Patent Description:
Autonomous vehicles employ various computing means to aid automated vehicle operation. Recently, in the automotive industry, much of the focus is on making a vehicle operate in an autonomous mode in a safe manner. Autonomous driving vehicles allow a passenger (driver) to manually switch from a human driving mode (i.e., a mode when the operator fully exercises the controls of the vehicle) to an autonomous mode (i.e., a mode where the vehicle essentially drives itself). Vehicles capable of both modes of operation (autonomous and manual) are hybrid driving vehicles.

In the past, the switching between autonomous and manual driving modes is done manually. In operation, in some situations, switching itself may present danger if it is carried out in certain situations. Furthermore, even when an autonomous driving vehicle detects potential danger and decides to switch the control to a human driver, the manner by which the human driver is to take over the control in a manual mode may depend on the state of the passenger.

For instance, while in an autonomous driving mode, the passenger may have been paying less attention or may even fall sleep. Those real issues in autonomous driving have not been addressed in the past.

Another aspect involves automatic switching in a vehicle of hybrid driving modes in the reverse direction, i.e., from a human driving mode to an autonomous driving mode.

The traditional approaches do not address switching in this direction, let alone how to do it in a safe manner.

Therefore, there is a need for solutions to solve such problems.

<CIT> discusses a processor-implemented method, system, and/ or computer program product control a driving mode of a self-driving vehicle. <CIT> discusses a method for transitioning vehicle control.

The invention is defined by the independent claims, with preferred features being set out in the dependent claims.

The invention disclosed herein relates to methods, systems, and programming for augmented behavior planning in autonomous and hybrid vehicular driving environments. More particularly, the present invention relates to methods, systems, and programming related to mechanisms of performing handover operations associated with different modes of operation of vehicles.

Other concepts relate to software for implementing the present invention on developing a vehicular system. A software product, in accordance with this concept, includes at least one machine-readable non-transitory medium and information carried by the medium. The information carried by the medium may be executable program code data, parameters in association with the executable program code, and/or information related to a user, a request, content, or information related to a social group, etc..

Additional advantages and novel features will be set forth in part in the description which follows, and in part will become apparent to those skilled in the art upon examination of the following and the accompanying drawings or may be learned by production or operation of the examples. The advantages of the present invention may be realized and attained by practice or use of various aspects of the methodologies, instrumentalities and combinations set forth in the detailed examples discussed below.

The methods, systems and/or programming described herein are further described in terms of exemplary embodiments.

In the following detailed description, numerous specific details are set forth by way of examples in order to provide a thorough understanding of the relevant invention. However, it should be apparent to those skilled in the art that the present invention may be practiced without such details. In other instances, well known methods, procedures, components, and/or circuitry have been described at a relatively high-level, without detail, in order to avoid unnecessarily obscuring aspects of the present invention.

An autonomous vehicle is one that is capable of sensing its environment and navigating through the environment without human input. Autonomous cars use a variety of techniques to detect their surroundings, such as radar, laser light, GPS, odometer and computer vision. Advanced control systems interpret sensory information to identify appropriate navigation paths, as well as obstacles and relevant signage. Autonomous cars include control systems that are capable of analyzing sensory data to distinguish between different cars on the road. The potential benefits of autonomous vehicles include reduced mobility and infrastructure costs, increased safety, increased mobility, increased customer satisfaction and reduced crime. Specifically, a significant reduction in traffic collisions and related costs is incurred by autonomous vehicles, including less need for insurance. Autonomous vehicles are predicted to increase traffic flow, relieve travelers from driving and navigation chores, and lower fuel consumption.

However, there are certain obstacles in the widespread adoption of autonomous vehicles. For instance, disputes concerning liability, time period needed to replace the existing stock of vehicles, resistance by individuals to forfeit control, consumer safety concerns, implementation of a workable legal framework and establishment of government regulations, risk of loss of privacy and security concerns are some factors that impede the adoption of autonomous vehicles. As such, there is described below a framework for a vehicular system that employs both an autonomous mode of operation, as well as a human-driver mode of operation. Note that the terms 'autonomous mode' and 'auto mode' are herein used interchangeably to correspond to an automatic operation of the vehicle, while the terms 'human-driver mode' and 'manual mode' are used interchangeably to correspond to operating the vehicle by a human driver.

<FIG> depicts an exemplary diagram illustrating switching of operating modes in a vehicle, according to an embodiment of the present invention. As shown in <FIG>, the vehicle includes a driving mode switching unit <NUM> and a multi-modal switching warning unit <NUM>. The vehicle can operate in an autonomous mode <NUM> or a human-driver mode <NUM>. The driving mode switching unit <NUM> is configured to switch the mode of operation of the vehicle between the autonomous mode <NUM> and a human-driver mode <NUM>, respectively.

By one embodiment, the driving mode switching unit <NUM> initially determines a current mode in which the vehicle is operating. Upon determining the current mode of operation, the driving mode switching unit <NUM> determines, based on certain criteria (described next with reference to <FIG>), whether a transition to a different mode is required. For example, if the current mode of operation is determined to be the autonomous mode (or alternatively, the human-driver mode), the driving mode switching unit <NUM> determines, based on a criterion associated with operating the vehicle in the current mode, whether a transition to the human-driver mode (or alternatively, the autonomous mode) is required. Upon an affirmative determination to switch the current mode of operation, the driving mode switching unit <NUM> provides an instruction to a multi-modal switching warning unit <NUM> indicating the intent to perform a switch in the operating mode of the vehicle.

Upon receiving the instruction indicating the intent of performing the switch in the operating mode of the vehicle, the multi-modal switching warning unit <NUM>, delivers warning signals (described later with reference to <FIG>) to an operator (e.g., driver) of the vehicle. Moreover, the warning signals may include certain tasks that are to be performed by the driver of the vehicle in order to switch the operating mode of the vehicle in an efficient manner. As such, by one embodiment, the multi-modal switching warning unit <NUM> monitors the driver to determine whether the tasks are being performed in a timely manner. Specifically, the multi-modal switching warning unit <NUM> monitors each task that is assigned to the driver of the vehicle to ensure that the assigned task is being performed in a timely manner. The driving mode switching unit <NUM> receives a feedback signal indicating a status of each of the tasks assigned to the driver of vehicle. Based on a successful completion of each task, the driving mode switching unit <NUM> executes the switching of the operation mode of the vehicle. By one embodiment, if a certain task is not completed in a timely manner, the driving mode switching unit <NUM> receives a feedback signal indicating that an exception handling process is to be performed. Details regarding the operations of the multi modal switching warning unit <NUM>, and the driving mode switching unit <NUM> are described herein.

<FIG> depicts an exemplary block diagram of the driving mode switching unit <NUM> of the vehicle, according to an embodiment of the present invention. The driving mode switching unit <NUM> includes a current risk evaluator <NUM>, a switch risk determiner <NUM>, a switch warning control unit <NUM>, a switch executor <NUM>, a vehicle control system <NUM>, a driver profile <NUM> and a map/road configuration model <NUM>.

The current risk evaluator <NUM> is configured to determine a risk in operating the vehicle in a current mode of operation. By one embodiment, to determine the risk, the current risk evaluator <NUM> receives as input, real-time vehicle data, real-time intrinsic and extrinsic data, sensor data, the driver profile <NUM>, and the map/road configuration data <NUM>. The map/road configuration data <NUM> provides information pertaining to a geographical location where the vehicle is currently located. Additionally, the map/road configuration data <NUM> may include information corresponding to traffic in the geographical location of the vehicle. The driver profile <NUM> data includes information pertaining to a driving history of the driver. Such information may include, for instance, a number of violations the driver has been involved in a predetermined time-period, a model of the vehicle the driver is operating, characteristics of the driver such as, whether the driver is handicapped, whether the driver is short-sighted, whether the driver is required by law to wear devices (e.g., prescription glasses) which aid the driver in operating the vehicle, weather conditions in which driver is preferably recommended not to operate the vehicle, etc..

Turning to <FIG>, there is depicted an exemplary real-time vehicle data which is input to the current risk evaluator <NUM>. Specifically, <FIG> depicts an illustrative graph depicting the information associated with real-time vehicle data in accordance with various embodiments of the present invention. For instance, the real time vehicle data may include information pertaining to a current location of the vehicle (e.g., a latitude and longitude position), information regarding the surrounding of the vehicle, current visibility (e.g., amount of sun glare based on the current time) experienced by the driver of the vehicle, weight or mass specific control of the vehicle (e.g., current weight of passengers in the vehicle and other control parameters relevant to the operation of the vehicle), and information pertaining to servicing of the vehicle e.g., a current oil-level, condition of tires, brakes, wipers, and other important parameters that determine whether the vehicle can be operated in a safe fashion.

The current risk evaluator <NUM> also receives real time data (extrinsic and intrinsic capabilities of the vehicle) that is utilized in determining the risk of the current mode of operation of the vehicle. Turning to <FIG>, there is depicted an illustrative graph depicting the information associated with real-time intrinsic and extrinsic data in accordance with various embodiments of the present invention. As shown in <FIG>, data related to intrinsic capabilities of the vehicle may include information pertaining to operating parameters of the vehicle such as capable speed, capable safety level of the vehicle, faults in the vehicle (e.g., low-levels of tire pressure, faulty brake pads, faulty head/tail lights etc.), and a reliability factor of the vehicle. The data related to extrinsic capabilities of the vehicle may include information external to the vehicle such as, a type and condition of the road the vehicle is traversing (e.g., a steepness/slope of the road, speed limits permitted on the road, current vehicular and human traffic on the road, and road surface conditions such as whether the road is slippery), weather information corresponding to the environment of the vehicle (e.g., ice, snow or amount of precipitation on the road the vehicle is traversing), a visibility in the environment of the vehicle, and external events such as whether there is an accident in the route of the vehicle, whether the vehicle is traversing in a restricted zone (e.g., a hospital or a school), or whether there is construction in the route of the vehicle that results in a detour of the initially planned route for the vehicle and the like.

A further input to the current risk evaluator <NUM> is real-time sensor data that is utilized to determine a current state of the driver of the vehicle. Turning to <FIG>, there is depicted an illustrative graph depicting information associated with the state of the driver of the vehicle in accordance with various embodiments of the present invention. Such information may include data corresponding to a posture of the driver and/ or passengers (e.g., detecting position, sitting posture, whether a seatbelt is worn by the driver, etc.), and a position of the driver and the passengers in the vehicle. Additional information associated with the driver state may include information pertaining to a health of the driver, a functional state of the driver (i.e., whether the driver is drowsy, sleeping or feeling sleepy, and whether the driver is intoxicated), a mental state of the driver (e.g. an alertness level of the driver), and information pertaining to a nature of trip made by the driver (e.g., if the driver and/or passenger is seriously wounded and the vehicle is on route to a hospital etc.). The sensor data utilized by the current risk evaluator <NUM> to detect the above described state(s) of the driver are described later with reference to <FIG>.

Upon receiving the above described inputs, the risk evaluator <NUM> determines the risk involved in the current mode of operation of the vehicle. Specifically, the risk evaluator <NUM> determines whether it is safe to operate the vehicle in the current mode of operation. Details regarding the computation of such a risk are described later with reference to <FIG>. Upon computing the risk, the current risk evaluator <NUM> determines whether the computed risk satisfies a certain criterion (e.g., is the computed risk above or below a predetermined first threshold risk level). The predetermined first threshold risk level associated with a particular mode of operation of the vehicle may correspond to a safety level of operating the vehicle in the particular mode of operation of the vehicle. Specifically, if the computed risk is above the first predetermined threshold risk level, it may be deemed that it is unsafe to operate the vehicle in the current mode, whereas if the computed risk is below the first predetermined threshold risk level, it may be deemed that the vehicle can continue to operate in the current mode. Based on the computed risk satisfying (or not satisfying) the criterion, the risk evaluator <NUM> may determine whether it is safe to operate the vehicle in the current mode of operation, or whether a switching of the current mode to a different mode of operating the vehicle is to be performed.

By one embodiment, if the computed risk associated with the current mode of operation is within permissible limits (e.g., the risk is below the first predetermined threshold risk level), the vehicle maintains the current mode of operation of the vehicle (i.e., no transition in the operation mode of the vehicle is to be executed). However, if the computed risk does not satisfy the criterion (e.g., the computed risk is above the first predetermined threshold risk level), the current risk evaluator <NUM> activates the switch risk determiner <NUM>, to determine whether it is feasible to switch the operating mode of the vehicle to a different mode.

The switch risk determiner <NUM> receives the real-time intrinsic and extrinsic data, information pertaining to the current state of the driver, and the current mode in which the vehicle is operating. By one embodiment, the switch risk determiner <NUM> is configured to determine a risk associated with switching the vehicle to operate in the different mode of operation. For instance, if the vehicle is currently operating in the autonomous mode, the switch risk determiner <NUM> computes the risk of switching the vehicle to operate in the human-driven mode (i.e., a manual mode), and similarly if the vehicle is currently operating in the human-driven mode, the switch risk determiner <NUM> computes the risk of switching the vehicle to operate in the autonomous mode. The determination of the risk incurred in switching the mode of operation of the vehicle is computed based on several factors as described later with reference to <FIG>.

By one embodiment, the current risk evaluator <NUM> determines the current risk associated with the current mode of operation of the vehicle. If the current risk is determined to be exceptionally high i.e., greater than a second predetermined threshold (substantially greater than the first predetermined threshold (e.g., the safety level)) associated with the current mode, the risk determiner <NUM> may not initiate the switch risk determiner to determine a risk associated with switching the mode of operation of the vehicle to the different mode.

Rather, the current risk evaluator <NUM> may execute an exception handling process e.g., to bring the vehicle to a stop in a safe manner. For example, consider that the current mode of operation of the vehicle is a human-driven mode. If the risk determiner <NUM> determines, for instance, that the driver of the vehicle is having a seizure or a life-threatening event (detected via a driver state analyzer included in the risk evaluator <NUM>, and described later with reference to <FIG>), then risk determiner <NUM> may not initiate the switch risk determiner <NUM> to determine a risk associated with switching the operating mode of vehicle. Instead, the current risk evaluator <NUM> may execute the exception handling process such as bringing the vehicle to an immediate halt, initiating a call for assistance to governmental authorities (e.g., automatically dialing <NUM> or calling for roadside assistance via a mobile phone associated with the vehicle), transmitting GPS location of the vehicle to a server that monitors the operations of the particular vehicle and other like vehicles. It must be appreciated that to perform the above stated functions of bringing the vehicle to a complete halt may include processing steps such as determining a current speed of the vehicle, a current lane in which the vehicle is traversing, neighboring traffic, identifying a shoulder region on the road (e.g., a pull-over zone), and gradually bringing the vehicle to a complete halt in a safe manner. As such, as shown in <FIG>, the current risk evaluator <NUM> may bypass the switch risk determiner <NUM> and directly signal the switch executor <NUM> to instruct the vehicle control <NUM> of the imminent change in operation of the vehicle e.g., bringing the vehicle to a stop.

By one embodiment, if the current risk evaluator <NUM> determines that the current risk associated with the current mode of operation of the vehicle is above the first predetermined threshold associated with the current mode (safety level of the current mode), and below the second predetermined threshold level associated with the current mode, the current risk evaluator activates the switch risk determiner <NUM> to determine a risk associated with switching the vehicle to a different mode. If the switch risk determiner <NUM> determines that the risk associated with switching the operating mode of the vehicle to the different mode is feasible i.e., the switch risk determiner <NUM> determines that the vehicle can operate in the different mode in an efficient manner, the switch risk determiner <NUM> controls the switch warning control unit <NUM> to transmit a signal to the multi-modal switch warning unit <NUM>, which provides instructions (e.g., via visual and audio means, that are described later with reference to <FIG>) to the driver to perform a certain set of tasks such that the vehicle can transition to the different mode in an effective manner. Specifically, the multi-modal switch warning unit <NUM> provides an indication to the driver that the current mode of operation of the vehicle is at risk, as thus a switch to a different mode of operation of the vehicle will occur imminently based on the driver performing the set of assigned tasks. Details regarding the operations involved in switching the operating mode of the vehicle to the different mode are described later with reference to <FIG>.

In contrast, if the switch risk determiner <NUM> determines that the risk associated with switching the vehicle to the different mode is high, the switch risk determiner <NUM> may control the switch executor <NUM> to instruct the vehicle control system <NUM> to implement an exception handling process as stated previously.

<FIG> depicts an illustrative flowchart of an exemplary process performed by the driving mode switching unit <NUM> of the vehicle, according to an embodiment of the present invention. The process commences in step <NUM>, wherein the driving mode switching unit <NUM> receives real-time information (i.e., real-time vehicle data, real-time intrinsic and extrinsic data), and sensor data.

Further, in step <NUM> the process determines the current driving mode of the vehicle and a current state of the driver operating the vehicle based on the received information in step <NUM>. Details regarding the detection of the current state of the driver operating the vehicle are described later with reference to <FIG>, whereas the details regarding the determination of the current mode of operation of the vehicle are described later with reference to <FIG>.

Further in step <NUM>, the process evaluates a risk associated with the current mode of operation of the vehicle. Thereafter, in step <NUM>, the process performs a query to determine if the evaluated risk of operating the vehicle in the current mode is exceptionally high. For example, as stated previously, the process determines whether the evaluated risk is above the second predetermined threshold associated with the current mode of operation of the vehicle. If the response to the query is affirmative, the process moves to step <NUM>, wherein the exceptional handling process as stated previously is executed. However, if the response to the query is negative, the process moves to step <NUM>.

In step <NUM>, the process determines a switching risk i.e., risk associated with transitioning the vehicle to a different mode of operation of the vehicle. By one embodiment, and as described later with reference to <FIG>, the switching risk may be computed the driver based on the driver of the vehicle executing at least one task within an estimated time to perform the at least one task, wherein the estimated time is determined based on the state of the driver. Moreover, it must be appreciated that while switching from the current mode to a different mode of operating the vehicle, the risk in the different mode of operation of the vehicle does not exceed a threshold level of risk associated with the different mode.

The process then moves to step <NUM>, wherein a query is performed to determine whether the switching risk evaluated in step <NUM> is high. By one embodiment, the process may determine whether there is any switching risk associated with transitioning the vehicle to the different mode. If the response to the query in step <NUM> is affirmative, the process moves to step <NUM> and executes the exception handling process, else the process moves to step <NUM>.

In step <NUM>, the process selects at least one warning media from a plurality of warning media sources to alert the driver of the vehicle of the imminent switch in the operating mode of the vehicle. By one embodiment, the warning media is selected based on the evaluated switching risk of step <NUM>. Additionally, by one aspect of the present invention, the warning media may be selected, based on the driver's state wherein the warning media alerts the driver to perform certain tasks (described later with reference to <FIG>) in order to transition/switch the operating mode of the vehicle in an efficient manner.

In step <NUM>, the process executes the warning based on the selected media, and thereafter in step <NUM>, the driving mode switching unit <NUM> executes the switching of the operating mode of the vehicle.

Turning now to <FIG>, there is depicted according to an embodiment, an exemplary block diagram of a risk evaluator <NUM> included in the driving mode switching unit <NUM> of the vehicle. As stated previously, the risk evaluator <NUM> is configured to determine a risk associated with a current mode in which the vehicle is operating. As shown in <FIG>, by one embodiment of the present invention, the risk evaluation is performed in the autonomous mode of operation and the manual model of operation, respectively. Also associated with each mode of operation is a risk evaluation corresponding to a risk incurred in switching from the current mode of operation to a different mode. It must be appreciated that the number of modes in which the vehicle can operate is in no way limited to the two modes depicted in <FIG>. Rather, the vehicle can operate in a plurality of modes as described later with reference to <FIG>.

The risk evaluator <NUM> as depicted in <FIG> includes a driver state analyzer <NUM>, a driver risk model <NUM>, a current mode detector <NUM>, an auto mode risk detector <NUM>, a manual mode risk detector <NUM>, a current mode risk report generator <NUM>, an exceptional risk handler <NUM>, and driver profiles <NUM>.

By one embodiment, the driver state analyzer <NUM> receives data from a plurality of sensors that are configured to capture information pertaining to various characteristics of the driver and/or passengers in the vehicle. For instance, the vehicular system may comprise a plurality of sensors including visual sensors, acoustic sensors, smell sensors, light sensors and the like that enable the risk evaluator <NUM> to determine a state of the driver. Details regarding the various sensors and the information captured by them to detect the state of the driver are described later with reference to <FIG>.

The current mode detector <NUM> is configured to determine a current mode of operation of the vehicle. By one embodiment, real-time vehicle data described previously with reference to <FIG> can be used to determine the mode of operation of the vehicle. For example, sensors disposed within the vehicle may be configured to determine whether the driver is operating the vehicle by detecting for instance, if the steering wheel is being operated by the driver, the gas and/or brake pedals are being controlled by the driver and like. It must be appreciated that various mechanisms can be utilized to determine whether the vehicle is being operated in the human-driver or autonomous mode of operation.

Based on a determination of the current mode of operation of the vehicle, the current mode detector <NUM> activates either the auto mode risk detector <NUM> or the manual mode risk detector <NUM>, to determine a risk associated with the respective mode of operation of the vehicle. The auto mode risk detector <NUM> receives as input, real-time data, and real-time vehicle data as described previously with reference to <FIG> and <FIG>. The manual mode risk detector <NUM> receives as input, the real-time data, and real-time vehicle data, the driver state, and the information included in the driver profile <NUM>.

By one embodiment, the auto mode risk detector <NUM> may determine risk events based on environmental conditions. For example, in extreme foggy weather, the auto mode risk detector <NUM> may determine that it is unsafe for the vehicle to operate autonomously, for example, it may be difficult for the collision sensors of the vehicles to detect neighboring vehicles accurately. In a similar manner, when the vehicle is traversing on an icy road that is steep in nature, it may be feasible to operate the vehicle under human control i.e., the autonomous mode may not be appropriate to control the vehicle under harsh (icy) road conditions. Additionally, there may be certain geographical areas where autonomous driving is prohibited or is deemed unsafe such as acceleration lanes, exit lanes, toll booths, known construction zones, school zones and portions of roadway near such areas. The risk associated with such events is determined by the auto mode risk detector <NUM>.

Similar to the scenario of hazardous autonomous driving cases as described above, by one embodiment, the manual mode risk detector <NUM> may determine situations where operating the vehicle under manual control may be hazardous. For example, the manual mode risk detector <NUM> may determine based on a detected state of the driver and driver profiles <NUM> that the driver is likely to meet with an accident in the imminent future. Such a determination may be based on a density of traffic disposed near the vehicle under consideration. As a further example, risk associated with the manual mode of operation of the vehicle may correspond to detecting a number of times (within a predetermined time-window), the vehicle diverts from its intended path. For example, sensors in the vehicle may detect that the vehicle is being operated by the driver in a manner such that the vehicle diverts from a lane center into adjacent lanes. Based on an amount of traffic disposed near the vehicle, the manual mode risk detector <NUM> may deem the occurrence of such an event as a risky event. Similarly, the driver state detector may determine that the driver is in a state of drowsiness, sleepy and/or yawning, and it may be risky to operate the vehicle in the human-driven mode.

The auto mode risk detector <NUM> as well as the manual mode risk detector <NUM> detect the respective risks associated in operating the vehicle in the autonomous mode or manual mode respectively, in accordance with a driving risk model <NUM>. Specifically, based on the respective input information, the auto mode risk detector <NUM> as well as the manual mode risk detector <NUM> utilize the risk model <NUM> to evaluate the risk in operating the vehicle in the respective modes.

By one embodiment, the auto mode risk detector <NUM> and the manual mode risk detector <NUM> input the information pertaining to the driver and/or the above detected scenarios pertaining to the geographical location in which the vehicle is traversing to a risk report generator <NUM>. The risk report generator <NUM> utilizes driving risk models <NUM> to generate a risk report associated with the auto mode or the manual mode of operation of the vehicle respectively, and outputs the current risk associated with the mode of operation of the vehicle.

Moreover, by one embodiment of the present invention, the auto mode risk detector <NUM> and the manual mode risk detector <NUM> provide inputs (indicating the respectively detected risks) to the exceptional risk handler <NUM>. As will be described later with reference to <FIG>, the vehicle system upon detecting a risk in the current mode of operation of the vehicle may, by one embodiment, determine the risk associated with switching the vehicle to different mode of operation. If the risk associated with the different mode of operation is within permissible limits, the vehicle system may execute an operation of switching the mode of operation of the vehicle.

However, if the risk associated with the different mode of operation of the vehicle is unacceptable, the current risk evaluator <NUM> may activate the exceptional risk handler <NUM>, which based on the driver profile, may be configured to perform safety related functions as stated previously. For instance, the exceptional risk handler <NUM> may execute processes such as bringing the vehicle to an immediate halt, initiating a call for assistance to governmental authorities (e.g., automatically dialing <NUM> or calling for roadside assistance via a mobile phone associated with the vehicle), transmitting GPS location of the vehicle to a server that monitors the operations of the particular vehicle and other like vehicles. It must be appreciated that in order to perform the above stated functions of bringing the vehicle to a complete halt may include processing steps such as determining a current speed of the vehicle, a current lane in which the vehicle is traversing, neighboring traffic, identifying a shoulder region on the road (e.g., a pull-over zone), and gradually bringing the vehicle to a complete halt in a safe manner.

<FIG> depicts an illustrative flowchart outlining an exemplary process performed by the risk evaluator <NUM>, according to an embodiment of the present invention. The process commences in step <NUM>, wherein activities (described next with reference to <FIG>) of a driver and/or passenger of the vehicle under consideration are detected via a plurality of sensors.

Based on the detected information by the sensors and a driver detection model (described next with reference to <FIG>), the process in step <NUM> analyzes the driver/passenger state. In step <NUM>, a current mode of operation of the vehicle is determined. For instance, the current mode detector <NUM> as shown in <FIG> can detect the current mode of operation of the vehicle.

The process further proceeds to step <NUM>, wherein a query is performed to determine whether the vehicle is operating in an autonomous mode. If the response to the query is affirmative, the process moves to step <NUM>, else if the vehicle is operating in the manual mode, the process moves to step <NUM>.

In step <NUM>, the process detects the risks associated with the vehicle operating in the manual mode. As described previously, the determination of such a risk may be based at least on a detected state of the driver, information included in the driver profile, and real-time information pertaining to the vehicle that the driver is operating. It must be appreciated that the information included in the driver profile is static driver information that corresponds to characteristics of the driver e.g., whether the driver is handicapped, short-sighted, medical information of the driver etc., whereas information related to the detected driver state is dynamic information based on a current behavior of the driver.

Returning to step <NUM>, if it is determined that the vehicle is operating in the autonomous mode, the process moves to step <NUM> and obtains a state of operation of the vehicle in the autonomous mode. For instance, the process may determine a location of the vehicle, a current speed at which the vehicle is travelling, and the like information. By one embodiment, the process may be configured to determine a level of autonomous mode (described later with reference to <FIG>) in which the vehicle is being operated.

Upon determining the respective risks in operating the vehicle in the autonomous mode (step <NUM>) or in the human-driven mode (step <NUM>), the process moves to step <NUM>. In step <NUM>, a query is performed to determine whether exceptional handling is required i.e., the determined risks in the autonomous mode or in the human-driven mode of the vehicle is exceptionally high. If the response to the query is affirmative, the process moves to step <NUM>, wherein the vehicle is operated in an exception handling mode and at least one of the previously described exception handling functions are performed.

However, if the response to the query in step <NUM> is negative, the process moves to step <NUM>, wherein a risk assessment report is generated. Further, as shown in step <NUM>, the generated risk assessment report may be displayed on the display panel included in the vehicle and/or be transmitted to a remote server for monitoring purposes.

<FIG> depicts an exemplary block diagram of a driver state analyzer <NUM>, according to an embodiment of the present invention. The driver state analyzer <NUM> includes a sensor activator <NUM>, a plurality of in-situ sensors <NUM>, a driver detector <NUM>, a driver detection model <NUM>, a behavior feature detector <NUM>, a feature behavior model <NUM>, a driver health estimator <NUM>, a functional state estimator <NUM>, a mental state estimator <NUM>, and a current user state generator <NUM>.

By one aspect of the present invention, the driver state analyzer <NUM> is configured to determine a state of the driver. Determining the state enables one to predict in an accurate manner, whether the driver is capable of performing activities related to maneuvering the vehicle such that any potential hazardous situations can be avoided.

By one embodiment, the sensor activator <NUM> activates the in-situ sensors <NUM> to detect the driver state. The in-situ sensors <NUM> comprise a plurality of sensors including visual sensors, acoustic sensors, smell sensors, light sensors and the like that enable the detection of the state of the driver. For instance, the visual sensors included in the in-situ sensors <NUM> may comprise a plurality of spatially distributed camera devices within the vehicle that are capable of processing and fusing images of a scene from a variety of viewpoints into some form more useful than the individual images. For example, the visual sensors may be configured to capture a pose of the driver (i.e., a posture/orientation of the driver in the driver seat). The pose information may be used to determine additional information such as a location of the driver's head with respect to a steering wheel, a direction in which the driver is looking (based on eye-tracking of the driver), etc. The information captured by the in-situ sensors <NUM> is input into a driver detector unit <NUM>, which determines, for example, the driver's pose based on a driver detection model <NUM>.

Information detected by the driver detector unit <NUM> e.g., the driver's pose may be input to a behavior feature detector <NUM>. The behavior feature detector <NUM> may be configured to determine, based on a feature behavior model <NUM>, features associated with the detected pose of the driver. For instance, features such as whether the driver is sleeping, whether the driver is yawning, whether the driver feeling drowsy and/or vomiting and the like can be determined by the feature behavior detector <NUM>.

By one embodiment, the detected behavior of the driver is input to the driver health estimator <NUM>, which is configured to determine a health of the driver. By one embodiment, the in-situ sensors may include a plurality of sensors that are disposed on the driver of the vehicle e.g., wearable sensors and/or sensors included in a device (e.g., a watch) worn by the driver, which collect information pertaining to the health of the driver. Such sensors may include for instance, a heart rate sensor configured to determine a heart rate of the driver, a temperature sensor configured to detect a temperature of the surface of the skin of the driver and the like. Information pertaining to the health of the driver is input to the current user state generator <NUM>.

According to one embodiment of the present invention, information pertaining to the behavior of the driver may be input to a functional state estimator <NUM> and a mental state estimator <NUM>. The functional state estimator <NUM> also receives additional inputs from the feature behavior model <NUM>, the driver detector unit <NUM>, and the in-situ sensors <NUM> to determine a functional state of the driver. For instance, the functional state estimator <NUM> may be configured to determine based on a detected pose/orientation of the driver, whether the driver is capable of operating the vehicle in a safe manner i.e., is the driver functioning in an acceptable manner.

Based on the driver's functional state which is estimated by the functional state estimator <NUM>, the mental state estimator <NUM> may be configured to determine whether a mental state of the driver is normal. Such information can be used to determine whether the driver is capable of maneuvering the vehicle. Mental state information may include information pertaining to whether the driver is experiencing a life-threatening event such as a seizure. It must be appreciated that information from the sensors such as medical sensors including a heart rate monitor and the like may be used by the mental state estimator <NUM> to determine the mental state of the driver. Information pertaining to the driver that is estimated by the modules: health estimator <NUM>, the mental state estimator <NUM>, and the functional state estimator <NUM> are input to the current user state generator <NUM> that combines the estimated health related information to determine a current state of the user i.e., the driver's state information.

<FIG> depicts an illustrative flowchart outlining an exemplary process performed by the driver state analyzer <NUM>, according to an embodiment of the present invention. The process commences in step <NUM>, wherein the sensor activator (<NUM> in <FIG>) activates the plurality of in-situ sensors in order to respectively capture information pertaining to the driver of the vehicle. In step <NUM>, the driver detector upon receiving information from the respective sensors, utilizes a driver detection model to detect the state of the driver (step <NUM>). Specifically, in step <NUM>, information related to the state of the driver of the vehicle such as a location of the driver within the vehicle, a pose of the driver etc. may be determined based on the driver detection model.

The process then proceeds to step <NUM>, wherein behavior features of the driver are detected. Specifically, in step <NUM>, based on the information detected in step <NUM>, a behavior feature model can be utilized to detect behavior features such as whether the driver is sleeping, drowsy, vomiting, etc. The behavior features detected in step <NUM> can be utilized in steps <NUM>, <NUM>, and <NUM> to estimate a functional state, a health of the driver, and a mental state of the driver, respectively, as described previously with reference to <FIG>.

The detected functional state, health of the driver, and the mental state of the driver can be used in step <NUM> to generate an overall state of the driver. For example, the current driver state generator (<NUM> in <FIG>) can be utilized to determine an overall state of the driver that is based on the detected mental, functional and health information of the driver.

The process then proceeds to step <NUM>, wherein the generated state of the driver from step <NUM> may be output to be included in the current mode risk report generator (<NUM> in <FIG>) and/or to utilized by the switch risk determiner, and switch risk evaluator e.g., to determine the risk associated with the current mode in which the vehicle is being operated.

<FIG> depicts an exemplary block diagram of a switch risk determiner <NUM>, according to an embodiment of the present invention. The switch risk determiner <NUM> comprises a switch direction controller <NUM>, an autonomous to human (A-H) mode switch risk determiner <NUM>, an A-H exceptional risk handler <NUM>, a human to autonomous (H-A) mode switch risk determiner, and a H-A exceptional risk handler <NUM>.

The switch direction controller <NUM> receives as input the current mode of operation of the vehicle. Based on the current mode, the switch direction controller <NUM> activates one of the A-H switch risk determiner <NUM> and H-A switch risk determiner <NUM>. As described later with reference to <FIG> and <FIG>, respectively, the A-H switch risk determiner <NUM> determines a risk associated in transitioning from the autonomous mode of operation to a human driver mode of operation of the vehicle, whereas the H-A switch risk determiner <NUM> determines risk associated in transitioning from the human driver mode to the autonomous mode of operation of the vehicle.

By one embodiment, the A-H switch risk determiner <NUM> and the H-A switch risk determiner <NUM>, respectively generate the vehicle control signals based on a determination that the risk associated in switching the current mode of the vehicle is below a predetermined threshold level. The vehicle control signals can be transmitted by the A-H switch risk determiner <NUM> and the H-A switch risk determiner <NUM>, respectively, to a switch executor (e.g., block <NUM> in <FIG>) to instruct the vehicle control (<NUM> in <FIG>) to perform the respective switch in the operating mode of the vehicle.

Moreover, the A-H switch risk determiner <NUM> and the H-A switch risk determiner <NUM>, respectively generate the following signals: A-H switch warning instruction and the H-A switch warning instruction (described later with reference to <FIG> and <FIG>, respectively). By one embodiment, both the A-H switch warning instruction and the H-A switch warning instruction are associated with a set of tasks to be performed by the driver of the vehicle so that a successful switching of the operating mode of the vehicle can occur.

However, if the A-H switch risk determiner <NUM> or the H-A switch risk determiner <NUM> determine that the risk associated with the switching of the operation mode of the vehicle is unacceptable (i.e., a high-risk mode), the A-H switch risk determiner <NUM> and the H-A switch risk determiner <NUM>, respectively activate the A-H exception risk handler <NUM> and the HA exception risk handler <NUM>. As stated previously, the A-H exception risk handler <NUM> and the H-A exception risk handler <NUM> may be configured by one embodiment to perform safety related functions such as bringing the vehicle to an immediate halt, initiating a call for assistance to governmental authorities (e.g., automatically dialing <NUM> or calling for roadside assistance via a mobile phone associated with the vehicle), transmitting GPS location of the vehicle to a server that monitors the operations of the particular vehicle and other like vehicles. It must be appreciated that in order to perform the above stated functions of bringing the vehicle to a complete halt may include processing steps such as determining a current speed of the vehicle, a current lane in which the vehicle is traversing, neighboring traffic, identifying a shoulder region on the road (e.g., a pull-over zone), and gradually bringing the vehicle to a complete halt in a safe manner.

<FIG> depicts an illustrative flowchart outlining an exemplary process performed by the switch risk determiner <NUM>, according to an embodiment of the present invention. The process commences in step <NUM>, wherein real-time information (described previously with reference to <FIG>) is obtained by the switch risk determiner. In step <NUM>, the switch risk determiner receives information pertaining to a current state of the driver. For example, the switch risk determiner obtains the current state of the driver from the current driver state generator <NUM> in <FIG>.

The process further proceeds to step <NUM>, wherein a query is performed to determine whether the vehicle intends to switch from an autonomous mode to human-driven (AH) mode of operating the vehicle, or the vehicle intends to switch from the human-driven to autonomous (H-A) mode of operating the vehicle. If the response to the query is a switch from the autonomous mode to human-driven mode (i.e., A-H switch), the process moves to step <NUM>. If the response to the query is a switch from the human-driven to autonomous mode (i.e., H-A), the process moves to step <NUM>.

In step <NUM>, the switch risk determiner determines a risk associated in performing the switch from the autonomous mode to human-driven mode of operating the vehicle. As will be described in detail later with reference to <FIG> and <FIG>, while switching from the autonomous mode to the human driver mode, a set of estimated tasks are presented to the driver to be performed in order to switch the operating mode of the vehicle. Based on whether the driver performs the set of estimated tasks, the A-H switch risk determiner <NUM> determines a risk associated with switching the vehicle to the human-driver mode.

Thereafter, the process in step <NUM> performs a query to determine whether a high risk is associated in transitioning to the human driven mode. If the response to the query is affirmative, the process moves to step <NUM>, wherein the exception handling process is performed. However, if the response to the query in step <NUM> is negative, the process moves to step <NUM>.

In step <NUM>, the process generates an A-H switch instruction warning, which is associated with a set of tasks to be performed by the driver of the vehicle before a successful switch to the human-driven mode of operating the vehicle can occur. Thereafter, the process in step <NUM> generates (and outputs) the A-H vehicle control signal to instruct the control system of the vehicle to perform the switching operation concurrently with the driver performing the set of estimated tasks.

Similar to steps <NUM> to <NUM> described above, the switch risk determiner in steps <NUM> to <NUM> performs functions related to a switch from the human-driven mode to autonomous mode of operating the vehicle. Specifically, in step <NUM>, the switch risk determiner determines a risk associated in performing the switch from the human-driven mode to autonomous mode of operating the vehicle.

The process then moves to step <NUM>, wherein a query is made to determine whether a high risk is associated in transitioning to the autonomous mode of operating the vehicle. If the response to the query is affirmative, the process moves to step <NUM>, wherein the exception handling process is performed. However, if the response to the query in step <NUM> is negative, the process moves to step <NUM>.

In step <NUM>, the process generates an H-A switch instruction warning, which is associated with a set of tasks to be performed by the driver of the vehicle at which time a successful switch to the autonomous mode of operating the vehicle can occur. Thereafter, the process in step <NUM> generates (and outputs) the H-A vehicle control signal to instruct the vehicle control system to perform the switch to the autonomous mode of operation.

<FIG> depicts an exemplary block diagram of an autonomous mode to human-driver/manual (A-H) mode switch risk determiner <NUM>, according to an embodiment of the present invention. As stated previously, the A-H switch risk determiner <NUM> is configured to determine risk associated in switching the mode of operation of the vehicle from the autonomous mode to the human-driver mode of operation. As shown in <FIG>, the A-H switch risk determiner <NUM> comprises driver profiles <NUM>, generic response time profiles <NUM>, a response time estimator <NUM>, a switch task estimator <NUM>, a switch task model <NUM>, a switching risk estimator <NUM>, and an A-H warning instruction generator <NUM>.

By one embodiment of the present invention, based on a degree/level of risk associated with the current mode (i.e., the autonomous mode with respect to <FIG>) of operation of the vehicle, the A-H switch risk determiner <NUM> determines an amount of time within which the vehicle should transition to the human-driven mode to avoid hazardous scenarios. For example, consider the case of the vehicle being driven in the autonomous mode along a road which is covered with dense fog. In this case, the sensors of the vehicle may not be able to detect vehicles in its vicinity in an accurate manner, and thus it may not be feasible to continue operating the vehicle in the autonomous mode. Based on the risk associated with the autonomous mode of operation (determined for example, based on real-time fog conditions, an amount of traffic in the area, etc.), the A-H switch risk determiner <NUM> may determine an amount of time within which a transition to the human mode of operating the vehicle should be made for safety concerns.

Further, the switch task estimator <NUM> receives as input, the current passenger state, real-time data and real-time vehicle data. As described previously with reference to <FIG> and <FIG>, the real-time data includes intrinsic and extrinsic capabilities of the vehicle, while the real-time vehicle data includes information pertaining to the location of the car, environment in which the vehicle is currently positioned in, an amount of visibility, in-service information of the vehicle and the like. By one embodiment, based on the received inputs, and in accordance with the switch task model <NUM>, the switch task estimator <NUM> determines a set of tasks that are to be performed by the driver that enable the switching of the operation mode of the vehicle from autonomous to human-driver mode. Additionally, by one embodiment, the switch task estimator <NUM> receives the current driver state and determines whether the driver can perform any tasks. For instance, if the state of the driver is such that the driver is completely un-alert, passed out or the like, the switch task estimator may signal the switching risk estimator <NUM> that there is a high risk associated in switching the operating mode of the vehicle to the human-driver mode and thus instructs the switch risk estimator <NUM> to implement the exception handling process as described previously.

Before switching to the manual mode of operation of the vehicle, a determination may be required to verify whether the driver is capable of operating the vehicle. Such determinations may include verifying the pose of the driver, determining an alertness of the driver and the like. By one embodiment, the alertness of a driver may be determined by posing a series of tasks to the driver (wherein, for example, the tasks can be displayed in the form of instructions on a display panel included in the vehicle), and determining whether the driver performs the instructed tasks in a satisfactory manner. Such tasks may include instructing the driver to perform a lane change, displaying an object (e.g., blinking icon) on the display panel of the vehicle and tracking a movement of the driver's eyes in order to determine a level of alertness and the like. Moreover, an amount of time may be required to determine a health of the driver e.g., via medical sensors such as blood pressure, heart-rate monitor and the like that measure vital signs of the driver which are processed by a processor (described later with reference to <FIG>) included in the vehicle system.

Further, based on the real-time information received by the switch task estimator <NUM>, a set of tasks may be estimated for the driver to perform in order to successfully transition the vehicle to the human-driver mode. It must be appreciated that the set of tasks estimated by the switch task estimator <NUM> in accordance with the switch task model <NUM> are in no way limited the tasks as described above.

As shown in <FIG>, the output of the switch task estimator <NUM> i.e., the estimated tasks to be performed (e.g., by the human driver of the vehicle) to initiate the switch to the manual mode of operation of the vehicle are input to the response time estimator <NUM>. The response time estimator <NUM> estimates an amount of time required by the driver of the vehicle to perform the set of estimated tasks. Specifically, the response time estimator <NUM> estimates an amount of time required by the driver to complete each of the tasks estimated by the switch task estimator <NUM>. By one embodiment, the response time estimator <NUM> estimates the amount of time required to perform the tasks based on a current passenger state, a driver profile <NUM>, and a generic response time profile <NUM>. It must be appreciated that the current passenger state can be obtained, as described previously, from the current state generator (<NUM> in <FIG>), which is included in the driver state analyzer (i.e., block <NUM> in <FIG>).

The driver profile <NUM> may include information related to the driving history of the driver, e.g., a number of violations the driver has been involved in a predetermined prior time-period, and a model of the vehicle the driver is operating, and characteristics of the driver such as whether the driver is handicapped, short-sighted and the like. Moreover, the driver profile <NUM> may comprise an alertness score of the driver that may be computed based on prior mode switching operations from autonomous to manual mode, and the corresponding times required by the driver in those switching operations to perform the set of estimated tasks. Additionally, information from the generic response time profile <NUM>, which includes for instance, an amount of time consumed by other drivers (having a similar profile as the current driver) in performing the set of estimated tasks may be used by the response time estimator <NUM> to estimate the amount of time required (by the current driver) to perform the set of estimated tasks.

By one embodiment, as shown in <FIG>, the response time required to perform the set of estimated tasks may be determined based on physiological information of the driver (e.g., a current position or pose of the driver), user/driver information (e.g., time required in prior engagement in transition of manual mode of operation, a state of the driver etc.), extrinsic factors such as road conditions, an amount of visibility on the road, an amount of traffic on the road, and intrinsic capabilities of the vehicle such as a permissible speed of the vehicle, capable safety of the vehicle, a condition of the vehicle (e.g., number of faults in the vehicle) and the like.

The estimated set of tasks to be performed and the corresponding response time estimated in performing the tasks are input to the switching risk estimator <NUM>. By one embodiment, the switching risk estimator <NUM> compares the estimated time required to perform the tasks (TE) to the amount of time (T) within which the vehicle should transition to the different mode (human-driver mode in the present embodiment). It must be appreciated that the estimated time to perform the set of tasks is determined by the generic response time profile <NUM>. If the estimated time (TE) is greater than (T), the switching risk estimator <NUM> generates a high-risk control signal indicating that a risk associated with transitioning to the manual mode of operation is high i.e., the risk of switching to the human-driver mode is high. In such situations, the A-H switch risk determiner <NUM> may perform the previously described exception handling operations. However, if the estimated time (TE) is lower than (T), the switching risk estimator <NUM> activates a A-H switch instruction generator <NUM>. The A-H switch instruction generator <NUM> generates an A-H switch warning instruction signal that is associated with the set of tasks that are to be performed by the driver of the vehicle to successfully switch the operating mode of the vehicle to the human-driven mode.

Turning to <FIG>, there is depicted according to an embodiment of the present invention, an illustrative flowchart outlining an exemplary process performed by the (AH) mode switch risk determiner. The process commences in step <NUM> wherein the (A-H) switch mode risk determiner receives real time information including intrinsic and extrinsic capabilities of the vehicle as well as real-time vehicle data.

The process then moves to step <NUM>, wherein the (A-H) switch mode risk determiner estimates a set of tasks to be performed by the human driver to successfully switch the operating mode of the vehicle to the human-driven mode. Note that by one embodiment, the set of tasks can be estimated based on the received real-time information in accordance with a switch task model.

In step <NUM>, a response time i.e., an amount of time required by the driver of the vehicle to complete each of the set of tasks is estimated. It must be appreciated that the response time can be computed based on at least one of the driver profile, the current driver state, and the generic response time profile as described previously with reference to <FIG>.

The process further proceeds to step <NUM>, wherein a risk associated with switching the operating mode of the vehicle to the human-driven mode is determined. As stated previously, the switching risk can be determined based on a comparison of the total estimated time of performing the set of tasks, and a time within which the vehicle should transition to the different mode (e.g., human-driver mode) that is determined based on a level of risk associated with operating the vehicle in the current mode (e.g., autonomous mode).

Thereafter, the process in step <NUM> performs a query to determine whether the determined risk (in step <NUM>) is high. For instance, a determination is made to verify whether the determined risk of step <NUM> violates a certain criterion e.g., TE is greater than T. If the response to the query in step <NUM> is affirmative, the process proceeds to step <NUM>, else the process moves to step <NUM>.

In step <NUM>, corresponding to the case where the determined risk of step <NUM> does not violate the criterion (i.e., TE is lower than T) the process generates the A-H switch warning instruction signal, which is further utilized in step <NUM> to output (e.g., display on the panel) the set of estimated tasks to the driver of the vehicle. Details regarding presenting the driver with the set of tasks is described later in greater detail with reference to <FIG> and <FIG>. However, if the risk in step <NUM> is determined to be high, the process in step <NUM> executes the exception handling procedures as previously described.

<FIG> depicts an exemplary block diagram of a human-driver to autonomous (H-A) mode switch risk determiner <NUM>, according to an embodiment of the present invention. As stated previously, the H-A switch risk determiner <NUM> is configured to determine a risk in switching the mode of operation of the vehicle from the manual mode to the autonomous mode of operating the vehicle. As described below, based on the estimated risk in switching the mode of operation of the vehicle, the (H-A) switch mode risk determiner <NUM> determines whether it is feasible to switch to the autonomous mode (from the human-driver mode) of operating the vehicle.

As shown in <FIG>, the H-A switch risk determiner <NUM> comprises a switch task determiner <NUM>, a switch time estimator <NUM>, an auto take-over risk estimator <NUM>, an auto take-over task model <NUM>, a vehicle model <NUM>, an H-A warning instruction generator <NUM>, and a control signal generator <NUM>. The switch task determiner <NUM> receives as input, real-time data, real-time vehicle data, and the current driver state. As described previously with reference to <FIG> and <FIG>, the real-time data includes intrinsic and extrinsic capabilities of the vehicle, while the real-time vehicle data includes information pertaining to the location of the car, environment in which the vehicle is currently travelling in, an amount of visibility in the environment, in-service information of the vehicle and the like information. Moreover, the switch task determiner <NUM> receives as input the current passenger state, which is generated by the user state generator as described previously in <FIG>.

Based on the received inputs, the switch task determiner <NUM> utilizes an auto take-over task model <NUM> to generate a set of tasks that are to be performed (e.g., by the vehicle) in the autonomous mode of operation. For instance, by one embodiment, the set of tasks may include controlling a speed of the vehicle (i.e., reducing or increasing the speed the vehicle based on proximate traffic), controlling maneuverability of the vehicle (i.e., controlling a steering wheel functionality of the vehicle), changing a lane in which the vehicle is currently travelling in, determining (for safety purposes) whether the location of the vehicle is in a zone that restricts autonomous driving (e.g., certain geographical locations such as school zones, certain regions on freeways such as toll-booths etc.). It must be appreciated that each of the above described tasks that are to be performed in the autonomous mode may be associated with a task that is to be performed by the driver of the vehicle to ensure a smooth transition from the human-driven mode to the autonomous mode of operating the vehicle. For instance, the tasks to be performed by the driver may include removing the driver's feet from the accelerator and/or brakes, as the vehicle is about to be controlled in an automated manner in the autonomous mode of operation. Another task that may be required to be performed by the driver may include the driver removing his hands from the steering wheel to relinquish control of maneuverability of the vehicle to the automated system.

By one embodiment of the present invention, the H-A switch risk determiner <NUM> observes the current state of the driver to determine whether the driver is capable of performing any of the above-mentioned tasks. For instance, if it is determined that the driver if the vehicle is completely passed out, the H-A switch risk determiner <NUM> may initiate an immediate takeover by the autonomous function of the car i.e., the car will operate in the autonomous mode immediately. It must be appreciated that if a complete autonomous takeover of the vehicle is not possible, the H-A switch risk determiner <NUM> may execute the exception handling process as stated below.

By one embodiment, the sequence of determined tasks, driver state, as well as the current vehicle data is input to the switch time estimator <NUM>. Based on the received inputs, the switch time estimator <NUM> utilizes the vehicle model <NUM> to estimate an amount of time required by the vehicle and/or correspondingly by the driver of the vehicle to perform the respective determined tasks. By one embodiment, the vehicle model <NUM> includes information pertaining to the prior operation of the current vehicle, such as an average amount of time required by the vehicle to change its speed from a first operating speed to a second operating speed, an amount of time required by the vehicle to change its operating lane, which may be based on nearby traffic, an amount of time required by the vehicle to control maneuverability of the vehicle and the like. Thus, by one aspect, the switch time estimator <NUM> utilizes the real-time information to estimate the time required by the vehicle to perform a certain task in accordance with the vehicle model <NUM>.

By one embodiment, the switch time estimator <NUM> estimates a total time required by the vehicle and/or correspondingly by the driver of the vehicle to perform all the respective estimated tasks. The total estimated time is input to the auto take-over risk estimator <NUM>. The auto take-over risk estimator <NUM> receives as input, the auto take-over control signal that may be generated by the switch direction controller <NUM> of <FIG>. Specifically, the auto take over control signal activates the auto take over risk estimator <NUM> when the switch direction controller (<NUM> in <FIG>) determines that a transition to the autonomous mode of operation is to be performed. The auto take-over risk estimator <NUM> evaluates a risk associated with transitioning to the autonomous mode of operation of the vehicle.

By one embodiment, the risk associated in switching to the autonomous mode may be determined based on the level/degree of risk associated with the current mode of operation of the vehicle. For instance, similar to the description provided previously with regard to the A-H switch risk determiner, the H-A switch risk determiner determines a level of risk associated in operating the vehicle in the human-driver mode. Based on the risk level, the H-A switch risk determiner obtains an amount of time within which the vehicle should switch to the autonomous mode of operation for safety concerns. Further, based on a comparison of the estimated time required to perform the tasks (e.g., by the vehicle) to the amount of time within which the vehicle should switch the mode of operation, the auto take-over risk determiner <NUM> may compute a risk associated with switching the vehicle to the autonomous mode.

Based on the evaluated risk being within acceptable, the auto take-over risk estimator <NUM> activates the H-A warning instruction generator <NUM> and the control signal generator <NUM>. By one embodiment, the H-A warning instruction generator <NUM> generates an HA switch warning instruction signal thereby indicating to the driver that the vehicle is to be imminently transitioned to the autonomous mode of operation. Additionally, the user warning instruction generator <NUM> may use audio/visual mechanisms (described later with reference to <FIG> and <FIG>) to indicate to the driver the tasks that are to be performed to successfully transition the vehicle to the autonomous mode of operation.

As stated above, it must be appreciated that in the present embodiment, each of the functions/tasks that are to be performed by the driver of the vehicle correspond to a task that is to be performed in the autonomous mode of operation. For instance, if one of the tasks determined by the auto take-over task model <NUM> is that of reducing the speed of the vehicle, then such a task may correspond to the driver removing his/her feet from the gas pedal. The execution of the H-A switch warning instruction signal is described later in detail with reference to <FIG>. Additionally, the take-over risk estimator <NUM> triggers the control signal generator <NUM> to generate a vehicle control signal that is to be transmitted to the switch executor (e.g. unit <NUM> in <FIG>). The switch executor in turn, activates the vehicle control system (unit <NUM> in <FIG>) indicating that a switch over to the autonomous mode of operation is being performed. It must be appreciated that if the risk estimator <NUM> determines that the risk associated in transitioning to the autonomous mode is unacceptable, the risk estimator <NUM> may signal the control signal generator <NUM> to instruct the switch executor <NUM> to perform exception handling.

Additionally, by one embodiment, when the risk associated in transitioning to the autonomous mode is unacceptable, the risk estimator <NUM> may perform a plurality of additional functions prior to performing the exception handling functions. For instance, instead of switching from the human-driver mode to a fully autonomous mode of operating the vehicle as described above, the H-A switch risk determiner, may determine a risk associated in switching the vehicle from the human-driver mode to a lower level of autonomous mode of operating the vehicle.

<FIG> provides a classification of a number of modes of operation of the vehicle based on six different levels (ranging from fully manual to fully automated systems) , according to an embodiment of the present invention. The classification can be based on an amount of driver intervention and attentiveness required. As depicted in <FIG>, there are six modes/levels of operation of the vehicle:.

Thus, by one embodiment, the H-A switch risk determiner may determine the risk associated in switching from the human driver mode to all the levels of the autonomous mode as shown in <FIG>. It must be appreciated that switching to a lower level of autonomous control of the vehicle may require a lesser number of tasks to be performed by the autonomous system of vehicle as compared to switching to the fully autonomous level. However, the lower level of autonomous control may require an increased alertness level of the driver.

Turning to <FIG>, there is depicted according to an embodiment of the present invention, an illustrative flowchart outlining an exemplary process performed by the (HA) switch mode risk determiner. The process commences in step <NUM> wherein the (H-A) switch mode risk determiner receives real time information including current driver state, intrinsic and extrinsic capabilities of the vehicle as well as real-time vehicle data.

The process then moves to step <NUM>, wherein the (H-A) switch mode risk determiner estimates, in accordance with a auto take-over task model, a set of tasks to be performed by the vehicle in switching the operating mode of the vehicle to the autonomous mode. Additionally, in step <NUM>, the set of corresponding tasks to be performed by the driver of the vehicle may also be estimated.

In step <NUM>, a response time i.e., an amount of time required to complete the estimated set of tasks is estimated. It must be appreciated that the response time can be estimated based on the vehicle model. Further, in step <NUM>, the H-A switch risk determiner may determine urgency in performing the switch to the autonomous mode of operating the vehicle. Such a determination may be made based on an extremely high risk associated with the human-mode of operating the vehicle, which can be determined based on the current state of the driver (e.g., the driver is passed out). Additionally, in step <NUM>, the H-A switch risk determiner may determine a risk associated with switching the vehicle to the autonomous mode of operation.

Based on the determined risk (in step <NUM>) associated with switching the vehicle to the autonomous mode not violating a criterion, the process in step <NUM> generates the H-A switch warning instruction signal, and a control signal (in step <NUM>) to indicate to the vehicular system that the vehicle is about to be switched to the autonomous mode of operation.

Further, the process in step <NUM> outputs the generated signals of steps <NUM> and <NUM>. For instance, the switch warning instruction signal may be output (e.g., on a display panel) to display the set of estimated tasks that are to be performed by the driver of the vehicle. Details regarding presenting the driver with the set of tasks is described later in greater detail with reference to <FIG> and <FIG>.

<FIG> depicts an exemplary block diagram of a switch warning control unit <NUM> included in the driving mode switching unit (block <NUM> in <FIG>) of the vehicular system, according to an embodiment of the present invention. The switch warning control unit <NUM> includes a warning instruction analyzer <NUM>, a vehicle model <NUM>, a user profile <NUM>, a warning time determiner <NUM>, a warning content determiner <NUM>, a warning media determiner <NUM>, a task/warning configuration model <NUM>, a plurality of multi-modal media models <NUM>, and a multi-modal warning instruction generator <NUM>.

By one embodiment, the warning instruction analyzer <NUM> receives a warning instruction signal corresponding to a switch of the operating mode of the vehicle from autonomous to human-driven (A-H) or a switch from human-driven to autonomous (H-A) mode. Specifically, the warning instruction analyzer <NUM> receives one of the A-H switch warning instruction signal from the A-H switch instruction generator (block <NUM> in <FIG>) and the H-A switch warning instruction signal from the H-A switch instruction generator (block <NUM> in <FIG>). It must be appreciated that each of the A-H switch warning instruction and the H-A switch warning instruction signals correspond to a set of tasks that are to be performed in order to switch the mode of operation of the vehicle. Moreover, the warning instruction analyzer <NUM> obtains the estimate of time required to complete each task (referred to herein as task duration time).

The warning instruction analyzer <NUM> inputs each analyzed task to the warning time determiner <NUM>. The warning time determiner <NUM> determines an amount of time required to perform a warning operation (referred to herein as warning duration time). Specifically, the warning duration time corresponds to a time period wherein a warning alert is presented to the driver of the vehicle, in order to ensure that the driver performs the corresponding task in a timely manner. By one embodiment, the warning duration time for each task is determined based on a current state of the driver. Moreover, the warning duration time for each task may be adjustable based on the current state of the driver. Details regarding the adjusting of the warning time duration of each task are described later with reference to <FIG>.

For instance, consider a task having a task duration time of <NUM> seconds i.e., the driver of the vehicle is expected to complete the task within <NUM> seconds. In this case, the warning time determiner <NUM> may determine that the warning time duration of <NUM> seconds is to be used to provide the warning alert to the driver thereby notifying the driver of the corresponding task that is to be performed. By one embodiment, the warning time duration is a part of the task duration time. Specifically, referring to the above example, the warning time of <NUM> seconds (within a time window of <NUM> seconds) is presented to the driver (e.g., at the beginning of the time-window) in order to notify the driver to perform the task within the estimated window of <NUM> seconds. It must be appreciated that the warning time having an initial duration of <NUM> seconds, may be extended to for example, <NUM> seconds upon determining that the driver has not performed the assigned task.

Thus, as sated above, the warning time determiner <NUM> may determine the warning duration time for each task based on the current state of the driver. For instance, consider the case that the driver is expected to perform a certain task, and the driver state analyzer (<FIG>) determines that the driver is not fully alert (e.g., yawning, drowsy, etc). In such a case, the warning time determiner <NUM> may determine to have a longer warning time duration as compared to case where the driver state analyzer determines that the driver is fully alert. It must be noted that the task duration time for completing a certain task is estimated by the switch time-estimator (e.g., <NUM> in <FIG>) based on the driver state.

For each task, the warning time determiner <NUM> inputs each task as well as the warning time duration associated with the task to the warning media determiner <NUM> and the warning content determiner <NUM>. Moreover, the warning media determiner <NUM> receives as input, information pertaining to the vehicle model <NUM>, a user profile <NUM> corresponding to the driver operating the vehicle, and the current state of the driver of the vehicle. By one embodiment, the warning media determiner <NUM> is configured to select at least one media (from the pool of multi-media models <NUM>) that is to be used as a platform for providing the warning to the driver. Specifically, the warning media determiner <NUM> associates each task with the at least one media <NUM> that is used to warn the driver to perform the respective task.

By one embodiment, the selected media can be determined based on a preference of the driver. The preference of the driver may be predetermined and stored a-priori within the driver profile <NUM>. Additionally, or alternatively, the type of selected media may be determined based on the state of the driver. For instance, if the driver is in a state of yawning (as determined by the driver state analyzer block <NUM> in <FIG>), a visual media (i.e., a display) and/or audio media form (i.e. speakers) may be used to warn the driver. In contrast, if the driver is either sleeping or extremely drowsy, the selected media forms may include a vibration mechanism (i.e., a haptic response) and/or a combination of other media forms. As a further example, if the user/driver profile <NUM> indicates that the driver of the vehicle has hearing impairments, then the warning media determiner <NUM> may refrain from using audio sources to warn the driver. In such a scenario, the warning media determiner <NUM> may utilize vibratory media and/or display media to warn the driver. It must be appreciated that a number of media sources <NUM> that are available to the warning media determiner <NUM> are determined via the vehicle model <NUM> that the driver is currently operating. It must be appreciated that the selectable sound source as shown in <FIG> may correspond to any non-speech sounds that can be selected for warning purposes, e.g., a siren, whereas audio may correspond to specifically any speech related acoustic signal. By one embodiment of the present invention, the selectable sound source and the audio source can be independently selected and used to compose a multi-model augmented warning.

By one embodiment, the warning content determiner <NUM> determines warning content to be associated with each task. For instance, for a display type of media, the content may correspond to a specific message to be displayed on the display panel of the vehicle. The displayed message serves as a warning to the driver of the vehicle. In a similar manner, audio content may correspond to content that is to be played via the audio system included in the vehicle. Content related to the audio or video modes of warning may also include a decibel level (i.e. how loud should an audio message be), a frequency of presenting the warning, a brightness of the display message on the panel, whether the message is being displayed with effects such as blinking and the like information.

With regard to a vibration type media warning, the warning content determiner <NUM> may determine a magnitude of the vibration. For instance, if the vibration mode of warning the driver includes providing a vibration to the steering wheel or the seat of the driver, the warning content determiner may determine a magnitude with which the respective vibrations are to be imposed on the driver. As shown in <FIG>, the warning content determiner <NUM> may also utilize the task/warning configuration model <NUM> to associate each task with at least one media source and present the warning to the driver.

Further, the type of media source to be used for warning purposes (as determined by the warning media determiner <NUM>), and the warning content (as determined by the warning content determiner <NUM>) are input to the multi-modal warning instruction generator <NUM>. Upon receiving the input from the warning content determiner <NUM> and the warning media determiner <NUM>, the multi-modal warning instruction generator <NUM> generates a sequence of tasks that are to be executed by the driver.

By one embodiment, the multi-modal warning instruction generator <NUM> is also configured to generate a warning schedule of the tasks for alerting the driver. Specifically, the multi-modal warning instruction generator <NUM> determines a sequence with which the tasks are to be presented to the driver. For example, the multi-modal warning instruction generator <NUM> may generate a schedule based on the task duration time of each task, wherein the task having the largest task duration time is presented first to the driver. Alternatively, the multi-modal warning instruction generator <NUM> may first present the task having the smallest task duration time to the driver. Additionally, the multi-modal warning instruction generator <NUM> may generate a schedule of the tasks based on a critical score (i.e., a priority) associated with each task. The critical score of a task corresponds to a level of urgency of performing the task. For example, while transitioning to an autonomous mode of operating the vehicle, a task such as removing the driver's foot from the gas pedal may be deemed more important than a task such as changing a car lane before switching the operating mode of the vehicle. In such a scenario, the multi-modal warning instruction generator <NUM> may generate a schedule, wherein the task of removing the driver's foot from the pedal (i.e., a task with higher priority) is presented first to the driver. In what follows, is provided a detailed description of the execution of the multi-media warning instructions with reference to <FIG>.

<FIG> depicts an illustrative flowchart outlining an exemplary process performed by the switch warning control unit <NUM>, according to an embodiment of the present invention. The process commences in step <NUM>, wherein the switch warning control unit receives one of the A-H switch warning instruction and the H-A switch warning instruction.

In step <NUM>, the process analyzes the received switch warning instruction signal to obtain a task duration time of each task of a set of tasks (step <NUM>). Note that as stated previously, each task has an estimated time (i.e., the task duration time) within which the task must be performed. The process in step <NUM> determines a warning duration time for each task i.e., the time required to perform a warning operation for the task. It must be appreciated that the warning duration time of each task may be determined based on the current state of the driver. Moreover, the warning duration time may be adjustable based on the state of the driver.

The process then moves to step <NUM> wherein the switch warning control unit determines a warning content to be associated with each task. For example, the warning content determiner <NUM>, as described previously with reference to <FIG>, determines a warning content to be associated with each task. Further, in step <NUM>, the switch warning control unit selects at least one media from a plurality of media sources that is to be utilized to warn the driver.

Upon determining the content and the media to be associated with each task (steps <NUM> and <NUM>), the switch warning control unit in step <NUM> generates a warning schedule of the tasks for alerting the driver. Specifically, as described previously with reference to <FIG>, the multi-modal warning instruction generator <NUM> of the switch warning control unit determines a sequence with which the tasks are to be presented to the driver.

Turning now to <FIG>, there is depicted an exemplary task schedule <NUM> illustrating different media being utilized for warning the driver of the vehicle to perform the tasks in the schedule. For sake of simplicity, <FIG> illustrates a schedule including three tasks (Task <NUM>, Task <NUM>, and Task <NUM>, respectively), according to an embodiment of the present invention. The task schedule <NUM> comprises a first task having a task duration time 2081a of magnitude |t<NUM> - t<NUM>|, a second task having a task duration time 2081b of magnitude |t<NUM> - t<NUM>|, and a third task having a task duration time 2081c of magnitude |t<NUM> - t<NUM>|. Note that by one embodiment of the present invention, the task duration times are estimated based on the current driver state of vehicle.

Additionally, <FIG> illustrates a at least one warning media (from a set of four media sources 2085a, 2085b, 2085c, and 2085d) that is utilized for alerting the driver of the vehicle to perform the respective task. For example, as shown in <FIG>, media <NUM> (2085a) is utilized to warn the driver to perform task <NUM>, media <NUM> (2085b) and media <NUM> (2085c) are utilized to warn the driver to perform task <NUM>, and media <NUM> (2085d) is utilized to warn the driver to perform task <NUM>. The warning duration times for each task are represented as follows: a first warning duration time 2083a associated with task <NUM>, and having a magnitude of |w<NUM> - t<NUM>| in time, wherein media <NUM> is selected to warn the driver to perform task <NUM>. Note that media <NUM> is activated for the warning duration time 2083a to warn the driver to perform task <NUM>. Similarly, for task <NUM> a combination of media <NUM> and media <NUM> (2085b and 2085c) are selected to warn the driver to perform task <NUM>. Note that media <NUM> and <NUM> are concurrently activated for the warning duration time 2083b (i.e., having magnitude |w<NUM> - t<NUM>|) to warn the driver to perform task <NUM>. In a similar manner, a third warning duration time 2083c associated with task <NUM>, and having a magnitude of |w<NUM> - t<NUM>| in time, wherein media <NUM> is selected to warn the driver to perform task <NUM>.

It must be appreciated that the warning durations 2083a to 2083c are plotted along time on the X-axis and intensity on the Y-axis. The height of a particular warning duration corresponds to, for instance, an intensity level of the media source that is used for warning purposes. For example, for an audio type media, the intensity may correspond to a volume level, for a display type of media, the intensity may correspond to a brightness level of the display message that is presented to the driver.

Moreover, as shown with reference to Task <NUM>, multiple media may be used to warn the driver of the respective task that is to be performed. Note that the multiple media used to warn a driver to perform the necessary task may be present in a concurrent fashion as depicted in <FIG>, and/or may be presented in a consecutive manner (i.e., one after another). Further, as previously stated the warning duration time for each task may be configurable based on the state of driver. As shown in <FIG>, the arrows 2087a to 2087c and 2089a to 2089c indicate that the warning durations of each media type that is used to warn the driver to perform the task may be increased based on the detected driver state.

For instance, if it is observed that upon presenting a warning, the driver has not performed the task, the time duration of the warning may be adjusted. In a similar manner, the intensity of the media type used to warn the driver to perform the respective tasks may also be adjusted as shown by arrows 2089a to 2089c. It must be appreciated that while using multiple media sources to warn the driver to perform a task (e.g., as shown in <FIG> for task <NUM>), the warning duration, as well as the intensity of each media type can be controlled in an independent manner. Moreover, by one embodiment, the warning duration times for each task are preferably a fraction of the corresponding task duration times. It must be noted that the warning duration time for a particular task may have a maximum time duration that is slightly less that the corresponding task duration time (assuming that a small of time will be required by the driver of the vehicle to perform the task). Moreover, as stated previously, if the driver of the vehicle fails to perform a particular task within the estimated task duration time, the vehicle control can terminate the operation of switching the mode of the vehicle and instead initiate the exception handling process.

<FIG> depicts an exemplary block diagram of a multi-modal switching warning unit <NUM>, according to an embodiment of the present invention. The multi-modal switching warning unit <NUM> comprises a multi-modal warning instruction parser <NUM>, time control models <NUM>, a plurality of media generators <NUM>, a plurality of multi-modal media models <NUM>, a multi-modal warning coordinator <NUM>, a multi-modal warning delivery unit <NUM>, a warning effect monitor <NUM>, and a warning instruction modifier <NUM>.

The plurality of multi-modal media models <NUM> include at least a selectable sound media <NUM>-<NUM>, a vibration media <NUM>-<NUM>, light <NUM>-<NUM>, visual media <NUM>-<NUM>, an augmented visual media <NUM>-<NUM>, and an audio media <NUM>-<NUM>. By one embodiment, each media included in the multi-modal media models <NUM> includes a corresponding media generator that is configured to select and activate the corresponding media. For example, as shown in <FIG>, the plurality of media generators <NUM> includes at least a warning sound generator <NUM>-<NUM>, a vibration signal generator <NUM>-<NUM>, a warning light generator <NUM>-<NUM>, a visual warning signal generator <NUM>-<NUM>, an augmented visual effect generator <NUM>-<NUM>, and an audio warning signal generator <NUM>-<NUM>.

The multi-model warning instruction parser <NUM> receives as input multi-model warning instructions that are generated by the switch warning control unit <NUM> described previously with reference to <FIG>. The multi-model warning instruction parser <NUM> is configured to parse through the set of instructions, wherein each instruction may be associated with a plurality of tasks that are to be performed by the driver of the vehicle. Note that each instruction received by the multi-model warning instruction parser <NUM> includes a schedule of tasks (determined by the switch warning control unit <NUM> of <FIG>) that are to be presented to the driver for execution.

By one embodiment, the multi-modal warning instruction parser <NUM> utilizes the time control model <NUM> to activate (at a specific time, determined by the schedule of the task set) at least one media generator <NUM>-<NUM> to <NUM>-<NUM>, which is configured to activate the corresponding media associated with the task. Note that a specific task may be associated with multiple media sources. For example, if the intended driver function to be performed is that of the driver removing his/her foot from the pedal, the corresponding warning may be presented to the driver by utilizing both a visual as well as an audio media source.

Accordingly, for each task, the selected media along with the schedule of the tasks is input to the multi-modal warning coordinator <NUM>. The multi-modal warning coordinator <NUM> coordinates the activation of all media associated with a specific task, and ensures that the respective media remain activated for a time duration corresponding to the warning duration time associated with the task. Further, the multi-modal warning delivery unit <NUM> executes the warning instruction by utilizing the activated media sources and presenting the warning to the driver.

By one embodiment, the multi-modal switching warning unit <NUM> includes the warning effect monitor <NUM> that is configured to determine, whether upon presenting a particular warning to the driver, the driver is executing (or has executed) the particular task associated with the warning. For instance, the warning effect monitor <NUM> may utilize a plurality of sensors disposed in the vehicle to capture information pertaining to whether the driver has executed the task. For example, considering the task wherein the driver is warned to remove his/her foot from the gas pedal, the warning effect monitor may utilize a sensor (e.g., a displacement sensor) to determine whether he driver has lifted his/her foot from the gas pedal.

By one embodiment, information captured by the plurality of sensors may be input to the warning instruction modifier <NUM>. The warning instruction modifier <NUM> is configured to modify/adjust parameters associated with the warning of the task. For instance, if the warning effect monitor <NUM> determines that the driver has not removed his/her foot from the gas pedal, the instruction modifier <NUM> may increase a decibel level of an audio source that is used to provide the warning to the driver. Additionally, by one embodiment, the warning instruction modifier <NUM> may utilize the multi-modal media models <NUM> to incorporate additional sources to be used in re-warning the driver to perform the task. As such, the warning instruction modifier <NUM> feeds back the updated instruction to the multi-modal warning instruction parser which repeats execution of the warning instruction. It must be appreciated that upon presenting the warning to the driver to execute the assigned task, the multi-modal switch warning unit <NUM> monitors the driver to determine whether the task is being executed in a timely manner. If it is observed that the driver does not perform the assigned task within the estimated task duration time, the vehicle may provide a feedback (referring to <FIG>) to the driving mode switching unit <NUM> to execute an exception handling process.

Turning to <FIG>, there is depicted an illustrative flowchart outlining an exemplary process performed by the multi-modal switching warning unit <NUM>. The process commences in step <NUM>, wherein the multi-modal switching warning unit <NUM> receives a multi-modal warning instruction. In step <NUM>, the multi-modal switching warning unit parses the multi-modal warning to obtain the schedule of tasks associated with each instruction.

The process further proceeds to step <NUM>, wherein based on the media selected for each task (i.e., selected by the warning media determiner <NUM> in <FIG>), the multi-modal switching warning unit <NUM> utilizes a time control model to select at least one media generator <NUM>-<NUM> to <NUM>-<NUM>, which is configured to activate the corresponding media associated with the task. In this manner, a warning signal associated with the task is generated and transmitted to the warning coordinator of the multi-modal switching warning unit <NUM>.

Further, the process in step <NUM> utilizes the warning coordinator of the multi-modal switching warning unit <NUM> to coordinate the activation of all media associated with a specific task. Further, in step <NUM>, the generated warning is delivered to the driver.

The process then moves to step <NUM>, wherein the multi-modal switching warning unit observes an effect of the warning. As stated previously, the multi-modal switching warning unit collects information from a plurality of sensors to observe if the warning presented to the user is being followed. Further, the process in step <NUM> determines based on the observation of step <NUM>, whether the scheduled task is completed.

In response to the scheduled task not being completed by the driver, the multi-modal switching warning unit <NUM> modifies the instruction in step <NUM>. Specifically, the multi-modal switching warning unit <NUM> modifies/adjusts parameters associated with the warning of the task. Additionally, the multi-modal switching warning unit <NUM> may modify a task by associating additional media to warning instruction. In this manner, the modified warning (of step <NUM>) is feedback to the multi-modal switching warning unit <NUM> for being re-presented to the driver of the vehicle. Note that if a particular task is not completed within the corresponding task duration time, an exception handling process as described previously may be initiated.

<FIG> depicts the architecture of a mobile device <NUM> which can be used to realize a specialized system implementing the present invention. This mobile device <NUM> includes, but is not limited to, a smart phone, a tablet, a music player, a handled gaming console, a global positioning system (GPS) receiver, and a wearable computing device (e.g., eyeglasses, wrist watch, etc.), or in any other form factor. The mobile device <NUM> in this example includes one or more central processing units (CPUs) <NUM>, one or more graphic processing units (GPUs) <NUM>, a memory <NUM>, a communication platform <NUM>, such as a wireless communication module, storage <NUM>, one or more input/output (I/O) devices <NUM>, a display or a projection <NUM>-a for visual based presentation, and one or more multi-modal interface channels <NUM>-b. The multi-modal channels may include acoustic channel or other media channels for signaling or communication. Any other suitable component, including but not limited to a system bus or a controller (not shown), may also be included in the mobile device <NUM>. As shown in <FIG>, a mobile operating system <NUM>, e.g., iOS, Android, Windows Phone, etc., and one or more applications <NUM> may be loaded into the memory <NUM> from the storage <NUM> in order to be executed by the CPU <NUM>.

To implement various modules, units, and their functionalities described herein, computer hardware platforms may be used as the hardware platform(s) for one or more of the elements described herein. The hardware elements, operating systems and programming languages of such computers are conventional in nature, and it is presumed that those skilled in the art are adequately familiar therewith to adapt those technologies to the present invention as described herein. A computer with user interface elements may be used to implement a personal computer (PC) or other type of work station or terminal device, although a computer may also act as a server if appropriately programmed. It is believed that those skilled in the art are familiar with the structure, programming and general operation of such computer equipment and as a result the drawings should be self-explanatory.

<FIG> depicts the architecture of a computing device which can be used to realize a specialized system implementing the present invention. Such a specialized system incorporating the present invention has a functional block diagram illustration of a hardware platform which includes user interface elements. The computer may be a general-purpose computer or a special purpose computer. Both can be used to implement a specialized system for the present invention. This computer <NUM> may be used to implement any component or aspect of the present invention, as described herein. Although only one such computer is shown, for convenience, the computer functions relating to the present invention as described herein may be implemented in a distributed fashion on a number of similar platforms, to distribute the processing load.

The computer <NUM>, for example, includes COM ports <NUM> connected to and from a network connected thereto to facilitate data communications. The computer <NUM> also includes a central processing unit (CPU) <NUM>, in the form of one or more processors, for executing program instructions. The exemplary computer platform includes an internal communication bus <NUM>, program storage and data storage of different forms, e.g., disk <NUM>, read only memory (ROM) <NUM>, or random access memory (RAM) <NUM>, for various data files to be processed and/or communicated by the computer, as well as possibly program instructions to be executed by the CPU. The computer <NUM> also includes an I/O component <NUM>, supporting input/output flows between the computer and other components therein such as interface elements <NUM> in different media forms. An exemplary type of interface element may correspond to different types of sensors <NUM>-a deployed on the autonomous driving vehicle. Another type of interface element may correspond to a display or a projection <NUM>-b for visual based communication. There may be additional components for other multi-modal interface channels such as acoustic device <NUM>-c for audio based communications and/or component <NUM>-d for signaling based on communication, e.g., signal that causes vibration on a vehicle component such as a car seat. The computer <NUM> may also receive programming and data via network communications.

Hence, aspects of the methods of the present invention , as outlined above, may be embodied in programming. Program aspects of the technology may be thought of as "products" or "articles of manufacture" typically in the form of executable code and/or associated data that is carried on or embodied in a type of machine readable medium. Tangible non-transitory "storage" type media include any or all of the memory or other storage for the computers, processors or the like, or associated modules thereof, such as various semiconductor memories, tape drives, disk drives and the like, which may provide storage at any time for the software programming.

All or portions of the software may at times be communicated through a network such as the Internet or various other telecommunication networks. Such communications, for example, may enable loading of the software from one computer or processor into another, for example, from a management server or host computer of a search engine operator or other enhanced ad server into the hardware platform(s) of a computing environment or other system implementing a computing environment or similar functionalities in connection with the present invention. Thus, another type of media that may bear the software elements includes optical, electrical and electromagnetic waves, such as used across physical interfaces between local devices, through wired and optical landline networks and over various air-links. The physical elements that carry such waves, such as wired or wireless links, optical links or the like, also may be considered as media bearing the software. As used herein, unless restricted to tangible "storage" media, terms such as computer or machine "readable medium" refer to any medium that participates in providing instructions to a processor for execution.

Hence, a machine-readable medium may take many forms, including but not limited to, a tangible storage medium, a carrier wave medium or physical transmission medium. Non-volatile storage media include, for example, optical or magnetic disks, such as any of the storage devices in any computer(s) or the like, which may be used to implement the system or any of its components as shown in the drawings. Volatile storage media include dynamic memory, such as a main memory of such a computer platform. Tangible transmission media include coaxial cables; copper wire and fiber optics, including the wires that form a bus within a computer system. Carrier-wave transmission media may take the form of electric or electromagnetic signals, or acoustic or light waves such as those generated during radio frequency (RF) and infrared (IR) data communications. Common forms of computer-readable media therefore include for example: a floppy disk, a flexible disk, hard disk, magnetic tape, any other magnetic medium, a CD-ROM, DVD or DVD-ROM, any other optical medium, punch cards paper tape, any other physical storage medium with patterns of holes, a RAM, a PROM and EPROM, a FLASH-EPROM, any other memory chip or cartridge, a carrier wave transporting data or instructions, cables or links transporting such a carrier wave, or any other medium from which a computer may read programming code and/or data. Many of these forms of computer readable media may be involved in carrying one or more sequences of one or more instructions to a physical processor for execution.

Those skilled in the art will recognize that the present invention is amenable to a variety of modifications and/or enhancements. For example, although the implementation of various components described above may be embodied in a hardware device, it may also be implemented as a software only solution-e.g., an installation on an existing server. In addition, the present invention as disclosed herein may be implemented as a firmware, firmware/software combination, firmware/hardware combination, or a hardware/firmware/software combination.

Claim 1:
A method, implemented on a machine having at least one processor, storage, and a communication platform capable of connecting to a network for operating a vehicle, the method comprising:
receiving (<NUM>) real-time data related to the vehicle;
determining (<NUM>) a current mode of operation of the vehicle;
evaluating (<NUM>) a first risk associated with the current mode of operation of the vehicle based on the real-time data in accordance with a risk model;
determining (<NUM>), in response to the first risk satisfying a first criterion, a second risk associated with switching the current mode to a different mode of operation of the vehicle, the first criterion being that the first risk exceeds a first level, indicating that the current mode of operation of the vehicle is unsafe, but does not exceed a second level that is greater than the first level and that indicates that a driver of the vehicle is not having a life-threatening event;
switching (<NUM>), in response to the second risk satisfying a second criterion, the vehicle from the current mode to the different mode; and
executing (<NUM>), in response to the first risk exceeding the second level, an exception handling process.