Patent Description:
Safety is a critical objective of autonomous driving systems (ADS) and advanced driver assistance systems (ADAS), including both the safety of the occupants of the controlled vehicles as well as the safety of others who are in the vicinity of such vehicles. In this regard, safety can be classed into two categories, namely egocentric or "ego" safety which is the safety of the controlled vehicle (e.g. the ego vehicle) and its occupants and "social" safety which is the safety of other objects that are acting within the environment of the ego vehicle.

Some ADS and ADAS solutions employ a controlling agent for the ego-vehicle that has been trained using reinforcement learning (RL) techniques. However, known RL techniques tend to be inherently egocentric. Multi-agent RL approaches may be used to account for the behavior of the agents controlling other objects, however such approaches can be inaccurate due to difficulties in determining or understanding the policy of the agents controlling the other objects. For example, it is difficult to determine if the driver of another vehicle is paying attention.

For the foregoing and other reasons, improvements in systems that protect the safety of both an ego vehicle and its occupants as well as other objects acting in the ego vehicle's environment.

<CIT> discloses method of operating an autonomous vehicle, the method comprising: determining, at an automated driving controller (ADC), one or more planned driving corridors that are predicted to be drivable by the vehicle and safely separated from surrounding vehicles and other objects; determining, at a vehicle controller (VC), based on the one or more planned driving corridors, one or more vehicle trajectories which are predicted to avoid collisions with the surrounding vehicles and other objects; selecting, at the VC, one of the determined trajectories as active based on criteria of collision likelihood; sending steering, throttle, and braking commands from the VC to one or more respective actuator controllers within the vehicle to follow the active trajectory.

<CIT> discloses a method for operating a device for traffic situation analysis which processes input data relating to an at least partially autonomously operable motor vehicle. The input data comprises geographical map data describing an environment of the motor vehicle and environment data describing positions and/or directions of movement of further road users in the environment of the motor vehicle. The method comprises: determining movement space information describing a predicted movement space of the motor vehicle from the map data; determining movement path information describing at least one predicted movement path of at least one road user by applying a movement prediction model to the environment data; determining evaluation information describing the relevance for a traffic situation analysis of at least a partial movement space in dependence on the movement space information and the movement path information; and performing the traffic situation analysis for the or at least one partial movement space in dependence on the evaluation information.

According to a first aspect of the invention, a method is disclosed for controlling safety of both an ego vehicle and at least one social objects in an environment the ego vehicle is operating in. The method includes receiving data representative of at least one social object and determining a current state of the ego vehicle based on sensor data. An ego safety value is predicted corresponding to the ego vehicle, for each possible behavior action in a set of possible behavior actions, based on the current state. A social safety value corresponding to the at least one social object in the environment of the ego vehicle is predicted, based on the current state, for each possible behavior action. A next behavior action for the ego vehicle is selected, based on the ego safety values, the social safety values, and one or more target objectives for the ego vehicle.

In line with the invention, for each possible behavior action the ego safety value indicates a probability that an obstacle will not be located in an ego safety zone of the ego vehicle if the possible behavior action is performed by the ego vehicle and the target policy followed thereafter. The social safety value indicates a probability, for the at least one social object, that the ego vehicle will not be located in a social safety zone of the social object if the possible behavior action is performed by the ego vehicle and the target policy followed thereafter.

Further according to the invention, predicting the ego safety value for each possible behavior action is performed by a general value function (GVF) implemented by a trained neural network. Predicting the social safety value for each possible behavior action for each of the plurality of social objects is performed by a further GVF implemented by a trained neural network.

In at least some examples of the preceding aspects, the data received includes data representative of a plurality of social objects in the environment of the ego vehicle. In such examples, the method includes, for each possible behavior action, predicting a respective social safety value for each of the plurality of social objects, each social safety value indicating a probability that the ego vehicle will not be located in a respective social safety zone of the respective social object if the possible behavior action is performed by the ego vehicle and the target policy followed thereafter.

In at least some examples of the preceding aspects, determining the current state comprises determining a velocity and direction of the ego vehicle, and a velocity, direction and position of each of the plurality of social objects.

In at least some examples of the preceding aspects, the ego safety zone includes a physical space that includes and extends beyond the ego vehicle in a direction of travel of the ego vehicle, and the social safety zone for a social object <NUM> includes and extends beyond the social object in a direction of travel of the social object.

In at least some examples of the preceding aspects, for each possible behavior action, the social safety value corresponds to a plurality of social objects in the environment of the ego vehicle, the social safety value indicates a probability that the ego vehicle will not be located in a respective social safety zone of any of the social objects if the possible behavior action is performed by the ego vehicle and the target policy followed thereafter.

In at least some examples of the preceding aspects, selecting the behavior action includes performing fuzzification of the ego safety value and the social safety value predicted for each of the possible behavior actions by mapping each of the ego safety values and the social safety values to a respective truth value; applying fuzzy inference on the truth values to generate a goal fuzzy set; and defuzzifying the goal fuzzy set to select the behavior action for the ego vehicle.

A predictive safety control system is disclosed according to a second aspect of the invetion. The predictive safety control system includes a state module configured to determine a current state based on sensor data, and an ego safety predictor module configured to predict, based on the current state, for each possible behavior action in a set of possible behavior actions generated by an action module, an ego safety value corresponding to the ego vehicle, wherein the ego safety predictor module comprises a general value function, GVF, implemented by a trained neural network for predicting ego safety values. The predictive safety control system also includes a social safety predictor module configured to predict, based on the current state, for each of the possible behavior actions, a social safety value corresponding to at least one social object in an environment of the ego vehicle, wherein the social safety predictor module comprises a further GVF implemented by a trained neural network for predicting the social safety values for each social object. A safety controller is configured to select, based on the ego safety values, the social safety values predicted for each of the possible behavior actions, and one or more target objectives, a next behavior action for the ego vehicle, wherein, for each possible behavior action: the ego safety value indicates a probability that an obstacle will not be located in an ego safety zone of the ego vehicle if the possible behavior action is performed by the ego vehicle; and the social safety value indicates a probability, for the at least one social object, that the ego vehicle will not be located in a social safety zone of the at least one social object if the possible behavior action is performed by the ego vehicle.

In example embodiments, the systems and methods disclosed herein may in some circumstances reduce the safety risk of behavior actions taken at the ego vehicle on social objects such as other vehicles and pedestrians. The systems and methods of the present invention consider not only the safety of an ego vehicle, but also the safety of social objects. Social safety predictions and ego safety predictions as described in the present disclosure may in some applications be applied across a broad spectrum of environments including intersection handling, multi-lane highway driving, parking lots, school zones, and other complicated environments where the need for social safety is highly important. In some examples, social safety and ego safety can be considered as separate components, thereby making it possible to assign different prioritize these safeties in an automated decision making process.

The following is a list of selected acronyms and terms and their associated definitions that appear in this description:.

For convenience, the present application describes example embodiments of methods and systems with reference to a motor vehicle, such as a car, truck, bus, boat or ship, submarine, aircraft, warehouse equipment, construction equipment, tractor or other farm equipment. The teachings of the present application are not limited to any particular type of vehicle, and may be applied to vehicles that do not carry passengers as well as vehicles that do carry passengers. The teachings of the present application may also be implemented in mobile robot vehicles including, but not limited to, autonomous vacuum cleaners, rovers, lawn mowers, unmanned aerial vehicle (UAV), and other moving objects.

Example embodiments are described for systems and methods that are directed towards enhancing ego safety and social safety in the context of a vehicle that includes an automated driver replacement or driver assistance system such as an ADS or ADAS. In this regard, ego safety refers to the safety of an ego vehicle (i.e. the subject vehicle that is being controlled), and social safety refers to the safety of social objects within the environment of the ego vehicle. As used herein, a social object refers to an object other than the ego vehicle that is active (i.e. moving or dynamic as opposed to fixed in place) in the environment. By way of example, social objects can include non-stationary objects such as, but not limited to, other vehicles, bicycles, scooters, pedestrians and animals. Example embodiments are directed to a behavior planner of a planning system of the ADS (or ADAS), in which the behavior planner is configured to predict the impact of potential behavior actions on the safety of the ego vehicle (e.g. ego safety) as well as on the safety of social objects in the environment of the ego vehicle (e.g. social safety). In example embodiments, a suitable behavior action can be selected based on both the predicted ego safety and the predicted social safety determined for each behavior action in a set of possible behavior actions. Accordingly, in at least some example embodiments the problem of improving safety for both the ego vehicle and social objects is addressed by configuring the behavior planner to consider the impact that particular behavior actions will have not only on the safety of the ego vehicle but also on social objects, and select a suitable behavior action that satisfies safety requirements for both the ego vehicle and the surrounding social objects. In example embodiments, a predictive safety control system of the behavior planner is configured to assess both of the following questions: (a) if a given target policy is followed, will the ego vehicle be safe?; and (b) if the given target policy is followed will the ego vehicle make the social objects unsafe?.

In at least some examples, in addition to ego safety and social safety predictions, ego comfort can also be predicted for different types of behavior actions, and a particular behavior action selected based on the ego safety, social safety, and ego comfort predictions. In this regard, ego comfort corresponds to a degree of physical and/or mental comfort of the occupants of the ego-vehicle. By way of example, a certain behavior action may result in a rate of linear or angular acceleration of an ego vehicle that is safe, but which is physically or mentally uncomfortable for the occupants of the vehicle.

The predictive functions used to make safety and optionally comfort predictions may be trained via reinforcement learning (RL) using the general value function (GVF) framework. An example of a GVF framework that can be implemented in example embodiments is described in: "<NPL>. " Reinforcement learning (RL) enables a way of dealing with the stochastic and unknown behavior of other vehicles by learning from experience, including observing changes in behavior of other vehicles and the impact that has on safety. An example of RL is described in:<NPL>.

<FIG> is a schematic diagram showing selected elements of a system <NUM> in which the methods and systems for controlling safety of vehicles and surrounding objects can be implemented according to example embodiments of the present application. The system <NUM> comprises a vehicle control system <NUM> embedded in a vehicle <NUM>. The vehicle control system <NUM>, shown in greater detail in <FIG>, is coupled to a drive control system <NUM> and an electromechanical system <NUM> of the vehicle <NUM>, as described below. The vehicle control system <NUM> can in various embodiments allow the vehicle <NUM> to be operable in one or more of a fully-autonomous, semi-autonomous or fully user-controlled mode.

The vehicle <NUM> includes a plurality of environmental sensors <NUM> that collect information about the external environment surrounding vehicle <NUM> in which the vehicle <NUM> operates in, and a plurality of vehicle sensors <NUM> that collect information about the operating conditions of the vehicle <NUM>. Environment sensors <NUM> may for example include electromagnetic (EM) wave based sensors such as digital cameras <NUM>, light detection and ranging (LIDAR) units <NUM>, and radar units <NUM> such as synthetic aperture radar (SAR) units. Cameras <NUM>, LIDAR units <NUM> and radar units <NUM> are located about the vehicle <NUM> and are each coupled to the vehicle control system <NUM>, as described below. In an example embodiment, the digital cameras <NUM>, LIDAR units <NUM> and SAR units <NUM> are located at the front, rear, left side and right side of the vehicle <NUM> to capture information about the environment in front, rear, left side and right side of the vehicle <NUM>. The digital cameras <NUM>, LIDAR units <NUM> and radar units <NUM> are mounted or otherwise located to have different fields of view (FOVs) or coverage areas to capture information about the environment surrounding the vehicle <NUM>. In some examples, the FOVs or coverage areas of some or all of the adjacent environmental sensors <NUM> are partially overlapping. Accordingly, the vehicle control system <NUM> receives information about the external environment of the vehicle <NUM> as collected by cameras <NUM>, LIDAR units <NUM> and radar units <NUM>. In at least some examples, the coverage areas are divided into zones, including for example a front zone, a back zone, and right and left side zones. In at least some examples, one or more of cameras <NUM>, LIDAR units <NUM> and radar units <NUM> are configured with on-board processing and can perform pre-processing of collected information before providing the collected information to other systems of the vehicle control system <NUM> as sensor data <NUM>.

Vehicle sensors <NUM> can include an inertial measurement unit (IMU) <NUM>, an electronic compass <NUM>, and other vehicle sensors <NUM> such as a speedometer, a tachometer, wheel traction sensor, transmission gear sensor, throttle and brake position sensors, and steering angle sensor. The vehicle sensors <NUM>, when active, repeatedly (e.g., in regular intervals) sense information and provide the sensed information to the vehicle control system <NUM> as sensor data <NUM> in real-time or near real-time. The vehicle sensors <NUM> can include an IMU <NUM> that senses the vehicle's specific force and angular rate using a combination of accelerometers and gyroscopes. The vehicle control system <NUM> may also collect information about a position and orientation of the vehicle <NUM> using signals received from a satellite receiver <NUM> and the IMU <NUM>. The vehicle control system <NUM> may determine a linear speed, angular speed, acceleration, engine RPMs, transmission gear and tire grip of the vehicle <NUM>, among other factors, using information from one or more of the satellite receivers <NUM>, and the vehicle sensors <NUM>.

The vehicle control system <NUM> may also comprise one or more wireless transceivers <NUM> that enable the vehicle control system <NUM> to exchange data and optionally voice communications with a wireless network such as a wireless wide area network (WAN) <NUM> of the communication system <NUM>. The vehicle control system <NUM> may use the wireless WAN <NUM> to access a server <NUM>, such as a driving assist server, via one or more communications networks <NUM>, such as the Internet. The server <NUM> may be implemented as one or more server modules in a data center and is typically located behind a firewall <NUM>. The server <NUM> is connected to network resources <NUM>, which may provide supplemental data sources (for example local whether information or information collected by other environment sensors located in the environment the vehicle <NUM> is operating in, such as sensors located on or integrated into traffic lights, road signs, other vehicles, and the like) that may be used by the vehicle control system <NUM>.

The communication system <NUM> comprises a satellite network <NUM> comprising a plurality of satellites in addition to the WAN <NUM>. The vehicle control system <NUM> comprises the satellite receiver <NUM> (<FIG>) that may use signals received by the satellite receiver <NUM> from the satellite network <NUM> to determine its position. The satellite network <NUM> typically comprises a plurality of satellites which are part of at least one Global Navigation Satellite System (GNSS) that provides autonomous geo-spatial positioning with global coverage. For example, the satellite network <NUM> may be a constellation of GNSS satellites. Example GNSSs include the United States NAVSTAR Global Positioning System (GPS) or the Russian GLObal NAvigation Satellite System (GLONASS). Other satellite navigation systems which have been deployed or which are in development include the European Union's Galileo positioning system, China's BeiDou Navigation Satellite System (BDS), the Indian regional satellite navigation system, and the Japanese satellite navigation system.

<FIG> illustrates selected components of the vehicle <NUM> in accordance with an example embodiment of the present application. As noted above, the vehicle <NUM> comprises a vehicle control system <NUM> that is connected to a drive control system <NUM> and an electromechanical system <NUM> as well as to the environmental sensors <NUM> and vehicle sensors <NUM>. The vehicle <NUM> also comprises various structural elements such as a frame, doors, panels, seats, windows, mirrors and the like that are known in the art but that have been omitted from the present application to avoid obscuring the teachings of the present application. The vehicle control system <NUM> includes a processor system <NUM> that is coupled to a plurality of components via a communication bus (not shown) which provides a communication path between the components and the processor <NUM>. The processor system <NUM> is coupled to a drive control system <NUM>, Random Access Memory (RAM) <NUM>, Read Only Memory (ROM) <NUM>, persistent (non-volatile) memory <NUM> such as flash erasable programmable read only memory (EPROM) (flash memory), one or more wireless transceivers <NUM> for exchanging radio frequency signals with a wireless network <NUM>, a satellite receiver <NUM> for receiving satellite signals from the satellite network <NUM>, a real-time clock <NUM>, and a touchscreen <NUM>. The processor system <NUM> may include one or more processing units, including for example one or more central processing units (CPUs), one or more graphical processing units (GPUs), and other processing units.

The one or more wireless transceivers <NUM> may comprise one or more cellular (RF) transceivers for communicating with a plurality of different radio access networks (e.g., cellular networks) using different wireless data communication protocols and standards. The vehicle control system <NUM> may communicate with any one of a plurality of fixed transceiver base stations (one of which is shown in <FIG>) of the wireless WAN <NUM> (e.g., cellular network) within its geographic coverage area. The one or more wireless transceiver(s) <NUM> may send and receive signals over the wireless WAN <NUM>. The one or more wireless transceivers <NUM> may comprise a multi-band cellular transceiver that supports multiple radio frequency bands.

The one or more wireless transceivers <NUM> may also comprise a wireless local area network (WLAN) transceiver for communicating with a WLAN (not shown) via a WLAN access point (AP). The WLAN may comprise a Wi-Fi wireless network which conforms to IEEE <NUM>. 11x standards (sometimes referred to as Wi-Fi®) or other communication protocol.

The one or more wireless transceivers <NUM> may also comprise a short-range wireless transceiver, such as a Bluetooth® transceiver, for communicating with a mobile computing device, such as a smartphone or tablet. The one or more wireless transceivers <NUM> may also comprise other short-range wireless transceivers including but not limited to Near field communication (NFC), IEEE <NUM>. 3a (also referred to as UltraWideband (UWB)), Z-Wave, ZigBee, ANT/ANT+ or infrared (e.g., Infrared Data Association (IrDA) communication).

In at least some examples, one or more or the wireless transceivers <NUM> enable the vehicle control system <NUM> to receive third party information produced by the vehicle control systems of other vehicles operating in or near an environment of the vehicle control system, which may for example include state information generated in respect of the other vehicles or information about how vehicle <NUM> is perceived by the other vehicles. In some examples, such information could be communicated through peer-to-peer signaling using a predetermined communications protocol, and in some examples the such information may be provide through an intermediate service (e.g. from a network resource <NUM>).

The vehicle control system <NUM> also includes one or more speakers <NUM>, one or more microphones <NUM> and one or more data ports <NUM> such as serial data ports (e.g., Universal Serial Bus (USB) data ports). The system may also include other sensors such as tire pressure sensors (TPSs), door contact switches, light sensors, proximity sensors, etc..

The drive control system <NUM> serves to control movement of the vehicle <NUM>. The drive control system <NUM> may for example comprise a steering controller <NUM>, and a speed controller <NUM>, each of which may be implemented as software modules or control blocks within the drive control system <NUM>. The steering controller <NUM> and speed controller <NUM>, when in fully or semi-autonomous driving mode, receives navigation instructions from an autonomous driving system <NUM> (for autonomous driving mode) or a driving assistance system <NUM> (for semi-autonomous driving mode) and generate control signals to control one or more of the steering, braking and throttle of the vehicle <NUM>. The drive control system <NUM> may include additional components to control other aspects of the vehicle <NUM> including, for example, control of turn signals and brake lights.

The electromechanical system <NUM> receives control signals from the drive control system <NUM> to operate the mechanical components of the vehicle <NUM>. The mechanical system <NUM> effects physical operation of the vehicle <NUM>. The mechanical system <NUM> comprises a throttle <NUM> for controlling power applied to wheels by an engine, a steering system <NUM> for controlling the direction of the wheels and brakes <NUM> for applying braking force to the wheels. The engine may be a gasoline-powered engine, a battery-powered engine, or a hybrid engine, for example. Other components may be included in the mechanical system <NUM>, including, for example, turn signals, brake lights, fans and windows.

A graphical user interface (GUI) of the vehicle control system <NUM> is rendered and displayed on the touchscreen <NUM> by the processor <NUM>. A user may interact with the GUI using the touchscreen and optionally other input devices (e.g., buttons, dials) to select a driving mode for the vehicle <NUM> (e.g. fully autonomous driving mode or semi-autonomous driving mode) and to display relevant information, such as navigation information, driving information, parking information, media player information, climate control information, etc. The GUI may comprise a series of traversable content-specific menus.

The memory <NUM> of the vehicle control system <NUM> has stored thereon sets of software instructions executable by the processor system <NUM> that configure the vehicle control system <NUM> to implement a number of systems <NUM> in addition to the GUI. The systems <NUM> includes an operating system <NUM>, one or both of driving assistance system <NUM> for semi-autonomous driving (generally known as an advanced autonomous driver-assistance system (ADAS)), and autonomous driving system (ADS) <NUM> for fully autonomous driving. Both the driving assistance system <NUM> and the autonomous driving system <NUM> can include one or more of a navigation planning and control module, a vehicle localization module, parking assistance module, and autonomous parking module, vehicle state determination module as well as other modules. In example embodiment shown in <FIG>, the systems <NUM> include a perception module <NUM> and a path planning module 173Systems <NUM> may also include other modules <NUM>, which may include for example mapping module, navigation module, climate control module, media player module, telephone module and messaging module. In example embodiments the various systems and system modules are configured to interact during operation of the vehicle <NUM>.

Referring to <FIG>, the path planning module <NUM> includes a mission planner <NUM>, a behavior planner <NUM> and a motion planner <NUM>. The behavior planner <NUM> includes a predictive safety control system <NUM>. The predictive safety control system <NUM> causes the operations of methods described herein to be performed.

Referring again to <FIG>, the memory <NUM> also stores a variety of data <NUM>. The data <NUM> may comprise sensor data <NUM> received from the sensors <NUM>, user data <NUM> comprising user preferences, settings and optionally personal media files (e.g., music, videos, directions, etc.), and a download cache <NUM> comprising data downloaded via the wireless transceivers <NUM>, including for example data downloaded from network resources <NUM>. The sensor data <NUM> may comprise image data representative of an image from each camera <NUM>, LIDAR data representative of a point cloud from the LIDAR units <NUM>, radar data from the radar units <NUM>, and other sensor data from other vehicle sensors <NUM>. System software, software modules, specific device applications, or parts thereof, may be temporarily loaded into a volatile store, such as RAM <NUM>, which is used for storing runtime data variables and other types of data or information. Data received by the vehicle control system <NUM> may also be stored in the RAM <NUM>. Although specific functions are described for various types of memory, this is merely one example, and a different assignment of functions to types of memory may also be used.

Referring again, <FIG> is a block diagram that illustrates further details of the path planning module <NUM>. It should be understood that, in some examples involving machine learning, the path planning system <NUM>, or components of the path planning module <NUM>, may be trained outside of the vehicle <NUM> (e.g., in a simulator system). In examples discussed below, one or more of the mission planner <NUM>, and the motion planner <NUM> may include a neural network that is trained in a simulator.

Generally, path planning may be performed at three levels, namely at the mission level (e.g., performed by the mission planner <NUM>), at the behavior level (e.g., performed by the behavior planner <NUM>) and at the motion level (e.g., performed by the motion planner <NUM>).

Generally, the purpose of path planning is to determine a path for the vehicle <NUM> to travel from a first state (e.g., defined by the vehicle's current position and orientation, or an expected future position and orientation) to a target state (e.g., a final destination defined by the user). Path planning may also include determining one or more sub-paths to one or more intermediate target states. The path planning module <NUM> determines the appropriate path and sub-paths with consideration of conditions such as the drivable ground (e.g., defined roadway), obstacles (e.g., pedestrians and other vehicles), traffic regulations (e.g., obeying traffic signals) and user-defined preferences (e.g., avoidance of toll roads).

Path planning performed by the path planning module <NUM> may be dynamic, and be repeatedly performed as the environment changes. Changes in the environment may be due to movement of the vehicle <NUM> (e.g., vehicle <NUM> approaches a newly-detected obstacle) as well as due to the dynamic nature of the environment (e.g., moving pedestrians and other moving vehicles).

As mentioned above, path planning may be performed at different levels, for example at the mission level, behavior level and motion level. Mission level path planning is considered to be a higher (or more global) level of path planning, motion level path planning is considered to be a lower (or more localized) level of path planning, and behavior level path planning is considered to be between mission and motion level. Generally, the output of path planning at a higher level may form at least part of the input for a lower level of path planning.

At each level of planning, the planned path may be defined as a series of points, each point defining a planned target position (e.g., x- and y-coordinates) of the ego vehicle <NUM>. Each point may additionally define the planned speed, orientation, acceleration and/or angular speed of the vehicle <NUM>, thus defining the planned state of the vehicle <NUM> at each target position. The planned path may thus define a set of locations (or more generally, a set of states) to be travelled by the vehicle <NUM> in the planned journey.

Path planning at the mission level (more simply referred to as mission planning) relates to planning a path for the autonomous vehicle at a high, or global, level. The first state of the ego vehicle <NUM> may be the starting point of the journey (e.g., the user's home) and the target state of the ego vehicle <NUM> may be the final destination point (e.g., the user's workplace). Selecting a route to travel through a set of roads is an example of mission planning. Generally, the final destination point, once set (e.g., by user input) is unchanging through the duration of the journey. Although the final destination point may be unchanging, the path planned by mission planning may change through the duration of the journey. For example, changing traffic conditions may require mission planning to dynamically update the planned path to avoid a congested road. The user may also change the final destination point at any time during the journey.

Input data for mission planner <NUM> may include, for example, GPS data (e.g., GPS coordinates that are used to determine the starting point of the ego vehicle <NUM>), geographical map data (e.g., from an internal or external map database), traffic data (e.g., from an external traffic condition monitoring system), the final destination point (e.g., defined as x- and y-coordinates, or defined as longitude and latitude coordinates), as well as any user-defined preferences (e.g., preference to avoid toll roads).

The planned path output from the mission planner <NUM> defines the route to be travelled to reach the final destination point from the starting point. The output of the mission planner <NUM> may include data defining a set of intermediate target states (or waypoints) along the route. The intermediate target states may be defined at road intersections to indicate which road to take at each intersection, for example. The intermediate target states may be used for path planning at the behavior level.

The behavior planner <NUM> includes the predictive safety control system <NUM>. The behavior planner <NUM> receives the planned route from the mission planner <NUM>, including the set of intermediate target states (if any). The behavior planner <NUM> generates a planned behavior action for the vehicle <NUM>, in order to make driving decisions on a more localized and short-term basis than the mission planner <NUM>. For example, the behavior planner <NUM> may ensure that the vehicle <NUM> follows certain behavior rules (e.g., left turns should be made from the left-most lane). In the embodiment shown in <FIG>, the predictive safety control system <NUM> is a sub-system of the behavior planner <NUM> that includes instructions that are executable by a processor, such as the processor <NUM> of the vehicle control system <NUM>. The predictive safety control system <NUM> may be invoked by the behavior planner <NUM> to cause execution of the instructions of the predictive safety control system <NUM>. When the instructions of the predictive safety control system <NUM> are executed by the processor <NUM> of the vehicle control system <NUM>, the predictive safety control system <NUM> selects a behavior action. The behavior planner <NUM> receives the selected behavior action from the predictive safety control system <NUM> to enable the behavior planner <NUM> to generate a planned behavior action for the vehicle <NUM> that meets the target objectives.

The planned behavior action is received by the motion planner <NUM>. As will be discussed further below, the planned behavior action may be received by the motion planner <NUM> as state input data. The motion planner <NUM> should find a trajectory that satisfies the planned behavior action, and that navigates the environment in a relatively safe, comfortable, and speedy way. The motion planner <NUM> provides a safe and robust navigation of the vehicle <NUM> in both structured and unstructured environments. A structured environment is generally an environment having well-defined drivable and non-drivable areas (e.g., a highway having clear lane markings), and which may have defined driving rules that all vehicles are expected to follow. An unstructured environment is generally an environment in which drivable and non-drivable areas are less defined (or undefined) (e.g., an open field), and which may have fewer or no driving rules for expected vehicle behavior. Regardless of whether the environment is structured or unstructured, the environment may also be highly dynamic (e.g., pedestrians and other vehicles are each moving) and each dynamic obstacle may have different and independent behaviors.

In example embodiments, the behavior planner <NUM> includes the predictive safety control system <NUM>. The predictive safety control system <NUM> of vehicle control system <NUM> of vehicle <NUM> is configured to predict the effect that particular behavior actions will have on the safety of the vehicle <NUM> (referred to hereinafter as ego vehicle <NUM>) as well as on other social objects acting within the environment of the ego vehicle <NUM> and select a suitable behavior action that addresses safety requirements for both the ego vehicle <NUM> and the surrounding social objects.

In this regard, in example embodiments the predictive safety control system <NUM> is configured to define one or more ego safety zones z around ego vehicle <NUM> and one or more social safety zones z around any surrounding social objects, and select behavior actions with the objective of keeping social objects out of the ego-vehicle's safety zone(s) z and keeping the ego-vehicle out of the safety zones z of any of the social objects. An ego safety zone z is a physical space that extends beyond the dimensions of ego vehicle <NUM> in at least one direction, and a social safety zone z for a social object is a physical space that extends beyond the dimensions of that social object in at least one direction.

For illustrative purposes, <FIG> shows, from a bird's eye view, ego vehicle <NUM> approaching an intersection along with three social objects <NUM>(<NUM>) <NUM>(<NUM>) and <NUM>(<NUM>) (referred to collectively or generically as social object(s) <NUM>). In <FIG>, the social objects <NUM> are all shown as vehicles, however the social objects may also include other types of active objects such as cyclists, pedestrians and animals.

As can be seen in <FIG>, dashed lines are used to indicate direction of travel safety zones defined for each of the vehicles by predictive safety control system <NUM>. In particular, a direction of travel ego safety zone z <NUM> is shown surrounding ego vehicle <NUM>, and direction of travel social safety zones z <NUM>(<NUM>), <NUM>(<NUM>) and <NUM>(<NUM>) (referred to collectively or generically using reference numeral <NUM>), are shown surrounding social objects <NUM>(<NUM>) <NUM>(<NUM>) and <NUM>(<NUM>) (referred to collectively or generically using reference numeral <NUM>), respectively.

In example embodiments, in addition to direction of travel safety zones (which will be referred to as front safety zones for convenience), other safety zones may also be defined for the ego vehicle <NUM> and each of the social objects <NUM>, including for example a back safety zone (i.e. opposite to the direction of travel) and right and left safety zones (i.e. in horizontal directions that are perpendicular to the direction of travel). In the case of vehicles that are capable of three dimensional movement (for example flight enabled vehicles and submarines), up and down safety zones may also be defined. In some examples, omnidirectional safety zones may be defined for the ego vehicle <NUM> and each of the social objects <NUM>.

In at least some examples, the safety zones are defined as three dimensional (3D) spaces relative to the respective ego vehicle <NUM> and social objects <NUM>, and in this regard <FIG> illustrates 3D forward ego safety zone z <NUM> in respect of ego vehicle <NUM>, which as shown has a zone length zlength, zone width zwidth, and zone zheght. As will be explained in greater detail below, one or more of the safety zone dimensions (for example zone length zlength) can be adaptively determined by the predictive safety control system <NUM> based on one or more properties of a sensed vehicle state, such as speed for example. In some examples, some zone dimensions (for example height and width) may be based exclusively on predetermined vehicle dimensions.

As indicated by arrow <NUM>, which indicates a predicted path of ego vehicle <NUM> in response to a possible action, <FIG> represents a potential left hand turn scenario. Based solely on the ego vehicle forward safety zone z <NUM>, it appears that ego vehicle can safely make a left hand turn. However, when the forward social safety zone z <NUM>(<NUM>) of social object <NUM>(<NUM>) is considered, it can be determined that the predicted ego vehicle path <NUM> intersects with the forward social safety zone z <NUM>(<NUM>). Accordingly, a decision can be made to brake and not make the left hand turn at the immediate time.

Accordingly, in example embodiments, predictive safety control system <NUM> is configured to select behavior actions with the objective of keeping the social objects <NUM> out of the ego safety zone (e.g. z <NUM>) and keeping the ego vehicle <NUM> out of the social safety zones (e.g. z <NUM>(<NUM>), <NUM>(<NUM>) and <NUM>(<NUM>)) of any of the social objects <NUM>. An example architecture and operation of predictive safety control system <NUM> will now be provided with reference to <FIG>, which illustrates a functional block diagram of predictive safety control system <NUM> accordingly to example embodiments.

As shown in <FIG>, in example embodiments the predictive safety control system <NUM> includes a predictive perception unit <NUM>, which is configured to make predictions <NUM> about possible future states based on a current state determined from sensor data received from environmental sensors <NUM> and vehicle sensors <NUM> (i.e., information about the environment the ego vehicle <NUM> operates in sensed by the sensors <NUM> and information about the ego vehicle <NUM> sensed by the vehicle sensors <NUM>), and a safety controller <NUM>, which is configured to select behavior actions based on the predicted future states.

In example embodiments, the predictive perception unit <NUM> includes a state module <NUM> and a set <NUM> of predictor modules <NUM>, <NUM>, <NUM>.

The state module <NUM> is configured to map sensor data received from environmental sensors <NUM>, vehicle sensors <NUM> and, in some examples, external resources (e.g. network resources <NUM> or other social objects) to a current vehicle state st of the ego vehicle <NUM>. The ego vehicle state st ∈ s (where S represents all possible state values) is a representation of the ego vehicle environment at a discrete time t, and includes numeric values (e.g. state data) describing aspects of the physical environment surrounding the ego vehicle <NUM> (st,env) and the physical vehicle operating parameters of the ego vehicle <NUM> itself (st,op).

In some examples, vehicle parameter state data st,op included in the ego vehicle state st about the physical operating parameters of the ego vehicle <NUM> may be based on sensor data received from vehicle sensors <NUM>. Vehicle parameter state data st,op about the current physical operating parameters may include, for example: ego vehicle speed v; engine RPM; transmission gear; throttle position; brake position; steering angle; angular acceleration; linear acceleration; and vehicle pitch, yaw and roll.

In example embodiments, environmental state data st,env included in ego vehicle state st about the physical environment surrounding the ego vehicle <NUM> may be determined based on sensor data about the surroundings of the ego vehicle <NUM> as detected by embedded environmental sensors <NUM> (e.g. one or more of cameras <NUM>, LIDAR units <NUM> and radar units <NUM>). Environmental state data st,env may for example include data about obstacles (e.g. stationary objects and social objects), road lanes, traffic lights, road side and overhead signs, road markings, road conditions and other detectable elements within the environment surrounding the ego vehicle <NUM>. In at least some examples, one or more of the environmental sensors <NUM> may have on-board processing capabilities that enable intelligent outputs such as distance measurements or speed measurements of nearby social objects, however in some examples such calculations may be performed by the state module <NUM> based on less refined data from sensors <NUM>. By way of example, LIDAR units <NUM> may provide range images or point cloud data representative of a point cloud that provide <NUM> degree coverage of the physical environment (including for example social objects <NUM>) surrounding the ego vehicle <NUM>. The surrounding environment data from LIDAR units <NUM> may in some examples be supplemented with data from one or both of cameras <NUM> and radar units <NUM>.

In some examples, data about the surrounding environment of the ego vehicle <NUM> may also be received through wireless transceiver(s) <NUM> from other resources, including for example data about weather or road conditions from network resources <NUM>, and data received directly or indirectly from other social objects <NUM>. By way of example, third-party vehicles in the environment may be configured to communicate information about one or more of their own perceived state (based, for example, on their own sensor data), planned behavior, or planned actions.

As noted above, the environmental state data st,env generated by state module <NUM> about the physical environment surrounding the ego vehicle <NUM> includes data about stationary objects and moving objects, including social objects <NUM>. In some examples, the data included in environmental state data st,env may be limited to data that indicates the presence and location of obstacles in the environment of the ego vehicle <NUM>. In example embodiments, the state module <NUM> is configured to generate additional state data in respect of social objects <NUM>. In this regard, in some example embodiments, the state module <NUM> includes a social object detector function <NUM> that is configured to identify social objects <NUM> within the environment of the ego vehicle <NUM>, and generate a representative social object state <MAT> for each social object <NUM>(i) detected at time t. In example embodiments, the social object state <MAT> generated in respect of a social object <NUM>(i) may include a unique identifier and data indicating one or more of a speed v of the social object <NUM>(i), a relative location and/or absolute location and direction of the social object <NUM>(i), and dimensions of the social object <NUM>(i), among other things. Accordingly, social object detector function <NUM> is configured to generate a social object state data set ot that includes <MAT> where <MAT> is the number of social objects detected at time t. The number <MAT> of social objects <NUM> will typically vary, and in example embodiments, the social object detector function <NUM> is configured to limit the number <MAT> of social objects represented in data set Ot to a threshold number K. For example, where the number of social objects <NUM> detectable within the environment of the ego vehicle <NUM> is greater than K at time t, social object detector function <NUM> may be configured to generate SODIs <MAT> for only the <MAT> closest social objects <NUM>. In example embodiments, social object detector function <NUM> may employ known object detection methods or receive object data from other modules that employ known object detection methods. An example of one suitable object detection method is described in: <NPL>.

Accordingly, in example embodiments the state data for ego vehicle <NUM> at time t can be represented as st = st,env, st,op, Ot.

In example embodiments, some or all of the functionality of state module <NUM> may be implemented by modules of systems of the vehicle control system <NUM> other than predictive perception unit <NUM>. For example, the some or all of the functionality of state module <NUM> may be implemented in the perception system <NUM>.

In example embodiments, state module <NUM> is configured to calculate additional state data in addition to the ego vehicle state st described above. This calculated state data st,calc may for example include data indicating current ego vehicle safety, data indicating current social object safety, and optionally data indicating current ego vehicle comfort. In this regard, in example embodiments state module <NUM> includes an ego safety function <NUM> for calculating an ego vehicle safety state for the ego vehicle <NUM>, a social object safety function <NUM> for calculating a social object safety state for each of the social objects <NUM>, and a comfort function <NUM> for calculating a comfort state for the ego vehicle <NUM>.

In some examples, the current safety states and current comfort states are calculated only when training predictor modules <NUM>, <NUM>, <NUM>. For example, current ego safety states, current social object safety states and current comfort states can be used to generate respective cumulant signals (pseudo-reward signals) for training ego safety, social safety and comfort GVFs respectively that are used in example embodiments to implement the ego safety, social safety and comfort predictor modules <NUM>, <NUM>, and <NUM> (described in greater detail below).

As noted above in respect of <FIG>, the predictive safety control system <NUM> is configured to define one or more ego safety zones z around ego vehicle <NUM> and one or more social safety zones z around any surrounding social objects <NUM>. In example embodiments, the safety zones z for ego-vehicle <NUM> are defined by ego safety function <NUM> and the safety zones z for respective social objects <NUM> are determined by social object safety function <NUM>, and the safety states and are determined on a zone by zone basis.

In one example, ego safety function <NUM> (safe) is a function that maps parameters concerning current ego vehicle state st ∈ S, parameters concerning safety <MAT> and the safety zone z ∈ Zego, represented as follows: <MAT>.

The output of the ego safety state function <NUM> is a value between <NUM> and <NUM> that indicates the safety state of the ego vehicle <NUM> for the specific safety zone z, where <NUM> is safe and <NUM> is unsafe. Possible ego safety zones z include: omni-directional (safe or unsafe in all directions); specific spatial zones/areas around the vehicle; specific directions around the vehicle. In the following description, direction of travel (e.g. front) safety zones such as those as discussed above in respect of <FIG> are used for purposes of illustrating example embodiments.

In one example embodiment, the ego safety state function <NUM> is configured to conclude that the ego safety state at time t for a zone z is safe if data from environmental sensors <NUM> indicates that no obstacles are located in the zone z. In a specific example, the safety parameters are selected to specify that ego safety zone z is safe at time t if LIDAR data representative of a point cloud received from Lidar units <NUM> indicates that less than a threshold number of data points fall within the boundaries of the ego safety zone z. In some examples, the threshold could be <NUM> point, and in some example the threshold could be set higher to avoid false positives.

Accordingly, in an example embodiment, the ego-vehicle safety function <NUM> is defined as: <MAT> where o is a an object (for example a stationary object or a social object <NUM>) detected in the environment around the ego vehicle <NUM>. The zone z ∈ Zego is a three dimensional zone oriented with respect to the ego vehicle <NUM>. In the illustrated example, as shown in <FIG>, the length of the front ego safety zone is a function of speed such that zlength = zsafe + Vlength where zsafe = vtspacing + dmin; where tspacing represents a predefined safe time threshold spacing between the ego vehicle <NUM> and the object o; dmin is a predefined minimum safe distance between the ego vehicle <NUM> and object o when stopped; vlength is the length of the vehicle; and v the speed of the ego vehicle <NUM>.

In example embodiments, the predefined safety thresholds tspacing and dmin can be based, within limits, on user input preferences hpref.

In one example, social object safety function <NUM> (socialsafe) is a function that maps the current state, the parameters of the detected social object, parameters concerning safety (such as human preferences in spacing) <MAT> and the social safety zone z ∈ Zsocial to a social safety value in accordance with the following: <MAT>.

The social safety value (i.e., the output of the above) is a value between <NUM> and <NUM> that indicates the safety level of the social object <NUM> in relation to a specific safety zone z for that social object <NUM> where <NUM> is safe and <NUM> is unsafe. In example embodiments, the social object safety function <NUM> is configured to determine that the social obstacle safety state at time t is safe if sensor data received from environmental sensors <NUM> indicates that the ego vehicle <NUM> is not located in the social safety zone z of any of the social objects. In example embodiments, social object safety function <NUM> may use social object state data generated by social object detector <NUM> to predict the social safety of that object. In some examples, rather than or in addition to predicting social safety in respect of social object, the social object safety function <NUM> may output a global social safety value that indicates a global safety value for all social objects in the surrounding environment. For example, a global social safety value could be determined based on one or more combinations of individual social safety values reaching a defined threshold.

In example embodiments, the social object safety function <NUM> for a social object <NUM> for social safety zone zl is defined as: <MAT> where z is the social safety zone z ∈ Zsocial of social object <NUM> (i) (each social object has a set of one or more social safety zones, Zsocial), <MAT> is the state for social object <NUM>(i), and e is the three dimensional geometric volume occupied by the ego vehicle <NUM>. The social safety zone z for the social object <NUM> is defined based on coordinates given in reference to the ego vehicle <NUM>; social safety zone zl is calculated by defining a bounding box is around the social object <NUM> and adding a safety distance zsafe along the direction of travel to determine a safety region in front of the social object. Similar to ego-vehicle <NUM> as discussed above, the safety distance zsafe can be a function of the social object's speed.

Although only the functions for front safety zones are set out above, as noted above in example embodiments states could also be determined for other possible zones z, including for example: an omni-directional safety zone (safe or unsafe in all directions); and other specific spatial zones/areas around the vehicle, including for example side zones and, in the case of objects enabled for 3D motion, vertical zones.

In example embodiments, zone specific ego vehicle comfort state function <NUM> for the ego vehicle <NUM> is represented as: <MAT>.

The comfort safety value (i.e., the output of the comfort state function) is a value between <NUM> and <NUM> that indicates the comfort level of the ego vehicle <NUM> (in relation to a specific zone) where <NUM> is comfortable and <NUM> is uncomfortable. In one example embodiment, ego vehicle comfort state function <NUM> is defined as: <MAT> where <MAT> is the root mean square (RMS) of the accelerometer data representative of the acceleration or vibration of the ego vehicle <NUM> received from an accelerometer sensor (for example an accelerometer sensor included in the IMU <NUM>) at time t and θaccel is comfort threshold for measured acceleration or vibration in the ego vehicle <NUM>.

In some embodiments, the safety, social safety and comfort functions are defined based on algorithms and criteria set by human experts. In some examples, one or both of the safety and comfort thresholds (for example may be based, within defined safety limits, on user input preferences ( <MAT>), may be automatically adjusted based on road and weather conditions received through network resources <NUM>, or may be based on road surface conditions as sensed by cameras <NUM>.

As illustrated in <FIG>, the set <NUM> of predictor modules <NUM>, <NUM>, <NUM> includes ego safety predictor module <NUM>, social safety predictor module <NUM> and, in at least some examples, a comfort predictor module <NUM>. The state st constructed by the state module <NUM> is used by predictor modules <NUM>, <NUM>, <NUM> to determine a set of action conditioned (AC) predictions <NUM> about the effects of various behavior actions on the environment of ego vehicle <NUM>. The AC predictions <NUM> are behavior action conditioned in that the predictions indicate a predicted state for a future time that is conditional on a certain behavior action at occurring. In example embodiments t1 can be from <NUM> to <NUM> seconds.

In this regard, in example embodiments, predictive perception unit <NUM> receives, as an input from an action module <NUM> (which may be part of the behavior planner <NUM>), a set A of all possible behavior actions ât that can be taken by the ego vehicle <NUM> given the current vehicle state st. In some examples, the set A may include all behavior actions possible at defined intervals within a future time duration, for example all behavior actions possible at each second for the next <NUM> seconds. In example embodiments, the behavior actions ât in the set A will each specify a target speed vt for speed controller <NUM>. For example a target speed vt could be specified on the interval of [<NUM>, vmax] where <NUM> is stopped and vmax is the maximum allowed target speed permitted by speed controller <NUM>. A target direction (e.g. a steering angle) may also be included in the behavior actions at (e.g. -<NUM> = -<NUM> degrees to +<NUM> = +<NUM> degrees, where <NUM> degrees is no angle). In example embodiments, the set A of all possible behavior actions is generated by action module <NUM> using known techniques. In some example embodiments, action module <NUM> is configured to select the set A of permissible behavior actions based on the planned route output by the mission planner <NUM> and current state of the ego vehicle <NUM>. In some examples, all permissible behavior actions could include all physically plausible behaviors, and in some examples, the set of permissible behavior actions could be intelligently filtered to takes into account the local laws and eliminate illegal behaviors.

As will be described in greater detail below, the AC predictions <NUM> that are output by the set <NUM> of predictor modules <NUM>, <NUM>, <NUM> are provided to the safety controller <NUM>, which selects a suitable behavior action to achieve one or more target objectives based on the AC predictions <NUM>. Target objectives include one or more of a target speed vt, a target direction, a target safety, a target comfort, a target lane. Accordingly, predictive perception unit <NUM> provides a set of AC predictions <NUM> that effectively form an interactive model of the environment surrounding the ego vehicle <NUM>, providing the safety controller <NUM> with the input needed for the safety controller <NUM> to select a behavior action to minimize a defined cost function or maximize total reward.

Referring to <FIG>, in some embodiments the predictor modules <NUM>, <NUM>, <NUM> each include one or more respective predictor functions <NUM>, <NUM>, <NUM> that are implemented by learned agents based on machine learning algorithms trained through reinforcement learning (RL) (see for example the above identified papers by R. For example, the predictor functions <NUM>, <NUM> and <NUM> may be implemented as one or more learned agents in the form of trained neural networks that are implemented using one or more CPUs or GPUs of the processor system <NUM> of vehicle control system <NUM>. In some examples, a separate neural network is used for each predictor function <NUM>, <NUM>, <NUM>, although in some embodiments at least some layers of a neural network may be used for multiple predictors - for example in some embodiments it is possible that one or more or all predictors may share the same inputs (state) along with <NUM> or more layers, meaning that it is possible for all predictors to be implemented in a single neural network with multiple diverging output branches for each prediction.

Neural network (NN) based predictor functions <NUM>, <NUM>, <NUM> can be trained using different methods, however in an example embodiment RL is used to determine GVFs for each of the NN based predictor functions <NUM>, <NUM><NUM> (also referred to herein as predictor GVFs). An example embodiment for training predictor functions <NUM>, <NUM>, <NUM> will be described in greater detail below. In some alternative embodiments, one or more of the predictor functions <NUM>, <NUM>, <NUM> are implemented by rule-based algorithms.

In at least some example embodiments, the predictive perception unit <NUM> includes a total of |Zego| + |Zsocial| + |Zcomfort| predictor functions, where |Zego| is the number of ego vehicle safety zones, |Zsocial| is the number of social object safety zones, and |Zcomfort| is the number of ego vehicle comfort zones. For example, in the case where only front ego safety, front social object safety, and front ego vehicle comfort zones are considered, the number of predictor functions is three as shown in <FIG>, namely: front zone ego safety predictor GVF <NUM> (fego); front zone social object safety predictor GVF <NUM> (fsocial); and front zone ego vehicle comfort predictor GVF <NUM> (fcomfort). In some embodiments, the comfort predictor module <NUM> and its corresponding predictor GVF <NUM> can be omitted.

The predictor functions <NUM>, <NUM>, <NUM> collectively make predictions <NUM> about the environment, providing a predictive state space pt ∈ P for the safety controller <NUM>. The predictions <NUM> are action conditional "what-ifs" that evaluate the long term impact (e.g. for the next <NUM>-<NUM> seconds) of possible actions on ego safety, social safety, and comfort. The mapping from the state space S= st, Ot to the predictive state space P that is performed by the set <NUM> of predictor modules <NUM>, <NUM>, <NUM> can be represented as: <MAT>.

Each predictor functions <NUM>, <NUM>, <NUM> generates a vector of predictions, one for each possible behavior action <MAT> in state st, where n = |A| the number of behavior actions available The number of predictions collectively output by predictor modules <NUM>, <NUM> and <NUM> and their respective predictor functions <NUM>, <NUM>, <NUM> is |Zego| + <MAT>, for each behavior action available.

Each of the predictor modules <NUM>, <NUM> and <NUM> and their respective predictor functions <NUM>, <NUM>, <NUM> will now be described in greater detail. In example embodiments, the ego safety predictor module <NUM> is configured to predict, based on the current vehicle state st, future ego safety predictions <MAT> for each of a plurality of different possible behavior actions at. As noted above, the ego safety predictor module <NUM> includes a predictor GVF fego(st,ât,z) for each ego safety zone. In the illustrated example of <FIG>, only front zone ego safety predictor GVF fego(st,ât,z) <NUM> is illustrated. In an example embodiment, the specific data from the ego vehicle state space (st) that is input to the front ego safety zone predictor GVF fego(st,ât,z) <NUM> may include, for a given time t: (<NUM>) physical ego vehicle operating state st,op, including data for: ego vehicle speed vt, transmission gear, engine RPM, steering angle, throttle position, and brake position; and (<NUM>) ego vehicle environment state st,env, which may for example include LIDAR data representative of a point cloud and/or other environmental data such as image data or radar data. For each possible input behavior action ât, the input may include an ego target speed vtarget and a target steering angle (or direction). In some examples, the output safety prediction <MAT> for a safety zone is an ego safety value that indicates a probability that, based on a specific behavior action ât, the ego safety zone z will be free of both static and moving obstacles (such as another vehicle) at future time t+<NUM>. In some examples, predicted ego safety <MAT> is represented as a probability value normalized between <NUM> and <NUM>, where <NUM> is unsafe (e.g. <NUM>% certain an obstacle will be in the ego safety zone) and <NUM> is safe (e.g. <NUM>% certain no obstacle will be in the ego safety zone).

In this regard, the front zone ego safety predictor GVF fego(st,ât,z) <NUM> maps current state, safety preferences <MAT>, safety zone z ∈ Zego, and next behavior action ât ∈ A to a value between <NUM> and <NUM> as shown: <MAT>.

The output of the front ego safety zone predictor GVF fego(st,ât,z) <NUM> for each behavior action is a scaler representation of the safety probability of the front ego safety zone.

In some examples, the current ego vehicle safety state safe may optionally also be included as an input to the ego vehicle safety predictor GVF <NUM>. In example embodiments, the current ego vehicle safety state safe is included as an input to the ego vehicle safety predictor GVF fego <NUM> when training the predictor GVF fego <NUM> to learn predictions, as described in greater detail below.

The social object safety predictor module <NUM> is configured to predict, based on the current ego vehicle state st and the social object state space Ot, future social object safety predictions ptsocial[ât|zsocial|oit] for each of <MAT> social objects, for a plurality of different possible behavior actions at. As noted above, the social object safety predictor module <NUM> includes a predictor GVF fisocial(st,ât,oti,z) <NUM> for each ego vehicle safety zone. In the illustrated example of <FIG>, only front zone social object safety predictor GVF fisocial(st,ât,oti,z) <NUM> is illustrated. In an example embodiment, the specific data from the ego vehicle state space (st) that is input to the front social object safety zone predictor fisocial(st,ât,oti,z) <NUM> may include, for a given time t: (<NUM>) physical ego vehicle operating state st,op, including data for: ego vehicle speed vt, transmission gear, engine RPM, steering angle, throttle position, ego vehicle dimensions, and brake position; (<NUM>) ego vehicle environment state st,env, which may for example include LIDAR data representative of a point cloud and/or other environmental data such as image data or radar data; and (<NUM>) social object state oti for each of the <MAT> social objects, including, for each social object: relative position to the ego vehicle, speed, heading or direction and turning rate. For each possible input behavior action ât, the input may include an ego vehicle target speed vtarget and an ego vehicle target steering angle (or direction). In some examples, the output social safety prediction ptsocial[ât|zsocial|oit] for the safety zone of each social object is a social safety value that indicates a probability that, based on a specific behavior action ât, the social object safety zone z will be free of the ego vehicle <NUM> at future time t+<NUM>. In some examples, predicted social zone safety ptsocial[ât|zsocial|oit] is represented as a probability value normalized between <NUM> and <NUM>, where <NUM> is unsafe (e.g. <NUM>% certain ego vehicle will be in the social object safety zone) and <NUM> is safe (e.g. <NUM>% certain ego vehicle will NOT be in the social object safety zone).

In this regard, the front zone social vehicle safety predictor GVF fisocial(st,ât,oti,z) <NUM> maps current state, safety preferences <MAT>, social safety zone z ∈ Zsocial, and next behavior action ât ∈ A to a value between <NUM> and <NUM> as shown: <MAT>.

The output of the front ego safety zone predictor GVF fisocial(st,ât,oti,z) <NUM> for each social object for each behavior action is a scaler representation of the safety probability of the front social object safety zone.

In some examples, the current social object safety state socialsafe may optionally also be included as an input to the social object safety predictor GVF <NUM>. In example embodiments, the social object safety states socialsafe are included as an input to the social object safety predictor GVF <NUM> when training the predictor GVF to learn predictions, as described in greater detail below.

In embodiments that include comfort predictor module <NUM>, the comfort predictor module <NUM> can be configured in the same manner as ego safety predictor module <NUM>, except that comfort predictor module <NUM> makes predictions in respect of ego vehicle comfort risk zones rather than safety zones. In this regard, comfort predictor module <NUM> is configured to predict, based on the current vehicle state st future vehicle comfort predictions ptcomfort[ât|zcomfort] for each of a plurality of different behavior actions ât. As noted above, the ego vehicle comfort predictor module <NUM> includes a predictor GVF fcomfort(st,ât) for each ego vehicle comfort zone. In the illustrated example of <FIG>, only front zone ego vehicle safety predictor GVF fcomfort(st,ât) <NUM> is illustrated. In an example embodiment, the specific data from the ego vehicle state space (st) that is input to the front ego vehicle safety zone predictor GVF fcomfort(st,ât) <NUM> may include, for a given time t: physical ego vehicle operating state st,op, including data for: ego vehicle speed vt, transmission gear, engine RPM, steering angle, throttle position, brake position, as well as a short history of linear and/or sensor data indicative of acceleration of the ego vehicle <NUM> received from the vehicle sensors <NUM>, such as the IMU <NUM> (e.g. last "K" RMS readings). For each possible input behavior action ât, the input may include an ego target speed vtarget and a target steering angle. In some examples, the vehicle comfort prediction ptcomfort[ât|zcomfort] indicates a probability that, based on a specific behavior action ât, the RMS acceleration of the ego vehicle <NUM> will fall within a comfort threshold at future time t+<NUM>. In some examples, predicted comfort is represented as a probability value normalized between <NUM> and <NUM>, where <NUM> is uncomfortable (e.g. <NUM>% certain ego vehicle will be outside comfort threshold) and <NUM> is comfortable (e.g. <NUM>% certain ego vehicle comfort will be within threshold).

In some example embodiments, comfort predictor module <NUM> may optionally also receive the current comfort state comfort(st,z) as an input.

Accordingly, the AC predictions <NUM> that are output by the prediction perception unit <NUM> for each available behavior action ât at time t can be represented as: <MAT>.

These AC predictions <NUM> collectively provide a predictive state space pt ∈ P for the safety controller <NUM>. All of these predictions are action conditional "what-ifs" that can be used to evaluate the impact that different behavior actions will have on ego vehicle safety, social object safety and ego vehicle comfort.

The predictions pt are supplied to the safety controller <NUM> which is configured to select a next behavior action for the ego vehicle <NUM> to maximize safety, comfort and other goals. The safety controller <NUM> can be represented as a function fcontrol that maps current state and current predictive state to the next behavior action as follows: <MAT>.

In example embodiments, the safety controller <NUM> can implement a number of different controllers. In the presently disclosed example embodiment, as indicated in <FIG>, the safety controller <NUM> includes a fuzzy inference system (FIS) controller <NUM> to select a target speed vtarget and a classical PID controller <NUM> (which may for example be part of speed controller <NUM>) to achieve the target speed vtarget. In example embodiments, FIS controller <NUM> is configured to seek for the behavior action that satisfies the following linguistic statement: <MAT>.

In example embodiments, FIS controller <NUM> is configured to treat the selection of a behavior action as a maximization problem, however a maximization is just one defuzzification approach that can be used. As shown in <FIG>, in one example, FIS controller <NUM> implements the following modules or operations: (a) fuzzification module <NUM>; (b) fuzzy reasoning module <NUM>; and (c) defuzzification module <NUM>.

Fuzzification module <NUM> includes: (i) fuzzification function SAFEego for mapping ego safety predictions pego to fuzzy truth values mego; (ii) fuzzification function SAFEsocial for mapping social safety predictions psocia/ for each social object to fuzzy truth values msocial; and (iii) fuzzification function COMFORTego for mapping ego comfort predictions pcomfort to fuzzy truth values mcomfort. Accordingly, in an example embodiment, fuzzification functions SAFEego, SAFEsocial, COMFORTego map predictions pt to graded truth values, or values between <NUM> and <NUM> that denote the degree to which the safety prediction of a behavior action is considered safe to an end-user, as follows: <MAT> <MAT> <MAT>.

The mapping performed by fuzzification module <NUM> can be represented as: <MAT> <MAT> <MAT> where the truth values of ego, social and comfort are respectively denoted as mego[ât], msocial[ât] and mcomtort[ât].

Fuzzy reasoning module <NUM> is configured to apply fuzzy inference in respect of the truth values mego[ât], msocial[ât] and mcomfort[ât] to generate a goal fuzzy set that satisfies the following statement (<NUM>) (which is a restatement of linguistic statement (<NUM>): <MAT> where Λ is a standard t-norm operator (common t-norms are min or product) and G[ât] is the goal fuzzy set.

The goal fuzzy set G[ât] characterizes the statement (<NUM>) and denotes the membership value of each behavior action that satisfies the statement. Defuzzification module <NUM> is configured to produce a final behavior action by applying defuzzification to the goal fuzzy set G[ât] to select a single best behavior action. Although different defuzzification methods existin example embodiments defuzzification module <NUM> is configured to select the behavior action with maximum membership. The defuzzification module returns the behavior action that maximizes the membership values as computed by <MAT>.

In some example embodiments, COMFORTego can be omitted, however its inclusion may enable a selected behavior action sequence over time that results in a smoother ride for the ego vehicle <NUM>.

In example embodiments, target speed vtarget can be a maximum desired speed that is as set by driving assistance system <NUM> or autonomous driving system <NUM>, for example. The fuzzification functions Safeego, Safesocial, Comfortego and fuzzy reasoning module <NUM> can be implemented using rules-based algorithms, and in some embodiments may be implemented as trainable functions learned via machine learning. In a rules-based implementation, fuzzification functions Safeego, Safesocial, Comfortego and fuzzy reasoning module <NUM> may be configured using manual specifications to optimize goal fuzzy sets. In some embodiments, the definitions used and rules applied by the fuzzification functions Safeego, Safesocial, Comfortego and fuzzy reasoning module <NUM> to output goal fuzzy sets are selected to support the entire behavior action space so as to mitigate against scenarios where there may be no suitable behavior action found. In the case where behavior action space at an unprotected left turn is turn left or yield, the behavior command is issued to the motion planner <NUM> to formulate a motion plan to be executed by the drive control system <NUM>.

In example embodiments, in order to ensure ego safety is more important than social safety, a requirement may be set that SAFEego ⊆ SAFEsocial, which means the truth values for ego safety must be higher than the truth values for social safety across the entire domain. An alternative simple interpretation for SAFEego and SAFEsocial can be the identity function since the probabilistic predictions of safety can be also considered truth values. However, in example embodiments, fuzzy sets may add flexibility to control the interpretation of the predictions from a system programmer point of view.

As noted above, in example embodiments, ego vehicle safety predictor GVF <NUM> (fego), social object safety predictor GVF <NUM> (fsocial), ego vehicle comfort predictor GVF <NUM> (fcomfort) are trained using RL based on methodology disclosed in the above identified mentioned paper by R. Sutton et al. To construct each GVF, a cumulant (pseudo-reward) function, pseudo-termination function, and target policy is defined. For constant values of the termination function, namely the discount factor γ, the time horizon for the prediction can be controlled via the relationship: <MAT> where nΔt is the number of time steps to predict into the future.

The cumulant for predicting comfort is: <MAT>.

The correction factor <NUM> - γ normalizes the sum of all future cumulants such that the total return fcomfort(st,at) is: <MAT>.

The cumulant for predicting ego safety and social safety, respectively, are: <MAT> <MAT>.

A target policy of π(at|st) = <NUM> for all behavior actions at and states st can be used for a scenario where selecting an appropriate target policy may be more challenging than building a simple versatile policy for data collection purposes. Defining an expert policy for data collection and training can result in more stable learning than using traditional off-policy learning with a specified target policy. In at least some example embodiments, data collection and learning can be done with a human expert driver.

Although a number of different data collection and training (DCT) systems are possible, in one example, training of the ego safety predictor GVF is treated as a function learning problem. The function to be learned for predicting the front zone ego safety is: <MAT> where <MAT> is the predicted safety at Δt time steps into the future as described in equation (<NUM>), st is a vector that represents the state of the system and at is a potential behavior action to be taken.

The function is realized as a standard feed forward neural network. The cumulant for predicting front ego safety is: <MAT> where <MAT> is the current front safety of the ego vehicle, z = FRONT is the direction and γ is the discount factor.

The correction factor <NUM> - γ normalizes the sum of all future cumulants such that the front ego safety predictor GVF <MAT> <NUM>(<NUM>) represents a weighted average of all future front safeties.

In the present example embodiment, state-action-reward-state-action (SARSA) learning is selected for training the ego and social safety predictor functions for improved learning stability. In example embodiments, an expert policy can be used to collect data rather than using traditional off-policy RL learning. In example embodiments, data collection involves creating turn scenarios such as shown in <FIG>, parking lot scenarios such as shown in <FIG>, and roadway scenarios such as shown in <FIG>. In each of the example scenarios, ego vehicle and social objects can be controlled by respective controllers that control direction and speed of the ego vehicles and social objects with pre-defined rules and limits.

In some, examples two types of DCT controllers may be used, namely a "basic controller" that ignores all other objects and only aims to achieve a target speed and a "baseline controller" that aims to achieve a target speed and target inter-vehicle spacing. Data collection for safety predictor training may, in example embodiments be gathered through actual road data, through simulation, or through a combination thereof. Training data coverage of the entire state and behavior action space is desirable for generalization and, in an example embodiment, is achieved through a slow random walk of each of the controller parameters to simulate sample behaviors under different policies such as very cautious following and tail-gating. In the present example, these parameters are target speed and target headway (e.g. inter-vehicle spacing). It is desirable that the policy remain relatively constant over small periods of time in order to enable the safety predictor to learn to generalize.

Using safety predictor DCT systems, training data is collected and used to train respective predictor GVFs that are enabled to predict a probabilistic future safety of the ego vehicle <NUM> and social objects where the behavior action is assumed to be relatively constant over short periods of time.

As noted above, other simulation systems or even a human expert can be used to collect the necessary data to train the predictor GVFs, so long as sufficient coverage of the state and behavior action spaces is provided to train a GVF that generalizes well. In example embodiments, during training the DCT system observes diverse enough behaviors and situations to enable the resulting safety and comfort predictor functions to be able to make meaningful predictions. In example embodiments, the behavior of the ego vehicle and social objects are sufficiently uncorrelated to avoid the introduction of biases that may result in poor or even incorrect predictions.

In example embodiments, training occurs offline for greater stability and safety in learning; however, it should be noted that the trained GVFs that implement the predictor functions (once trained) can continuously collect and improve predictions in real-time using off-policy RL learning.

As a result of the above training, a target policy with respect to an input action is inherently embedded into each of the ego vehicle safety predictor GVF <NUM> (fego), social object safety predictor GVF <NUM> (fsocial), ego vehicle comfort predictor GVF <NUM> (fcomfort). Accordingly, during normal operation, the respective predictions that are output by these GVFs are based on the input state as well as the target policy embedded into the predictor functions. Thus: an ego safety prediction for a behavior action indicates a probability that the ego vehicle <NUM> will be safe based both on the current state and on the ego vehicle <NUM> following the target policy and the current state; social safety predictions for an behavior action indicate a probability that the social objects will be safe based both on the current state and on the ego vehicle <NUM> following the target policy; and ego comfort predictions for a behavior action indicate a probability that the ego vehicle <NUM> will be comfortable based both on the current state and on the ego vehicle <NUM> following the target policy. In example embodiments, in this context, target policy can be following a set of behavior actions similar to the input behavior action for a future time duration.

In example embodiments, operation of predictive safety control system <NUM> as described above is summarized as shown in <FIG>, as follows:.

As will be appreciated from the above, predictive safety control system <NUM> considers not only the safety of ego vehicle <NUM>, but also the safety of other social objects <NUM>. Social safety predictors work in tandem with ego safety predictors to address safety in a manner that can be applied across a broad spectrum of environments including intersection handling, multi-lane highway driving, parking lots, school zones, and other complicated environments where the need for social safety is highly important. In example embodiments, predictive safety control system <NUM> focuses on determining whether actions of the ego vehicle <NUM> will make another moving object unsafe/safe rather than considering the global safety of another vehicle. Social safety and ego safety are considered as separate components, thereby making it possible to prioritize these safeties differently (e.g. to minimize the potential loss of life) and may enables a more general view of safety that better reflects how human's actually drive.

The scenario of <FIG> relates to controlling ego vehicle <NUM> to make an unprotected left turn at an intersection. A common solution involves classical behavior planning and motion planning methods including time to collision methods, however modeling the environment of an intersection with many actors (vehicles, pedestrians, etc) can be rather challenging. Some modern approaches include using reinforcement learning to issue commands to the motion planner like "turn left" or "yield". This very simple approach does not easily take into account the safety of social vehicles because the rewards for reinforcement learning methods are often ego centric as the agent does not easily observe the actions of the other agents. The most common approach to prevent the learned agent from cutting in front of other vehicles dangerously is to minimize braking of the social agents but this requires often inaccurate modelling of their behavior to determine how much they are braking. Multi-agent RL approaches can be used to consider the other agents however it is rather difficult to determine or understand the policy of the other agents including whether the other driver is actually paying attention (and thus is able to follow a safe policy and slow down if required). In contrast to common solutions, predictive safety control system <NUM> utilizes a definition of safety (definitions other than that described above can be applied in alternative embodiments) to predict the safety of the other vehicles (or more generally objects) and use both the ego safety and social safety to control the ego vehicle <NUM> in the intersection.

By predicting social safety, in some examples predictive safety control system <NUM> may be able to predict the need to wait before executing an unprotected left turn in an intersection in order to keep other social objects <NUM> safe from ego vehicle <NUM> while still arriving at the destination lane in a timely manner.

As noted above, in example embodiments, ego and social safety predictor functions are learned via reinforcement learning (RL) using the general value function (GVF) framework. Reinforcement learning may enable a way of dealing with the stochastic and unknown behavior of the other drivers by learning from experience or seeing drivers follow a variety of behaviors and the impact that has on determining whether they are safe from us.

In the example scenarios shown in <FIG>, <FIG>, the objective of is to keep ego vehicle <NUM> out of the social safety zones <NUM> of social objects <NUM> and keep social objects <NUM> out of ego safety zone <NUM>. In some cases, unsafe situations may arise for the ego vehicle <NUM> that can be difficult if not impossible to completely avoid; under those conditions, priorities can be set with preference for either ego safety or social safety. In the case of the highway lane scenario of <FIG>, prioritizing front safety of the ego vehicle <NUM> is logical since most rear-end collisions from the vehicle behind will not be the fault of the ego driver.

In example embodiments, the systems and methods disclosed herein may in some circumstances reduce the safety risk of behavior actions taken at the ego vehicle <NUM> on social objects <NUM> such as other vehicles and pedestrians. In example embodiments, the predictive perception unit <NUM> makes predictions about the world (e.g. the environment ego vehicle <NUM> is operating in) using information obtained from the collection of on-board sensors <NUM>, <NUM>, and optionally external data sources such as other vehicles located in the environment a vehicle is operating in, or the cloud. The predictions are behavior action conditioned which allow the safety controller <NUM> to select behavior actions that meet the objectives of the safety controller <NUM>. In this regard, the world is represented to the safety controller <NUM> as behavior action-conditioned predictions that form an interactive model of the environment that includes information about how different behavior actions can manipulate the environment to minimize some cost function or maximize total reward.

In the context of left turn problem of <FIG>, the predictive perception unit <NUM> generates predictions of ego safety and social safety, and these predictions depend on the next action to be taken in the environment. The predictions can be broken down into ego safety zones around the ego vehicle such as in front and behind (overlapping zones can be defined). Social safety zones are also defined around each social object <NUM>, and safety probabilities predicted for these social safety zones with respect to the ego vehicle <NUM>.

In example embodiments, as described above, the predictive perception unit <NUM> outputs predictions which include a probability of each ego safety zone being free of obstacles, including social objects <NUM> and static obstacles. Predictive perception unit <NUM> also outputs a probability of each social safety zone around each social object <NUM> being free of the ego vehicle <NUM>. Static or non-social objects are ignored in the context of social safety.

In example embodiments, safety controller <NUM> is configured to maximize ego safety, social safeties, and optionally other goals like comfort, while balancing those goals with reaching the destination quickly and within boundaries such as speed limits. The safety controller <NUM> is configured to keep ego safety zones free of other obstacles (static and dynamic) while also keeping the safety zones assigned to the social objects <NUM> free of the ego vehicle <NUM> in order to improve the ego and social safety of ego vehicle <NUM> while it operates on the road. The safety controller <NUM> receives predictions from the predictive perception unit <NUM> and uses classical fuzzy inference to select a behavior action for the ego vehicle <NUM> to perform in the environment. The behavior action generated by the safety controller <NUM> can be provided to the motion planner <NUM> a drive control system <NUM> to effect actuators of the ego vehicle <NUM> operating within the environment.

<FIG> is a flow diagram further summarizing a method implemented by predictive safety control system <NUM> for controlling safety of both an ego vehicle and at least one social object in an environment of the ego vehicle, according to an example embodiment. The method includes receiving data representative of at least one social object <NUM> (Action <NUM>) and determining a current state of the ego vehicle <NUM> based on sensor data (Action <NUM>). An ego safety value is predicted corresponding to the ego vehicle, for each possible behavior action in a set of possible behavior actions, based on the current state (Action <NUM>). A social safety value corresponding to the at least one social object in the environment of the ego vehicle <NUM> is predicted, based on the current state, for each possible behavior action (Action <NUM>). A next behavior action for the ego vehicle <NUM> is selected, based on the ego safety values, the social safety values, and one or more target objectives for the ego vehicle <NUM> (Action <NUM>).

For each possible behavior action the ego safety value indicates a probability that an obstacle will not be located in an ego safety zone <NUM> of the ego vehicle <NUM> if the possible behavior action is performed by the ego vehicle <NUM> and the target policy followed thereafter. The social safety value indicates a probability, for the at least one social object <NUM>, that the ego vehicle <NUM> will not be located in a social safety zone <NUM> of the social object <NUM> if the possible behavior action is performed by the ego vehicle <NUM> and the target policy followed thereafter.

In at least some example embodiments, in Action <NUM>, the data received includes data representative of a plurality of social objects <NUM> in the environment the ego vehicle <NUM>. The method includes, for each possible behavior action, predicting a respective social safety value for each of the plurality of social objects <NUM>, each social safety value indicating a probability that the ego vehicle <NUM> will not be located in a respective social safety zone <NUM> of the respective social object <NUM> if the possible behavior action is performed by the ego vehicle <NUM> and the target policy followed thereafter.

In some examples embodiments, determining the current state (Action <NUM>) comprises determining a velocity and direction of the ego vehicle <NUM>, and a velocity, direction and position of each of the plurality of social objects <NUM>.

According to this application, predicting the ego safety value for each possible behavior action (Action <NUM>) is performed by a general value function (GVF) implemented by a trained neural network. Predicting the social safety value for each possible behavior action for each of the plurality of social objects (Action <NUM>) is performed by a further GVF implemented by a trained neural network.

In example embodiments, the ego safety zone includes a physical space that includes and extends beyond the ego vehicle <NUM> in a direction of travel of the ego vehicle <NUM>, and the social safety zone for a social object <NUM> includes and extends beyond the social object <NUM> in a direction of travel of the social object <NUM>.

In further example embodiments, for each possible behavior action, the social safety value corresponds to a plurality of social objects <NUM> in the environment of the ego vehicle <NUM>, the social safety value indicating a probability that the ego vehicle <NUM> will not be located in a respective social safety zone of any of the social objects <NUM> if the possible behavior action is performed by the ego vehicle <NUM> and the target policy followed thereafter.

In some example embodiments, selecting the behavior action (Action <NUM>) includes performing fuzzification of the ego safety value and the social safety value predicted for each of the possible behavior actions by mapping each of the ego safety values and the social safety values to a respective truth value; applying fuzzy inference on the truth values to generate a goal fuzzy set; and defuzzifying the goal fuzzy set to select the behavior action for the ego vehicle.

In the example embodiment described above, predictive perception unit <NUM> includes a social object detector <NUM> that provides a social object state oit for each detected social object. However, in an alternative example embodiment, social object detector <NUM> is omitted and the state for each detected social object is not explicitly provided to the social safety predictor module <NUM>. Rather, the social safety predictor GVF fsocial is configured to map social object safety from sensor data alone (e.g. from state data st,env, without addition state data oit from the social object detector). In such embodiments, social object detector <NUM> may still be used during training. However, instead of generating <MAT> social safety predictions, only one social safety prediction is produced per action by social safety predictor module <NUM>. In this way, the social safety predictor module <NUM> does not depend on an object detector <NUM> once deployed on an autonomous vehicle (e.g., the ego vehicle <NUM>).

In this alternative embodiment, instead of equation (<NUM>), the predictive state pt at time t is represented as: <MAT> for each behavior action available and ego and social safety zones respectively. In the presently described embodiment, only one ego safety zone and one social safety zone are considered, namely the zones are in the direction of travel for the ego vehicle and in the direction of travel for the social objects respectively (regardless of whether the direction of travel is forward or in-reverse).

For training purposes, the cumulants used for training the ego safety GVF fego <NUM> and the ego comfort GVF fcomfort <NUM> are the same as those defined above. However, the cumulant definition for <MAT> set out in equation (<NUM>) above for training social safety GVF fsocial <NUM> is replaced by a definition that employs a single cumulant for all objects detected. There are many ways to do this: one way is to use a logical and operator on all the social safety values, i.

Another approach is to calculate the percentage of social objects that are safe: <MAT>.

The latter (e.g. equation (<NUM>)) may be more challenging to train because it is more common for vehicles to be social safe than ego safe (the reason is because the ego vehicle <NUM> has more control over its own safety than social safety and therefore the cumulants for (<NUM>) may not vary that much). This means that the training of the ego and social safety predictors still depends on the detection of all the objects in the scene. However, the GVF fsocial <NUM> is learning to predict without relying on an object to be detected explicitly when the solution is deployed on a vehicle. The function mapping for the social safety prediction is therefore: <MAT>.

Learning this function mapping, may, in some embodiments, enable social safety predictor GVF fsocial <NUM> to identify social threats without actually performing object detection explicitly.

The safety controller <NUM> of the first embodiment is modified so that the goal fuzzy set is determined by:
<MAT>
where msocial(ât|zsocial) is the membership of the truth value of social safety and <MAT>.

As noted above, this alternative removes the need for social object detector <NUM> post training when predictive safety control system <NUM> is deployed on an autonomous vehicle (e.g., the ego vehicle <NUM>). The social safety predictor GVF fsocial <NUM> can be trained to identify objects that threaten social safety implicitly from LIDAR data representative of a point cloud or image data rather than passing the object parameters explicitly to the social safety predictor GVF fsocial <NUM>. This has the advantage of being able to learn to predict social safety in environments where very accurate object detection may be available without the need for real-time object detection constraints. The social safety predictor GVF fsocial <NUM> can then be deployed in a real-time predictive safety control system <NUM> without needing an on-line object detector <NUM> which may sacrifice realtime accuracy by introducing latency.

Although described herein as a system integrated into the ADAS <NUM> or the ADS <NUM>, in example embodiments, predictive safety control system <NUM> can be a standalone system that is used to record information and provide feedback. In some example embodiments, the predictive safety control system <NUM> could be used in a passive safety system that provides a monitoring and alert module that issues driver guidance. For example embodiments, in the case of a human driver controlled vehicle, the output of the safety controller <NUM> may be used to trigger a message to the driver, for example a visual and/or audible message to "TURN LEFT". In this regard, predictive safety control system <NUM> can be a stand-alone system or may be integrated into an autonomous driving system (i.e., the ADAS <NUM> or the ADS <NUM>).

The present invention is made with reference to the accompanying drawings, in which embodiments are shown. However, many different embodiments may be used, and thus the description should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete.

Separate boxes or illustrated separation of functional elements of illustrated systems, modules and devices does not necessarily require physical separation of such functions, as communication between such elements may occur by way of messaging, function calls, shared memory space, and so on, without any such physical separation. As such, functions need not be implemented in physically or logically separated platforms, although they are illustrated separately for ease of explanation herein. Different devices may have different designs, such that although some devices implement some functions in fixed function hardware, other devices may implement such functions in a programmable processor with code obtained from a machine readable medium.

Also, although the systems, devices and processes disclosed and shown herein may comprise a specific number of elements/components, the systems, devices and assemblies may be modified to include additional or fewer of such elements/components. For example, although any of the elements/components disclosed may be referenced as being singular, the embodiments disclosed herein may be modified to include a plurality of such elements/components.

Claim 1:
A method for controlling safety of both an ego vehicle and at least one social object in an environment the ego vehicle is operating in, wherein the method comprises:
receiving (<NUM>) data representative of the at least one social object;
determining (<NUM>) a current state of the ego vehicle based on sensor data;
predicting (<NUM>), based on the current state, for each possible behavior action in a set of possible behavior actions, an ego safety value corresponding to the ego vehicle, wherein predicting (<NUM>) the ego safety value for each possible behavior action is performed by a general value function, GVF, implemented by a trained neural network;
predicting (<NUM>), based on the current state, for each possible behavior action, a social safety value corresponding to the at least one social object in the environment of the ego vehicle, wherein predicting (<NUM>) the social safety value for each possible behavior action for each of the plurality of social objects is performed by a further GVF implemented by a trained neural network; and
selecting (<NUM>), based on the ego safety values, the social safety values, and one or more target objectives for the ego vehicle, a next behavior action for the ego vehicle; wherein, for each possible behavior action: the ego safety value indicates a probability that an obstacle will not be located in an ego safety zone of the ego vehicle if the possible behavior action is performed by the ego vehicle and the target policy followed thereafter; and the social safety value indicates a probability, for the at least one social object, that the ego vehicle will not be located in a social safety zone of the social object if the possible behavior action is performed by the ego vehicle and the target policy followed thereafter.