Progressive-Density Fallback

Mechanism

The fallback architecture treats marker density as a measured operating variable rather than a binary deployment property. At each control epoch the vehicle estimates the local marker density from the rate at which marker observations are admitted into the perception pipeline over a trailing spatial window. The estimate is compared against a tier ladder; the tier whose admissibility window contains the current estimate selects the active operating mode. Hysteresis is applied to tier boundaries so that small fluctuations in observation rate do not produce mode chatter; an upgrade transition requires the estimate to exceed the upper tier threshold for a configurable dwell, while a downgrade transition takes effect at the moment the lower threshold is crossed.

The high-density tier admits marker observations as the primary source of routing and lane authority. Sensor-derived perception runs concurrently as a cross-check; disagreement above a bounded tolerance triggers a downgrade rather than overriding marker authority. The sparse tier admits marker observations as anchor points between which vehicle pose is propagated by inertial and odometric integration; sensor perception contributes lane-keeping and obstacle detection but does not assert routing authority. The dead-reckoning tier is entered when marker observations have been absent for longer than the sparse-tier tolerance; the vehicle propagates pose under bounded uncertainty and seeks corroboration from cross-mesh peers — neighboring vehicles whose own marker observations and pose estimates can be fused to constrain the local vehicle's state. The sensor-primary tier is entered when neither markers nor cross-mesh corroboration is available; the vehicle operates under a credentialed acknowledgment that the marker-track authority basis is absent, and the actuation gate restricts the operating envelope accordingly.

Every tier transition is recorded as a confidence-downgrade or confidence-upgrade event in the vehicle's lineage. The event captures the pre-transition tier, the post-transition tier, the measured density estimate, the dwell counter, and the credential under which the transition was taken. Downstream actuators consume the tier identifier together with the commit token; the tier identifier is a structural input to the actuation gate's mode selection and cannot be elided.

Operating Parameters

Tier thresholds are specified in marker observations per unit distance, with representative high-density thresholds in the range of one observation per several meters of travel and sparse thresholds an order of magnitude lower. The trailing window over which density is estimated is configurable; representative windows span tens to hundreds of meters depending on vehicle speed and geometry. Dwell counters for upgrade transitions are configurable in epochs and are tuned so that upgrade is conservative relative to downgrade, reflecting the asymmetry that an erroneous upgrade exposes the vehicle to higher-authority operation under inadequate evidence while an erroneous downgrade merely restricts the envelope.

Cross-mesh corroboration parameters include the maximum acceptable peer pose uncertainty, the maximum acceptable communication latency, and the minimum number of corroborating peers required to sustain dead-reckoning beyond a baseline duration. In representative deployments a single corroborating peer permits brief extension of dead-reckoning, two or more peers permit extended operation, and the absence of peers within the latency budget forces transition to sensor-primary within a bounded interval.

The operating envelope in each tier is parameterized by maximum speed, lane discipline, turn discipline, headway, and permissible action classes. The envelope at the high-density tier may exceed the envelope authorized for an equivalent vehicle operating without marker authority because the credentialed authority basis differs; the envelope at the sensor-primary tier matches that of the unmarked baseline. Envelopes are configured per jurisdiction and per vehicle class and are loaded into the actuation gate at credential install time.

Alternative Embodiments

The marker stream may be realized as passive optical fiducials read by onboard cameras, as active radio beacons, as embedded magnetic markers, as roadside transponders, or as any combination thereof. The fallback architecture is agnostic to marker physics; it consumes admitted observations regardless of the modality through which they were captured. Embodiments combining multiple marker modalities admit each modality as an independent observation stream, and density is estimated as a weighted aggregate; loss of one modality degrades density gracefully rather than triggering an immediate tier change.

Cross-mesh corroboration may be realized over direct vehicle-to-vehicle radio, over a cellular uplink to a fleet coordinator that relays neighbor state, or over a roadside intermediary. The architecture does not constrain the transport; it constrains only the latency and uncertainty bounds under which a peer observation may be admitted as corroborating evidence. Embodiments without any peer transport reduce to a three-tier ladder in which dead-reckoning is bounded by inertial drift alone.

The dead-reckoning tier may itself be subdivided. In one embodiment, a short-horizon dead-reckoning regime maintains the operating envelope of the sparse tier under tight uncertainty bounds, while a long-horizon dead-reckoning regime imposes a progressively tighter envelope as uncertainty grows. In another embodiment, the dead-reckoning tier is collapsed and the vehicle transitions directly from sparse to sensor-primary when marker observations cease; this embodiment trades operational continuity for simpler tier logic and is appropriate where cross-mesh corroboration is unreliable.

Tier selection may be driven by factors beyond marker density. In one embodiment, weather and lighting estimates contribute to the tier decision so that sensor-primary operation is restricted when sensor confidence is itself degraded. In another embodiment, governance state — for example, a regional override imposing a maximum tier — caps the admissible tier independent of measured density. In a further embodiment, the tier ladder is augmented with a maintenance tier in which the vehicle operates at a tightly bounded envelope while reporting marker-stream anomalies to a coverage-management service; this embodiment supports infrastructure operators who require feedback from the fleet about marker degradation without requiring vehicles to halt service while reporting.

The hysteresis policy admits variation. In one embodiment, hysteresis is applied symmetrically with a single dwell parameter governing both upgrade and downgrade transitions; this embodiment is appropriate where tier changes are inexpensive. In another embodiment, hysteresis is asymmetric, with a long upgrade dwell and a short downgrade dwell; this embodiment is appropriate where the cost of an erroneous upgrade dominates. In a third embodiment, hysteresis is parameterized by tier pair, so transitions across particular boundaries (notably the boundary into sensor-primary) carry distinct dwell discipline reflecting the regulatory significance of those transitions.

Composition

The fallback architecture composes with the broader marker-track transport stack as a layer between the perception pipeline and the actuation gate. The perception pipeline produces admitted marker observations and sensor-derived perception; the fallback layer consumes these and produces a tier identifier together with a pose estimate and a confidence descriptor; the actuation gate consumes the tier identifier and confidence descriptor as structural inputs to mode selection. The composition is strictly downward: the fallback layer does not itself command actuators, and the actuation gate does not itself estimate density.

Composition with fleet-level coordination is supported through the cross-mesh corroboration interface. A fleet coordinator may aggregate neighbor pose estimates and publish them to the local vehicle's corroboration consumer; the local vehicle treats the aggregated estimate as a single peer observation under bounded uncertainty. The fleet coordinator does not participate in tier selection; it provides only the evidence the local vehicle uses to sustain dead-reckoning.

Composition with regulatory frameworks is supported through the credentialing layer. The credential under which the vehicle operates declares the authorized envelopes per tier; the actuation gate enforces these envelopes unconditionally. A jurisdiction that prohibits marker-primary operation may issue credentials whose high-density envelope is no broader than the sensor-primary envelope; a jurisdiction that authorizes elevated marker-primary operation issues credentials with the broader envelope. The vehicle's behavior is the conjunction of measured tier and credentialed envelope.

Prior-Art Distinction

Prior art in marker-aided navigation treats marker absence as a fault condition. Systems designed around dense marker coverage degrade ungracefully when markers are missing: either they continue to operate under marker-primary semantics on the basis of stale observations, or they transition to a single fallback mode without graduated authority adjustment. Sensor-primary autonomous architectures, conversely, do not contemplate elevated authority under marker presence; markers, where consumed at all, are treated as supplementary localization aids without distinct envelope implications.

V2I architectures of the past two decades have assumed dense deployment as a precondition of value. The progressive-density architecture rejects this assumption: each tier delivers value at the density it admits, and the transition between tiers is part of the operating contract rather than a degraded mode. This permits incremental marker deployment to deliver incremental value, breaking the deployment-versus-adoption deadlock that has stalled prior V2I efforts.

Cross-mesh corroboration as a means of sustaining dead-reckoning past inertial drift bounds is distinct from cooperative perception schemes that share raw sensor data among vehicles. The architecture disclosed here shares pose estimates and marker observations under bounded uncertainty, not raw sensor streams; the bandwidth and latency requirements are correspondingly modest, and the corroboration semantics are explicit rather than implicit in fused perception.

The explicit confidence-downgrade lineage discipline distinguishes the architecture from systems in which fallback behavior is implicit in controller dynamics. In implicit-fallback systems the vehicle's degraded operation is a consequence of degraded inputs, but no record identifies the moment of degradation or the basis on which subsequent commits were made; downstream auditors must reconstruct the fallback from raw telemetry. The architecture disclosed here emits a structured downgrade event at every tier transition, including the measured density estimate and the credential under which the transition was taken, so that any post-incident audit can recover the operating tier at any past epoch without telemetry replay.

Disclosure Scope

The disclosure encompasses the progressive-density fallback architecture independent of marker modality, communication transport, sensor suite, vehicle class, or jurisdiction. The inventive contribution lies in the tiered authority ladder with explicit confidence-downgrade transitions, in the use of cross-mesh corroboration to sustain dead-reckoning under bounded uncertainty, and in the structural composition with the actuation gate such that tier identifier is an unconditional input to mode selection. Embodiments described herein are illustrative; variations in tier count, threshold values, dwell parameters, corroboration transport, and envelope specification fall within the scope of the disclosure provided they preserve the graduated-authority property and the explicit-downgrade lineage discipline.