Remote control autonomous vehicle with operator protection and terrain dynamics

An electronic control unit for controlling an operation of a vehicle, the electronic control unit comprising:

• a first processor configured to receive instructions from a remote operator via a remote teleoperation device to actuate one or more subsystems to perform the operation of the vehicle, the first processor not having a direct communication connection to the one or more subsystems;
• and
• a second processor communicably coupled to the first processor, the second processor configured to:
• receive requests from the first processor associated with carrying out the instructions from the remote operator;
• filter the requests to determine safe requests that satisfy safety rules;
• and
• in response to the requests satisfying the safety rules, actuate the one or more subsystems to perform the safe requests, wherein the second processor is further configured not to actuate the one or more subsystems for denied requests based on terrain dynamics of an environment of the vehicle, the environment including at least one of road surface traction, terrain slope, or center-of-gravity predictions.

A method implemented by an electronic control unit for controlling an operation of a vehicle, the method comprising:

• receiving, by a first processor of the electronic control unit, instructions to actuate one or more subsystems of the vehicle, the instructions received from a remote operator via a remote teleoperation device, the first processor not having a direct communication connection to the one or more subsystems of the vehicle;
• receiving, by a second processor of the electronic control unit and from the first processor, requests associated with carrying out the instructions from the remote operator;
• filtering, by the second processor, the requests by permitting the instructions that satisfy safety rules;
• and
• in response to the requests satisfying the safety rules, actuating the one or more subsystems, by the second processor, to perform the instructions that satisfy the safety rules, wherein the second processor does not actuate the one or more subsystems for denied requests based on terrain dynamics of an environment of the vehicle, the environment including at least one of road surface traction, terrain slope, or center-of-gravity predictions.