Patent Description:
Some vehicles may operate in various modes which provide different levels of control to a driver. For instance, typical vehicles may operate in manual driving modes, where a human operator or driver controls acceleration, deceleration, and steering of the vehicle as well as semi-autonomous driving mode, such as cruise control, where a computer of the vehicle controls acceleration and deceleration while a driver controls steering, etc. In some instances, these vehicles may also operate in autonomous driving modes where the computer of the vehicle controls all of braking, all of the acceleration, deceleration and steering of the vehicle without continuous input from a driver or passenger. In the autonomous driving mode, the passenger may provide some initial input, such as a destination location, and the vehicle maneuvers itself to that destination. German patent application publication no. <CIT> makes disclosure relating to blocking for unauthorized acceptance of driving control in autonomous driving mode. United States patent application publication no. <CIT> presents a dual-state steering wheel/input device. United States patent application publication no. <CIT> presents a device and method for controlling a motor vehicle.

The invention is defined in the claims. One aspect of the invention provides a system. The system includes one or more control computing devices configured to send commands to one or more actuators of a vehicle in order to control deceleration, acceleration, and steering of the vehicle, and wherein the vehicle includes one or more user input devices for allowing a human operator to control the one or more actuators in order to control deceleration, acceleration, and steering of the vehicle; wherein the one or more control computing devices are configured to allow the vehicle to operate the vehicle in: a manual driving mode wherein a human operator controls the deceleration, acceleration, and steering of the vehicle at the one or more user input devices; a first autonomous driving mode wherein the one or more control computing devices are configured to send the commands to control the one or more actuators and wherein human operator inputs at the one or more user input devices are prioritized over the commands from the one or more control computing devices such that the vehicle transitions to the manual driving mode in response to the human operator inputs at the one or more user input devices; and a second autonomous driving mode wherein the one or more control computing devices are configured to send the commands to control the one or more actuators and wherein the commands from the one or more control computing devices are prioritized over the human operator inputs from the one or more user input devices.

In one example, the one or more computing devices are configured such that the first autonomous driving mode includes different requirements for entering than the second autonomous driving mode. In another example, the one or more computing devices are configured to prevent transitions from the manual driving mode to the second autonomous driving mode when the vehicle is in motion. In another example, the one or more computing devices are configured such that the first autonomous driving mode includes different requirements for transitioning to the manual driving mode than the second autonomous driving mode. In another example, the one or more computing devices are configured to transition from the first autonomous driving mode to the manual driving mode when any of the one or more actuators is operating in the manual driving mode. In this example, the one or more computing devices are configured such that when any of the one or more actuators is operating in the manual driving mode, the commands are ignored. In addition or alternatively, the one or more actuators include a deceleration actuator configured to cause the vehicle to deceleration, an acceleration actuator configured to cause the vehicle to accelerate, and a steering actuator configured to change an orientation of the vehicle.

In another example, the one or more computing devices are configured to prevent direct transitions from the first autonomous driving mode to the second autonomous driving mode. In another example, the one or more computing devices are configured to prevent direct transitions from the second autonomous driving mode to the first autonomous driving mode. In another example, the one or more computing devices are configured to operate the vehicle in a third autonomous driving mode which allows the vehicle to be serviced. In another example, the one or more computing devices are configured to operate the vehicle in the third autonomous driving mode based on a current location of the vehicle relative to a depot location. In this example, the one or more computing devices are configured to operate the vehicle in the third autonomous driving mode based whether the vehicle is at a specific location within the depot location. In addition or alternatively, the one or more computing devices are configured to automatically transition the vehicle into the third autonomous driving mode when the vehicle reaches the depot location. In addition or alternatively, the one or more computing devices are configured to prevent the vehicle from leaving the depot location until the one or more computing devices receive an instruction from a dispatching server computing device indicating that the vehicle is needed for providing transportation services.

In another example, the one or more computing devices are configured to operate the vehicle in a first configuration of the second autonomous driving mode where the vehicle provides transportation services to passengers. In another example, the one or more computing devices are configured to operate the vehicle in a second configuration of the second autonomous driving mode where the vehicle provides transportation services using restrictions defined by a current status of the vehicle. In another example, the one or more computing devices are configured to allow transitions into the second autonomous driving mode only when a door of the vehicle is open. In another example, the manual driving mode is configured such that commands from the one or more control computing devices are invalidated and ignored by the one or more actuators. In another example, system includes the one or more user input devices. In another example, system includes the vehicle.

Autonomous vehicles or vehicles having an autonomous driving mode may have many different modes of operation ranging from manual (where a driver controls braking, acceleration and steering) to fully autonomous (where a computer controls deceleration, acceleration and steering) and various modes there between. In such systems, a driver may switch between modes, for instance from autonomous to manual, by providing input at an input device, such as a steering wheel, brake pedal, accelerator pedal, buttons, etc. The vehicle's control computing devices may then transition control of deceleration, acceleration, and steering to the driver.

In some cases, however, even where there is a passenger in the vehicle, it may not always be appropriate to switch directly from an autonomous driving mode to a manual driving mode. For instance, a passenger may not be able to take control of the vehicle, due to age, disability, being asleep, or otherwise not paying attention. To avoid such situations, an autonomous vehicle may have multiple autonomous driving modes. For example, the autonomous vehicle may include one or more autonomous driving modes, and if available, a typical manual driving mode.

In a manual driving mode, a driver is able to control the deceleration, acceleration, and steering of a vehicle at the input devices. In a first autonomous driving mode, the control computing devices may expect that a driver is presently in the vehicle and capable of controlling the vehicle in the manual driving mode. The first autonomous driving mode may also have a plurality of different sub-modes or configurations which allows for different levels of autonomy in different environments. The first autonomous driving mode may also include a configuration with additional modifications to allow for safe testing of the vehicle when a test driver is present.

In a second autonomous driving mode, the control computing devices may expect that a driver is not presently in the vehicle and capable of controlling the vehicle in the manual driving mode. As with the first autonomous driving mode, the second autonomous driving mode may include a plurality of different sub-modes or configurations for providing transportation services. The second autonomous driving mode may also include a configuration for testing the vehicle.

In some instances, the vehicle may include a third autonomous driving mode that allows for service or software changes to the vehicle. This third autonomous driving mode may be considered a "depot" mode that allows an operator to interact with the vehicle and address any work orders generated for the vehicle by the server computing devices <NUM>. The third autonomous driving mode may include a geo-fencing aspect that prevents or limits the ability for the vehicle to be serviced when the vehicle's current location is not at or within a predetermined distance of a depot or a specific location within a depot.

As noted above, the vehicle's computing devices may be configured to prevent "accidental engages" or "accidental disengages" of the autonomous driving modes. This may include limiting specific types of transitions, requiring specific conditions of the vehicle, using geo-fencing, and/or requiring specific authorization.

The features described herein provide for safe and effective transitions between different autonomous driving modes and between different autonomous driving modes and a manual driving mode. The first autonomous driving mode may be especially useful when testing the vehicle (i.e. when a test driver is in the vehicle) and when a driver is able to take control of the vehicle in the event of an uncomfortable or emergency situation. The second autonomous driving mode may be especially useful in situations in which there is no passenger in the vehicle or any passengers are not be able to take control of the vehicle, due to age, disability, being asleep, or otherwise not paying attention.

As shown in <FIG>, a vehicle <NUM> in accordance with one aspect of the invention includes various components. While certain aspects of the invention are particularly useful in connection with specific types of vehicles, the vehicle may be any type of vehicle including, but not limited to, cars, trucks, motorcycles, buses, recreational vehicles, etc. The vehicle may have one or more control computing devices, such as computing device <NUM> containing one or more processors <NUM>, memory <NUM> and other components typically present in general purpose computing devices.

The one or more processor <NUM> may be any conventional processors, such as commercially available CPUs. Alternatively, the one or more processors may be a dedicated device such as an ASIC or other hardware-based processor. Although <FIG> functionally illustrates the processor, memory, and other elements of computing device <NUM> as being within the same block, it will be understood by those of ordinary skill in the art that the processor, computing device, or memory may actually include multiple processors, computing devices, or memories that may or may not be stored within the same physical housing. For example, memory may be a hard drive or other storage media located in a housing different from that of computing device <NUM>. Accordingly, references to a processor or computing device will be understood to include references to a collection of processors or computing devices or memories that may or may not operate in parallel.

Computing device <NUM> may all of the components normally used in connection with a computing device such as the processor and memory described above as well as a user input <NUM> (e.g., a mouse, keyboard, touch screen and/or microphone) and various electronic displays (e.g., a monitor having a screen or any other electrical device that is operable to display information). In this example, the vehicle includes an internal electronic display <NUM> as well as one or more speakers <NUM> to provide information or audio visual experiences. In this regard, internal electronic display <NUM> may be located within a cabin of vehicle <NUM> and may be used by computing device <NUM> to provide information to passengers within the vehicle <NUM>.

Computing device <NUM> may also include one or more wireless network connections <NUM> to facilitate communication with other computing devices, such as the client computing devices and server computing devices described in detail below. The wireless network connections may include short range communication protocols such as Bluetooth, Bluetooth low energy (LE), cellular connections, as well as various configurations and protocols including the Internet, World Wide Web, intranets, virtual private networks, wide area networks, local networks, private networks using communication protocols proprietary to one or more companies, Ethernet, WiFi and HTTP, and various combinations of the foregoing.

In one example, computing device <NUM> may be an autonomous driving computing system incorporated into vehicle <NUM>. The autonomous driving computing system may capable of communicating with various components of the vehicle in order to control the movement of vehicle <NUM> according to primary vehicle control code of memory <NUM>. For example, returning to <FIG>, computing device <NUM> may be in communication with various systems of vehicle <NUM>, such as deceleration system <NUM>, acceleration system <NUM>, steering system <NUM>, signaling system <NUM>, navigation system <NUM>, positioning system <NUM>, perception system <NUM>, and power system <NUM> in order to control the movement, speed, etc. of vehicle <NUM> in accordance with the instructions <NUM> of memory <NUM>. Again, although these systems are shown as external to computing device <NUM>, in actuality, these systems may also be incorporated into computing device <NUM>, again as an autonomous driving computing system for controlling vehicle <NUM>.

As an example, computing device <NUM> may interact with one or more actuators of the deceleration system <NUM> and/or acceleration system <NUM>, such as brakes, accelerator pedal, and/or the power system <NUM> (i.e. an engine or motor of vehicle <NUM>), in order to control the speed of the vehicle. Similarly, one or more actuators of the steering system <NUM>, such as a steering wheel, steering shaft, and/or pinion and rack in a rack and pinion system, may be used by computing device <NUM> in order to control the direction of vehicle <NUM>. For example, if vehicle <NUM> is configured for use on a road, such as a car or truck, the steering system may include one or more actuators to control the angle of wheels to turn the vehicle. Signaling system <NUM> may be used by computing devices <NUM> in order to signal the vehicle's intent to other drivers or vehicles, for example, by lighting turn signals or brake lights when needed.

Navigation system <NUM> may be used by computing device <NUM> in order to determine and follow a route to a location. In this regard, the navigation system <NUM> and/or data <NUM> may store detailed map information, e.g., highly detailed maps identifying the shape and elevation of roadways, lane lines, intersections, crosswalks, speed limits, traffic signals, buildings, signs, real time traffic information, vegetation, or other such objects and information. For instance, <FIG> is an example of map information <NUM>. In this example, the map information <NUM> includes the shape and location of lanes <NUM>, <NUM>, bounded by lane lines <NUM>, <NUM>, <NUM>, <NUM>. As noted above, the map information may include numerous other features not depicted in this example.

As discussed further below, the map information may also include information identifying depot locations. The depots may be fixed locations which include parking areas or spaces for the vehicles. Some depots may also include one or more human operators who may manage work orders and vehicle transitions as discussed further below. These depots may have different characteristics, such as availability, intake bandwidth, services available, etc. In addition, some depots may have features such as shade, refueling or charging stations, cleaning services, and maintenance services. In some examples, the map information may also identity the physical to features of the depots in order to allow the vehicle to operate in an autonomous driving mode within the depot. In this regard, the map information may also identify specific areas of the depot, such as a maintenance area, that can be used to automatically transition the vehicle to a specific autonomous driving mode as discussed further below. For instance, map information <NUM> includes a depot <NUM> with entrance <NUM> and exit <NUM>. The map information also identifies features within the depot <NUM>, such as parking spots <NUM>-<NUM> as well as maintenance area <NUM> for performing various maintenance, such as cleaning, oil changes, refueling, charging, etc., on the vehicle <NUM>.

Positioning system <NUM> may be used by computing device <NUM> in order to determine the vehicle's relative or absolute position on a map or on the earth. For example, the position system <NUM> may include a GPS receiver to determine the device's latitude, longitude and/or altitude position. Other location systems such as laser-based localization systems, inertial-aided GPS, or camera-based localization may also be used to identify the location of the vehicle. The location of the vehicle may include an absolute geographical location, such as latitude, longitude, and altitude as well as relative location information, such as location relative to other cars immediately around it which can often be determined with less noise that absolute geographical location.

The positioning system <NUM> may also include other devices in communication with computing device <NUM>, such as an accelerometer, gyroscope or another direction/speed detection device to determine the direction and speed of the vehicle or changes thereto. By way of example only, an acceleration device may determine its pitch, yaw or roll (or changes thereto) relative to the direction of gravity or a plane perpendicular thereto. The device may also track increases or decreases in speed and the direction of such changes. The device's provision of location and orientation data as set forth herein may be provided automatically to the computing device <NUM>, other computing devices and combinations of the foregoing.

The perception system <NUM> also includes one or more components for detecting objects external to the vehicle such as other vehicles, obstacles in the roadway, traffic signals, signs, trees, etc. For example, the perception system <NUM> may include lasers, sonar, radar, cameras and/or any other detection devices that record data which may be processed by computing device <NUM>. In the case where the vehicle is a passenger vehicle such as a minivan, the minivan may include a laser or other sensors mounted on the roof or other convenient location. For instance, <FIG> is an example external view of vehicle <NUM>. In this example, roof-top housing <NUM> and dome housing <NUM> may include a lidar sensor as well as various cameras and radar units. In addition, housing <NUM> located at the front end of vehicle <NUM> and housings <NUM>, <NUM> on the driver's and passenger's sides of the vehicle may each store a lidar sensor. For example, housing <NUM> is located in front of driver door <NUM>. Vehicle <NUM> also includes housings <NUM>, <NUM> for radar units and/or cameras also located on the roof of vehicle <NUM>. Additional radar units and cameras (not shown) may be located at the front and rear ends of vehicle <NUM>.

The computing device <NUM> may control the direction and speed of the vehicle by controlling various components. By way of example, computing device <NUM> may navigate the vehicle to a destination location completely autonomously using data from the detailed map information and navigation system <NUM>. Computing device <NUM> may use the positioning system <NUM> to determine the vehicle's location and perception system <NUM> to detect and respond to objects when needed to reach the location safely. In order to do so, computing device <NUM> may cause the vehicle to accelerate (e.g., by increasing fuel or other energy provided to the engine by acceleration system <NUM>), decelerate (e.g., by decreasing the fuel supplied to the engine, changing gears, and/or by applying brakes by deceleration system <NUM>), change direction (e.g., by turning the front or rear wheels of vehicle <NUM> by steering system <NUM>), and signal such changes (e.g., by lighting turn signals of signaling system <NUM>). Thus, the acceleration system <NUM> and deceleration system <NUM> may be a part of a drivetrain that includes various components between an engine of the vehicle and the wheels of the vehicle. Again, by controlling these systems, computing device <NUM> may also control the drivetrain of the vehicle in order to maneuver the vehicle autonomously.

Computing device <NUM> of vehicle <NUM> may also receive or transfer information to and from other computing devices. <FIG> and <FIG> are pictorial and functional diagrams, respectively, of an example system <NUM> that includes a plurality of computing devices <NUM>, <NUM>, <NUM>, <NUM> and a storage system <NUM> connected via a network <NUM>. System <NUM> also includes vehicle <NUM>, and vehicle 100A which may be configured similarly to vehicle <NUM>. Although only a few vehicles and computing devices are depicted for simplicity, a typical system may include significantly more.

In one example, one or more computing devices <NUM> may include a server having a plurality of computing devices, e.g., a load balanced server farm, that exchange information with different nodes of a network for the purpose of receiving, processing and transmitting the data to and from other computing devices. For instance, one or more computing devices <NUM> may include one or more server computing devices that are capable of communicating with computing device <NUM> of vehicle <NUM> or a similar computing device of vehicle 100A as well as computing devices <NUM>, <NUM>, <NUM> via the network <NUM>. For example, vehicles <NUM> and 100A may be a part of a fleet of vehicles that can be dispatched by server computing devices to various locations. In this regard, the vehicles of the fleet may periodically send the server computing devices location information provided by the vehicle's respective positioning systems and the one or more server computing devices may track the locations of the vehicles.

In addition, server computing devices <NUM> may use network <NUM> to transmit and present information to a user, such as user <NUM>, <NUM>, <NUM> on a display, such as displays <NUM>, <NUM>, <NUM> of computing devices <NUM>, <NUM>, <NUM>. In this regard, computing devices <NUM>, <NUM>, <NUM> may be considered client computing devices.

As shown in <FIG>, each client computing device <NUM>, <NUM>, <NUM> may be a personal computing device intended for use by a user <NUM>, <NUM>, <NUM>, and have all of the components normally used in connection with a personal computing device including a one or more processors (e.g., a central processing unit (CPU)), memory (e.g., RAM and internal hard drives) storing data and instructions, a display such as displays <NUM>, <NUM>, <NUM> (e.g., a monitor having a screen, a touch-screen, a projector, a television, or other device that is operable to display information), and user input devices <NUM>, <NUM>, <NUM> (e.g., a mouse, keyboard, touchscreen or microphone). The client computing devices may also include a camera for recording video streams, speakers, a network interface device, and all of the components used for connecting these elements to one another.

Although the client computing devices <NUM>, <NUM>, and <NUM> may each comprise a full-sized personal computing device, they may alternatively comprise mobile computing devices capable of wirelessly exchanging data with a server over a network such as the Internet. By way of example only, client computing device <NUM> may be a mobile phone or a device such as a wireless-enabled PDA, a tablet PC, a wearable computing device or system, or a netbook that is capable of obtaining information via the Internet or other networks. In another example, client computing device <NUM> may be a wearable computing system, shown as a wrist watch as shown in <FIG>. As an example the user may input information using a small keyboard, a keypad, microphone, using visual signals with a camera, or a touch screen.

In some examples, client computing device <NUM> may be a concierge work station used by an administrator to provide concierge services to users such as users <NUM> and <NUM>. For example, user <NUM> may be a concierge who uses the concierge work station <NUM> to communicate via a telephone call or audio connection with users through their respective client computing devices or vehicles <NUM> or 100A in order to facilitate the safe operation of vehicles <NUM> and 100A and the safety of the users as described in further detail below. Although only a single concierge work station <NUM> is shown in <FIG> and <FIG>, any number of such work stations may be included in a typical system.

As with memory <NUM>, storage system <NUM> can be of any type of computerized storage capable of storing information accessible by the server computing devices <NUM>, such as a hard-drive, memory card, ROM, RAM, DVD, CD-ROM, write-capable, and read-only memories. In addition, storage system <NUM> may include a distributed storage system where data is stored on a plurality of different storage devices which may be physically located at the same or different geographic locations. Storage system <NUM> may be connected to the computing devices via the network <NUM> as shown in <FIG> and <FIG>, and/or may be directly connected to or incorporated into any of the computing devices <NUM>, <NUM>, <NUM>, <NUM>, <NUM>, etc..

The memory <NUM> of computing device <NUM> may store configuration instructions to allow the operating vehicle <NUM> to operate in different modes including a manual driving mode as well as one or more autonomous driving modes. In the manual driving mode, a driver is able to control the deceleration, acceleration, and steering of a vehicle at the input devices. In addition, vehicle <NUM> is configured via the configuration instructions such that commands from the control computing devices to control the actuators of the deceleration system <NUM>, acceleration system <NUM>, and steering system <NUM> are given no priority. In other words, in the manual driving mode, commands from the control computing device are invalid or ignored. In this way, the driver is guaranteed that the self-driving system will not interfere with operation of vehicle <NUM>.

In a first autonomous driving mode, the control computing devices may expect that a driver is presently in vehicle <NUM> and capable of controlling the vehicle in the manual driving mode. In other words, the control computing devices are configured via the configuration instructions to readily allow transitions from the first autonomous driving mode to the manual driving mode. Vehicle <NUM> is also configured such that commands originating from the user input devices are given priority over commands from the control computing devices. In this regard, the driver is able to readily take control by using any of the input devices of vehicle <NUM>. At the same time, the driver is guaranteed by both the control computing devices and the actuators that driver inputs will be prioritized over those of the control computing devices.

The first autonomous driving mode may also have a plurality of different sub-modes or configurations which allows for different levels of autonomy in different environments. For instance, the first autonomous driving mode may have a first configuration that allows for a fully-autonomous driving mode in specific areas of a pre-mapped environment, but semi-autonomous driving modes (e.g. where a driver controls speed and/or steering) everywhere else. A second configuration may allow a driver to adjust to increase the sensitivity of vehicle <NUM> to transitions to manual driving mode, for instance, where a driver prefers to more easily change vehicle <NUM> from the first autonomous driving mode to a semi-autonomous or the manual driving mode.

The first autonomous driving mode may also include a third configuration with additional modifications to allow for safe testing of vehicle <NUM> when a test driver is present. In order to have a redundant and more reliable means of guaranteeing test driver takeover ability, the transition between the first driverless mode and manual driving mode may be implemented in two different places: the control computing devices and at each actuator. The actuator software may be considered well vetted and fixed due to extensive testing and may not change very often. However, the software of the control computing devices may be changed and tested regularly. Because the actuators may transition to the manual driving mode independently of the control computing devices, commands from the control computing devices which are improper (i.e. those which continue even though there is a transition to the manual driving mode) are invalid and ignored. This transition may occur, for example, by having a driver (or test driver) take control of one or more of steering, braking, or acceleration. This allows for the safe and effective testing of new or updated software at the control computing devices.

In a second autonomous driving mode, the control computing devices may expect that a driver is not presently in vehicle <NUM> and capable of controlling vehicle <NUM> in the manual driving mode. In this configuration, both the actuators and control computing devices are configured via the configuration instruction to limit the impact of human inputs and transitions to the manual driving mode in order to guarantee the safety of passengers and vehicle <NUM>. In other words, the first autonomous driving mode may be "easier" to enter than the second autonomous driving mode in order to limit use of the second driving mode to situations in which there is no driver capable of controlling vehicle <NUM> present.

As with the first autonomous driving mode, the second autonomous driving mode may include a plurality of different sub-modes or configurations. As an example, a first configuration may be a fully autonomous "driverless transportation service" mode discussed above which can be used to allow vehicle <NUM> to provide transportation services to passengers or users of the transportation service. This configuration may prevent vehicle <NUM> from starting a trip if the vehicle does not meet certain conditions, such as if the vehicle is dirty, a door is open, passengers are not sitting in seats and/or do not have seat belt bucked, the vehicle is overloaded (there is too much weight in the vehicle's seats and/or cargo compartments), etc. This configuration may also utilize a partition to prevent passengers from reaching manual controls (steering wheel, brake pedal, acceleration pedal, etc.).

This first configuration may also allow vehicle <NUM> to accept instruction from a dispatching server such as the server computing devices <NUM>. For instance, when in the first configuration of the second autonomous driving mode, vehicles may be dispatched and/or staged by the server computing devices <NUM> to locations where a vehicle can safely wait to be assigned a trip. This may include sending a vehicle to a specific location, for instance, waiting at a specific shaded area near a mall, or sending a vehicle to a specific area, for instance, a specific square mile (<NUM> square mile being <NUM> square kilometers) or more or less to drive around and wait for an assignment. Similarly, vehicles may be limited to trips in certain areas as discussed above using, for instance, the second configuration of the second driving mode or by sending vehicle <NUM> to that area and using geo-fencing to limit movements of the vehicle to within certain areas. This may allow the dispatching servers to confirm that vehicles are sent only where needed, and thereby allow more efficient staging and use of a fleet of vehicles.

A second configuration may be similar to the first configuration, but with some limitations determined based on the current status of vehicle <NUM>. For instance, vehicle <NUM> may be prevented from entering specific regions, such as school zones, highways, etc., based on the vehicle's computing device's current software version, state of the vehicle's sensors (whether all are operating within normal parameters and/or whether the sensors were calibrated within some predetermined number of miles (one mile being <NUM> kilometers) or period of time, such as <NUM> miles or more or less or <NUM> hours), etc. In this regard, if vehicle <NUM>'s sensors have not been calibrated at a depot within the last <NUM> miles or last <NUM> hours, the vehicle may not be able to drive on highways or in school zones. For instance, if certain sensors, such as radar or cameras, are not recently calibrated, the vehicle may need to avoid unprotected left turns or certain intersections having traffic lights at certain relative positions.

The second autonomous driving mode may also include a third configuration for testing vehicle <NUM>. In this example, the computing devices may control vehicle <NUM> according to the configuration instructions as if the vehicle were operating in the first configuration. However, a test driver, rather than taking control of steering, acceleration, or deceleration, may use an "emergency stopping" button to immediately stop vehicle <NUM> in the event of a problem. In this regard, vehicle <NUM> may apply all braking power available immediately to stop the vehicle as quickly as possible. Generally, because such immediate stopping is not appropriate for when vehicle <NUM> is providing transportation services, the emergency stopping button may not be available (i.e. may be removable) when operating in the first configuration. In such cases, vehicle <NUM> may be stopped by a passenger using a pull over request via the passenger's client computing device or a pull over button of the vehicle.

In some instances, vehicle <NUM> may include a third autonomous driving mode that allows for service or software changes to the vehicle. For instance, this third autonomous driving mode may be considered a "depot" mode. This depot mode function similarly to the second autonomous mode, but also allow the vehicle to be transitioned out of the second autonomous driving mode and into a manual mode by an operator, which would otherwise not be allowed in the second autonomous mode. In the depot mode, the vehicle may also to function a certain way such as by operating at or below a certain speed limit designated for the depot (when operating manually or autonomously), using hazard or other lights to increase visibility of the vehicle, etc. hen in the third autonomous driving mode, the computing devices may operate vehicle <NUM> according to the configuration instructions in a way that allows an operator to interact with the vehicle and address any work orders generated for the vehicle by the server computing devices <NUM>. For instance, a vehicle may report its status to the server computing devices <NUM> periodically. If there any issues with vehicle <NUM> that require service, the server computing devices <NUM> may assign the vehicle to a depot (i.e. send the vehicle to a depot) and generate a work order which is sent a computing device at the depot to allow an operator to address the service need. This may include calibrating vehicle <NUM>'s sensors, refueling (gas or recharging), making oil changes, correcting tire pressure, cooling the vehicle or sensors, cleaning (interior and/or exterior), software updates, map information updates, etc. In some examples, the computing devices may be configured to keep the vehicle in the third autonomous driving mode or prevent the vehicle from leaving the depot until all outstanding work orders for vehicle <NUM> are addressed. As another example, once all work orders are completed, vehicle <NUM> may automatically transition back into the second autonomous driving mode (if the vehicle was previously in this mode before transitioning into the third autonomous driving mode) or may only do so after an operator manually transitions the vehicle into another mode.

The third autonomous driving mode may include a geo-fencing aspect that prevents or limits the ability for vehicle <NUM> to be serviced when the vehicle's current location is not at or within a predetermined distance of a depot or a specific location within a depot. In this regard, this third autonomous driving mode may not activate itself, or is prohibited by the configuration instructions, unless vehicle <NUM> meets these geo-fencing requirements. In other words, vehicle <NUM> may transition into the third autonomous driving mode automatically as soon as the vehicle reaches a depot. In order to address situations in which vehicle <NUM> needs service at a location which does not meet these requirements, an operator may connect to the vehicle and using a laptop or other mobile computing device, connect directly to the vehicle's computing device in order to transition the vehicle into the third autonomous driving mode.

As noted above, the computing devices <NUM> may be configured to prevent "accidental engages" or "accidental disengages" of the autonomous driving modes. For instance, certain restrictions may be added to mode transitions via the configuration instructions from the manual driving mode to the second autonomous driving mode and from the second autonomous driving mode to the manual driving mode or simply to engage the second autonomous driving modes. As one example, when vehicle <NUM> is operating in the manual driving mode, if vehicle <NUM> is in motion, the system may not be allowed to transition into the second autonomous driving mode. A request to do so would be invalid as if vehicle <NUM> is already in motion, as a driver would be available. Similarly, if vehicle <NUM> is in an area that was not already included in the vehicle's map information or not sufficiently mapped, the vehicle may be prevented from transitioning into the first or second autonomous driving mode.

In another example, the when operating in the second autonomous driving mode, the configuration instructions may prevent vehicle <NUM> from transitioning directly into the first autonomous driving mode. This may be especially important in a situation where a human driver is not actually able to take control of vehicle <NUM>.

As another example, the configuration instructions may include geo-fencing features. These geo-fencing features may be used by the computing device <NUM> to determine when to engage the manual or autonomous driving modes or specific configurations of these modes. For instance, a vehicle may only enter the second or third autonomous driving modes at or when vehicle <NUM> is within a predetermined distance of a depot or a specific location within a depot, whereas everywhere else, the vehicle may only transition into the manual or second autonomous driving mode. Similarly, vehicle <NUM> may not enter into the driverless transportation service or second configuration of the second autonomous driving mode if the vehicle is not within a predetermined distance of a depot or a specific location within a depot.

The configuration instructions may also prevent engages of the first or second autonomous driving modes without a specific type of human operator or passenger input, such as a press of a specific button or specific series of buttons. For instance, the computing devices may require a specific sequence of button presses to enter the first, second, or third autonomous driving modes. Ideally, this sequence may be selected to be complex enough to avoid an unauthorized person from taking control of vehicle <NUM> purposefully or by accident, but also simple and predictable enough that it could be easily performed by an operator. A further example may be to require specific authorization before allowing vehicle <NUM> to enter the second or third autonomous driving modes such as by signing in on a laptop with a password/code and/or security key and/or using a hardware dongle to plug into the vehicle and authenticate the operator using, for instance the sequence, before allowing the vehicle to transitioning modes. This may be especially useful if vehicle <NUM> is a personal (as opposed to a fleet vehicle) and can be used to confirm that the owner of the vehicle authorizes use of the second or third autonomous driving modes.

In another example, before transitioning into the manual driving mode from the second autonomous driving mode or the second autonomous driving mode to the manual driving mode, the configuration instructions may require that vehicle <NUM> meet a series of requirements such as being in park with the door open, at a specific location or area of the map information, with a door of the vehicle being open, recently calibrated sensors, specific software requirements, etc. Keeping the door open may prevent vehicle <NUM> from moving, i.e. by using a parking brake, during and after such transitions. In this regard, opening a door while the vehicle <NUM> is moving may cause the vehicle to come to a stop or pull over. Similarly, vehicle may only transition into the first or second autonomous driving mode if vehicle <NUM>'s sensors were calibrated within some specific time frame, such as within the last <NUM> miles or more or less and/or within the last <NUM> hours or more or less. In addition, the computing devices may be configured to only transition into the first or second autonomous driving mode after confirming that the corresponding software has been crytpographically signed.

The configuration instructions may also prevent vehicle <NUM> from transitioning into the second or third autonomous driving modes or leaving a depot based on instructions from the server computing devices <NUM>. For instance, if vehicle <NUM> is not currently assigned to a specific staging locations (to wait for a trip assignment) or on a specific trip assignment, the computing devices may prevent vehicle <NUM> from leaving the depot. In this regard, vehicle <NUM> may be in a "holding pattern" at a depot until needed to provide transportation services. In other words, vehicle <NUM> may "refuse" to leave a depot until it is put "into service" by the server computing devices <NUM>. This holding pattern may be a fourth configuration or the second autonomous driving mode, a configuration of the third autonomous driving mode, or a geo-fencing feature. This may prevent a third party from accessing or trying to take vehicle <NUM>.

Moreover, any of the foregoing examples may be utilized together. For instance, when transitioning to the second or third autonomous driving modes, the safety monitor may require proximity to a specific depot, an open door, and a specific sequence of button presses.

In addition to the above, the memory <NUM> may also store instructions for a safety monitor which monitors communications between the control computing devices and other systems of vehicle <NUM>. The safety monitor may operate using a secondary code library that runs alongside the primary vehicle control code at the control computing devices. The safety monitor maintains certain safety invariants. This may include, for instance, that in the first autonomous driving mode either all actuators (deceleration, acceleration, and steering) are in the autonomous driving mode or none are. This ensures that any actuator has the ability to return the whole system to manual driving mode. In other words, when operating in the first autonomous driving mode, if one actuator transitions to manual driving mode, this functions to transition the entire system, including all other actuators and the control computing devices into the manual driving mode.

In another example, the when operating in the second autonomous driving mode, the safety monitor may prevent vehicle <NUM> from transitioning into the manual or first autonomous driving mode. This may be especially important in a situation where a human driver is not actually able to take control of vehicle <NUM>. The safety monitor may also prevent vehicle <NUM> from taking specific actions in the first autonomous driving mode, such as sudden maneuvers (U-turns, etc.) that may make it hard for a human driver to take control of the vehicle. By checking for these conditions, the safety monitor may operate to prevent inappropriate entry into or operations during the autonomous driving modes.

As an example, as shown in <FIG>, vehicle <NUM> is being operated in a manual driving mode on a portion of roadway <NUM> corresponding to the map information <NUM>. For instance, <FIG> includes lanes <NUM>, <NUM> corresponding to lanes <NUM>, <NUM>, lane lines <NUM>, <NUM>, <NUM>, <NUM> corresponding to lane lines <NUM>, <NUM>, <NUM>, <NUM>, depot <NUM> with entrance <NUM> and exit <NUM> corresponding to corresponding to depot <NUM> with entrance <NUM> and exit <NUM>, parking spots <NUM>-<NUM> corresponding to parking spots <NUM>-<NUM>, as well as maintenance area <NUM> corresponding to maintenance area <NUM>.

In this manual driving mode, a driver is able to control the deceleration, acceleration, and steering of vehicle <NUM> at the input devices. As the driver controls these input devices, any commands from computing device <NUM> are ignored or invalidated by the actuators of the deceleration system <NUM>, acceleration system <NUM>, and steering system <NUM>. Again, because of this, the driver is guaranteed that the self-driving system will not interfere with operation of vehicle <NUM>.

At some point, the driver may want to transition from the manual driving mode into a first autonomous driving mode. This may be accomplished by having the driver push a specific button, push a series of buttons, use a lever or gear shift control, etc. In addition, vehicle <NUM> must also meet any transition requirements or geo-fencing requirements of the configuration instructions and/or safety monitor. Otherwise, the configuration instructions and/or safety monitor may prevent the transition into the first autonomous driving mode. Once in the first autonomous driving mode, the computing device <NUM> will control vehicle <NUM> according to the instructions of memory <NUM>. In addition, the safety monitor may continuously confirm that in the first autonomous driving mode all actuators of the deceleration system <NUM>, acceleration system <NUM>, and steering system <NUM> are in the first autonomous driving mode. If any are not operating in the first autonomous driving mode, the safety monitor may transition such actuators into the first autonomous driving mode or transition vehicle <NUM> to the manual driving mode as a safety precaution.

As noted above, commands originating from the user input devices are given priority over commands from the computing devices <NUM>. As such, the driver is able to transition vehicle <NUM> back to the manual driving mode by using any of the input devices of the vehicle. Again, the driver is guaranteed by both the control computing devices and the actuators that driver inputs will be prioritized over those of the control computing devices.

The driver may select to operate the first autonomous driving mode in various configurations. When in the first configuration, vehicle <NUM> may operate in a fully-autonomous driving mode in specific areas defined by the map information, but in semi-autonomous driving modes everywhere else. In the second configuration, the driver may use a user input device, such as a set of buttons or knob, to increase the sensitivity of vehicle <NUM> to transitions to manual driving mode. In this regard, the driver may change the amount of gripping force on the steering wheel, amount of change in the position of the steering wheel, amount of force or change in position of an accelerator pedal, amount of force or change in position of a brake pedal, etc. needed to transition vehicle <NUM> from the first autonomous driving mode to the manual driving mode.

The driver may also choose to operate vehicle <NUM> in a third configuration of the first autonomous driving mode in order to test the vehicle's operation in the first autonomous driving mode. When transitioning to the third configuration of the second autonomous driving mode, the change may occur both at the control computing device <NUM> as well as the actuators of the deceleration system <NUM>, acceleration system <NUM>, and steering system <NUM>. Similarly, when the driver wants to transition back to the manual driving mode as discussed above, the transition again may occur at both the control computing device <NUM> as well as the actuators of the deceleration system <NUM>, acceleration system <NUM>, and steering system <NUM>. As such, commands from the control computing devices which are improper are invalid and ignored.

When operating vehicle <NUM> in the first autonomous driving mode, the driver may not be able to transition to the second autonomous driving mode. Any such requests may be prohibited by the configuration instructions, safety monitor, or both.

In order to operate vehicle <NUM> in the second autonomous driving mode, the vehicle must also meet any transition requirements or geo-fencing requirements of the configuration instructions and/or safety monitor. Using the examples above, vehicle <NUM> must be stopped, with the door open, and within a depot location while a human operator performs a series of button pushes to activate the second autonomous driving mode. In this regard, if the vehicle is moving as shown in <FIG>, vehicle <NUM> could not transition into the second autonomous driving mode, the configuration instructions and/or safety monitor may prevent the transition into the first autonomous driving mode. However, in the example of <FIG>, vehicle <NUM> is located within parking spot <NUM> of depot <NUM> with driver door <NUM> shown in the open position. As such, upon performing the proper series of button pushes, an operator may transition vehicle <NUM> into the second autonomous driving mode.

Once in the second autonomous driving mode, the computing devices <NUM> will control vehicle <NUM> according to the instructions of memory <NUM>. In addition, the safety monitor may continuously confirm that in the second autonomous driving mode all actuators of the deceleration system <NUM>, acceleration system <NUM>, and steering system <NUM> are in the second autonomous driving mode. If any are not operating in the second autonomous driving mode, the safety monitor may transition such actuators into the second autonomous driving mode or cause vehicle <NUM> to come to a stop immediately. This may also prevent vehicle <NUM> from being transitioned from the second autonomous driving mode to the manual driving mode.

When in the second autonomous driving mode, both the actuators of the deceleration system <NUM>, acceleration system <NUM>, and steering system <NUM> and computing device <NUM> are configured via the configuration instruction to limit the impact of human inputs and transitions to the manual driving mode in order to guarantee the safety of passengers and vehicle <NUM>. In this regard, a passenger of vehicle <NUM> may not ever be permitted to transition the vehicle directly from the second autonomous driving mode to the first autonomous driving mode.

The human operator may also select a configuration for the second autonomous driving mode. In one instance, the operator may select a first or second configuration using a laptop or other device as described above to provide transportation services to passengers or users of the transportation service as discussed above. The human operator may also select a third configuration for testing vehicle <NUM> which provides for the use of an "emergency stopping" button to immediately stop the vehicle in the event of a problem. For instance, the operator may load certain files, remove certain files, run certain commands, etc. or use a user interface to simply select or initiate the different configurations.

In some instances, vehicle <NUM> may require maintenance or other services. In this regard, the vehicle may transition into the third autonomous driving mode. This may occur as vehicle <NUM> approaches or enters a depot (or a specific location within a depot), or when a human operator "manually" transitions the vehicle to the third autonomous driving mode using a laptop or other mobile computing device connected directly to the computing device <NUM>. For instance, turning to the example of <FIG>, vehicle <NUM> may automatically transition to the third autonomous driving mode when the vehicle enters depot <NUM> via entrance <NUM>. In another example, vehicle <NUM> may automatically transition to the third autonomous driving mode when the vehicle is parked in a parking spot of the depot, such as parking spot <NUM> as shown in <FIG>. In a further example, vehicle <NUM> may automatically transition to the third autonomous driving mode when the vehicle enters or is parked within maintenance area <NUM> as shown in <FIG>. Alternatively, when in any of the locations of the examples of <FIG>, an operator may be able to transition the vehicle into the third autonomous driving mode. Similarly, if a vehicle requires maintenance and is stopped in a non-depot location, for instance, if vehicle <NUM> is stopped and positioned in lane <NUM> as shown in <FIG>, a human operator may connect directly to computing devices <NUM> with a mobile computing device in order to transition the vehicle into the third autonomous driving mode. When in the third autonomous driving mode, the computing device <NUM> may also control the vehicle <NUM> in order to allow the vehicle to be serviced according to any outstanding work orders for the vehicle.

Claim 1:
A system comprising:
one or more control computing devices (<NUM>) configured to send commands to one or more actuators of a vehicle (<NUM>) in order to control deceleration, acceleration, and steering of the vehicle, and wherein the vehicle includes one or more user input devices (<NUM>) for allowing a human operator to control the one or more actuators in order to control deceleration, acceleration, and steering of the vehicle;
wherein the one or more control computing devices are configured to allow the vehicle to operate the vehicle in:
a manual driving mode wherein a human operator controls the deceleration, acceleration, and steering of the vehicle at the one or more user input devices;
a first autonomous driving mode wherein the one or more control computing devices are configured to send the commands to control the one or more actuators and wherein human operator inputs at the one or more user input devices are prioritized over the commands from the one or more control computing devices such that the vehicle transitions to the manual driving mode in response to the human operator inputs at the one or more user input devices; and
a second autonomous driving mode wherein the one or more control computing devices are configured to send the commands to control the one or more actuators and wherein the commands from the one or more control computing devices are prioritized over the human operator inputs from the one or more user input devices.