Secure software communication with autonomous vehicles
Techniques for engaging and disengaging a vehicle from an autonomous operation mode are described. The techniques include receiving a request to engage or disengage the autonomous mode at a teleoperations system. The request is validated at the teleoperations system using a first set of conditions describing trust in the request and validity of the request. The request is then sent, if valid, to the vehicle where a second validation is performed using a second set of conditions describing the conditions or states of the vehicle. If the second conditions are valid then the request is performed and the vehicle engages or disengages from autonomous mode.
1 . A teleoperations system comprising:
one or more processors; and
one or more non-transitory computer-readable media storing instructions executable by the one or more processors, wherein the instructions, when executed, cause the one or more processors to perform operations comprising:
receiving first data from an autonomous vehicle;
receiving, as input remote from the autonomous vehicle, a request to transition the autonomous vehicle between a first mode associated with an autonomous mode and a second mode associated with a disengaged autonomous mode of the autonomous vehicle;
determining, based at least in part on a set of first validity conditions, the request, and the first data, a first validity associated with the request,
wherein the set of first validity conditions comprising determining whether the first data comprises an authorization to submit the request and determining whether the request comprises a valid operation for the autonomous vehicle to perform;
transmitting, based at least in part on the first validity, the request; and
receiving, from the autonomous vehicle, second data indicative of:
a successful transition between the first mode and the second mode based at least in part on a set of second validity conditions being fulfilled, wherein the set of second validity conditions comprises determining whether an operating status of the autonomous vehicle indicates that the autonomous vehicle is on a mission or in a standby mode; or
a rejection of the request transition between the first mode and the second mode based at least in part on the set of second validity conditions not being fulfilled.
2 . The teleoperations system of claim 1 , wherein the set of first validity conditions comprises determining whether the first data comprises an authorization to submit the request and determining whether the request comprises a valid operation for the autonomous vehicle to perform disengaged autonomous mode is a semi-autonomous driving mode and wherein the autonomous vehicle receives input from a remote teleoperations system to perform a portion of driving tasks of the autonomous vehicle.
3 . The teleoperations system of claim 2 , wherein the set of second first validity conditions comprises determining whether an operating status of the autonomous vehicle indicates that the autonomous vehicle is on a mission or in standby mode a format of the request is proper.
4 . The teleoperations system of claim 2 , wherein the set of second validity conditions comprises determining whether a vehicle location is within a geographical region and whether a vehicle motion status is stopped.
5 . The teleoperations system of claim 2 , wherein the valid operation for the autonomous vehicle to perform comprises engaging the autonomous mode in a safe area.
6 . A method comprising:
receiving first data from an autonomous vehicle;
receiving, from a computing device remote from the autonomous vehicle, a request to cause the autonomous vehicle to transition between operating in a first mode and operating in a second mode;
determining, based at least in part on the first data, the request, and a first set of conditions, a first validity associated with the request,
wherein the first validity associated with the request comprises determining whether the first data comprises an authorization to submit the request and determining whether the request comprises a valid operation for the autonomous vehicle to perform;
sending the request to the autonomous vehicle based at least in part on the first validity associated with the request; and
receiving an acknowledgement from the autonomous vehicle comprising of one or more of:
a second validity associated with the request based on a second set of conditions different from the first set of conditions, wherein the second validity associated with the request comprises determining whether an operating status of the autonomous vehicle indicates that the autonomous vehicle is on a mission or in a standby mode; or
an indication that the autonomous vehicle is performing or will perform the transition between operating in the first mode and operating in the second mode.
7 . The method of claim 6 , wherein determining the first validity associated with the request comprises determining a first validity score based at least in part on the first data, the method further comprising one or more of:
rejecting the request based on the first validity score being less than a threshold validity score, or
transmitting a notification to the computing device remote from the autonomous vehicle based at least in part on the first validity score being less than the threshold validity score.
8 . The method of claim 6 , further comprising receiving a different indication that the request was rejected based at least in part on a condition of the second set of conditions being unsatisfied.
9 . The method of claim 6 , wherein the first validity associated with the request is based at least in part on a trust score associated with the computing device remote from the autonomous vehicle.
10 . The method of claim 6 , wherein the first validity associated with the request is based at least in part on determining that an action associated with the request is one of a set of actions comprising engaging an autonomous mode of the autonomous vehicle in a safe area.
11 . The method teleoperations system of claim 1 , wherein the second validity is based at least in part on an operating status of the rejection comprises one or more rejection reasons and is displayed at a user interface of a user device.
12 . The method of claim 6 , wherein the request comprises an additional action for the autonomous vehicle to perform to fulfill the second set of conditions before performing an action.
13 . The method of claim 6 , wherein determining the first validity associated with the request further comprises determining whether a format of the request is proper and whether a type of action included in the request comprises a valid type.
14 . The method of claim 6 , wherein the second validity associated with the request is based at least in part on determining a vehicle state of the autonomous vehicle and whether a vehicle location is within a geographic area.
15 . One or more non-transitory computer-readable media storing instructions executable by one or more processors, wherein the instructions, when executed, cause the one or more processors to perform operations comprising:
receiving first data from an autonomous vehicle;
receiving, from a computing device remote from the autonomous vehicle, a request to transition the autonomous vehicle between a first mode associated with an autonomous mode and a second mode associated with a disengaged autonomous mode of the autonomous vehicle;
determining, based at least in part on a set of first validity conditions, the request, and the first data, a first validity associated with the request,
wherein the set of first validity conditions comprising determining whether the first data comprises an authorization to submit the request and determining whether the request comprises a valid operation for the autonomous vehicle to perform;
transmitting, based at least in part on the first validity, the request; and
receiving, from the autonomous vehicle, second data indicative of:
a successful transition between the first mode and the second mode based at least in part on a set of second validity conditions being fulfilled, wherein the set of second validity conditions comprises determining whether an operating status of the autonomous vehicle indicates that the autonomous vehicle is on a mission or in a standby mode; or
a rejection of the request transition between the first mode and the second mode based at least in part on the set of second validity conditions not being fulfilled.
16 . The one or more non-transitory computer-readable media of claim 15 , wherein the set of first validity conditions comprises determining whether the first data comprises an authorization to submit the request and determining whether the request comprises a valid operation for the autonomous vehicle to perform rejection comprises one or more rejection reasons and is displayed at a user interface of a user device.
17 . The one or more non-transitory computer-readable media of claim 16 , wherein the set of second first validity conditions comprises determining whether a vehicle operating status indicates that the autonomous vehicle is on a mission or in standby mode format of the request is proper.
18 . The one or more non-transitory computer-readable media of claim 15 , wherein the set of second validity conditions further comprises determining whether a vehicle location is within a geographical region and whether a vehicle motion status is stopped.
19 . The one or more non-transitory computer-readable media of claim 15 , wherein the valid operation for the autonomous vehicle to perform comprises engaging the autonomous mode in a safe area.
20 . The one or more non-transitory computer-readable media of claim 15 , wherein the second mode is a semi-autonomous driving mode and wherein the autonomous vehicle receives input from a remote teleoperations system to perform a portion of driving tasks of the autonomous vehicle.