Mechanism

The marker is a passive device installable in roadway, lane edge, shoulder, or other infrastructure positions, integrating a human-perceptible indicator with machine-readable data communication from the same installed device. The disclosure describes the human-perceptible indicator as a retroreflective surface, a light-emitting element, a painted surface, or a tactile feature, so that the marker remains visible to human operators and to camera-based vehicle perception. The machine-readable channel is a passive integrated circuit with non-volatile memory storing a governed data record, with the marker harvesting energy from interrogation signals and modulating responses back to the interrogator through radio-frequency backscatter. The device may instead employ passive optical retroreflection with data modulation, a surface-acoustic-wave chipless identifier, or another disclosed passive modality. The marker carries no internal battery and is housed in a physical enclosure sealed for the installation environment.

In an active-illumination embodiment, the marker adds a photovoltaic cell, a charge-storage element, and a light-emitting element, providing active visible delineation during low-light conditions.

The dual-use property is structural, not coincidental. A vehicle passing the marker may extract a positioning constraint from the human-perceptible return observed against the vehicle's perception geometry while reading the stored governed data record. The two extractions are independent measurement channels grounded in the same physical device. In a multi-modal embodiment, the marker provides a response through multiple physical channels, radio-frequency plus optical, radio-frequency plus magnetic, or any combination, producing redundant authentication.

Both uses are governed under a single governance chain. The marker's stored data record carries a marker identifier, a spatial-reference field, an authority credential, a revision-version field, and a cryptographic integrity attestation binding the stored data to the authority. A marker-track lineage recorder records each marker read, navigation determination, and admissibility evaluation in the governance-chain lineage field, so that a positioning observation and a data-record reading derived from the same marker are recorded with their provenance rather than combined silently.

Operating Parameters

The stored data record is compact enough to be transmittable in a single backscatter read event at operational velocities. In an exemplary automotive embodiment at highway velocity, a 32-byte record transmittable in a single read satisfies the read-rate constraints.

The active-illumination subsystem, when present, draws on the photovoltaic cell and charge-storage element to provide visible delineation during low-light conditions.

Governance is enforced through the stored data record's authority credential, temporal-scope, and cryptographic-attestation fields. A credentialing authority may emit a revocation governed observation identifying a specific marker, credential, or credential class as no longer authoritative, and consuming devices down-weight or invalidate previously-admitted messages emitted under the revoked credential. The governed data record additionally carries a temporal-validity bound, and semi-passive and ephemeral marker embodiments carry a governance-policy-defined time-to-live.

Alternative Embodiments

In a surface-adhesive embodiment, the device is mounted to the pavement surface in the same workflow as conventional raised pavement markers and requires no civil-works modification. In a recessed embodiment, the device is embedded within the pavement. The device may also attach by mechanical fastening, by magnetic attachment to a ferromagnetic substrate, or by integration into a pre-fabricated infrastructure component such as a road stud, guardrail reflector, bollard, post cap, lane reflector, sign post, or overhead gantry.

In a semi-passive embodiment, the marker adds a small-battery-backed data response element with a governance-policy-defined time-to-live. In an active embodiment, the marker has dedicated power and continuous broadcast capability, supporting governance-policy-configurable active and passive response modes and credential rotation. These embodiments suit installations such as regulatory-zone entry and exit points and access-controlled segments where dynamic credentials are warranted.

In a multi-modal embodiment, the marker responds through multiple physical channels, for example radio-frequency plus optical or radio-frequency plus magnetic, producing redundant authentication.

In a degraded embodiment, the device continues to provide its human-perceptible delineation function even when the machine-readable channel has failed, and the operating unit's cognitive architecture gracefully degrades under reduced confidence rather than forcing a binary failure. Human-operator function through the passive signaling mechanism is preserved.

In a non-roadway embodiment, the same construction is applied to rail wayside, port apron, warehouse floor, or other surface markings, where the dual-use property holds with a different reader population of human operators and autonomous equipment. The governance and lineage requirements transpose directly.

Composition With Other Primitives

The dual-use marker composes with the marker-track transport primitive by contributing credentialed marker-read observations to the authority-validated interrogator-and-response mechanism, and by delivering signed routing authority through the route-manifest constructor. The single governance chain and the marker-track lineage recorder together reduce a class of failure mode in which a single physical compromise, such as a displaced or substituted marker, would otherwise corrupt both the vehicle's position estimate and its routing decisions.

The marker composes with the vehicle's composite admissibility evaluation: a credentialed marker read that is consistent with the consensus-calibrated marker coordinates is admissible, while a reading inconsistent with those coordinates produces a governed calibration-anomaly observation flagging possible marker displacement for maintenance investigation. The adversarial-marker rejection mechanism contributes substitution-attack and replay-attack rejection on top of this.

Threat Model and Audit Requirements

The disclosure describes adversarial-marker rejection mechanisms that include, without limitation, replay-attack rejection detecting previously-observed marker reads replayed at new locations or times, injection-attack rejection detecting fabricated marker reads inserted through adversarial emission, substitution-attack rejection detecting unauthorized marker-payload substitution at a deployment location, tampering-attack rejection detecting physical-tampering evidence, supply-chain-attack rejection detecting markers with invalid manufacture provenance, denial-attack rejection detecting marker-coverage denial that forces the unit into governed fallback, and composite-attack rejection detecting coordinated multi-vector campaigns.

Marker displacement is addressed through consensus calibration: a marker whose coordinates are observed to drift from the consensus of pass-readings produces a governed calibration-anomaly observation flagging possible marker displacement for maintenance investigation. A reading inconsistent with the marker's consensus-calibrated coordinates is treated as inadmissible regardless of the credential's validity. Credential revocation is addressed through revocation governed observations: a credentialing authority emits a revocation identifying a specific marker, credential, or credential class, and consuming devices down-weight or invalidate messages emitted under the revoked authority, subject to a governance-policy-defined retroactive-effect window.

Rejection events are not merely logged. A marker-rejection-lineage recorder records each rejection event, the applied evaluator, and the supporting evidence, and rejections trigger a governance-chain-preserving graduated response with cascade propagation to adjacent units and infrastructure agents. The marker-track lineage recorder likewise records each marker read, navigation determination, and admissibility evaluation, so that the provenance of a combined positioning and data-record use is auditable in the governance chain.

Lifecycle, Installation, and Maintenance

The marker is intended for installation through standard roadway-marking workflows, with no specialized civil works required for the surface-adhesive and fastener-mounted embodiments. The disclosure describes deployment by untrained personnel, wherein approximate initial coordinates are supplied at installation and precise coordinates emerge through accumulated pass-readings from equipped operating units, without requiring precision-survey equipment at installation. The marker's enrollment is recorded as a governed observation in a credentialing-authority registry.

Maintenance can rely on the consensus-calibration mechanism, which supports drift detection by comparing a marker's observed coordinates to the consensus of pass-readings. Marker data updates are authority-credentialed and lineage-recorded, with update patterns that are governance-policy-configurable across peer-vehicle, infrastructure-mediated, scheduled, and event-driven modes. When a marker is decommissioned, the credentialing authority emits a revocation governed observation so that any device reusing the revoked credential is rejected.

Prior-Art Distinction

The disclosure distinguishes its passive environmental markers from prior radio-frequency-identification-based vehicle-positioning systems and prior passive-marker systems on several grounds. First, the markers are integrated with the physical delineation devices of the navigable infrastructure, providing dual human-perceptible delineation and machine-readable spatial-data communication from a single installed device, rather than standalone identifier tags positioned separately from existing delineation. Second, the markers encode local-geometry parameters representing the navigable segment at each marker's location, rather than encoding only a marker identifier or relay-point code to be looked up against a remote database. Third, the markers form one tier of a multi-tier architecture of passive markers, active sentinels, and cognitive agents as independently deployable, progressively composable layers, rather than a single-tier tag-and-reader architecture. Fourth, the stored data is authority-credentialed, lineage-linked, composite-admissibility-evaluable, and integrated into a governance chain, rather than an un-credentialed identifier. Fifth, the marker primitive is signaling-mechanism-independent, embracing any of the disclosed passive signaling mechanisms rather than being limited to a specific radio-frequency backscatter implementation. The contribution lies in this integration and governance binding, not in any individual physical layer.

Disclosure Scope

This article describes subject matter disclosed in U.S. Provisional Application No. 64/049,409. The disclosure covers the dual-use marker that combines a human-perceptible indicator with machine-readable governed data communication from the same installed device, the passive, semi-passive, active, hybrid, multi-modal, embedded-infrastructure, mobile-deployed, ephemeral, and active-illumination marker embodiments, the governed data record and its compact single-read transmission at operational velocities, the governance-chain credentialing and marker-track lineage recording, the consensus-calibration and adversarial-marker rejection mechanisms, and the composition with the marker-track transport primitive and the composite admissibility evaluation.