Method for initiating safety protocol for decelerating vehicle

Abstract

The present disclosure relates to a method (100) for initiating a safety protocol (108) for decelerating a vehicle (10), where the method comprises: obtaining first data indicative of at least one driving parameter of the vehicle (10), obtaining second data indicative of driver awareness of a driver of the vehicle (10), a driver responsiveness check (106) is initiated based on the first data and the second data, and the safety protocol (108) is initiated if the driver responsiveness check (106) indicates that the driver responsiveness check (106) is not passed.

Description

Technical Field

[0001] The present disclosure relates to a method for initiating a safety procedure for decelerating a vehicle, a computer program product, a data processing device, and a vehicle. Background Art

[0002] When a vehicle's driver suffers from a sudden illness (e.g., heart failure, syncope, seizure), they may inadvertently press the accelerator pedal, resulting in unwanted acceleration. This inadvertent pressing of the accelerator pedal can also override vehicle interventions. For example, such an intervention can be automatic emergency braking, which can be overridden if the accelerator pedal is pressed beyond a certain threshold.

[0003] Although in-vehicle sensors can be used to detect abnormal driving behavior and driver status, vehicles are often too slow to react by initiating a safety procedure for stopping the vehicle, or alternatively, initiate the safety procedure too early, i.e., when the driver has not suffered from a sudden illness. The first alternative does not increase safety as desired, while in the second alternative of a false positive trigger of the safety procedure, the driving experience of a healthy driver is significantly interrupted due to the vehicle being forced to stop prematurely. Summary of the Invention

[0004] The problem is at least partially solved or alleviated by the subject matter of the independent claims of the present disclosure, where additional examples are incorporated in the dependent claims.

[0005] According to a first aspect of the present disclosure, there is provided a method for initiating a safety procedure for decelerating a vehicle, the method comprising:

[0006] obtaining first data indicative of at least one driving parameter of the vehicle,

[0007] obtaining second data indicative of the driver awareness of the driver of the vehicle,

[0008] initiating a driver responsiveness check based on the first data and the second data, and

[0009] if the driver responsiveness check indicates that the driver responsiveness check has failed, initiating the safety procedure.

[0010] Accordingly, the method provides for initiating a safety procedure for decelerating a vehicle based on the driving of the vehicle and the driver awareness of the vehicle driver. However, the safety procedure is only initiated after a driver responsiveness check based on the driving of the vehicle and driver awareness, and if the driver responsiveness check indicates that it has failed, or in other words, the result of the driver responsiveness check is a failure or indicates a failure. Thus, false positive triggering of the safety procedure can be avoided or at least reduced. If the driver responsiveness check passes, the safety procedure may not be initiated, i.e., the driving of the vehicle may continue, e.g., under the automatic or manual control of the driver. Alternatively, when the driver responsiveness check fails, the safety procedure is initiated. For example, a control signal indicating the safety procedure may be provided for controlling the vehicle such that the safety procedure for decelerating the vehicle is executed.

[0011] For example, deceleration may be performed by using the friction brakes of the vehicle, using the motor brakes of the vehicle, and / or a one-pedal drive (e.g., in the case of an electric vehicle). The vehicle may be a motor vehicle, such as an internal combustion engine vehicle or an electric vehicle. The vehicle may be, for example, a passenger vehicle. The vehicle may be configured for at least partially autonomous driving. In other words, the vehicle may be at least a partially autonomous vehicle. In particular, the vehicle may at least decelerate, especially stop (e.g., by emergency or controlled braking), and / or autonomously change lanes to execute the safety procedure.

[0012] For example, the initiation of the driver responsiveness check may be provided by running data configured to perform the driver responsiveness check. The driver responsiveness check may be performed at least partially on any visual, acoustic, or similar system of the vehicle, such as including a display interface, a voice interface, or any other user interface for receiving input as a response to the driver responsiveness check.

[0013] To initiate the driver responsiveness check, first data and second data are considered. For example, at least one threshold and / or at least one criterion for the first data and / or the second data may be compared with the first data and / or the second data, especially with at least one driving parameter and / or driver awareness, especially with at least one driver awareness parameter. When the (one or more) thresholds and / or (one or more) criteria are met or exceeded, the driver responsiveness check may be initiated and performed. If they are not met or exceeded, the driver responsiveness check may not be performed, and the driver is not troubled by the driver responsiveness check. Thus, the driver responsiveness check can be used as an additional determinant for determining that the vehicle is operating in an unsafe manner (e.g., due to a sudden illness of the driver) and should be decelerated (especially stopped) to prevent an accident.

[0014] The method can be implemented at least in part by a computer. Accordingly, one, more than one, or all steps of the method can be performed by a computer. The method can be implemented in software or hardware or a combination of software and hardware. Additionally, the method can be performed by computer program instructions running on a component that provides data processing functionality. The data processing component can be a suitable computing component, such as an electronic control module, etc., which can also be a distributed computer system. The data processing component or computer can respectively include one or more of a processor, a memory, a data interface, etc.

[0015] According to an example, at least one driving parameter can be at least one of the speed and acceleration of the vehicle. For example, the speed and / or acceleration can be determined based on the throttle pedal pressure (or in other words, the throttle pedal depression), for example, which can be measured by a throttle pedal sensor. Alternatively or additionally, the speed and / or acceleration can be measured in any other way, for example, by one or more wheel speed sensors, GPS sensors, or the like. High speed and / or high acceleration can indicate that an unaware (e.g., ill) driver has their foot on the throttle pedal and is increasing the speed of the vehicle in an uncontrolled manner. Thus, for example, by setting the thresholds and / or criteria as described above, the likelihood of initiating a safety procedure when the driver is unaware can be increased.

[0016] According to an example, the method can include setting a limit for at least one of the speed and acceleration of the vehicle based on first data and second data. In particular, when the (one or more) thresholds and / or (one or more) criteria as described above are satisfied, the limit can be set. The same (one or more) thresholds and / or (one or more) criteria can be applied for setting the limit and for initiating a driver responsiveness check. In particular, when a driver responsiveness check is initiated, the limit can be set. However, the limit can be set before, during, or after the driver responsiveness check is initiated. Thus, while the driver responsiveness check is being performed, the driver can be constrained from increasing the speed and / or acceleration of the vehicle above the limit. This can be regarded as a first measure for preventing vehicle accidents when the driver is supposed to be unaware. However, it is a much less restrictive measure than the safety procedure, which is only executed after the driver responsiveness check fails (i.e., the driver does not or does not correctly respond to the driver responsiveness check). Nevertheless, the limit can substantially help prevent accidents because if the safety procedure is to be executed, the vehicle will need to be decelerated from the speed at which the limit was set rather than a higher speed, which gives valuable time to prevent any accident to the vehicle.

[0017] According to an example, the method may include: if a driver responsiveness check indicates that the driver responsiveness check has passed, or in other words, the result of the driver responsiveness check is pass or indicates pass, then the restriction is disabled. Thus, once it is ensured that the driver is aware and the driver responsiveness check is triggered by a reason that does not require a safety procedure (e.g., the driver is distracted for a short period or the like), full control or ability of driving the vehicle in terms of speed and / or acceleration is returned to the driver. Thus, in the case where the driver responsiveness check has a pass result, the restriction on speed and / or acceleration only lasts for a short period and is more likely to be accepted by the driver as a safety feature.

[0018] According to an example, the method may include initiating an output of at least one signal indicating a restriction by at least one user interface of the vehicle. The user interface may be any interface that can notify a user or driver of the vehicle of a set restriction, e.g., at least one display (e.g., for infotainment, dashboard, and / or as a head-up display), at least one speaker, or the like. Thus, the signal may be output as a visual signal (e.g., in the form of text and / or image or icon) and / or, for example, as an acoustic signal. Thus, the driver (if he is aware) is prevented from being surprised by the set restriction or wrongly considering a vehicle malfunction or the like.

[0019] According to an example, the method may include disabling the deactivation of at least one safety system of the vehicle and / or enabling at least one safety system of the vehicle. Examples of such safety systems may be automatic emergency braking, a collision warning system (e.g., front collision warning), an adaptive cruise control system, or the like. For example, one or more different safety systems may be disabled for deactivation, while one or more additional safety systems may be enabled. In particular, when the above-mentioned (one or more) thresholds and / or (one or more) criteria are met, the disabling of the deactivation of at least one safety system and / or the enabling of at least one safety system may be performed. The same (one or more) thresholds and / or (one or more) criteria may be applied to the following operations: disabling the deactivation of at least one safety system and / or enabling at least one safety system, and for initiating a driver responsiveness check. In particular, when a driver responsiveness check is initiated, the disabling of deactivation and / or enabling may be performed. However, the disabling and / or enabling may be performed before, during, or after the initiation of the driver responsiveness check. Thus, by implementing one or more safety systems, safety during the driver's unaware driving period or at least during the time of the driver responsiveness check can be increased.

[0020] According to an example, the initiation of the driver responsiveness check can also be based on at least one driving parameter exceeding a driving parameter threshold for a period of time and / or at least one driver awareness parameter of the second data exceeding a driver awareness threshold or meeting a driver awareness criterion for a period of time. The periods of time can be the same. One or more periods of time can be predefined. The driving parameter threshold can be a driving speed, for example, higher than 80 km / h, higher than 100 km / h, or higher than 120 km / h. For example, the driver awareness parameter can be determined based on one or more measured values (such as heart rate, breathing rate, and the like) and / or, for example, pictures of the driver taken by a camera inside the vehicle (such as showing facial expressions, gaze direction, and the like). For example, the period of time can be in the range of 3 seconds to 60 seconds, particularly 5 seconds to 50 seconds, and further particularly 7 seconds to 45 seconds.

[0021] According to an example, the driver responsiveness check can be configured to output at least one signal indicating the driver responsiveness check through at least one user interface of the vehicle. The user interface can be any interface that can notify the user or driver of the vehicle about the responsiveness check, for example, at least one display (such as for infotainment, dashboard, and / or as a head-up display), at least one speaker, or the like. For example, the signal can be or can be configured as a task or information regarding the initiated driver responsiveness check that requires input or response from the driver, such as by pressing a touch display.

[0022] According to an example, the driver responsiveness check can be configured such that: if at least one user interface of the vehicle receives a response from the driver within a time limit after at least one signal has been output, the driver responsiveness check passes, and if at least one user interface does not receive a response from the driver within the time limit, the driver responsiveness check fails. For example, the time limit can be predefined. For example, the limit can be in the range of 1 second to 8 seconds, particularly 2 seconds to 6 seconds, and further particularly 3 seconds to 5 seconds, such as about 3 seconds. It can also be provided that if the response from the driver is incorrect, the driver responsiveness check fails. For example, the driver responsiveness check can be configured such that a specific response is required. For example, there can be two or more types of responses or two or more possibilities to respond to the signal, where only one response is correct and the other is incorrect. An incorrect response indicates that the user is actually unaware despite responding to the driver responsiveness check. In this case, the driver responsiveness check may still fail. The user interface for receiving the response can be the same as the user interface that outputs the signal indicating the driver responsiveness check, or it can be a different user interface, for example, a microphone or a camera or a sensor for gesture recognition. For example, the response can be a touch on one or more buttons or parts of a touch display that is the user interface, one or more voice responses via the microphone, a gesture indication, or other indications, etc. Additionally, alternatively, the user interface can be an accelerator pedal, a brake pedal, a steering wheel, and / or any other user interface for controlling the vehicle. The driver responsiveness check can require the driver to perform a driving action as a response, for example, using the brake pedal, stepping on the accelerator pedal, switching lanes with the steering wheel, or the like. In the case where the user interface for outputting the signal and the user interface for receiving the response from the driver are different, the user interface for outputting the signal can also be referred to as the output user interface, and the user interface for receiving the response can also be referred to as the input or response user interface.

[0023] According to an example, the second data can indicate the driver awareness of the driver during vehicle acceleration and / or during a time period when at least one driving parameter exceeds a driving parameter threshold. Additionally or alternatively, the second data can be obtained at a time after at least one driving parameter exceeds the driving parameter threshold. Thus, the second data can not be obtained permanently. Instead, the second data can be obtained only when necessary, for example, at high speeds.

[0024] According to an example, driver awareness can be related to one or more of the following: whether the driver's hands are on the vehicle's steering wheel, the driver's steering behavior, whether the driver is looking at the road on which the vehicle is traveling, the driver's posture, the driver's facial color, the driver's gaze behavior, the driver's heart rate, the driver's breathing behavior, the driver's blood pressure, and the driver's facial expression. In particular, at least one driver awareness parameter can indicate one or more of the following: whether the driver's hands are on the vehicle's steering wheel, the driver's steering behavior, whether the driver is looking at the road on which the vehicle is traveling, the driver's posture, the driver's facial color, the driver's gaze behavior, the driver's heart rate, the driver's breathing behavior, the driver's blood pressure, and the driver's facial expression. For example, any one of the above can be detected by a camera, a sensor, or a user interface. For example, at least whether the driver's hands are on the vehicle's steering wheel, whether the driver is looking at the road on which the vehicle is traveling, the driver's posture, the driver's facial color, the driver's gaze behavior, and the driver's facial expression can be detected by an in-vehicle camera that can take pictures of the driver and / or record video of the driver during driving. For example, image processing of these pictures and / or videos can be performed to detect any one of the above. For example, the driver's heart rate, the driver's breathing behavior, and the driver's blood pressure can be detected by sensors of the vehicle itself or external sensors of the vehicle (e.g., sensors of the driver's watch that can be communicatively coupled to the vehicle).

[0025] According to an example, the safety procedure can be configured to stop the vehicle. In particular, the safety procedure can be configured such that the stopping of the vehicle is performed in a traffic-free zone. For this purpose, the method can further include determining a traffic-free zone (in particular, a traffic-free zone in front of the vehicle), and driving the vehicle towards the traffic-free zone to stop it there, for example, by steering it into the shoulder of the road lane.

[0026] According to a second aspect, there is provided a computer program product including instructions that, when run by a computer, cause the computer to perform the method according to the first aspect of the present disclosure.

[0027] For example, the computer program product can be such a computer program or a product on which a computer program can be stored, for example, a computer-readable storage medium.

[0028] According to a third aspect, there is provided a data processing device including components for performing the method according to the first aspect of the present disclosure. For example, the data processing device can be a computer or a control unit of a vehicle. For example, the device can be a suitable processing component and / or a computer program product.

[0029] According to a fourth aspect, there is provided a vehicle including the data processing device according to the third aspect of the present disclosure.

[0030] The vehicle may also include elements or systems as described herein, for example, one or more user interfaces, one or more safety systems, one or more sensors and / or cameras, a computer program product, and / or a data processing device.

[0031] It should be noted that the above examples can be combined with each other regardless of the aspects involved. Thus, the method can be combined with structural features, and similarly, the computer program product, the data processing device, and the vehicle can be combined with the features described above with respect to the method.

[0032] These and other aspects of the present disclosure will become apparent and be elucidated with reference to the examples described below. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] Examples of the present disclosure will be described below with reference to the following drawings.

[0034] Figure 1 A schematic diagram of a method according to an example of the present disclosure is shown;

[0035] Figure 2 A schematic diagram of a vehicle for performing Figure 1 the method is shown. DETAILED DESCRIPTION

[0036] The drawings are only schematic representations and are only used to illustrate examples of the present disclosure. Identical or equivalent elements are in principle provided with the same reference numerals.

[0037] Figure 1 A method 100 for initiating a safety procedure for decelerating a vehicle 10 as schematically shown in Figure 2 is shown. The method 100 can be executed based on instructions stored on a computer program product 60 of the vehicle 10, in particular by a data processing device 70 which can be a computer.

[0038] In a first step 101 of the method 100, first data indicating at least one driving parameter of the vehicle 10 is determined. For example, the at least one driving parameter can be at least one of the speed and acceleration of the vehicle 10. The determination can be based on, for example, the throttle pedal pressure or depression. The throttle pedal of the vehicle 10 can be a user interface 20 of the vehicle 10, in particular an input user interface, through which the driver of the vehicle 10 can provide an input to the vehicle 10, in this example in the form of an acceleration request.

[0039] Furthermore, in, before, and / or after the first step 101 of the method 100, the at least one driving parameter is compared with a driving parameter threshold. As long as the threshold is not exceeded, the driver of the vehicle 10 is also provided with full ability 102 to control the vehicle 10.

[0040] In the second step 103 of method 100, second data indicating the driver awareness (e.g., one or more driver awareness parameters) of the driver of vehicle 10 is obtained. The second step 103 may depend on the first step 101, especially since it may be required to exceed a driving parameter threshold to perform step 103. Full capability may at least include that the driver can accelerate vehicle 10 according to his expectations and is only limited by the technical capabilities of vehicle 10.

[0041] The second data may be obtained from a driver awareness system 50, which may include, for example, one or more sensors or cameras. For example, the driver awareness system 50 may include an interior or cabin camera for monitoring the driver and / or other passengers of vehicle 10. Thus, the driver awareness system 50 may, for example, determine whether the driver's hands are on the steering wheel of vehicle 10, whether looking at the road on which vehicle 10 is traveling, and / or optionally determine the driver's posture, facial color, gaze behavior, and / or the driver's facial expression. Based on this, the driver awareness system 50 may determine the level of the driver's awareness.

[0042] Similar to the first step 101, in, before, and / or after the second step 103 of method 100, at least one driver awareness parameter may be compared with a driver awareness parameter threshold or criterion. As long as the threshold is not exceeded or the criterion is not met, the driver of vehicle 10 is further provided with the full capability 102 for controlling vehicle 10.

[0043] If both thresholds are exceeded, method 100 may proceed to a third step 104. In an optional third step 104, a warning or information may be output to the driver via, for example, a user interface 30 of vehicle 10, and the user interface 30 may be an output user interface 30, such as, but not limited to, a display. Additionally or alternatively, in the third step 104, a limit may be set for at least one of the speed and acceleration of vehicle 10, and a corresponding signal indicating the limit may be output via the user interface 30. Thus, the driver is no longer provided with the full capability of driving vehicle 10 but is limited at least in terms of the speed and / or acceleration of vehicle 10. Further, additionally or alternatively, in the third step 104, at least one safety system 40 of vehicle 10 may be deactivated and / or at least one safety system 40 or another safety system 40 of vehicle 10 may be enabled.

[0044] Then, in an optional fourth step 105, it may be checked whether at least one driving parameter has exceeded a driving parameter threshold for a predetermined period of time, for example at least 3 seconds, and / or whether at least one driver awareness parameter of the second data has exceeded a driver awareness threshold or met a driver awareness criterion for a predetermined period of time. If either or both of the thresholds are exceeded within the predetermined period of time, a driver responsiveness check 106 may be initiated. The driver may be requested to respond to the driver responsiveness check 106 via the user interface 20, which may be notified to him via the user interface 30, for example by lifting his foot from the accelerator pedal. Alternatively, another user interface 20 may be used to receive the response, for example, in the form of the user interface 30, i.e., for example, a display on which the driver may press a virtual button indicating that he is able to continue driving.

[0045] The driver responsiveness check 106 may be configured, for example, such that: if the user interfaces 20, 30 of the vehicle 10 receive a response from the driver within a predetermined time limit after a signal restricting the speed of the vehicle 10 is output, the driver responsiveness check 106 passes, and if the user interfaces 20, 30 do not receive a response from the driver within this time limit, the driver responsiveness check 106 fails.

[0046] In the case where the driver responsiveness check 106 has passed as a result 107 of the driver responsiveness check, the method 100 continues to return the full ability 102 to drive the vehicle 100 to the driver, i.e., the speed restriction is removed. However, if the driver responsiveness check 106 has failed as a result 107, the method 100 proceeds to a safety procedure 108 for decelerating the vehicle 10 (in particular for stopping the vehicle).

[0047] As used herein, the phrase "at least one" with respect to a list of one or more entities should be understood to mean at least one entity selected from any one or more of the entities in the list of entities, but not necessarily including at least one of each entity specifically listed within the list of entities, and not excluding any combination of entities in the list of entities. This definition also allows that entities other than those specifically identified within the list of entities referred to by the phrase "at least one" may optionally be present, whether related or unrelated to those specifically identified. Thus, as a non-limiting example, "at least one of A and B" (or equivalently, "at least one of A or B", or equivalently, "at least one of A and / or B") can, in one example, refer to at least one A, optionally including more than one A, without B being present (and optionally including entities other than B); in another example, refer to at least one B, optionally including more than one B, without A being present (and optionally including entities other than A); in yet another example, refer to at least one A, optionally including more than one A, and at least one B, optionally including more than one B (and optionally including other entities). In other words, the phrases "at least one", "one or more", and "and / or" are open-ended expressions that are both conjunctive and disjunctive in operation. For example, each of the expressions "at least one of A, B, and C", "at least one of A, B, or C", "one or more of A, B, and C", "one or more of A, B, or C", and "A, B, and / or C" can represent A alone, B alone, C alone, A and B together, A and C together, B and C together, A, B, and C together, and optionally a combination of any of the foregoing with at least one other entity.

[0048] By studying the drawings, the disclosure, and the appended claims, those skilled in the art can understand and realize other variations of the disclosed examples when practicing the claimed disclosure. In a claim, the word "comprising" does not exclude other elements or steps, and the indefinite article "a" or "an" does not exclude a plurality. A single processor or other unit can perform the functions of several items or steps recited in a claim. The mere fact that certain measures are recited in mutually different dependent claims does not indicate that a combination of these measures cannot be used to advantage. A computer program can be stored / distributed on a suitable medium, such as an optical storage medium or a solid-state medium provided together with or as part of other hardware, but can also be distributed in other forms, such as via the Internet or other wired or wireless telecommunication systems. Any reference signs in the claims should not be construed as limiting the scope of the claims.

[0049] List of reference signs

[0050] 10 Vehicle

[0051] 20 Input User Interface

[0052] 30 Output User Interface

[0053] 40 Safety System

[0054] 50 Driver Awareness System

[0055] 60 Computer Program Product

[0056] 70 Data Processing Device

[0057] 100 Method

[0058] 101 First Step

[0059] 102 Full Capacity

[0060] 103 Second Step

[0061] 104 Third Step

[0062] 105 Fourth Step

[0063] 106 Driver Responsiveness Check

[0064] 107 Driver Responsiveness Check Result

[0065] 108 Safety Regulation

Claims

1. A method (100) for initiating a safety procedure (108) for decelerating a vehicle (10), wherein: The method comprises: obtaining first data indicative of at least one driving parameter of the vehicle (10), obtaining second data indicative of driver awareness of a driver of the vehicle (10), initiating a driver responsiveness check (106) based on the first data and the second data, and If the driver responsiveness check (106) indicates that the driver responsiveness check (106) has not passed, the safety procedure (108) is initiated.

2. The method (100) according to any one of the preceding claims, wherein: The at least one driving parameter is at least one of a speed and an acceleration of the vehicle (10).

3. The method (100) according to claim 1 or 2, wherein: The method (100) includes setting a limit for at least one of a speed and an acceleration of the vehicle (10) based on the first data and the second data.

4. The method (100) according to claim 3, wherein: The method (100) includes disabling the limiting if the driver responsiveness check (106) indicates that the driver responsiveness check (106) passes.

5. The method (100) according to claim 3, wherein: The method (100) includes initiating output of at least one signal indicative of the restriction by at least one user interface (20, 30) of the vehicle (10).

6. The method (100) according to claim 1 or 2, wherein: The method (100) comprises: disabling deactivation of at least one safety system (40) of the vehicle (10) and / or enabling at least one safety system (40) of the vehicle (10) based on the first data and / or the second data.

7. The method (100) according to claim 1 or 2, wherein: The initiation of the driver responsiveness check (106) is also based on the at least one driving parameter exceeding a driving parameter threshold for a period of time, and / or at least one driver awareness parameter of the second data exceeding the driver awareness threshold or satisfying a driver awareness criterion for a period of time.

8. The method (100) according to claim 1 or 2, wherein: The driver responsiveness check (106) is configured to output at least one signal indicative of the driver responsiveness check (106) via at least one user interface (20, 30) of the vehicle (10).

9. The method (100) according to claim 8, wherein: The driver responsiveness check (106) is configured such that: if at least one user interface (20, 30) of the vehicle (10) receives a response from the driver within a time limit after the at least one signal has been output, the driver responsiveness check passes, and if the at least one user interface (20, 30) does not receive a response from the driver within the time limit, the driver responsiveness check fails.

10. The method (100) according to claim 1 or 2, wherein: The second data is indicative of the driver awareness of the driver during acceleration of the vehicle (10) and / or during a time when the at least one driving parameter exceeds a driving parameter threshold.

11. The method (100) according to claim 1 or 2, wherein: The driver awareness is related to one or more of the following: whether the driver's hands are on the steering wheel of the vehicle (10), the driver's steering behavior, whether the driver is looking at the road on which the vehicle (10) is traveling, the driver's posture, the driver's facial color, the driver's gaze behavior, the driver's heart rate, the driver's breathing behavior, the driver's blood pressure, and the driver's facial expression.

12. The method (100) according to claim 1 or 2, wherein: The safety procedure (108) is configured to stop the vehicle (10).

13. A computer program product (60) comprising instructions which, when said program is run by a computer, cause said computer to perform the method (100) according to any one of claims 1 to 12.

14. A data processing device (70) comprising means for executing the method (100) according to any one of claims 1 to 12.

15. A vehicle (10) comprising a data processing device (70) according to claim 14.

Images