Patent Description:
For automated driving systems (ADS), a vehicle may have the technical capability to perceive the external environment and to perform all necessary driving tasks on its own. However, a human driver still has to be present to take back control and override the ADS decisions in challenging situations that fall out of the Operational Design Domain (ODD).

In order to determine whether a driver is attentional, and thus ready to take back control, Driver Monitoring Systems (DMS) are deployed as a safety-critical component. A key challenge is the assessment of the ODD compliance, which means that the ADS has to identify whether or not it is currently in a state that belongs to the intended ODD for the L3 system. This can be defined as the "operating conditions under which a given driving automation system or feature thereof is specifically designed to function, including, but not limited to, environmental, geographical, and time-of-day restrictions, and/or the requisite presence or absence of certain traffic or roadway characteristics.

This assessment can be performed in a separate component called the ODD monitor. A major safety risk occurs if this assessment is false positive, i.e. if the monitor assesses to be in the ODD, while in reality it is not. False negative ODD compliance assessments on the other hand lead to unnecessary handovers which reduce availability of the L3 system and can be potentially unsafe as well during the transition phase.

German patent application publication <CIT> discloses an automated driving system with a hazard warning device that may alert the driver to a hazard and/or the potential need of the driver to retake control of the vehicle during autonomous or semi-autonomous driving. The takeover probability is determined by a risk estimator based on environment data and vehicle dynamics data of vehicle. The driver's attention level is estimated by an attention estimation unit, and the period of time for the generation of the warning signal is determined from the transfer probability as a function of the driver's attention level.

US patent application publication <CIT> discloses a vehicle with a pre-safe system in which active and/or passive safety devices are activated based on information recorded of the area surrounding the vehicle and based on a driving situation data detection device. The recorded information of the surrounding area is evaluated to determine whether a collision is plausible. The active and/or passive safety features of the vehicle are activated when the information of the surrounding area indicates a potential collision object and when data from the driving situation data detection device indicates a driver response that matches a predefined response for how a driver is expected to respond when a potential collision object is present and a collision is plausible. The number of false positives in detecting potential collision objects may be reduced by comparing the driver's actual reaction to one that would normally take place when the driver notices that a collision object is present.

The invention pursued in this application is set out by the appended set of claims.

The drawings are not necessarily to scale; emphasis instead generally being placed upon illustrating the principles of the invention. In the following description, various aspects of the invention are described with reference to the following drawings, in which:.

The following detailed description refers to the accompanying drawings that show, by way of illustration, exemplary details and aspects in which the invention may be practiced.

The word "exemplary" is used herein to mean "serving as an example, instance, or illustration". Any aspect or design described herein as "exemplary" is not necessarily to be construed as preferred or advantageous over other aspects or designs.

The terms "at least one" and "one or more" may be understood to include a numerical quantity greater than or equal to one (e.g., one, two, three, four, [. The term "a plurality" may be understood to include a numerical quantity greater than or equal to two (e.g., two, three, four, five, [.

The words "plural" and "multiple" in the description and in the claims expressly refer to a quantity greater than one. Accordingly, any phrases explicitly invoking the aforementioned words (e.g., "plural [elements]", "multiple [elements]") referring to a quantity of elements expressly refers to more than one of the said elements. The phrases "group (of)", "set (of)", "collection (of)", "series (of)", "sequence (of)", "grouping (of)", etc., and the like in the description and in the claims, if any, refer to a quantity equal to or greater than one, i.e., one or more. The phrases "proper subset", "reduced subset", and "lesser subset" refer to a subset of a set that is not equal to the set, illustratively, referring to a subset of a set that contains fewer elements than the set.

The phrase "at least one of" with regard to a group of elements may be used herein to mean at least one element from the group including the elements. For example, the phrase "at least one of" with regard to a group of elements may be used herein to mean a selection of: one of the listed elements, a plurality of one of the listed elements, a plurality of individual listed elements, or a plurality of a multiple of individual listed elements.

The term "data" as used herein may be understood to include information in any suitable analog or digital form, e.g., provided as a file, a portion of a file, a set of files, a signal or stream, a portion of a signal or stream, a set of signals or streams, and the like. Further, the term "data" may also be used to mean a reference to information, e.g., in the form of a pointer. However, the term "data" is not limited to the aforementioned examples and may take various forms and represent any information as understood in the art.

The terms "processor" or "controller" as, for example, used herein may be understood as any kind of technological entity that allows handling of data. The data may be handled according to one or more specific functions executed by the processor or controller. Further, a processor or controller as used herein may be understood as any kind of circuit, e.g., any kind of analog or digital circuit, and may also be referred to as a "processing circuit," "processing circuitry," among others. A processor or a controller may thus be or include an analog circuit, digital circuit, mixed-signal circuit, logic circuit, processor, microprocessor, Central Processing Unit (CPU), Graphics Processing Unit (GPU), Digital Signal Processor (DSP), Field Programmable Gate Array (FPGA), integrated circuit, Application Specific Integrated Circuit (ASIC), etc., or any combination thereof. Any other kind of implementation of the respective functions, which will be described below in further detail, may also be understood as a processor, controller, or logic circuit. It is understood that any two (or more) of the processors, controllers, or logic circuits detailed herein may be realized as a single entity with equivalent functionality, among others, and conversely that any single processor, controller, or logic circuit detailed herein may be realized as two (or more) separate entities with equivalent functionality, among others.

As utilized herein, terms "module", "component," "system," "circuit," "element," "slice," "circuitry," and the like are intended to refer to a set of one or more electronic components, a computer-related entity, hardware, software (e.g., in execution), and/or firmware. For example, circuitry or a similar term can be a processor, a process running on a processor, a controller, an object, an executable program, a storage device, and/or a computer with a processing device. By way of illustration, an application running on a server and the server can also be circuitry. One or more circuits can reside within the same circuitry, and circuitry can be localized on one computer and/or distributed between two or more computers. A set of elements or a set of other circuits can be described herein, in which the term "set" can be interpreted as "one or more.

As used herein, "memory" is understood as a computer-readable medium in which data or information can be stored for retrieval. References to "memory" included herein may thus be understood as referring to volatile or non-volatile memory, including random access memory (RAM), read-only memory (ROM), flash memory, solid-state storage, magnetic tape, hard disk drive, optical drive, among others, or any combination thereof. Registers, shift registers, processor registers, data buffers, among others, are also embraced herein by the term memory. The term "software" refers to any type of executable instruction, including firmware.

Unless explicitly specified, the term "transmit" encompasses both direct (point-to-point) and indirect transmission (via one or more intermediary points). Similarly, the term "receive" encompasses both direct and indirect reception. Furthermore, the terms "transmit," "receive," "communicate," and other similar terms encompass both physical transmission (e.g., the transmission of radio signals) and logical transmission (e.g., the transmission of digital data over a logical software-level connection). For example, a processor or controller may transmit or receive data over a software-level connection with another processor or controller in the form of radio signals, where the physical transmission and reception is handled by radio-layer components such as RF transceivers and antennas, and the logical transmission and reception over the software-level connection is performed by the processors or controllers. The term "communicate" encompasses one or both of transmitting and receiving, i.e., unidirectional or bidirectional communication in one or both of the incoming and outgoing directions. The term "calculate" encompasses both 'direct' calculations via a mathematical expression/formula/relationship and 'indirect' calculations via lookup or hash tables and other array indexing or searching operations.

A "vehicle" may be understood to include any type of driven or drivable object. By way of example, a vehicle may be a driven object with a combustion engine, a reaction engine, an electrically driven object, a hybrid driven object, or a combination thereof. A vehicle may be or may include an automobile, a bus, a mini bus, a van, a truck, a mobile home, a vehicle trailer, a motorcycle, a bicycle, a tricycle, a train locomotive, a train wagon, a moving robot, a personal transporter, a boat, a ship, a submersible, a submarine, a drone, an aircraft, a rocket, and the like.

A "ground vehicle" may be understood to include any type of vehicle, as described above, which is configured to traverse or be driven on the ground, e.g., on a street, on a road, on a track, on one or more rails, off-road, etc. An "aerial vehicle" may be understood to be any type of vehicle, as described above, which is capable of being maneuvered above the ground for any duration of time, e.g., a drone. Similar to a ground vehicle having wheels, belts, etc., for providing mobility on terrain, an "aerial vehicle" may have one or more propellers, wings, fans, among others, for providing the ability to maneuver in the air. An "aquatic vehicle" may be understood to be any type of vehicle, as described above, which is capable of being maneuvers on or below the surface of a liquid, e.g., a boat on the surface of water or a submarine below the surface. It is appreciated that some vehicles may be configured to operate as one or more of a ground, an aerial, and/or an aquatic vehicle.

The term "autonomous vehicle" may describe a vehicle capable of implementing at least one navigational change without driver input. A navigational change may describe or include a change in one or more of steering, braking, or acceleration/deceleration of the vehicle. A vehicle may be described as autonomous even in case the vehicle is not fully automatic (e.g., fully operational with driver or without driver input). Autonomous vehicles may include those vehicles that can operate under driver control during certain time periods and without driver control during other time periods. Autonomous vehicles may also include vehicles that control only some aspects of vehicle navigation, such as steering (e.g., maintaining a vehicle course between vehicle lane constraints) or some steering operations under certain circumstances (but not under all circumstances). Still, they may leave other vehicle navigation aspects to the driver (e.g., braking or braking under certain circumstances). Autonomous vehicles may also include vehicles that share the control of one or more aspects of vehicle navigation under certain circumstances (e.g., hands-on, such as responsive to a driver input) and vehicles that control one or more aspects of vehicle navigation under certain circumstances (e.g., hands-off, such as independent of driver input). Autonomous vehicles may also include vehicles that control one or more vehicle navigation aspects under certain circumstances, such as under certain environmental conditions (e.g., spatial areas, roadway conditions). In some aspects, autonomous vehicles may handle some or all aspects of braking, speed control, velocity control, and/or steering of the vehicle. An autonomous vehicle may include those vehicles that can operate without a driver. The level of autonomy of a vehicle may be described or determined by the Society of Automotive Engineers (SAE) level of the vehicle (e.g., as defined by the SAE, for example in SAE J3016 <NUM>: Taxonomy and definitions for terms related to driving automation systems for on-road motor vehicles) or by other relevant professional organizations. The SAE level may have a value ranging from a minimum level, e.g., level <NUM> (illustratively, substantially no driving automation), to a maximum level, e.g., level <NUM> (illustratively, full driving automation).

In the context provided herein, "vehicle operation data" may be understood to describe any type of feature related to the operation of a vehicle. By way of example, "vehicle operation data" may describe the vehicle's status, such as the type of propulsion unit(s), types of tires or propellers of the vehicle, the type of vehicle, and/or the age of the manufacturing of the vehicle. More generally, "vehicle operation data" may describe or include static features or static vehicle operation data (illustratively, features or data not changing over time). As another example, additionally or alternatively, "vehicle operation data" may describe or include features changing during the operation of the vehicle, for example, environmental conditions, such as weather conditions or road conditions during the operation of the vehicle, fuel levels, fluid levels, operational parameters of the driving source of the vehicle, etc. More generally, "vehicle operation data" may describe or include varying features or varying vehicle operation data (illustratively, time-varying features or data).

Various aspects herein may utilize one or more machine learning models to perform or control functions of the vehicle (or other functions described herein). The term "model" as, for example, used herein may be understood as any kind of algorithm, which provides output data from input data (e.g., any kind of algorithm generating or calculating output data from input data). A computing system may execute a machine learning model to improve a specific task's performance progressively. In some aspects, a machine learning model's parameters may be adjusted during a training phase based on training data. A trained machine learning model may be used during an inference phase to make predictions or decisions based on input data. In some aspects, the trained machine learning model may be used to generate additional training data. An additional machine learning model may be adjusted during a second training phase based on the generated additional training data. A trained additional machine learning model may be used during an inference phase to make predictions or decisions based on input data.

The machine learning models described herein may take any suitable form or utilize any suitable technique (e.g., for training purposes). For example, any machine learning models may utilize supervised learning, semi-supervised learning, unsupervised learning, or reinforcement learning techniques.

In supervised learning, the model may be built using a training set of data including both the inputs and the corresponding desired outputs (illustratively, each input may be associated with a desired or expected output for that input). Each training instance may include one or more inputs and a desired output. Training may include iterating through training instances and using an objective function to teach the model to predict the output for new inputs (illustratively, for inputs not included in the training set). In semi-supervised learning, a portion of the inputs in the training set may be missing the respective desired outputs (e.g., one or more inputs may not be associated with any desired or expected output).

In unsupervised learning, the model may be built from a training set of data including only inputs and no desired outputs. The unsupervised model may be used to find structure in the data (e.g., grouping or clustering of data points), illustratively, by discovering patterns in the data. Techniques that may be implemented in an unsupervised learning model may include, e.g., self-organizing maps, nearest-neighbor mapping, k-means clustering, and singular value decomposition.

Reinforcement learning models may include positive or negative feedback to improve accuracy. A reinforcement learning model may attempt to maximize one or more objectives/rewards. Techniques that may be implemented in a reinforcement learning model may include, e.g., Q-learning, temporal difference (TD), and deep adversarial networks.

Various aspects described herein may utilize one or more classification models. In a classification model, the outputs may be restricted to a limited set of values (e.g., one or more classes). The classification model may output a class for an input set of one or more input values. An input set may include sensor data, such as image data, radar data, LIDAR data, and the like. As described herein, a classification model may classify certain driving conditions and/or environmental conditions, such as weather conditions, road conditions, and the like. References herein to classification models may contemplate a model that implements, e.g., any one or more of the following techniques: linear classifiers (e.g., logistic regression or naive Bayes classifier), support vector machines, decision trees, boosted trees, random forest, neural networks, or nearest neighbor.

Various aspects described herein may utilize one or more regression models. A regression model may output a numerical value from a continuous range based on an input set of one or more values (illustratively, starting from or using an input set of one or more values). References herein to regression models may contemplate a model that implements, e.g., any one or more of the following techniques (or other suitable techniques): linear regression, decision trees, random forest, or neural networks.

A machine learning model described herein may be or may include a neural network. The neural network may be any kind of neural network, such as a convolutional neural network, an autoencoder network, a variational autoencoder network, a sparse autoencoder network, a recurrent neural network, a deconvolutional network, a generative adversarial network, a forward-thinking neural network, a sum-product neural network, and the like. The neural network may include any number of layers. The training of the neural network (e.g., adapting the layers of the neural network) may use or may be based on any kind of training principle, such as backpropagation (e.g., using the backpropagation algorithm).

In aspects provided herein, the following terms may be used as synonyms: driving parameter set, driving model parameters, driving model parameter set, safety layer parameter set, driver assistance, automated driving model parameter set, and/or the like (e.g., driving safety parameter set). These terms may correspond to groups of values used to implement one or more models for directing a vehicle to operate according to the manners described herein.

Furthermore, in aspects provided herein, the following terms may be used as synonyms: driving parameter, driving model parameter, safety layer parameter, driver assistance and/or automated driving model parameter, and/or the like (e.g., driving safety parameter), and may correspond to specific values within the previously described sets.

<FIG> shows a vehicle <NUM>, including a mobility system <NUM> and a control system <NUM> (see also <FIG>) in accordance with various aspects. It is appreciated that vehicle <NUM> and control system <NUM> are exemplary in nature and may thus be simplified for explanatory purposes. For example, while vehicle <NUM> is depicted as a ground vehicle, aspects provided herein may be equally or analogously applied to aerial vehicles such as drones or aquatic vehicles such as boats. Furthermore, the quantities and locations of elements, as well as relational distances (as discussed above, the figures are not to scale) are provided as examples and are not limited thereto. The components of vehicle <NUM> may be arranged around a vehicular housing of vehicle <NUM>, mounted on or outside of the vehicular housing, enclosed within the vehicular housing, or any other arrangement relative to the vehicular housing where the components move with vehicle <NUM> as it travels. The vehicular housing, such as an automobile body, drone body, plane or helicopter fuselage, boat hull, or similar type of vehicular body dependent on the type of vehicle that vehicle <NUM> is.

In addition to including a control system <NUM>, vehicle <NUM> includes a mobility system <NUM>. Mobility system <NUM> may include components of vehicle <NUM> related to steering and movement of vehicle <NUM>. In some aspects, where vehicle <NUM> is an automobile, for example, mobility system <NUM> may include wheels and axles, a suspension, an engine, a transmission, brakes, a steering wheel, associated electrical circuitry and wiring, and any other components used in the driving of an automobile. In some aspects, where vehicle <NUM> is an aerial vehicle, mobility system <NUM> may include one or more of rotors, propellers, jet engines, wings, rudders or wing flaps, air brakes, a yoke or cyclic, associated electrical circuitry and wiring, and any other components used in the flying of an aerial vehicle. In some aspects, where vehicle <NUM> is an aquatic or sub-aquatic vehicle, mobility system <NUM> may include any one or more of rudders, engines, propellers, a steering wheel, associated electrical circuitry and wiring, and any other components used in the steering or movement of an aquatic vehicle. In some aspects, mobility system <NUM> may also include autonomous driving functionality, and accordingly may include an interface with one or more processors <NUM> configured to perform autonomous driving computations and decisions and an array of sensors for movement and obstacle sensing. In this sense, the mobility system <NUM> may be provided with instructions to direct the navigation and/or mobility of vehicle <NUM> from one or more components of the control system <NUM>. The autonomous driving components of mobility system <NUM> may also interface with one or more radio frequency (RF) transceivers <NUM> to facilitate mobility coordination with other nearby vehicular communication devices and/or central networking components. The devices or components can perform decisions and/or computations related to autonomous driving.

The control system <NUM> may include various components depending on the requirements of a particular implementation. As shown in <FIG> and <FIG>, the control system <NUM> includes one or more processors <NUM>, one or more memories <NUM>, one or more data acquisition devices <NUM>, and may include an antenna system <NUM> which may include one or more antenna arrays at different locations on the vehicle for radio frequency (RF) coverage, one or more radio frequency (RF) transceivers <NUM>, one or more position devices <NUM> which may include components and circuitry for receiving and determining a position based on a Global Navigation Satellite System (GNSS) and/or a Global Positioning System (GPS), and one or more measurement sensors <NUM>, e.g., speedometer, altimeter, gyroscope, velocity sensors, etc..

The control system <NUM> may be configured to control the vehicle's <NUM> mobility via mobility system <NUM> and/or interactions with its environment, e.g., communications with other devices or network infrastructure elements (NIEs) such as base stations, via data acquisition devices <NUM> and the radio frequency communication arrangement including the one or more RF transceivers <NUM> and antenna system <NUM>.

The one or more processors <NUM> may include a data acquisition processor <NUM>, an application processor <NUM>, a communication processor <NUM>, and/or any other suitable processing device. Each processor <NUM>, <NUM>, <NUM> of the one or more processors <NUM> may include various types of hardware-based processing devices. By way of example, each processor <NUM>, <NUM>, <NUM> may include a microprocessor, pre-processors (such as an image pre-processor), graphics processors, a central processing unit (CPU), support circuits, digital signal processors, integrated circuits, memory, or any other types of devices suitable for running applications and for image processing and analysis. In some aspects, each processor <NUM>, <NUM>, <NUM> may include any type of single or multi-core processor, mobile device microcontroller, central processing unit, etc. These processor types may each include multiple processing units with local memory and instruction sets. Such processors may include video inputs for receiving image data from multiple image sensors and may also include video out capabilities.

Any of the processors <NUM>, <NUM>, <NUM> disclosed herein may be configured to perform certain functions according to program instructions that may be stored in a memory of the one or more memories <NUM>. In other words, a memory of the one or more memories <NUM> may store software that, when executed by a processor (e.g., by the one or more processors <NUM>), controls the operation of the system, e.g., a driving and/or safety system. A memory of the one or more memories <NUM> may store one or more databases and image processing software, as well as a trained system, such as a neural network, or a deep neural network, for example. The one or more memories <NUM> may include any number of random-access memories, read-only memories, flash memories, disk drives, optical storage, tape storage, removable storage, and other storage types. Alternatively, each of processors <NUM>, <NUM>, <NUM> may include an internal memory for such storage.

The data acquisition processor <NUM> may include processing circuity, such as a CPU, for processing data acquired by data acquisition units <NUM>. For example, suppose one or more data acquisition units are image acquisition units, e.g., one or more cameras. In that case, the data acquisition processor may include image processors for processing image data using the information obtained from the image acquisition units as an input. The data acquisition processor <NUM> may therefore be configured to create voxel maps detailing the surrounding of the vehicle <NUM> based on the data input from the data acquisition units <NUM>, i.e., cameras in this example.

Application processor <NUM> may be a CPU, and may be configured to handle the layers above the protocol stack, including the transport and application layers. Application processor <NUM> may be configured to execute various applications and/or programs of vehicle <NUM> at an application layer of vehicle <NUM>, such as an operating system (OS), a user interfaces (UI) <NUM> for supporting user interaction with vehicle <NUM>, and/or various user applications. Application processor <NUM> may interface with communication processor <NUM> and act as a source (in the transmit path) and a sink (in the receive path) for user data, such as voice data, audio/video/image data, messaging data, application data, basic Internet/web access data, etc. In the transmit path, communication processor <NUM> may therefore receive and process outgoing data provided by application processor <NUM> according to the layer-specific functions of the protocol stack, and provide the resulting data to digital signal processor <NUM>. Communication processor <NUM> may then perform physical layer processing on the received data to produce digital baseband samples, which digital signal processor may provide to RF transceiver(s) <NUM>. RF transceiver(s) <NUM> may then process the digital baseband samples to convert the digital baseband samples to analog RF signals, which RF transceiver(s) <NUM> may wirelessly transmit via antenna system <NUM>. In the receive path, RF transceiver(s) <NUM> may receive analog RF signals from antenna system <NUM> and process the analog RF signals to obtain digital baseband samples. RF transceiver(s) <NUM> may provide the digital baseband samples to communication processor <NUM>, which may perform physical layer processing on the digital baseband samples. Communication processor <NUM> may then provide the resulting data to other processors of the one or more processors <NUM>, which may process the resulting data according to the layer-specific functions of the protocol stack and provide the resulting incoming data to application processor <NUM>. Application processor <NUM> may then handle the incoming data at the application layer, which can include execution of one or more application programs with the data and/or presentation of the data to a user via one or more user interfaces <NUM>. User interfaces <NUM> may include one or more screens, microphones, mice, touchpads, keyboards, or any other interface providing a mechanism for user input.

The communication processor <NUM> may include a digital signal processor and/or a controller which may direct such communication functionality of vehicle <NUM> according to the communication protocols associated with one or more radio access networks, and may execute control over antenna system <NUM> and RF transceiver(s) <NUM> to transmit and receive radio signals according to the formatting and scheduling parameters defined by each communication protocol. Although various practical designs may include separate communication components for each supported radio communication technology (e.g., a separate antenna, RF transceiver, digital signal processor, and controller), for purposes of conciseness, the configuration of vehicle <NUM> shown in <FIG> and <FIG> may depict only a single instance of such components.

Vehicle <NUM> may transmit and receive wireless signals with antenna system <NUM>, which may be a single antenna or an antenna array that includes multiple antenna elements. In some aspects, antenna system <NUM> may additionally include analog antenna combination and/or beamforming circuitry. In the receive (RX) path, RF transceiver(s) <NUM> may receive analog radio frequency signals from antenna system <NUM> and perform analog and digital RF front-end processing on the analog radio frequency signals to produce digital baseband samples (e.g., In-Phase/Quadrature (IQ) samples) to provide to communication processor <NUM>. RF transceiver(s) <NUM> may include analog and digital reception components including amplifiers (e.g., Low Noise Amplifiers (LNAs)), filters, RF demodulators (e.g., RF IQ demodulators)), and analog-to-digital converters (ADCs), which RF transceiver(s) <NUM> may utilize to convert the received radio frequency signals to digital baseband samples. In the transmit (TX) path, RF transceiver(s) <NUM> may receive digital baseband samples from communication processor <NUM> and perform analog and digital RF front-end processing on the digital baseband samples to produce analog radio frequency signals to provide to antenna system <NUM> for wireless transmission. RF transceiver(s) <NUM> may thus include analog and digital transmission components including amplifiers (e.g., Power Amplifiers (PAs), filters, RF modulators (e.g., RF IQ modulators), and digital-to-analog converters (DACs), which RF transceiver(s) <NUM> may utilize to mix the digital baseband samples received from communication processor <NUM> and produce the analog radio frequency signals for wireless transmission by antenna system <NUM>. In some aspects, communication processor <NUM> may control the radio transmission and reception of RF transceiver(s) <NUM>, including specifying the transmit and receive radio frequencies for the operation of RF transceiver(s) <NUM>.

According to some aspects, the communication processor <NUM> includes a baseband modem configured to perform physical layer (PHY, Layer <NUM>) transmission and reception processing to, in the transmit path, prepare outgoing transmit data provided by communication processor <NUM> for transmission via RF transceiver(s) <NUM>, and, in the receive path, prepare incoming received data provided by RF transceiver(s) <NUM> for processing by communication processor <NUM>. The baseband modem may include a digital signal processor and/or a controller. The digital signal processor may be configured to perform one or more of error detection, forward error correction encoding/decoding, channel coding and interleaving, channel modulation/demodulation, physical channel mapping, radio measurement and search, frequency and time synchronization, antenna diversity processing, power control, and weighting, rate matching/de-matching, retransmission processing, interference cancelation, and any other physical layer processing functions. The digital signal processor may be structurally realized as hardware components (e.g., as one or more digitally-configured hardware circuits or FPGAs), software-defined components (e.g., one or more processors configured to execute program code defining arithmetic, control, and I/O instructions (e.g., software and/or firmware) stored in a non-transitory computer-readable storage medium), or as a combination of hardware and software components. In some aspects, the digital signal processor may include one or more processors configured to retrieve and execute program code that defines control and processing logic for physical layer processing operations. In some aspects, the digital signal processor may execute processing functions with software via the execution of executable instructions. In some aspects, the digital signal processor may include one or more dedicated hardware circuits (e.g., ASICs, FPGAs, and other hardware) that are digitally configured to specific execute processing functions, where the one or more processors of digital signal processor may offload specific processing tasks to these dedicated hardware circuits, which are known as hardware accelerators. Exemplary hardware accelerators can include Fast Fourier Transform (FFT) circuits and encoder/decoder circuits. The digital signal processor's processor and hardware accelerator components may be realized as a coupled integrated circuit in some aspects.

Vehicle <NUM> may be configured to operate according to one or more radio communication technologies. The digital signal processor of the communication processor <NUM> may be responsible for lower-layer processing functions (e.g., Layer <NUM>/PHY) of the radio communication technologies. In contrast, a controller of the communication processor <NUM> may be responsible for upper-layer protocol stack functions (e.g., Data Link Layer/Layer <NUM> and/or Network Layer/Layer <NUM>). The controller may thus be responsible for controlling the radio communication components of vehicle <NUM> (antenna system <NUM>, RF transceiver(s) <NUM>, position device <NUM>, etc.) in accordance with the communication protocols of each supported radio communication technology, and accordingly may represent the Access Stratum and Non-Access Stratum (NAS) (also encompassing Layer <NUM> and Layer <NUM>) of each supported radio communication technology. The controller may be structurally embodied as a protocol processor configured to execute protocol stack software (retrieved from a controller memory) and subsequently control the radio communication components of vehicle <NUM> to transmit and receive communication signals in accordance with the corresponding protocol stack control logic defined in the protocol stack software. The controller may include one or more processors configured to retrieve and execute program code that defines the upper-layer protocol stack logic for one or more radio communication technologies, which can include Data Link Layer/Layer <NUM> and Network Layer/Layer <NUM> functions. The controller may be configured to perform both user-plane and control-plane functions to facilitate the transfer of application layer data to and from vehicle <NUM> according to the specific protocols of the supported radio communication technology. User-plane functions can include header compression and encapsulation, security, error checking and correction, channel multiplexing, scheduling, and priority, while control-plane functions may include setup and maintenance of radio bearers. The program code retrieved and executed by the controller of communication processor <NUM> may include executable instructions that define the logic of such functions.

In some aspects, vehicle <NUM> may be configured to transmit and receive data according to multiple radio communication technologies. Accordingly, in some aspects, one or more of antenna system <NUM>, RF transceiver(s) <NUM>, and communication processor <NUM> may include separate components or instances dedicated to different radio communication technologies and/or unified components that are shared between different radio communication technologies. For example, in some aspects, multiple controllers of communication processor <NUM> may be configured to execute multiple protocol stacks, each dedicated to a different radio communication technology and either at the same processor or different processors. In some aspects, multiple digital signal processors of communication processor <NUM> may include separate processors and/or hardware accelerators that are dedicated to different respective radio communication technologies, and/or one or more processors and/or hardware accelerators that are shared between multiple radio communication technologies. In some aspects, RF transceiver(s) <NUM> may include separate RF circuitry sections dedicated to different respective radio communication technologies, and/or RF circuitry sections shared between multiple radio communication technologies. In some aspects, antenna system <NUM> may include separate antennas dedicated to different respective radio communication technologies, and/or antennas shared between multiple radio communication technologies. Accordingly, antenna system <NUM>, RF transceiver(s) <NUM>, and communication processor <NUM> can encompass separate and/or shared components dedicated to multiple radio communication technologies.

Communication processor <NUM> may be configured to implement one or more vehicle-to-everything (V2X) communication protocols, which may include vehicle-to-vehicle (V2V), vehicle-to-infrastructure (V2I), vehicle-to-network (V2N), vehicle-to-pedestrian (V2P), vehicle-to-device (V2D), vehicle-to-grid (V2G), and other protocols. Communication processor <NUM> may be configured to transmit communications including communications (one-way or two-way) between the vehicle <NUM> and one or more other (target) vehicles in an environment of the vehicle <NUM> (e.g., to facilitate coordination of navigation of the vehicle <NUM> in view of or together with other (target) vehicles in the environment of the vehicle <NUM>), or even a broadcast transmission to unspecified recipients in a vicinity of the transmitting vehicle <NUM>.

Communication processor <NUM> may be configured to operate via a first RF transceiver of the one or more RF transceivers(s) <NUM> according to different desired radio communication protocols or standards. By way of example, communication processor <NUM> may be configured according to a Short-Range mobile radio communication standard such as, e.g., Bluetooth, Zigbee, and the like first RF transceiver may correspond to the corresponding Short-Range mobile radio communication standard. As another example, communication processor <NUM> may be configured to operate via a second RF transceiver of the one or more RF transceivers(s) <NUM> in accordance with a Medium or Wide Range mobile radio communication standard such as, e.g., a <NUM> (e.g., Universal Mobile Telecommunications System - UMTS), a <NUM> (e.g., Long Term Evolution - LTE), or a <NUM> mobile radio communication standard in accordance with corresponding 3GPP (<NUM>rd Generation Partnership Project) standards. As a further example, communication processor <NUM> may be configured to operate via a third RF transceiver of the one or more RF transceivers(s) <NUM> in accordance with a Wireless Local Area Network communication protocol or standard such as, e.g., in accordance with IEEE <NUM> (e.g., <NUM>, <NUM>. 11a, <NUM>. 11b, <NUM>, <NUM>. 11n, <NUM>. 11p, <NUM>-<NUM>, <NUM>. 11ac, <NUM> ad, <NUM>. 11ah, and the like). The one or more RF transceiver(s) <NUM> may be configured to transmit signals via antenna system <NUM> over an air interface. The RF transceivers <NUM> may each have a corresponding antenna element of antenna system <NUM>, or may share an antenna element of the antenna system <NUM>.

Memory <NUM> may embody a memory component of vehicle <NUM>, such as a hard drive or another such permanent memory device. Although not explicitly depicted in <FIG> and <FIG>, the various other components of vehicle <NUM>, e.g., one or more processors <NUM>, are shown in <FIG> and <FIG> may additionally each include integrated permanent and non-permanent memory components, such as for storing software program code, buffering data, etc..

The antenna system <NUM> may include a single antenna or multiple antennas. In some aspects, each of the one or more antennas of antenna system <NUM> may be placed at a plurality of locations on the vehicle <NUM> in order to ensure maximum RF coverage. The antennas may include a phased antenna array, a switch-beam antenna array with multiple antenna elements, etc. Antenna system <NUM> may be configured to operate according to analog and/or digital beamforming schemes in order to maximize signal gains and/or provide levels of information privacy. Antenna system <NUM> may include separate antennas dedicated to different respective radio communication technologies, and/or antennas shared between multiple radio communication technologies. While shown as a single element in <FIG>, antenna system <NUM> may include a plurality of antenna elements (e.g., antenna arrays) positioned at different locations on vehicle <NUM>. The placement of the plurality of antenna elements may be strategically chosen in order to ensure a desired degree of RF coverage. For example, additional antennas may be placed at the front, back, corner(s), and/or on the side(s) of the vehicle <NUM>.

Data acquisition devices <NUM> may include any number of data acquisition devices and components depending on the requirements of a particular application. This may include: image acquisition devices, proximity detectors, acoustic sensors, infrared sensors, piezoelectric sensors, etc., for providing data about the vehicle's environment. Image acquisition devices may include cameras (e.g., standard cameras, digital cameras, video cameras, single-lens reflex cameras, infrared cameras, stereo cameras, etc.), charge coupling devices (CCDs) or any type of image sensor. Proximity detectors may include radar sensors, light detection and ranging (LIDAR) sensors, mmWave radar sensors, etc. Acoustic sensors may include: microphones, sonar sensors, ultrasonic sensors, etc. Accordingly, each of the data acquisition units may be configured to observe a particular type of data of the vehicle's <NUM> environment and forward the data to the data acquisition processor <NUM> in order to provide the vehicle with an accurate portrayal of the vehicle's environment. The data acquisition devices <NUM> may be configured to implement preprocessed sensor data, such as radar target lists or LIDAR target lists, in conjunction with acquired data.

Measurement devices <NUM> may include other devices for measuring vehicle-state parameters, such as a velocity sensor (e.g., a speedometer) for measuring a velocity of the vehicle <NUM>, one or more accelerometers (either single-axis or multi-axis) for measuring accelerations of the vehicle <NUM> along one or more axes, a gyroscope for measuring orientation and/or angular velocity, odometers, altimeters, thermometers, etc. It is appreciated that vehicle <NUM> may have different measurement devices <NUM> depending on the type of vehicle it is, e.g., car vs. drone vs. boat.

Position devices <NUM> may include components for determining a position of the vehicle <NUM>. For example, this may include a global position system (GPS) or other global navigation satellite system (GNSS) circuitry configured to receive signals from a satellite system and determine the vehicle <NUM>. Position devices <NUM>, accordingly, may provide vehicle <NUM> with satellite navigation features.

The one or more memories <NUM> may store data, e.g., in a database or in any different format, that may correspond to a map. For example, the map may indicate a location of known landmarks, roads, paths, network infrastructure elements, or other elements of the vehicle's <NUM> environment. The one or more processors <NUM> may process sensory information (such as images, radar signals, depth information from LIDAR, or stereo processing of two or more images) of the environment of the vehicle <NUM> together with position information, such as a GPS coordinate, a vehicle's ego-motion, etc., to determine a current location of the vehicle <NUM> relative to the known landmarks, and refine the determination of the vehicle's location. Certain aspects of this technology may be included in a localization technology, such as a mapping and routing model.

The map database (DB) <NUM> may include any type of database storing (digital) map data for the vehicle <NUM>, e.g., for the control system <NUM>. The map database <NUM> may include data relating to the position, in a reference coordinate system, of various items, including roads, water features, geographic features, businesses, points of interest, restaurants, gas stations, etc. The map database <NUM> may store the locations of such items and descriptors relating to those items, including, for example, names associated with any of the stored features. In some aspects, a processor of the one or more processors <NUM> may download information from the map database <NUM> over a wired or wireless data connection to a communication network (e.g., over a cellular network and/or the Internet, etc.). In some cases, the map database <NUM> may store a sparse data model including polynomial representations of certain road features (e.g., lane markings) or target trajectories for the vehicle <NUM>. The map database <NUM> may also include stored representations of various recognized landmarks that may be provided to determine or update a known position of the vehicle <NUM> with respect to a target trajectory. The landmark representations may include data fields such as landmark type, landmark location, among other potential identifiers.

Furthermore, the control system <NUM> may include a driving model, e.g., implemented in an advanced driving assistance system (ADAS) and/or a driving assistance and automated driving system. By way of example, the control system <NUM> may include (e.g., as part of the driving model) a computer implementation of a formal model such as a safety driving model. A safety driving model or driving model may be or include a mathematical model formalizing an interpretation of applicable laws, standards, policies, etc. that are applicable to self-driving vehicles. A safety driving model may be designed to achieve, e.g., three goals: first, the interpretation of the law should be sound in the sense that it complies with how humans interpret the law; second, the interpretation should lead to a useful driving policy, meaning it will lead to an agile driving policy rather than an overly-defensive driving which inevitably would confuse other human drivers and will block traffic and in turn limit the scalability of system deployment; and third, the interpretation should be efficiently verifiable in the sense that it can be rigorously proven that the self-driving (autonomous) vehicle correctly implements the interpretation of the law. A safety driving model, illustratively, may be or include a mathematical model for safety assurance that enables identification and performance of proper responses to dangerous situations such that self-perpetuated accidents can be avoided.

As described above, the vehicle <NUM> may include the control system <NUM> and described with reference to <FIG>. The vehicle <NUM> may include the one or more processors <NUM> integrated with or separate from an engine control unit (ECU), which may be included in the mobility system <NUM> of the vehicle <NUM>. The control system <NUM> may, in general, generate data to control or assist to control the ECU and/or other components of the vehicle <NUM> to directly or indirectly control the movement of the vehicle <NUM> via mobility system <NUM>. The one or more processors <NUM> of the vehicle <NUM> may be configured to implement the aspects and methods described herein.

The components illustrated in <FIG> and <FIG> may be operatively connected to one another via any appropriate interfaces. Furthermore, it is appreciated that not all the connections between the components are explicitly shown, and other interfaces between components may be covered.

<FIG> shows an exemplary network area <NUM> according to some aspects. Network area <NUM> may include a plurality of vehicles <NUM>, which may include, for example, drones and ground vehicles. Any one of these vehicles may communicate with one or more other vehicles <NUM> and/or with network infrastructure element (NIE) <NUM>. NIE <NUM> may be a base station (e.g., an eNodeB, a gNodeB, etc.), a road side unit (RSU), a road sign configured to wirelessly communicate with vehicles and/or a mobile radio communication network, etc., and serve as an interface between one or more of vehicles <NUM> and a mobile radio communications network, e.g., an LTE network or a <NUM> network.

NIE <NUM> may include, among other components, at least one of an antenna system <NUM>, an RF transceiver <NUM>, and a baseband circuit <NUM> with appropriate interfaces between each of them. In an abridged overview of the operation of NIE <NUM>, NIE <NUM> may transmit and receive wireless signals via antenna system <NUM>, which may be an antenna array including multiple antenna arrays. Antenna system <NUM> may include multiple antenna elements (e.g., multiple antenna arrays) in order to employ multiple-input and multiple-output (MIMO) methods and schemes.

RF transceiver <NUM> may perform transmit and receive RF processing to convert outgoing baseband samples from baseband circuit <NUM> into analog radio signals to provide to antenna system <NUM> for radio transmission and to convert incoming analog radio signals received from antenna system <NUM> into baseband samples to provide to baseband circuit <NUM>. Accordingly, RF transceiver <NUM> may be configured to operate similarly to the RF transceiver(s) described in <FIG> and <FIG>, albeit perhaps on a much larger scale (e.g., amplifiers to transmit higher power signals, etc.).

Baseband circuit <NUM> may include a controller <NUM> and a physical layer processor <NUM> which may be configured to perform transmit and receive PHY processing on baseband samples received from RF transceiver <NUM> to provide to a controller <NUM> and on baseband samples received from controller <NUM> to provide to RF transceiver <NUM>. In some aspects, the baseband modem <NUM> may be located external to the NIE <NUM>, e.g., at a centralized location of a mobile radio communication network. Controller <NUM> may control the communication functionality of NIE <NUM> according to the corresponding radio communication technology protocols, which may include exercising control over antenna system <NUM>, RF transceiver <NUM>, and physical layer processor <NUM>. Each of RF transceiver <NUM>, physical layer processor <NUM>, and controller <NUM> may be structurally realized with hardware (e.g., with one or more digitally-configured hardware circuits or FPGAs), as software (e.g., as one or more processors executing program code defining arithmetic, control, and I/O instructions stored in a non-transitory computer-readable storage medium), or as a mixed combination of hardware and software. NIE <NUM> may also include an interface <NUM> for communicating with (e.g., receiving instructions from, providing data to, etc.) with a core network according to some aspects.

Additionally, NIE <NUM> may include a memory <NUM>, which may be internal to NIE <NUM> (as shown in <FIG>) or external to NIE <NUM> (not shown). Memory <NUM> may store one or more maps of the coverage area of NIE <NUM> among other types of information. Each of the one or more maps may include a static layer depicting environmental elements that remain largely unchanged over longer periods of time (e.g., roads, structures, trees, etc.) and/or a dynamic layer with more frequent changes (e.g., vehicles, detected obstacles, construction, etc.). In some aspects, memory <NUM> may also store maps corresponding to one or more neighboring areas of NIE <NUM> so as to provide vehicles within its coverage area with information of neighboring coverage areas (e.g., to facilitate the process when a vehicle moves to the coverage of the neighboring NIE).

<FIG> is a diagram that shows various components related to driver monitoring. Some of the features or components may be implemented or integrated into a vehicle <NUM>. The components illustrated in <FIG> may be operatively connected to one another via any appropriate interfaces. Furthermore, it is appreciated that not all the connections between the components are explicitly shown, and other interfaces between components may be covered.

Vehicle <NUM> may be any suitable type of vehicle described herein, e.g., vehicle <NUM> described in connection with <FIG>. The vehicle <NUM> can include automated driving systems (ADS) <NUM> or, in other cases, may be or include an advanced driving assistance system (ADAS). The ADS <NUM> may include a control system (not shown), e.g., the control system <NUM> described in connection with <FIG>. The vehicle <NUM> (e.g., through a control system) may be configured to operate at one or more different levels of driving automation. Table <NUM> of <FIG> describes various known automated driving levels. According to various aspects provided herein, the vehicle <NUM> may operate at L3, L4, and/or L5 automation level.

Regarding the aspects provided herein, the ADS component <NUM> is responsible for determining vehicle data, including environmental perception data. The ADS <NUM> can be configured to evaluate the environment surrounding the vehicle <NUM> to produce environmental perception data. The environmental perception data may include a risk assessment or data indicating a safety risk concerning (perceived) features or elements external to the vehicle <NUM>. The risk assessment may indicate a collision risk involving one or more perceived or detected elements in the vehicle's environment or vicinity <NUM>.

More specifically, the ADS <NUM> may generate the vehicle data (e.g., environmental perception data) from sensor data obtained from one or more sensors, e.g., sensors of the vehicle <NUM> or other external sources. The detected or perceived elements can include, for example, vehicles, pedestrians, bicyclists, animals, road obstructions, or any other type of road actor.

The vehicle <NUM> may further include an Operational Design Domain monitor <NUM> and a Driver Monitoring System (DMS) <NUM>. The Operational Design Domain (ODD) of the vehicle <NUM> may be the operating conditions under which a given driving system/vehicle is designed explicitly to or properly function or operate. The ODD monitor <NUM> may determine ODD compliance for the vehicle <NUM>. For example, the ODD monitor <NUM> can determine whether the vehicle <NUM> is operating with the proper operating conditions for a current operation mode. If the ODD monitor determines that vehicle <NUM> is not operating under the proper conditions, then the vehicle <NUM> is determined to be out of the ODD and not in ODD compliance. For example, the ODD monitor <NUM> may determine or detect when the vehicle <NUM> is not in ODD compliance in response to determining that a safety risk to vehicle <NUM> exceeds a threshold.

The ODD monitor <NUM> can inform the ADS <NUM> (e.g., send a data signal) to indicate the ODD compliance status of the vehicle <NUM>. The ADS <NUM> can be configured in response to take one or more actions to resolve the ODD non-compliance.

The ODD monitor <NUM> can inform or provide the ODD compliance assessment to the ADS <NUM>, which may take one or more actions in response. For example, in the case where the ODD assessment indicates non-compliance due to a high level of risk, the ADS <NUM> may take one or more actions such as a handover in which automated control of the vehicle by the control system of the vehicle <NUM> transitions to driver/manual control of the vehicle. In other cases, the ADS <NUM> may take one more actions even when the ODD compliance is reached, but a determined safety risk of the vehicle is too high. In yet some examples, the ADS may initiate a "reverse transition". For example, if the human driver is determined or interpreted of not being capable of controlling the vehicle, e.g., due to a heart attack, epileptic shock, or when asleep, unconscious, etc., the ADS may take control from the driver or prevent the driver from controlling the vehicle, e.g., the ADS may maintain automated control.

The driving monitoring system or DMS <NUM> may be a component of the vehicle <NUM> that monitors the driver <NUM> of the vehicle <NUM>. According to aspects provided herein, the DMS <NUM> may monitor and interpret driver data (e.g., driver feedback). Further, the DMS <NUM> can generate or produce driver perception data based on the monitoring and interpretation of driver data. In some instances, the DMS <NUM> can ascertain an awareness/attention status or level of the driver <NUM>. The DMS <NUM> may obtain and analyze and interpret sensor data, e.g., image, video, audio, concerning the driver to determine the awareness/attention status. The DMS <NUM> can determine how attentive the driver <NUM> in one or more situations or contexts. This awareness or attention level may be in the form of a probabilistic risk assessment.

Interpreting driver feedback includes the DMS <NUM> configured to interpret signals from the driver <NUM>, e.g., as safety-enhancing feedback. The signals may be an audio and/or visual signal. The driver can be in the form of proactive feedback. The DMS <NUM> interprets driver feedback (e.g., signals) to determine or estimate information regarding one or more objects or elements in the vehicle's environment or vicinity. In one example, the driver <NUM> can provide one or more signals, that if correctly interpreted, indicate the existence (or potential existence) of one or more objects in the vehicle's vicinity. Further, the feedback information may indicate a level of risk or threat regarding such an object or objects. The driver perception data can indicate and be used to indicate or infer a safety risk (e.g., collision risk) for one or more elements in the vehicle's vicinity or environment.

The DMS <NUM> can provide information that can be used directly or indirectly by the ODD monitor <NUM> for assessing ODD compliance. For example, the vehicle <NUM> of <FIG> includes a risk estimator <NUM>, a component configured to make or produce risk assessments for the vehicle <NUM> regarding current or (immediate) upcoming situations/scenarios. The risk assessment or risk assessment data can be sent to and used by the ODD monitor <NUM> to determine ODD compliance, e.g., the ODD compliance concerning a current driving or automation mode of the vehicle <NUM> for a current or upcoming scenario. In at least some instances, the DMS <NUM> provides driver data or driver perception data to the risk estimator <NUM>.

The risk estimator <NUM> can be a component for evaluating scenarios involving the vehicle <NUM>, e.g., situations regarding the vehicle <NUM> and the vehicle's surrounding environment to generate or produce a risk assessment. The risk estimator <NUM> can generate a risk assessment that includes data indicating the vehicle's risk, e.g., a risk of collision. In aspects provided herein, the risk estimator <NUM> may generate or provide a risk assessment by assimilating or integrating information from different sources, e.g., using driver perception data and environmental perception data. The environmental perception data (which can be obtained and/or determined from sensor data of the vehicle's external environment) can include data indicating a safety risk (e.g., collision risk) for the vehicle <NUM>. The safety risk may be specified with respect to one or more perceived elements or objects in the vehicle's vicinity.

Using at least these data types (e.g., driver perception data and the vehicle data), the risk estimator <NUM> can determine a combined or integrated risk assessment regarding the vehicle. The risk estimator <NUM> can integrate the driver feedback or the driver perception data with the ADS risk assessment (from the vehicle or environmental perception data). The result produces an integration of risk assessment from the driver perception data and the environmental perception data. The integrated risk assessment or risk assessment may be a probabilistic estimation. In determining the risk assessment, the risk estimator <NUM> determines the existence or likelihood of elements in the vehicle's environment and one or more (potential) situations/scenarios involving the vehicle <NUM>. Further, the risk estimator <NUM> may determine a safety risk such as a collision risk between the vehicle <NUM> and such elements.

The ODD monitor can use the integrated risk assessment to determine whether the vehicle is currently in or out of the vehicle's ODD. The ODD monitor <NUM> may evaluate ODD compliance by comparing the determined integrated risk assessment with one or more risk thresholds. The particular threshold(s) used for comparison may be selected based on the driver perception data, indicating the driver's attentional awareness.

The risk estimator <NUM> can provide the risk assessment to the ADS <NUM>. In response, the ADS <NUM> may take one or more actions, even if the ODD assessment provided by the ODD monitor <NUM> does not indicate out of the ODD. For example, if the integrated risk determined by the risk estimator <NUM> is higher than the level of risk determined by the ADS <NUM>, then the ADS may initiate action(s) to change the driving behavior even if the vehicle is in ODD compliance. That is, automated control of the vehicle <NUM> may be maintained, but the driving behavior may be altered by ADS <NUM>, e.g., the ADS <NUM> may cause a change in driving model parameters to drive with more caution or safety due to the risk assessment provided by the risk estimator <NUM>.

According to aspects provided herein, the vehicle <NUM> may systematically collect ODD compliance assessments. ODD compliance assessments can be collected and stored, for example, in a database or other storage <NUM> that may be part of the vehicle, or in other cases, may be a remote database. The ODD compliance assessments may be stored along with the corresponding scenarios, labelling (e.g., see below with respect to <FIG>) which may be obtained from the vehicle data and the driver perception data. In some cases, not every ODD compliance assessment may be stored. In some instances, a subset of the ODD compliance assessments, e.g., corner cases such as those in which the driver perception data and the vehicle data are discordant, may be stored.

For example, in situations where the driver proactively provides feedback, and thus a ground-truth label (e.g., interpreted driver feedback) may be stored together with a snapshot (e.g., sensor image data) of the current environment. Since a driver will be active mostly in critical situations, such data will contain an above-average proportion of corner cases, e.g., challenging cases for the DMS and ADS in the form of high perception uncertainty perception errors (misclassifications, missed objects). Detected corner cases and associated ground-truth labels can be collected systematically and are forwarded by the ODD monitor to a database, e.g., database <NUM>. Since a driver might intentionally or unintentionally provide an incorrect label, each pair of corner case and ground-truth data may be later verified by an operator (e.g., certified operator) first before it is shared or used by other users. That is, the data may be updated with the verification information by certified or legitimate operators. This verification may be in the form or similar to labeling tasks during any dataset generation, and no significant training is necessary for such an operator.

As a result, a database of corner cases can be of great value for other ADS perception systems because critical situations do not frequently occur during normal operations. Traditional dataset collection techniques have a notorious lack of such corner cases, which makes, for example, neural networks trained with such a database can provide informed results, e.g., regarding risk, ODD compliance, and overall provide superior to results for driver systems compared to others. This way, an entire fleet of vehicles can benefit by using the data. That, the database information may be used for a fleet with the information being transmitted or downloaded to one more vehicles for use in their driving and perception system.

In aspects provided herein, the ODD compliance assessment may fall into certain categories as determined by the ODD monitor <NUM> and its compliance assessment. As such, the ODD compliance assessments may be labeled, e.g., by the ODD monitor <NUM> or another suitable component according to its category. In one or more examples example, the ODD compliance assessments may be annotated or labeled "exit", "save", or "support".

<FIG> shows an exemplary diagram illustrating the ODD compliance assessment using driver perception data (e.g., proactive driver signal(s)) and the ADS risk assessment. The driver feedback <NUM>, which may be in the form of a proactive signal, may be consistent with the ADS data at <NUM> to produce an ODD assessment at <NUM>.

The label "exit" may indicate situations where the perception data of the vehicle system and the driver feedback disagree, and this discrepancy suggests that the current ODD compliance assessment is incorrect and needs to be changed to maintain safety. For example, such situations appear if the driver points out elements of high estimated risk that the vehicle perception system has missed and cannot handle. In that case, an exit from the current ODD to another, safe ODD is being forced.

The label "support" may be used for ODD assessments where the driver perception data agrees or supports the environmental perception data of the vehicle data agrees with. The "support" label means the risk estimation determines that the vehicle is either in or out of the defined ODD, and the driver perception data (e.g., driver feedback) supports the current ODD compliance determination.

The "save" label may be used to indicate situations in which the environmental perception data of the vehicle data disagrees with the driver perception data but does not alter or appreciably alter the relevant safety risk, e.g., safety risk and the vehicle remains in ODD compliance. The risk indicated in the driver perception data is within a specific range of the risk indicated by the environmental perception data.

According to aspects provided herein, a driver can be proactive and provide feedback and notification regarding possible or pending hazards or indicate their attention status during automated vehicle control. Therefore, the vehicle's mechanism can confirm (ODD support) or correct (ODD save, exit) the ODD assessment and thus reduce the critical time for performing a handover operation or avoiding a handover operation altogether.

The safety analysis or risk estimation in aspects provided herein relates to assimilating information from the inside (driver perception) and outside (vehicle environment perception). In some instances, a driver <NUM> can proactively signal his attention status. In such cases, the DMS <NUM>, e.g., through sensors connected (e.g., through an interface), can interpret and determine attention status or awareness level from the driver <NUM>. This interpreted information can be passed on to the risk estimator module <NUM> for risk estimation. At or near the same time, the risk estimator <NUM> can receive the sensing input (e.g., risk estimation of the vehicle's environment) from the ADS <NUM>. The risk estimator <NUM> can combine or integrate both types of data to determine or calculate a quantitative risk, or a combined risk. The combined risk determined by the risk estimator <NUM> may be determined based on the consistency between the types of data, e.g., the vehicle data and the driver perception data. In at least one example, the risk estimator <NUM> may determine a combined risk from the vehicle data and the driver perception data based on a consistency between risk indicated, inferred, and/or determined from the vehicle data and risk indicated, inferred, and/or determined from the driver perception data. The combined risk may be produced regarding or be associated with imminent actions regarding features or elements external to the vehicle <NUM>.

If the recognized driver signal(s) are consistent with the available vehicle information, then the vehicle data's risk estimate will not affect or appreciably affect the ADS risk estimate (indicated in the vehicle data) up to an uncertainty correction. However, if the proactive driver signal is not consistent with the vehicle data from the ADS <NUM>, then determining the integrated risk estimate may include incorporating extra precautions to ensure safety. For example, if the proactive driver signals attention but the DMS recognizes unawareness, the combined estimate will output a high risk. Further, ins such instances, the ADS <NUM> may provide a driver alert depending on the current environment and the determined risk. The risk estimator <NUM> may use one or more awareness or attention thresholds and compare the determined awareness level from the DMS <NUM> with one or more awareness/attention thresholds. The surpassing of the one or more attention/awareness threshold level can be used to calculate the integrated risk. For example, greater levels of detected driver awareness can produce a smaller integrated risk assessment. In comparison, low or lower driver awareness levels can produce a more significant integrated risk assessment by the risk estimator <NUM>.

In other cases, the driver perception data may be interpreted when the driver <NUM> proactively signals or refers to the vehicle's external environment. That is, the DMS <NUM> may interpret the driver perception data (e.g., from sensors) and determine a driver's indication regarding an element or object in the vehicle's vicinity. In such cases, a fused environment may be created, e.g., by the risk estimator <NUM>. All elements detected by both data sources (e.g., vehicle data from ADS <NUM> and the driver perception data from the DMS <NUM>) can be aligned temporally and spatially in a common coordinate system, using standard sensor fusion techniques. The fused environment can be a temporal and/or spatial representation of the environment surrounding the vehicle, including one or more elements in the vehicle's environment.

The generated or created fused environment can contain the same number or more elements than each of the individual sources. Any additional elements can be correct observations enhancing the overall perception completeness or false positives. The fused environment can include a safety risk for each of the elements or objects detected. The risk estimator <NUM>, to ensure safety, can account for all observations from both sources, and the ADS <NUM> can then evaluate the resulting combined/integrated risk for the planned driving strategy. For example, if the data sources are inconsistent or discordant (e.g., observations by driver and ADS conflict or the risks indicated from the sources are in conflict), then the ADS <NUM> may be configured to choose a more cautious option. This situation may occur when a possible object in the vehicle's vicinity is seen or detected by one of the sources but is not seen or detected by the other source. In such a case, observation of the object or element is added to the combined environment with a safety risk (e.g., collision risk) determined for the object/element.

In general, if the determined safety risk is beyond an acceptable threshold for any elements of the combined or fused environment, then an ODD exit can be triggered, or the respective driving task can be adapted if an ODD save with reduced risk is possible. The ADS <NUM> can adopt a driving strategy that results in safer driving behavior to avoid accidents.

As described herein, sensor data captured of the driver, e.g., sensor data of the driver's feedback, can be analyzed and interpreted. The DMS <NUM> and/or any other suitable component may be configured to interpret driver feedback. The DMS <NUM> (or another component), for example, may include logic (interpretation logic) for understanding or interpreting the driver data captured from one or more sensors of the vehicle.

The interpretation logic may, in some instances, rely on a hierarchical signal and interpretation structure. Namely, the signals may be a combination of audiovisual signals. Since the signals are audiovisual, e.g., they are any suitable combination of audio and visual signals, this reduces the incidence of false positives and provides enhanced robustness. Any suitable signal detection techniques known in the art may be used, including, for example, speech detection, physical feedback (e.g., from buttons such as on steering or console), gaze estimation or head pose estimation of the driver, hand gesture recognition (e.g., swipe left/right, circle clockwise/counterclockwise actions), finger gestures (e.g., any of one, two, & three fingers up), pointing gestures (e.g., including with full arm), and the like.

The interpretation logic can include or use a mapping of signals to communicated information can be implemented in various ways. Table <NUM> of <FIG> shows one exemplary type of mapping; however, other implementations and variants can be realized and used.

In at least one example, a neural network or machine learning logic trained for driver signal interpretation may be used. The interpretation logic may be trained for application-specific audiovisual signals and can be configured to determine or calculate a probabilistic risk assessment of the driver's monitoring ability and compute feedback of the driver's risk assessment ((e.g., driver risk assessment regarding possible elements in vehicle's environment).

In various aspects provided herein, one or more types of sensors may be used. For example, in-vehicle for the driver may include one or multiple of the following: RGB cameras, Infrared (IR) cameras, IR LED, Time-of-flight (ToF) camera, dynamic vision sensor (event camera), Structured Light at diverse wavelengths, microphones (e.g., placed in the driver's cabin for audio input and output), physical buttons (e.g., on the steering wheel), interactive displays or other interfaces.

<FIG> shows an exemplary method <NUM> that may be performed in accordance with aspects provided herein. The method <NUM> may be performed by one or more components of a vehicle. The vehicles may be ones that support or include autonomous-type control (e.g., L3). In some cases, the method may be embodied as instructions contained (non-transitory) computer-readable medium with the method being performed by one or more processors executing the instructions.

he method <NUM> includes at <NUM>, obtaining vehicle data comprising environmental perception data indicating a risk assessment regarding one or more perceived elements of an environment surrounding a vehicle. At <NUM>, the method <NUM> includes obtaining driver perception data regarding a driver inside the vehicle. The further includes at <NUM> determining an integrated risk assessment based on the vehicle data and the driver perception data. Then at <NUM>, the method includes determining an Operational Design Doman (ODD) compliance assessment of the vehicle at least based on the determined integrated risk assessment.

According to aspects provided herein, the data used for ODD assessment, e.g., the driver perception data and the vehicle/environmental data, may include uncertainties. That is, uncertainties in the perception can arise due to imperfections or noise on sensor information and algorithms. Uncertainties may take the form of probability of existence, which expresses how likely it is that an object that has been detected is a real object. This uncertainty can be expressed as a probabilistic value of existence. Further, uncertainties may take the form of properties of an object/element, e.g., an exact velocity or position. This uncertainty is usually expressed by a distribution (e.g., Gaussian). The vehicles or components described herein may be configured to process and make decisions with such types of uncertainties.

Further, as described, uncertainties can be handled by thresholding. In one example, a vehicle has some threshold that influences whether or how information is used. In the case of the probability of an element or object's existence, a probability value could be used. If the object probability is higher than the threshold, then the object is considered existing; otherwise, no object is considered. For the distribution of values, such a threshold could be, e.g., defined by a multiple sigma quantile of the distribution.

Further, in aspects provided herein, components of the vehicles described herein may calculate a risk based on the given information and uncertainties. As used herein, risk may be defined as the "probability of something happening multiplied by the resulting cost or benefit it does". Any suitable or appropriate risk estimation methods known in the art may be used. If collision severity is used for risk, a simple inelastic collision model can be applied. With a risk calculation, it is possible to calculate for each given object in the environment a probabilistic risk value, referring to harmful collision with this object, given its probability of existence and a distribution of the information. However, for the vehicle's decision-making, the use of a threshold or thresholds may be used or required in which the threshold(s) defines the acceptable risk.

While the above descriptions and connected figures may depict electronic device components as separate elements, skilled persons will appreciate the various possibilities to combine or integrate discrete elements into a single element. Such may include combining two or more circuits for form a single circuit, mounting two or more circuits onto a common chip or chassis to form an integrated element, executing discrete software components on a common processor core, etc. Conversely, skilled persons will recognize the possibility to separate a single element into two or more discrete elements, such as splitting a single circuit into two or more separate circuits, separating a chip or chassis into discrete elements originally provided thereon, separating a software component into two or more sections and executing each on a separate processor core, etc..

It is appreciated that implementations of methods detailed herein are demonstrative in nature, and are thus understood as capable of being implemented in a corresponding device. Likewise, it is appreciated that implementations of devices detailed herein are understood as capable of being implemented as a corresponding method. It is thus understood that a device corresponding to a method detailed herein may include one or more components configured to perform each aspect of the related method.

Claim 1:
System for a vehicle (<NUM>) comprising:
a plurality of sensors configured to detect data of an environment external to a vehicle (<NUM>) and further configured to detect data of a driver inside the vehicle (<NUM>), wherein at least one of the plurality sensors is inside the vehicle (<NUM>) and configured to face the driver;
a driver monitoring system (DMS) (<NUM>) configured to generate driver perception data regarding the driver inside the vehicle (<NUM>);
an automated driving system (ADS) (<NUM>) configured to generate vehicle data comprising environmental perception data indicating a risk assessment regarding an environment surrounding the vehicle (<NUM>);
a risk estimator (<NUM>) configured to determine an integrated risk assessment based on the vehicle data and the driver perception data, wherein the vehicle data further comprises driving monitoring system data regarding the driver, and wherein the risk estimator (<NUM>) configured to determine the integrated risk assessment comprises the risk estimator (<NUM>) configured to determine a combined risk from the vehicle data and the driver perception data based on a consistency between risk indicated from the vehicle data and risk indicated from the driver perception data, wherein the driver perception data comprises data indicating a probabilistic risk assessment regarding one or more elements of the environment surrounding the vehicle (<NUM>), wherein the driver perception data includes data indicating a probabilistic risk assessment of the driver's monitoring ability, and wherein the DMS (<NUM>) configured to generate the driver perception data comprises the DMS (<NUM>) configured to:
determine an awareness level of the driver from sensor data from one or more sensors inside the vehicle (<NUM>); and
determine the probabilistic risk assessment of the driver's monitoring ability including comparing the determined awareness level of the driver to one or more threshold values each associated with a level of driver awareness; and
an Operational Design Domain (ODD) monitor (<NUM>) configured to determine ODD compliance assessment of the vehicle (<NUM>) at least based on the determined integrated risk assessment and whether the combined risk is greater than a threshold.