Method, device, system, program and computer readable storage medium

Abstract

To provide a computing system which makes an autonomous vehicle usable.SOLUTION: A device includes: at least one interface for receiving sensor data from a plurality of sensors of a vehicle; and one or a plurality of processors which autonomously controls driving of a vehicle according to a route plan based on the sensor data, determine to stop autonomous control of the vehicle, sends a hand-off request to a remote computing system so that the remote computing system remotely controls the driving of the vehicle, receives driving instruction data from the remote computing system, and controls driving the vehicle on the basis of an instruction included in the driving instruction data.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS This application claims the benefit of and priority to U.S. Provisional Patent Application No. 62 / 826,955, filed March 29, 2019, entitled “AUTONOMOUS VEHICLE SYSTEM,” the disclosure of which is incorporated herein by reference in its entirety.

[0002] The present disclosure relates generally to the field of computer systems, and more particularly to computing systems that enable autonomous vehicles. [Background technology]

[0003] Some vehicles are configured to operate in an autonomous mode in which the vehicle navigates an environment with little or no input from a driver. Such vehicles typically include one or more sensors configured to sense information about the environment. The vehicle may use the sensed information to navigate the environment. For example, if the sensor senses that the vehicle is approaching an obstacle, the vehicle may navigate around the obstacle. [Brief description of the drawings]

[0004] [Figure 1] FIG. 1 is a schematic diagram illustrating an example autonomous driving environment, in accordance with certain embodiments.

[0005] [Diagram 2] FIG. 1 is a schematic block diagram illustrating an example implementation of a vehicle (and corresponding in-vehicle computing system) equipped with autonomous driving functionality, in accordance with certain embodiments.

[0006] [Diagram 3] FIG. 2 illustrates a portion of an example neural network, in accordance with certain embodiments.

[0007] [Figure 4]FIG. 1 is a schematic block diagram illustrating example levels of autonomous driving that may be supported in various vehicles (e.g., by their corresponding in-vehicle computing systems) in accordance with certain embodiments.

[0008] [Diagram 5] FIG. 1 is a schematic block diagram illustrating an example autonomous driving flow that may be implemented in some autonomous driving systems, according to certain embodiments.

[0009] [Figure 6] FIG. 1 is a schematic block diagram illustrating an autonomous vehicle and various sensors, in accordance with certain embodiments.

[0010] [Figure 7] FIG. 2 is a schematic block diagram illustrating communication between systems during an example remote valet service delivery, in accordance with certain embodiments.

[0011] [Figure 8] FIG. 1 is a schematic block diagram illustrating collaborative reporting of information regarding evacuation event risk and road condition alerts, which may be leveraged to launch a remote valet service, according to certain embodiments.

[0012] [Figure 9] FIG. 1 is a schematic block diagram illustrating an example autonomous vehicle mechanism including vehicle sensors, an artificial intelligence / machine learning based autonomous driving stack, and logic corresponding to triggering and generating handoff requests to a system capable of providing remote valet services, in accordance with certain embodiments.

[0013] [Figure 10] FIG. 2 illustrates an example safety model operation phase, in accordance with certain embodiments.

[0014] [Figure 11] FIG. 1 illustrates a system for modifying driver input to ensure acceleration conforms to a safety model, according to certain embodiments.

[0015] [Figure 12] FIG. 2 illustrates a training phase of a control-to-acceleration converter, in accordance with certain embodiments.

[0016] [Figure 13] FIG. 2 illustrates an inference phase of a control and acceleration converter, in accordance with certain embodiments.

[0017] [Figure 14] FIG. 2 illustrates a flow diagram for providing acceptable control signals to a vehicle actuation system according to certain embodiments.

[0018] [Figure 15] FIG. 1 illustrates a training phase for building a context model, according to certain embodiments.

[0019] [Figure 16] FIG. 2 illustrates a training phase for building a signal quality metric model, according to certain embodiments.

[0020] [Figure 17] FIG. 1 illustrates a training phase for building a handoff readiness model, according to certain embodiments.

[0021] [Figure 18] FIG. 1 illustrates an inference phase for determining a handoff decision based on sensor data, in accordance with certain embodiments.

[0022] [Figure 19] FIG. 2 illustrates a flow diagram for determining whether to hand off control of a vehicle, according to certain embodiments.

[0023] [Figure 20] FIG. 2 illustrates a driver state model training phase, according to certain embodiments.

[0024] [Figure 21] FIG. 1 illustrates a training phase of a handoff decision model, in accordance with certain embodiments.

[0025] [Figure 22] FIG. 2 illustrates an inference phase for determining a handoff decision, according to certain embodiments.

[0026] [Diagram 23] FIG. 1 illustrates a flow for generating a handoff decision in accordance with certain embodiments.

[0027] [Figure 24] FIG. 1 illustrates a high-level block diagram of a framework for control of an autonomous vehicle, in accordance with certain embodiments.

[0028] [Diagram 25] FIG. 1 illustrates an example process for controlling takeover of an autonomous vehicle, according to certain embodiments.

[0029] [Figure 26] FIG. 1 illustrates a further example process for controlling takeover of an autonomous vehicle, according to certain embodiments.

[0030] [Figure 27] FIG. 28 illustrates an example perception, planning, and action autonomous driving pipeline 2800 for an autonomous vehicle, in accordance with certain embodiments.

[0031] [Figure 28] FIG. 1 illustrates an example process for controlling a takeover request by a human driver of an autonomous vehicle, according to certain embodiments.

[0032] [Figure 29] FIG. 1 illustrates the amount of automation and associated amounts of different levels of participation required from a human driver, according to certain embodiments.

[0033] [Diagram 30] FIG. 1 illustrates a comprehensive cognitive supervisory system, according to certain embodiments.

[0034] [Diagram 31] FIG. 2 illustrates an example autonomy level transition, according to certain embodiments.

[0035] [Diagram 32] FIG. 2 illustrates an example of a structural flow of data in an autonomous vehicle operating at an L4 autonomy level, according to certain embodiments.

[0036] [Diagram 33] FIG. 2 illustrates an example of a video signal for a driver, according to certain embodiments.

[0037] [Diagram 34] FIG. 1 illustrates a flow diagram of an example autonomous vehicle handoff situation, in accordance with certain embodiments.

[0038] [Diagram 35] FIG. 2 illustrates an example of a flow for handing off control of an autonomous vehicle to a human driver, according to certain embodiments.

[0039] [Diagram 36] FIG. 36 illustrates an example system 3600 for handing off an autonomous vehicle to a human driver, in accordance with certain embodiments.

[0040] [Figure 37] FIG. 2 illustrates an example route that a vehicle may take to get from point A to point B, according to certain embodiments.

[0041] [Figure 38] FIG. 2 illustrates a flow that may be implemented at least in part by a handoff handling module, according to certain embodiments.

[0042] [Figure 39] FIG. 1 is a block diagram illustrating an example computer architecture that may be used in accordance with embodiments disclosed herein. [Diagram 40] FIG. 1 is a block diagram illustrating an example computer architecture that may be used in accordance with embodiments disclosed herein. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0043] 1 is a schematic diagram 100 illustrating an example autonomous driving environment. Vehicles (e.g., 105, 110, 115, etc.) may be equipped with various levels of autonomous driving capabilities facilitated by in-vehicle computing systems with logic implemented in the form of hardware, firmware, and / or software that enable respective autonomous driving stacks. Such autonomous driving stacks may allow self-control of the vehicle or provide driver assistance to detect roadways, navigate from one point to another, detect other vehicles and road actors (e.g., pedestrians (e.g., 135), bicyclists, etc.), detect obstacles and hazards (e.g., 120) and road conditions (e.g., traffic volume, road conditions, weather conditions, etc.), and adjust vehicle control and guidance accordingly. Within this disclosure, a "vehicle" may be a manned vehicle designed to carry one or more human occupants (e.g., a car, truck, van, motorcycle, train, airborne vehicle, ambulance, etc.), an unmanned vehicle that operates with or without a human occupant (e.g., a cargo vehicle (e.g., truck, rail car, etc.)), a vehicle that carries a non-human occupant (e.g., a livestock carrier, etc.), and / or a drone (e.g., a land or airborne drone or robot that moves within a driving environment (e.g., gathers information about the driving environment, assists in the automation of other vehicles, performs road maintenance operations, provides industrial services, provides security and emergency response services, etc.). In some implementations, a vehicle may be a system (e.g., a passenger car, an unmanned vehicle, or a drone vehicle), among other examples, configured to selectively operate in multiple different modes. A vehicle may "drive" within an environment, moving the vehicle along a ground (e.g., paved or unpaved roads, paths, or terrain), through water, or through the air. In this sense, a "road" or "roadway" may embody an outdoor or indoor ground path, a waterway, or a defined aerial boundary, depending on the implementation. Accordingly, it should be recognized that the following disclosure and related embodiments may be equally applicable to a variety of contexts and vehicular implementations.

[0044] In some implementations, the vehicles (e.g., 105, 110, 115) in the environment may be "connected" in that they include communications modules capable of wireless communication that enable the in-vehicle computing systems to connect to and communicate with other computing systems, such as in-vehicle computing systems of other vehicles, roadside units, cloud-based computing systems, or other supporting infrastructure, using one or more technologies (e.g., IEEE 802.11 communications (e.g., WiFi), cellular data networks (e.g., Third Generation Partnership Project (3GPP) networks, Pan-European System for Mobile Communications (GSM), General Packet Radio Service, Code Division Multiple Access (CDMA), etc.), 4G, 5G, 6G, Bluetooth, millimeter wave (mmWave), ZigBee, Z-Wave, etc.). For example, in some implementations, the vehicles (e.g., 105, 110, 115) may communicate with computing systems to provide sensors, data, and services in support of the autonomous driving capabilities of the vehicles themselves. For example, as shown in the illustrative example of Figure 1, among other examples, supporting drones 180 (e.g., ground and / or airborne), roadside computing devices (e.g., 140), various external (relative to the vehicle, i.e., "off-vehicle") sensor devices (e.g., 160, 165, 170, 175, etc.), and other devices may be provided as an autonomous driving infrastructure, separate from the computing systems, sensors, and logic mounted on the vehicles (e.g., 105, 110, 115), to assist and improve the autonomous driving results provided through the vehicles. Vehicles may also communicate with other connected vehicles over wireless communication channels to share data and coordinate movement within the autonomous driving environment, among other example communications.

[0045] As shown in the example of Figure 1, an autonomous driving infrastructure may incorporate a variety of different systems. Such systems may vary depending on location, for example, more developed roadways (e.g., roadways controlled by a particular local government or tolling agency, roadways in urban areas, sections of roadway known to be problematic for autonomous vehicles, etc.) may have more numerous or sophisticated supporting infrastructure devices than other sections of roadway, etc. Auxiliary sensor devices (e.g., 160, 165, 170, 175) may be provided, including, for example, sensors that observe portions of the roadway and vehicles moving within the environment and generate corresponding data describing or embodying the sensor observations. By way of example, the sensor devices may be embedded in the roadway itself (e.g., sensor 160), on roadside or overhead signs (e.g., sensor 165 on sign 125), sensors (e.g., 170, 175) attached to electronic roadside equipment or facilities (e.g., traffic lights (e.g., 130), electronic road signs, electronic billboards, etc.), or may be dedicated roadside units (e.g., 140), among other examples. The sensor devices may also include communication capabilities to communicate the sensor data they collect directly to nearby connected vehicles or to fog- or cloud-based computing systems (e.g., 140, 150). The vehicle may obtain data embodying observations or recommendations made by other systems (e.g., 140, 150) based on sensor data collected by or from external sensor devices (e.g., 160, 165, 170, 175, 180) and use this data for sensor fusion, inference, route planning, and other tasks performed by the in-vehicle autonomous driving system. In some cases, such off-vehicle sensors and sensor data may actually be located within the vehicle, such as in the form of aftermarket sensors installed in the vehicle, personal computing devices (e.g., smartphones, wearables, etc.) carried or worn by vehicle occupants.Other road actors, including pedestrians, cyclists, drones, unmanned aerial vehicles, robots, e-scooters, etc., may also be equipped with or carry sensors that generate sensor data describing the autonomous driving environment that may be used and consumed by autonomous vehicles, cloud-based or fog-based assistance systems (e.g., 140, 150), other sensor devices (e.g., 160, 165, 170, 175, 180), among other examples.

[0046] Because autonomous vehicle systems may possess varying levels of functionality and sophistication, the assistance infrastructure may require computational and machine learning functionality to not only assist some vehicles with their sensing capabilities, but also to enable some vehicles' autonomous driving functionality. For example, the computational resources and autonomous driving logic used to facilitate machine learning model training and the use of such machine learning models may be provided entirely in the in-vehicle computing systems, or partially in both the in-vehicle systems and some external systems (e.g., 140, 150). For example, connected vehicles may communicate with roadside units, edge systems, or cloud-based devices (e.g., 140) localized to particular segments of the roadway that can provide data (e.g., aggregated sensor data from local sensors (e.g., 160, 165, 170, 175, 180) or data reported from sensors in other vehicles), perform computations (as a service) on the data provided by the vehicle to aid in the vehicle's inherent capabilities, and / or forward information to passing or approaching vehicles (e.g., based on sensor data collected by device 140 or from nearby sensor devices, etc.). Connected vehicles (e.g., 105, 110, 115) may also, or instead, communicate with cloud-based computing systems (e.g., 150), which may provide similar memory, sensing, and computational resources to enhance their availability to the vehicles. For example, a cloud-based system (e.g., 150) may collect sensor data from various devices in one or more locations and utilize this data to build and / or train machine learning models that may be used by the cloud-based system to provide results to various vehicles (e.g., 105, 110, 115) in communication with the cloud-based system 150 or forward them to the vehicles for use by in-vehicle systems, among other example implementations.Access points (e.g., 145), such as cellular towers, roadside units, network access points equipped on various roadway infrastructure, access points provided by nearby vehicles or buildings, and other access points, may be provided within the environment and used to facilitate communication between the cloud-based system (e.g., 150) and the various vehicles (e.g., 105, 110, 115) over one or more local or wide area networks (e.g., 155). Through such infrastructure and computing systems, it should be appreciated that the embodiments, features, and solutions discussed herein may be implemented generally by one or more of such in-vehicle computing systems, fog-based or edge computing devices, or cloud-based computing systems, or by any combination of the above through communication and collaboration between the systems.

[0047] Generally, the terms "server," "client," "computing device," "network element," "host," "platform," "sensor device," "edge device," "autonomous driving system," "autonomous vehicle," "fog-based system," "cloud-based system," "system," and the like discussed herein may generally include electronic computing devices operable to receive, transmit, process, store, or manage data and information associated with an autonomous driving environment. As used herein, the terms "computer," "processor," "processor device," or "processing device" are intended to encompass any suitable processing device, including central processing units (CPUs), graphic processing units (GPUs), application specific integrated circuits (ASICs), field programmable gate arrays (FPGAs), digital signal processors (DSPs), tensor processors, and other matrix operation processors, among other examples. For example, an element depicted as a single device in an environment may be implemented using multiple computing devices and processors, such as a server pool including multiple server computers. Additionally, any, all, or some of the computing devices may be adapted to run virtual machines adapted to virtualize the execution of specific operating systems, including any operating system, such as Linux®, UNIX®, Microsoft® Windows®, Apple® OS, Apple® iOS®, Google® Android®, Windows Server®, as well as customized and proprietary operating systems.

[0048] Any of the flows, methods, processes (or portions thereof), or functionality of any of the various components described below or illustrated in the figures may be implemented by any suitable computing logic, such as one or more modules, engines, blocks, units, models, systems, or other suitable computing logic. References herein to a "module," "engine," "block," "unit," "model," "system," or "logic" may refer to hardware, firmware, software, and / or combinations of each that implement one or more functions. As an example, a module, engine, block, unit, model, system, or logic may include one or more hardware components, such as a microcontroller or processor, associated with a non-transitory medium that stores code adapted to be executed by the microcontroller or processor. Thus, references to a module, engine, block, unit, model, system, or logic may, in one embodiment, refer to hardware that is specifically configured to recognize and / or execute code held on the non-transitory medium. Moreover, in another embodiment, the use of a module, engine, block, unit, model, system, or logic refers to a non-transitory medium containing code specifically adapted to be executed by a microcontroller or processor to perform certain operations, and as can be inferred, in yet another embodiment, a module, engine, block, unit, model, system, or logic may refer to a combination of hardware and non-transitory medium.In various embodiments, a module, engine, block, unit, model, system, or logic may include a microprocessor or other processing element operable to execute software instructions, discrete logic such as an application specific integrated circuit (ASIC), a programmed logic device such as a field programmable gate array (FPGA), a memory device containing instructions, a combination of logic devices (e.g., as found on a printed circuit board), or other suitable hardware and / or software. A module, engine, block, unit, model, system, or logic may include one or more gates or other circuit components, which may be realized, for example, by transistors. In some embodiments, a module, engine, block, unit, model, system, or logic may be embodied entirely as software. Software may be embodied as a software package, code, instructions, instruction sets, and / or data recorded on a non-transitory computer-readable storage medium. Firmware may be embodied as code, instructions or instruction sets, and / or data hard-coded (e.g., non-volatile) in a memory device. Furthermore, logical boundaries illustrated as being separate will generally vary and possibly overlap. For example, a first and second module (or multiple engines, blocks, units, models, systems, or logic) may share hardware, software, firmware, or a combination thereof, but may in some cases retain some independent hardware, software, or firmware.

[0049] The flows, methods, and processes described below and illustrated in the accompanying drawings are merely representative of functions that may be implemented in certain embodiments. In other embodiments, additional functions may be implemented in the flows, methods, and processes. Various embodiments of the present disclosure contemplate any suitable signal generation mechanism that performs the functions described herein. Some of the functions illustrated herein may be repeated, combined, modified, or eliminated in the flows, methods, and processes, where appropriate. In addition, functions may be implemented in any suitable order in the flows, methods, and processes without departing from the scope of a particular embodiment.

[0050] 2, a schematic block diagram 200 is shown illustrating an example implementation of a vehicle (and corresponding in-vehicle computing system) 105 equipped with autonomous driving functionality. In one example, the vehicle 105 may be equipped with one or more processors 202, such as a central processing unit (CPU), a graphics processing unit (GPU), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), a digital signal processor (DSP), a tensor processor, and other matrix operation processors, among other examples. Such processors 202 may be coupled to or integrated with hardware accelerator devices (e.g., 204), which may comprise hardware to accelerate certain processing and memory access functions, such as functions related to machine learning inference or training (including any of the machine learning inference or training described below), processing certain sensor data (e.g., camera image data, LIDAR point clouds, etc.), performing certain computational functions related to autonomous driving (e.g., matrix operations, convolution operations, etc.), among other examples. One or more memory elements (e.g., 206) may be provided for storing machine-executable instructions implementing all or a portion of any one of the modules or sub-modules of the autonomous driving stack implemented in the vehicle, as well as for storing machine learning models (e.g., 256), sensor data (e.g., 258), and other data received, generated, or used in connection with the autonomous driving functionality performed by the vehicle (or used in connection with the embodiments and solutions discussed herein). Various communications modules (e.g., 212) may also be provided, implemented in hardware circuitry and / or software, to implement communications capabilities used by systems of the vehicle to communicate with other off-vehicle computing systems over one or more network channels using one or more network communication technologies.These various processors 202, accelerators 204, memory devices 206, and network communications modules 212 may be interconnected on the vehicle system through one or more interconnection fabrics or links (e.g., 208), such as fabrics utilizing technologies such as Peripheral Component Interconnect Express (PCIe), Ethernet, OpenCAPI™, Gen-Z™, UPI, Universal Serial Bus (USB), Cache Coherent Interconnect for Accelerators (CCIX™), Advanced Micro Devices™ (AMD™)'s Infinity™, Common Communications Interface (CCI), or Qualcomm™'s Centriq™ interconnect, among others.

[0051] 2, an example vehicle (and corresponding in-vehicle computing system) 105 may include an in-vehicle processing system 210, driving controls (e.g., 220), sensors (e.g., 225), and user / occupant interfaces (e.g., 230), among other example modules that implement autonomous vehicle functionality in hardware and / or software. For example, the in-vehicle processing system 210 may implement all or a portion of an autonomous driving stack and process flow (e.g., as shown and discussed in the example of FIG. 5) in some implementations. The autonomous driving stack may be implemented in hardware, firmware, or software. A machine learning engine 232 may be provided to utilize various machine learning models (e.g., 256) provided to the vehicle 105 in connection with one or more autonomous functions and features provided and implemented in or for the vehicle, such as those discussed in the examples herein. Such machine learning models 256 may include artificial neural network models, convolutional neural networks, decision tree-based models, support vector machines (SVMs), Bayesian models, deep learning models, and other example models. In some implementations, an example machine learning engine 232 may include one or more model trainer engines 252 that participate in one or more trainings (e.g., initial training, ongoing training, etc.) of the machine learning models 256. One or more inference engines 254 may also be provided that utilize the trained machine learning models 256 to derive various inferences, predictions, classifications, and other results. In some embodiments, training or inference of the machine learning models described herein may be performed outside the vehicle, such as by computing system 140 or 150.

[0052] The machine learning engine 232 provided to the vehicle may be utilized to support and provide results used by other logical components and modules of the in-vehicle processing system 210 that implement the autonomous driving stack and other autonomous driving related features. For example, the data collection module 234 may comprise logic to determine from which sources data should be collected (e.g., for input in training or use of various machine learning models 256 used by the vehicle). For example, a particular source (e.g., internal sensors (e.g., 225) or external sources (e.g., 115, 140, 150, 180, 215, etc.)) may be selected, as well as the frequency and fidelity at which data may be sampled. In some instances, such selection and configuration may be made at least in part autonomously by the data collection module 234 using one or more corresponding machine learning models (e.g., to appropriately collect data given a particular detected scenario).

[0053] The sensor fusion module 236 may also be used to govern the use and processing of various sensor inputs utilized by the machine learning engine 232 and other modules of the in-vehicle processing system (e.g., 238, 240, 242, 244, 246, etc.). One or more sensor fusion modules (e.g., 236) may be provided that may derive output from multiple sensor data sources (e.g., on-vehicle or off-vehicle). The sources may be homogenous or heterogeneous types of sources (e.g., multiple inputs from multiple instances of a common sensor type or from multiple instances of different sensor types). An example sensor fusion module 236 may apply direct fusion, indirect fusion, among other example sensor fusion techniques. The output of the sensor fusion may be provided as an input (possibly with additional inputs) to another module of the in-vehicle processing system and / or one or more machine learning models in some cases in connection with providing autonomous driving functionality or other functionality, such as those described in the example solutions discussed herein.

[0054] A perception engine 238 may be provided in some embodiments, and in some examples may take as input various sensor data (e.g., 258), including data from external sources and / or sensor fusion module 236, to perform object recognition and / or tracking of detected objects, among other example functions corresponding to autonomous perception of the environment encountered (or to be encountered) by vehicle 105. Perception engine 238 may perform object recognition from the sensor data inputs using deep learning, such as by one or more convolutional neural networks and other machine learning models 256. Object tracking may also be performed to autonomously estimate from the sensor data inputs whether an object is moving and, if so, along what trajectory. For example, after a given object is recognized, perception engine 238 may detect how the given object is moving relative to the vehicle. Such functionality may be used, for example, to detect objects, such as other vehicles, pedestrians, wildlife, bicyclists, etc., moving in the environment that may affect the path of the vehicle on the roadway, among other example uses.

[0055] A localization engine 240 may also be included in the in-vehicle processing system 210 in some implementations. In some cases, the localization engine 240 may be implemented as a subcomponent of the perception engine 238. The localization engine 240 may also utilize one or more machine learning models 256 and sensor fusion (e.g., of LIDAR and GPS data) to determine a high-confidence location of the vehicle and the space the vehicle occupies within a given physical space (i.e., the "environment").

[0056] The vehicle 105 may further include a route planner 242 that may utilize the results of various other modules, such as data collection 234, sensor fusion 236, perception engine 238, and localization engine (e.g., 240), among others (e.g., recommendation engine 244), to determine a path plan and / or action plan for the vehicle, which may be used by a driving control (e.g., 220) to control the driving of the vehicle 105 within the environment. For example, the route planner 242 may utilize these inputs and one or more machine learning models to determine probabilities of various events within the driving environment to determine an effective real-time plan to act within the environment.

[0057] In some implementations, the vehicle 105 may include one or more recommendation engines 244 that generate various recommendations from sensor data generated by the vehicle 105's own sensors (e.g., 225) as well as sensor data from external sensors (e.g., sensor devices 115, 180, 215, etc.). Some recommendations may be determined by the recommendation engine 244, which may be provided as inputs to components of the vehicle's autonomous driving stack to influence decisions made by those components. For example, recommendations may be determined that, if considered by the route planner 242, would normally determine otherwise, but that cause the route planner 242 to deviate from a decision or plan for the recommendation. Recommendations may also be generated by the recommendation engine (e.g., 244) based on considerations of passenger comfort and experience. In some instances, internal mechanisms within the vehicle may be operated predictively and autonomously based on these recommendations determined from sensor data (e.g., 258) acquired by the vehicle's sensors and / or external sensors, etc.

[0058] As described above, some vehicle implementations may include a user / occupant experience engine (e.g., 246) that may utilize the sensor data and the output of other modules in the vehicle's autonomous driving stack to control the vehicle's control units to modify driving maneuvers and perform modifications to the vehicle's cabin environment to enhance the occupant's experience within the vehicle based on observations acquired via the sensor data (e.g., 258). In some examples, aspects of the user interface (e.g., 230) provided in the vehicle that allows the user to interact with the vehicle and its autonomous driving system may be enhanced. In some cases, information representations may be generated and provided by a user display (e.g., audio, visual, and / or haptic representations) to help influence and improve the occupant's experience within the vehicle (e.g., 105), among other example uses.

[0059] In some cases, a system manager 250 may also be provided that monitors information collected by various sensors in the vehicle to detect issues with the performance of the vehicle's autonomous driving system. For example, computational errors, sensor failures and issues, communication channel availability and quality (e.g., provided through communication module 212), vehicle system checks (e.g., issues with the motor, transmission, battery, cooling system, electrical system, tires, etc.), or other operational events may be detected by system manager 250. Such issues may be identified in system report data generated by system manager 250, which may in some cases be used as inputs to machine learning models 256 and associated autonomous driving modules (e.g., 232, 234, 236, 238, 240, 242, 244, 246, etc.) so that vehicle system health and issues can also be considered along with other information collected in sensor data 258 in the autonomous driving functionality of vehicle 105.

[0060] In some implementations, the autonomous driving stack of the vehicle 105 may be coupled with driving controls 220 that affect how the vehicle is driven, including steering controls (e.g., 260), accelerator / throttle controls (e.g., 262), brake controls (e.g., 264), signaling controls (e.g., 266), among other examples. In some cases, the vehicle may also be controlled based in whole or in part on user input. For example, the user interface (e.g., 230) may include driving controls (e.g., physical or virtual steering wheel, accelerator, brake, clutch, etc.) that allow a human driver to take over control from the autonomous driving system (e.g., in a handover or subsequent driver assistance action). Other sensors may be utilized to receive user / occupant input, such as speech detection 292, gesture detection cameras 294, and other examples. A user interface (e.g., 230) may capture occupant-user wishes and intents, which the autonomous driving stack of the vehicle 105 may consider as additional inputs in controlling the driving of the vehicle (e.g., driving control 220). In some implementations, driving control may be governed by an external computing system, such as when an occupant utilizes an external device (e.g., a smartphone or tablet) to provide driving instructions or control, or in the case of a remote valet service where an external driver or system takes over control of the vehicle (e.g., based on an emergency event), among other example implementations.

[0061] As discussed above, the vehicle's autonomous driving stack may utilize various sensor data (e.g., 258) generated by various sensors provided on or outside the vehicle. As an example, the vehicle 105 may possess an array of sensors 225 that collect various information related to the vehicle's exterior and surrounding environment, vehicle system states, conditions within the vehicle, and other information usable by modules of the vehicle's processing system 210. For example, such sensors 225 may include global positioning (GPS) sensors 268, light detection and ranging (LIDAR) sensors 270, two-dimensional (2D) cameras 272, three-dimensional (3D) or stereo cameras 274, acoustic sensors 276, inertial measurement unit (IMU) sensors 278, thermal sensors 280, ultrasonic sensors 282, biosensors 284 (e.g., facial recognition, voice recognition, heart rate sensors, body temperature sensors, emotion detection sensors, etc.), radar sensors 286, weather sensors (not shown), among other example sensors. Such sensors may be utilized in combination to determine various attributes and conditions of the environment in which the vehicle operates (e.g., weather, obstacles, traffic, road conditions, etc.), occupants within the vehicle (e.g., occupant or driver awareness or alertness, occupant comfort or mood, occupant health or physiological condition, etc.), other contents of the vehicle (e.g., parcels, livestock, cargo, luggage, etc.), subsystems of the vehicle, among other examples. Sensor data 258 may also (or instead) be generated by sensors not integrally coupled to the vehicle, including sensors (e.g., 115) of other vehicles (which may be communicated to the vehicle 105 via vehicle-to-vehicle communication or other techniques), sensors of ground or airborne drones 180, sensors of user devices 215 (e.g., smartphones or wearables) carried by human users inside or outside the vehicle 105, and sensors mounted or provided on roadside units (e.g., 140), road signs, traffic lights, street lights, and other roadside elements. Sensor data from such off-vehicle sensor devices may be provided to the vehicle directly from the sensor devices, or may be provided through a data aggregation device or as results generated based on these sensors by other computing systems (e.g., 140, 150), among other example implementations.

[0062] In some implementations, the autonomous vehicle system 105 may interface with other computing systems and leverage information and services provided by them to enhance, enable, or otherwise assist the autonomous driving functionality of the device 105. In some examples, some autonomous driving mechanisms (including some of the example solutions discussed herein) may be made available through services, computing logic, machine learning models, data, or other resources of computing systems external to the vehicle. When such external systems are not available to the vehicle, these mechanisms may be at least temporarily unavailable. For example, external computing systems may be provided and leveraged, hosted on roadside units or fog-based edge devices (e.g., 140), on other (e.g., upper) vehicles (e.g., 115), and on cloud-based systems 150 (e.g., accessible through various network access points (e.g., 145)). The roadside unit 140 or cloud-based system 150, or other cooperating systems with which the vehicle (e.g., 105) interacts, may include all or a portion of the logic illustrated as belonging to an example in-vehicle processing system (e.g., 210), possibly along with additional functionality and logic. For example, the cloud-based computing system, the roadside unit 140, or other computing system may include a machine learning engine corresponding to either or both of the model training and inference engine logic. For example, such external systems may possess higher-end computing resources and more advanced or up-to-date machine learning models, enabling these services to provide better results than would otherwise be produced in the vehicle's processing system 210. For example, the in-vehicle processing system 210 may rely on machine learning training, machine learning inference, and / or machine learning models provided through a cloud-based service for specific tasks and handling specific scenarios.Indeed, it should be appreciated that one or more of the modules discussed and illustrated as belonging to vehicle 105 may, in some implementations, be selectively or redundantly provided within a cloud-based, fog-based, or other computing system supporting an autonomous driving environment.

[0063] Various embodiments herein may utilize one or more machine learning models to perform functions of an autonomous vehicle stack (or other functions described herein). The machine learning models may be executed by a computing system to incrementally improve performance of a particular task. In some embodiments, parameters of the machine learning models may be adjusted during a training phase based on training data. The trained machine learning models may then be used during an inference phase to make predictions or decisions based on input data.

[0064] The machine learning models described herein may take any suitable form or utilize any suitable technique, for example, any of the machine learning models may utilize supervised learning, semi-supervised learning, unsupervised learning, or reinforcement learning techniques.

[0065] In supervised learning, a model may be constructed using a training set of data that includes both inputs and corresponding desired outputs. Each training instance may include one or more inputs and a desired output. Training may include iterating through the training instances using an objective function that teaches the model to predict an output for a new input. In semi-supervised learning, a portion of the inputs in the training set may not have a desired output.

[0066] In unsupervised learning, a model may be constructed from a data set that contains only inputs and no desired outputs. Unsupervised models may be used to find structure in the data (e.g., grouping or clustering of data points) by discovering patterns in the data. Techniques that may be implemented in unsupervised learning models include, for example, self-organizing maps, nearest neighbor mapping, k-means, and singular value decomposition.

[0067] Reinforcement learning models may be given positive or negative feedback to improve accuracy. Reinforcement learning models may attempt to maximize one or more objectives / rewards. Techniques that may be implemented in reinforcement learning models may include, for example, Q-learning, Temporal Difference (TD), and Deep Adversarial Networks.

[0068] Various embodiments described herein may utilize one or more classification models. In a classification model, the output may be constrained to a limited set of values. A classification model may output a class for an input set of one or more input values. References herein to a classification model may contemplate a model that implements any one or more of the following techniques, for example, a linear classifier (e.g., a logistic regression or a naive Bayes classifier), a support vector machine, a decision tree, a boosted tree, a random forest, a neural network, or a nearest neighbor.

[0069] Various embodiments described herein may utilize one or more regression models. A regression model may output a numerical value from a continuous range based on an input set of one or more values. References herein to a regression model may contemplate a model that implements, for example, any one or more of the following techniques: linear regression, decision trees, random forests, or neural networks (or other suitable techniques).

[0070] In various embodiments, any of the machine learning models discussed herein may utilize one or more neural networks. A neural network may include a population of neural units loosely modeled to resemble the structure of a biological brain, including large clusters of neurons connected by synapses. In a neural network, neural units are connected to other neural units via links that may be excitatory or inhibitory in terms of their influence on the activation state of the connected neural units. A neural unit may utilize the value of its input to perform a function to update the membrane potential of the neuronal unit. A neuronal unit may propagate a spike signal to the connected neuronal unit upon exceeding a threshold associated with the neuronal unit. A neural network may be trained or otherwise adapted to perform a variety of data processing tasks (including tasks performed by an autonomous vehicle stack), such as computer vision tasks, speech recognition tasks, or other suitable computing tasks.

[0071] FIG. 3 illustrates a portion of an example of a neural network 300, according to certain embodiments. Neural network 300 includes neuronal units X1-X9. Neuronal units X1-X4 are input neuronal units that receive primary inputs I1-I4, respectively, which may be held constant while neural network 300 processes the output. Any suitable primary inputs may be used. As an example, when neural network 300 performs image processing, the primary input values ​​may be values ​​of pixels from an image (and the values ​​of the primary inputs may remain constant while the image is being processed). As another example, when neural network 300 performs speech processing, the primary input values ​​applied to a particular input neuronal unit may change over time based on changes to the incoming speech.

[0072] Although a particular topology and connectivity scheme is illustrated in FIG. 3, the teachings of the present disclosure may be used with neural networks having any suitable topology and / or connectivity. For example, the neural network may be a forward propagation neural network, a recurrent network, or other neural network having any suitable connectivity between neural units. As another example, although the neural network is illustrated as having an input layer, a hidden layer, and an output layer, the neural network may have any suitable layers arranged in any suitable format. In the illustrated embodiment, each link between two neural units has a synaptic weight indicating the strength of the relationship between the two neural units. The synaptic weights are illustrated as WXY, where X indicates a presynaptic neuron and Y indicates a postsynaptic neuron. Links between neural units may be excitatory or inhibitory in terms of their effect on the activation state of the connected neuron. For example, a spike propagating from X1 to X5 may increase or decrease the membrane potential of X5 depending on the value of W15. In various embodiments, the connections may be directed or undirected.

[0073] In various embodiments, during each time step of the neural network, a neuronal unit may receive any suitable input, such as a bias value or one or more input spikes from one or more of the neuronal units connected to it via their respective synapses (this set of neurons is referred to as the neuronal unit's fan-in neurons). The bias value applied to the neuronal unit may be a function of the primary inputs applied to the input neuronal units, and / or some other value applied to the neuronal unit (e.g., a constant value that may be adjusted during training or other operation of the neural network). In various embodiments, each neuronal unit may be associated with its own bias value or bias values ​​that may be applied to multiple neuronal units.

[0074] A neuronal unit may perform a function utilizing the values ​​of its inputs and its current membrane potential. For example, the inputs may be added to the neuronal unit's current membrane potential to generate an updated membrane potential. As another example, a non-linear function such as a sigmoid transfer function may be applied to the inputs and the current membrane potential. Any other suitable function may be used. The neuronal unit thereby updates its membrane potential based on the output of the function.

[0075] Turning to FIG. 4, a schematic block diagram 400 is shown illustrating example levels of autonomous driving that various vehicles may support (e.g., by their corresponding in-vehicle computing systems). For example, a range of levels (e.g., L0-L5 (405-435)) may be defined, with Level 5 (L5) corresponding to a vehicle having the highest level of autonomous driving functionality (e.g., fully automated) and Level 0 (L0) corresponding to the lowest level of autonomous driving functionality (e.g., non-automated). For example, an L5 vehicle (e.g., 435) may possess a fully autonomous computing system that can provide autonomous driving performance in all driving scenarios, including in harsh road conditions and weather, at or above the capabilities that would be provided by a human driver. An L4 vehicle (e.g., 430) may also be considered fully autonomous and may be able to autonomously perform safety-critical driving functions and efficiently monitor roadway conditions throughout the entire journey from the starting location to the destination. L4 vehicles may differ from L5 vehicles in that the L4 autonomous capabilities are defined within the limits of the vehicle's "driving design space," which may not include all driving scenarios. L3 vehicles (e.g., 420) provide autonomous driving functionality that shifts safety-critical functions entirely to the vehicle in a specific set of traffic and environmental conditions, but still anticipates the involvement and availability of a human driver to handle driving in all other scenarios. Thus, L3 vehicles may provide handover protocols that orchestrate the transfer of control from the human driver to the autonomous driving stack and vice versa. L2 vehicles (e.g., 415) provide driver assistance functionality that allows the driver to occasionally step away from physical operation of the vehicle, so that both the driver's hands and feet may periodically step away from physical control of the vehicle. L1 vehicles (e.g., 410) provide driver assistance for one or more specific functions (e.g., steering, braking, etc.), but still require the driver to control most functions of the vehicle at all times.L0 vehicles may be considered non-autonomous, with a human driver controlling all of the vehicle's driving functionality (although such vehicles may still passively participate in an autonomous driving environment by providing sensor data to a higher-level vehicle, using sensor data to enhance in-vehicle GPS and entertainment information services, etc.). In some implementations, a single vehicle may accommodate operation at multiple autonomous driving levels. For example, the driver may control and select which level of autonomous assistance (e.g., L4 or lower) is used during a given trip. In other cases, the vehicle may autonomously switch between levels based, for example, on conditions affecting the roadway or the vehicle's autonomous driving system. For example, among other examples, in response to detecting that one or more sensors are faulty, an L5 or L4 vehicle may shift to a lower mode (e.g., L2 or lower) to engage a human occupant regarding the sensor issue.

[0076] FIG. 5 is a schematic block diagram 500 illustrating an example autonomous driving flow that may be implemented in some autonomous driving systems. For example, an autonomous driving flow implemented in an autonomous (or semi-autonomous) vehicle may include a sensing and perception stage 505, a planning and decision stage 510, and a control and action phase 515. During the sensing and perception stage 505, data is generated by various sensors and collected for use by the autonomous driving system. Data collection may include data filtering and receiving sensors from external sources in some examples. This stage may also include sensor fusion operations and object recognition, as well as other perception tasks such as localization, performed using one or more machine learning models. The planning and decision stage 510 may utilize the sensor data and the results of various perception operations to make probabilistic predictions of the roadway ahead and determine a real-time route plan based on these predictions. The planning and decision stage 510 may further include making decisions regarding the route plan in response to detection of obstacles and other events to determine whether to travel the determined route taking these events into account and what actions to take to travel safely. Based on the path planning and decisions of the planning and decision stage 510, the control and action stage 515 may translate these decisions into actions to operate, through actuators, the driving controls including steering, acceleration, and braking, as well as auxiliary controls such as turn signals, sensor cleaners, wipers, headlights, etc.

[0077] All functionality required for a vehicle to function autonomously may be provided natively through an in-vehicle computing system (and updated, if necessary, by periodic communications through a wired or wireless home or garage network connection), but as wireless communication technologies and speeds advance, some autonomous vehicle implementations may rely more on communications from off-vehicle data and computational resources (e.g., external to the vehicle or not natively integrated into the vehicle). For example, with the advent of 5G carrier networks and the expansion of 4G LTE coverage, the implementation of connected autonomous vehicles and vehicle-to-everything (V2X) systems becomes more immediately achievable. For example, given the emphasis on safety, the safety provided natively through the vehicle's autonomous driving system may be supplemented, augmented, or enhanced using systems external to the vehicle to both provide enhanced crowd-sourced intelligence as well as provide redundancy through real-time high-reliability applications, etc.

[0078] An autonomous vehicle may communicate with and be directed by an external computing system. Such control may include low-level control, such as transferring over-the-air (OTA) updates, and the vehicle may receive software and / or firmware updates from a remote control / maintenance management center (e.g., belonging to an original equipment manufacturer (OEM) or provider of the vehicle or autonomous driving system) (as opposed to, e.g., taking the vehicle to a maintenance center for a technician to do it manually). In other higher level control applications, complete control of the autonomous vehicle may be handed over to an external computing system or a remote user / virtual driver at a remote computing terminal. For example, such remote control may be presented as an on-demand “remote valet” service, e.g., to assist a vehicle that is struggling with the autonomous driving system to navigate a particular portion of a route accurately, efficiently, or safely, or to assist an autonomous vehicle that is immobilized during an evacuation event or another condition, e.g., when handover of control from the autonomous vehicle to an occupant in the vehicle is not feasible or desirable.

[0079] In some implementations, when an autonomous vehicle encounters a situation or event that the autonomous vehicle does not know how to reliably and safely handle, the vehicle may be programmed to initiate an evacuation event in which the autonomous driving system directs the vehicle to leave the roadway (e.g., to the shoulder, a parking space, etc.). In the future, as autonomous vehicles are seen in greater numbers on roadways, an event that causes one autonomous vehicle to initiate an evacuation may similarly affect other nearby autonomous vehicles, leading to the potential for multiple evacuations to cause further congestion and roadway stalls, potentially paralyzing roadways and autonomous driving on those roadways. While some examples may acknowledge a handover event from the autonomous driving system to a human occupant to navigate the situation that triggers the evacuation, in other implementations, a remote valet service may be triggered (e.g., when the vehicle does not have an occupant (e.g., drone vehicles, vehicles in the process of using a remote summons mechanism for an occupant, etc.)), among other example situations and implementations.

[0080] In accordance with the above, some implementations of autonomous vehicles may support a remote valet mode that allows driving of the vehicle to be handed off (from the vehicle's autonomous driving system) and controlled by a remote computing system over a network. For example, remote control of an autonomous vehicle may be triggered on-demand by the autonomous vehicle when it faces a situation it cannot handle (e.g., a sensor is not functioning, a new road condition unknown to the vehicle, the in-vehicle system is unable to make a decision, etc.). Such remote control may also be provided to vehicles in emergency situations where the vehicle requests remote control. A remote valet service may involve a human remotely located at a control and maintenance management center with a user endpoint system operated to remotely control the vehicle. Such a system may be used to mitigate edge cases where an autonomous vehicle may retreat or remain immobile due to lack of usable information of itself or its environment to perform a maneuver. The remote valet system may also be equipped with functionality to receive information from the autonomous system (e.g., provide visibility of the roadway the vehicle is traveling on, provide information regarding the vehicle's system status, vehicle occupant status, etc.), but may still function independently of the vehicle's autonomous driving system. Such independence may enable the remote valet service itself to function even under conditions of complete or substantial sensor failure in the autonomous vehicle, among other example use cases, benefits, and implementations.

[0081] For example, as shown in schematic block diagram 600 of FIG. 6, autonomous vehicle 105 may include various sensors (e.g., 620, 625, 630, etc.) and autonomous driving logic that enables the autonomous vehicle to navigate autonomously in various environments. As described above, in some examples, it may be determined by the autonomous vehicle (or upon request by an occupant within the autonomous vehicle) that the autonomous driving system of vehicle 105 is not capable of reliably, desirably, or safely navigating a portion of the route planned. Autonomous vehicle 105 may include communications capabilities to interface with one or more networks (e.g., 155) and enable data to be exchanged between vehicle 105 and one or more computing systems implementing remote valet service 605. The remote valet service 605 may provide multiple user terminal devices that may enable a virtual driver user to observe the conditions around the vehicle 105 based on sensor data (e.g., camera views or other sensor information) provided from sensors (e.g., 175) on the vehicle (e.g., 620, 625, 630, etc.) or from other devices (e.g., roadside systems (e.g., 130), airborne or ground drones (e.g., 180), and even sensors from other nearby vehicles). The virtual driver may then provide inputs at the remote valet terminal to communicate corresponding low latency, high priority data (over network 155) to the vehicle 105 to control the steering, acceleration, and braking of the vehicle 105.

[0082] In some examples, the vehicle 105 may automatically request intervention and handover of control to the remote valet service 605. In some cases, this request may be reactive (e.g., in response to an evacuation event, sensor failure, or emergency situation), while in other cases, the request may be sent to have the remote valet service 605 preemptively take over control of the vehicle (based on a prediction that an evacuation event or other difficulty is likely to occur given the conditions on the route ahead). Leveraging sensor data from its own sensors (e.g., 620, 625, 630, etc.), as well as data from other sensors and devices (e.g., 130, 180, etc.), as well as back-end autonomous driving assistance services (e.g., cloud-based services 150), the vehicle 105 may use one or more machine learning models to determine that conditions are right to hand over control to the remote valet service 605.

[0083] In some cases, there may be multiple remote valet services that may be utilized by any one of multiple different autonomous vehicles. Indeed, multiple autonomous vehicles may simultaneously connect to and be controlled by a single remote valet service (e.g., with separate remote drivers guiding each vehicle). In some cases, one remote valet service may advertise higher availability than another. In some cases, a ranking of remote valet service quality may be maintained. In still other cases, connection quality and speed information may be maintained to identify real-time connectivity conditions for each of multiple different remote valet services. Thus, in addition to detecting that a remote handover is necessary or expected, the autonomous vehicle (e.g., 105) may also take such inputs into account to determine which of many possible available alternative remote valet services may be used and requested. In some implementations, the selection is straightforward, such as the instance where the vehicle is associated with a particular one of the remote valet services (e.g., by an active subscription to a remote valet service from a particular provider, the remote valet service being associated with the manufacturer of the automobile or its autonomous driving system, among other considerations).

[0084] In addition, the remote valet service may also tailor services to individual autonomous vehicles (e.g., 105) and their owners and occupants based on various attributes detected by the remote valet service (e.g., from information included in the request for handover, information gleaned from sensor data received in connection with the handover or remote control, etc.) For example, tailored driving assistance user interfaces and controls may be provided and presented to the virtual driver of the remote valet service based on the make and model of the vehicle being controlled, the version and implementation of the vehicle's autonomous driving system, which sensors of the vehicle remain operational and reliable, the particular conditions that trigger the handoff (e.g., an expert remote driver is requested to assist in troubleshooting and guiding the vehicle out of a difficult corner case), among other example considerations.

[0085] In some implementations, the remote valet service may be provided through a government agency as a public service. In other implementations, the remote valet service may be provided as a commercial enterprise in the private sector. Thus, in association with the remote valet service provided in association with a given vehicle (e.g., 105) trip, metrics may be automatically collected and corresponding data may be generated (e.g., by sensors or monitors in either or both of the vehicle (e.g., 105) and the remote valet system 605) that describes the remote valet service provided. Such metrics and data may describe characteristics of the remote valet service, such as the severity of the conditions that triggered the remote valet service (e.g., more difficult problems call for higher remote valet service fees), the distance traveled under remote valet service control, the time under remote valet service control, the particular virtual driver and tools used to facilitate the remote valet service, the source and amount of off-vehicle data used by the remote valet service (e.g., the amount of data requested and collected from sources (e.g., 175, 180) outside the sensors (e.g., 620, 625, 630)), which may be considered and used to determine the usage fee that the remote virtual service will charge for its services, among other metrics. In some cases, the usage fee may be paid by or split between the vehicle owner, the vehicle manufacturer, the vehicle warranty provider, the provider of the vehicle's autonomous driving system, etc. In some cases, the responsibility for the remote valet service billing may be determined automatically from data generated in connection with the handover request to determine which party is responsible for how much of the remote valet service usage fee, among other example implementations.

[0086] Data generated in connection with a handover request for a remote valet service, as well as data generated to record the remote valet services provided to the vehicle on a given trip, may be collected and maintained in a system (e.g., 610) of the remote valet service (e.g., 605) or in a cloud-based service (e.g., 150), thereby aggregating and crowdsourcing the results of the remote valet service to improve future remote valet service offerings, as well as the autonomous driving models relied upon by the vehicle to navigate independently and request remote valet services, among other example uses.

[0087] Turning to FIG. 7, a schematic block diagram 700 is shown illustrating communication between systems during delivery of an example remote valet service. For example, a handover request 710 may be sent from the vehicle (105) (e.g., a remote valet support block (e.g., 705) of its autonomous driving system) over a network to a computing system that provides or mediates remote valet services (provided through one or more remote valet service systems (e.g., 605)). In other examples, a trusted third party system (e.g., external to the autonomous vehicle 105) may determine that the vehicle 105 needs assistance (e.g., by aggregation of sensor data from various devices monitoring traffic involving the vehicle). In some cases, an occupant in the vehicle may trigger the remote valet service (e.g., through a smartphone app) using a third party service (e.g., cloud-based service 150), which may send a handover request (e.g., 710′) on behalf of the vehicle 105, among other example implementations. A secure, top-priority communication channel 715 may be established between the vehicle 105 and the remote valet system 605 to enable the remote valet service to be provided. For example, sensor data (e.g., camera data, LIDAR data, etc.) collected by sensors of the vehicle 105 may be sent to provide a near real-time view of the vehicle's location and status and its surrounding environment. In some cases, the data may include data from internal sensors of the vehicle 105, for example, to enable a view for the vehicle's occupants and / or to facilitate live communication between the occupants and a virtual driver of the remote valet, among other example uses. The virtual driver of the remote valet may respond to the received information describing the live conditions of the vehicle 105 and use control of his / her own terminal to generate driving command data that is sent to the vehicle over the channel 715 to remotely control the driving operation of the vehicle 105. The remote valet service may also obtain supplemental data (e.g., in addition to that received from the vehicle 105) from off-vehicle sources such as roadside units, other vehicles, drones, and other sensor devices.Such information may be provided through a top priority channel (e.g., 720) facilitated by one or more backend systems (e.g., 150). In some implementations, the remote valet system 605 may determine, from the location of the vehicle 105, a sensor set (which may change dynamically as the vehicle moves along a route, under the control of the remote valet driver) that the remote valet system may use to establish another secure channel (e.g., 720) and obtain live data describing the scene around the vehicle being controlled by the remote valet system. Thus, in some implementations, the remote valet service may use either or both sensor data from sensors on or off the vehicle 105 being controlled.

[0088] As described above, in some implementations, an autonomous vehicle may detect instances when it should call a remote valet service for assistance. In some cases, this decision may be assisted by one or more back-end services (e.g., 150). In some implementations, the vehicle may provide data to such services 150 (or to other cloud-based systems, repositories, and services) describing the conditions that triggered the handover request (e.g., 710). The vehicle may also provide reports (after or during the service) describing the performance of the remote valet system (e.g., describing the maneuvers or routes taken by the remote valet, describing the occupant satisfaction of the service, etc.). Such report data (e.g., 730) may later be used to train machine learning models or otherwise enhance the services provided by the back-end or cloud-based systems (e.g., 150). Insights and improved models may be derived by the system 150 and then shared with the vehicle's autonomous driving system (as well as its remote valet support logic 705). In some cases, the autonomous vehicle may record information describing the remote valet's operations and reactions and use it to further train and improve models used in its own autonomous driving machine learning models. Similarly, reporting data (e.g., via 720) may be provided from the remote valet system 605 to a cloud-based service or to the vehicle and used to enhance the vehicle's (and other vehicles') autonomous driving logic and handover requests, among other example uses, as described herein.

[0089] As an illustration, an autonomous vehicle (e.g., 105) may autonomously determine (or determine based on occupant feedback, or feedback received or reported by a public safety officer, etc.) while traveling along a route that the vehicle's autonomous driving system cannot handle a particular situation. Thus, a remote valet service may be triggered. In some cases, the remote valet service may proactively contact the next section of road based on a prediction that the next section of road will be problematic. In some implementations, the handoff request may be implemented by a logic block complementary to the autonomous driving system logic that implements the path planning phase of the autonomous driving pipeline (as discussed in the example of FIG. 5). In some examples, when a remote valet handoff request is issued to the remote valet system, a communication module of the autonomous vehicle, such as a telematics control unit (TCU), may be used to connect to the remote valet service. In some implementations, the remote valet service communication may be established as communication with an emergency service (similar to an emergency call) that is specified during the manufacturing phase of the TCU. The location of the vehicle may be provided in the handoff request. In some implementations, the handoff request and the remote valet service may be implemented in an OEM-provided call / control center where a human virtual driver who handles the "remote valet" takes action. In some implementations, in response to establishing a connection between the vehicle and the remote valet service, the remote valet may send a request to the vehicle to stream video from all of its cameras for a surrounding field of view in real time. Other co-located sensors (e.g., roadway cameras and roadside sensors) may also be identified to provide data (e.g., additional streaming video) that supplements the information received from the vehicle. Based on a view of the vehicle's surroundings and road conditions displayed to the remote valet in near real time through video streamed from the vehicle (and possibly from auxiliary sources (e.g., roadway cameras)), the remote valet controls the vehicle (similar to a video immersive game where the player sees a view of the automobile and drives and controls it via a wheel, handheld controller, etc.) to drive the vehicle to its destination.In some cases, the destination may correspond to the next leg of the route that is determined to be less problematic, at which point control may be returned to the autonomous driving system to control driving of the vehicle in standard autonomous driving mode. In other cases, based on the context of the original handoff request and the detected characteristics, the remote valet service may direct the vehicle to a particular destination where a sensor or autonomous driving system has identified that it is equipped to address the issue detected in the vehicle, such as driving a vehicle with a malfunction to the nearest service center or driving a vehicle with an ill or injured occupant to a hospital, among other examples and use cases.

[0090] As mentioned above, in some implementations, the vehicle's autonomous driving system may access data collected by other remote sensor devices (e.g., other autonomous vehicles, drones, roadside units, weather monitors, etc.) to preemptively determine likely conditions on the next section of road. In some cases, various sensors may provide data to a cloud-based system that aggregates and processes this data to provide information to multiple autonomous vehicles related to sections of road and conditions affecting their routes. As mentioned above, in some cases, the cloud-based system and other systems may receive inputs associated with previous evacuation and remote valet handover events and may detect common characteristics of these events. In some implementations, machine learning models may be built or trained from this information, and such machine learning models may be deployed to and executed by roadside units, cloud-based assistance systems, remote valet computing systems, or in-vehicle systems of the autonomous vehicles themselves to provide logic for predictively determining potential remote valet handoffs. For example, through sensor data accessed by a given autonomous vehicle, the vehicle may determine in advance areas along each road where evacuation occurs frequently and / or remote valet handoffs are common. In some examples, the autonomous vehicle may determine (e.g., from a corresponding machine learning model) that conditions reported for an upcoming section of road suggest the possibility of evacuation and / or remote valet handover (even if evacuation and handover have not previously occurred on that particular section of road). Using such information, the autonomous vehicle may preemptively take steps to prepare for a handover to an in-vehicle driver or remote valet service. In some instances, the autonomous vehicle may determine to modify its route plan to avoid a troublesome section of road ahead (e.g., based also on detected unavailability of communication resources capable of accommodating remote valets, reported lack of availability for a preferred valet service, user preferences that require remote valets to be avoided as much as possible, etc.).In some implementations, the autonomous vehicle's display may present warnings or instructions to the in-vehicle occupant regarding upcoming predicted issues and the possibility of evacuation and / or remote valet handover. In some instances, this information may be presented in the form of an interactive display through which the occupant may register their preferences regarding handling of the next trip segment, either by handover to the occupant, handover to a remote valet service, selection of an alternate route, or an evacuation event. In still other implementations, cloud-based knowledge reflecting troublesome segments of roads may be communicated to road signs or in-vehicle road maps to indicate the troublesome segments to the driver and other autonomous vehicles, among other example implementations.

[0091] Turning to FIG. 8, a schematic block diagram 800 is shown illustrating collaborative reporting of such turn-off event risk and road condition alert information that may be further utilized to launch a remote valet service to assist autonomous vehicles through dangerous and challenging scenarios. For example, information may be collected regarding turn-off requests and / or remote valet events by associated vehicles and / or surrounding sensor devices, and this information may be shared and utilized to enhance the autonomous driving system. In the example of FIG. 8, when a turn-off or hand-off occurs, the associated vehicles (e.g., 105) may assemble the data generated and collected related to the event and share this information with edge devices such as a cloud-based assistance system (e.g., 150) and / or a roadside unit or an edge computer (or edge cloud) server (e.g., 140).

[0092] 9 illustrates a schematic block diagram 900 illustrating an example autonomous vehicle 105 that may include various vehicle sensors (e.g., 620, 625), an artificial intelligence / machine learning based autonomous driving stack 515, and logic (e.g., 905) corresponding to triggering and generating handoff requests to a system that may provide remote valet services. A telematics control unit (TCU) 910 may be provided through which handoff requests may be sent and communications may be established between the vehicle 105 and a virtual driver terminal to provide remote valet services.

[0093] Once the autonomous driving engine (e.g., 515) determines an evacuation event or the remote valet support logic (e.g., 905) determines that a handoff request should be sent, a signal may be sent to the TCU 910 to send the vehicle's location and evacuation location to various cloud-based entities (or a single entity or gateway that distributes this information to multiple entities or services). Indeed, many different services may utilize such information. For example, the cloud-based application 815 (e.g., associated with the vehicle OEM) may in one example be the primary target or recipient of this information and may distribute portions of this information to other recipients. In other examples, the vehicle 105 may provide and distribute the data itself to multiple different cloud-based applications (e.g., one application per recipient). For example, an OEM maintenance management application (e.g., 820) may utilize the evacuation or handoff information and utilize it in diagnosing and identifying cases of turns where the vehicle (and its model) cannot handle autonomous driving. In some examples, recipients of evacuation or handoff information may include map application providers (e.g., 825, 826), including providers of traditional navigation maps, 3D maps, high definition (HD) maps, etc., which may receive this information directly from the vehicle through a dedicated cloud app or through an OEM that receives the information directly from the vehicle. Map providers may leverage the evacuation and handoff information into statistics that may help populate the map with information about areas prone to evacuation events and difficult autonomous driving conditions, allowing this information to be updated on an ongoing basis. Additionally, HD maps may incorporate such information as part of the high definition information per road segment that the HD maps provide, among other examples.Local governments, government agencies, toll road providers, and other infrastructure companies and operators (e.g., 830) may also be recipients of evacuation and handoff information (e.g., by acquiring such information directly from the vehicle 105, indirectly through another application or entity, or through associated roadside sensors and roadside assistance units, among other examples). Such agencies may use this information to trigger road maintenance management, as evidence of new road and infrastructure planning, policing, triggering the deployment of toll booths, signs or warnings, and other uses.

[0094] An evacuation or handoff event may also trigger the vehicle 105 to share information with nearby roadside units, vehicles, and other sensor devices. An example roadside unit (e.g., 140) may leverage this information, for example, to process this data along with other data it receives and share this information or the results of this analysis with other vehicles (e.g., 110) or systems in the vicinity (e.g., through the road segment application 835). For example, the roadside unit may alert other vehicles to the risk of an evacuation event and prepare infrastructure to assist in communicating with remote valet services, among other example actions. The roadside unit may also store or communicate this information so that relevant local governments, maintenance providers, and agencies may access and use this information (e.g., to dynamically adapt traffic light timing, update digital signs, open additional lanes, etc.).

[0095] As described above, various cloud and edge-based computing systems may utilize evacuation and handoff information collected from various vehicles over time to improve models, which may be shared and used to improve recommendation systems (e.g., to recommend evacuation or remote valet handoff), enable predictive or preemptive remote valet handoff, improve autonomous driving models, and improve remote valet services, among other example uses and benefits.

[0096] Various embodiments may use mathematical models that ensure safety when all road agents comply with the model, or that properly allocate responsibility in case of an accident. For example, a safety model may rely on mathematically calculated minimum longitudinal and lateral safe distances between two road agents to avoid collisions in modeled worst-case scenarios by restricting the behavior of the agents to a prescribed set of constraints.

[0097] Whenever a situation arises where the distance between two agents falls below the safe distance prescribed by the safety model (e.g., a "danger situation"), the safety model may mathematically guarantee the prevention of a collision if both agents respond by enacting an acceleration within the previously prescribed limits (e.g., enacting an "appropriate response"). On the other hand, if one of the agents does not comply, that agent should be held responsible in case of an accident.

[0098] The safety model simplifies the analysis of situations involving two agents by focusing separately on the longitudinal and lateral dimensions: for example, the speed and acceleration of the agents, the minimum safe distance calculated using their speed and acceleration, and the actual distance between the agents are all analyzed with respect to their longitudinal and lateral components in a coordinate system in which the center of the lane is considered to be on the y-axis (hence the longitudinal component is represented by y and the lateral component by x).

[0099] FIG. 10 illustrates various driving phases according to certain embodiments. In FIG. 10, agents 1002 and 1004 are shown in three phases 1006, 1008, and 1010. To comply with the safety model, the agents are required to enact appropriate responses when both the longitudinal and lateral minimum safe distances are violated, with the appropriate response itself depending on which violation occurred most recently. In the first phase 1006, agents 1002 and 1004 are separated by an unsafe lateral distance, but a safe longitudinal distance. The second phase 1008 illustrates the last time when the longitudinal distance was still safe (called the "blame time"). At the next time after the blame time, the longitudinal safe distance is also violated. In the third phase 1010, after the longitudinal appropriate response has been enacted, the agents are back in a safe situation and a collision has been avoided.

[0100] The safety model may be designed completely separate from the agent's policies. To comply with the safety model, the autonomous driving stack may include additional components that check compliance of decisions made by the agent's policies and enforce decisions that comply with the default safety model when the agent's policies call for non-compliant actions.

[0101] Although the safety model may be designed with autonomous vehicles in mind, various embodiments of the present disclosure include vehicles with control systems that use any suitable accident avoidance mathematical model as a mechanism to avoid accidents at the discretion of a human driver. Such embodiments may potentially result in higher overall safety for the human driver, and may also provide evidence or assurance that the driver will not be held responsible for the accident if current law assigns responsibility in a manner comparable to the safety model's responsibility assignment mechanism (e.g., responsibility is assigned to the agent that violated the model's terms). In accordance with the safety model, various embodiments described herein offer other possible longer-term benefits, such as, for example, that as more agents (human or otherwise) are equipped with safety model enforcers (or similar model enforcers), the overall amount of traffic accidents will decrease, evolving into an ideal situation for all agents.

[0102] In certain embodiments of the present disclosure, the vehicle includes a control system that replaces driver inputs that would result in non-safety model-compliant acceleration with synthetically generated inputs guaranteed to produce accelerations that fall within the range of safety model-compliant accelerations. The safety model-compliant driver inputs are passed unchanged to the actuation system, thereby implementing a system that takes over only in potentially dangerous situations.

[0103] FIG. 11 illustrates a diagram of a system 1100 for modifying driver inputs to ensure acceleration conforming to a safety model, according to certain embodiments. In various embodiments, the system 1100 may be part of a vehicle, e.g., 105, and any of the illustrated modules may be implemented by any suitable logic of a computing system of the vehicle, e.g., 105. In other embodiments, any of the modules may be implemented external to the vehicle (e.g., by 140 or 150), and the results may be communicated to the vehicle. The system 1100 includes a control 1102 (in various embodiments, the control 1102 may have any suitable characteristic of a driving control 220), a sensor suite 1104 (in various embodiments, the sensor suite 1104 may have any suitable characteristic of a sensor 225), a safety model 1106, a safety model enforcer 1108, a control-to-acceleration converter 1110, and an acceleration-to-control converter 1112. In certain embodiments, the components of the system 1100 may all be integrated within the vehicle. In other embodiments, one or more components may be separate from the vehicle and communicatively coupled to the vehicle.

[0104] Controls 1102 may be provided to enable a human driver to provide input to the vehicle's operating systems. For example, the controls may include a steering wheel or other steering mechanism, an accelerator pedal or other throttle, and a brake pedal or other braking mechanism. In one embodiment, the controls may include other components, such as a gear shifter, an emergency brake, a joystick, a touch screen, a gesture recognition system, or other suitable input control that may affect the speed or direction of the vehicle.

[0105] The sensor suite 1104 may include any suitable combination of one or more sensors utilized by the vehicle to gather information regarding world conditions associated with the vehicle. For example, the sensor suite 1104 may include one or more LIDAR, radar, cameras, global positioning systems (GPS), inertial measurement units (IMUs), audio sensors, infrared sensors, or other sensors described herein. The world state information may include any suitable information, such as any of the contexts described herein, objects detected by the sensors, location information associated with the objects, or other suitable information.

[0106] The world state may be provided to any suitable component of the system 1100, such as the safety model 1106, the control-to-acceleration converter 1110, or the acceleration-to-control converter 1112. For example, the world state information may be provided to the safety model 1106. The safety model 1106 may utilize the world state information to determine a range of safety-model-compliant acceleration for the vehicle. In doing so, the safety model 1106 may track the longitudinal and latitudinal distances of the vehicle to other vehicles or other objects. In addition, the safety model 1106 may also track the longitudinal and latitudinal speeds of the vehicle. The safety model 1106 may periodically update the range of safety-model-compliant acceleration and provide the acceleration range to the safety model enforcer 1108. The safety model-compliant acceleration may specify a range of safety model-compliant acceleration in the longitudinal direction as well as a range of safety model-compliant acceleration in the latitudinal direction. The acceleration may be expressed in any suitable units, such as meters per second per second, and may have positive or negative values ​​(or may be zero-valued).

[0107] The safety model enforcer 1108 receives control signals from the driver input and invokes the control-to-acceleration converter 1110, thereby converting the driver input to an acceleration value indicative of a predicted vehicle acceleration (including both latitudinal and longitudinal acceleration components, in some embodiments) if the driver input is passed to the actuation system 1114. The safety model enforcer 1108 may determine whether the acceleration value is within a recent range of safety model-compliant accelerations received from the safety model 1106. If the acceleration value is within the range of safety model-compliant accelerations, the safety model enforcer allows the driver input to be passed from the control 1102 to the actuation system 1114. If the acceleration value is not within the range of safety model-compliant accelerations, the safety model enforcer blocks the driver input and selects a safety model-compliant acceleration value within the received range. The safety model enforcer 1108 may then invoke the acceleration-to-control converter 1112 with the selected acceleration value and may receive one or more control signals in return. In certain embodiments, the control signals provided by the acceleration-to-control converter 1112 may have the same format as the control signals provided to the actuation system 1114 in response to the driver input. For example, the control signals may specify the amount of braking, the amount of acceleration, and / or the amount and direction of steering, or other suitable control signals. The safety model enforcer 1108 may provide these new control signals to the actuation system 1114, which may use the control signals to accelerate the vehicle as specified.

[0108] In various embodiments, the safety model enforcer 1108 may choose any suitable acceleration value within the range of acceleration that conforms to the safety model. In certain embodiments, the safety model enforcer 1108 may choose an acceleration value randomly from the range. In another embodiment, the safety model enforcer 1108 may choose a maximum or minimum conservative value from the range. In another embodiment, the safety model enforcer 1108 may choose a value from the middle of the range. In yet another embodiment, the safety model enforcer 1108 may use policy information (e.g., based on driver preferences or based on safety considerations) to determine the acceleration value. For example, the safety model enforcer 1108 may prefer longitudinal acceleration over latitudinal acceleration, or vice versa. As another example, the safety model enforcer 1108 may prefer an acceleration that is more comfortable for the driver (e.g., slower braking or smaller steering adjustments may be preferred over hard braking or tailgating). In various embodiments, the decision may be based on both safety and comfort, with the relevant metrics calculated from the same set of motion parameters and vehicle characteristics.

[0109] As described above, the control-to-acceleration converter 1110 converts driver inputs (e.g., steering wheel rotation and throttle / brake pedal pressure) to acceleration. In various embodiments, the converter 1110 may take into account any suitable information during the conversion, such as world conditions (e.g., vehicle speed, weather, road conditions, road layout, etc.) and physical properties of the host vehicle (e.g., vehicle weight, vehicle shape, tire properties, brake properties, etc.). In one embodiment, the conversion may be based on an advanced mathematical model of the vehicle dynamics (e.g., as provided by the vehicle manufacturer). In some embodiments, the converter 1110 may implement a machine learning model (e.g., implementing any suitable regression model) to perform the conversion. An example machine learning model for control-to-acceleration conversion is described in further detail in connection with FIG. 12 and FIG. 13.

[0110] The acceleration-to-control converter 1112 may include logic to convert the acceleration conforming to the safety model enforced by the safety model enforcer 1108 during takeover into an input suitable for the actuation system 1114. The converter 1112 may utilize any suitable information to perform this conversion. For example, the converter 1112 may utilize one or more of the information used by the control-to-acceleration converter 1110. Similarly, the converter 1112 may use a method similar to the converter 1110, such as a machine learning model adapted to output a control signal given an input of acceleration. In certain embodiments, the acceleration-to-control converter may comprise a proportional-integral-derivative (PID) controller that determines a desired control signal based on the acceleration value. The PID controller may be implemented using a traditional controller algorithm with proportional, integral, and derivative coefficients or may be machine learning based, where these coefficients are predicted using an ML algorithm (e.g., implemented by the machine learning engine 232) that utilizes optimization metrics that take into account safety and comfort.

[0111] 1114 may represent any suitable actuation system that receives one or more control signals and causes the vehicle to respond to the one or more control signals. For example, the actuation system may adjust the amount of gasoline or electricity (or other power source) provided to an engine or motor of the vehicle, the amount of braking pressure applied to the wheels of the vehicle, the amount of angle applied to one or more wheels of the vehicle, or make any other suitable adjustment that may affect the acceleration of the vehicle.

[0112] FIG. 12 illustrates a training phase of the control-to-acceleration converter 1110, according to certain embodiments. Training inputs 1202 for the model may include any suitable information that may affect the acceleration enacted in response to the control signal. For example, the training inputs may include any combination of the vehicle's initial speed, road conditions, tire conditions, weather conditions, wheel rotation, accelerator pedal pressure levels, brake pedal pressure levels, road layout, vehicle physical properties, or other suitable information, and the resulting acceleration under each set of such information. Such data may be used to train a regression model 1206, which may be used by the vehicle to convert the control signal and other information (e.g., world state information, vehicle physical properties) into acceleration values ​​during the machine learning training phase 1204. In various embodiments, the regression model 1206 is trained on ground truth data collected using one or more vehicles of a class of vehicles under many different weather, road, and vehicle state conditions. In various embodiments, the training may be performed by any suitable computing system (whether an in-vehicle computing system, a cloud-based system, or other data processing environment).

[0113] 13 illustrates the inference phase of the control-to-acceleration converter 1110, according to certain embodiments. During the inference phase, various inputs 1302 associated with the vehicle are provided to the regression model 1206, which outputs a predicted acceleration based on the inputs. The inputs may reflect the types of inputs used to train the model 1206, but may also include real-time values ​​of such inputs. The regression model 1206 outputs an acceleration value 1304.

[0114] A similar regression model may be used for the acceleration-to-control converter 1112. Similar input data may be used to train the model, but during inference, the model may receive the desired acceleration as input (along with real-time values ​​of world and / or vehicle states) and may output predicted control signals to result in the desired acceleration.

[0115] FIG. 14 illustrates a flow for providing acceptable control signals to a vehicle actuation system according to certain embodiments. At 1402, a first set of one or more control signals is generated in response to a human input to the vehicle. At 1404, a determination is made as to whether the first set of control signals results in acceptable acceleration of the vehicle. If the control signals result in acceptable acceleration, at 1406, the control signals are provided unchanged to the vehicle actuation system. If the control signals result in unacceptable acceleration, at 1408, an acceptable acceleration is identified. At 1410, the acceptable acceleration is converted to a second set of one or more control signals. At 1412, the second set of one or more control signals is provided to the vehicle actuation system instead of the first set of one or more control signals.

[0116] The safe handover of driving responsibility from an autonomous vehicle to a human or vice versa is a critical task. As mentioned above, one approach for handover from a human to an autonomous vehicle may be based on a safety model, or the like, where the autonomous vehicle may interfere with unacceptable human inputs and replace them with safer inputs.

[0117] In various embodiments of the present disclosure, the handoff readiness may be based on an indication of overall signal quality of the vehicle's sensors relative to the context in which such measurements are made. The context may be any suitable context described herein, such as traffic conditions (e.g., highway or busy street) or weather conditions (e.g., sunny, rainy, with puddles, with thin ice, etc.). The signal quality metric may be determined using a machine learning (ML) algorithm that receives sensor data and context information as inputs and outputs a signal quality metric. This signal quality metric is then used to determine the handoff readiness using another ML algorithm trained using vehicle crash incident information. If the signal quality metric indicates poor signal quality relative to the context, a handoff from a human driver to an autonomous vehicle may not be allowed, as such a handoff may not be safe.

[0118] FIG. 15 illustrates a training phase for building a context model 1508, according to certain embodiments. In various embodiments, the context model 1508 may be a classification model built using the sensor data 1504 and the context information ground truth 1506. The ML algorithm 1502 may represent any suitable algorithm for training the context model 1508 based on the sensor data 1504 and the context information ground truth 1506. The sensor data 1504 may include any suitable sensor data from one or more sensors of the vehicle, such as one or more LIDAR, radar, cameras, global positioning systems (GPS), inertial measurement units (IMUs), audio sensors, infrared sensors, or other sensors. The ML algorithm 1502 may train the context model 1508 using various instances of the sensor data 1504 and the context information ground truth 1506, each of which may include a set of sensor data as well as an associated context. In various embodiments, the training data may include actual sensor data and associated context, simulated data and associated context, and / or synthetic data and associated context (e.g., from synthetic images generated using the methods described herein). In particular embodiments, the context may include one or more text keywords that describe the context, such as "fog" and "wet road," although any suitable representation of the context is contemplated by this disclosure.

[0119] FIG. 16 illustrates a training phase of building a signal quality metric model 1608 according to certain embodiments. In various embodiments, the signal quality metric model 1608 may be a regression model built using sensor data and contextual information ground truth. In various embodiments, the sensor data 1604 may be the same sensor data as the sensor data 1504 or may be at least partially different. In some embodiments, the contextual information ground truth 1606 may be the same contextual information as the contextual information ground truth 1506 or may be at least partially different. The ML algorithm 1602 may train the signal quality metric model 1608 using various instances of the sensor data 1604 and the contextual information ground truth 1606, each of which may include a set of sensor data and associated context. In various embodiments, the training data may include actual sensor data and associated context, simulated data and associated context, and / or synthetic data and associated context. By analyzing multiple different instances of sensor data associated with a particular context, the ML algorithm 1602 may be able to train a signal quality metric model 1608 to distinguish between the quality of various instances of sensor data 1604 for a particular context. Similar training may be performed for any suitable number of different contexts.

[0120] After the signal quality metric model is trained, it may be able to receive instances of sensor data (where an instance of sensor data comprises sensor data collected over a period of time) and associated context and output one or more indications of sensor data quality. For example, the signal quality metric may include a composite score for the quality of the instance of sensor data. In another example, the signal quality metric may include scores for the quality of each of multiple types of sensor data. For example, the signal quality metric may include a score for the camera data and a score for the LIDAR data. In some embodiments, the score may be any of multiple types of quality metrics, such as a signal-to-noise ratio measurement, a resolution measurement, or other suitable type of quality metric. In some embodiments, the signal quality metric may include scores for multiple types of quality metrics, or may include a single score based on multiple types of quality metrics. In some embodiments, the signal quality metric score may be a normalized value (e.g., between 0 and 1).

[0121] 17 illustrates a training phase for building a handoff readiness model 1708, according to certain embodiments. In various embodiments, the handoff readiness model 1708 may be a classification model built using signal quality metric information 1704 and crash incident information ground truth 1706.

[0122] The ML algorithm 1702 may represent any suitable algorithm for training the handoff readiness model 1708 based on the signal quality metrics 1704 and the crash information ground truth 1706. The ML algorithm 1702 may train the context model 1508 using various instances of the signal quality metrics 1704 and the crash information ground truth 1706. The instances used for training may include a set of signal quality metrics as well as crash information. The set of crash information may include any suitable safety outcome associated with a particular instance of the signal quality metrics. For example, an instance of the crash information may indicate whether an accident occurred when the autonomous vehicle was operated under the signal quality metric. As another example, an instance of the crash information may indicate whether an accident was likely to occur when the autonomous vehicle was operated under the signal quality metric. As another example, an instance of the crash information may indicate whether an accident occurred or was likely to occur when the autonomous vehicle was operated under the signal quality metric (e.g., a likely accident may be treated the same as an actual accident) In various embodiments, the training data may include actual data signal quality metrics and crash incident information, simulated data signal quality metrics and crash incident information, synthetic data signal quality metrics and crash incident information, or combinations thereof.

[0123] 18 illustrates an inference phase that determines a handoff decision 1808 based on sensor data 1802, according to certain embodiments. In the inference phase, which may be implemented, for example, at driving time by an in-vehicle computing system, sensor data 1802 is collected and provided to a trained context model 1508. The context model analyzes the sensor data 1504 and determines a context 1804 from the sensor data 1802. The determined context 1804 is provided along with the sensor data 1802 to a signal quality metric model 1608. The signal quality metric model 1608 analyzes the sensor data 1802 and the context 1804 and determines a signal quality metric 1806 based on the quality of the sensor data 1802 in light of the context 1804. The signal quality metric 1806 is provided to a handoff readiness model 1708, based thereon, on which a handoff decision 1808 is determined. In certain embodiments, the handoff decision 1808 is a binary indication of whether or not a handoff is safe. In other embodiments, this may be a multi-class decision with more than two possible outcomes. For example, the handoff decision may indicate any number of outcomes, each representing a different range of safety for the handoff. In various embodiments, the vehicle may use the outcome of the handoff decision 1808 to determine whether to handoff or not, or whether to perform a partial handoff, such as handing off some controls and not others (e.g., handing off only the steering and not the braking, or vice versa).

[0124] In various embodiments, the inference phase may be performed periodically or in response to a trigger (or both). For example, while the autonomous vehicle is handling driving controls, the inference phase may be performed periodically to determine whether the autonomous vehicle can still reliably handle driving controls. As another example, the inference phase may be triggered when a request to transfer control to the vehicle is received from a human driver. As yet another example, the inference phase may be triggered by a change in context or a significant change in the quality of the sensor data.

[0125] In certain embodiments, the preemptive planning of the handoff is based on a known level of static data, such as the availability of high definition maps of the roads the vehicle will travel on. This type of data may be unavailable in a particular area where the vehicle must travel, for example, because HD map data for that area has not yet been collected. In such cases, the system may preemptively plan the handoff (e.g., before the start of the journey) and use any of the handoff techniques described herein to prepare the driver for a safe handoff in advance. In certain examples, the inference phase that determines the handoff decision is triggered when (or just before) the vehicle enters an area that does not have HD map data. In some embodiments, the availability of HD map data may be used as an input to a signal quality metric model 1608 that affects the signal quality metric positively if HD map data is available, or negatively if it is not available. In some embodiments, the HD map is essentially treated as an additional sensor input.

[0126] In various embodiments, the ML algorithms or models described with reference to Figures 15-18 may be trained or implemented by any suitable computing system, such as an in-vehicle computing system, an assistance system implemented using cloud and / or fog-based computing resources, or another data processing environment.

[0127] 19 illustrates a flow diagram for determining whether to hand off control of a vehicle, according to certain embodiments. At 1902, a vehicle computing system determines a signal quality metric based on the sensor data and a context of the sensor data. At 1904, a likelihood of safety associated with handing off control of the vehicle is determined based on the signal quality metric. At 1906, the handoff is prevented or initiated based on the likelihood of safety.

[0128] Autonomous vehicles are expected to offer possible advantages over human drivers in that they have better and more consistent responses to driving events due to being immune to factors that adversely affect humans, such as fatigue, fluctuating alertness levels, mood swings, or other factors. However, autonomous vehicles may experience equipment failures or may experience situations in which the autonomous vehicle is not prepared to operate properly (e.g., the autonomous vehicle may enter an area with new features that the vehicle algorithms have not been trained on), necessitating a handoff of the vehicle to a human driver or evacuation of the vehicle.

[0129] In various embodiments of the present disclosure, before handing off the vehicle to a human driver, the driver's state (e.g., fatigue level, alertness level, emotional state, or other state) is analyzed to improve the safety of the handoff process. Suddenly handing off control to an unprepared person can be more dangerous than not handing off at all, as shown by the number of recently reported accidents with modern test vehicles.

[0130] Typically, autonomous vehicles have outward-facing sensors because their perception systems are focused on mapping the environment and their localization systems are focused on locating the vehicle based on data from these sensors and map data. Various embodiments of the present disclosure provide one or more in-vehicle cameras or other sensors that track driver states.

[0131] 20 illustrates a training phase of a driver state model 2008, according to certain embodiments. In the training phase, sensor data 2004 and driver state ground truth data 2006 are provided to an ML algorithm 2002, which trains a driver state model 2008 based on this data. In various embodiments, the driver state model 2008 may be a classification model that outputs classes describing the driver's state. In other embodiments, the driver state model 2008 may be a regression model that outputs a score for the driver's state (with a higher score indicating a more desirable state).

[0132] In various embodiments, the sensor data 2004 may represent any suitable sensor data and / or information derived from the sensor data. For example, the sensor data 2004 may include or be based on image data collected from one or more cameras that capture images of the vehicle's interior. In some embodiments, the one or more cameras, or a computing system coupled to the cameras, may implement AI algorithms that detect facial, eyebrow, or eye movements, extract features, and track levels of fatigue and alertness as indicated by the detected features.

[0133] In various embodiments, the sensor data 2004 may include or be based on one or more temperature maps collected from an infrared camera. In some embodiments, the infrared camera or a computing system coupled to the infrared camera may implement AI algorithms that track the driver's emotional state or other physical state based on these temperature maps. By way of example only, an increase in a human driver's body temperature (e.g., as indicated by an increasing number of red areas in the temperature map) may indicate an aroused state. In various embodiments, the sensor data 2004 may include or be based on pressure data collected from tactile or force sensors on the steering wheel, accelerator, or driver's seat. In some embodiments, a computing system coupled to such tactile or force sensors may implement AI algorithms that analyze such pressure data to track the driver's alertness level or other physical state.

[0134] In various embodiments, the sensor data 2004 may include or be based on electrocardiogram (EKG) or inertial measurement unit (IMU) data from a wearable, such as a smartwatch or health tracker band. A computing system coupled to such a wearable, or the wearable itself, may utilize AI algorithms to extract features from the EKG to track the health or other physical condition of the driver, or analyze the IMU data to extract features to track the alertness level or other physical condition of the driver.

[0135] In various embodiments, the sensor data 2004 may include or be based on audio data from an in-vehicle microphone. Such data may be pre-processed using noise cancellation techniques to isolate sounds generated by vehicle occupants. For example, if audio is played by an in-vehicle entertainment and information system, signals from the audio being played may be removed from the audio captured by the in-vehicle microphone before any further processing. Features of the raw audio may be used directly to measure the user's responsiveness level or overall physical state (e.g., slurred speech may indicate intoxication), but may also be used to classify audio events (e.g., laughter, crying, yawning, snoring, vomiting, or other events) that can be used as further features indicative of driver state. The analyzed audio data may also include speech detected from conversations that the occupants are having with each other or with the vehicle's entertainment and information system (e.g., speech may be converted to text by an automatic speech recognition engine or the like). As an example, in addition to communicating with the driver regarding the handoff, the vehicle's conversation system may attempt to obtain the driver's confirmation of the impending handoff. The utterance may be converted to text and then analyzed by an advanced natural language processing pipeline (or the like) to classify the speaker's intent (e.g., positive or negative confirmation), analyze the sentiment of the dialogue (e.g., negative sentiment in the case of verbal material such as foul language), or model the topic being discussed. Such output may then be used as additional features for the driver state tracking algorithm.

[0136] Vehicle state features may also provide insight into the driver's current alertness level. By way of example, such features may include one or more of the media currently playing in the vehicle (e.g., movies, video games, music), the level of light in the cabin, the amount of driver interaction with the dashboard controls, the window opening level, the status of the cabin temperature control system (e.g., air conditioning or heating), the status of a device connected to the vehicle (e.g., a cell phone connected via Bluetooth), or other vehicle state inputs. Such features may be included in the sensor data 2004 as inputs to the ML algorithm 2002 that trains the driver state model 2008.

[0137] In certain embodiments, the activity level may be derived from the sensor data by an activity classification model. For example, the model may detect whether the driver is sleeping (e.g., based on eyes closed in the image data, snoring heard in the audio data, and a drop in body temperature), arguing with another occupant in the vehicle cabin (e.g., increasing voice volume, rapid heart rate, insults being exchanged), unwell (e.g., vomiting sounds captured by a microphone and the driver's head lowered as shown in the image data), or any other suitable activity.

[0138] In various embodiments, the raw sensor data may be fed to the training algorithm 2002. Additionally or alternatively, classifications based on the raw sensor data may be fed to the ML algorithm 2002 to train the driver state model 2008. In some embodiments, the activity levels described above may be fed to the training algorithm 2002 (optionally along with lower level features and / or raw sensor data) for more robust driver state tracking results.

[0139] The driver state ground truth 2006 may include known driver states corresponding to instances of the sensor data 2004. If the driver state model 2008 implements a classification algorithm, the driver state ground truth 2006 may include various classes of driver states. If the driver state model 2008 implements a regression algorithm, each instance of the driver state ground truth 2006 may include a numerical score indicative of the driver state.

[0140] In various embodiments, the driver state ground truth 2006 and the sensor data 2004 may be driver specific or may include data aggregated for multiple different drivers.

[0141] FIG. 21 illustrates the training phase of the handoff decision model 2110. The ML training algorithm 2102 uses the driver history data 2104, the driver states 2106, and the handoff decision ground truth 2108 to train the handoff decision model 2110. In an alternative embodiment, the ML algorithm 2102 may simply use the driver states 2106 and the handoff decision ground truth 2108 to train the handoff decision model 2110. The handoff decision ground truth 2108 may include actual previous handoff decisions and their respective outcomes (e.g., whether a crash or other dangerous event occurred). In certain embodiments, all or a subset of the handoff decision ground truth 2108 may be simulated to augment the dataset.

[0142] The driver history data 2104 may include any suitable background information that may inform the driver's level of alertness. For example, the history data 2104 may include driver history data including instances of drunk driving (DUI), past accidents, instances of potentially dangerous behaviors taken by the driver (e.g., swerving into oncoming traffic, braking hard to avoid rear-ending another vehicle, crossing a speed barrier), the driver's health, or other suitable background information. In some embodiments, the autonomous vehicle may have a driver ID slot into which the driver inserts a special ID, and the autonomous vehicle connectivity system pulls the driver's relevant history data. The driver's background information may be obtained in any other suitable manner.

[0143] In the illustrated embodiment, during a training phase, driver historical data 2104 along with driver state information 2106 are fed to an ML algorithm 2102 to build a handoff decision model 2110 that outputs two or more classes. In one embodiment, the handoff decision model 2110 outputs three classes: handoff, no handoff, or short handoff. In another embodiment, the handoff decision model 2110 outputs two classes: handoff or no handoff. In yet another embodiment, one of the classes may be partial handoff. As various examples, a class of "handoff" may indicate that the handoff may be performed at a high level of trust, a class of "no handoff" may indicate a low level of trust, and in situations where continued control by the vehicle is undesirable, the handoff may be subject to a remote monitoring system taking over control of the vehicle until the driver is ready or the vehicle is safely stopped, a class of "short handoff" may represent an intermediate level of trust in the driver, and in some embodiments, control may be handed off to the driver for a time period during which the vehicle is stopped (e.g., the vehicle may be safely stopped by a standby unit, such as a communication system, that may control the vehicle or provide storage for the vehicle). In another embodiment, a "partial handoff" may represent an intermediate level of trust in the driver, and only a portion of the control (e.g., only braking control, or only steering control) may be handed over to the driver. In one embodiment, a "conditional handoff" may represent an intermediate level of trust in the driver, and the handoff may be handed over to the driver and the driver's actions and / or user status may be monitored to ensure that the vehicle is being operated safely. The above only represent examples of possible handoff classes, and the handoff decision model 2110 may output any combination of the above mentioned handoff classes or any other suitable handoff classes.

[0144] In various embodiments, context detected via the vehicle's outward-facing sensors may also be taken into account in assessing the driver's ability to handle the handoff successfully. For example, weather conditions, visibility conditions, road conditions, traffic conditions, or other conditions may affect the desired alertness level for the handoff. For example, if conditions are severe, a different level of awareness may be required before handing off to the driver. This may be accomplished by feeding the context information to the machine learning algorithm 2102 or in any other suitable manner.

[0145] 22 illustrates the inference phase of determining a handoff decision 2208, according to certain embodiments. Sensor data 2202, as described above, is provided to a driver state model 2008, which outputs driver states 2204. Driver states 2204 and historical data 2206 are provided to a handoff decision model 2110, which outputs a handoff decision 2208, as described above, or another suitable handoff decision. In other embodiments, the handoff decision model may consider other factors (e.g., the context of the driving situation determined from one or more exterior-facing sensors) or omit the historical data 2206.

[0146] The inference phase may be performed in response to any suitable trigger. For example, the inference phase may be performed in response to a determination that the vehicle itself is unable to operate independently at an acceptable level of safety. As another example, the inference phase may be performed periodically while a human driver is operating the vehicle, and the outcome of the inference phase may be a determination of whether the driver is fit to operate the vehicle. If the driver is not fit, the vehicle may take over all or part of the driving controls, provide an alert to the driver, or take an action to increase the driver's alertness (e.g., play loud music, open the windows, vibrate the driver's seat or steering wheel, or other suitable action).

[0147] Once the system decides to hand off to a human driver, the driver is notified of the impending handoff. To do so, the system may engage the driver in one or more of several possible ways. For example, the system may verbally engage the driver. For example, semantically and syntactically correct text may be constructed by a natural language generation engine and then converted to synthetic speech by a text-to-speech engine to create a verbal message describing the handoff. As another example, the system may physically engage the driver. For example, a motor mounted on the driver's seat or steering wheel may violently vibrate the seat or steering wheel for driver safety considerations to avoid startling the driver and causing an accident. In other embodiments, the system may engage the driver in any suitable way to communicate the handoff.

[0148] 23 illustrates a flow for generating a handoff decision, according to certain embodiments. At 2302, sensor data is collected from at least one sensor located inside the vehicle. At 2304, the sensor data is analyzed to determine a physical state of a person inside the vehicle. At 2306, a handoff decision is generated that indicates whether or not the person is expected to be able to safely operate the vehicle based at least in part on the person's physical state.

[0149] As discussed herein, some autonomous driving systems may be equipped with functionality to assist in the transfer of control from the autonomous vehicle to a human user in the vehicle or at a remote location (e.g., a remote valet application). In some implementations, the autonomous driving system may employ a logic-based framework for smooth transfer of control from the occupant (EGO) to the autonomous (agent) vehicle, or vice versa, for the purpose of enhancing both occupant and road safety under different conditions and circumstances. At least some aspects of this framework may be parallelized as implemented on the autonomous driving system's hardware (e.g., via FPGAs, Hadoop clusters, etc.).

[0150] For example, an example framework may consider different situations where it is safer for either the autonomous vehicle or the human driver to control the vehicle and present a mechanism for implementing these control requests between the two parties. As an example, there may be conditions in which the autonomous vehicle desires to take back control of the vehicle for safer driving. The autonomous vehicle may be equipped with a camera or other internal sensors (e.g., microphones) that may be used to sense the driver's state of awareness (e.g., determine whether the driver is distracted by a phone call or feeling drowsy / distracted) and determine whether to take over control based on the driver's awareness. An autonomous vehicle may include mechanisms to analyze sensor data (e.g., analysis performed on camera and microphone data from inside the vehicle) and request control and take over from the driver if the driver has a low level of awareness or is otherwise deemed unsafe (e.g., drunk driving, hands-off driving, sleeping behind the wheel, texting while driving, dangerous driving, etc.), or if the autonomous vehicle senses any abnormal behavior within the vehicle (e.g., fighting or yelling, or other unsafe driving behavior by a human driver or passenger). In this manner, safety of persons both inside and outside the autonomous vehicle may be enhanced.

[0151] In some implementations, authentication-based (e.g., using biometrics) command control may be utilized to prevent unauthorized use of the autonomous vehicle. As an example, in some embodiments, when an autonomous vehicle is stolen or falls into the wrong hands, the autonomous vehicle may be able to detect this scenario and lock itself from being controlled. For example, an authentication mechanism may be included in the autonomous vehicle that uses biometrics (e.g., fingerprint, voice and face recognition, driver's license, etc.) to authenticate a user requesting control of the autonomous vehicle. These mechanisms may prevent unauthorized use of the autonomous vehicle. In some cases, use of the autonomous vehicle or aspects thereof may be provided based on different authorization levels. For example, one user may be able to fully control the vehicle manually anywhere, while another user may only be able to control the vehicle in limited locations on a particular map. As another example, in some embodiments, an occupant may request control of the autonomous vehicle when encountering a particular situation, such as very congested roads, bad weather, or a sensor (e.g., camera, LIDAR, radar, etc.) failure. In response to the request, the autonomous vehicle may authenticate the user based on one or more of the user's biometrics and, if authenticated, may hand over control of the autonomous vehicle to the user. As another example, in some embodiments, if an entity / user (e.g., police, first responders, government officials, etc.) wishes to remotely control the autonomous vehicle, the autonomous vehicle may validate the user before transferring control to that entity / user.

[0152] In some embodiments, control of the autonomous vehicle may be crowdsourced to multiple surrounding automobiles (including police vehicles) or infrastructure-based sensors / controllers, for example, if surrounding autonomous vehicles believe the autonomous vehicle is driving unsafely or not within acceptable limits of other vehicle behavior models. In such examples, the entity requesting control may be authenticated, such as through biometric authentication of the human requesting control or by digital security information (e.g., digital certificates) of the autonomous vehicle / infrastructure sensors.

[0153] Figure 24 illustrates a high-level block diagram of the above-described framework, according to at least one embodiment. For example, in scenario 2402, when the autonomous vehicle detects (e.g., via camera or microphone data from inside the autonomous vehicle) an unsafe driving condition (e.g., one of those listed in Figure 24 or other unsafe conditions), the autonomous vehicle is operating in a human-driven / manual operating mode, and therefore returns control to the autonomous vehicle to continue in autonomous driving mode. In this scenario, the autonomous vehicle may present a request to the driver to take back control of the vehicle before taking back control.

[0154] In scenario 2404, the human driver requests control of the autonomous vehicle, such as in response to the driver identifying a situation (e.g., those listed in FIG. 24 or other) in which the driver does not feel comfortable continuing in an autonomous mode of operation. The autonomous vehicle may responsively initiate an authentication request at 2405 to authenticate the human driver, e.g., using biometric authentication or other authentication methods, and upon validation, may pass control from the autonomous vehicle to the human driver (whereas the autonomous vehicle would otherwise retain control).

[0155] In scenario 2406, a police officer or nearby autonomous vehicle may request control of the autonomous vehicle, for example, due to unsafe driving observed by the autonomous vehicle, due to the autonomous vehicle being reported stolen, due to the need to move the autonomous vehicle for congestion / road control purposes, etc. The autonomous vehicle may in response initiate an authentication request to authenticate the requesting person / entity at 2407, and in response and upon authenticated validity, control may be passed from the autonomous vehicle to the police officer / nearby autonomous vehicle (otherwise the autonomous vehicle retains control).

[0156] FIG. 25 is a diagram of an example process for controlling takeover of an autonomous vehicle, according to at least one embodiment. The operations of the example process may be performed by aspects or components of an autonomous vehicle. The example process 2500 may include additional or different operations, and the operations may be performed in the order shown or in another order. In some cases, one or more of the operations shown in FIG. 25 are implemented as a process, sub-process, or other type of routine that includes multiple operations. In some cases, the operations may be combined, performed in a different order, performed in parallel, repeated, or otherwise repeated or performed in a different manner.

[0157] At 2502, the autonomous vehicle is operated in an autonomous mode, whereby the autonomous vehicle is in control of many or all aspects of the operation of the autonomous vehicle.

[0158] At 2504, the autonomous vehicle receives a request to take over control of the autonomous vehicle from another entity, which may include a human occupant / driver of the autonomous vehicle, a person remote from the autonomous vehicle (e.g., a police officer or government official), or another autonomous vehicle or multiple autonomous vehicles in the vicinity of the autonomous vehicle (e.g., crowdsourced control).

[0159] At 2506, the autonomous vehicle prompts for credentials of the entity to authenticate the entity requesting control. The prompts may include prompts for biometric authentication, such as a fingerprint, a voice sample for voice recognition, a face sample for facial recognition, or another type of biometric authentication. The prompts may include prompts for other types of credentials, such as a username, password, etc.

[0160] At 2508, the autonomous vehicle receives input from the requesting entity and determines whether the entity is authenticated based on the received input at 2510. If the entity is authenticated, the autonomous vehicle allows the takeover and passes control to the requesting entity at 2512. If the entity is not authenticated based on the input, the autonomous vehicle denies the takeover request at 2514 and continues operating in an autonomous mode of operation.

[0161] FIG. 26 is a diagram of another example process for controlling takeover of an autonomous vehicle, according to at least one embodiment. The operations of the example process may be performed by aspects or components of an autonomous vehicle. The example process 2600 may include additional or different operations, and the operations may be performed in the order shown or in another order. In some cases, one or more of the operations shown in FIG. 26 are implemented as a process, sub-process, or other type of routine that includes multiple operations. In some cases, the operations may be combined, performed in a different order, performed in parallel, repeated, or otherwise repeated or performed in a different manner.

[0162] At 2602, the autonomous vehicle is operated in a manual / human-driven mode of operation whereby a human (either within the autonomous vehicle or remote from the autonomous vehicle) is controlling one or more aspects of the operation of the autonomous vehicle.

[0163] At 2604, the autonomous vehicle receives sensor data from one or more sensors located within the autonomous vehicle and analyzes the sensor data to determine whether input from a human operator is safe, at 2606. If the input is determined to be safe, the autonomous vehicle continues to operate in a manual mode of operation. If the input is determined to be unsafe, the autonomous vehicle requests control takeover from the human operator, at 2608, and operates the autonomous vehicle in an autonomous mode of operation, at 2610.

[0164] The transition from Level 2 ("L2" or "L2+") autonomous vehicles to fully autonomous Level 5 ("L5") autonomous vehicles may take several years, and the autonomous vehicle industry could see a gradual shift of responsibilities away from the role of the human driver until reaching full autonomy (no driver) everywhere. Achieving a safe takeover from machine control (autonomous mode) to human control (human-driven mode) is critical in this transition phase, but it presents several challenges. For example, one possible challenge is controlling random interventions by the human driver that occur without a request from the autonomous system. Another challenge arises from event-driven interventions. There are three types of takeovers that can occur in autonomous vehicles:

[0165] Vehicle-requested takeover: When the vehicle requests a driver takeover and hands over from autonomous mode to human-driven mode. This may occur in some cases when there is some uncertainty in the best decision or when the autonomous vehicle faces a situation that is new to its perception system, such as when the vehicle leaves a bounded area on the map. A common strategy for requesting a human takeover is by alerting the driver through one or more techniques (e.g., a pop-up message on the dashboard, a beep, or a vibration on the steering wheel). Even if the human driver accepts the takeover, some errors may occur in the takeover due to longer than expected human reaction times, human lack of focus, or other reasons.

[0166] Random takeover by human driver: A possible takeover may occur randomly (e.g., without a request from the vehicle) by a human driver for unpredictable reasons. For example, the human driver may be distracted or may wake up from unintentional sleep and react inappropriately (suddenly control the steering wheel without full awareness). As another example, the human driver may be in a hurry (e.g., to catch a flight or an important event) and may not be satisfied with the vehicle speed in the autonomous mode, so may take over control and accelerate. These types of random takeovers may be undesirable since it is not feasible to put driving rules / policies in place for such unpredictable takeovers, and the random takeover itself may lead to accidents / crashes.

[0167] Human event-driven takeover: Another possibility for takeover is when it is triggered by a human due to an unpredictable event. For example, the human driver may suddenly feel the need to exit the car (e.g., claustrophobia, feeling unwell, etc.). As another example, the human driver and the passenger in the car may suddenly enter a high-risk scenario, causing the human driver to take over to stop the car. As another example, the human driver may feel uncomfortable on the road they are driving on (e.g., a dark, unfamiliar road), triggering the need to take control and make themselves more comfortable. These types of takeovers may be undesirable as they may disturb the autonomous driving mode in an unpredictable way, and the takeover itself may lead to an accident / crash. Similar to the above case, this type of takeover may also be undesirable as it is not feasible to have driving rules / policies in place for such unpredictable takeovers, and takeovers driven by unpredictable events are likely to be unsafe.

[0168] Of these types, random and event-driven takeovers may be considered unsafe, and therefore an autonomous driving system may be specifically configured to detect and control these types of takeovers, thereby enabling safer driving and avoidance of unpredictable behavior while in an autonomous driving mode. In certain embodiments, to mitigate these potentially unsafe takeover situations: The autonomous driving perception phase (e.g., as implemented in an in-vehicle perception software stack) may be extended to include a software module for detecting unsafe takeover in real time. The autonomous driving behavioral phase (e.g., vehicle control software and hardware implemented in in-vehicle systems) may be extended to include software modules for mitigating unsafe takeovers detected in real time. The autonomous driving planning phase (e.g., the route planning subsystem) may be expanded to include considering possible route changes or other adjustments to the autonomous driving mode to avoid conditions that are uncomfortable for the passengers or driver as a means of performing mitigation.

[0169] FIG. 27 is a diagram of an example perception, planning, and action autonomous driving pipeline 2800 for an autonomous vehicle, according to at least one embodiment. In particular, FIG. 27 outlines certain considerations in autonomous vehicle perception and control to detect and mitigate potentially unsafe takeovers in real time. The operations of the perception, planning, and action pipeline may be performed by an in-vehicle control system of the autonomous vehicle. As shown, the example perception, planning, and action pipeline includes a sense / perception phase, a plan phase, and an act / control phase.

[0170] In the illustrated example, the control system receives sensor data from multiple sensors coupled to the autonomous vehicle, including vehicle perception sensors (e.g., cameras, LIDAR, etc.) and vehicle control elements (e.g., steering wheel sensors, brake / accelerator pedal sensors, interior cameras, interior microphones, etc.). The control system uses the sensor data in the sensing / perception phase to detect an unsafe takeover request by a human driver of the autonomous vehicle. The detection of an unsafe takeover may be based at least in part on the received sensor data. For example, an unsafe takeover may be detected based on sensors coupled to the accelerator pedal, brake pedal, and / or steering wheel that sense a takeover action. In some instances, cameras and / or microphones inside the vehicle may be used (e.g., in conjunction with artificial intelligence) to detect that a driver action is to take over control of the autonomous vehicle. In some embodiments, data from the pedal / steering wheel sensors and from the in-vehicle camera may be correlated to detect a possible human takeover request and determine whether the action is actually a requested takeover. For example, a driver who is suddenly awakened or distracted may actuate one or more of the brake, accelerator, or steering wheel without any intention of initiating a random takeover of control.

[0171] After it is detected that a requested takeover is unsafe, the control system mitigates the unsafe takeover request. This may include, for example, blocking the takeover request so that a human driver is not permitted to control the autonomous vehicle. For example, the steering wheel, brake actuators / pedals, and accelerator actuators / pedals may be locked during the autonomous driving mode and unlocked only when the autonomous vehicle requests a human takeover (which may be in response to detecting that a random takeover request is safe, as described below). Additionally, in some instances, door unlocking may be enabled only when the vehicle is stationary (not moving), so that the doors may remain locked in response to an unsafe takeover request.

[0172] In some cases, mitigating an unsafe takeover request may include modifying the autonomous driving mode to meet the wishes of the driver / passenger. For example, the control system may replan the autonomous vehicle's route (e.g., direction, speed, etc.) to ensure driver / passenger comfort and minimize risk to the passenger / driver introduced by the takeover request. In some cases, the control system may prompt the human driver and / or passenger for input in response to the takeover request (e.g., using voice prompts (in the case of a voice recognition enabled autonomous vehicle) and / or text prompts) and may modify one or more aspects of the autonomous mode based on the input received from the driver / passenger.

[0173] FIG. 28 is a diagram of an example process for controlling a takeover request by a human driver of an autonomous vehicle, according to at least one embodiment. In particular, FIG. 28 illustrates an unsafe takeover detection and mitigation scheme. The operations of the example process may be performed by components of an autonomous vehicle (e.g., a control system of the autonomous vehicle). The example process 2800 may include additional or different operations, and the operations may be performed in the order shown or in another order. In some cases, one or more of the operations shown in FIG. 28 are implemented as a process, sub-process, or other type of routine that includes multiple operations. In some cases, the operations may be combined, performed in a different order, performed in parallel, repeated, or otherwise repeated or performed in a different manner.

[0174] At 2802, the autonomous vehicle is operating in an autonomous driving mode. For example, a control system of the autonomous vehicle may control one or more aspects of the operation of the autonomous vehicle, such as through a perception, planning, and action pipeline. At 2804, the autonomous vehicle determines (e.g., based on sensor data passed to the control system) whether it is encountering an irregular or unknown situation. If so, at 2806, the autonomous vehicle requests that a human driver take over control of the autonomous vehicle, and at 2808, the autonomous vehicle enters and operates in a human-driven operating mode (wherein the human driver controls the autonomous vehicle). The autonomous vehicle may then determine at 2810 whether it is encountering a regular / known condition while in the human-driven operating mode. If so, the autonomous vehicle may request a takeover or recapture of control of the autonomous vehicle at 2812 and may re-enter the autonomous operating mode. If no irregular / unknown situation is encountered at 2804, the autonomous vehicle may continue to operate in the autonomous driving mode, thereby continually determining whether an irregular / unknown situation is encountered.

[0175] At 2814, the autonomous vehicle detects a takeover request by a human driver. The takeover request may be based on sensor data from one or more sensors coupled to the autonomous vehicle, which may include sensors located internal to the autonomous vehicle (e.g., sensors coupled to a steering wheel, a brake actuator, an accelerator actuator, or an internal camera or microphone).

[0176] At 2816, the autonomous vehicle determines whether the takeover request is unsafe. If so, the autonomous vehicle may mitigate the unsafe takeover request in response. For example, at 2818, the autonomous vehicle may block the takeover request. In addition, at 2818, the autonomous vehicle may prompt the driver for input (e.g., using voice recognition software to enable a conversation with the driver) to understand more about the cause of the takeover request or the irregular situation.

[0177] Based on the input received from the driver, at 2820, the autonomous vehicle determines what situation the driver is in or why the driver is initiating a takeover request. For example, if a situation is identified that is a risk to the driver or passenger (e.g., screaming, unsafe behavior, etc.), the autonomous vehicle may modify the autonomous driving mode to back off and stop at 2822, as replanning may need to be considered for the route. For example, if a situation is identified where the autonomous driving mode is uncomfortable for the driver and / or passenger (e.g., unknown routes / roads, very dark environment, etc.), the autonomous vehicle may modify the autonomous driving mode at 2824 such that more visual information is displayed to the driver / passenger (e.g., (additionally) displaying route details, and the autonomous vehicle may also adjust interior lights to allow the driver to see the additional information) to help the driver and / or passenger become more comfortable in the autonomous driving mode. For example, if a situation is identified where speed is unsatisfactory (e.g., the driver wants the autonomous vehicle to slow down or speed up), the planning phase may consider alternative speeds and / or routes, and the autonomous vehicle may modify its autonomous driving mode to change the speed (or route). Other mitigating measures may be used in response to received driver input.

[0178] One of the potential benefits of autonomous vehicles is the possibility of a safer driving environment. However, despite best efforts to create error-free automated systems, mechanical, physical, and / or electronic damage caused by wear and tear on the vehicle is inevitable. Such damage may cause the autonomous vehicle to malfunction.

[0179] Inevitably, damage to an autonomous vehicle, especially to its sensors, can result in reduced vehicle functionality. The automation level of an autonomous vehicle is defined in relation to the amount of participation required from a human driver, as shown in Figure 29. When an autonomous vehicle encounters a problem, a human occupant (or a remote monitoring entity) may be required to take over driving control, or the vehicle may cease operation.

[0180] Furthermore, if the vehicle has a problem, whether that problem is a sensor problem, a processor or memory malfunction, or any other hardware / software problem, the likelihood of an accident occurring increases. This is also true if the human driver is allowed to take over control of the vehicle, especially if the driver is not ready to take over. The ability to track what is happening with the vehicle can prove very important to many parties. For example, insurance companies, the driver, or the manufacturer of the vehicle can benefit with respect to various liability issues. Additionally, vehicle designers can benefit by understanding what happens in critical situations.

[0181] A comprehensive cognitive supervision system 3000 is shown in FIG. 30. The system 3000 is a computing system (subsystem or implementation of the computing system discussed herein) configured with logic to supervise and adjust the vehicle's autonomy level based on continuous analysis of driving conditions and the accuracy of the autonomous vehicle, particularly the autonomous vehicle's sensing, planning, and acting layers. The system 3000 can include multi-level smart mechanisms that handle issues that may arise with the autonomous vehicle by monitoring, alerting, and re-engaging the human driver, and by implementing a safe handoff of driving control to the human driver. The system 3000 can also be configured to enable remote supervision and / or control of the autonomous vehicle. The system 3000 can also be considered a system that reduces the autonomous vehicle's autonomy level, thereby relying more heavily on the human driver in situations where the vehicle's sensors or components fail, or other situations that the vehicle cannot handle.

[0182] The system 3000 can monitor the level of autonomy of the autonomous vehicle. Additionally, the system can determine whether the level of autonomy is appropriate and, if not, can change the level of autonomy of the vehicle. Additionally, if a change is necessary, the system 3000 can alert the driver of the change. The system can also alert the remote surveillance system 3010 of the change.

[0183] A generic cognitive supervision system (C2S2) 3005 may sit on top of (e.g., supervise) the autonomous vehicle's regular automation systems. In one example, the system 3005 sits on top of the vehicle's sensor (3020), planning (3030), and execution (3040) systems. It should be noted that in some implementations, the C2S2 may sit on top of or co-operate with a greater number of the autonomous vehicle's in-vehicle computing systems. In particular, the C2S2 may sit on top of any system that may affect the vehicle's autonomy level. The system 3005 may also record the history of the autonomous driving level and sensor health monitoring. The collected data may be very concise and accessible offline so that it can be referenced in case of any malfunction or accident.

[0184] In some examples, C2S2 3005 includes logic executable to monitor the autonomy level of the automobile, and comprises three main modules: functional assurance, quality assurance, and safety assurance. Each of these main modules may have a predefined set of key performance indicators (KPIs) that accept or reject the current autonomy state set for the vehicle. If C2S2 determines that the autonomy level is not acceptable by any of the monitored modules, C2S2 may have the ability to change the autonomy level of the vehicle. Furthermore, the system notifies the human driver of the change. The ability to change the autonomy level can be very beneficial. For example, instead of completely stopping the autonomy of the vehicle in the event of any sensor failure, C2S2 may determine that the autonomy level can be reduced as opposed to removing the autonomy completely. This may mean that the vehicle goes from an L4 to an L3 level (e.g., as shown in FIG. 31). Such a change may not require the human driver to be involved in the control of the vehicle, although in some embodiments, the change in autonomy may be communicated to the driver to allow the driver to pay closer attention if required.

[0185] Continuing with the example of FIG. 30, C2S2 3005 evaluates the KPIs of each of the three main blocks (functional assurance, quality assurance, and safety assurance) of the three systems (sensors 3020, planning 3030, and execution 3040). If C2S2 3005 detects that there is some problem with the system, it can evaluate whether the autonomy level needs to be changed. Not all problems may require a change in the autonomy level. For example, a vehicle may have a problem with one of the sensors. However, if this sensor produces repetitive data compared to another sensor, the vehicle may not lose the ability to maintain the current autonomy level.

[0186] In other instances, however, sensor issues may cause problems. Although manufacturers have introduced certain vehicles capable of L4 autonomy levels, such designations are conditional in nature and the vehicle's autonomy capabilities may vary over time. For example, in scenarios such as sensor / component failure, the autonomy level may need to be changed if the sensor becomes unavailable or occupant safety is compromised. The C2S2 3005 can change the autonomy level and notify both the driver and the remote surveillance system (3010).

[0187] In addition to monitoring and changing the autonomy level, C2S2 3005 can also report actions back to the remote surveillance system 3010. Not only can C2S2 3005 report changes in autonomy level, C2S2 3005 can report any important data to the remote system 3010. For example, in a situation where there is a required autonomy level change, or even an accident involving an autonomous vehicle, a complete record of the level change and data regarding the vehicle's movements, plans, autonomy level, etc. can be sent to the surveillance system 3010 and stored there. Such data can be useful in determining fault for the accident, data for improvement, etc. It is contemplated that any data that can be acquired can be sent to the remote surveillance system 3010, if desired.

[0188] The system depicted in Figure 30 is merely representative of modules that may be provided in certain embodiments. Other embodiments may include additional modules not specifically mentioned herein. In addition, not all modules are required, or modules may be combined in other embodiments.

[0189] Although it may be ideal to provide a completely human-free driving experience with an autonomous vehicle, depending on the autonomous level of the autonomous vehicle, it may be necessary to have some interaction by a human driver while the vehicle is operating. This is especially true in emergency situations where it may be necessary for the human driver to take over control. In such situations, a typical handoff to a human driver, if successful, may take about three seconds on average. However, humans are often distracted, easily distracted, and often slow to respond to certain situations. Therefore, to achieve a quick and safe handoff, it may be difficult to keep the driver engaged while the vehicle is operating in an autonomous mode.

[0190] Thus, in at least some circumstances, a person may not be trusted as a backup for an autonomous vehicle handoff. If a person cannot react quickly enough, a potentially dangerous situation may be exacerbated by a distracted driver who fails to react in a timely manner. Various implementations of the above-described system may provide a safer approach to conducting a handoff between an autonomous driver and a human driver.

[0191] FIG. 32 illustrates an example of a structural flow of data in an autonomous vehicle operating at an L4 level of autonomy. The example flow of FIG. 32 includes a sensing module 3210, a planning module 3220, an action module 3230, and a drive-by-wire ("DBW") module 3240. As an example, the sensing module 3210 can be involved in processing data from various perception sensors (e.g., camera, radar, LIDAR, GPS, etc.). The sensing module 3210 may have any suitable characteristics of a sensor 225. Data output by the sensing module can represent the vehicle's motion parameters (e.g., speed, position, orientation, etc.) and can be passed to a planning module 3220 (which may have any suitable characteristics of a path planner module (e.g., 242), such as those discussed elsewhere herein), along with data representing objects around the vehicle. The planning module 3220 can make relevant decisions about actions to be taken on the road while driving based on the current situation. The decisions by the planning module can be communicated to a behavior module 3230, which can comprise a controller, to generate specific vehicle commands that are provided to the DBW module 3240. Such commands can include, for example, commands for specific steering angles, and / or acceleration. These commands are then executed by the DBW module. It should be noted that the above flows are merely exemplary and other flows may exist. Additionally, there may be different levels of intelligence for different vehicles. For example, an L2 rated vehicle will have a different level of intelligence than an L4 rated vehicle.

[0192] Now, in a situation where there is a failure in one of the module levels in the example of Figure 32, or if the vehicle's planning algorithm is unable to take action for a particular driving scenario, the vehicle will automatically send a signal to the driver indicating that the driver needs to take over. This signal can be visual, audio, or a combination thereof. Figure 33 shows an example of a video signal to the driver.

[0193] Figure 34 illustrates the flow of an example autonomous vehicle handoff situation. As can be seen, at the start of the flow, the vehicle may be in autonomous mode at 3410. If a problem is recognized and the level of autonomy needs to be changed, a takeover signal is sent at 3420. Finally, at 3430, the autonomous mode is deactivated.

[0194] A handoff process that is neither abrupt nor sudden helps the driver to engage with the vehicle when necessary. In addition, it may not be necessary for the vehicle to become completely non-autonomous if a sensor fails. It may be safe to simply lower the level of autonomy. For example, for an autonomous vehicle operating in L4 mode, it may not be necessary for the vehicle to handoff directly to a human driver and cease its autonomy. The planning algorithm (e.g., implemented by the planning module 3220) relies on multiple sensor inputs. The reliability of an autonomous system is defined by the accuracy with which the planning algorithm can make decisions based on these sensor inputs. Every system has its own set of critical and non-critical sensor inputs that define the confidence level of the decisions made by the planning module. An L4 level vehicle will not be able to operate at the same confidence level if a subset of its sensors (mainly redundant sensors) stop working. In one example situation, the vehicle may simply demote the confidence level from L4 to L3, which requires a higher level of attention by the driver. However, it may not be necessary for the driver to fully take over and for the vehicle to shut down the autonomous system.

[0195] FIG. 35 illustrates an example of a flow for handing off control of an autonomous vehicle to a human driver. In addition, FIG. 35 illustrates the linkage between human responses and autonomous vehicle actions. This linkage is illustrated by the dotted lines. The example flow of FIG. 35 may be performed by the planning module 3220 of the autonomous vehicle. However, it should be noted that the flow of FIG. 35 may be performed by any module or combination of computing systems, including those not mentioned herein.

[0196] The example of Figure 35 first shows (3510) an autonomous vehicle operating normally in its autonomous mode, in this example at the L4 level. As a result, the human driver is inactive (3515). This may be especially true for higher autonomy levels of the autonomous vehicle.

[0197] If a problem occurs, the vehicle may send out a system malfunction warning 3520. Thus, the human driver receives a warning 3525. This warning can be visual, audio, tactile, or any other type of warning.

[0198] Once it is determined that the malfunction is not severe enough to require immediate driver interaction, the vehicle may switch to a lesser autonomous mode (3530). In this example, the vehicle switches from L4 to L3. The human driver may then become aware of this transition (e.g., based on the alert received in 3525), pay attention to the driving conditions, and, if necessary, gain control of the vehicle for a certain amount of time (3535). In some examples, the vehicle may confirm driver involvement by using certain sensors and monitoring. For example, the vehicle may use gaze monitoring, haptic feedback, audio feedback, etc.

[0199] If there is another error, the vehicle may again send a system malfunction warning (3540). After the warning is sent, the driver again receives a warning (3545).

[0200] Next, if it is once again determined that the autonomy level can be reduced again (in this example, from L3 to L2), the vehicle again reduces its autonomy level (3550). Now, in a corresponding move, the driver begins to pay more attention (3555). In this example, the car is in L2 mode, so the human driver continues to pay attention.

[0201] If the car needs to once again reduce its autonomy level, this time to L1, then a driver takeover is required. Thus, the vehicle may send out a takeover signal (3560). With a corresponding movement, the driver may receive the takeover signal (3570).

[0202] The vehicle may then check whether the driver is available to take over control of the vehicle. Thus, the vehicle waits for the driver to take over control (3562). As described above, the vehicle can use monitoring and sensors to determine the driver's readiness in addition to monitoring whether the driver has actually taken over control.

[0203] If, after a period of time, the vehicle determines that the driver has not taken over control (or cannot safely take over control), the emergency system is activated (3564). This may include implementing different actions depending on the situation. For example, it may be necessary for the vehicle to pull over. In some situations, the vehicle may continue to move for a period of time because it may not be safe to pull over and stop. Thus, the vehicle may slow down and / or pull over to the side of the road until it is safe to stop. Once the emergency system is activated, the corresponding emergency action state is completed (3574).

[0204] However, if the driver is able to take over and the handoff is successful, the autonomous mode can be deactivated 3566. With corresponding action, the driver is fully engaged and driving the vehicle 3576. As can be seen, early warnings (multiple times before handoff is required) allow the driver to prepare for handoff before the system fails and forces the driver to take over.

[0205] Depending on the autonomous level of the autonomous vehicle, some interaction by a human driver may be required while the vehicle is operating. Even when the vehicle is normally capable of operating in a fully autonomous manner, there may be some situations (e.g., emergency situations) where a human driver may be required to take over control. In other situations, it may be desirable for a human driver to take over control of the autonomous vehicle, for example, when the human driver wants to drive or when there is a beneficial reason for a person to control the vehicle. However, humans are often distracted, easily distracted, and slow to respond to certain situations. Thus, at least in some situations, a person may not be reliable as a backup for handoff of an autonomous vehicle. Furthermore, human response times and reactions may vary depending on the context of the situation. For example, some humans have slower reaction times than other humans. As another example, some humans react calmly to emergency situations while others panic.

[0206] It may be beneficial for an autonomous vehicle handoff system and procedure to implement a personalized strategy for handing off control of the vehicle to a person. Such a system and procedure may enhance the safety and effectiveness of the handoff. This may be particularly true for level 5 autonomous vehicles, where a human driver is generally not required. In some situations, the human driver may be asleep or distracted, thus increasing the risk associated with the handoff. A personalized and coordinated handoff strategy may take into account the attention level and / or reaction characteristics of the human driver in such situations when planning the handoff.

[0207] In various embodiments, the personalized and coordinated handoff strategy can be applied to both planned and unplanned handoffs in autonomous vehicles. While full autonomy may be desirable, real-world scenarios (e.g., critical sensor failures, sudden and unexpected changes in road conditions (e.g., flash floods), etc.) may create situations that exceed the capabilities of an autonomous vehicle.

[0208] According to embodiments herein, a solution to the handoff problem can comprise a multi-faceted approach that takes into account one or more of the driver's activity, personal capabilities, and the target route when planning the handoff. This approach allows the system (e.g., the in-vehicle processing system 210) to make better decisions regarding whether and when to hand off control of the vehicle to a human driver. In addition, various embodiments can also provide for driver personalization over time, constantly maintaining contextual information references to incrementally improve the handoff process.

[0209] FIG. 36 illustrates an example system 3600 for handoff of an autonomous vehicle to a human driver. The system may be considered as a system for safe, timely, and adaptive handoff of an autonomous vehicle to a human driver. In some embodiments, the various modules may be implemented by an in-vehicle processing system (e.g., 210). In other embodiments, one or more of the modules may be implemented by a cloud-based computing system (e.g., 140 or 150). The system 3600 includes a vehicle occupant activity monitoring module 3610, a personalized vehicle occupant capability database 3615, a general vehicle occupant capability database 3620, a handoff forecast module 3625, a handoff handling module 3630, and a performance assessment and optimization module 3635. The system 3600 is merely exemplary and is not limited to the embodiments specifically presented herein.

[0210] The vehicle occupant activity monitoring ("OAM") module 3610 extracts information related to a human driver of an autonomous vehicle. In certain embodiments, the OAM module 3610 implements a combination of rule-based machine learning as well as deep learning methods. The OAM may determine state characteristics associated with a human driver, such as the direction the driver is facing (e.g., whether the person is sitting facing the road or the rear of the vehicle), the positioning of the driver's seat (e.g., the distance from the driver's seat to the steering wheel, the angle of the seat backrest, or other characteristics of the driver's seat relative to the steering wheel), whether the driver is awake or asleep, whether the driver is engaged in another activity (e.g., reading, watching a video, playing a game, etc.), or other state characteristics. The determinations made by the OAM module 3610 listed here are merely exemplary, and the OAM may be used to determine any characteristic of the driver that is deemed relevant to the driver's ability to fully or partially take over control of the vehicle.

[0211] The OAM module 3610 may use data from a number of different sensors as input. For example, in-vehicle sensors that may provide information to the OAM module 3610 include, for example, cameras, inertial measurement units, seat and back sensors, ultrasonic sensors, or biometric sensors (e.g., heart rate monitors, body temperature monitors, etc.). Data from the sensors can be in raw form or pre-processed. The sensors enumerated herein are merely exemplary, and any type of sensor, whether enumerated herein or not, can be used as a data input to the OAM module 3610.

[0212] The general vehicle occupant capability ("GOC") database 3620 may include data related to statistics of general driver characteristics similar to actual drivers of the autonomous vehicle. For example, the GOC database 3620 may contain information of characteristic responses for drivers with similar characteristics (e.g., gender, age, fitness level) as the actual driver. Furthermore, the information stored in the database 3620 may be global or specific to one or more particular geographic areas. In some embodiments, the GOC database 3620 may be external to the vehicle and made available to the autonomous vehicle through the cloud. The GOC database 3620 may be updated at any suitable time or interval such that the handoff operation of the autonomous vehicle may improve over time. It should be noted that the GOC database 3620 may comprise more than one database.

[0213] Examples of the types of data in the GOC database may include the amount of time it takes a characteristic driver (e.g., a person with similar characteristics (e.g., age, gender, etc.) as the driver) to respond to a prompt, rotate the seat 180 degrees, move the seat longitudinally a particular distance, place one's hands from a lap position onto the steering wheel, engage the road while awake (which may depend on the driver's activity prior to being warned to engage), or other suitable activity associated with a handoff. Additionally, the driver's characteristics (e.g., the driver's health status) may be used to create statistical data that corresponds to the context of the driver's situation. For example, the database may acquire information indicating that an average driver with the same back problems as the driver of the autonomous vehicle may take a particular amount of time, on average, to put the seat into an upright position or move the seat forward toward the steering wheel.

[0214] Besides utilizing available statistical data, machine learning models, for example implemented by in-vehicle processing system 210, can also be used to process raw data on the autonomous vehicle. In other embodiments, such machine learning models may be executed on the cloud (rather than locally on the autonomous vehicle) and inference outputs may be utilized on the vehicle.

[0215] The personalized vehicle occupant capability ("POC") database 3615 may essentially contain similar data as the GOC database 3620. However, the POC database contains driver and vehicle specific information rather than aggregated information from multiple drivers as the GOC database. Since each person varies from the baseline established by the GOC database 3620, the data in the POC database 3615 can help improve the functioning of the system 3600. The data in the POC database 3615 can be observed and measured over time. The POC module 3615 of the system 3600 can be considered a central location that keeps track of the differences between the driver and the virtual driver.

[0216] In addition to driver-specific information, the POC database 3615 can also contain vehicle-specific information, for example, the time it takes for a driver to rotate their seat 180 degrees may depend on the technical capabilities of the vehicle, and the driver may not be able to speed up or slow down this process.

[0217] As examples, the following types of data may be stored in the POC database: the driver takes X1 seconds longer to respond to a voice prompt than the average driver, the driver takes X2 seconds less than the average to turn the seat (e.g., this may be due to the vehicle having a high-speed turning motion and / or the driver responding relatively quickly), the driver moves the seat longitudinally X3 seconds slower than the average driver, the driver places hands on the wheel X4 seconds faster than the average driver, and the driver engages the road when awake X5 seconds faster than the average driver. While these examples discuss measurements related to the average driver, in some embodiments, the information stored by the POC database may include absolute measurements (e.g., the driver takes Y1 seconds on average to respond to a voice prompt, the driver takes Y2 seconds on average to turn the seat, etc.). In addition, similar to the GOC database, the POC database may encompass other characteristics of the driver that may be used to generate statistical data that may provide further context to the driver's situation. As an example, the POC database may contain information indicating how quickly a driver moves their seat into an upright position or moves their seat forward due to a back injury.

[0218] A handoff forecast (HOF) module 3625 determines when a handoff may be necessary. The HOF module may consider road conditions, such as accidents, congested roads, public events, pedestrians, construction, etc., in determining where and when a handoff from an autonomous driver to a human driver may be necessary. The HOF module may receive local map and route information, for example, along with real-time traffic, accident, hazard, and road maintenance updates. Some or all of this information may be stored locally within the autonomous vehicle or in the cloud (and the vehicle may receive updates to such information through the cloud).

[0219] FIG. 37 illustrates an example route 3700 that a vehicle 3705 takes to go from point A to point B. The route 3700 is selected by a navigation system (e.g., route planner module 242) of the vehicle 3705. The HOF module 3625 may consider road conditions such as accidents, congested road segments, and road construction sites to determine where a handoff to a human driver may be required. In the example of FIG. 37, three areas (3710, 3720, and 3730) where such a handoff may be required are determined. After identifying potential handoff locations, the HOF module 3625 may rank the locations based on different criteria. Examples of such criteria may include:

[0220] 1—Is there an alternate route that may be lower priority but does not require a handoff to a human driver at the identified location? As an example, location 3720 may be associated with an alternate route 3715.

[0221] 2 - Can the autonomous vehicle address the identified handoff location by reducing speed and / or making intermittent stops if necessary? As an example, location 3730 has ongoing roadworks that will likely slow traffic in a controlled and safe manner.

[0222] 3-Are there any segments on the route that the autonomous vehicle will not be able to handle without human intervention? As an example, location 3710 could be such a location because an accident may have caused severe traffic disruption. The autonomous vehicle needs to make sure that a human driver is prepared in advance when approaching this particular location.

[0223] In various embodiments, the HOF module 3625 may determine handoff locations on the route and rank their relative importance (eg, which handoff locations are more likely to require a handoff).

[0224] Returning to Figure 36, a handoff handling ("HOH") module 3630 may take into account handoff related information in making a handoff decision. The HOH module 3630 receives the output of the OAM module 3610, the POC database 3615, the GOC database 3620, and the HOF module 3625, and makes a handoff decision based on one or more of them.

[0225] Finally, the execution assessment and optimization ("EAO") module 3635 compares the expected outcome of the handoff with the driver's behavior. The results of the comparison are fed back to the POC database 3615 and the HOH module 3630 to improve future handoffs. To gather information, the EAO module 3635 can use example criteria such as, at each handoff event on the route, how long it took the driver to respond to the handoff request, whether the driver was within the expected steering range after the handoff, whether the driver's acceleration / deceleration was within the expected acceleration / deceleration range after the handoff, and how long it took the driver to engage the road immediately after the handoff. The above listed criteria are merely examples, and in various embodiments, not all criteria or criteria not listed may be used.

[0226] Updates in the POC database 3615 allow the handoff process to take into account more personalized information by the driver and the technical capabilities of the autonomous vehicle, so that over time, as the number of autonomous vehicle rides increases, the POC database 3615 begins to become more differentiated from the GOC database 3620.

[0227] The HOH module 3630 uses the feedback information from the EAO module 3635 to calculate when and where the driver exhibited anomalies that deviate from typical behavior. This may be different than what the POC database 3615 stores for the driver as relating to deviations from the driver's expected behavior and may be taken into account in future handoffs. If the HOH module 3630 takes such anomalies into account in future handoffs, the autonomous vehicle may make handoff decisions and handoff execution assessments based on more representative data of the driver and the autonomous vehicle, which may improve road safety because it is based on real-world observations.

[0228] 38 illustrates an example of an advanced operational flow 3800 of the HOH module 3630. This operational flow can also be viewed as a method for handing off an autonomous vehicle to a human driver. First, the method begins by obtaining determined handoff locations from the HOF module 3625. These locations can be determined from the calculated priorities of the route.

[0229] Next, method 3800 continues with obtaining general driving data from GOC database 3620. It should be noted that obtaining any general driving data may not be necessary. For example, if an adequate amount of data is stored in POC database 3615, data from GOC database 3620 may be omitted from a particular decision. It should also be noted that it may be possible to communicate personalized data from one location to another, for example, when a driver purchases a new vehicle, information may be communicated from the old vehicle or the cloud to the new vehicle.

[0230] After obtaining the general data (if utilized), the HOH module then proceeds to obtain the personalized data from the POC database 3615. It should be noted that there may be situations where there is no personalized data, for example when the vehicle is new and no data has been obtained yet.

[0231] Next, the method 3800 continues with obtaining data from the OAM module 3610. This data may comprise information regarding the driver, such as related to the driver's attention level, activity, etc.

[0232] The HOH module can then determine an expected driver handling behavior for each possible handoff location as determined by the HOF module 3625. If the HOH module 3630 determines that it is time for a handoff, the driver is prompted. If not, the HOH module 3630 can determine whether there are real-time updates from any of the other modules. If there are updates, the update or updates can be used to redetermine the expected driver handling behavior.

[0233] 38, after being prompted by the driver, the HOH module 3630 determines whether the driver is able to take over. If takeover is possible, the HOH module can provide expected driver behavior to the EAO module 3635 and can then hand over control of the vehicle to the driver. Additionally, data regarding how well the driver performed during the handoff can be obtained from the EAO module 3635 and, in response, the expected driver behavior can be updated. The driver can continue to drive until it is determined, for example, that the driver is ready to relinquish control or that the AV can safely resume control.

[0234] If the driver is not ready to take over when prompted, the HOH module 3630 can assess whether there are alternatives to handoff. This can include, for example, taking an alternative route, slowing down, etc. If there are alternatives, one alternative can be selected. If there are no alternatives that allow the vehicle to continue moving, the HOH module can stop the vehicle. It should be noted that this may involve a change in the desired route to ensure that the vehicle can stop in a safe place and manner. If the vehicle comes to a stop, it can remain stationary until the driver is ready to take over. The driver can then drive until the autonomous vehicle is ready and safe to take over again. In other embodiments, it may also be possible for the vehicle to remain at the stop until there are alternatives that allow the vehicle to move again. This can include, for example, a change in the road conditions that caused the vehicle to stop, or even the opening of a new route.

[0235] The following example illustrates the operation of the HOH module 3630 by utilizing the example operational flow of FIG. 38 in combination with the example route of FIG.

[0236] Before the trip:

[0237] 1. The optimal route (3700) between A and B is calculated and provided to the HOF module.

[0238] 2. The HOF module 3625 uses real-time updates to identify three handoff areas (3710, 3720, and 3730).

[0239] 3. The HOF module determines that location 3710 is the location where driver assistance is most likely to be needed (because there is little information about accidents at that location).

[0240] 4. Location 3730 is selected as the next most probable location where another handoff may be required due to ongoing road construction.

[0241] 5. Location 3720 is identified as another possible area for handoff where increased pedestrian traffic on the road has been observed. The autonomous vehicle can easily handle this leg of the trip by taking an alternative route 3715 without requiring assistance from the driver.

[0242] 6. The GOC database 3620 provides general information about the driver to the HOH module 3630.

[0243] 7. The POC database is empty (because the driver just purchased a car and there is limited driver-based personalized information).

[0244] 8. The OAM module 3610 verifies that the driver is seated behind the wheel and that the son is seated in the back seat.

[0245] 9. The model of the vehicle the driver is driving has a fully rotating driver's seat, allowing the driver to freely interact with the passenger in the back seat while driving, so the driver can turn his back to the road and start talking to his son.

[0246] 10. Because the interior camera provides full coverage of what is happening inside the car, the OAM module 3610 is notified of this conversation activity in real time, as well as the driver's seated position. The OAM module 3610 also sees that the driver is leaning forward, slightly moving her seat closer to her son while she is talking.

[0247] During the journey:

[0248] 11. The autonomous vehicle starts moving towards the first handoff location 3710. Since this first handoff location is the most critical and is where the vehicle will require driver intervention, the HOH module 3630 starts notifying the driver early about the upcoming handoff.

[0249] 12. The HOH module 3630 knows how long it is likely to take the driver to turn and place their hands on the steering wheel.

[0250] 13. The HOH module 3630 also knows from the GOC database 3620 that older drivers generally take longer to become fully aware than younger drivers. Thus, as an example, if the driver is a 50 year old male, it may take 15-20 seconds for the driver to become fully aware of the driving context as soon as the driver places his hands on the wheel. Thus, this additional time is also taken into account by the HOH module 3630 as the handoff at location 3710 approaches.

[0251] 14. The HOH module 3630 also provides the expected response time by the driver to the EAO module 3635 to assess how the handoff will be performed. The driver responds to the handoff request by the vehicle and successfully steers the car through the incident on the road.

[0252] 15. After passing the accident site, the driver receives a call on their smartphone which is handed off to the autonomous vehicle.

[0253] 16. The EAO module 3635 begins evaluating the handoff at location 3710. The driver appears to have responded 10 seconds after the time expected by the HOH module 3630. The OAM module 3610 timestamp indicates that the driver was busy handing a toy to her son when she should have received control of the vehicle, at which point this unexpected delay occurred.

[0254] 17. This anomaly has been reported back to the HOH module 3630 for future reference to allow additional time for the planned handoff.

[0255] 18. The driver's capabilities during handoff are also reported back to the POC module 3615 for internal updates.

[0256] 19. As the vehicle approaches handoff 3720, the OAM module 3610 determines that the driver is still on the phone and appears to be signaling increasing distress.

[0257] 20. The HOH module 3630 knows that it can avoid the handoff location 3720 by following an alternate route 3715. This route adds an extra 2 minutes to the journey but allows the driver to continue the call uninterrupted.

[0258] 21. The HOH module 3630 determines that a handoff is not required at location 3720 and continues vehicle autonomy.

[0259] 22. The HOH module 3630 is aware of road construction at handoff location 3730, and because handoff at this location is not as critical as location 3710, the journey time may be slightly shorter due to human intervention.

[0260] 23. The OAM module 3610 indicates that the driver is no longer talking and is looking ahead, casually watching the traffic in front of the vehicle.

[0261] 24. The HOH module 3630 determines that the driver may take over very easily and notifies any handover which will save journey time.

[0262] 25. Deciding that a takeover to save a few more minutes would be a good idea, the driver agrees to the takeover and the handoff at location 3730 is successfully executed.

[0263] 26. The POC module 3615 is updated by the EAO module 3635 after the handoff and since no anomaly has been detected, the HOH module 3630 does not receive any notification this time.

[0264] 27. For the remainder of the journey, the driver decides not to hand off and drives in manual mode to the destination.

[0265] The above examples are merely illustrative and more or fewer, or even different, actions may be taken.Similarly, the example method of Figure 38 is also illustrative and more or fewer steps of the method may be performed.

[0266] It should also be noted that there may be situations where an autonomous vehicle has no choice but to hand off to a human driver (to meet the original objectives of the journey in terms of route, ETA, etc.), but the human driver is not in a position to take over. In such scenarios, the autonomous vehicle may choose a safer option, such as backing away and going to a safe stop until such time as the human driver can take over, heading into a slow lane and reducing travel speed according to traffic and road conditions at the expense of increased travel time, calculating an alternative route that allows the vehicle to continue without a handover (which may be longer and / or slower), or calculating an alternative route that does not allow the vehicle to continue without a handoff all the way to the final destination, but does get the vehicle to a safe stop until the human driver is ready to take over. These solutions are merely exemplary, and there may be other solutions to mandatory vehicle handoffs.

[0267] 39-40 are block diagrams of example computer architectures that may be used in accordance with embodiments disclosed herein. Other computer architecture designs known in the art of processors and computing systems may also be used. In general, computer architectures suitable for embodiments disclosed herein may include, but are not limited to, the configurations shown in FIGS. 39-40.

[0268] FIG. 39 is a diagram of an example of a processor according to one embodiment. Processor 3900 is an example of a type of hardware device that may be used in connection with the implementations described above. Processor 3900 may be any type of processor, such as a microprocessor, embedded processor, digital signal processor (DSP), network processor, multi-core processor, single-core processor, or other device that executes code. Although only one processor 3900 is shown in FIG. 39, alternatively, a processing element may include more than one processor 3900 as shown in FIG. 39. Processor 3900 may be a single-threaded core, or for at least one embodiment, processor 3900 may be multi-threaded in that it may include more than one hardware thread context (i.e., "logical processor") per core.

[0269] 39 also illustrates memory 3902 coupled to the processor 3900 according to one embodiment. The memory 3902 may be any of a wide variety of memories (including various layers of a memory hierarchy) known or otherwise available to those skilled in the art. Such memory elements may include, but are not limited to, random access memory (RAM), read only memory (ROM), logic blocks of a field programmable gate array (FPGA), erasable programmable read only memory (EPROM), and electrically erasable programmable ROM (EEPROM).

[0270] The processor 3900 may execute any type of instruction associated with an algorithm, process, or operation described herein. In general, the processor 3900 may transform elements or items (e.g., data) from one state or thing to another state or thing.

[0271] The code 3904 may be one or more instructions executed by the processor 3900 and may be stored in the memory 3902 or in software, hardware, firmware, or any suitable combination thereof, or in any other internal or external component, device, element, or object, as appropriate, based on a particular need. In one example, the processor 3900 may follow a program sequence of instructions indicated by the code 3904. Each instruction inputs the front-end logic 3906 and is processed by one or more decoders 3908. The decoder may generate as its output a micro-operation, such as a fixed-width micro-operation in a predefined format, or may generate other instructions, micro-instructions, or control signals reflective of the original code instruction. The front-end logic 3906 also generally includes register renaming logic 3910 and scheduling logic 3912 that allocate resources and queue operations corresponding to the instructions for execution.

[0272] The processor 3900 may also include execution logic 3914 having a set of execution units 3916a, 3916b, 3916n, etc. Some embodiments may include multiple execution units dedicated to a particular function or set of functions. Other embodiments may include only one execution unit, or one execution unit capable of performing a particular function. The execution logic 3914 performs the operations specified by the code instructions.

[0273] After completing execution of the operations specified by the code instructions, the back-end logic 3918 can retire the instructions of the code 3904. In one embodiment, the processor 3900 allows out-of-order execution but requires in-order retirement of instructions. The retirement logic 3920 may take various known forms (e.g., a reorder buffer, etc.). Thus, the processor 3900 is transformed during execution of the code 3904 with respect to at least the outputs generated by the decoder, the hardware registers and tables utilized by the register renaming logic 3910, and any registers (not shown) modified by the execution logic 3914.

[0274] Although not shown in Figure 39, the processing element may include other elements that are on a chip with the processor 3900. For example, the processing element may include memory control logic along with the processor 3900. The processing element may include I / O control logic and / or may include I / O control logic integrated with the memory control logic. The processing element may also include one or more caches. In some embodiments, non-volatile memory (such as flash memory or fuses) may also be included on a chip with the processor 3900.

[0275] Figure 40 illustrates a computing system 4000 arranged in a point-to-point (PtP) configuration, according to one embodiment. In particular, Figure 40 illustrates a system in which processors, memory, and input / output devices are interconnected by multiple point-to-point interfaces. In general, one or more of the computing systems described herein may be configured in the same or similar manner as computing system 3900.

[0276] The processors 4070 and 4080 may also include integrated memory controller logic (MC) 4072 and 4082, respectively, to communicate with the memory elements 4032 and 4034. In alternative embodiments, the memory controller logic 4072 and 4082 may be separate logic that is separate from the processors 4070 and 4080. The memory elements 4032 and / or 4034 may store various data used by the processors 4070 and 4080 to achieve the operations and functionality outlined herein.

[0277] The processors 4070 and 4080 may be any type of processor, such as those discussed in connection with other figures herein. The processors 4070 and 4080 may exchange data over a point-to-point (PtP) interface 4050 using point-to-point interface circuits 4078 and 4088, respectively. The processors 4070 and 4080 may exchange data with a chipset 4090 over individual point-to-point interfaces 4052 and 4054 using point-to-point interface circuits 4076, 4086, 4094, and 4098, respectively. The chipset 4090 may also exchange data with a coprocessor 4038, such as a high-performance graphics circuit, a machine learning accelerator, or other coprocessor 4038, over an interface 4039, which may be a PtP interface circuit. In an alternative embodiment, any or all of the PtP links shown in FIG. 40 may be implemented as multi-drop buses rather than PtP links.

[0278] The chipset 4090 may communicate with the bus 4020 via an interface circuit 4096. The bus 4020 may have one or more devices that communicate over the bus, such as a bus bridge 4018 and an I / O device 4016. Through the bus 4010, the bus bridge 4018 may communicate with other devices, such as a user interface 4012 (such as a keyboard, mouse, touch screen, or other input device), a communication device 4026 (such as a modem, network interface device, or other type of communication device that may communicate over a computer network 4060), an audio I / O device 4014, and / or a data storage device 4028. The data storage device 4028 may store code 4030, which may be executed by the processors 4070 and / or 4080. In alternative embodiments, any portion of the bus architecture may be implemented with one or more PtP links.

[0279] The computer system shown in Figure 40 is a schematic diagram of one embodiment of a computing system that may be utilized to implement the various embodiments discussed herein. It will be appreciated that the various components of the system shown in Figure 40 may be combined in a system-on-chip (SoC) architecture or in any other suitable configuration capable of achieving the functionality and features of the examples and implementations provided herein.

[0280] Although some of the systems and solutions described and illustrated herein are described as including or associated with multiple elements, not all elements explicitly illustrated or described may be utilized in each alternative implementation of the disclosure. In addition, one or more of the elements described herein may be located external to the system, while in other examples, a particular element may be included within or as part of one or more of the other described elements, as well as other elements not described in the illustrated implementation. Furthermore, a particular element may be combined with other components and may be used for alternative or additional purposes in addition to those described herein.

[0281] Moreover, it should be appreciated that the examples presented above are non-limiting examples provided merely for the purpose of illustrating certain principles and features, and do not necessarily limit or restrict possible implementations of the concepts described herein. For example, a variety of different embodiments can be realized utilizing various combinations of the features and components described herein, including combinations realized through various implementations of the components described herein. Other implementations, features, and details should be appreciated from the contents of this specification.

[0282] Although the present disclosure has been described with respect to specific implementations and generally associated methods, modifications and permutations of these implementations and methods will be apparent to those skilled in the art. For example, the actions described herein can be performed in a different order than described and still achieve desirable results. As an example, the processes depicted in the accompanying figures do not necessarily require the particular order or sequential order depicted to achieve desirable results. In certain implementations, multitasking and parallel processing may be advantageous. Additionally, other user interface layouts and functionality may be accommodated. Other variations are within the scope of the following claims.

[0283] Although the specification includes many specific implementation details, these should not be construed as limitations on the scope of the invention or the scope that can be claimed, but as descriptions of features specific to particular embodiments of a particular invention. Certain features described in the specification in the context of separate embodiments can also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment can also be implemented in multiple embodiments separately or in any suitable subcombination. Furthermore, although features may be described above as acting in a particular combination, and even initially claimed as such, one or more features from a claimed combination can, in some cases, be deleted from the combination, and the claimed combination may be directed to a subcombination or a variation of the subcombination.

[0284] Similarly, although operations are shown in the figures in a particular order, this should not be understood as requiring that such operations be performed in the particular order or sequential order shown, or that all of the operations shown be performed, to achieve desired results. In certain situations, multitasking and parallel processing may be advantageous. Furthermore, the separation of various system components in the embodiments described above should not be understood as requiring such separation in all embodiments, and it should be understood that the program components and systems described may generally be integrated together in a single software product or packaged in multiple software products.

[0285] One or more computing systems may be provided, including an in-vehicle computing system (e.g., used to implement at least a portion of an automated driving stack and enable automated driving of the vehicle to function), a roadside computing system (e.g., implemented separately from the vehicle in a dedicated roadside cabinet, on a traffic sign, traffic light, or light pole), one or more computing systems implementing a cloud-based or fog-based system corresponding to the autonomous driving environment, or a computing system remote from the autonomous driving environment. These computing systems may include logic implemented using one or a combination of one or more data processing units (e.g., central processing units, graphics processing units, tensor processing units, ASICs, FPGAs, etc.), accelerator hardware, other hardware circuitry, firmware, and / or software that performs or realizes one or a combination of the following embodiments (or portions thereof): For example, in various embodiments, the operations of the following example methods may be implemented using any suitable logic, such as a computing system or components thereof (e.g., processor 202, accelerator 204, communication module 212, user display 288, memory 206, IX fabric 208, driving control 220, sensor 225, user interface 230, in-vehicle processing system 210, machine learning model 256, other components, or subcomponents of any thereof) of a vehicle (e.g., 105), roadside computing device 140, fog-based or cloud-based computing system 150, drone 180, and access point 145, sensor (e.g., 165), memory 3602, processor core 3600, system 3700, other suitable computing system or device, subcomponents of any of these, or other suitable logic. In various embodiments, one or more particular operations of an example method of the following may be implemented by a particular component or system, but one or more operations of the method of implementation may be implemented by another component or system.In other embodiments, each of the operations of an example method may be performed by the same component or system.

[0286] Example 1 includes an apparatus comprising at least one interface that receives sensor data from a plurality of sensors of a vehicle; and one or more processors that autonomously control operation of the vehicle according to a route plan based on the sensor data, determine that autonomous control of the vehicle should cease, send a handoff request to a remote computing system such that the remote computing system remotely controls operation of the vehicle, receive driving instruction data from the remote computing system, and control operation of the vehicle based on instructions included in the driving instruction data.

[0287] Example 2 includes the apparatus of example 1, wherein the driving command data is generated from human user input at a remote computing system.

[0288] Example 3 includes the device of any one of Examples 1-2, wherein the one or more processors detect a evacuation event, the vehicle evacuates and stops driving in association with the evacuation event, and a handoff request is sent in response to the evacuation event.

[0289] Example 4 includes the device of any one of Examples 1 to 2, wherein determining that autonomous control of the vehicle should be stopped includes predicting, using a particular machine learning model, that conditions in the next section of the route plan will present challenges to autonomous driving during the next section.

[0290] Example 5 includes the device of any one of Examples 1-4, wherein the one or more processors determine, based on detection of one or more faulty sensors in the vehicle, that autonomous control of the vehicle should be stopped.

[0291] Example 6 includes the device of any one of examples 1-5, wherein the one or more processors determine that no eligible occupants are present in the vehicle, and the handoff request is sent based at least in part on the determination that no eligible occupants are present.

[0292] Example 7 includes the device of any one of Examples 1-6, wherein the one or more processors transmit the sensor data to a remote computing system to present a dynamic representation of the vehicle's surroundings to a human user of the remote computing system.

[0293] Example 8 includes the apparatus of example 7, wherein the sensor data comprises video data.

[0294] Example 9 includes the device of any one of examples 1-8, wherein the one or more processors communicate an alert to an occupant of the vehicle identifying that control of the vehicle is being handed over to a remote valet service.

[0295] Example 10 includes the device of any one of examples 1-9, wherein the one or more processors detect changes in conditions along the route plan and return control of the vehicle's operation from the remote computing system to the vehicle's autonomous driving logic.

[0296] Example 11 includes a computer-readable medium storing instructions that, when executed by the machine, cause the machine to autonomously control operation of the vehicle according to a route plan based on sensor data generated from a set of sensors of the vehicle, determine that autonomous control of the vehicle should cease, send a handoff request to a remote computing system such that the remote computing system remotely controls operation of the vehicle, receive driving instruction data from the remote computing system, and control operation of the vehicle based on instructions included in the driving instruction data.

[0297] Example 12 includes the medium of example 11, wherein the driving command data is generated from input of a human user at a remote computing system.

[0298] Example 13 includes the media of any one of Examples 11-12, wherein the instructions, when executed by the machine, cause the machine to detect an evacuation event, the vehicle to evacuate and cease driving in association with the evacuation event, and a handoff request is sent in response to the evacuation event.

[0299] Example 14 includes the media of any one of Examples 11 to 12, in which determining that autonomous control of the vehicle should be stopped includes predicting, using a particular machine learning model, that conditions in the next section of the route plan will present challenges to autonomous driving during the next section.

[0300] Example 15 includes the medium of any one of examples 11 to 14, in which it is determined that autonomous control of the vehicle should be stopped based on detection of one or more failed sensors in the vehicle.

[0301] Example 16 includes the medium of any one of examples 11-15, wherein the instructions, when executed by the machine, cause the machine to determine that no eligible occupants are present in the vehicle, and a handoff request is sent based at least in part on the determination that no eligible occupants are present.

[0302] Example 17 includes the medium of any one of Examples 11-16, wherein the instructions, when executed by the machine, cause the machine to send sensor data to a remote computing system to present a dynamic representation of the vehicle's surroundings to a human user of the remote computing system.

[0303] Example 18 includes the medium of example 17, wherein the sensor data comprises video data.

[0304] Example 19 includes the medium of any one of examples 11-18, wherein the instructions, when executed by the machine, cause the machine to present an alert to an occupant of the vehicle identifying that control of the vehicle will be handed over to a remote valet service.

[0305] Example 20 includes the media of any one of Examples 11-19, wherein the instructions, when executed by the machine, cause the machine to detect changes in conditions along the route plan and return control of operation of the vehicle from the remote computing system to the vehicle's autonomous driving logic.

[0306] Example 21 includes a system comprising: means for autonomously controlling operation of the vehicle according to a route plan based on sensor data generated from a set of sensors of the vehicle; means for determining that autonomous control of the vehicle should cease; means for sending a handoff request to a remote computing system such that the remote computing system remotely controls operation of the vehicle; means for receiving driving command data from the remote computing system; and means for controlling operation of the vehicle based on instructions included in the driving command data.

[0307] Example 22 includes the system of example 21, wherein the driving command data is generated from human user input at a remote computing system.

[0308] Example 23 includes the system of any of examples 21-22, further comprising a means for detecting a turnaround event, wherein the vehicle turns away and stops operating in association with the turnaround event, and the handoff request is sent in response to the turnaround event.

[0309] Example 24 includes the system of example 21, in which determining that autonomous control of the vehicle should be stopped includes predicting, using a particular machine learning model, that conditions in the next section of the route plan will present challenges to autonomous driving during the next section.

[0310] Example 25 includes a vehicle comprising a plurality of sensors that generate sensor data; a control system that physically controls movement of the vehicle; and processing circuitry that communicates with the control system to autonomously control operation of the vehicle according to a route plan based on the sensor data, determines that autonomous control of the vehicle should cease, sends a handoff request to the remote computing system such that the remote computing system remotely controls operation of the vehicle, receives driving command data from the remote computing system, and communicates with the control system to control operation of the vehicle based on instructions included in the driving command data.

[0311] Example 26 includes a method comprising: providing a user interface to a human user at a computing terminal device; receiving a handoff request from a vehicle configured to drive autonomously; receiving sensor data from a remote sensor device describing an environment surrounding the vehicle; presenting a representation of the environment in the user interface based on the sensor data; receiving user input at the computing terminal device in response to the representation, the user input having input directing driving of the vehicle within the environment; and sending instruction data corresponding to the user input to the vehicle to remotely drive the vehicle in accordance with the user input.

[0312] Example 27 includes the method of example 26, wherein the handoff request specifies a location of the vehicle.

[0313] Example 28 includes the method of example 27, further comprising determining a sensor device outside the vehicle that corresponds to the location and accessing supplemental sensor data from the sensor device, wherein the representation is presented based at least in part on the supplemental sensor data.

[0314] Example 29 includes the method of any one of examples 26-28, wherein the sensor device comprises an on-vehicle sensor device.

[0315] Example 30 includes the method of any one of examples 26-29, wherein the sensor device comprises a sensor device separate from the vehicle.

[0316] Example 31 includes the method of any one of Examples 26-30, further including receiving a request from the vehicle to return control of operation of the vehicle to the vehicle, sending a confirmation of the return of control to the vehicle, and stopping transmission of command data to the vehicle.

[0317] Example 32 includes the method of any one of Examples 26 to 30, further comprising generating reporting data describing the vehicle's environment and performance based on user input during control of the vehicle by the remote valet service, and sending the reporting data to a cloud-based system.

[0318] Example 33 includes a system comprising means for carrying out the method of any one of examples 26 to 32.

[0319] Example 34 includes the system of Example 33, wherein the means has a computer-readable medium storing instructions that, when executed by the machine, cause the machine to perform at least a portion of the method of any one of Examples 26 to 32.

[0320] Example 35 includes a method comprising generating sensor data from a set of sensors in a vehicle, determining a route plan for the vehicle, autonomously controlling driving of the vehicle according to the route plan based on one or more machine learning models and the sensor data, identifying a condition in a next portion of the route plan, determining an opportunity to hand off control of driving of the vehicle to a remote valet service based on the condition, sending a handoff request to a remote computing system providing the remote valet service based on the opportunity, receiving driving instruction data from the remote computing system, and automating driving of the vehicle in response to instructions included in the instruction data.

[0321] Example 36 includes the method of example 35, further comprising sending reporting data identifying the handoff and a condition corresponding to the handoff to another computing system.

[0322] Example 37 includes the method of example 36, wherein the reporting data is sent to a cloud-based application.

[0323] Example 38 includes the method of any one of examples 36-37, wherein the reporting data is sent to the roadside unit.

[0324] Example 39 includes the method of any one of examples 35-38, wherein the condition is identified from data received from another computing system.

[0325] Example 40 includes the method of example 39, wherein the conditions are identified by applying a machine learning model and data from another system is provided as input to the machine learning model.

[0326] Example 41 includes the method of example 40, wherein the machine learning model is trained based on data reporting to other instances either a handoff to a remote valet service or an evacuation event.

[0327] Example 42 includes the method of any one of Examples 35-41, wherein the handoff request is sent to avoid an evacuation event.

[0328] Example 43 includes the method of any one of examples 35-42, where the opportunity corresponds to a prediction that the autonomous driving functionality of the vehicle will not function satisfactorily in light of the conditions.

[0329] Example 44 includes the method of any one of examples 35-43, wherein the opportunity is determined based at least in part on information included in the sensor data.

[0330] Example 45 includes the method of any one of examples 35-44, further comprising accessing additional data; predicting improvement in conditions in another portion of the route plan following the next route based on the additional data; and, based on the predicted improvement in conditions, sending request data to the remote computing system requesting that control be returned to the vehicle; and resuming autonomous control of operation of the vehicle.

[0331] Example 46 includes the method of any one of examples 35-45, wherein determining an opportunity to hand off control comprises detecting an evacuation event.

[0332] Example 47 includes the method of example 46, further comprising determining a condition from the sensor data associated with the evacuation event and uploading data describing the condition to a remote computing system.

[0333] Example 48 includes a system comprising means for carrying out the method of any one of examples 35 to 47.

[0334] Example 49 includes the system of example 48, wherein the means has a computer-readable medium storing instructions that, when executed by the machine, cause the machine to perform at least a portion of the method of any one of examples 35 to 47.

[0335] Example 50 includes a method comprising: generating a first set of one or more control signals in response to a human input to a vehicle; and, in response to a determination that the first set of one or more control signals would cause unacceptable acceleration, identifying an acceptable acceleration, converting the acceptable acceleration to a second set of one or more control signals, and providing the second set of one or more control signals to a vehicle actuation system in place of the first set of one or more control signals.

[0336] Example 51 includes the method of example 50, further comprising receiving a range of acceptable acceleration values ​​and identifying an acceptable acceleration from the range of acceptable acceleration values.

[0337] Example 52 includes the method of example 51, wherein the range of allowable acceleration values ​​is determined according to an accident avoidance mathematical model.

[0338] Example 53 includes the method of any of examples 51-52, wherein the range of allowable acceleration values ​​is determined according to a liability-aware safety model.

[0339] Example 54 includes any of the methods of examples 50-53, wherein determining that the one or more control signals will cause unacceptable acceleration includes using a machine learning model to convert the one or more control signals into an expected acceleration.

[0340] Example 55 includes any of the methods of examples 50-54, wherein converting the allowable acceleration into a second set of one or more control signals includes converting the allowable acceleration based on a context associated with the vehicle, the context being determined based on input received via one or more sensors of the vehicle.

[0341] Example 56 includes the method of example 55, wherein the input received via one or more sensors of the vehicle indicates one or more of road surface conditions, weather conditions, tire conditions, or road layout.

[0342] Example 57 includes any of the methods of examples 50-56, wherein converting the allowable acceleration to a second set of one or more control signals includes converting the allowable acceleration based on a weight of the vehicle.

[0343] Example 58 includes any of the methods of examples 50-57, wherein identifying the acceptable acceleration includes selecting the acceptable acceleration from a range of acceptable acceleration based on policy information provided by a driver of the vehicle.

[0344] Example 59 includes the method of any of examples 50-58, further comprising: generating a third set of one or more control signals in response to a human input to the vehicle; and providing the third set of one or more control signals unchanged to the vehicle actuation system in response to a determination that the third set of one or more control signals would cause acceptable acceleration.

[0345] Example 60 includes an apparatus comprising a memory and processing circuitry coupled to the memory for performing one or more of the methods of examples 50-59.

[0346] Example 61 includes a system comprising means for performing one or more of the methods of examples 50-59.

[0347] Example 62 includes at least one machine-readable medium comprising instructions that, when executed, actualize an apparatus or implement a method such as any one of Examples 50-59.

[0348] Example 63 includes a method comprising determining, by a computing system of the vehicle, a signal quality metric based on sensor data and a context of the sensor data, determining a safety likelihood associated with a handoff of control of the vehicle based on the signal quality metric, and preventing or initiating a handoff of control of the vehicle based on the safety likelihood.

[0349] Example 64 includes the method of example 63, further comprising determining a context of the sensor data based on the sensor data using a machine learning model.

[0350] Example 65 includes the method of any of Examples 63-64, further comprising using a machine learning model to determine the likelihood of safety based on the signal quality metric.

[0351] Example 66 includes the method of any of Examples 63-65, further comprising using a machine learning model to determine a signal quality metric based on the sensor data and a context of the sensor data.

[0352] Example 67 includes the method of any of examples 63-66, further comprising periodically determining a safety probability associated with handing off control of the vehicle while the vehicle is autonomously controlled.

[0353] Example 68 includes any of the methods of examples 63-67, further comprising determining a safety probability associated with handing off control of the vehicle in response to a request from a human driver to hand off control of the vehicle.

[0354] Example 69 includes the method of any of examples 63-68, further comprising determining a safety probability associated with handing off control of the vehicle in response to the vehicle entering an area where a high definition map of the area is unavailable to the vehicle.

[0355] Example 70 includes the method of any of examples 63-69, wherein the signal quality metric at least partially indicates a signal-to-noise ratio of the sensor data.

[0356] Example 71 includes the method of any of examples 63-70, wherein the signal quality metric at least partially indicates the resolution of the sensor data.

[0357] Example 72 includes an apparatus comprising a memory and processing circuitry coupled to the memory for performing one or more of the methods of examples 63-71.

[0358] Example 73 includes a system comprising means for performing one or more of the methods of Examples 63-71.

[0359] Example 74 includes at least one machine-readable medium comprising instructions that, when executed, actualize an apparatus or implement a method such as any one of Examples 63-71.

[0360] Example 75 includes a method comprising collecting sensor data from at least one sensor located inside a vehicle, analyzing the sensor data to determine a physical state of a person inside the vehicle, and generating a handoff decision indicating whether the person is expected to be able to safely operate the vehicle based at least in part on the physical state of the person.

[0361] Example 76 includes the method of example 75, further comprising identifying historical driving data of a person within the vehicle and generating a handoff decision further based on the historical driving data of the person.

[0362] Example 77 includes any of the methods of examples 75-76, further comprising analyzing the sensor data to determine a context indicative of conditions outside the vehicle, and generating a handoff decision further based on the context.

[0363] Example 78 includes the method of any of examples 75-77, wherein the physical state of the person inside the vehicle is based at least in part on sensor data comprising image data of the person inside the vehicle.

[0364] Example 79 includes the method of any of examples 75-78, wherein the physical state of the person inside the vehicle is based at least in part on sensor data comprising voice data of the person inside the vehicle.

[0365] Example 80 includes the method of any of examples 75-79, wherein the physical condition of the person inside the vehicle is based at least in part on sensor data comprising temperature data of the person inside the vehicle.

[0366] Example 81 includes the method of any of examples 75-80, wherein the physical state of the person inside the vehicle is based at least in part on sensor data comprising pressure data from a tactile sensor.

[0367] Example 82 includes any of the methods of examples 75-81, wherein the physical condition of the person inside the vehicle is based at least in part on data received from a health tracking device worn by the person.

[0368] Example 83 includes the method of any of Examples 75-82, further comprising determining a particular activity performed by a person inside the vehicle based on the sensor data, wherein a physical state of the person inside the vehicle is based at least in part on the determined activity.

[0369] Example 84 includes the method of any of Examples 75-83, further comprising preprocessing audio data of the sensor data to isolate sounds produced by a person or one or more occupants inside the vehicle, and the physical state of the person inside the vehicle is based at least in part on the preprocessed audio data.

[0370] Example 85 includes the method of any of examples 75-84, wherein the sensor data has one or more of media being played in the vehicle, a light level inside the vehicle, an amount of interaction between the person and one or more dashboard controls, a window opening level, a status of the in-vehicle climate control system, or a status of the person's phone.

[0371] Example 86 includes any of the methods of examples 75-85, wherein the physical state of the person is performed using a machine learning algorithm using the sensor data as input.

[0372] Example 87 includes the method of any of examples 75-86, further comprising using a machine learning algorithm to generate the handoff decision.

[0373] Example 88 includes an apparatus that performs one or more of the methods of examples 75-87, comprising a memory and processing circuitry coupled to the memory.

[0374] Example 89 includes a system comprising means for performing one or more of the methods of examples 75-87.

[0375] Example 90 includes at least one machine-readable medium comprising instructions that, when executed, actualize an apparatus or implement a method such as any one of Examples 1-13.

[0376] Example 91 includes a method comprising: operating, by a controller of the autonomous vehicle, an autonomous vehicle in an autonomous driving mode; receiving a request to take over control of the autonomous vehicle by an entity other than the controller; in response to receiving the request to take over control of the autonomous vehicle, prompting authentication information of the requesting entity; receiving input in response to the prompt; and in response to authentication of the requesting entity based on the received input, granting the request to take over control of the autonomous vehicle.

[0377] Example 92 includes the method of example 91, wherein prompting the requesting entity for authentication information includes prompting the requesting entity to provide a biometric for authentication.

[0378] Example 93 includes the method of example 92, wherein the biometric authentication includes one or more of a fingerprint, a voice sample for voice recognition, and a face sample for face recognition.

[0379] Example 94 includes the method of any one of examples 91-93, wherein the requesting entity includes a person inside the autonomous vehicle.

[0380] Example 95 includes the method of any one of examples 91-93, wherein the requesting entity includes a person remote from the autonomous vehicle.

[0381] Example 96 includes the method of any one of examples 91-93, where the requesting entity includes one or more other autonomous vehicles in proximity to the autonomous vehicle.

[0382] Example 97 includes an apparatus comprising a memory and processing circuitry coupled to the memory for performing one or more of the methods of examples 91-96.

[0383] Example 98 includes a system comprising means for performing one or more of the methods of Examples 91-96.

[0384] Example 99 includes an article of manufacture comprising one or more tangible computer-readable non-transitory storage media having computer-executable instructions operable, when executed by at least one computer processor, to enable the at least one computer processor to perform the operations of the methods of Examples 91-96.

[0385] Example 100 includes a method comprising operating an autonomous vehicle controlled based on human input in a manual operating mode, receiving sensor data from a plurality of sensors within the autonomous vehicle, detecting that the human input is unsafe based on an analysis of the sensor data, and operating the autonomous vehicle in an autonomous operating mode in response to detecting the unsafe human input.

[0386] Example 101 includes the method of example 100, wherein detecting that the human input is unsafe includes one or more of determining that the human providing the input is distracted, determining that the human providing the input has an impairment, and determining that the human providing the input is unconscious.

[0387] Example 102 includes an apparatus that performs one or more of the methods of Examples 100-101, comprising a memory and processing circuitry coupled to the memory.

[0388] Example 103 includes a system comprising means for performing one or more of the methods of Examples 100-101.

[0389] Example 104 includes an article of manufacture comprising one or more tangible computer-readable non-transitory storage media having computer-executable instructions operable, when executed by at least one computer processor, to enable the at least one computer processor to perform the operations of the methods of Examples 100-101.

[0390] Example 105 includes a method comprising: operating, by a control system of the autonomous vehicle, the autonomous vehicle in an autonomous operating mode based on sensor data obtained from a plurality of sensors coupled to the autonomous vehicle; detecting, by the control system of the autonomous vehicle, a takeover request by an occupant of the autonomous vehicle; determining, by the control system of the autonomous vehicle based on the sensor data, whether the requested takeover is safe; and preventing the requested takeover in response to a determination that the requested takeover is not safe.

[0391] Example 106 includes the method of example 105, further comprising modifying the autonomous operating mode in response to determining that the requested takeover is not safe.

[0392] Example 107 includes the method of example 106, further comprising prompting an occupant for input in response to the decision and receiving input from the occupant in response to the prompt, wherein modifying the autonomous operation mode is based on the received input.

[0393] Example 108 includes the method of example 105, wherein the plurality of sensors coupled to the autonomous vehicle includes an internal sensor within the autonomous vehicle, and determining whether the requested takeover is safe is based on sensor data received from the internal sensor.

[0394] Example 109 includes the method of example 108, wherein the internal sensor includes one or more of a camera and a microphone.

[0395] Example 110 includes the method of any one of examples 105-109, further comprising, in response to determining that the requested takeover is legitimate, granting the takeover request.

[0396] Example 111 includes the method of any one of examples 105-109, further comprising, in response to determining that the requested takeover is not safe, blocking the takeover request.

[0397] Example 112 includes any one of the methods of examples 105-111, wherein the determination of whether the requested takeover is unsafe is performed during a sensing / perception phase of the autonomous driving pipeline.

[0398] Example 113 includes the method of any one of examples 105-112, wherein blocking the requested takeover is performed during a behavior / control phase of the autonomous driving pipeline.

[0399] Example 114 includes the method of example 107, in which the modification of the autonomous operation mode is implemented during a planning phase of the autonomous driving pipeline.

[0400] Example 115 includes an apparatus comprising a memory and processing circuitry coupled to the memory for performing one or more of the methods of Examples 105-114.

[0401] Example 116 includes a system comprising means for performing one or more of the methods of Examples 105-114.

[0402] Example 117 includes an article of manufacture comprising one or more tangible computer-readable non-transitory storage media having computer-executable instructions operable, when executed by at least one computer processor, to enable the at least one computer processor to perform the operations of the methods of Examples 105-114.

[0403] Example 118 includes a method comprising: monitoring, by a supervisory system, at least one subsystem of an autonomous vehicle; and initiating, by the supervisory system, a change in an autonomy level of the autonomous vehicle from a first autonomy level to a second autonomy level based on the monitoring of the at least one subsystem.

[0404] Example 119 includes the method of example 118, further comprising communicating the change in the autonomy level of the autonomous vehicle to a remote surveillance system.

[0405] Example 120 includes the method of any of examples 118-119, further comprising recording a history of the autonomy level and the sensor state over time.

[0406] Example 121 includes the method of any of examples 118-120, wherein at least one of the subsystems includes a sensor subsystem, and the change in the level of autonomy is based at least in part on the change to the sensor subsystem.

[0407] Example 122 includes any one or more of the methods of examples 118-121, wherein at least one of the subsystems has a planning subsystem, and the change in the level of autonomy is based at least in part on the change to the planning subsystem.

[0408] Example 123 includes any one or more of the methods of examples 118-122, wherein at least one of the subsystems has an executive subsystem, and the change in the level of autonomy is based at least in part on the change to the executive subsystem.

[0409] Example 124 includes any one or more of the methods of Examples 118-123, in which the supervisory system monitors the functional assurance of at least one subsystem.

[0410] Example 125 includes any one or more of the methods of Examples 118-124, in which the comprehensive cognitive supervision system monitors quality assurance of at least one subsystem.

[0411] Example 126 includes an apparatus comprising a memory and processing circuitry coupled to the memory for performing one or more of the methods of examples 118-125.

[0412] Example 127 includes a system comprising means for performing one or more of the methods of Examples 118-125.

[0413] Example 128 includes at least one machine-readable medium comprising instructions that, when executed, actualize an apparatus or implement a method such as any one of Examples 118-125.

[0414] Example 129 includes a method comprising determining a system failure of an autonomous vehicle, determining that an autonomy level of the autonomous vehicle can be reduced to a first level that does not require driver takeover, alerting the driver when the autonomy level is reduced to the first level, and reducing the autonomy level to the first level.

[0415] Example 130 includes the method of example 129, further comprising determining that there is an additional system failure of the autonomous vehicle, determining that the autonomy level can be reduced to a second level, alerting the driver when the autonomy level is reduced to the second level, and reducing the autonomy level to the second level.

[0416] Example 131 includes the method of any one or more of examples 129-130, further comprising verifying driver engagement.

[0417] Example 132 includes the method of example 131, where the driver involvement includes monitoring the driver.

[0418] Example 133 includes any one or more of the methods of examples 129-132, further comprising determining that there is an additional system failure of the autonomous vehicle, determining that the vehicle's autonomy should be deactivated, and attempting a handoff to the driver in response to determining that the vehicle's autonomy should be deactivated.

[0419] Example 134 includes the method of example 133, further comprising determining whether the handoff was successful.

[0420] Example 135 includes the method of example 134, further comprising deactivating vehicle autonomy if the handoff is successful.

[0421] Example 136 includes the method of example 134, further comprising activating an emergency system if the handoff is unsuccessful.

[0422] Example 137 includes the method of example 136, in which the emergency system safely stops the autonomous vehicle.

[0423] Example 138 includes a system comprising means for implementing any one or more of examples 129-137.

[0424] Example 139 includes the system of example 138, wherein the means has at least one machine-readable medium having instructions thereon, which, when executed, realizes any one or more of the methods of examples 129 to 137.

[0425] Example 140 includes a method comprising determining at least one handoff location of an autonomous vehicle to a driver along a route, receiving information related to characteristics of the driver, receiving information related to a current attention state of the driver, and determining expected driver behavior while at each of the at least one handoff location.

[0426] Example 141 includes the method of example 140, wherein the information relating to the driver's characteristics comprises general information.

[0427] Example 142 includes the method of any one or more of examples 140-141, where the information related to the driver characteristic comprises driver-specific information.

[0428] Example 143 includes any one or more of the methods of examples 140-142, further comprising determining whether the driver is ready for handoff.

[0429] Example 144 includes the method of example 143, further comprising handing over control of the vehicle to the driver in response to determining that the driver is ready for the handoff.

[0430] Example 145 includes the method of example 143, further comprising calculating a handoff alternative if the driver is not ready for the handoff.

[0431] Example 146 includes the method of example 145, where the alternative includes finding an alternative route.

[0432] Example 147 includes the method of example 145, where the alternative includes stopping the vehicle.

[0433] Example 148 includes the method of any one or more of examples 140-147, further comprising updating information related to the driver's characteristics.

[0434] Example 149 includes a system comprising means for implementing any one or more of Examples 140-148.

[0435] Example 150 includes the system of example 149, wherein the means has at least one machine-readable medium having instructions thereon, which, when executed, realizes any one or more of the methods of examples 140 to 148.

[0436] Example 151 includes a system comprising a vehicle occupant activity monitoring module, a personalized vehicle occupant capability database, a general vehicle occupant capability database, a handoff prediction module, a performance assessment and optimization module, and a handoff handling module.

[0437] Thus, certain embodiments of the subject matter have been described. Other embodiments are within the scope of the following claims. In some cases, the actions recited in the claims can be performed in a different order and still achieve desirable results. In addition, the processes depicted in the accompanying figures do not necessarily require the particular order shown, or sequential order, to achieve desirable results. Other possible claims (Item 1) at least one interface for receiving sensor data from a plurality of sensors of the vehicle; one or more processors, Autonomously controlling the operation of the vehicle according to a route plan based on the sensor data; Deciding that the autonomous control of said vehicle should be stopped; sending a handoff request to the remote computing system so that the remote computing system remotely controls operation of the vehicle; receiving driving command data from the remote computing system; one or more processors for controlling operation of the vehicle based on instructions included in the driving instruction data; An apparatus comprising: (Item 2) 2. The apparatus of claim 1, wherein the driving instruction data is generated from input of a human user at the remote computing system. (Item 3) 2. The apparatus of claim 1, wherein the one or more processors detect an evacuation event, the vehicle evacuates and ceases operation in association with the evacuation event, and the handoff request is sent in response to the evacuation event. (Item 4) 2. The apparatus of claim 1, wherein determining that the autonomous control of the vehicle should be stopped includes predicting, using a specific machine learning model, that conditions in a next section of the route plan will present challenges to autonomous driving during the next section. (Item 5) 2. The apparatus of claim 1, wherein the one or more processors determine that autonomous control of the vehicle should be stopped based on detection of one or more faulty sensors of the vehicle. (Item 6) 2. The apparatus of claim 1, wherein the one or more processors determine that no eligible occupants are present in the vehicle, and the handoff request is sent based at least in part on a determination that no eligible occupants are present. (Item 7) 2. The apparatus of claim 1, wherein the one or more processors transmit the sensor data to the remote computing system to present a dynamic representation of the vehicle's surroundings to a human user of the remote computing system. (Item 8) Item 8. The apparatus of item 7, wherein the sensor data comprises video data. (Item 9) 2. The apparatus of claim 1, wherein the one or more processors communicate an alert to an occupant of the vehicle identifying that control of the vehicle will be handed over to a remote valet service. (Item 10) said one or more processors: Detecting changes in conditions along the route plan; returning control of the operation of the vehicle from the remote computing system to autonomous driving logic of the vehicle. Item 1. The device according to item 1. (Item 11) storing instructions that, when executed by a machine, cause the machine to: Autonomously controlling the operation of the vehicle according to a path plan based on sensor data generated from a set of sensors on the vehicle; determining that autonomous control of the vehicle should cease and sending a handoff request to the remote computing system such that the remote computing system remotely controls operation of the vehicle; receiving driving command data from said remote computing system; controlling the driving of the vehicle based on instructions included in the driving command data; Computer-readable medium. (Item 12) 12. The medium of claim 11, wherein the driving command data is generated from input of a human user at the remote computing system. (Item 13) Item 12. The medium of item 11, wherein the instructions, when executed by a machine, cause the machine to detect an evacuation event, cause the vehicle to evacuate and cease operation in association with the evacuation event, and the handoff request is sent in response to the evacuation event. (Item 14) 12. The medium of claim 11, wherein determining that autonomous control of the vehicle should be stopped includes predicting, using a specific machine learning model, that conditions in a next section of the route plan will present challenges to autonomous driving during the next section. (Item 15) 12. The medium of claim 11, wherein a determination is made that autonomous control of the vehicle should be stopped based on detection of one or more faulty sensors in the vehicle. (Item 16) 12. The medium of claim 11, wherein the instructions, when executed by a machine, cause the machine to determine that a qualified occupant is not present in the vehicle, and wherein the handoff request is sent based at least in part on the determination that a qualified occupant is not present. (Item 17) 12. The medium of claim 11, wherein the instructions, when executed by a machine, cause the machine to transmit the sensor data to the remote computing system to present a dynamic representation of the vehicle's surroundings to a human user of the remote computing system. (Item 18) Item 18. The medium of item 17, wherein the sensor data comprises video data. (Item 19) Item 12. The medium of item 11, wherein the instructions, when executed by a machine, cause the machine to present an alert to an occupant of the vehicle identifying that control of the vehicle will be handed over to a remote valet service. (Item 20) The instructions, when executed by a machine, cause the machine to: Detecting changes in conditions along the route plan; returning control of the operation of the vehicle from the remote computing system back to autonomous driving logic of the vehicle. Item 12. The medium according to item 11. (Item 21) means for autonomously controlling operation of the vehicle according to a route plan based on sensor data generated from a set of sensors of the vehicle; means for determining that autonomous control of the vehicle should be stopped; means for sending a handoff request to a remote computing system so that the remote computing system remotely controls operation of the vehicle; means for receiving driving instruction data from said remote computing system; means for controlling the driving of the vehicle based on instructions included in the driving command data; A system comprising: (Item 22) 22. The system of claim 21, wherein the driving command data is generated from input of a human user at the remote computing system. (Item 23) 22. The system of claim 21, further comprising means for detecting an evacuation event, the vehicle evacuating and ceasing operation in association with the evacuation event, and the handoff request being sent in response to the evacuation event. (Item 24) 22. The system of claim 21, wherein determining that autonomous control of the vehicle should be stopped includes predicting, using a specific machine learning model, that conditions in a next section of the route plan will present challenges to autonomous driving during the next section. (Item 25) A plurality of sensors generating sensor data; A control system that physically controls the movement of the vehicle; Processing circuitry, autonomously controlling operation of the vehicle according to a route plan based on the sensor data by communicating with the control system; Deciding that the autonomous control of said vehicle should be stopped; sending a handoff request to the remote computing system so that the remote computing system remotely controls operation of the vehicle; receiving driving command data from the remote computing system; processing circuitry for communicating with the control system to control operation of the vehicle based on instructions contained in the driving command data; A vehicle equipped with: (Item 26) determining at least one handoff location of the autonomous vehicle to a driver along the route; Receiving information related to a driver characteristic; receiving information relating to a current attention state of the driver; determining an expected driver behavior while at each of said at least one handoff location; and A method comprising: (Item 27) generating a first set of one or more control signals in response to a human input to the vehicle; in response to determining that the first set of one or more control signals would cause unacceptable acceleration; Identify acceptable accelerations, converting the allowable acceleration into a second set of one or more control signals; providing the second set of one or more control signals to a vehicle operation system in place of the first set of one or more control signals; A method comprising: (Item 28) operating, by a controller of an autonomous vehicle, the autonomous vehicle in an autonomous driving mode; receiving a request to take over control of the autonomous vehicle by an entity other than the controller; in response to receiving the request to take over control of the autonomous vehicle, prompting the requesting entity for authentication information; receiving input in response to said prompt; granting the request to take over control of the autonomous vehicle in response to authentication of the requesting entity based on the received input; A method comprising: (Item 29) operating, by a control system of the autonomous vehicle, the autonomous vehicle in an autonomous mode of operation based on sensor data obtained from a plurality of sensors coupled to the autonomous vehicle; detecting, by the control system of the autonomous vehicle, a takeover request by an occupant of the autonomous vehicle; determining, by the control system of the autonomous vehicle, whether the requested takeover is safe based on the sensor data; blocking the requested takeover in response to determining that the requested takeover is unsafe; and A method comprising: (Item 30) Determining a system failure of the autonomous vehicle; determining that a level of autonomy of the autonomous vehicle can be reduced to a first level that does not require driver takeover; alerting the driver when the autonomy level is reduced to the first level; reducing the autonomy level to the first level; A method comprising:

Claims

1. generating a first set of one or more control signals in response to a human input to the vehicle; identifying an acceptable acceleration in response to determining that the first set of one or more control signals would cause an unacceptable acceleration; converting the allowable acceleration into a second set of one or more control signals; providing the second set of one or more control signals to a vehicle operation system in place of the first set of one or more control signals.

2. receiving a range of acceptable acceleration values; The method of claim 1 , further comprising: identifying the acceptable acceleration from the range of acceptable acceleration values.

3. The method of claim 2 , wherein the range of acceptable acceleration values ​​is determined according to an accident avoidance mathematical model.

4. The method according to claim 2 or 3, wherein the range of permissible acceleration values ​​is determined according to a liability-aware safety theory model.

5. 5. The method of claim 1, wherein determining that the first set of one or more control signals will cause the unacceptable acceleration comprises converting the first set of one or more control signals into an expected acceleration using a machine learning model.

6. translating the allowable acceleration into the second set of one or more control signals comprises translating the allowable acceleration based on a context associated with the vehicle; The method of claim 1 , wherein the context is determined based on inputs received via one or more sensors of the vehicle.

7. The method of claim 6 , wherein the input received via the one or more sensors of the vehicle is indicative of one or more of a road surface condition, a weather condition, a tire condition, or a road layout.

8. 8. The method of claim 1, wherein converting the allowable acceleration into the second set of one or more control signals comprises converting the allowable acceleration based on a weight of the vehicle.

9. 9. The method of claim 1, wherein identifying the acceptable acceleration comprises selecting the acceptable acceleration from a range of acceptable accelerations based on policy information provided by a driver of the vehicle.

10. generating a third set of one or more control signals in response to a human input to the vehicle; 10. The method of claim 1, further comprising: in response to determining that the third set of one or more control signals would cause acceptable acceleration, providing the third set of one or more control signals unchanged to the vehicle operation system.

11. 11. An apparatus comprising a memory and processing circuitry coupled to the memory for implementing the method of any one of claims 1 to 10.

12. A system comprising means for carrying out the method according to any one of claims 1 to 10.

13. A program which, when executed by a computer, causes the computer to implement the method according to any one of claims 1 to 10.

14. A computer readable storage medium storing the program according to claim 13.

Images