Credentialed Markers as Primary Routing Reference

Mechanism

The disclosed mechanism rests on a strict ordering of evidentiary sources. Markers physically embedded in or on a credentialed road segment carry signed payloads identifying the issuing jurisdictional authority, a unique segment identifier, the lane class and geometry of the marker's position, applicable speed and behavioral envelopes, and time-bounded advisory flags such as construction, weather degradation, or emergency reroute. Each marker payload is signed under a credential chain anchored at the segment-issuing authority, and the chain itself is bound to a publicly auditable jurisdictional registry. As the vehicle traverses the segment, its marker reader consumes the stream and emits credentialed observations into the vehicle's composite admissibility evaluator.

The admissibility evaluator treats credentialed marker observations as the primary routing reference. The route manifest, defined as the ordered set of segments, lanes, speeds, and behavioral authorizations the vehicle is permitted to execute, is constructed exclusively from credentialed observations under nominal operation. Sensor-derived observations from cameras, lidar, radar, and inertial systems are admitted as secondary cross-checks: they may corroborate, contradict, or supplement credentialed observations, but they cannot independently authorize the vehicle to occupy a lane, exceed a speed envelope, or execute a maneuver that the credentialed stream has not authorized. When credentialed and sensor observations agree, the admissibility score is high and the vehicle proceeds at full operational confidence. When they disagree, the vehicle enters a constrained mode in which it executes only the intersection of what both sources authorize, biased toward the more conservative of the two.

A fallback path is explicitly disclosed for conditions in which the credentialed stream is unavailable or degraded. If markers are missing, occluded, or fail credential verification across a contiguous segment of road, the vehicle transitions to a sensor-primary fallback mode under bounded authority: it may continue at reduced speed and constrained lane authority for a bounded distance or duration sufficient to reach the next credentialed segment or a safe stopping location. The fallback mode is not a substitute for credentialed operation; it is a degraded continuation that is logged, reported to the jurisdictional authority, and that triggers a credential-stream re-acquisition handshake at the next available marker. The vehicle never silently promotes uncredentialed observations to primary status; the transition is explicit, time-bounded, and auditable.

Operating Parameters

Marker spacing along a credentialed segment is governed by the lane class and the maximum authorized speed. Higher-speed segments require denser marker placement to maintain a minimum credentialed-observation rate at the reader. The disclosure contemplates marker-to-marker intervals tuned to deliver at least one credentialed observation per second at the segment's posted maximum speed, with denser placement at decision points such as merges, exits, and intersections where the route manifest requires finer-grained authority.

Credential freshness is bounded by signature validity windows tied to the issuing authority's key rotation schedule. A marker whose credential has expired is treated as uncredentialed and contributes only as a sensor-equivalent secondary observation; the vehicle does not silently honor stale credentials. Revocation is propagated through over-the-air updates to the vehicle's trust store and through revocation flags carried in adjacent valid markers, providing redundant revocation paths.

Signature schemes are policy-defined and may be selected per jurisdiction. The disclosure contemplates conventional asymmetric schemes, post-quantum schemes for jurisdictions that anticipate cryptographic transition, and threshold schemes in which a marker payload is signed jointly by multiple authorities. The vehicle's trust store carries the public-key material for every jurisdiction whose segments the vehicle is authorized to operate on, and the trust store is updated through a credentialed update channel that itself uses the same signature primitives the marker system uses, providing a uniform cryptographic surface from trust-store update through marker verification.

Admissibility thresholds are policy-configurable per jurisdiction. A jurisdiction may require a minimum credentialed-observation rate, a minimum agreement ratio between credentialed and sensor observations, and a maximum permissible duration in fallback mode before the vehicle must execute a safe-stop. These parameters are not embedded in the vehicle firmware as constants; they are carried in the segment credential itself, allowing per-segment tuning without vehicle recertification.

Alternative Embodiments

The disclosure contemplates multiple physical realizations of the credentialed marker. A first embodiment uses passive RFID transponders embedded in the road surface, energized by a vehicle-mounted reader and returning a signed payload. A second embodiment uses optical markers, including retroreflective patterns and machine-readable codes embedded in lane striping, read by a vehicle-mounted camera under controlled illumination. A third embodiment uses magnetic markers whose field signatures encode the credentialed payload, read by a vehicle-mounted magnetometer array. A fourth embodiment uses short-range radio beacons mounted on roadside infrastructure rather than embedded in the surface. The credentialing logic is independent of the physical modality; any modality that can deliver a signed payload to a vehicle reader at the required rate is within scope.

Hybrid embodiments combine multiple marker modalities on the same segment to provide redundancy against single-modality failure. A segment may carry both RFID and optical markers, with the admissibility evaluator treating concordant readings across modalities as higher-confidence than single-modality readings. The fallback path is then triggered only when all modalities fail simultaneously, raising the bar for fallback entry and reducing the duration the vehicle spends in degraded operation.

The disclosure also contemplates embodiments in which the credentialed stream is supplemented by a credentialed wireless channel carrying segment-wide advisories that are not tied to a specific marker location. Such channel-borne credentials must satisfy the same signature and freshness requirements as marker-borne credentials and are subject to the same primary-secondary ordering relative to sensor observations.

Composition with Vehicle Operation

The credentialed marker stream composes with the vehicle's existing perception, planning, and control stack without displacing it. The perception stack continues to detect and classify obstacles, road users, and environmental hazards. The planning stack continues to generate trajectories. The control stack continues to execute those trajectories. What changes is the source of authority for routing decisions: the route manifest that the planner consumes is now constructed from credentialed observations, and the planner is constrained to generate trajectories that lie within the manifest's authorizations.

This compositional structure preserves the manufacturer's investment in the sensor stack and its associated machine learning models. The sensor stack is not replaced; it is repositioned. Its outputs continue to drive obstacle avoidance, emergency braking, and fine-grained trajectory optimization, all of which operate within the envelope the credentialed stream has authorized. The vehicle remains fully autonomous in the sense that no human input is required during operation; it is the source of routing authority that has been inverted, not the operational autonomy itself.

Liability allocation follows the compositional structure. The jurisdictional authority that signs the segment credential is accountable for the correctness of the segment's geometry, lane class, and posted envelopes. The vehicle manufacturer is accountable for the correctness of the marker reader, the credential verification logic, and the admissibility evaluator. The fleet operator is accountable for keeping the vehicle's trust store current and for executing the fallback path correctly when it is invoked. Each party's accountability is bounded and auditable.

Prior-Art Distinction

Existing autonomous-vehicle architectures treat sensor-derived perception as the primary routing authority and treat any infrastructure-borne signal, where present at all, as advisory. V2X and DSRC deployments to date have positioned roadside-issued messages as supplementary inputs to a sensor-primary planner, not as the authoritative source of routing authority. The disclosed mechanism inverts this ordering: credentialed markers are primary, sensors are secondary cross-checks, and the inversion is enforced structurally by the admissibility evaluator rather than by convention.

Prior credentialing schemes for vehicles have focused on the vehicle as the credentialed entity, with the road treated as a passive surface. The disclosed mechanism credentials the road segment itself and reduces vehicle certification to a demonstration of correct credentialed-stream consumption. This shift in the locus of credentialing is the structural distinction over the prior art.

Existing high-definition map approaches pre-load the vehicle with a static representation of the road and treat real-time observations as updates to that map. The disclosed mechanism is not map-based: the segment authority is delivered in the credentialed stream at the moment of traversal, signed by the issuing jurisdiction, and bounded by freshness windows that reflect the live state of the segment. A pre-loaded map cannot represent a dynamic advisory flag such as a construction lane closure or an emergency reroute; the credentialed marker stream carries those flags inline. The marker-primary architecture therefore subsumes the routing role that maps have historically played while adding the credential and freshness properties that maps lack.

Connected-vehicle proposals based on cellular V2X have positioned a wireless channel as the bearer of road authority. The disclosed mechanism does not require continuous wireless coverage and does not depend on a backhaul to a remote authority at the moment of traversal. The credential is physically present at the marker, signed offline by the issuing authority, and verified locally by the vehicle. The architecture is therefore robust to wireless outages, jurisdictional handoffs, and the long tail of physical environments in which cellular service is unreliable.

Disclosure Scope

U.S. Provisional Application 64/049,409 discloses the credentialed-marker-primary architecture, the fallback path, the marker modalities, the admissibility evaluator, and the per-segment policy mechanism. The scope reaches any vehicle that consumes a credentialed marker stream as its primary routing reference on a credentialed segment, regardless of the manufacturer of the sensor stack, the physical modality of the marker, or the specific signature scheme used to credential the payload.

Once a jurisdictional authority adopts marker-track per-segment certification as a precondition for commercial autonomous operation within its boundaries, every fleet operating on those segments must integrate with the credentialed-marker-primary architecture. The disclosure scope is therefore co-extensive with the regulatory adoption surface, and the regulatory narrative, the alignment between the certification model and the actual expertise of the road-owning authority, is the structural moat that drives that adoption.

The disclosure also reaches the certification process itself. A vehicle is certified to operate on credentialed segments by demonstrating, in a controlled test environment, that its marker reader correctly consumes a representative credentialed stream, that its admissibility evaluator correctly applies the primary-secondary ordering, that its fallback path is correctly triggered and bounded, and that its trust store is correctly maintained. The certification surface is bounded, auditable, and within the actual expertise of the certifying authority. The fleet operator's continuing obligation is to maintain the trust store and to report fallback-mode incidents; this obligation is ongoing but bounded and is well within the surface that fleet operators already manage for safety-related software updates and incident reporting.