CN117302264A - Remote take-over method for automatic driving vehicle - Google Patents

Abstract

The invention relates to a remote take-over method for an automatic driving vehicle, which comprises the steps of judging whether a road environment exceeds a control boundary of the automatic driving system or not during the control of the vehicle by an automatic driving system, further evaluating the take-over capability of a driver in the road environment if the road environment exceeds the control boundary of the automatic driving system, transferring driving control authority to the driver if the road environment accords with the driving capability of the driver, and otherwise, entering a take-over transition module to wait for the driver to take over the safety and transferring the control authority. The take-over method is mainly used for taking over actively before the automatic driving system fails or fails, so that the problem of midway stopping and waiting caused by the traditional take-over mode is solved, the safety in the control authority transferring process is improved, meanwhile, the continuity of driving tasks can be ensured, the comfort of passengers is improved, the traffic efficiency is improved, and the safety is improved.

Description

Remote take-over method for automatic driving vehicle

Technical Field

The invention relates to a remote take-over method for an automatic driving vehicle, belongs to the technical field of automatic driving, and particularly relates to a remote driving safety switching method supporting vehicle cloud control capability assessment.

Background

Automobile automatic driving technologies of different grades and different functions are rapidly developing. However, complicated operation scenes, dynamic traffic conditions and various legal and engineering ethical problems lead to the fact that full-working-condition automatic driving vehicles are difficult to realize in a short period of time.

The safety problem is the biggest problem restricting the development of the automatic driving vehicle at present, the research and development of passive safety are mature day by day, but unilaterally, the safety of the automobile is ensured to be relatively low-efficiency by the passive safety.

In the running process of the automatic driving vehicle, when the control difficulty exceeds the capability of the automatic driving system, if some extreme conditions are met, the automatic driving system can have the problems that the automatic driving system is difficult to process and even has system failure, and a cloud security personnel can acquire the control right of the vehicle; in contrast, when the vehicle control accords with the design operation domain of the automatic driving system, the cloud control system needs to remind the cloud security personnel serving as the driver currently and transfer the control right to the vehicle-end automatic driving system. How to realize quick and safe control authority transfer is a problem to be solved by the application.

Disclosure of Invention

The invention aims to provide a remote take-over method for an automatic driving vehicle, which is used for solving the problem of low safety in the transfer process of man-machine control permission of the automatic driving vehicle.

In order to achieve the above object, the present invention provides a method comprising:

according to the technical scheme of the automatic driving vehicle remote take-over method, during the control of the vehicle by the automatic driving system, whether the road environment exceeds the control boundary of the automatic driving system is judged, if yes, the take-over capability of a driver in the road environment is further evaluated, if the driving control authority is transferred to the driver, and if not, the taking-over transition module is entered to wait for the driver to take over the safety, the control authority is transferred.

According to the vehicle state information and traffic information of the automatic driving vehicle, the present vehicle state information and traffic information are compared with the control boundary index by combining the acquired control boundary of the automatic driving system, so as to evaluate whether the vehicle state exceeds the design operation domain. The vehicle is taken over directly by the autopilot system when the design operation domain of the autopilot system is met, and is taken over by the cloud driver when the autopilot operation domain is exceeded.

The take-over method is mainly used for taking over actively before the automatic driving system fails or fails, so that the problem of midway stopping and waiting caused by the traditional take-over mode is solved, the safety in the control authority transferring process is improved, meanwhile, the continuity of driving tasks can be ensured, the comfort of passengers is improved, the traffic efficiency is improved, and the safety is improved.

Further, in order to ensure that the control right returns to the automatic driving system in time and improve the operation efficiency, after the driving control right is transferred to a driver, the automatic driving control boundary assessment module assesses a new road environment and a vehicle state, and if the road environment falls into the control boundary of the automatic driving system, the driving control right is returned to the automatic driving system.

Further, the following condition should be satisfied when transferring the driving control authority to the driver:

depending on the vehicle itself and the road conditions, the vehicle must be in an area that can be controlled by the driver;

the state of the vehicle must remain in this area for the time before the driver takes over completely.

Further, the vehicle state in the time before the driver takes over completely is predicted by the following method:

the dynamics of a vehicle are described using a first order transfer function:

wherein,to the desired acceleration, a _s For the actual acceleration, K, τ and θ are steady-state gain, time constant and time delay, respectively;

the discretization above is reduced to the following model:

wherein A, B and E are derived matrices, x= [ a ] _h v _h v _l l] ^T In the form of a vehicle state vector,for inputting commands to a vehicle, w=a _t To input a disturbance;

the model is used to predict the vehicle state trajectory from the control inputs u (t) and disturbances w (t), by introducing a Pre (S) set, defined as the control inputs u (t) and disturbances w (t) at a given instant t, evolving in one step to a state set x of S, namely:

further, the vehicle autopilot system control boundary is determined by:

representing the scene considered by the automatic driving of the vehicle as a point in a scene parameter space, wherein each point corresponds to an input state of the automatic driving system of the vehicle to generate an output state; the vehicle automatic driving system G is arranged in the input space P ⁿ Point p on _i Input, the corresponding output is obtained as phi (p _i ) The method comprises the steps of carrying out a first treatment on the surface of the The boundary scene to be found exists in the scene parameter space;

by evaluating the function pair phi (p _i ) Evaluation was performed to obtain an evaluation value T (p _i ) The method comprises the steps of carrying out a first treatment on the surface of the For point p inside the boundary _in T (p) _in )>0. For the edgePoint p outside the boundary _out T (p) _out )<0; the boundary is considered as the positive and negative crossing region of the evaluation value. And the boundary is the design operation domain of the automatic driving system, and the boundary is outside and exceeds the design operation domain.

The invention can summarize the boundary description process, and can describe the boundary with a certain precision by adopting a point set method.

Further, the driver handling ability is determined using the following method:

the occurrence of a driving accident represents a fault of the driver, and the ability to handle the current driving task is lost. The invention uses the accident occurrence condition to explain the driver state and driving ability, which is characterized in that: a driver correction capability reliability field, the driver manipulation capability being determined according to the driver correction capability reliability field;

describing the correction capability of the driver by utilizing the deviation between the theoretical output value and the actual value under the normal capability of the driver, and representing the deviation by utilizing the absolute value of the error between the theoretical value and the actual operation value of the driver output by the driver model; steering wheel angle and acceleration are used to represent the lateral and longitudinal behavior of the driver, respectively.

Further, the calculation formula of the deviation ES of the steering wheel angle and the deviation EA of the acceleration is as follows:

ES＝|SWA _C -SWA|

EA＝|a _c -a|

wherein SWA _C And a _c Representing the actual values of steering wheel angle and acceleration, respectively, SWA and a represent the model output values of the lateral and longitudinal behaviour of the driver, respectively, i.e. the theoretical values under normal driver capacity.

Further, the takeover capability boundary of the driver is updated by the following method:

the different characteristics of the drivers are analyzed by using the lognormal distribution, the index distribution suitable for each driver is fitted, and the core parameters mu and sigma in the lognormal distribution are updated:

mu at time t-1 is known _t-1 、σ _t-1 Sample size n _t-1 And time tIs the sample value x of (2) _t Mu at time t _t 、σ _t Can be calculated by the following formula:

further, the updating of the driver take over capability boundary includes the following requirements:

1) Considering the situation of replacing the driver, resetting the driver takeover capability boundary when the vehicle speed is 0;

2) When the driver's ability drops to unreliable, the DCS will remain unchanged;

3) If a dangerous event actually occurs in the actual calculation process, the ES is abandoned from the moment to the data in the set time period.

Further, in order to protect the security switching, the following method is adopted to evaluate whether the takeover of the cloud security personnel is safe or not:

starting from DCS, the prediction module is used recursively in M steps, each time intersecting the result set with DCS, the current state set x (t ₀ ) Will remain in DCSThe aggregate sequence, the vehicle state held at the DCS is calculated as:

m＝M-1,…,0

at the time of calculationAfter that, if state x (t ₀ ) At->If the driving control authority is within the range, the driver is considered to take over the safety, and the driving control authority is transferred to the driver; otherwise, switching to emergency stop.

Drawings

FIG. 1 is a schematic diagram of an autopilot vehicle remote take over process scenario;

FIG. 2 is a flow chart for autonomous vehicle remote take over;

FIG. 3 is a schematic diagram of the control boundary construction principle of the autopilot system;

FIG. 4 is a schematic diagram of an autopilot system control boundary using a front vehicle speed, a vehicle speed, and a two-vehicle distance as descriptive parameters of a parameter space.

Detailed Description

The present invention will be further described in detail with reference to the drawings and examples, in order to make the objects, technical solutions and advantages of the present invention more apparent.

A typical application scenario of the automatic driver at the vehicle end to the cloud security officer taking over the manual driving switch is shown in fig. 1, and a remote take-over flow of the automatic driving vehicle is shown in fig. 2. In the automatic driving state, the vehicle state is evaluated and predicted, meanwhile, relevant indexes are compared with the vehicle operation domain indexes and the driver takeover capability set, after the fact that the vehicle-end automatic driving system is about to fail (as shown in fig. 1, accidents occur in front of roads and occupy all traffic lanes, the traffic lanes cannot be avoided through conventional lane changing, a lane-borrowing emergency lane is needed), meanwhile, the cloud security officer can safely Take Over, and takeover Request (TOR) information is needed to be timely transmitted to the driver through a system human-computer interaction interface (Human Machine Interface, HMI).

The take-over point is the moment when the vehicle control right is handed over to the cloud security officer, and at the moment, the cloud security officer is taken as a vehicle driver to judge the driving environment and the vehicle state and to try to avoid danger.

The danger avoiding point is the moment when the vehicle successfully avoids the risk, the running risk starts to decline after the moment, and the cloud security personnel is reminded to return the driving right to the automatic driving system when the control domain of the automatic driving system is met.

The invention relates to a remote take-over method for an automatic driving vehicle, which comprises the following modules.

1. The autopilot system controls the boundary assessment module.

The module is mainly used for evaluating the control boundary of the automatic driving system and judging whether the current vehicle state exceeds the designed operation domain.

The automatic driving vehicle is provided with a sensor, a radar, a high-precision map, a camera and other devices for acquiring vehicle state information of the automatic driving vehicle and traffic environment information around the vehicle. The vehicle state information here includes vehicle speed information, vehicle position information, steering wheel angle information, brake pedal opening information, gear information, power battery SOC (number of nuclear charges) information, parking state information, and lane position information where the vehicle is located. The traffic environment information includes road topology information, weather state information, obstacle information, and traffic signal information.

Firstly, selecting a collision scene evaluation value as negative and a non-collision scene evaluation value as positive, so that the boundary is the junction of collision and non-collision. For a collision scene, the higher the collision speed is, the less safe the collision speed is, so that the speed difference of two vehicles is selected as an evaluation value of the collision scene, and for a non-collision scene, the speed difference of two vehicles is meaningless when the scene is ended because no collision occurs, so that the distance of the two vehicles is selected as the evaluation value.

The scenes of the autopilot consideration of the vehicle are each represented as a point in the scene parameter space. Each point is an input state for the object under test, and an output state is generated correspondingly. The system G is arranged in the input space P ⁿ Point p on _i Input, the corresponding output is obtained as phi (p _i ). The boundary scene to be found exists in the scene parameter space.

The control boundary construction flow of the automatic driving system is shown in fig. 3, and the boundary problem is that boundary surfaces formed by positive and negative crossing points of all evaluation values are covered with a certain precision in a point set form in a parameter space formed by input parameters of a tested system. The large-scale detection is performed to obtain a sufficiently large point set, and then the existing point set is classified to generate a convergence region, and the convergence region further generates a crossing boundary portion.

Corresponding state points can be generated in the parameter space, taking an automatic emergency braking system (Autonomous Emergency Braking, AEB) system as an example, the front vehicle speed, the self vehicle speed and the distance between two vehicles are used as description parameters of the parameter space, and the effect is as shown in fig. 4 (the same plot generated finally in fig. 3).

By evaluating the function pair phi (p _i ) Evaluation was performed to obtain an evaluation value T (p _i ) The method comprises the steps of carrying out a first treatment on the surface of the For point p inside the boundary _in T (p) _in )>0. For points p outside the boundary _out T (p) _out )<0; the boundary is considered as the positive and negative crossing region of the evaluation value.

The boundary is defined as a point crossing the specified evaluation value in the parameter space, and the comprehensive searching boundary point is a test target. In order to embody the adaptability to different expectations and also to guide convergence, an evaluation framework based on expectations is proposed.

The evaluation function is a method of evaluating data in the parameter space.

Before designing the evaluation function framework, the expectations of the summary evaluation index are:

(1) The expected boundary is specifically displayed as a conversion place of the positive and negative evaluation values;

(2) And the method has usability for most black box problems.

In order to meet the requirement of having a certain convergence guiding capability, the evaluation value should be quantized rather than binary, and the size of the evaluation value should be such that it can contain distance information from the boundary as much as possible. On the other hand, in order to make the boundary appear at the boundary between the positive and negative evaluation values, the determination of the positive and negative evaluation should be clearly and precisely described. Finally, to provide adaptability to most black box problems, the magnitude of the evaluation value should be determined on a ubiquitous basis. Thus, an evaluation constraint based on the expected outcome of the problem by the tester is obtained.

The setting of the evaluation index should meet the following constraints:

(1) According to phi (p _j ) The output evaluation value that meets the desire is set to be positive, and the evaluation value that does not meet the desire is set to be negative.

(2) P phi (p) _j ) The human determination is performed such that the evaluation value is larger as the expected value is satisfied, and the evaluation value is smaller as the expected value is not satisfied.

(3) The evaluation value not belonging to the desired effect and the undesired effect is set to 0.

Therefore, the boundary can be searched in the direction of 0 evaluation value according to the evaluation value.

The detection algorithm requires:

the algorithm in the parameter space needs to meet certain precision requirements and completely describe the boundary region in a point set mode. The following basic requirements can be considered:

(1) High coverage, covering as much as possible all boundary areas.

(2) Accuracy, boundaries are described as far as possible with a certain degree of precision.

(3) The maximum precision is limited, and the highest precision of the realization result is required to be limited in consideration of the realization target precision, so that the cost is controlled.

(4) Considering the problems of discontinuity, nonlinearity and the like, the following requirements can be obtained by matching the functions of the evaluation function:

(5) The interference resistance of the space was evaluated for non-uniformity. For non-uniform regions, the guidance of the region is reduced, and excessive cost input into nonsensical regions is prevented.

(6) The search capability along the gradient descent direction and the search capability along the gradient ascent direction are certain.

2. The cloud driver takes over the capability assessment module.

(1) Take over the security assessment algorithm.

The online update of the cloud-secure take-over capability domain comprises three steps: 1) Collecting data; 2) Estimating a mean and variance of a hypothetical distribution of data; 3) A bound for D is determined from the estimated cumulative distribution function. These three steps are each described in detail below. This method of online updating the take over capability domain provides a simple and efficient process that can be performed in real time.

Because these two variables describe different aspects of vehicle follow, including potential and actual hazards, they are both considered in the definition of D.

For the AEB application considered herein, the definition of set D depends on the variables: time To Collision (TTC)

The collision time interval is defined as:

TTCs have proven to be effective in capturing the actual risk of driving situations. TTC is closely related to the time the driver initiates and controls the braking.

The correction capability of the driver is described by utilizing the deviation between the theoretical output value and the actual value under the normal capability of the driver, the deviation is represented by utilizing the absolute value of the error between the theoretical value output by the driver model and the actual operation value of the driver, and the steering wheel rotation angle and the acceleration are used for representing the transverse and longitudinal behaviors of the driver respectively. The driving risk correction capability index can be expressed as:

ES＝|SWA _C -SWA|

EA＝|a _c -a|

wherein ES and EA represent the steering wheel angle deviation and acceleration deviation, SWA, respectively _C And a _c Representing the actual values of steering wheel angle and acceleration, respectively. SWA and a represent model output values for both behaviors, respectively, i.e., theoretical values under normal driver capability.

A model of the driver behavior mechanism.

Transverse model:

the vehicle track will be characterized by using the lateral position of the vehicle in the lane, i.e. the distance between the center point of the vehicle and the center line of the lane, and assuming that the lateral position of the vehicle at the current moment is y and the lateral position of the pre-aiming point is yp, then:

wherein d is the pretightening distance, v _h For the current speed of the vehicle, T _p In order to pre-address the time of day,is the heading angle of the vehicle.

The compensation module represents the decision-making characteristics of the driver, which are expressed in detail as follows:

wherein k is the compensation gain of the pre-aiming error, T ₁ Is a prepositive time constant, T ₂ For the lag time constant, s determines the frequency of the compensation.

Longitudinal model:

wherein,for the driver to expect maximum deceleration, v _n (t) is the current speed of the own vehicle, v _n Is the driver desired speed, s _n (T) is the distance the driver expects to follow, T _n Is the distance s between the driver and the vehicle expected to follow _n Is the safety distance desired by the driver,is comfortable deceleration of driver, deltav _n (t) is the speed difference of two vehicles, R ₀ For minimum safe turning radius, δ is oneR and R ₀ The relevant constant, R, is the radius of curvature of the road.

Based on the driving risk index and the driving correction capability index, a Driver-control-Set (DCS) can be expressed as follows:

DCS＝{x∈R ⁴ |TTCi<TTCi ^max ,EA<EA ^max }

wherein,for maximum longitudinal risk index, EA ^max For maximum value of the longitudinal correction capability index, x= [ a ] _h v _h v _l l] ^T Is a vehicle longitudinal state vector, wherein a _h For self-vehicle acceleration, v _h Representing the speed of the vehicle, v _l For the front speed, l is the distance to follow.

3. And updating the boundary.

The known takeover capability boundaries conform to a lognormal distribution, the different characteristics of the driver are analyzed using the lognormal distribution, an index distribution adapted to each driver is fitted, and a cumulative distribution inverse function is used for setting the threshold.

The distributed parameters are updated online, so that the threshold value, namely the boundary, is updated online, and is adapted to the characteristics of the current driver, and the updating mode is as follows:

the update satisfies the following condition:

(1) Considering the situation of replacing the driver and the driver model, the system is reset when the vehicle speed is 0 in the algorithm because the driver can be replaced only when the vehicle is stopped;

(2) Since the distribution parameters of the previous moment need to be known when the threshold value is updated online, the initial distribution mean value and standard deviation are calculated by using the first 100 values of which the TTC is greater than 0 in the acquired following event in the current study;

(3) The invention does not consider the intention of a driver, and judges whether a steering lamp is started or not according to the lane change condition in the actual driving process;

(4) When the driver's ability drops to unreliable, the DCS will remain unchanged;

(5) If a truly occurring dangerous event is encountered during the actual calculation, the ES is discarded from 10s forward from that moment.

4. A vehicle state prediction module.

The longitudinal dynamics of a vehicle are described using a first order transfer function:

wherein,to the desired acceleration, a _s For actual acceleration, K, τ, and θ are steady-state gain, time constant, and time delay, respectively.

The rewritten as differential equation is:

the above formula may be abbreviated as:

wherein A, B and E are derived matrices, x= [ a ] _h v _h v _l l] ^T In the form of a vehicle state vector,for inputting commands to a vehicle, w=a _t To input a disturbance.

The control inputs u (t) and disturbances w (t) must be defined within the time interval t0, t0+m to predict vehicle behavior using the model described above.

Once the control input u (t) and the disturbance w (t) are defined. A vehicle state trajectory for a given input and disturbance condition may be calculated. By introducing a Pre (S) set, defined as input-output and perturbation wt at a given instant t, the state set x of S evolves in one step, namely:

5. the transition safety evaluation module (take over the transition module).

And the control module is used for entering the take-over transition module to wait for the meeting of the operation capability of the driver when the operation capability of the cloud driver is not met.

Starting from DCS, the prediction module is used recursively in M steps, intersecting the result set with DCS each time, under control input and interference signals, the current state set x (t ₀ ) Will remain in DCSThe aggregate sequence, the vehicle state held at the DCS is calculated as:

m＝M-1,…,0

at the time of calculationThe algorithm then continues to evaluate the security of the drive takeover. If state x (t ₀ ) At->Within range, the security flag is set to true and the switching procedure may be initiated to be taken over by the cloud security officer. If state x (t ₀ ) Not at->If the range is within, a flag is set to false, indicating that control should not be transferred to the cloud security officer. In this case, as shown in fig. 2, the autonomous vehicle remote takeover system should be switched to emergency stop to keep driving safety.

Claims (10)

1. The remote take-over method for the automatic driving vehicle is characterized in that during the control of the vehicle by an automatic driving system, whether the road environment exceeds the control boundary of the automatic driving system is judged, if yes, the take-over capability of a driver in the road environment is further evaluated, if the control capability of the driver is met, driving control authority is transferred to the driver, and otherwise, the control authority is transferred when the take-over transition module waits for the driver to take over the safety.

2. The method for remotely taking over an automatically driven vehicle according to claim 1, wherein after the driving control authority is transferred to the driver, the automatic driving control boundary evaluation module evaluates a new road environment and a vehicle state, and returns the driving control authority to the automatic driving system if the road environment falls within the automatic driving system control boundary.

3. The method for remotely taking over an automatically driven vehicle according to claim 1, wherein the following condition should be satisfied when transferring the driving control authority to the driver:

depending on the vehicle itself and the road conditions, the vehicle must be in an area that can be controlled by the driver;

the state of the vehicle must remain in this area for the time before the driver takes over completely.

4. A method of remotely taking over an autonomous vehicle according to claim 3, characterized by predicting the vehicle state in the time before the driver takes over completely by:

the dynamics of a vehicle are described using a first order transfer function:

wherein,to the desired acceleration, a _s For the actual acceleration, K, τ and θ are steady-state gain, time constant and time delay, respectively;

the above discrete reduction is a model as follows:

wherein A, B and E are derived matrices, x= [ a ] _h v _h v _l l] ^T In the form of a vehicle state vector,for inputting commands to a vehicle, w=a _t To input a disturbance;

the model is used to predict the vehicle state trajectory from the control inputs u (t) and disturbances w (t), by introducing a Pre (S) set, defined as the control inputs u (t) and disturbances w (t) at a given instant t, evolving in one step to a state set x of S, namely:

5. the method of remotely taking over an autonomous vehicle of claim 1, wherein the vehicle autopilot system control boundaries are determined by:

representing the scene considered by the automatic driving of the vehicle as a point in a scene parameter space, wherein each point corresponds to an input state of the automatic driving system of the vehicle to generate an output state; the vehicle automatic driving system G is arranged in the input space P ⁿ Point p on _i Input, the corresponding output is obtained as phi (p _i ) The method comprises the steps of carrying out a first treatment on the surface of the The boundary scene to be found exists in the scene parameter space;

by evaluating the function pair phi (p _i ) Evaluation was performed to obtain an evaluation value T (p _i ) The method comprises the steps of carrying out a first treatment on the surface of the For point p inside the boundary _in T (p) _in )>0; for points p outside the boundary _out T (p) _out )<0; the boundary is considered as the positive and negative crossing region of the evaluation value.

6. The method of remotely taking over an autonomous vehicle of claim 1, wherein the driver handling capacity is determined by:

the situation of accident is used for describing the state and the driving capability of a driver, and is characterized in that: a driver correction capability reliability field, the driver manipulation capability being determined according to the driver correction capability reliability field;

describing the correction capability of the driver by utilizing the deviation between the theoretical output value and the actual value under the normal capability of the driver, and representing the deviation by utilizing the absolute value of the error between the theoretical value and the actual operation value of the driver output by the driver model; steering wheel angle and acceleration are used to represent the lateral and longitudinal behavior of the driver, respectively.

7. The method for remotely taking over an autonomous vehicle according to claim 6, wherein the calculation formula of the deviation ES of the steering wheel angle and the deviation EA of the acceleration is as follows:

ES＝|SWA _C -SWA|

EA＝|a _c -a|

wherein SWA _C And a _c Representing the actual values of steering wheel angle and acceleration, respectively, SWA and a represent the model output values of the lateral and longitudinal behaviour of the driver, respectively, i.e. the theoretical values under normal driver capacity.

8. The method for remotely taking over an autonomous vehicle of claim 5, wherein the operator's takeover capability boundary is updated by:

the different characteristics of the drivers are analyzed by using the lognormal distribution, the index distribution suitable for each driver is fitted, and the core parameters mu and sigma in the lognormal distribution are updated:

mu at time t-1 is known _t-1 、σ _t-1 Sample size n _t-1 And sample value x at time t _t Mu at time t _t 、σ _t Can be calculated by the following formula:

9. the method of remotely taking over an autonomous vehicle of claim 6, wherein the updating of the driver take over capability boundary comprises the following:

1) Considering the situation of replacing the driver, resetting the driver takeover capability boundary when the vehicle speed is 0;

2) When the driver's ability drops to unreliable, the DCS will remain unchanged;

3) If a dangerous event actually occurs in the actual calculation process, the ES is abandoned from the moment to the data in the set time period.

10. The method for remotely taking over an autonomous vehicle according to claim 4, wherein the cloud security officer is evaluated for safety in taking over by:

starting from DCS, the prediction module is used recursively in M steps, each time intersecting the result set with DCS, the current state set x (t ₀ ) Will remain in DCSThe aggregate sequence, the vehicle state held at the DCS is calculated as:

m＝M-1,…,0

at the time of calculationAfter that, if state x (t ₀ ) At->Within the range, then considerTaking over safety for the driver, and transferring driving control authority to the driver; otherwise, switching to emergency stop.