Autonomous vehicle and method of operating same

Abstract

The present document relates to an autonomous vehicle and a method of operating the same. Various embodiments of the present document relate to a method of providing an alert for switching driving control from an autonomous driving system to a user, the method including: determining whether control of a vehicle needs to be switched to a user based on an event occurring during autonomous driving of the vehicle; and providing a notification to the user indicating that control of the vehicle needs to be switched to the user.

Description

Technical Field

[0001] This document relates to autonomous vehicles and methods of operating the same, and more particularly, to methods of providing an alert in a Level 4 autonomous vehicle that driving control is switching from an autonomous driving system to a user. Background Art

[0002] The Society of Automotive Engineers (SAE) classifies the maturity of vehicle autonomous driving technology into industry standard levels ranging from 0 to 5. Level 4 autonomous driving technology (known as high automation) is characterized by the automated driving system taking full responsibility for vehicle operation within a specific operational design domain (ODD) without user or driver intervention.

[0003] Level 4 autonomous systems monitor the driving environment and vehicle status in real time, can perform all driving functions on daily routes or under predetermined conditions, and do not require user intervention in driving.

[0004] However, in certain environments, such as heavy snowfall, or when the vehicle is operating outside of its ODD, Level 4 autonomous systems need to transfer the Dynamic Driving Task (DDT) to the user.

[0005] Level 4 autonomous driving technology is also referred to as the "Mind off" level because it should not require the user's attention, allowing the user of a Level 4 autonomous vehicle to rely on the autonomous driving system for vehicle operation and to engage in various non-driving related activities. Therefore, even when the autonomous system requests a control handover via an alert, it may take a considerable amount of time for the user to take over control.

[0006] Current commercialized autonomous systems have a limited and standardized set of predefined request for intervention (RTI) scenarios, and their responses are also uniform. In addition, since Level 4 autonomous systems have not yet been commercialized, there is no established definition for when and how to request a control handover in a Level 4 autonomous system. Summary of the invention

[0007] Various embodiments of this document aim to provide a method for switching driving control from an autonomous driving system to a user based on a user monitoring system request taking into account the characteristics of a Level 4 autonomous driving system.

[0008] Various embodiments of this document are also intended to define various conditions under which a request to switch driving control should be made in a Level 4 autonomous driving system.

[0009] The technical purposes of this document are not limited to the foregoing, and those skilled in the art can clearly understand other purposes not described herein from the following description.

[0010] According to various embodiments of the present document, a vehicle with autonomous driving capabilities may include: at least one sensor configured to detect the external environment of the vehicle, the state of the vehicle, and the state of a user; a processor configured to perform autonomous driving of the vehicle based on information obtained through the at least one sensor; and a controller configured to control the operation of the vehicle under the control of the processor, wherein the processor can determine whether control of the vehicle needs to be switched to the user based on events occurring during the autonomous driving of the vehicle, and provide a notification to the user indicating that control of the vehicle needs to be switched to the user, the notification being provided through multiple levels.

[0011] According to an embodiment, the processor can detect an upcoming event, determine whether control needs to be switched based on the event, obtain the remaining time for the event to occur when the control needs to be switched until the event occurs, determine whether the remaining time for the event to occur is greater than or equal to a first time, when the remaining time for the event to occur is greater than or equal to the first time, determine whether the remaining time for the event to occur is greater than a second time, when the remaining time for the event to occur is greater than the second time, continue autonomous driving, and when the remaining time for the event to occur is less than the second time, display a first level notification for a control switching request, wherein the second time is determined based on at least one of a user's state and a vehicle's state.

[0012] According to an embodiment, the second time may be calculated by adding a vehicle state change time required to put the vehicle in a state in which the user can drive the vehicle based on the state of the vehicle and a buffer time required for the user to perform a driving operation based on the state of the user to the first time.

[0013] According to an embodiment, the buffer time can be configured to increase as the user's gaze further deviates from the direction of travel, and the vehicle state change time can be configured to increase as the seat or driving operation interface deviates further from a normal state that allows the user to drive the vehicle.

[0014] According to an embodiment, the processor may perform a minimum risk maneuver to transition the vehicle to a minimum risk condition state based on the remaining time for the event to occur being less than the first time.

[0015] According to an embodiment, the processor can calculate the driving risk level of the vehicle based on the remaining time of the event occurrence being less than the first time, move the driver's seat to a state predefined by the user based on the driving risk level determined to be low risk, and move the driver's seat to a state capable of protecting the user based on the driving risk level determined to be high risk.

[0016] According to an embodiment, the processor may display a second level notification for controlling a switching request based on the remaining time for an event to occur being less than a third time, and display a third level notification for controlling a switching request based on the remaining time for an event to occur being less than a fourth time, the first time and the fourth time being the same, the third time being longer than the fourth time, and the second time being longer than the third time.

[0017] According to an embodiment, the processor may perform a minimum risk maneuver driving to transition the vehicle to a minimum risk condition state after a fifth time from displaying the third level notification.

[0018] According to an embodiment, the first time and the fourth time are minimum expected times required for the user to recognize the current state of the vehicle and surrounding traffic and be able to drive the vehicle, and the third time is a time obtained by subtracting the buffer time from the second time.

[0019] According to an embodiment, the processor may move the driver's seat to a state predefined by the user while displaying the second level notification.

[0020] According to an embodiment, the vehicle state change time may include at least one of the seat adjustment time required to adjust the driver's seat from a changed state in which the user is not involved in driving to a state in which the user is allowed to drive and the operation interface adjustment time required to adjust the operation interface to a state in which the user is allowed to use it.

[0021] According to various embodiments of the present document, a method for operating a vehicle with autonomous driving capabilities may include: determining whether control of the vehicle needs to be switched to a user based on an event occurring during autonomous driving of the vehicle, and providing a notification to the user indicating that control of the vehicle needs to be switched to the user, the notification being provided at multiple levels.

[0022] According to an embodiment, determining whether control of a vehicle needs to be switched may include: detecting an upcoming event, and determining whether control needs to be switched based on the event, and providing a notification to a user may include: obtaining a remaining time for an event to occur from when control needs to be switched until the event occurs; determining whether the remaining time for the event to occur is greater than or equal to a first time, determining whether the remaining time for the event to occur is greater than a second time when the remaining time for the event to occur is greater than or equal to the first time, continuing autonomous driving based on the remaining time for the event to occur being greater than the second time, and displaying a first level notification for a control switching request based on the remaining time for the event to occur being less than the second time, wherein the second time is determined based on at least one of a state of the user and a state of the vehicle.

[0023] According to an embodiment, the second time may be calculated by adding a vehicle state change time required to put the vehicle in a state in which the user can drive the vehicle based on the state of the vehicle and a buffer time required for the user to perform a driving operation based on the state of the user to the first time.

[0024] According to an embodiment, the state of the user may include gaze information and information on whether the user is asleep, and the state of the vehicle may include at least one of seat state information and driving operation interface state information.

[0025] According to an embodiment, the buffer time can be configured to increase as the user's gaze further deviates from the direction of travel, and the vehicle state change time can be configured to increase as the seat or driving operation interface deviates further from a normal state that allows the user to drive the vehicle.

[0026] According to an embodiment, providing the notification to the user may include: performing a minimum risk maneuver to transition the vehicle to a minimum risk condition state based on the remaining time to the event occurring being less than the first time.

[0027] According to an embodiment, providing notification to the user may include: calculating a driving risk level of the vehicle based on a remaining time for an event to occur being less than a first time; moving the driver's seat to a state predefined by the user based on a driving risk level determined to be low risk; and moving the driver's seat to a state capable of protecting the user based on a driving risk level determined to be high risk.

[0028] According to an embodiment, providing notification to the user may include: displaying a second level notification for controlling a switching request based on the remaining time for an event to occur being less than a third time; and displaying a third level notification for controlling a switching request based on the remaining time for an event to occur being less than a fourth time, wherein the first time and the fourth time are the same, the third time is longer than the fourth time, and the second time is longer than the third time.

[0029] According to an embodiment, the first time and the fourth time are minimum expected times required for the user to recognize the current state of the vehicle and surrounding traffic and be able to drive the vehicle, and the third time is a time obtained by subtracting the buffer time from the second time.

[0030] According to an embodiment, providing the notification may include moving the driver's seat to a state predefined by the user while displaying the second level notification.

[0031] According to an embodiment, the vehicle state change time may include at least one of the seat adjustment time required to adjust the driver's seat from a changed state in which the user is not involved in driving to a state in which the user is allowed to drive and the operation interface adjustment time required to adjust the operation interface to a state in which the user is allowed to use it. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] Figure 1 is a block diagram of a vehicle according to various embodiments of the present document;

[0033] Figure 2 is a simplified state transition diagram of an HMCS according to an embodiment, the HMCS being one of the Level 4 autonomous driving technologies executed by a processor of a vehicle;

[0034] Figure 3 is a flowchart illustrating an operation of displaying a control switching request notification based on urgency in a Level 4 autonomous driving system according to various embodiments; and

[0035] Figure 4 is a flow chart illustrating operations for displaying multi-level notifications based on urgency and user response in a Level 4 autonomous driving system according to various embodiments. DETAILED DESCRIPTION

[0036] Hereinafter, embodiments of the present document are described in detail with reference to the accompanying drawings.

[0037] From the detailed description provided below, the organization of the present disclosure and its operational effects will be apparent, thereby promoting clear understanding. Before the detailed description in this document, it should be noted that, whenever possible, the same reference numerals will be used for the same components even if shown on different drawings, and the detailed description of well-known components will be omitted to avoid obscuring the subject matter of the present disclosure.

[0038] Before proceeding to a detailed description in this document, the terms used herein may be defined as follows.

[0039] A vehicle refers to a vehicle equipped with an autonomous driving system (ADS) capable of autonomous driving. For example, the vehicle may perform at least one of steering, accelerating, decelerating, lane changing, and stopping (or parking) without user intervention of the ADS. The ADS may, for example, include at least one of a highly automated highway driver system (HMCS), a pedestrian detection and collision mitigation system (PDCMS), a lane change decision assist system (LCDAS), a lane departure warning system (LDWS), an adaptive cruise control (ACC), a lane keeping assist system (LKAS), a road boundary departure prevention system (RBDPS), a curve speed warning system (CSWS), a forward vehicle collision warning system (FVCWS), and a low speed follow (LSF).

[0040] A user is a person who uses a vehicle and receives services from an autonomous driving system. According to an embodiment, all occupants of a vehicle may be users, and one of them may be a driver. An autonomous driving system may identify a user sitting in a designated driver's seat as a driver.

[0041] Vehicle control authority refers to authority to control at least one component and / or function of a vehicle. At least one function of a vehicle may, for example, include at least one of a steering function, an acceleration function, a deceleration function (or a braking function), a lane change function, a lane detection function, a lateral control function, an obstacle detection and distance sensing function, a powertrain control function, a safety zone detection function, an engine on / off function, a power on / off function, and a vehicle lock / unlock function. The listed vehicle functions are examples provided for illustrative purposes, and the embodiments of this document are not limited thereto.

[0042] Figure 1 is a block diagram of a vehicle according to various embodiments of the present document, and Figure 2 is a simplified state transition diagram of an HMCS, one of the Level 4 autonomous driving technologies executed by a processor of a vehicle, according to an embodiment.

[0043] Figure 1 The configuration of the vehicle shown is provided as an exemplary embodiment, and each component may be configured as a chip, a component, or an electronic circuit, or a combination of chips, components and / or electronic circuits. Figure 1 Some of the components shown may be divided into multiple components and configured as different chips, different components, or different electronic circuits, and some components may be combined to be configured as one chip, one component, or one electronic circuit. Figure 1 Some components are shown, or other components not shown may be added.

[0044] refer to Figure 1 , the vehicle 100 may include a sensor unit 110 , a controller 120 , a processor 130 , a user interface 140 , a communication device 150 , and a memory 160 .

[0045] According to various embodiments, the sensor unit 110 may acquire road information, information about objects around the vehicle (e.g., other vehicles, pedestrians, objects, curbs, guardrails, lanes, obstacles), and / or position information of the vehicle based on sensing data obtained from at least one sensor. The road information may include, for example, lane position, lane shape, lane color, lane type, number of lanes, the presence of a shoulder, or the size of a shoulder. The objects around the vehicle may include, for example, the position of the object, the size of the object, the shape of the object, the distance to the object, and the relative speed of the object.

[0046] According to an embodiment, the sensor unit 110 may include at least one of a camera, a light detection and ranging (LiDAR), a radio detection and ranging (RADAR), an ultrasonic sensor, an infrared sensor, and a position measurement sensor. The listed sensors are provided as examples only for illustrative purposes, and the sensors included in the sensor unit 110 of the present document are not limited thereto. The camera may capture images around the vehicle to generate image data, including lanes and / or surrounding objects on the face, rear, and / or side of the vehicle 100. The LiDAR may use light (or laser) to generate information about objects located in front of, behind, and / or on the side of the vehicle 100. The radar may use electromagnetic waves (or radio waves) to generate information about objects located in front of, behind, and / or on the side of the vehicle 100. The ultrasonic sensor may use ultrasonic waves to generate information about objects located in front of, behind, and / or on the side of the vehicle 100. The infrared sensor may use infrared to generate information about objects located in front of, behind, and / or on the side of the vehicle 100. The position measurement sensor may measure the current position of the vehicle. The position measurement sensor may include at least one of a global positioning system (GPS) sensor, a differential global positioning system (DGPS) sensor, and a global navigation satellite system (GNSS) sensor. The position measurement sensor may generate position data of the vehicle based on a signal generated by at least one of the GPS sensor, the DGPS sensor, and the GNSS sensor.

[0047] The sensor unit 110 may include various sub-functional modules such as a user state detection unit 111 , a vehicle state detection unit 113 , and an external recognition sensor unit 115 .

[0048] The user state detection unit 111 can detect the current state of the user. According to an embodiment, when there are multiple occupants in the vehicle, the user state detection unit 111 can identify all occupants as users and monitor their states. In addition, the user state detection unit 111 can identify the user sitting in the driver's seat as the driver and monitor the driver's state more closely. For example, the user state detection unit 111 can determine the presence or absence of the user in the driver's seat, detect whether the user is sleepy, and / or assess the degree of fatigue the user is experiencing. In addition, the user state detection unit 111 can determine the concentration level of the user's current behavior and whether the behavior is acceptable. For example, the user state detection unit 111 can determine whether the user is concentrated on reading or playing games, and whether the user is engaged in acceptable activities within the range of allowing immediate takeover of driving control of the vehicle. The user state detection unit 111 can also determine whether the user is able to drive. For example, the user state detection unit 111 can determine whether the user sitting in the driver's seat is a licensed driver by identifying the user's biometrics, and can also determine whether the user is drunk. In addition, the user state detection unit 111 can also detect the user's physical information (e.g., height, weight, etc.).

[0049] According to an embodiment, the vehicle state detection unit 113 can obtain internal vehicle state information using sensors or the like. For example, the vehicle state detection unit 113 can detect normal operation information and / or fault state information of each component of the vehicle. In addition, the vehicle state detection unit 113 can obtain the current state of the driver's seat and the state of the driver's seat before activating the autonomous driving system. The state of the driver's seat may include information such as seat position, seat rotation angle, and seat back tilt. In addition, the vehicle state detection unit 113 can detect user inputs related to vehicle motion control, such as steering torque and acceleration or brake pedal input.

[0050] According to an embodiment, the external recognition sensor unit 115 may detect operation design domain (ODD) information, such as whether the vehicle is within the ODD range and close to the ODD boundary, and recognize normal operation information and / or fault state information of each sensor. In addition, the external recognition sensor unit 115 may provide its own reliability information for the sensor output from the sensor unit 110. For example, the external recognition sensor unit 115 may provide lane detection reliability information, output change information, and / or reflected wave intensity.

[0051] According to various embodiments, the controller 120 may control the operation of at least one component of the vehicle 100 and / or at least one function of the vehicle under the control of the processor 130. The at least one function may, for example, include at least one of a steering function, an acceleration function or a longitudinal acceleration function, a deceleration function or a longitudinal deceleration function, a braking function, a lane change function, a lane detection function, an obstacle detection and distance detection function, a lateral control function, a powertrain control function, a safety zone detection function, an engine on / off, a power on / off, and a locking / unlocking function of the vehicle.

[0052] According to an embodiment, the controller 120 may control the operation of at least one component and / or at least one function of the vehicle 100 for autonomous driving (e.g., autonomous driving according to the HMCS) and / or minimum risk maneuvering (MRM) under the control of the processor 130. For example, the controller 120 may control the operation of at least one of a steering function, an acceleration function, a deceleration function, a lane change function, a lane detection function, a lateral control function, an obstacle detection and distance detection function, a powertrain control function, and a safety zone detection function for minimum risk maneuvering.

[0053] According to an embodiment, the controller 120 may include a seat control unit 121, an operation interface control unit 123, and a vehicle motion control unit 125. The seat control unit 121, the operation interface control unit 123, and the vehicle motion control unit 125 may perform various tasks to notify the user of a control handover in a Level 4 autonomous driving system. For example, the seat control unit 121 may return the driver's seat to a driving position, and the operation interface control unit 123 may control the operation interface to extend so that the user can operate the vehicle.

[0054] The vehicle motion control unit 125 may control the motion of the vehicle by controlling the suspension of the vehicle and the like.

[0055] According to various embodiments, the user interface (UI) 140 may include various devices that provide information related to the vehicle 100 in an auditory, visual, and / or tactile manner. For example, the user interface 140 may include a tactile device equipped in a display, a seat, or a seat belt, and a speaker that provides information by sound. The user interface (UI) 140 may provide various information related to the state of the vehicle 100 to the user of the vehicle 100 under the control of the processor 130. In addition, the user interface (UI) 140 may provide various notifications from the autonomous driving system to the user in a visual, auditory, and / or tactile manner under the control of the processor 130. The various information related to the state of the vehicle may include at least one of information indicating normal operation or failure of various components included in the vehicle and / or at least one function of the vehicle and information indicating the driving state of the vehicle.

[0056] According to various embodiments, the communication device 150 may communicate with an external device of the vehicle 100. According to an embodiment, the communication device 150 may receive data from the outside of the vehicle 100 or transmit data to the outside of the vehicle 100 under the control of the processor 130. For example, the communication device 150 may perform communication using a wireless or wired communication protocol.

[0057] According to various embodiments, the memory 160 may store an autonomous driving program implemented by the autonomous driving system or the processor 130. According to an embodiment, the memory 160 may store a program for implementing the HMCS, and the processor 130 may read the corresponding program from the memory 160 to implement the HMCS autonomous driving function.

[0058] According to various embodiments, the processor 130 may control the overall operation of the vehicle 100. In an embodiment, the processor 130 may include an electronic control unit (ECU) capable of integrally controlling components within the vehicle 100. For example, the processor 130 may include a central processing unit (CPU) or a microcontroller unit (MCU) capable of performing computing tasks.

[0059] According to various embodiments, the processor 130 may activate an autonomous driving system (ADS) upon the occurrence of a predetermined event, thereby controlling components within the vehicle 100 to achieve autonomous driving. The predetermined event may occur when autonomous driving of the vehicle is requested, when a user delegates vehicle control authority, or when conditions specified by a user and / or designer are met.

[0060] According to various embodiments, the processor 130 may determine whether autonomous driving is possible based on at least one of vehicle state information and surrounding environment information during autonomous driving. In the event that normal autonomous driving is not possible, the processor 130 may control the vehicle to stop by performing a minimum risk maneuver (MRM).

[0061] Depending on the implementation, the processor 130 may implement a highly automated highway driver system (HMCS), a Level 4 autonomous driving technology, such as Figure 2 HMCS is one of the Level 4 autonomous driving technology standards and is designed to enable autonomous vehicles to perform a complete dynamic driving task (DDT) on access-controlled highways that meet the constraints of the operational design domain (ODD).

[0062] refer to Figure 2, the processor 130 may start in the HMCS OFF state 210. Since HMCS is a Level 4 autonomous driving technology specifically for driving on access-controlled highways, the HMCS may remain OFF and not activated on regular roads. The processor 130 may remain in the HMCS OFF state unless the vehicle approaches the operational design domain defined for the HMCS.

[0063] The processor 130 may transition from the HMCS off state 210 to the HMCS standby state 220 upon recognizing that the vehicle 100 is passing through a highway toll gate entrance, driving conditions satisfying the ODD defined for the HMCS, or based on user input.

[0064] When a predetermined condition is met, the processor 130 may transition from the HMCS standby state 220 to the HMCS active state 230. In the HMCS active state 230, the processor 130 may perform autonomous driving according to a method defined in the HMCS.

[0065] In the HMCS activation state 230, the processor 130 may operate in a coupling mode 231 or a decoupling mode 233 while performing normal vehicle driving operations. Here, the coupling mode 231 is a mode in which user input is possible for vehicle operation and the user input may affect the vehicle operation. The decoupling mode 233 is a mode in which the user input does not affect the vehicle operation. For example, in the decoupling mode 233, even when the user presses the accelerator or the brake, the operation of the vehicle does not change accordingly. Various methods may be used to implement the decoupling mode 233.

[0066] While normally controlling the vehicle based on the HMCS autonomous driving technology, the processor 130 can operate in the coupling mode 231 or the decoupling mode 233, and can switch from the coupling mode 231 to the decoupling mode 233 when condition A is met, or switch from the decoupling mode 233 to the coupling mode 231 when condition B is met.

[0067] According to an embodiment, the processor 130 may automatically switch from the coupling mode 231 to the decoupling mode 233 without user consent, but requires user approval to switch from the decoupling mode 233 to the coupling mode 231. That is, the processor 130 may switch from the decoupling mode 233 to the coupling mode 231 only when one or one of the users is in a position capable of driving and has approved the switch.

[0068] According to another embodiment, the processor 130 may perform the transition only after obtaining user approval, both when transitioning from the coupling mode 231 to the decoupling mode 233 and when transitioning from the decoupling mode 233 to the coupling mode 231 .

[0069] When switching from the decoupling mode 233 to the coupling mode 231 or from the coupling mode 231 to the decoupling mode 233, the processor 130 may provide a warning to the user about the transition. In addition, when user approval for the transition is required, the processor 130 may display a message requesting approval for the transition using the user interface 140 or by using other components or methods.

[0070] In the HMCS activated state 230, when the conditions for activating the minimum risk maneuver (MRM) are met, the processor 130 may execute the MRM as represented by reference numeral 235 to put the vehicle in a minimum risk condition (MRC) state. Here, the MRC state may be a stationary state. In this state, the HMCS may transition from the HMCS activated state 230 to the HMCS closed state 210.

[0071] The minimum risk maneuver (MRM) as shown by reference numeral 235 executed by the processor 130 may proceed as follows. The following operations may be performed in parallel with the HMCS autonomous driving operation of the processor 130, and when the vehicle is in a minimum risk condition (MRC) state due to the execution of the MRM as shown by reference numeral 235, the HMCS may transition from the HMCS activated state to the HMCS deactivated state 210.

[0072] According to an embodiment, the processor 130 may determine whether the functions required for autonomous driving are operating normally based on the vehicle state information. The functions required for autonomous driving may include lane detection, lane change, lateral control, deceleration (or braking control), acceleration control, powertrain control, safety area detection, and at least one of obstacle detection and distance sensing. When at least one of the functions required for autonomous driving cannot operate normally, the processor 130 may determine that normal autonomous driving is impossible.

[0073] According to an embodiment, the processor 130 may determine whether the vehicle state is suitable for normal operating conditions based on the vehicle state information. For example, the processor 130 may determine whether the mechanical state information of the vehicle (e.g., tire pressure information or engine overheating information) meets the requirements of normal operating conditions. When it is detected that the state of the vehicle does not meet the requirements of normal operating conditions, the processor 130 may determine that normal autonomous driving is impossible. For example, when it is found that the vehicle cannot operate normally due to tire pressure problems or engine overheating, the processor 130 may determine that normal autonomous driving is impossible.

[0074] According to an embodiment, the processor 130 may determine whether the surrounding environment of the vehicle is suitable for a basic operational design domain of autonomous driving based on at least a portion of the surrounding environment information. The operational design domain represents a condition under which autonomous driving operates effectively. When it is detected that the surrounding environment information does not satisfy the operational design domain, the processor 130 may determine that normal autonomous driving is impossible.

[0075] According to various embodiments, when normal autonomous driving is not possible, the processor 130 may determine that a minimum risk maneuver is required to minimize the risk of an accident. When a minimum risk maneuver is required, the processor 130 may select one of a plurality of minimum risk maneuver strategies and execute the maneuver. For example, the minimum risk maneuver strategy may include a lane stop strategy and a load shoulder stop strategy.

[0076] Lane stop strategies may include straight-line stop and in-lane stop, while road shoulder stop strategies may include half-shoulder stop and full-shoulder stop.

[0077] A straight-line stop is a type of stop that uses only longitudinal deceleration control and does not involve lateral control. For example, a straight-line stop may be performed in a situation where lane detection is not possible or lateral control is not possible due to a fault in an actuator. During a straight-line stop, acceleration control and lane changes are prohibited or impossible, and detection of a potential stopping position outside of a lane may not be required. Here, detecting a potential stopping position outside of a lane may refer to a function of detecting a position in a safety area (such as a road shoulder or a rest area) outside of a lane.

[0078] An in-lane stop is a type of stop in which the vehicle stops within the boundaries of the lane in which the vehicle is traveling. For example, an in-lane stop may refer to a type of stop in which the vehicle stops within the boundaries of the lane in which the vehicle is traveling using lateral control and / or deceleration control. The lane in which the vehicle is traveling may refer to the lane in which the vehicle is traveling at the point at which it is determined that the least risk maneuver is required. During an in-lane stop, acceleration control and lane changes are prohibited, and the out-of-lane potential stopping position detection function may not be required.

[0079] A half shoulder stop is a type of stop where a portion of the vehicle stops on the shoulder of the road, while a full shoulder stop is a type of stop where the entire vehicle stops on the shoulder of the road. During both a half shoulder stop and a full shoulder stop, lateral control, deceleration control, lane change, and out-of-lane potential stop position detection functions may be used, and only acceleration control may be employed to maintain the current speed.

[0080] refer to Figure 2In the HMCS active state 230, when the conditions for switching vehicle control to the user are met, the processor 130 may display a message or notification to the user through various methods to resume the dynamic driving task (DDT), as shown by reference numeral 237. Then, when the user resumes the DDT, the processor 130 may transition from the HMCS active state 230 to the HMCS standby state 220.

[0081] Currently, standards for HMCS-related technologies are still in the early stages of development, and there are no established standards for displaying notifications to users, as represented by reference numeral 237. However, in Level 4 autonomous driving, users may be involved in activities unrelated to vehicle operation, and the time it takes for users to perceive notifications and resume DDT may be significantly longer than in Level 1 to Level 3 autonomous driving. Therefore, this document proposes a method for displaying notifications to ensure that users can perceive and respond to control switching requests within the necessary response time.

[0082] Figure 3 is a flowchart illustrating an operation of displaying a control switching request notification based on urgency in a Level 4 autonomous driving system according to various embodiments.

[0083] refer to Figure 3 In operation S210, when it is recognized that an event is about to occur (e.g., a collision with a vehicle in front), the processor 130 may determine whether the event is an emergency event or a non-emergency event. According to an embodiment, when the event occurrence remaining time (T 事件 ) than the minimum response time (T 响应时间 ) is short, the processor 130 may regard the event as an emergency event. The minimum response time is the minimum estimated time required for the user to perceive the current vehicle status and surrounding traffic and restore DDT. When the event occurs, the remaining time (T 事件 ) than the minimum response time (T 响应时间 ) for a long time, the processor 130 may regard the event as a non-emergency event.

[0084] Specifically, an event may be an event that requires control to be switched from the autonomous driving system to the user. The event may include situations where the ODD boundary is uncertain but there is a possibility of ODD deviation, such as a planned ODD boundary approach event, a sudden ODD boundary approach or deviation event, and changes in lighting conditions, rainfall or snowfall. The event may also include situations where a minor fault does not yet require the execution of MRM but has the possibility of deteriorating or worsening performance, or a serious fault requires the execution of MRM. In addition, even if the autonomous driving system executes MRM without user intervention and the vehicle reaches the MRC state, when the vehicle can still be driven by the user, this can be considered an event that requires control switching. In addition, events may include situations where the user is involved in non-driving related activities that exceed the allowable limit of the autonomous driving system, such as entering a deep sleep, or a user condition that makes driving impossible, such as cardiac arrest or being drunk.

[0085] Among the above events, sudden ODD boundary approach or deviation events, events in which a serious fault necessitates the execution of MRM, events indicating an unresolvable condition of the user during driving (such as cardiac arrest or intoxication), and events in which the autonomous driving system executes MRM without user intervention and the vehicle reaches an MRC state can be considered as emergency events, while planned ODD boundary approach events, events in which the ODD boundary is uncertain but there is a risk of ODD deviation, events in which minor faults do not yet require MRM but have the possibility of deteriorating or worsening performance, and events in which the user engages in non-driving related activities (such as deep sleep) within permitted limits can be considered as non-emergency events.

[0086] In operation S210, when it is determined that an emergency has occurred, the processor 130 may proceed to operation S214 to perform a minimum risk maneuver (MRM) while moving at least the driver's seat to a position predefined by a user. According to an embodiment, in operation S214, the processor 130 may move not only the driver's seat but all seats in the vehicle to positions predefined by a user.

[0087] In case of an emergency, since the processor 130 performs the MRM in operation S214 , the vehicle 100 may transition to a minimum risk condition (MRC) state in operation S240 .

[0088] When it is determined in operation S210 that no emergency event has occurred, the processor 130 may proceed to operation S218 to determine a remaining time (T 事件 ) is longer than the alarm time (T 警报 ) long. Here, the alarm time (T 警报) may be a time (T ) obtained by dividing the vehicle state change time required to put the vehicle in a user-drivable state based on the vehicle state by an additional buffer time (T ) required until the user can perform a driving operation based on the user state detected by the user state detection unit 111. 驾驶 ) is added to the minimum response time (T 响应时间 Here, the user state may include information about whether the user is asleep and gaze information. In detail, when the user is in a sleeping state, the buffering time may be significantly longer, and when the user's gaze is not directed forward, the buffering time may be further increased.

[0089] According to an embodiment, the vehicle state change time may include a seat adjustment time (T 座椅 ) and / or operation interface adjustment time. Seat adjustment time (T 座椅 ) may refer to the time required to adjust the driver's seat from its state when the user is not engaged in driving to a state that allows the user to drive. Here, the state of the driver's seat that allows the user to drive may be the state that the seat was in when the user controlled the vehicle before the autonomous driving system took control. Therefore, the adjustment of the driver's seat state includes not only two-dimensional and three-dimensional position changes of the seat in the upward, downward, left, right, forward and backward directions, but also changes in the rotation angle of the seat (wherein, when the seat is adjusted to allow the user to drive, the angle is set to zero) and changes in the inclination of the backrest, including all changes from a state in which the seat is set to drive.

[0090] The operation interface adjustment time may refer to the time required to convert the operation interface (such as a steering wheel) from a state in which the steering wheel is not in a state in which the user is not engaged in driving to a state in which the user is allowed to drive. According to an embodiment, the time may also refer to the duration required to extend or unfold the operation interface that is retracted during autonomous driving to a position in which the user can access and use the operation interface to drive. According to another embodiment, even if not retracted, the operation interface may be in a different orientation or have undergone a change in its two-dimensional or three-dimensional position, such as moving up, down, left, right, forward or backward, and in this case, the operation interface adjustment time refers to the time required to convert the operation interface from the changed state to a state in which the user can access and use the operation interface to drive. The seat adjustment time and the operation interface adjustment time may increase as the changes in the seat and the operation interface further deviate from the normal state in which the user is allowed to drive the vehicle.

[0091] According to an embodiment, when the operation interface and the seat are adjusted simultaneously, the operation interface adjustment time and the seat adjustment time (T 座椅 ) can be regarded as the vehicle state change time. According to another embodiment, when the operation interface adjustment and the seat adjustment are performed in sequence, the seat adjustment time (T座椅 ) is added to the operation interface adjustment time to determine the vehicle status change time.

[0092] In operation S218, when the event occurs, the remaining time (T 事件 ) than the alarm time (T 警报 ) is longer, the processor 130 may proceed to operation S220 to continue driving the vehicle based on a Level 4 autonomous driving method (eg, HMCS) without displaying a notification to the user. Meanwhile, in operation S218, the processor 130 may continuously determine the remaining time for the event to occur (T 事件 ) is still longer than the alarm time (T 警报 )long.

[0093] In operation S218, when the event occurs, the remaining time (T 事件 ) becomes longer than the alarm time (T 警报 ) is short, the processor 130 may proceed to operation S222 to display a Level 1 control switching request notification to the user. That is, the processor 130 that performs Level 4 autonomous driving (such as HMCS) may display an alert time (T) before the event is expected to occur. 警报 ) before providing the user with a control switch request notification.

[0094] After displaying the notification, the processor 130 may determine whether the user responds to the switching request in operation S223. When the user's response to the switching request is deemed sufficient, the processor 130 may terminate both the notification display and the Level 4 autonomous driving operation.

[0095] After displaying the control switching request notification, when the user does not respond to the control switching request or the response is deemed insufficient in operation S223, the processor 130 may proceed to operation S234 to perform a minimum risk maneuver (MRM). As the processor 130 performs the minimum risk maneuver (MRM) in operation S234, the vehicle 100 may transition to a minimum risk condition (MRC) state in operation S240.

[0096] Once the vehicle 100 transitions to the Minimum Risk Condition (MRC) state via the Minimum Risk Maneuver (MRM), the processor 130 may terminate both the notification display and the Level 4 autonomous driving operation.

[0097] Figure 4 is a flow chart illustrating operations for displaying multi-level notifications based on urgency and user response in a Level 4 autonomous driving system according to various embodiments.

[0098] Figure 4 Shows Figure 3 An extended version of the method depicted in , wherein operations denoted by the same reference numerals perform the same functions. In addition, Figure 4based on Figure 3 The method presents several expansion options, and some or all of the proposed expansion options may be applied.

[0099] refer to Figure 4 When it is identified in operation S210 that an event is about to occur (e.g., a collision with a vehicle ahead), the processor 130 may determine whether the event is an emergency event or a non-emergency event. According to an embodiment, when the event occurrence remaining time (T 事件 ) than the minimum response time (T 响应时间 ) is short, the processor 130 may regard the event as an emergency event. The minimum response time is the minimum estimated time required for the user to perceive the current vehicle status and surrounding traffic and restore DDT. When the event occurs, the remaining time (T 事件 ) than the minimum response time (T 响应时间 ) for a long time, the processor 130 may regard the event as a non-emergency event.

[0100] Specifically, an event may be an event that requires control to be switched from the autonomous driving system to the user. The event may include situations where the ODD boundary is uncertain but there is a possibility of ODD deviation, such as a planned ODD boundary approach event, a sudden ODD boundary approach or deviation event, and changes in lighting conditions, rainfall or snowfall. The event may also include situations where a minor fault does not yet require the execution of MRM but has the possibility of deteriorating or worsening performance, or a serious fault requires the execution of MRM. In addition, even if the autonomous driving system executes MRM without user intervention and the vehicle reaches the MRC state, when the vehicle can still be driven by the user, this can be considered an event that requires control switching. In addition, events may include situations where the user is involved in non-driving related activities that exceed the allowable limit of the autonomous driving system, such as entering a deep sleep, or a user condition that makes driving impossible, such as cardiac arrest or being drunk.

[0101] Among the above events, sudden ODD boundary approach or deviation events, events in which a serious fault necessitates the execution of MRM, events indicating an unresolvable condition of the user during driving (such as cardiac arrest or intoxication), and events in which the autonomous driving system executes MRM without user intervention and the vehicle reaches an MRC state can be considered as emergency events, while planned ODD boundary approach events, events in which the ODD boundary is uncertain but there is a risk of ODD deviation, events in which minor faults do not yet require MRM but have the possibility of deteriorating or worsening performance, and events in which the user engages in non-driving related activities (such as deep sleep) within permitted limits can be considered as non-emergency events.

[0102] When it is determined in operation S210 that an emergency event has occurred, the processor 130 proceeds to operation S212 to determine a driving risk level. The driving risk level may be determined based on at least one of a braking deceleration, a steering torque, a steering change rate, an expected vehicle yaw rate change, a vehicle stability, and a risk level evaluation value provided by an autonomous driving system used during a minimum risk maneuver (MRM).

[0103] When it is determined in operation S212 that the driving risk level is low or has a value lower than a predetermined value, the processor 130 proceeds to operation S214 to perform a minimum risk maneuver (MRM) while moving the driver's seat to a position predefined by a user.

[0104] When it is determined in operation S212 that the driving risk level is high or the driving risk level has a value higher than or equal to the predetermined value, the processor 130 proceeds to operation S216 to respond to the emergency by adjusting the driver's seat to a position that protects the user and / or the passenger in a collision event, while also performing a minimum risk maneuver (MRM). For example, considering the user's body information obtained from the user state detection unit 111, the position of the airbag, and the current seat position, the processor 130 may adjust the seat to a position that minimizes damage during a collision.

[0105] In case of an emergency, since the processor 130 performs the MRM in operation S214 or S216 , the vehicle 100 may transition to a minimum risk condition (MRC) state in operation S240 .

[0106] When it is determined in operation S210 that no emergency event has occurred, the processor 130 may proceed to operation S218 to determine a remaining time (T 事件 ) is longer than the alarm time (T 警报 Here, the alarm time (T 警报 ).

[0107] According to an embodiment, the alarm time (T 警报 ) may be a time (T ) obtained by dividing the vehicle state change time required to put the vehicle in a user-drivable state based on the vehicle state by an additional buffer time (T ) required until the user can perform a driving operation based on the user state detected by the user state detection unit 111. 驾驶 ) is added to the minimum response time (T 响应时间 Here, the user state may include information about whether the user is asleep and gaze information. In detail, when the user is in a sleeping state, the buffering time may be significantly longer, and when the user's gaze is not directed forward, the buffering time may be further increased.

[0108] According to an embodiment, the vehicle state change time may include a seat adjustment time (T 座椅 ) and / or operation interface adjustment time. Seat adjustment time (T 座椅 ) may refer to the time required to adjust the driver's seat from its state when the user is not engaged in driving to a state that allows the user to drive. Here, the state of the driver's seat that allows the user to drive may be the state that the seat was in when the user controlled the vehicle before the autonomous driving system took control. Therefore, the adjustment of the driver's seat state includes not only two-dimensional and three-dimensional position changes of the seat in the upward, downward, left, right, forward and backward directions, but also changes in the rotation angle of the seat (wherein, when the seat is adjusted to allow the user to drive, the angle is set to zero) and changes in the inclination of the backrest, including all changes from a state in which the seat is set to drive.

[0109] The operation interface adjustment time may refer to the time required to convert the operation interface (such as a steering wheel) from a state in which the steering wheel is not in a state in which the user is not engaged in driving to a state in which the user is allowed to drive. According to an embodiment, the time may also refer to the duration required to extend or unfold the operation interface that is retracted during autonomous driving to a position in which the user can access and use the operation interface to drive. According to another embodiment, even if not retracted, the operation interface may be in a different orientation or have undergone a change in its two-dimensional or three-dimensional position, such as moving up, down, left, right, forward or backward, and in this case, the operation interface adjustment time refers to the time required to convert the operation interface from the changed state to a state in which the user can access and use the operation interface to drive. The seat adjustment time and the operation interface adjustment time may increase as the changes in the seat and the operation interface further deviate from the normal state in which the user is allowed to drive the vehicle.

[0110] According to an embodiment, when the operation interface and the seat are adjusted simultaneously, the operation interface adjustment time and the seat adjustment time (T 座椅 ) can be regarded as the vehicle state change time. According to another embodiment, when the operation interface adjustment and the seat adjustment are performed in sequence, the seat adjustment time (T 座椅 ) is added to the operation interface adjustment time to determine the vehicle status change time.

[0111] In operation S218, when the event occurs, the remaining time (T 事件 ) than the alarm time (T 警报 ) is longer, the processor 130 may proceed to operation S220 to continue driving the vehicle based on a Level 4 autonomous driving method (eg, HMCS) without displaying a notification to the user. Meanwhile, in operation S218, the processor 130 may continuously determine the remaining time for the event to occur (T 事件 ) is still longer than the alarm time (T警报 )long.

[0112] In operation S218, when the event occurs, the remaining time (T 事件 ) becomes longer than the alarm time (T 警报 ) is short, the processor 130 may proceed to operation S222 to display a Level 1 control switching request notification to the user. That is, the processor 130 that performs Level 4 autonomous driving (such as HMCS) may display an alert time (T) before the event is expected to occur. 警报 ) before providing the user with an initial switch request notification.

[0113] After displaying the initial notification, the processor 130 may proceed to operation S224 to determine the remaining time (T 事件 ) is less than the minimum response time (T 响应时间 ) and seat adjustment time (T 座椅 ). The processor 130 may monitor the remaining time (T 事件 ) is less than the minimum response time (T 响应时间 ) and seat adjustment time (T 座椅 ) and the remaining time (T 事件 ) becomes less than the minimum response time (T 响应时间 ) and seat adjustment time (T 座椅 ), proceeds to operation S226 to display a 2-level control switching request notification to the user while moving the driver's seat to a position predefined by the user.

[0114] In operation S228, the processor 130 may determine the remaining time (T 事件 ) is greater than the minimum response time (T 响应时间 ). Referring to operations S224 and S226, in operation S228, the processor 130 may wait for a time required for the driver's seat to be adjusted to a position predefined by the user. Therefore, in operation S228, the processor 130 may also determine whether the driver's seat is in a position predefined by the user.

[0115] When the remaining time (T 事件 ) is less than the minimum response time (T 响应时间 ), the processor 130 may proceed to operation S230 to display a 3-level control switching request notification.

[0116] After displaying the 3-level control switching request notification, the processor 130 proceeds to operation S232 to determine the event occurrence remaining time (T 事件 ) is less than or equal to zero. When the remaining time for the event to occur (T事件 ) is less than or equal to zero, the processor 130 proceeds to operation S234 to perform a minimum risk maneuver (MRM). As the processor 130 performs the minimum risk maneuver (MRM) in operation S234, the vehicle 100 may transition to a minimum risk condition (MRC) state in operation S240.

[0117] According to another embodiment, when the processor 130 determines the remaining time (T 事件 ) is less than the minimum response time (T 响应时间 ), thereby indicating that it may be impossible to respond to the event, the processor 130 may display a 3-level control switching request notification in operation S230, and immediately proceed to operation S234 to perform a minimum risk maneuver (MRM).

[0118] Once the vehicle 100 is transitioned to the minimum risk condition (MRC) state through the minimum risk maneuver (MRM), the processor 130 may determine whether the vehicle can continue to drive in operation S242. For example, the processor 130 may use information obtained from the sensor unit 110 to determine whether the vehicle can be driven only manually, both manually and autonomously, or even not manually.

[0119] When it is determined in operation S242 that even manual driving of the user is impossible, the processor 130 may proceed to operation S244 to request help through an emergency rescue system (eg, E-Call).

[0120] When it is determined in operation S243 that manual or autonomous driving is possible, the processor 130 may proceed to operation S246 to display a level 4 control switching request notification. In this case, as part of handling a high-risk emergency, when the driver's seat is not in a state predefined by the user, the processor 130 may adjust the driver's seat to a state predefined by the user.

[0121] According to an embodiment, if the control switching is not completed within a predefined time after the level 4 control switching request notification, the processor 130 may request external assistance through an emergency rescue system (eg, E-Call).

[0122] according to Figure 4 , the system or processor 130 performing Level 4 autonomous driving goes through a total of four levels for non-emergency events, provides different alerts at each level, and can perform controls related to changing the driver's seat to a drivable state, extending / activating the operating interface, and other related adjustments as needed.

[0123] According to the implementation mode, Figure 4As shown, as the levels progress from level 1 to level 4, the processor 130 may display increasingly strong notifications for controlling the switching.

[0124] For example, a Level 1 notification may use one or more types of output (visual, auditory, and tactile) to provide information about the occurrence and type of an event and the information required for control switching. A Level 2 notification may use two or more types of output (visual, auditory, and tactile) to provide information about the occurrence and type of an event and the information required for control switching, while also adjusting the driver's seat to a position that allows the user to drive, which is the state before the Level 4 autonomous driving system takes over, or returning the user's control interface to its initial position when it has been displaced. A Level 3 notification may use all methods of visual, auditory, and tactile output to provide information about the occurrence and type of an event and the information required for control switching. A Level 4 notification may provide information with the same intensity as a Level 3 notification or with a stronger intensity than a Level 3 notification.

[0125] In addition, when the user is in accordance with Figure 4 When the process is terminated immediately, the control is performed during the operation of the flowchart, and Figure 4 The method shown also ends.

[0126] As described above, various embodiments relate to a method for providing a notification to a user when the user is required to control the vehicle in Level 4 autonomous driving. Because the user may not be involved in driving at all during Level 4 autonomous driving (which is highly autonomous driving), the user may be concerned with something other than driving the vehicle. Therefore, the user is likely not to know or immediately respond to the vehicle control switching notification sent from the Level 4 autonomous driving system. In this case, various embodiments proposed in this document propose a method for providing notifications in levels from Level 1 to Level 4 in consideration of the user situation during Level 4 autonomous driving.

[0127] According to various embodiments of this document, it is advantageous to prevent accidents and increase passenger confidence in the system by handling unavoidable control switching events in situ rather than consistently in a Level 4 autonomous system.

Claims

1. A vehicle with autonomous driving capability, the vehicle comprising: at least one sensor configured to detect an external environment of the vehicle, a state of the vehicle, and a state of a user; a processor configured to perform autonomous driving of the vehicle based on information obtained by the at least one sensor; as well as a controller configured to control the operation of the vehicle under the control of the processor, Wherein, the processor is configured to: determining whether control of the vehicle needs to be handed over to the user based on an event occurring during autonomous driving of the vehicle, and A notification is provided to the user indicating that control of the vehicle needs to be switched to the user.

2. The vehicle according to claim 1, wherein: The processor is further configured to: Detect upcoming events, determining whether the control needs to be switched based on the event, Get the remaining time until the event occurs when the control needs to be switched, Determine whether the remaining time for the event to occur is greater than or equal to the first time, When the remaining time for the event to occur is greater than or equal to the first time, determining whether the remaining time for the event to occur is greater than a second time, When the remaining time for the event to occur is greater than the second time, continuing autonomous driving, and When the remaining time for the event to occur is less than the second time, displaying a first-level notification for controlling the switching request, The second time is determined based on at least one of a state of the user and a state of the vehicle.

3. The vehicle according to claim 2, wherein: The second time is calculated by adding a vehicle state change time required to put the vehicle in a state where the user can drive the vehicle based on the state of the vehicle and a buffer time required for the user to perform a driving operation based on the state of the user to the first time.

4. The vehicle according to claim 3, wherein: The state of the user includes gaze information and information on whether the user is asleep, and the state of the vehicle includes at least one of seat state information and driving operation interface state information.

5. The vehicle according to claim 4, wherein: The buffer time is configured to increase as the user's gaze further deviates from a heading direction, and the vehicle state change time is configured to increase as a seat or the driving operation interface deviates further from a normal state that allows the user to drive the vehicle.

6. The vehicle according to claim 2, wherein: The processor is configured to perform a minimum risk maneuver to transition the vehicle to a minimum risk condition state based on the remaining time to occurrence of the event being less than the first time.

7. The vehicle according to claim 6, wherein: The processor is further configured to: calculating the driving risk level of the vehicle based on the remaining time for the event to occur being less than the first time; moving the driver's seat to a state predefined by the user based on the driving risk level being determined to be low risk, and The driver's seat is moved to a state capable of protecting the user based on the driving risk level determined to be high risk.

8. The vehicle according to claim 3, wherein: The processor is configured to: displaying a second level notification for controlling the switching request based on the remaining time for the event to occur being less than a third time, and displaying a third level notification for controlling the switching request based on the remaining time for the event to occur being less than a fourth time, The first time is the same as the fourth time, the third time is longer than the fourth time, and the second time is longer than the third time.

9. The vehicle according to claim 8, wherein: The first time and the fourth time are minimum expected times required for the user to recognize the current state of the vehicle and surrounding traffic and be able to drive the vehicle, and the third time is a time obtained by subtracting the buffer time from the second time.

10. The vehicle according to claim 8, wherein: The processor is configured to move a driver's seat to a state predefined by the user while displaying the second level notification.

11. The vehicle according to claim 4, wherein: The vehicle state change time includes at least one of a seat adjustment time required to adjust the driver's seat from a changed state in which the user is not involved in driving to a state allowing the user to drive and an operation interface adjustment time required to adjust the operation interface to a state allowing the user to use it.

12. A method for operating a vehicle having autonomous driving capabilities, the method comprising the steps of: determining whether control of the vehicle needs to be handed over to a user based on an event occurring during autonomous driving of the vehicle; as well as A notification is provided to the user indicating that control of the vehicle needs to be switched to the user.

13. The method according to claim 12, wherein: Determining whether the control of the vehicle needs to be switched includes the following steps: Detect upcoming events, and determining whether the control needs to be switched based on the event, and Wherein, providing the notification to the user comprises the following steps: Get the remaining time until the event occurs when the control needs to be switched, Determine whether the remaining time for the event to occur is greater than or equal to the first time, When the remaining time for the event to occur is greater than or equal to the first time, determining whether the remaining time for the event to occur is greater than a second time, continuing autonomous driving based on the remaining time for the event to occur being greater than the second time, and Based on the remaining time of the event occurrence being less than the second time, a first-level notification for controlling the switching request is displayed, The second time is determined based on at least one of a state of the user and a state of the vehicle.

14. The method according to claim 13, wherein: The second time is calculated by adding a vehicle state change time required to put the vehicle in a state where the user can drive the vehicle based on the state of the vehicle and a buffer time required for the user to perform a driving operation based on the state of the user to the first time.

15. The method according to claim 14, wherein: The state of the user includes gaze information and information on whether the user is asleep, and the state of the vehicle includes at least one of seat state information and driving operation interface state information.

16. The method according to claim 15, wherein: The buffer time is configured to increase as the user's gaze further deviates from a heading direction, and the vehicle state change time is configured to increase as a seat or the driving operation interface deviates further from a normal state that allows the user to drive the vehicle.

17. The method according to claim 13, wherein: Providing the notification to the user includes the step of performing a minimum risk maneuver to transition the vehicle to a minimum risk condition state based on the remaining time to occurrence of the event being less than the first time.

18. The method according to claim 17, wherein: Providing the notification to the user comprises the following steps: calculating the driving risk level of the vehicle based on the remaining time for the event to occur being less than the first time; moving a driver's seat to a state predefined by the user based on the driving risk level being determined to be low risk; and The driver's seat is moved to a state capable of protecting the user based on the driving risk level determined to be high risk.

19. The method according to claim 14, wherein: Providing the notification to the user comprises the following steps: displaying a second level notification for controlling the switching request based on the remaining time for the event to occur being less than a third time; and displaying a third level notification for controlling the switching request based on the remaining time for the event to occur being less than a fourth time, The first time is the same as the fourth time, the third time is longer than the fourth time, and the second time is longer than the third time.

20. The method according to claim 19, wherein: The first time and the fourth time are minimum expected times required for the user to recognize the current state of the vehicle and surrounding traffic and be able to drive the vehicle, and the third time is a time obtained by subtracting the buffer time from the second time.

21. The method according to claim 19, wherein: Providing the notification includes the step of moving a driver's seat to a state predefined by the user while displaying the second level notification.

22. The method according to claim 15, wherein: The vehicle state change time includes at least one of a seat adjustment time required to adjust the driver's seat from a changed state in which the user is not involved in driving to a state allowing the user to drive and an operation interface adjustment time required to adjust the operation interface to a state allowing the user to use it.

Images