Procedure for transferring control of a motor vehicle that is at least partially automated

Abstract

The invention relates to a method for transferring control of an at least partially automated motor vehicle, comprising the following steps: determining that control of the motor vehicle, in particular currently at least partially automated, is to be transferred to a person for manual control of the motor vehicle, Capturing an identifying characteristic of the person to take over driving the motor vehicle in response to the determination, Comparing the person's identifying characteristic with a reference identifying characteristic, Handing over control of the motor vehicle to the person based on the comparison, so that the person can drive the motor vehicle manually. The invention relates to a system for transferring control of an at least partially automated motor vehicle, a computer program and a machine-readable storage medium.

Description

[0001] The invention relates to a method and a system for transferring control of an at least partially automated motor vehicle, a computer program and a machine-readable storage medium. State of the art

[0002] At least partially automated vehicles are known as such. There may be situations in which it is useful and / or necessary to hand over control of the vehicle to a person so that they can drive it manually. Disclosure of the invention

[0003] The object underlying the invention is to provide a concept for transferring control of an at least partially automated motor vehicle.

[0004] This problem is solved by means of the respective subject matter of the independent claims. Advantageous embodiments of the invention are the subject matter of dependent claims.

[0005] Following a first aspect, a procedure for transferring control of an at least partially automated motor vehicle is provided, comprising the following steps: To stipulate that the operation of the motor vehicle, especially one that is currently at least partially automated, should be handed over to a person for manual operation of the motor vehicle, Capturing an identifying characteristic of the person to take over driving the motor vehicle in response to the determination, Comparing the person's identifying characteristic with a reference identifying characteristic, Handing over control of the motor vehicle to the person based on the comparison, so that the person can drive the motor vehicle manually.

[0006] A second aspect involves providing a system for transferring control of at least a partially automated motor vehicle, including: a device that is set up to determine that the driving of the motor vehicle, in particular one that is currently at least partially automated, is to be handed over to a person, a recording device which is set up to record an identification feature of the person to take over driving the motor vehicle in response to the determination, a comparison facility which is set up to compare the person's identifying characteristic with a reference identifying characteristic, a transfer device which is set up to transfer the operation of the motor vehicle to the person based on the comparison, so that the person can operate the motor vehicle manually.

[0007] According to a third aspect, a computer program is provided, comprising instructions which, when the computer program is executed by a computer, in particular by the system according to the second aspect, cause it to execute a procedure according to the first aspect.

[0008] According to a fourth aspect, a machine-readable storage medium is provided on which the computer program is stored according to the third aspect.

[0009] The invention is based on and includes the understanding that, in response to a determination that the operation of the motor vehicle is to be transferred to a person for manual operation, an identification feature of the person who is to assume operation is captured. This identification feature is compared with a reference identification feature, and the operation of the motor vehicle is transferred to the person whose identification feature was captured based on the comparison, so that the person can operate the motor vehicle manually.

[0010] This allows, for example, advantageous control over who is authorized to drive the vehicle manually, or to whom the driving of the vehicle should be transferred. In other words, it is particularly intended to identify the person who is to take over the driving of the vehicle in order to advantageously ensure, for example, that this person is authorized to drive the vehicle manually.

[0011] For example, it is stipulated that driving privileges will not be transferred to the person if the comparison reveals that their identifying characteristic differs from the reference identifying characteristic. Conversely, it is stipulated that driving privileges will be transferred if the reference identifying characteristic matches the identifying characteristic. Thus, for example, one condition that must be met for driving privileges to be transferred is that the person's identifying characteristic matches the reference identifying characteristic. This means, in particular, that further conditions may also be stipulated that must be met for driving privileges to be transferred to the person. Further details on this will follow.

[0012] The vehicle is at least partially automated. For example, it is intended that the vehicle is currently being driven at least partially automatically. This means that, for example, it may be intended that the vehicle is currently being driven at least partially automatically, with the stipulation that the driving of the currently at least partially automated vehicle is to be transferred to a person for manual operation. For example, it may be intended that the vehicle is currently being driven manually, with the stipulation that the driving of the currently manually driven vehicle is to be transferred to a person for manual operation.The latter use case is advantageous, for example, when the driver of the vehicle is no longer able to drive manually or drives in such a way that it is necessary to hand over the driving to another person. This can be the case, for example, if the driver is performing dangerous maneuvers.

[0013] For example, the at least partially automated vehicle might be a robot taxi transporting one or more passengers. In this case, it might be stipulated that one of these passengers must manually operate the vehicle. The concept described in the description can also be applied here. For instance, the operation of the vehicle could be transferred to a teleoperator.

[0014] A person in the sense of the description is, for example, a teleoperator or, for example, an occupant of the motor vehicle, i.e., a motor vehicle occupant.

[0015] A motor vehicle that is at least partially automated is a motor vehicle that is designed to be driven at least partially automatically. The term "at least partially automated" encompasses the following: partially automated, highly automated, fully automated, and autonomous. Partially automated driving corresponds to automation level 2 according to the definition of the German Federal Highway Research Institute (BASt). Highly automated driving corresponds to automation level 3 according to the BASt definition. Fully automated driving corresponds to automation level 4 according to the BASt definition. Autonomous driving corresponds to automation level 5 according to SAE (J3016), where SAE stands for "Society of Automotive Engineers".

[0016] In one embodiment of the method, it is provided that, if the identification feature and the reference identification feature match, at least one attribute of the person is determined, whereby the guidance is transferred based on the at least one attribute, wherein the at least one attribute is an element selected from the following group of attributes: age of the person, criminal record of the person, driving licence class(es) of the person.

[0017] This results, for example, in the technical advantage that the transfer of control of the vehicle depends on attributes that are particularly relevant for manual driving. The attributes described here are therefore especially suitable for describing or characterizing the suitability of the person who is to take over driving the vehicle. In other words, these attributes are particularly suitable for deciding whether driving the vehicle should be transferred to that person.

[0018] For example, a person's age must be greater than or equal to a predetermined minimum age to be authorized to drive a motor vehicle. For example, the person's driving licence category(ies) must include the category required to operate the vehicle manually in order to be authorized to drive the vehicle. For example, the person's criminal record must be clean or must not contain certain criminal convictions in order to be authorized to drive a motor vehicle.

[0019] In one embodiment of the method, it is provided that a person's position is determined, and guidance is provided based on the determined position.

[0020] This offers the technical advantage, for example, that the transfer of control can be made dependent on the person's position. This allows, for instance, the advantageous assurance that the person has assumed the position necessary to manually operate the vehicle.

[0021] For example, the determined position of the person is compared with a reference position, and only if there is a match is the driving of the motor vehicle handed over to the person.

[0022] In one embodiment of the method, the person is an occupant of the motor vehicle, and the identification feature is captured by a vehicle-side detection device.

[0023] This results, for example, in the technical advantage that the identifying characteristic of the vehicle occupant can be efficiently recorded.

[0024] In one embodiment of the method, it is provided that control is only transferred if the determined position is located in a driver's seat of the motor vehicle.

[0025] This provides, for example, the technical advantage of efficiently ensuring that the person may only take over the operation of the motor vehicle if they are in a suitable position for manually operating the motor vehicle: the driver's seat.

[0026] In one embodiment of the method, the person is a teleoperator, and the identification feature is captured by a teleoperator-side detection device.

[0027] This results, for example, in the technical advantage that the teleoperator's identification feature can be efficiently captured.

[0028] A data acquisition device, i.e., a teleoperator-side data acquisition device and a vehicle-side data acquisition device, includes, for example, one or more of the following data acquisition elements: fingerprint scanner, iris scanner, camera, microphone and infrared camera.

[0029] In one embodiment of the method, it is provided that the control is only transferred if the determined position is located at a teleoperator workstation position.

[0030] This results, for example, in the technical advantage of efficiently ensuring that the control of the motor vehicle is only transferred to the teleoperator when the latter is in a position suitable for driving: the teleoperator workstation position.

[0031] In one embodiment of the method, the identification feature and the reference identification feature are each a biometric feature, in particular a facial image, a fingerprint, or an iris image.

[0032] This results, for example, in the technical advantage that particularly suitable identification features are provided.

[0033] In one embodiment of the method, the reference identification feature is provided to be an SSI reference identification feature of a digital identity, where SSI stands for "Self-Sovereign Identity".

[0034] This results, for example, in the technical advantage of providing a particularly suitable reference identification feature.

[0035] “Self-Sovereign Identity” can be translated into German as “selbstbestimmte Identität”.

[0036] In one embodiment of the method, it is provided that it is determined that the motor vehicle can no longer perform a driving task at least partially automatically, and based on this, it is determined that the driving of the motor vehicle should be handed over to a person.

[0037] This offers the technical advantage, for example, of enabling the efficient transfer of vehicle control to a person. In particular, it advantageously allows for manual control of the vehicle in situations where it can no longer drive, at least partially, autonomously. This helps avoid situations where the vehicle becomes unresponsive, such as a standstill.

[0038] For example, it is provided that it is determined that the driving of the motor vehicle should be handed over to a person in response to a determination that the motor vehicle can no longer perform a driving task, at least partially automatically.

[0039] In one embodiment of the method, it is provided that a request to hand over the driving of the motor vehicle is received, and based on the request, it is determined that the driving of the motor vehicle should be handed over to a person.

[0040] This results, for example, in the technical advantage that determining that the driving of the motor vehicle should be handed over to a person can be carried out efficiently.

[0041] This provides a particular technical advantage by offering an additional way to transfer control of the vehicle to a person. For example, the request can originate from a vehicle occupant. Thus, a vehicle occupant can request to take control of the vehicle. This allows an occupant of at least a partially automated vehicle to regain control. In emergency situations, for instance, they can manually drive the vehicle to defuse a dangerous situation. Furthermore, this can increase the occupant's sense of security by giving them the option to take manual control of the vehicle.

[0042] The request could, for example, originate from a teleoperator.

[0043] In one embodiment of the method, it is provided that it is determined that the motor vehicle is in an emergency situation, and based on this, it is determined that the driving of the motor vehicle should be handed over to a person.

[0044] This offers the technical advantage, for example, of enabling the efficient transfer of vehicle control to a person. In particular, this technical advantage allows for the manual transfer of vehicle control to a person in emergency situations. This can, for instance, resolve or defuse blockages or other dangerous situations.

[0045] In one embodiment of the method, it is provided that the execution of one, more, or all process steps is documented in a blockchain.

[0046] This offers the technical advantage, for example, of enabling efficient documentation of the process steps. In particular, it advantageously ensures that any subsequent manipulation of the documentation can be detected.

[0047] In one embodiment of the method, it is provided that one or more or all of the method steps are carried out automatically.

[0048] This results, for example, in the technical advantage that the process steps can be carried out efficiently. Thus, the process steps can be performed without human intervention. This allows the process steps to be automated. This advantageously leads to efficient execution of the process.

[0049] Process characteristics arise analogously from system characteristics and vice versa. This means, in particular, that the technical functionalities and technical characteristics of the process arise analogously from corresponding technical functionalities of the system, and vice versa. Statements made in connection with the system apply analogously to the process and vice versa.

[0050] The process is carried out, for example, using the system.

[0051] The system is set up, for example, to carry out all steps of the procedure.

[0052] The system is, for example, programmed to execute the computer program.

[0053] The method is, for example, a computer-implemented method.

[0054] For example, the reference identifier is intended to be stored in a wallet. A wallet could be, for example, an e-wallet or a hardware wallet, especially a secure hardware wallet.

[0055] The wallet can be stored, for example, in a vehicle component, such as a control unit, particularly an electronic control unit (ECU). A vehicle component is, for example, an ECU, where ECU stands for "Electronic Control Unit".

[0056] For example, the wallet could be a wallet application on a person's mobile device.

[0057] In other words, it may be stipulated, for example, that the reference identifier is stored in a wallet application on the person's mobile device, and, for example, that the reference identifier is also stored in a wallet on the vehicle. For example, the person may have given permission for their reference identifier to be stored in the vehicle's wallet.

[0058] For example, the plan is to capture several identifying characteristics of the person, which are then compared with several reference identifying characteristics. The transfer of leadership is then carried out based on this comparison.

[0059] Statements made in connection with one identification feature or reference identification feature apply analogously to multiple identification features or reference identification features and vice versa.

[0060] The embodiments and examples described here can be combined in any way, even if this is not explicitly described.

[0061] The term "credential" used in this description refers to a reference identifier of an SSI identity. A credential can also be called an SSI credential.

[0062] The invention is explained in more detail below with reference to preferred embodiments. These include: Fig. 1. A flowchart of a procedure for transferring control of a motor vehicle that is at least partially automated, Fig. 2 a system for transferring control of a motor vehicle that is at least partially automated, Fig. 3 a machine-readable storage medium, Fig. 4 a block diagram and Fig. Figures 5 to 8 each contain a flowchart of process steps as they can be used in the concept described here.

[0063] The same reference symbols can be used for identical features in the following.

[0064] Fig. Figure 1 shows a flowchart of a procedure for transferring control of an at least partially automated motor vehicle, comprising the following steps: 101 stipulates that the operation of the motor vehicle, in particular one currently being operated at least partially automatically, is to be handed over to a person for manual operation of the motor vehicle. Recording 103 an identification feature of the person to take over the driving of the motor vehicle in response to the determination, Compare 105 of the person's identification feature with a reference identification feature, Transfer 107 of the control of the motor vehicle to the person based on the comparison, so that the person can manually control the motor vehicle.

[0065] Fig. Figure 2 shows a system 201 for transferring control of an at least partially automated motor vehicle, comprising: a determination device 203, which is set up to determine that the operation of the, in particular currently at least partially automated, motor vehicle is to be handed over to a person a recording device, 205 which is set up to record an identification feature of the person to take over the driving of the motor vehicle in response to the determination, a comparison device 207, which is set up to compare the person's identification feature with a reference identification feature, a transfer device 209 which is set up to transfer the operation of the motor vehicle to the person based on the comparison, so that the person can operate the motor vehicle manually.

[0066] Fig. Figure 3 shows a machine-readable storage medium 301 on which a computer program 303 is stored. The computer program 303 comprises instructions which, when executed by a computer, cause the computer program 303 to perform a procedure according to the first aspect.

[0067] Fig. Figure 4 shows a block diagram 401, which illustrates the concept described here.

[0068] Block 403 depicts a scene encompassing a road 405 on which a partially automated vehicle 407 is driving. For example, the vehicle 407 is currently driving in a partially automated manner.

[0069] Person 409 wants to take over manual control of motor vehicle 407. Person 409 requests the transfer of control of motor vehicle 407 according to a function block 411.

[0070] Person 409 could, for example, be a teleoperator or an occupant of motor vehicle 407.

[0071] The person (409) has previously stored one or more reference identifiers (413), for example, in a wallet or on a remote server. These reference identifiers could be, for example, SSI reference identifiers of a digital identity.

[0072] Reference sign 415 identifies a group representing several persons 417 authorized to manually operate the motor vehicle 407. Reference identification features are assigned to each of these persons 417, or a reference identification feature is assigned to each of them.

[0073] In response to the requirement according to the functional block, it is determined that the operation of the motor vehicle should be transferred to person 409 for manual operation. In response to this determination, one or more identifying characteristics of person 409 are recorded. The recorded identifying characteristic(s) are compared with the respective reference identifying characteristics of persons 417. One of the persons 417 is person 409, so the comparison reveals a match of the characteristics being compared. Thus, person 409 can be identified as a person authorized to manually operate the motor vehicle 407.

[0074] Thus, control of the motor vehicle 407 can be transferred to person 409 according to a function block 419. This person could, for example, be a teleoperator, with reference 421 indicating a teleoperator workstation, so that person 409, as a teleoperator, can remotely control the motor vehicle 407 manually.

[0075] For example, it is provided that each person 417 is assigned one or more attributes, the attributes being the following: age of the person, criminal record of the person, driving licence class(es) of the person.

[0076] Depending on the attribute(s), a decision is made, for example, as to whether or not the operation of motor vehicle 407 may be handed over to the appropriate person.

[0077] The Fig. Figures 5 to 8 each show a flowchart of process steps as they can be implemented or used within the framework of the concept described here.

[0078] In detail, it shows Fig. 5 a flowchart 501 of a phase of a start of issuing a unique identity (“Verifiable Credential”) for the duration of the current process of handing over leadership. “Phase of a start of issuing can be translated into English as “Trigger Issuance Stage”.

[0079] Fig. Figure 6 shows a Flowchart 601 for verifying credentials to authenticate a person.

[0080] Fig. Figure 7 shows a flowchart 701 for requesting the transfer of control of a motor vehicle.

[0081] Fig. Figure 8 shows a flowchart 801 for stopping manual operation of a motor vehicle.

[0082] In some cases, the flowcharts show the same features, so the same reference symbols are used for the same features in the Fig. 5 to 8 can be used.

[0083] The following section describes the individual aspects in the Fig. The reference symbols for the elements shown in 5 to 8 are defined as follows: Reference 503 identifies the motor vehicle. Reference 505 identifies the infrastructure. Reference 507 identifies an SSI server. Reference 509 identifies a person. Reference 511 identifies a teleoperator subcomponent of a verifier. Reference 513 identifies the verifier. Reference 515 identifies a blockchain. Reference 517 identifies a VDR server. Reference 519 identifies an SSI issuer agent. Reference 521 identifies a wallet kit for the issuer and the verifier.

[0084] VDR stands for "Verifiable Data Registry," which is a decentralized data registry that acts as a trust layer in the SSI ecosystem to, among other things, ensure the trustworthy exchange of issuers' public keys. In this context, a VDR is a public, decentralized trust provider infrastructure without central (purely commercial) intermediaries.

[0085] SSI Issuer Agent refers to the entity that acts as the issuer (such as the Federal Printing Office for ID cards) – this can be software (e.g., an autonomously acting agent) or a backend process. A possible German translation of SSI Issuer Agent could be: autonomous issuer software.

[0086] According to the concept described here, an infrastructure is specifically provided for storing the public part of the identity in the Verifiable Data Registry (Public Key), while the private part is stored, for example, in the vehicle's eWallet. The decentralized nature of the VDR renders the term "server" obsolete, as it is a decentralized infrastructure with a multitude of servers that are managed by a consensus protocol. Since the process is twofold, involving the private and public parts of the identity, the final storage of the identity is called "publication."

[0087] In flowchart 501, reference 523 denotes the step of generating and initializing a digital identity at the beginning of the process. The digital identity is generated by person 509. According to step 525, the public part of the generated digital identity is stored in the VDR infrastructure 517. Reference 527 points to an arrow, symbolically representing the step of importing a private key into a hardware security module (eWallet). According to step 527, the digital identity is published. According to step 529, a configuration encompassing the digital identity is generated. Step 531 represents the generation of a configuration. Reference 533 indicates the generation and publication of the digital identity.

[0088] In flowchart 601, reference 603 represents a request for authorization. This request can include, for example, a selection of credentials—specific attributes that may and should be transmitted. It is important to note that only the absolutely necessary information for authorization needs to be transmitted, thus enabling data-efficient digital interaction. Reference 605 denotes a session ID, which is necessary to uniquely and securely identify the current transaction. Reference 607 indicates sending the request for credentials, which includes the session ID and the credential values. Reference 609 indicates forwarding the request. Reference 611 denotes an AuthCode, an authentication code required to gain access to critical system information and resources.According to reference 613, a token is requested using the AuthCode, which grants temporary access authorization. According to reference 615, the token is sent. According to reference 617, the credentials are requested using the token. According to reference 619, the credentials are sent. According to reference 621, the credentials are stored. The credentials are stored locally according to function block 625. This entire process thus allows for the secure, non-compromising transfer of authorizations and permissions from one party to another to use system-critical resources.

[0089] In flowchart 701, reference 703 indicates a request to start a teleoperation. Step 705 involves a trigger presentation, meaning the start signal (trigger) is transmitted. Reference 707 involves a start request (AuthCode), granting authorization to begin using the previously transferred rights. Step 709 forwards the start request (AuthCode). Step 711 involves the presentation step. Step 713 involves an access token (temporary access authorization). Step 715 involves a validation step using the access token. Step 717 involves a get presentation and status request (requesting a signal confirming authorization to proceed). Step 719 involves a presentation. Step 721 involves a start control (initiating control transfer).According to step 723, the transfer is completed, and control by the teleoperator is now active. According to step 725, an OK is sent. According to step 727, the transaction is recorded.

[0090] Analogous to flowcharts 601 and 701, the transaction (which was prepared and started there) is now completed, which is described below with reference to flowchart 801. Fig. 8 is explained in more detail. The above statements apply analogously. In flowchart 801 of the Fig.In step 801, a request to terminate the teleoperation is made. In step 803, a trigger presentation is performed. In step 805, a stop request (AuthCode) is made. In step 807, the stop request AuthCode is forwarded. In step 809, a present is performed. In step 811, an access token is generated. In step 813, a validation is performed using the access token. In step 815, a get presentation and status is generated. In step 817, a reliable presentation is generated. In step 819, a stop control is generated. Thus, the teleoperation is terminated according to function block 821. In step 823, an OK is sent. In step 825, the end of the transaction is recorded.

[0091] In summary, the concept described here enables the secure transfer of vehicle control to a person who can, for example, bring the vehicle to a safe state. This person could be a teleoperator. SSI reference identification features, for example, can be used to identify the person. One, several, or all of the process steps can be documented, for example, in a blockchain, to allow for the traceability of each step and to store them securely against manipulation.

[0092] For example, the transfer of control of the vehicle is requested if the vehicle malfunctions or if, for instance, a partially automated driving system requires assistance. This ensures, for example, that the vehicle can always be brought to a safe state under human supervision. The mechanism behind the transfer of control uses several technologies to enhance safety, reliability, and traceability.

[0093] One of these technologies is, for example, "Self Sovereign Identity", abbreviated "SSI".

[0094] SSI is a decentralized identity management model that allows individuals to control their digital identities. Within the framework of the concept described here, SSI is used, for example, to identify and / or authenticate individuals, particularly inmates and teleoperators. Individuals within this description can thus be identified and / or authenticated, for example, using their SSI credentials.

[0095] This effectively prevents unauthorized access. In particular, it advantageously ensures that only verified individuals can drive the vehicle.

[0096] By using cryptographic techniques, SSI can advantageously ensure that the transfer of control between motor vehicle and person is secure and tamper-proof.

[0097] Using SSI, an occupant of a motor vehicle, such as a robot taxi, can identify and / or authenticate themselves. For example, if an occupant needs to take manual control, such as in an emergency, their SSI credentials can be used to identify and / or authenticate them and authorize them to take over driving. This provides an additional layer of security and trust.

[0098] The process steps described here can be carried out automatically, for example. These steps can be performed using an AI agent. AI stands for "Artificial Intelligence," which can be translated into German as "künstliche Intelligenz," abbreviated "AI".

Claims

[1] Method for transferring control of a motor vehicle that is at least partially automated (407), comprising the following steps: Determine (101) that the operation of the motor vehicle (407), in particular currently at least partially automated, is to be handed over to a person (409) for manual operation of the motor vehicle (407), Recording (103) an identifying characteristic of the person (409) to be driving the motor vehicle (407) in response to the determination, Comparing (105) the person's identification feature (409) with a reference identification feature (413), Transferring (107) control of the motor vehicle (407) to the person (409) based on the comparison, so that the person (409) can manually control the motor vehicle (407). [2] Method according to claim 1, wherein, if the identification feature and the reference identification feature (413) match, at least one attribute of the person (409) is determined, wherein the guidance is transferred based on the at least one attribute, wherein the at least one attribute is an element selected from the following group of attributes: age of the person (409), criminal record of the person (409), driving licence class(es) of the person (409). [3] Method according to claim 1 or 2, wherein a position of the person (409) is determined, wherein the guidance is transferred based on the determined position. [4] Method according to any of the preceding claims, wherein the person (409) is an occupant of the motor vehicle (407) and wherein the identification feature is captured by a motor vehicle-side detection device. [5] Method according to claim 3 and claim 4, wherein the guidance is only transferred when the determined position is on a driver's seat of the motor vehicle (407). [6] Method according to any one of claims 1 to 3, wherein the person (409) is a teleoperator, and wherein the identification feature is captured by a teleoperator-side detection device. [7] Method according to claim 6 insofar as it relates back to claim 3, wherein the guidance is only transferred if the determined position is located at a teleoperator workstation position. [8] Method according to any of the preceding claims, wherein the identification feature and the reference identification feature (413) are each a biometric feature, in particular a facial image, a fingerprint, or an iris image. [9] Method according to any of the preceding claims, wherein the reference identification feature (413) is an SSI reference identification feature of a digital identity, where SSI stands for “Self-Sovereign Identity”. [10] Method according to one of the preceding claims, wherein it is determined that the motor vehicle (407) can no longer perform a driving task at least partially automatically, wherein, based on this, it is determined that the driving of the motor vehicle (407) is to be handed over to a person (409). [11] Method according to any of the preceding claims, wherein a request to transfer the driving of the motor vehicle (407) is received, wherein, based on the request, it is determined that the driving of the motor vehicle (407) is to be transferred to a person (409). [12] Method according to any of the preceding claims, wherein it is determined that the motor vehicle (407) is in an emergency situation, and based on this, it is determined that the operation of the motor vehicle (407) is to be transferred to a person (409). [13] A method according to any of the preceding claims, wherein the execution of one or more or all of the method steps is documented in a blockchain. [14] A method according to any of the preceding claims, wherein one or more or all of the method steps are carried out automatically. [15] System (201) for transferring control of a motor vehicle (407) that is at least partially automated, comprising: a determination facility (203) which is set up to determine, that the operation of the motor vehicle (407), which is currently at least partially automated, is to be handed over to a person (409), a recording device (205) which is designed to record an identification feature of the person (409) to be driving the motor vehicle (407) in response to the determination, a comparison device (207) which is set up to compare the person's identification feature (409) with a reference identification feature (413), a transfer device (209) which is set up to transfer the operation of the motor vehicle (407) to the person (409) based on the comparison, so that the person (409) can operate the motor vehicle (407) manually. [16] Computer program (303) comprising instructions which, when the computer program (303) is executed by a computer, cause it to execute a method according to any one of claims 1 to 14. [17] Machine-readable storage medium (301) on which the computer program (303) according to claim 16 is stored.

Images