout. Computed from the logs, it is identical for both policies—unlike planner-derived proxies such as solve time, which are endogenous and would make any density–compliance correlation circular. We report \(R\in\{20,30,50\}\) m.

Log-informed prediction ablation. On a \(30\)-scenario subset we replace W-SQP’s constant-velocity agent prediction with each agent’s constant velocity taken from its logged displacement over the horizon. This uses future log information, so it is not available online; nor is it a perfect oracle, since logged agents do not react to the altered ego rollout. It tests sensitivity to this one velocity estimate.

Baseline controllers. To evaluate W-SQP as a controller, not only as an evaluation instrument, we compare it against two architecturally distinct non-imitative planners on the same \(150\) scenarios and evaluator: a lightweight reactive controller (pure-pursuit \(+\) IDM) and a stronger sampling-based planner (PDM-Closed–style). Neither scores nor tracks the logged trajectory, so the comparison isolates control performance from the shared property of not matching the log.

Baseline controller: pure-pursuit \(+\) IDM. Lateral control is pure pursuit toward a lookahead point on the route geometry (lookahead \(6.0+0.6\,v\) m); longitudinal control is the Intelligent Driver Model with respect to the nearest in-path lead agent (free-flow speed set to the \(75\)th percentile of the scene’s logged ego speed, \(T_{\mathrm{hw}}{=}1.5\) s, \(s_0{=}5\) m). It uses no optimization, tracks no logged states, and follows the route at its own IDM-chosen speed.

Baseline controller: PDM-Closed–style. The stronger baseline is a PDM-Closed–style planner [5], a reimplementation in the spirit of the design that won the nuPlan closed-loop challenge (not a fully leaderboard-faithful port; see the route-corridor caveat below). It follows the proposal-and-select recipe: it generates \(15\) candidate policies (three lateral offsets \(\times\) five IDM target-speed profiles) along a route corridor, forward-simulates each over the \(3\) s horizon with constant-velocity agents, scores them with a nuPlan-CLS–style rule score (collision and off-road gates \(\times\) weighted route-progress, comfort, and speed-limit terms, with no log-deviation term), and executes the first control of the best. It is non-imitative—the score never references the logged trajectory—yet competent by construction on the rule set. We use the logged path geometry as the route corridor (a valid road; a full roadgraph route is a documented extension) and cap the pace to what the corridor affords, so divergence is emergent from the planner’s own speed/gap/offset choices, not imposed.

Threshold-sensitivity. To check that the log-coupled deficit is not an artifact of the deviation thresholds, we log the evaluator’s per-step raw deviation for the log-coupled rules and recompute their compliance across a sweep of thresholds \(\tau\) offline, for both planners (Sec. 7 reports the range).

Divergence sweep. To characterize the deficit across a continuum of planners between non-imitative W-SQP and expert replay, we add a single scalar \(\beta\in[0,1]\) that blends W-SQP’s executed next pose toward the logged pose at \(t{+}1\): \(\beta{=}0\) is W-SQP, \(\beta{\to}1\) approaches expert replay. The blend is applied in closed loop—the blended pose is executed and the reactive IDM agents respond to it each step, so the log-independent scores along the sweep are well defined. Because the pull toward the log is re-applied every \(0.1\) s, its effect compounds over the rollout: even a small per-step weight drives the executed trajectory close to the log, which is why by \(\beta{=}0.25\) the mean divergence has already collapsed to \({\approx}0\) (Fig. 12). Sweeping \(\beta\) thus parameterizes ego–log divergence directly.

Determinism and re-anchoring. All data are transformed to an ego-local frame for conditioning and inverted after solving. The low-weight reference \(x^{\mathrm{ref}}\) is time-indexed from the log; only if ego drift exceeds \(10\) m does it re-anchor to the closest future log point within a \(6\) s window, preventing the tracking term from racing ahead while still allowing recovery. Per-step speed limits use WOMD lane-type proxies (rule \(^{3}r_{0}\)). These choices keep the controller competent without making it imitative.

3pt

7 Results↩︎

We now evaluate W-SQP in closed loop. All results use paired evaluation at \(10\) Hz across \(n{=}150\) WOMD scenarios, with compliance computed from executed states. We proceed in five steps. We first place W-SQP as a controller against two non-imitative baselines and a no-tiering ablation (Sec. 7.1). We then show that its apparent aggregate deficit is almost entirely log-coupled (Sec. 7.2), which makes the naive aggregate unfair and lets a log-independent score flip W-SQP’s verdict from loss to parity (Sec. 7.3). Finally, we rule out the leading alternative explanations (Sec. 7.4) and illustrate the mechanism on two case studies (Sec. 7.5).

7.1 Control performance against baselines↩︎

Before analyzing the compliance score, we place W-SQP as a controller against the two non-imitative baselines of Sec. 6 (reactive PP+IDM and sampling-based PDM-Closed–style) and a no-tiering ablation, on the same \(150\) scenarios and the same evaluator. We read control quality off the log-independent rules—the safety, regulatory, and interaction rules that score driving quality without reference to the human log. On this group W-SQP attains \(93.6\%\) compliance, matching expert replay (\(93.7\%\); no systematic group-level deficit, Sec. 7.2) and leading both non-imitative baselines—PP+IDM \(91.8\%\) and PDM-Closed \(91.5\%\)—by roughly \(2\,\mathrm{pp}\). Among controllers that do not track the log, W-SQP is the one whose safety and regulatory behavior comes closest to the human’s.

On the log-coupled (imitation) axis every non-imitative controller necessarily falls below the expert’s \(100\%\), but the spread is enormous—W-SQP \(89.9\%\), PDM-Closed \(67.9\%\), PP+IDM \(33.0\%\)—and it orders the controllers by how much they happen to resemble the recorded human, not by how safely they drive. W-SQP’s comparatively high log-coupled score is itself in part an artifact of its soft route corridor (Eq. 7 , \(d_{\mathrm{route}}{=}2\) m at Tier-2 weight) and low-weight tracking reference, which supply the route intent that WOMD provides no other way to specify; a corridor-free planner of equal driving quality would diverge more and score lower. The \(-10.1\,\mathrm{pp}\) log-coupled deficit is therefore a conservative lower bound on the imitation penalty.

This contrast—a tight log-independent ranking beside a \(57\,\mathrm{pp}\)-wide log-coupled spread—is the confound in miniature. Fig. 7 places every planner in the plane of the two axes. Driving quality (horizontal) separates the planners by only \({\approx}2\,\mathrm{pp}\); imitation (vertical) spreads them by \({\approx}57\,\mathrm{pp}\); and the expert sits on the \(y{=}100\) dominance boundary of Prop. 1. A fair score reads the horizontal axis alone, so its iso-lines are vertical. The naive aggregate’s iso-lines are instead tilted by the \(16{:}2\) group sizes, so it ranks a two-dimensional reality by projecting it obliquely—and imitation leaks into the ordering.

The tiering carries the safety compliance. The paper’s central design claim is that the priority-biased tiering, not soft-constraint relaxation on its own, is what protects the high-priority rules. Three experiments support it. First, we remove the tiering entirely, setting all four slack weights equal to their geometric mean (\(\bar\rho{=}10^{4}\)) and leaving the controller otherwise unchanged. The log-independent deficit grows from \(-0.04\,\mathrm{pp}\) to \(-0.91\,\mathrm{pp}\)—an order of magnitude larger—the log-coupled deficit nearly doubles from \(-10.1\,\mathrm{pp}\) to \(-19.8\,\mathrm{pp}\), and overall compliance falls from \(93.4\%\) to \(91.7\%\). The flat program solves at the same rate, so this is the priority structure at work, not solver behavior.

The flat weight, however, changes two things at once: it removes the ordering between tiers and also lowers the overall stiffness of the top tiers. The remaining two experiments separate these. We first sweep the priority ratio \(r\) between adjacent tiers while holding the geometric-mean penalty fixed at \(10^4\), so total stiffness is constant, and only the ordering varies (\(r{=}1\) is the flat ablation, \(r{=}10^3\) the paper’s separation). As ordering strengthens on a \(40\)-scenario subset, the safety/regulatory deficit improves monotonically from \(-1.08\,\mathrm{pp}\) toward \(-0.68\,\mathrm{pp}\) and the log-coupled deficit from \(-17.5\) toward \(-13.4\,\mathrm{pp}\), while median solve time stays \({\approx}30\) ms throughout (Fig. 8). We then check the opposite extreme: raising all four weights uniformly to \(10^8\)—maximally stiff but unordered—degrades the safety/regulatory group further on the full set (\(-1.03\,\mathrm{pp}\), versus \(-0.91\) at flat \(10^4\) and \(-0.04\) tiered), with zero solver failures. Stiffer constraints without ordering are worse, not better; ordering is doing the work.

The priority bias is also visible as an auditable, fleet-level property (Fig. 9): logging each surrogate’s residual normalized by its own threshold, the safety/regulatory surrogates are relaxed on only a small fraction of steps (collision \(2.5\%\), road-edge \(4.9\%\), speed \(1.6\%\)) while the low-priority route surrogate absorbs most of the relaxation (\({\approx}17\%\))—exactly the ordering the tiering is designed to induce, measured across the fleet.

7.2 The compliance gap is log-coupled↩︎

Fig. 10 shows the mean paired difference \(\overline{\Delta c}=c(\pi_{\mathrm{mpc}})-c(\pi_{\star})\) by taxonomy group. The result is stark. The two log-coupled rules drop by \(\overline{\Delta c}_{\log}=-10.1\,\mathrm{pp}\), whereas the sixteen log-independent safety/regulatory rules show no systematic group-level deficit (\(\overline{\Delta c}_{\mathrm{inv}}=-0.04\,\mathrm{pp}\)); the controller-defined group lies between (\(-0.75\,\mathrm{pp}\)). We state the second finding as a bound rather than as parity: the bootstrap \(95\%\) CI, \([-1.07,+0.52]\,\mathrm{pp}\), places any systematic safety/regulatory deficit below \(1.1\,\mathrm{pp}\)—an order of magnitude under the log-coupled deficit, whose CI is \([-14.0,-6.6]\,\mathrm{pp}\). The two intervals do not overlap.

We rest the inference on those non-overlapping CIs rather than on a single effect-size number. Cohen’s \(d=-0.62\) between the two groups is reported as descriptive only, because the groups have very different intrinsic variance (\(\mathcal{R}_{\log}\) averages two rules, \(\mathcal{R}_{\mathrm{inv}}\) sixteen). For context, an effect of this size needs \(n{\approx}23\) scenarios for \(80\%\) power, or \(n{\approx}42\) under a more conservative two-sample assumption; at \(n{=}150\) the study is amply powered. Across scenarios the log-coupled deficit is heavy-tailed—its mean dragged down by a minority of high-divergence scenes—while the log-independent difference stays tight around zero (Fig. 10).

This is Corollary 1 made concrete. Because W-SQP matches expert replay on the log-independent rules (\(\delta_{\mathrm{ind}}\approx0\)), the entire aggregate gap collapses to the imitation premium—here \(\widehat{\Delta}_{\mathrm{imit}}=10.1\,\mathrm{pp}\). W-SQP is not a worse driver; it is a different driver, penalized only for not being the recorded human (Prop. 1, Prop. 2).

The per-rule view (Table 4) confirms the deficit is not diffuse. The two largest negative deltas are path tracking (\(^{0}r_{0}\), \(-10.7\,\mathrm{pp}\)) and route adherence (\(^{2}r_{2}\), \(-9.5\,\mathrm{pp}\))—both at \(100\%\) for expert replay by construction. The log-independent rules move in both directions by small amounts (headway \(+2.6\), clearance \(+1.9\), against speed limit \(-2.3\), drivable surface \(-2.1\)) and cancel at the group level, which is why the claim is a group-level one, not per-rule parity.

The small genuine regressions are not spread across the dataset either. The three largest significant safety/regulatory deficits—non-traversable surface, drivable surface, and speed limit (Table 3)—concentrate in the same high-divergence scenarios as the log-coupled penalty. They correlate with ego–log divergence at \(r{=}{-}0.90\), averaging \(-4.8\,\mathrm{pp}\) in the high-divergence half of scenarios but exactly \(0.0\,\mathrm{pp}\) in the low-divergence half. These are recovery transients in the hardest scenes, not a broad safety regression: in half the scenarios the safety/regulatory deficit simply vanishes. Benjamini–Hochberg correction flags \(10\) of \(25\) rules, the two log-coupled rules carrying the smallest \(q\)-values.

5pt

4pt

7.3 The aggregate is unfair; the log-independent score repairs it↩︎

The decomposition has a direct consequence for ranking. Fig. 11 plots, per scenario, the naive aggregate \(\Delta c\) (all \(25\) rules) against the log-independent \(\Delta c\). Almost every point lies below the parity line: the aggregate scores W-SQP harsher than the fair score, and the offset is the log-coupled contribution. Converting to verdicts with a \(\pm0.5\,\mathrm{pp}\) dead-band, the naive aggregate records W-SQP as losing \(44/150\) scenarios and winning \(32\) (mean \(-1.04\,\mathrm{pp}\)); under the log-independent score the verdict is balanced—\(30\) losses, \(34\) wins (mean \(-0.04\,\mathrm{pp}\))—with \(14\) scenarios flipped out of “loss.” A benchmark using the aggregate would report a net-negative, misleading ranking for a planner whose safety and regulatory compliance is, at the dataset level, statistically indistinguishable from the human’s (Table 3 details the localized exceptions). Reporting the log-independent score, with the log-coupled score separately as an imitation metric, removes the bias with no change to the simulator or agents—though, as Sec. 8 discusses, it presupposes an agreed rule classification and calibrated thresholds.

The confound is not an artifact of equal weighting. One might object that an unweighted mean over \(25\) heterogeneous rules is a straw aggregator, since rulebooks are priority-ordered and the log-coupled rules sit at the lowest levels (\(0\) and \(2\)). Re-weighting the aggregate by priority (\(w_r\propto(\ell_r{+}1)^p\), \(\ell_r\) the rule’s level) shrinks but does not remove the gap: the mean W-SQP\(-\)expert gap moves from \(-1.04\,\mathrm{pp}\) (equal weights) to \(-0.52\,\mathrm{pp}\) (\(p{=}1\)) and \(-0.41\,\mathrm{pp}\) (\(p{=}2\)), and the two lowest-priority log-coupled rules still account for \(78\%\) of the equal-weight gap. By Corollary 1 the imitation premium is positive for any weighting with \(w_r>0\) on a log-coupled rule; only excluding those rules removes it cleanly.

7.4 Falsification controls↩︎

The deficit is a predictable function of divergence. The magnitudes above are for two specific planners; what would a less-divergent planner—the kind that tops a leaderboard—incur? To answer, we build a continuum between non-imitative W-SQP (\(\beta{=}0\)) and expert replay (\(\beta{\to}1\)) by blending W-SQP’s executed pose toward the logged pose with weight \(\beta\), and trace the deficit against mean ego–log divergence (Fig. 12). The blend is a synthetic interpolation used only to parameterize divergence—the blended poses are not driven through the bicycle model—so the curve characterizes divergence versus deficit, not a family of realizable plans. The relationship is monotone and saturating: the deficit falls smoothly toward zero as divergence shrinks, vanishing only in the imitative limit, while log-independent compliance stays at parity throughout (\(-0.6\) to \(+0.1\,\mathrm{pp}\)).

Two things follow. A planner that stays closer to the log incurs a smaller deficit, but by Prop. 1 never a zero one. And the mapping is not universal across planners: PDM-Closed sits above this curve, with a larger deficit (\(-32\,\mathrm{pp}\)) at the same mean divergence (\(2.2\) m). The reason is that the deficit depends on the distribution of divergence, not its mean—bursty excursions cross the threshold more often than smoothly spread deviations of equal average. Divergence predicts the deficit within a planner family but does not reduce it to one number across families.

It is not interaction density. If the deficit reflected difficulty in crowds, it should grow with interaction density. It does the opposite. Regressing the log-coupled \(\Delta c\) on the exogenous scene density of Sec. 6 gives a positive slope (\(+0.45\,\mathrm{pp}\)/agent at \(R{=}30\) m, \(p{=}0.020\)), while the log-independent slope is flat (Fig. 13). A mediation analysis explains the sign: divergence drives the deficit (\(r{=}-0.68\)), but dense traffic produces less divergence (\(r{=}-0.22\)), because it funnels the ego onto the only feasible path—close to the human’s—whereas sparse scenes leave room for a valid alternative. The only proxy that yields the “expected” negative slope is the planner’s own solve time, an endogenous difficulty signal and precisely the circular measure an exogenous density is designed to avoid. Since the divergence-to-deficit link is partly tautological, we rest the main claim on the decomposition; this control establishes only the negative.

It is not the velocity predictor. W-SQP predicts other agents at their current constant velocity. Replacing this with a log-informed horizon-average velocity on a \(30\)-scenario subset barely moves the log-coupled difference (\(-10.3\,\mathrm{pp}\!\to\!-11.5\,\mathrm{pp}\)) and leaves the log-independent group unchanged. The check is limited to \(30\) scenarios and to one alternative estimate, so it supports robustness to the velocity model without ruling out prediction effects in general.

It is not specific to W-SQP. We repeat the whole decomposition on the two non-imitative baselines; the question now is not their control quality (Sec. 7.1) but whether the confound itself reproduces. It does, on both (Table 5): the log-coupled deficit is large (PP+IDM \(-67.0\,\mathrm{pp}\); PDM-Closed \(-32.1\,\mathrm{pp}\)) and far exceeds the log-independent one in each case. For the baselines, we claim only this reproducibility, not safety parity—their log-independent means are negative (\(-1.9\) and \(-2.2\,\mathrm{pp}\)), so they do drive somewhat less safely than the human on average, and PDM-Closed’s route corridor pushes it off-road in \(26\%\) of scenarios (a full roadgraph route would fix this). Only W-SQP reaches group-level log-independent parity. But the log-coupled deficit reproduces across three planners that share nothing except being non-imitative, which is the point: the deficit is a property of the metric, not of any one controller.

It is not a threshold artifact. The log-coupled rules fire when deviation from the logged pose exceeds a threshold \(\tau\) (nominally \(2.4\) m). Recomputing path-tracking compliance as \(\tau\) sweeps over \([1,6]\) m leaves the deficit large and negative everywhere: \([-26,-8]\,\mathrm{pp}\) for W-SQP and \([-83,-53]\,\mathrm{pp}\) for PP+IDM, with expert replay at \(100\%\) for every \(\tau\) by construction. No reasonable threshold removes the premium.

It is not scenario selection. We rank the main scenarios by complexity, which might correlate with divergence. Re-running the decomposition on a uniformly random sample of \(50\) WOMD scenarios preserves the effect and, if anything, sharpens it: \(\overline{\Delta c}_{\log}=-16.7\,\mathrm{pp}\) against \(\overline{\Delta c}_{\mathrm{inv}}=-1.0\,\mathrm{pp}\) (median \(0.0\,\mathrm{pp}\)). Selecting by complexity therefore understates the deficit rather than manufacturing it, consistent with the finding that sparser scenes admit more divergence.

5pt

7.5 Case studies↩︎

Two representative scenarios make the mechanism concrete (Table 6): a stop-controlled junction (H6, Figs. 14–15) and dense vehicle traffic (H7, \(290\) vehicles). In both, the trajectory overlay shows W-SQP taking a valid, different path from the logged human—a different lane or a different gap — and the per-rule panel shows the log-coupled rules lit up for W-SQP while its safety and regulatory rules stay close to the expert’s. The per-scenario numbers tell the same story: a large log-coupled deficit beside near-parity log-independent compliance (H6 \(\Delta_{\mathrm{inv}}{=}{-}0.9\), H7 \(+0.4\,\mathrm{pp}\), both inside the dataset-level CI). These are exactly the instances of Prop. 1—a valid alternative path scored down purely for not being the recorded human’s.

Fig. 17 tracks the same scenario over time. W-SQP’s path-tracking deviation climbs to \(7.7\) m and stays above the \(2.4\) m threshold for much of the rollout, so the log-coupled rule fires continuously. Yet over the same interval its physical margins—collision closeness, speed over the limit, headway—track expert replay and stay safe. The controller is penalized for tens of seconds while nothing physical is wrong.

7.6 Summary↩︎

A competent non-imitative planner is penalized almost entirely on rules that measure deviation from the human log, while its safety and regulatory compliance is statistically indistinguishable from expert replay. The effect is large; it is neither interaction density (which reverses the sign) nor prediction quality (in our ablation). Two claims should be kept apart. The structural premium—expert replay scores the log-coupled rules at \(100\%\) by construction, so any non-imitative planner pays a positive premium under any catalog that weights such a rule—holds in general. The magnitude (\(-10.1\,\mathrm{pp}\)) is specific to this controller and scenario set. An aggregate that includes the log-coupled rules ranks the planner a net loser; the log-independent score ranks it at parity.

8 Discussion↩︎

8.1 Deployment and practical relevance↩︎

As autonomous systems move toward deployment, planner decisions must be intelligible not only to the developers who tune them but to the safety engineers and investigators who must justify them. Being able to establish, after the fact, which rule was relaxed and by how much is thus an engineering requirement, not a reporting convenience. W-SQP offers three properties toward it. It is computationally tractable on the evaluated workstation—median solve time about \(28\) ms, maximum \(104\) ms under the \(90\) ms limit, with dynamics projection guaranteeing a model-consistent next pose even for a non-converged iterate. It records threshold-normalized residuals for every surrogate, making high-priority relaxations visible for review (Fig. 9). And its tier weights are explicit tuning knobs for the priority bias. None of this amounts to a safety guarantee: the weights do not impose lexicographic priority, the soft surrogates do not certify safety, and deployment still needs embedded profiling and validation with sensing, estimation, and actuation in the loop.

8.2 A log-independent compliance score↩︎

Our results point to a simple, low-cost remedy. Because the confounded rules form an explicit a priori subset, a benchmark can report two numbers instead of one: a log-independent compliance score over the safety, regulatory, map-, and interaction-defined rules, and, separately, an imitation score over the log-coupled rules. The first measures what closed-loop evaluation is meant to measure—did the planner drive safely and legally?—while the second is reported for transparency rather than folded into the ranking. This needs no change to the simulator or agents; it is a relabeling and re-aggregation of metrics benchmarks already compute. It does presuppose agreement on which rules are quality metrics and which are imitation metrics. We therefore recommend that leaderboards mixing the two kinds keep log-coupled metrics out of the aggregate quality score, and recalibrate the retained thresholds before treating them as absolute compliance measures.

The log-independent score must still reward task completion, or a planner could look safe merely by making no progress. A map-route progress term supplies this, defined against the assigned route corridor rather than the log—in the manner of nuPlan’s progress-along-route ratio and Waymax’s route-following metric [10], [11]. Referenced to route geometry and not to \(\xi^{\star}_\omega\), it is log-independent by Def. 2. Computed as executed arc-length along the route over route length, it gives expert replay, W-SQP, and PP+IDM comparable scores (\(0.93\), \(0.91\), \(0.89\)) while a do-nothing planner scores near zero. This term is a recommendation only: it is computed here post-hoc and is not part of the validated log-independent score of Sec. 7, whose verdict flip rests on the safety and regulatory rules alone.

Applied to existing benchmarks, the taxonomy is a simple audit (Table 7), and mature ones already pass it: nuPlan’s closed-loop score contains only interaction-, map-, and controller-defined terms, with pointwise matching confined to the separate open-loop score, and Waymax reports log-divergence standalone rather than in any aggregate [5], [10], [11]. The confound is not a flaw of these benchmarks but a risk for any catalogue that folds a log-coupled term into one ranking—as our own \(25\)-rule aggregate does. To make the fix turnkey we release a reference implementation that, given per-rule compliance and a per-rule taxonomy label, reports the aggregate, the fair score, and the imitation premium, with the verdict under each.

4pt

8.3 Relation to agent-realism findings↩︎

This reframes part of the score deterioration that learned reactive agents induce on existing benchmarks [14], [15]. As agents become more reactive, the recorded human log becomes a less attainable target, so any log-coupled sub-metric reports growing “violations” that reflect divergence from an un-followable log rather than degraded driving. Our per-rule decomposition makes this component separable from genuine compliance change and is complementary to that line of work: realism changes the rollout, metric construction changes what the rollout is scored against, and both must be controlled for fair comparison. We do not claim this accounts for the whole of the reported shifts, which are planner- and scenario-dependent; only that our decomposition isolates one component attributable to metric construction rather than to driving quality.

8.4 Limitations↩︎

The central threat to validity is external. We establish the decomposition for three non-imitative planners, but the evidence still rests on a single evaluator, a single (IDM) reactive-agent model, and one dataset; the magnitude of the log-coupled gap will vary with each. Our PDM-Closed also uses the log path geometry as its route corridor and occasionally leaves the drivable area on complex geometry (\(26\%\) of scenarios, inflating its log-independent mean but not its near-parity median). A full roadgraph route, a second evaluator catalogue, and learned reactive agents are the main future work.

A second asymmetry the taxonomy does not address is one of policy reactivity rather than metric reference. Expert replay cannot respond to the agents, only they to it. So some of W-SQP’s small positive deltas on interaction rules (headway \(+2.6\), clearance \(+1.9\,\mathrm{pp}\)) may reflect replay’s passivity rather than better driving—the reactivity counterpart of the log-coupling confound, this time in W-SQP’s favor. Since our headline is parity, not superiority, this does not threaten the result; but a fully symmetric comparison would need a reactive reference rather than a replayed one.

The evaluator calibration itself warrants a caveat. Some log-independent rules flag even the logged human at high rates (lateral clearance at \({\sim}55\%\), following headway at \({\sim}86\%\) for expert replay), largely because compliance 9 normalizes over all steps rather than applicable ones. The log-independent score is therefore best read as a relative, controller-vs-expert measure; individual thresholds would need recalibration before absolute use. Our claim is a paired decomposition, so this does not affect the headline. Finally, the scenarios are complexity-selected and W-SQP relaxes rules softly, so compliance is not a formal safety guarantee; the evaluator remains authoritative.

9 Conclusion↩︎

We have presented W-SQP, an auditable, rulebook-aware NMPC for autonomous driving. The controller maps nine rule families to four shared-slack tiers in one CasADi/IPOPT nonlinear program. Separated quadratic penalties bias violations toward lower-priority rules while actuation bounds remain hard; they do not provide lexicographic priority or formal safety guarantees. Threshold-normalized per-rule residuals provide an audit record for each control cycle.

W-SQP replans from its executed state at \(10\) Hz. A \(90\) ms CPU-time limit returns IPOPT’s best iterate, and dynamics projection produces a model-consistent executed pose; median and maximum observed wall-clock solve times on the evaluation workstation were \(28\) and \(104\) ms. These results establish anytime-capable operation on the tested platform, not hard-real-time execution. Closed-loop evaluation covered \(150\) WOMD scenarios in Waymax and included reactive and proposal-and-select baselines.

The evaluation also separated log-independent safety and regulatory rules from two rules defined relative to expert replay. W-SQP’s mean difference on the sixteen log-independent rules was \(-0.04\,\mathrm{pp}\), with no systematic group-level deficit, whereas the log-coupled difference was \(-10.1\,\mathrm{pp}\). Several individual safety rules nevertheless regressed in high-divergence scenarios (Table 3); the group-level result should not be read as per-rule or per-scenario parity.

For future work, we are interested in nondimensionalizing the optimization surrogates, improving the collision geometry and route construction, evaluating with additional agent and metric models, and profiling the controller on embedded automotive hardware. Hardware-in-the-loop and vehicle experiments must also incorporate perception, estimation, communication, and actuation latency, and combining the tiered-slack controller with certified feasibility or reachability mechanisms remains necessary for a formal safety claim.

10 Rule Catalogue and Threshold Definitions↩︎

This appendix lists the implemented evaluator rulebook. For each rule we give its identifier, priority level, short name, violation condition, and threshold \(\tau_r\); a rule is violated at step \(k\) when it is applicable and its Boolean predicate \(\phi_r(\mathcal{S}_k)\) is true. A global strictness multiplier \(\kappa=1.25\) tightens selected thresholds, either raising a required margin or lowering an allowed tolerance by \(\kappa\).

4pt

10.0.0.1 Navigation-alignment proxy rules.

Rules 0r0 and 2r2 measure similarity to the logged trajectory rather than a legal or safety requirement: path tracking (0r0) uses \(\|p_{\mathrm{ego}}-p_{\mathrm{log}}\|\) against \(3.0/\kappa\), and route adherence (2r2) uses position (\(5.0/\kappa\)) and yaw (\(0.5/\kappa\)) deviation. Retained for diagnostics, they nevertheless favor expert replay and must be read accordingly in any aggregate.

CRediT authorship contribution statement↩︎

Hadi Hajieghrary: Conceptualization, Methodology, Software, Formal analysis, Investigation, Data curation, Validation, Visualization, Writing – original draft, Writing – review & editing. Benedikt Walter: Software, Investigation, Validation, Writing – review & editing. Chaitanya Shinde: Software, Investigation, Validation, Writing – review & editing. Paul Schmitt: Conceptualization, Methodology, Writing – review & editing. Miguel Hurtado: Resources, Supervision, Project administration, Writing – review & editing.

Declaration of competing interest↩︎

The authors declare that they have no known competing financial interests or personal relationships that could have appeared to influence the work reported in this paper.

Declaration of generative AI in the writing process↩︎

During the preparation of this work the authors used a large language model to assist with drafting, editing, and figure generation. The authors reviewed and edited all content and take full responsibility for the content of the publication.

Data availability↩︎

This study is built on the Waymo Open Motion Dataset [13], which is publicly available under its dataset license. The W-SQP controller, the tiered-slack NLP formulation, the closed-loop simulation harness, the \(25\)-rule evaluator, and the fair (log-independent) scoring reference implementation will be released in a public repository upon publication; scenario indices and configuration files needed to reproduce the reported runs are included.

References↩︎

---

1. W-SQP abbreviates weighted soft-constrained quadratic-penalty NMPC, also called tiered-slack NMPC. The nonlinear program is solved with IPOPT [9]; W-SQP does not use a sequential-quadratic-programming solver.↩︎