Patent Description:
During the last couple of years, there has been a number of terrorist attacks involving vehicles, so called vehicle-ramming attacks. The vehicle, often a heavy vehicle such as a truck, is driven into crowds of pedestrians, resulting in large number of casualties and wounded. Notable attacks include the attack in Nice July <NUM>, <NUM> which resulted in <NUM> deaths. Attacks have also been carried out in, for example, London, Barcelona, Stockholm, Jerusalem and Berlin. It seems that the number of attacks has increased lately.

Vehicle-ramming requires little skill by the perpetrator and has the potential to cause large numbers of casualties. The vehicles are often stolen or hijacked by the terrorists shortly before the attack. The subsequent attack typically occurs where the streets are crowded with pedestrians.

Protective measures against vehicle ramming includes placing blocking objects, such as bollards, at locations where there is a high density of pedestrians.

Furthermore, modern cars with drive-by-wire systems or autonomous systems could be hijacked from a distance by using remote control. Moreover, such vehicles could possibly have bugs or viruses that causes them to drive dangerously, without any terrorist.

<CIT> discloses a method as well as a system to stop or slow down a vehicle in an emergency, comprising a microphone for detecting sound in the vicinity, where a predefined sound pattern can make the vehicle stop. However, <CIT> is silent with regard to ramming attacks and does not propose that a sound pattern should be detected more than once within a time window.

In a first aspect of the invention there is provided a method to stop or slow down a vehicle in an emergency, the method involving a vehicle comprising an emergency stop system which is able to cause the vehicle to stop or slow down, said emergency stop system comprising at least one microphone for detecting sounds in the vicinity of the vehicle, and a sound analysis unit for analysing sound, the method involving the steps: a) the microphone of the emergency stop system receiving a sound and sending a signal representing the sound to the sound analysis unit, b) the sound analysis unit of the emergency stop system determining that the received sound comprises a predetermined sound pattern, c) the emergency stop system causing the vehicle to stop or slow down, where the emergency stop system of the vehicle must detect a predetermined sound pattern at least a first time from a first user and a second time from a second user within a predetermined time window in order to cause the vehicle to stop or slow down.

The sound pattern may be a predefined spoken word.

This enables persons that are not driving a vehicle, for example pedestrians, to stop a vehicle, thereby providing a crowd sourcing solution for prevention of vehicle ramming attacks.

In one embodiment the emergency stop system of the vehicle must detect a predetermined sound pattern at least a first time from a first user and a second time from a second user within a predetermined time window in order to cause the vehicle to stop or slow down.

It may be determined that there are two different users by determining that the sound comes from different positions. The emergency stop system may have a plurality of microphones and the plurality of microphones may be used to determine the position from where the sound is made.

When the predetermined sound pattern is a spoken word, the emergency stop system may have speech recognition software and use the speech recognition software to determines that the word has been uttered by two different users.

The predetermined sound pattern may be associated with for example fear or danger.

In a second aspect of the invention there is provided an emergency stop system for a vehicle, the emergency stop system being able to cause a vehicle to stop or slow down, said emergency stop system comprising a memory for storing software, a processor and a communications interface and at least one microphone for detecting sounds in the vicinity of the vehicle, and a sound analysis unit for analysing and detecting sound said sound analysis unit comprising a speech recognition software able to identify a particular predetermined spoken word, the sound analysis unit being configured to receive a signal representing the sound from the microphone and to identify at least one predetermined sound pattern, and configured to immediately cause the emergency stop system to stop or slow down the vehicle when the sound analysis unit has identified the predetermined sound pattern, where the speech recognition software is able to distinguish voices of different users, characterized in that the speech recognition software is able to determine that the particular spoken word has been uttered by two different users within a predetermined time window.

The emergency stop system may have a plurality of microphones and a direction determination software configured to use the sound from the plurality of microphones for determining the location of the sound. The sound analysis unit may be able to identify a predetermined sound made by a portable device.

In a third aspect of the invention there is provided a vehicle comprising an emergency stop system according to the second aspect of the invention.

In a fourth aspect of the invention there is provided a vehicle control system comprising an emergency stop system and a portable device for making a predetermined sound.

The systems and methods herein can also be used for stopping a taxi on the street, when a user stands on the street and needs a taxi for a ride. The user can then, by uttering a predetermined word, make the taxi stop.

The accompanying drawings form a part of the specification and schematically illustrate preferred embodiments of the invention, and serve to illustrate the principles of the invention.

Vehicle <NUM> may be any type of powered vehicle such as a car, truck, pick-up, bus or tractor. The vehicle <NUM> may preferably be a vehicle that is capable of driving at a speed of more than <NUM>/h, even more preferably more than <NUM>/hour and most preferably <NUM>/h and most preferably faster than <NUM>/hour. The vehicle <NUM> is preferably adapted to drive on a road using wheels. Any type of propulsion may be used by the vehicle <NUM>. The vehicle <NUM> can be powered by for example a combustion engine, such as a gasoline or a diesel engine, or an electric motor. The electric engine may be powered by, for example a battery a solar cell or a fuel cell.

The vehicle <NUM> has various vehicle subsystems. Such vehicle subsystems may be, for example, the braking system, the ignition system, the fuel injection system, battery or electric power supply. Other example of such vehicle subsystems includes Advanced driver-assistance system (ADAS) that is able to control speed, brake and steering. The vehicle may also be a completely automatous car (self-driving car) vehicle and thus have a vehicle subsystem that has autonomous control over the vehicle (autonomous control subsystem).

The vehicle is preferably a vehicle that is controlled by a driver, typically with a steering wheel and one or more devices to control speed such as a gas (or speed pedal), possibly assisted by an ADAS. Thus vehicle <NUM> is preferably a non-autonomous vehicle, in certain embodiments.

The vehicle <NUM> is equipped with an emergency stop system <NUM>, as seen in <FIG>. The emergency stop system is referred to as "stopping system <NUM>" in certain non-emergency embodiments described below. The general purpose of the emergency stop system <NUM> is to enable persons that are not driving the vehicle <NUM> to stop or slow down the vehicle <NUM>. The person not driving the vehicle <NUM>, who may be a pedestrian, a biker, a passenger in a car nearby, a passenger in the vehicle <NUM>, for example a bus passenger, is referred to as "user <NUM>" hereafter. User <NUM> is preferably a person that can control vehicle <NUM> solely with the methods described herein, thus user <NUM> does not have any other means to stop or control the vehicle, such as a key, fob or remote control other than as described herein.

The emergency stop system <NUM> has a stop activator <NUM> that is connected to at least one vehicle subsystem of the vehicle, for example one or more braking systems, speed control systems, gas pedal, fuel injection, ignition, battery, electric power supply, or be interfaced with, or be a part of, an ADAS or an autonomous car system. The stop activator <NUM> may be software that interacts or is a part of other software of the vehicle <NUM>, and may have electronic or mechanical parts that interact with other vehicle subsystems of the vehicle <NUM>.

The stop activator <NUM> is controlled by the emergency stop system <NUM>. The emergency stop system <NUM> can receive input from various sources, for example portable electronic device <NUM>, pressing sensor <NUM>, microphone <NUM>, and then activate the stop activator <NUM>, causing the vehicle <NUM> to stop or slow down.

The stop activator <NUM> typically overrides the controls of the driver, for example by stopping fuel injection, activating a brake or stop electric power to the motor in the case of an electric car. The stop activator <NUM> may provide instructions to software subsystems of vehicle <NUM> that causes the vehicle <NUM> to stop or slow down.

The stop activator <NUM> may be designed to stop or slow down the vehicle <NUM> in a controlled manner. For example, to slow down the vehicle to a predetermined maximum speed, for example at most <NUM>/h, more preferably at most <NUM>/h and most preferably at most <NUM>/h. The slowing down may be done in a controlled manner, such as a slow deceleration or in a very fast deceleration.

The stop activator <NUM> may cause the vehicle <NUM> to come to a complete stop within a short time, for example <NUM> seconds, more preferably <NUM> seconds, more preferably <NUM> seconds, more preferably <NUM> seconds and most preferably <NUM> seconds and most preferably <NUM> second. It is desirable to make the vehicle <NUM> stop as soon as possible. However, the deceleration may need to be controlled in some manner, since there is a small risk that stop actuator <NUM> is activated by mistake or by mischief, and then is important that the drivers and passengers are not harmed. In addition, there may be innocent passengers in the vehicle <NUM>.

Preferably the vehicle <NUM> stops responding to driver actions (steering, accelerator) when the stop activator <NUM> is activated.

Activation of the stop activator <NUM> may cause the vehicle <NUM> to be undrivable for a predetermined time, for example, at least <NUM> seconds or at least <NUM> seconds and at most <NUM> minute, at most <NUM> minutes, at most <NUM> minutes or at most <NUM> minutes. This makes it possible for pedestrians to move to a safe area, for police to take control of the situation and possible arrest the terrorists. However, the time should be short enough to not be too inconvenient in the case of activation by mistake or mischief.

In addition to stopping or slowing down, the emergency stop system <NUM> may switch on the horn, or to activate hazard lights, of the vehicle <NUM> in order to alert bystanders.

The emergency stop system <NUM> is able to receive input from users <NUM> in the vicinity of the vehicle <NUM>, in various manners, for example touch, sound or signals from a portable electronic device <NUM>, or a combination of these kinds of signals. With reference to <FIG>, in step <NUM> a user <NUM> provides the signal to the emergency stop system <NUM> of the vehicle <NUM>. In step <NUM>, emergency stop system <NUM> receives the signal from the user <NUM> and the stopping activator <NUM> of the emergency stop system <NUM> causes the vehicle <NUM> to stop or slow down.

With reference to <FIG>, <FIG>, <FIG> and <FIG>, the emergency stop system <NUM> may comprise memory <NUM> for storing software, and in some embodiments an identity of the vehicle <NUM>, processor <NUM>, communications interface <NUM>, wireless communications unit <NUM> comprising a transmitter and a receiver, microphone <NUM>, sound analysis unit <NUM>, and pressing sensors <NUM>, danger determination system <NUM>, timer <NUM>, counter <NUM> and direction determination software <NUM>. The communication interface <NUM> provide connections between components of the emergency stop system <NUM>, and between the emergency stop system <NUM> and subsystems of the vehicle <NUM>.

The system and methods can also be used for stopping a vehicle in the case of theft of the vehicle or for example when a vehicle is hunted by the police.

<FIG> shows an embodiment where a user <NUM> uses a portable electronic device <NUM> to stop or slow down the vehicle <NUM>. The portable electronic device <NUM> (<FIG>) is typically a mobile phone <NUM>, such as an iPhone or an Android phone, but may also be a smart watch or smart glasses (for example Google glasses). The portable electronic device <NUM> has a display <NUM>, which preferably is a colour display. The display <NUM> may be able to show letters, digits, symbols or images. Preferably display <NUM> is a touch display, enabling the user to select items on the display. However, there may be other means for navigating and selecting items on the display, such as a joystick, or voice command. The portable electronic device <NUM> has a processor <NUM> and a memory <NUM> and at least one wireless communication unit <NUM> comprising a transmitter and a receiver. Many different types of wireless communication methods and protocols are mentioned herein. In one embodiment the wireless communication unit <NUM> of device <NUM> enables device <NUM> to communicate wirelessly directly with wireless communication unit <NUM> of emergency stop system <NUM>. The wireless communication unit <NUM> may be unit for enabling wireless communication between device <NUM> and emergency stop system <NUM> in a network. The electronic device <NUM> may have wireless communication unit <NUM> that enables both communication directly between emergency stop system <NUM> and device <NUM>, and communication via network <NUM>.

The emergency stop system <NUM> and the portable electronic device <NUM> is a part of vehicle control system <NUM> (<FIG>), which may comprise a plurality of vehicles <NUM> and devices <NUM>. The emergency stop system <NUM> of the vehicle <NUM> has stored in its memory <NUM> an identity (ID) of the vehicle. The identity is preferably a unique identity. The identity may be, for example, a number being stored in memory <NUM>. The identity may for example be the license plate number/letters of the vehicle, if necessary in combination with a country code, but may also be any other useful combination of digits and/or letters. The ID may also be an IMSI of a cell phone unit for the emergency stop system <NUM> or the vehicle <NUM> in general. The ID may also be a vehicle serial number.

The vehicle control system <NUM> has stored data describing visible features of the vehicle <NUM>. Preferably the vehicle control system <NUM> has stored data describing visible features for a plurality of vehicles <NUM>. The visible features of each vehicle <NUM> is linked, in vehicle control system <NUM>, to the unique ID of the vehicle <NUM>, such that the data describing the visible features can be retrieved using the ID.

The visible features are preferably easily recognizable features that are visible from some distance, for example type of vehicle (bus, car, truck, pickup, sedan) manufacturer (Ford, Volvo, Mercedes Benz) colour (black, red, blue etc.) model (Ford Escort, Toyota Land Cruiser), nationality, or part or entire license plate number. The license plate may also include one or more letters and those may also be used as visible features. For example, in certain countries (for example Germany) the first letter or letters indicate the city or region of registration of the vehicle, and those are typically easy to identify and memorize. In the USA the state of registration may be used. Furthermore, the license plate may display flags or symbol of the nation (Norway) or region (Switzerland) of registration, and those are typically easy to identify. Other visible features that may be used include company names or logos displayed on the body of the vehicle.

Preferably a combination of features is used that allows a user <NUM> to identify the vehicle <NUM> with some certainty from a distance. The combination of colour, body type and vehicle manufacturer should make it possible to identify the vehicle <NUM> with some certainty among the visible features of vehicles on a two-way street within a radius of <NUM> meters. Preferably the visible features are chosen so that a single vehicle can be identified with some certainty in a group of vehicles, preferably a random group of <NUM> vehicles, more preferably a group of <NUM> vehicles and more preferably a group of <NUM> vehicles, and most preferably more than <NUM> vehicles. If a part of information (letter or number) from the license plate is included as a visible feature, the accuracy in the identification should increase by at least one magnitude. The entire license plate together with nationality should make it possible to identify the vehicle <NUM> uniquely among all the vehicles in the world. However, there is a risk the user <NUM> does not have time to identify the complete license plate.

In certain embodiments, the data describing the visible features of the vehicles may be used as the unique ID of the vehicle, in particular when a part of the license plate is included in the visible features.

Briefly, the emergency stop system <NUM> provides the identity of the vehicle <NUM> to the portable electronic device <NUM> carried by user <NUM>. The portable electronic device <NUM> receives the identity of the vehicle <NUM> and displays the visible features of the vehicle <NUM> on the display <NUM>. This enables the user <NUM>, who has observed a vehicle <NUM> that behaves in a dangerous way, to select the vehicle <NUM> on the display <NUM> with the corresponding visible features. This causes the portable electronic device <NUM> to provide a signal to the emergency stop system <NUM>. The signal is received by the wireless communication unit <NUM> of the emergency stop system <NUM>. The stopping activator <NUM> of the emergency stop system1 is then activated, causing the vehicle <NUM> to stop or slow down.

The vehicle control system <NUM> comprises stored data about the visible features of the vehicle <NUM>. The visible features data may be stored anywhere in vehicle control system <NUM>. The visible features data may for example be stored in the emergency stop system <NUM> of the vehicle and provided to the device <NUM> together with the ID of the vehicle <NUM>. Alternatively, the visible features data may be stored on the device <NUM> as a database, and the devise <NUM> uses the ID of the vehicle to query the database for visible feature data. The visible feature data may also be stored on a server <NUM> and provided to the portable electronic device <NUM> from the server <NUM> (see below). The server <NUM> may use the ID to query the database for visible features data, and provide the data to the portable electronic device <NUM>.

The portable electronic device <NUM> may have software installed (e.g. an app) that carries out parts of the method described herein. The software may be downloaded in advance to the portable electronic device. The software preferably is capable of displaying visible features of a plurality of vehicles, for example as a list <NUM> (<FIG>) of vehicles <NUM>, and the user <NUM> is thereby able to select the desired vehicle <NUM> by for example by touching the screen <NUM> where the visible features vehicle <NUM> is displayed. In one embodiment a photo of the vehicle <NUM> may be included in the visible features data and displayed to the user. However, it may be more efficient, to show icons such as one symbol for a car, one symbol for bus, etc (<FIG>). The symbol may be coloured to the colour of the vehicle, or shown with other visible features of the vehicle <NUM>. Alternatively, the software may be run on server <NUM>, which causes the device <NUM> to display visible features on the display <NUM>.

Communication between emergency stop system <NUM> and portable electronic device <NUM> may be arranged in numerous different ways. Useful technologies and protocols include NFC, RFID, Bluetooth, ZigBee, Wi-Fi, lora, sigfox, fixed wireless network, mobile wireless network, satellite network, <NUM>, GSM, TDMA, FDMA, GPRS, EGPRS, EDGE, <NUM>, HSPA, WCDMA, CDMA2000, CDMA, <NUM>, OFDM, LTE-M, NB-loT, OFDMA, SC-FDMA, <NUM>, or WiMAX.

As seen in <FIG> wireless communication can be carried out directly between device <NUM> and emergency stop system <NUM>, by two-way radio. Thus, communication can be carried out in a peer to peer manner.

Alternatively, as seen in <FIG> communication can be carried out via network <NUM>, for example a cell network. This may involve server <NUM>.

Preferably parts, or even more preferably all, of the communication between emergency stop system <NUM> and device <NUM> is wireless. However, when communication is carried out through a network as in <FIG> parts of the communication may be transmitted by wire.

Again, communication in system <NUM> can be arranged in numerous ways a few possibilities will now be mentioned as examples.

As a first possibility, the ID is transmitted as a radio signal directly from emergency stop system <NUM> to the device <NUM>, as seen in <FIG>, and the device <NUM> transmits the stop signal directly to the emergency stop system <NUM>. Broadcast of ID is preferably done repeatedly with a predetermined time interval, which preferably is less than <NUM> seconds, more preferably less than <NUM> seconds, more preferably less than <NUM> second. Broadcast may be conditioned such that it is only carried out when certain criteria are fulfilled (see below). In one embodiment the portable electronic device <NUM> comprises an RFID reader that causes an RFID tag in the emergency stop system to broadcasts its ID.

Broadcast may be omnidirectional or directional, i.e. carried out in a certain direction.

A second possibility is that the emergency stop system <NUM> provides the ID to a server <NUM>, that in turn provides the ID to the portable medical device <NUM> (<FIG>). The ID can for example be provided to the device <NUM> with the use of push technology. Thus, the identity may be provided from the vehicle <NUM> to the server <NUM>, and from the server <NUM> to the portable electronic device <NUM>. In this embodiment it useful if some kind of geographic filter is applied, so that the ID is distributed to devices <NUM> that are within a threshold distance <NUM> from the vehicle <NUM> (see below).

A third possibility is that the emergency stop system <NUM> provides the ID to a stationary or mobile retransmitter that relays the ID to devices <NUM> in the vicinity. This may be used to implement a geographic filter.

A fourth possibility is that some signals, for example the ID signal is provided through network <NUM>, and the stop signal is provided directly from the device <NUM> to the emergency stop system <NUM>, or vice versa. For example, it may, in some cases, be advantageous to send the stopping signal directly from the device <NUM> to the emergency stopping system <NUM>, rather than via server <NUM>, in order to be fast and reliable. It may also be desirable to send the stopping signal from portable device <NUM> both directly to vehicle <NUM> and to server <NUM>, which passes it onto vehicle <NUM> in order to provide redundancy. Furthermore, the emergency stop system <NUM> may provide the identity directly to the portable electronic device <NUM>, and the portable electronic device <NUM> may use the identity of the vehicle to obtain data describing the visible features of the vehicle <NUM> from server <NUM>, for example by querying server <NUM>.

Again, many other possibilities for arranging communication between emergency stop system <NUM> and device <NUM> are possible.

With reference to <FIG> in step <NUM> the vehicle <NUM> provides the identity of the vehicle to the portable electronic device <NUM> with the use of the wireless communication unit <NUM>. The ID is preferably provided to the device <NUM> repeatedly, preferably with a predetermined time interval, which preferably is less than <NUM> seconds, more preferably less than <NUM> seconds, more preferably less than <NUM> second. Transmission may be conditioned by certain rules. For example, transmission may occur only when the vehicle <NUM> is switched on, for example when the engine is running. Alternatively, provision of the ID is only carried out when the vehicle behaves in a certain way. For example, the identity may be broadcast only when the vehicle <NUM> is moving or may be done only when the vehicle <NUM> is moving with a speed over a predetermined threshold speed, for example <NUM>/h, or when the vehicle <NUM> accelerates faster than a predetermined acceleration, or behaves in a dangerous manner (see below). Information about speed and acceleration may be provided to emergency stop system <NUM> from the subsystems of the vehicle <NUM>. Danger determination unit <NUM>, may be used to switch on broadcast, see below.

The visible features are preferably provided to a plurality of portable devices <NUM>. This provides crowd-souring of vigilance against attacks. A threshold distance <NUM> may be used to provide a geographic filter, se below.

In step <NUM> the electronic device <NUM> receives the ID of the vehicle with the use of the wireless communication unit <NUM>. In step <NUM> the portable electronic device <NUM> displays, on the display <NUM>, the visible features of the vehicle <NUM>.

In step <NUM> the user <NUM>, who wants to stop vehicle <NUM> because it behaves in a dangerous way, selects the vehicle <NUM> on the display <NUM> of the device. Selection by user <NUM> can be done with the aid of a touch display but also by using for example a navigation button or joystick for example by the side of the display <NUM>. In step <NUM> the portable electronic device <NUM>, using the identity of the vehicle <NUM>, provides a signal to the wireless communication unit <NUM> of the emergency stop system <NUM> of the selected vehicle <NUM>. When the user <NUM> selects the vehicle on the display <NUM>, a signal is immediately broadcast to the vehicle <NUM> in question. The correct vehicle <NUM> is selected by means of the ID. Only the vehicle with the corresponding ID is stopped or slowed down. Other vehicles are not affected. For example, the wireless communication unit <NUM> of the portable electronic device transmits a signal that is received by a plurality of vehicles <NUM> but only the vehicle <NUM> with the corresponding ID reacts to the signal. In step <NUM> the wireless communication unit <NUM> of the emergency stop system <NUM> receiving the signal and emergency stop system <NUM> causing the vehicle to stop or slow down by using stop activator <NUM>.

Vehicle control system <NUM> can preferably handle a plurality of vehicles <NUM> with emergency stop systems <NUM>. Thus, visible features of a plurality of vehicles <NUM> may be displayed on display <NUM> and list <NUM>.

The portable electronic device <NUM> preferably has software stored in its memory <NUM>. The software of the portable electronic device <NUM> is to be executed on or from a portable electronic device <NUM> with a display <NUM>, the computer software product being arranged to carry out the steps of <FIG>, namely in step <NUM> receiving the identity of a vehicle <NUM>, <NUM> using the identity to retrieve data describing visible features of the vehicle <NUM>. Step <NUM> is not necessarily carried out if the data describing the visible features are provided together with the ID from the vehicle <NUM>. In step <NUM> the device <NUM> displays, on the display <NUM>, the visible features of the vehicle <NUM>. Preferably display <NUM> is updated at least every <NUM> seconds, more preferably at least every second, to reflect for example the relative movement of user <NUM> to surrounding vehicles <NUM>.

In step <NUM> the device <NUM> receives input from a user selecting the vehicle, for example through a touch screen. In step <NUM> the device <NUM>, provides a wireless stop signal to the vehicle <NUM>.

The visible features of a vehicle <NUM> may be displayed on the display <NUM> of the device <NUM> only if the vehicle <NUM> behaves in a certain predetermined manner, i.e. a potentially dangerous manner. This may be carried out by a danger determination unit <NUM> in the emergency stop system <NUM>. This may decrease signal traffic in the system <NUM> and make the display <NUM> and list <NUM> less cluttered for the user <NUM>. For example, the visible features may be displayed only if the vehicle <NUM> has a speed that is over a predetermined threshold or accelerates with an acceleration above a certain acceleration threshold. Erratic steering in combination with high speeds may also trigger display. Again, the emergency stop system <NUM> may obtain data for determining this from the various subsystems of the vehicle <NUM>.

Danger determination unit <NUM> may also be located in server <NUM>. In general, parts of emergency stop system <NUM> may be placed on server <NUM> as a part of a cloud computing solution. The server <NUM> may then use data from subsystems of vehicle <NUM> and also use vehicle localisation data provided by mobile positioning or GPS, for determining if the vehicle behaves in a dangerous way. For example, if server <NUM> notices that vehicle <NUM> drives too fast on a pedestrian street where vehicle traffic is prohibited or only allowed at low speed, the visible features regarding vehicle <NUM> may be displayed. Control of display <NUM> can be carried out by emergency stop system <NUM>, server <NUM> or device <NUM>.

Thus, rules for transmission of ID and display of visible features on display <NUM> may be employed by the emergency stop system <NUM>, server <NUM> or the device <NUM>. For example, the list <NUM> may be edited by server <NUM> or device <NUM> based on the behaviour of the vehicle <NUM>. Thus, danger determination unit <NUM> may be located in server <NUM>, emergency stop system <NUM> or device <NUM>.

In order to limit the number of vehicles <NUM> that are shown on the display <NUM>, the visible features may be displayed on the display <NUM> of the portable electronic device <NUM> only if the electronic device <NUM> is within a threshold distance <NUM> of the vehicle <NUM> as seen in <FIG>. An advantage with this is that a limited number of vehicles <NUM> is shown on the display <NUM> of the electronic device <NUM>, making it easier for the user <NUM> to select the correct vehicle <NUM>. The threshold distance is suitable less at most <NUM>, and may be for example <NUM> or less, <NUM> or less or <NUM> or less. Alternatively, the threshold distance <NUM> may be measured from the portable electronic device <NUM>.

In <FIG> the portable electronic device 5a is within the threshold distance <NUM> and displays vehicle <NUM> on display <NUM>, but portable electronic device 5b is outside the threshold distance <NUM> and does not display the visible features of vehicle <NUM> on the display <NUM>.

Any suitable technology can be used to achieve the threshold distance. The threshold <NUM> can be achieved by for example the wireless communication unit <NUM> of the emergency stop system <NUM> only transmitting the identity signal a short distance. Thus, portable electronic devices 5b that are too far from the vehicle <NUM> cannot receive the signal, because the signal is too weak. An example is shown in <FIG>.

Alternatively, the distance between the portable electronic device and the vehicle <NUM> can be determined by the portable electronic device <NUM> by measuring the time of flight for the radio wave. In yet another option the vehicle <NUM> has a phased array, for example on antenna on the front of the vehicle and one in the back of the vehicle. Furthermore, received signal strength indication (RSSI) can be used.

The distance between the vehicle <NUM> and the portable electronic device <NUM> can be determined by determining the positions of the portable electronic device <NUM> and the vehicle <NUM> and measuring the distance between the positions.

The determination of the position of the vehicle <NUM> relative to the electronic device <NUM> may be carried out using any suitable technology. For example, the vehicle <NUM> may have means for determining the position of the vehicle <NUM>, such as for example GPS, Wi-Fi positioning or mobile positioning (if the vehicle has a mobile cell chip), AGPS or OTDOA. The vehicle <NUM> may broadcast its position together with the identity, preferably with a predetermined time interval. The position of the portable electronic device <NUM> can be determined with the use of, for example, mobile positioning or a GPS unit in device <NUM>. The portable mobile device <NUM>, having received the position of the vehicle <NUM> and being able to determine its own position, can then determine the distance using a map and a distance determination algorithm.

Thus, the vehicle control system <NUM> can decide to display the visible features only of those vehicles that are within a threshold distance <NUM> from the portable mobile device <NUM>.

In one embodiment, the server <NUM> keeps track of the positions of the vehicle <NUM> and the portable electronic device <NUM>. The server <NUM> may for example obtain the positions of the vehicle <NUM> and the portable electronic device <NUM> from a mobile cell network that uses mobile positioning for each of the vehicle <NUM> and the portable electronic device <NUM>. The server <NUM> may also obtain position information for vehicle <NUM> or device <NUM> from another unit, for an example a unit in network <NUM>, such as an antenna or a server of a cell phone network. The server <NUM> may query the network <NUM>, or may obtain positions using push technology. Alternatively, GPS or Wi-Fi positioning may be used. The position of vehicle <NUM> may be provided to the server <NUM> together with the ID from the emergency stop system <NUM>. The position of the vehicle <NUM> may be provided from the server <NUM> to the portable electronic device <NUM>, which then determines the distance.

The server <NUM> may provide the identity of the vehicle <NUM> to the portable electronic device <NUM> only if the distance between the vehicle <NUM> and the portable electronic device <NUM> is within a threshold distance <NUM>. Alternatively, the server <NUM> may be arranged to receive the identities for a number of vehicles <NUM> that is within a larger threshold distance <NUM>, for example all the vehicles in a city, and provide updated positions to the portable electronic device <NUM> at regular time points, and the electronic device <NUM> compares its own position with the position of the vehicle <NUM> received from the server <NUM>, and only displays the visible features if the vehicle <NUM> is within the threshold distance <NUM>. Alternatively, the server <NUM> only provides to the device <NUM> the ID for relevant vehicles within distance <NUM>, and the device quires a database on the device <NUM> for visible features. Thus, the device <NUM> buffers IDs and visible feature data for a large number of vehicles <NUM>. This may speed up traffic in the system <NUM>. In <FIG> device 5d is outside threshold distance <NUM> and has not received any data regarding vehicle <NUM> from server <NUM>. Device 5b and 5c are within threshold distance <NUM> and has received information about vehicle <NUM> (ID and visible features). However, the devices 5b and 5c does not display visible features of vehicle <NUM>. 5a has received information about vehicle and also displays the visible feature on display <NUM>. If devices 5b and 5c move so that they are within threshold distance <NUM>, the are able to speedily display the visible features on display <NUM>.

The display <NUM> is suitable updated frequently, since the set of vehicles <NUM> that are within the threshold distance will change rapidly with the flow of traffic. A suitable update frequency may be for example, less than <NUM> seconds, more preferably less than <NUM> seconds and even more preferably less than <NUM> second.

The signals between the vehicle <NUM>, the portable electronic device and the server <NUM> is preferably encrypted. Thus, the emergency stop system <NUM> and the portable electronic device <NUM> and server <NUM> has encryption and decryption units for encrypting and decrypting signals. The signals may also be signed with a digital signature. The method may include the steps of verifying the sender of a signal using a verification unit in the emergency stop system <NUM>, server <NUM> or the portable electronic device <NUM>.

Since this is an emergency system it is important that communication is carried out fast, so that the stopping signal can be provides as fast as possible. For example, when the stopping signal is provided through a network <NUM>, the stopping signal may be given priority of other types of network traffic.

Furthermore, the portable electronic <NUM> device may increase its transmission power when the user selects a vehicle on display <NUM>, in order to increase the possibility that the stop signal reaches the vehicle <NUM>. For example, device <NUM> may increase its transmission power to its maximum transmission power.

In one embodiment a vehicle <NUM> can be stopped if a user <NUM> utters a predefined word or makes a predetermined sound or if a group of users <NUM> creates a predetermined sound. In this embodiment, emergency stop system <NUM> has at least one microphone <NUM> for detecting sounds in the vicinity of the vehicle <NUM>, and a sound analysis unit <NUM> for detecting and analysing sound. Sound analysis unit <NUM> comprises at least one predetermined sound pattern. The maximum pickup distance of the microphone may be <NUM>-<NUM> meters. The sound analysis unit <NUM> is able to analyse sounds picked up by the microphone <NUM> in real time or near real time. The sound analysis unit <NUM> may employ artificial intelligence or machine learning and may have noise cancelling capabilities. The microphone <NUM> may for example be located in a small opening in the body of the vehicle <NUM>. Sound analysis unit <NUM> may be implemented by hardware or software or both.

The method of <FIG> involves the steps: <NUM> the microphone <NUM> of the emergency stop system <NUM> receiving a sound, step <NUM> the microphone sending a signal representing the sound to the sound analysis unit <NUM>, step <NUM> the sound analysis unit <NUM> determining that the received sound matches a predetermined sound pattern. The received sound should at least comprise the sound pattern. In step <NUM> the sound analysis unit <NUM> causes the emergency stop system <NUM> to stop or slow down the vehicle <NUM>.

The sound analysis unit <NUM> may comprise speech recognition software, able to distinguish spoken words. The predetermined sound pattern can be a predetermined spoken word, for example the word "stop". The emergency stop system <NUM> may therefore be able to stop or slow down if a user utters the word "stop" in the vicinity of the vehicle <NUM>. The speech recognition software may be able distinguish and understand any language. In a separate embodiment, this may be used to stop a taxi on the street in a non-emergency situation.

The sound analysis unit may be able to interpret the meaning of what is said by users <NUM>, for example if a plurality of persons uses certain combinations of words such as "help", "terrorist", "watch out", or screams or shouts etc. and may be able to detect frustration, fear or anger in the voices. The sound analysis unit <NUM> may be able to distinguish if these words are uttered by different persons, for example by using sound strength, distance to sound source, if the sounds are overlapping, tone, pitch, talking speed, stress, fear, dialect, language, etc. AI or machine learning may be particularly useful for this. Machine learning may be used to modify or update the predetermined sound pattern.

In one embodiment shown in <FIG>, the sound analysis unit <NUM> is capable of identifying a particular sound made by a sound device <NUM>, which is preferably portable, such as for example a whistle. A plurality of sound devices <NUM> may be distributed among users <NUM>, for example policemen, guards or shopkeepers close to crowded areas. The general public can be informed about the sound made by sound device <NUM> so that the sound is associated with danger. By using the portable sound device <NUM> a vehicle stopping signal can be generated quickly. The sound of the sound device <NUM> also warns people, for example pedestrians, in the vicinity. An advantage of using a sound device <NUM> is that a loud signal that carries far is generated. The specific sound generated by sound device <NUM> may also be easier to distinguish from surrounding noise or talk. The sound device <NUM> can be designed to make a sound that can be distinguished from for example police whistles or other well-known sounds.

Noise pollution is problem in cities and local authorities in general want to obtain information about what levels of noise occur where in a city. When emergency stopping system <NUM> has a microphone <NUM> it may be used for mapping of noise pollution. Emergency stopping system <NUM> then has mapping software <NUM> for mapping noise. Mapping software <NUM> uses microphone <NUM> to regularly record the noise level and store the noise level together with the current position of the vehicle <NUM>. Storage may take place for example at least every <NUM> minutes, or more preferably every minute or even more preferably at least every <NUM> seconds. The position of the vehicle <NUM> is determined as described herein, for example by GPS. The result may be stored in the memory of emergency stopping system <NUM>. Information from a plurality of vehicles <NUM> collected over time may be combined to form a noise "heat map", that provides important information about the noise levels. The noise information may be transferred from a plurality of vehicles <NUM> via network <NUM> to a server, that combines noise information from a plurality of vehicles <NUM> to obtain the noise map.

In one embodiment seen in <FIG>, the emergency stop system <NUM> may receive a stop signal from a pressing or touch sensor <NUM> on the body of the vehicle <NUM>, preferably on the outside of the vehicle. Thus, body of the vehicle <NUM> may have a button or a part (for example a window) that can be pressed by a user <NUM> in the case of an emergency to generate an emergency stop signal. Emergency stop buttons connected to the emergency stop system <NUM> may be placed on the outside of the vehicle <NUM> such that the can be pressed by users outside the vehicle <NUM>. Also, certain parts of the body of the vehicle <NUM>, for example a door, a side panel or a window may be sensitive to pressing by a user <NUM> Thus by pressing a button on the vehicle or a part of the body of the vehicle, a user <NUM> can activate pressing sensitive sensor <NUM> and send a stopping signal to the emergency stop system <NUM>, causing the vehicle1 to stop or slow down.

When the vehicle <NUM> is an autonomous vehicle there may be an emergency stopping button that can be pressed by a passenger, for example to override the autonomous system if it has been hijacked or taken over by a software bug.

In order to avoid activation of the stopping activator <NUM> by mistake or mischief, it may be useful to employ a rule where two independent signals are necessary to activate the stopping activator <NUM> of the emergency stop system <NUM>. Preferably the independent signals are caused by different users. Preferably at least two stopping signals must be received by the emergency stop system <NUM> within a predetermined time window in order to activate the stopping activator <NUM>. The stopping signals can be of the same type such as, for example, stopping signals from two different portable electronic devices <NUM>, or may be different types of signals, for example one stopping signal from a portable electronic device <NUM> and one signal detected by a microphone <NUM>. With reference to <FIG>, the emergency stopping system <NUM> may receive signals from wireless communication unit <NUM> (for example from portable electronic device <NUM>, or server <NUM> or other device), microphone <NUM>, pressing sensor <NUM>, or other sensors or devices.

With reference to <FIG>, in step <NUM> of <FIG> the emergency stop system <NUM> receives a first signal to stop the vehicle <NUM>. The stopping signal may be any of the signals mentioned herein, for example a signal from a portable medical device <NUM>, a sound signal detected by a sound analysis unit <NUM> or pressing sensor <NUM>, or any other type of signal provided to the emergency stop system <NUM> by a user that is not driving the vehicle <NUM>. In this embodiment the emergency stop system <NUM> comprises a timer <NUM> and counter <NUM>. When the emergency stop system <NUM> receives the signal, the timer <NUM> immediately starts, in step <NUM>, a timing procedure to determine if any second signal is received within a predetermined time window. Counter <NUM> counts the number of signals received during the time window, and may count the first signal as one signal.

The time window may be selected so that it provides adequate safety but still decreased the risk for use by mistake or mischief. The appropriate time window may be selected based on the type of signal (device <NUM>, sound or pressing sensor). The time window may be for example at most <NUM> minutes, at most <NUM> minutes, at most <NUM> minutes, at most <NUM> minute, at most <NUM> seconds or at most <NUM> second. When the system <NUM> requires signals from at least two different portable devices <NUM>, the time window may be comparatively long, for example at most <NUM> minutes, at most <NUM> minutes or at most <NUM> minutes.

If at least a second stop signal is received within the time window, as in step <NUM>, the emergency stop system causes the vehicle <NUM> to stop or slow down in step <NUM>. If no second stop signal is received within time window the counter <NUM> may be set to zero.

In this example two signals are necessary to trigger the stop, but any suitable number of stop signals may be made necessary, for example three, four, five or more signals, or types of signals may be used. It may be required that the signals should be of different types in order to trigger a stop.

For example, the system may be configured to cause the vehicle <NUM> to stop or slow down only of three signals are received within two minutes, of which two signals are from portable medical devices <NUM> and one is from pressing sensor <NUM>.

Preferably the plurality of signals are from independent users. The system can be designed in different manners in order to ensure that users are independent.

In one embodiment, shown in <FIG>, the first signal is provided from a first portable electronic device <NUM> and the second signal is provided by a second portable electronic device <NUM>'. Again, communication in system <NUM> can be carried out in any suitable manner, for example via network <NUM>. When there are two stopping signals from different portable electronic devices <NUM>, <NUM>', the portable electronic devices can be identified in system <NUM> by, for example, a user ID of the portable electronic devices <NUM>, <NUM>'. The user ID is provided to the emergency stop system <NUM> or server <NUM> together with the stopping signal. For example, the user ID may be an IMSI or an IMEI of the devices <NUM>, <NUM>'. When the stopping signal is provided with for example Bluetooth, the Bluetooth MAC address can be used for identifying the portable electronic devices <NUM>, <NUM>'. In one embodiment, server <NUM> receives two signals from two separate portable devices <NUM>, <NUM>' within the time window, and sends one single stopping signal to the emergency stop system <NUM>, which in turn activates stopping activator <NUM>. In this embodiment timer <NUM> and counter <NUM> is located in server <NUM>.

Thus, identification of portable electronic devices <NUM>,<NUM>' in system <NUM> can be done by emergency stop system <NUM> or server <NUM>.

When the stopping signals is a particular spoken word or a pattern of words, a variety of methods can be used.

In one embodiment, speech recognition software is able to distinguish different voices, for example based on tone, speed, etc. If the spoken word is uttered by two different users, as deemed by the speech recognition software, the stopping activator <NUM> is activated. As discussed above, the sound analysis unit <NUM> may be able to interpret the meaning of what is said by users, for example if a plurality of persons uses certain combinations of words such as "help", "terrorist", "watch out", or screams or shouts etc. and may be able to detect frustration, fear or anger in the voices. The sound analysis unit <NUM> may be able to distinguish if these words are uttered by different persons. Sound analysis unit <NUM> may employ Hidden Markov Models (HMM) for this.

In one embodiment, the vehicle has at least two microphones <NUM>, <NUM>' (<FIG>). Preferably these are placed far apart on vehicle <NUM>. The plurality of microphones <NUM>, <NUM>' can be used to determine the direction of the source of sound, by using for example triangulation (using at least two microphones). For this purpose, the emergency stop system <NUM> may have triangulation software <NUM> which may be employ triangulation. The direction determination software <NUM> is able to use information from the plurality of microphones <NUM>, <NUM>' to determine the position from where the sound is made. The time difference from when the sound is received by microphones <NUM>, <NUM>' may be used to determine the position.

The intensity of the sound and the amount of distortion of the sound can be used to determine the distance of the user <NUM>. When two different sound sources are far apart within a certain time window, they may be considered to be from two independent users. The time window can for example take into consideration the possible speed of movement of a user, for example a pedestrian walking or running on a street.

When the plurality of signals includes pressing a button on the vehicle <NUM> or a pressing sensitive part of the body of the vehicle <NUM> within the time window, it may be necessary to press parts that are spaced apart, for example one pressing sensor <NUM> on the back of the vehicle <NUM> and one pressing sensor <NUM>' on the front of the vehicle <NUM> (<FIG>) within a short time period, for example <NUM> second. It is usually difficult for one user <NUM> to move from the front of the vehicle to the back of the vehicle in <NUM> second. Thus, this ensures that the two pressing signals are from independent users. Thus, pressing sensors <NUM>, <NUM>' may be separated by a minimal distance. The minimal distance and time window should be selected such that it ensures that signals received from sensors <NUM>, <NUM>' are from independent users. The minimal distance may be <NUM> meters, more preferably <NUM> meters, for example.

Moreover, the emergency stop system may take into consideration the movement of the vehicle. If the vehicle <NUM> moves at <NUM>/hour, two pressing actions received <NUM> seconds apart are most likely from two different users, because the car has travelled <NUM> meters during that time. The emergency stop system <NUM> may obtain information regarding this from the abovementioned subsystems of the vehicle <NUM>.

As mentioned above the embodiment where vehicle <NUM> has a microphone <NUM> may be used for non-security purposes, for example hailing a taxi which is an autonomous vehicle, for example by calling out "Taxi!". In these embodiments vehicle <NUM> has an autonomous control subsystem that controls vehicle as is known in the art. The world "taxi" is recognized by the sound analysis unit <NUM> which causes the stop activator <NUM> of stop system <NUM> to make the taxi slow down and stop (stop system <NUM> share the features of emergency stop system <NUM> described above). Preferably the vehicle <NUM> makes a controlled stop at the curb, so that the user can enter the vehicle.

When a taxi is an autonomous vehicle, it must be able to solve specific issues that are otherwise resolved by a taxi driver. For example, if two different persons call out "taxi" it is reasonable that the person who called out taxi first gets the ride. This may be resolved as follows. As mentioned above and also described below, the sound analysis unit <NUM> may be able to distinguish between voices of different persons. The passenger door of the vehicle <NUM> is initially locked until unlocked by stop system <NUM>. The passenger door is locked and prevents a putative passenger from entering the taxi until the door is unlocked. The door is only unlocked if a second spoken word is uttered and detected by system <NUM>, and the system <NUM> detects that the second spoken word is uttered by the same person who called out "taxi" first, and which caused the vehicle <NUM> to stop. The user may be prompted to utter a second word, for example by a digital voice or a sign on the door of the vehicle.

With reference to <FIG>, in step <NUM> sound analysis unit <NUM> detects a first spoken word, and saves the voice pattern. The first word is preferably a predefined word, such as, for example, "taxi". In step <NUM>, the system <NUM> makes the vehicle stop. In step <NUM> sound analysis unit <NUM> receives a second spoken word and saves the voice pattern of the second spoken word. The second spoken word may be the same word as the word in step <NUM> ("taxi", for example), but may also be a different word, for example "open". It may be a predefined word but may also be any word. In step <NUM> sound analysis unit <NUM> analyses the voice patterns of the first and second words, and, if they are deemed to be spoken by the same person, the door of the vehicle is unlocked. Thus, if a second person approaches the stopped vehicle and speaks, the voice patterns are not the same and the door will not become unlocked. The door will only unlock if the voice patterns are the same.

The method of <FIG> may comprise: detecting the voice pattern of a first spoken word, then making the vehicle stop, then detecting the voice pattern of a second spoken word, then comparing the voice patterns, then unlocking the door.

A second non-security application of the invention is autonomous vending vehicles <NUM>. It is envisaged that, in the future, autonomous vending vehicles <NUM> will move around cities and sell goods, such as food and drinks. Autonomous vehicle <NUM> moves around in a predetermined manner as specified by the autonomous control subsystem of vehicle. Vehicle <NUM> may for example be instructed to drive along a certain street. As with a taxi, a user <NUM> is able to make such a vehicle <NUM> stop by calling out a word, for example a word that is written on the vehicle <NUM>. For example, if the user <NUM> sees an autonomous ice-cream van <NUM>, the user <NUM> calls out "Ice-cream!" which this makes the vehicle <NUM> stop, with the use of stopping system <NUM> as described above. An issue that arises is when the vehicle <NUM> will start again. This problem is solved by a timer that makes the vehicle <NUM> start again if user does not interact with the vehicle <NUM>, for example by touching a touch display, making a purchase, etc..

With reference to <FIG> a method comprises the steps of <NUM> microphone <NUM> and sound analysis unit <NUM> recognizing a predetermined word, for example "ice cream". This activates stopping activator <NUM> which makes the vehicle stop in step <NUM>, preferably in a controlled manner, and at the curb side. The vehicle <NUM> comes to a complete stop. When vehicle <NUM> has stopped completely, a timer immediately starts in step <NUM>. The stop is detected by the autonomous vehicle subsystem, that starts the timer. If the user <NUM> does not interact with the vehicle <NUM> in a predetermined manner within a predetermined time, the vehicle starts moving again in step <NUM>. The starting procedure is defined by autonomous control subsystem. For example, the vehicle may accelerate in a predetermined manner. Interaction between user <NUM> and vehicle <NUM> that stops the timer may be detected by a sensor connected to the autonomous control subsystem of the vehicle <NUM>. Basically, the interaction of user <NUM> with the sensor of vehicle <NUM> makes the vehicle <NUM> stay in place so that the user <NUM> may complete the transaction.

Claim 1:
A method to stop or slow down a vehicle (<NUM>) in an emergency, the method involving a vehicle (<NUM>) comprising an emergency stop system (<NUM>) which is able to cause the vehicle (<NUM>) to stop or slow down, said emergency stop system (<NUM>) comprising at least one microphone (<NUM>) for detecting sounds in the vicinity of the vehicle (<NUM>), and a sound analysis (<NUM>) unit for analysing sound, the method involving the steps:
a) the microphone (<NUM>) of the emergency stop system (<NUM>) receiving a sound and sending a signal representing the sound to the sound analysis unit (<NUM>),
b) the sound analysis unit (<NUM>) of the emergency stop system (<NUM>) determining that the received sound comprises a predetermined sound pattern,
c) the emergency stop system (<NUM>) causing the vehicle (<NUM>) to stop or slow down,
characterized in that
the emergency stop system (<NUM>) of the vehicle (<NUM>) must detect a predetermined sound pattern at least a first time from a first user and a second time from a second user within a predetermined time window in order to cause the vehicle to stop or slow down.