System, method, and apparatus to mitigate and or prevent autonomous vehicle misuse through the use of security enabled sensors

Methods and systems for implementing autonomous vehicle security features. The present invention details an effective and secure methodology to implement the external management and control of autonomous vehicles by authorized personnel, usually law enforcement, through the use of intelligent sensors that can override an autonomous vehicle controller's functionality as necessary.

TECHNICAL FIELD

The present invention relates generally to an improved data processing system and in particular to a method and apparatus for implementing security features using Autonomous Vehicle (AV) sensors. Still more particularly, the present invention provides for dedicated or integrated sensors that allow override of vehicle functions by authorized personnel, specifically allowing the shutdown and/or management of an AV by external means.

BACKGROUND OF THE INVENTION

The field of autonomous vehicle control is currently emerging as a promising technology that can reduce costs, reduce accidents and loss of life, reduce insurance premiums, increase productivity for workers in transit and potentially eliminate drunk driving and the associated losses; however, recent misuse of vehicles by terrorists demands that the technology be proactive to develop a comprehensive threat model, as well as mitigation and prevention methodologies rather than reacting to the consequences.

Autonomous vehicles are categorized by the Society of Automotive Engineers (SAE) in specification J3016, Autonomy Levels as follows:Level 0: Automated system issues warnings and may momentarily intervene but has no sustained vehicle control.Level 1: Driver and automated system shares control over the vehicle. An example would be Adaptive Cruise Control (ACC) where the driver controls steering and the automated system controls speed. Using Parking Assistance, steering is automated while speed is manual. The driver must be ready to retake full control at any time.Level 2: The automated system takes full control of the vehicle accelerating, braking, and steering. The driver must monitor the driving and be prepared to immediately intervene at any time if the automated system fails to respond properly.Level 3: The driver can safely turn their attention away from the driving tasks, e.g. the driver can text or watch a movie. The vehicle will handle situations that call for an immediate response, like emergency braking. The driver must still be prepared to intervene within some limited time when called upon by the vehicle to do so (specified by the manufacturer).Level 4: As level 3, but no driver attention is ever required for safety, i.e. the driver may safely go to sleep or leave the driver's seat. Self driving is supported only in limited areas or under special circumstances, like traffic jams. Outside of these areas or circumstances, the vehicle must be able to safely abort the trip, i.e. park the car, if the driver does not retake control.Level 5: No human intervention is required. e.g., robotic taxi.

Because of this recent technology's development, there are currently few commercially available autonomous vehicles available for sale worldwide, however, the very nature of an autonomous vehicle provides a large measure of anonymity and therefore the possibility of subsequent misuse. Additionally, a majority of the AVs under development are electric AVs that are much easier to drive and therefore will provide a larger potential for misuse. Misuse can be intentional as in the case of a terrorist's use of an autonomous truck to deliver explosive devices or mow down pedestrians in crowded venues; however, misuse can also be accidental as in the case of sensor failure, environmental conditions that interfere with sensor operations, driver medical issues, failure of mechanisms to secure vehicle loads, or third party misuse such as skitching or hooky bobbing, as well as any other of a multitude of real-world problems yet to be discovered.

It is clear that at AV Level 2 and above, where all control has been relinquished to the AV, there is the need for additional external control applied by authorized personnel, usually law enforcement, for mitigating and/or preventing misuse. At Level 2 after a driver has relinquished control, the driver could possibly have an incapacitating medical event that prevents proper control of the vehicle and if no external stimulus can provide access to the vehicle, the driver may not receive medical treatment promptly. As the level of autonomy increases, there are many additional factors that demand the development of a comprehensive policy and threat model, as well as mitigation and prevention methodologies. The policies and methodologies must meet all regulatory requirements for all jurisdictions where the AV is operated as the industry is subject to many additional rules and regulations such as required by the USG Federal Motor Carrier Safety Administration (FMCSA) e.g., Federal Motor Carrier Safety Regulations (FMCSRs).

The trucking industry is heavily regulated and in the normal course of business, Level 1 Class 8 vehicles are frequently required to stop for various inspections; in transit, intrastate weigh stations, border weigh stations, agricultural, etc. Additionally, law enforcement is frequently required to pull these vehicles over (lawfully stop) to issue violations for overweight loads, safety violations, or to alert the driver there are issues with vehicle or load. Level 5 vehicles do not magically make these disappear, law enforcement will have the same (and possibly more) reasons to stop the vehicle.

A partial list of requirements for lawful stop and search of Level 2 and above AVs are as follows:

A) The connection protocol must provide cryptographic mechanisms to:1) identify and authenticate the entity performing Lawful Stop as authorized law enforcement personnel,2)command messages and replies must be confidential and free of errors,3) messages must have both non-repudiation of origin and non-repudiation of receipt

B) In non-emergency situations:1) Indicate law enforcement's command received and action is in progress2) If message is “Stop”, the AV must safely pull off the right of way and stop, and:a) communicate with dispatchi) Notify owner/operator the vehicle is being stoppedii) Send law enforcement's credentials for records1) Identification,2) Method for authentication3) Jurisdiction,4) location and time,b) communicate with law enforcement to provide any necessary information,3) possibly relinquish control of vehicle to law enforcement,4) unlock cargo compartment upon request for inspection,5) lock cargo compartment,6) safely retake control of the vehicle,7) safely resume operation,

C) If message is “EmergencyStop”, the AV must apply all means to stop immediately,

D) Obey all “Fence” commands immediately by requesting reroute map and immediately reroute around restricted area.

Currently, the lawful stop of a vehicle depends on visual verification of law enforcement, i.e., the police vehicle, police uniform and the badge; unfortunately, unmarked police cars and a rising mistrust of law enforcement makes these inadequate, if a computer could perform these actions. The opportunity to improve these outdated metrics and move to secure methodologies requires that Level 2 and above autonomous vehicles use the best technology available and that was designed to provide law enforcement's identification and authentication, message integrity, message confidentiality, non-repudiation of origin and non-repudiation of receipt.

The current marketing blitz being waged by more than 20 AV manufacturers doesn't discuss AV Control System security, the use of recognized international standards for software development or the testing methodologies of the AV control system. They certainly don't disclose the dangers posed to the public by AVs used responsibly, or under normal misuse cases, or much less, the use of these vehicles by terrorists. Without secure control systems, i.e., developed with secure development practices, tested, evaluated and approved by third party experts, AVs are easily usable by terrorists as delivery programs for weapons.

Therefore, all Level 2 and above AVs must implement lawful stop and search that is independent of the vehicle's controller. Because all computer systems are much more vulnerable to exploit when an attacker has physical control of the device, the lawful controller must be implemented in a tamper-proof enclosure, as should the vehicle controller, sensor system, and all sensor wiring. It is recommended that a FIPS 140-2 Level 4 specification be used for guidance.

Additionally, the software and hardware should be subject to review by third party experts; it is suggested as a minimum that they undergo a Common Criteria evaluation as well as FIPS 140-2 Level 4 certification.

Most importantly, lawful stop and search must take into account that any Level 2 and above AV can be effectively used as a terrorist's weapon acting a great distance. When contemplating the use of Class 8 AVs as a weapon, the true gravity of the situation appears clear, an 80,000 lb weapon is frightening and cannot be ignored.

It is readily apparent that many threats and extensive regulations are present, but unsolved for this emerging technology; therefore, it would be advantageous to have an improved method and apparatus to prevent autonomous vehicle misuse.

SUMMARY OF THE INVENTION

The present invention provides a system, method and apparatus to prevent autonomous vehicle misuse. The exemplary aspects of the present invention details an effective and secure methodology to implement the external management and/or shutdown of autonomous vehicles by authorized personnel through the use of intelligent sensors that can override functionality as necessary.

DETAILED DESCRIPTION OF THE INVENTION

With reference now to the figures, and in particular with reference toFIG. 1, a block diagram depicting a typical Autonomous Vehicle (AV) with AV Controller and Sensor System100in which the present invention may be implemented. Those of ordinary skill in the art will appreciate that the AV Controller and the sensor systems may vary according to the manufacturer, design requirements, requirements mandated by local and federal regulatory bodies, as well as intended usage. Depicted inFIG. 1is an autonomous vehicle with AV Controller130and the various sensors currently being designed for autonomous vehicles; direction of forward travel is indicated by arrow. These diagrams show long range radar sensor coverage101, medium radar coverage104,105, and106, camera coverage102, short range radar coverage103, ultrasonic sensor coverage110,111,112,113,114, and115, and omnidirectional sensor coverage120generated by the omnidirectional sensor132. The omnidirectional sensor may represent a GPS/GNSS, LIDAR, V2X, LSS, RF, or a combination of these (or other technology types). i.e., an AV could support multiple omnidirectional technologies each having dedicated sensors, or sensors integrated with multiple technologies. A LSS (Lawful Stop and Search) sensor, either dedicated or integrated with other sensor technology may be implemented as a single mode or as a multi-mode sensor as design demands.

With reference now toFIG. 2, a block diagram depicting a typical Autonomous Vehicle (AV) Controller and Support Systems200in which the present invention may be implemented. Those of ordinary skill in the art will appreciate that the AV Controller and Support systems may vary according to the manufacturer, design requirements, requirements mandated by local and federal regulatory bodies, as well as intended usage. Depicted inFIG. 2is the autonomous vehicle controller processor subsystem201providing the main processing resources and external interface, the User Interface203that provides possible manual interfaces to the controller. Additionally shown are the following systems, the Brake Controller & Brake System205, Radio Controller & Radio System207, Steering Controller & Steering System209, Sensor Controllers211, Drive Motor Controller & Drive Motor System213, GPS Controller & GPS System215, Lighting Controller & Lighting System217, Other Systems Controller & Systems219. The External Control Interfaces221and223provide both normal control interfaces223and emergency control interfaces221to the AV Controller. The normal control interface223interfaces directly with the AV Controller Processor Subsystem210and allows an external controller override the normal autonomous operations. The emergency control interface221bypasses the AV Controller Processor Subsystem210and interfaces directly to the Brake Controller & Brake System205, Steering Controller & Steering System209and Drive Motor Controller & Drive Motor System213.

With reference now toFIGS. 3, 4, 5 and 6, depictions of a LSS handheld illuminator, a LSS Car Mounted illuminator, a LSS Helicopter Mounted illuminator, and a fixed LSS Fence, in accordance with a preferred embodiment of the present invention. Those of ordinary skill in the art will appreciate that the LSS Car Mounted illuminator and the LSS Helicopter Mounted illuminator will require external mounts that have azimuth and elevation control for pointing; however, this is beyond the scope of the present invention. Typically, law enforcement personnel will operate the LSS illuminators as part of an intervention process when an AV must be stopped for inspection or where other means have failed or deemed unusable or unsafe. The LSS illuminator is used to signal the AV that authorized personnel are overriding AV control. A LSS illuminator may be a single mode, or multi-mode device; multi-mode may allow different modes to be selectable or all modes may be used simultaneously. Additionally, each Illuminator depicted may be integrated into other systems already required; e.g. the LSS handheld illuminator could be integrated into a flashlight, the LSS Car Mounted illuminator could be integrated into the vehicle's emergency lighting. Those of ordinary skill in the art will appreciate that these modes may vary according to the manufacturer, design requirements, requirements mandated by local and federal regulatory bodies, as well as intended usage and range. Typical modes would be visible laser, infrared laser, ultrasonic, Radio Frequency (RF) and/or other applicable technologies; multi-mode devices would utilize two or more of these (or two or more frequencies), either selectably or simultaneously.

With reference now toFIG. 6a concept drawing of a restricted area consisting of Restricted Roadway312C, Pedestrian Walkways310C and314C. These areas are protected by an electronic fence consisting of LSS Illuminators302C,304C,306C, and308C, each transmitting a “Fence” command with the GPS coordinates of the restricted area. These coordinates could be the corners of the fenced area or the center and radius as design dictates. Commands are transmit periodically at a high repetition rate during periods of usage, and may be turned off otherwise. The installation could be used to exclude AV from restricted areas, such as large celebrations, and/or large public gatherings.

With reference now toFIG. 7, a depictions of the communications path between a LSS illuminator400and a LSS AV Sensor420showing the two way nature of communication in accordance with a preferred embodiment of the present invention. In this depiction, the communications may be visible laser, infrared laser, ultrasonic, Radio Frequency (RF) and/or other applicable technologies. Those of ordinary skill in the art will appreciate that one way communication cannot provide the required level of security to prevent LSS misuse, e.g., malicious or criminal hacking and/or pranking, load hijacking, competitor interference, etc.; therefore, a two way encrypted communication channel with mutual authentication is established to meet the applicable standards to guarantee LSS user identification and authentication, message integrity, message confidentiality, non-repudiation of origin and non-repudiation of receipt. LSS user identification and authentication is necessary to guarantee unauthorized interference to the AV, message integrity is required to ensure the message is received correctly so it may be interpreted properly, and message confidentiality is required to prevent spoofing of LSS messages or other hacking techniques. Non-repudiation of origin is required to ensure the AV's owner/dispatcher has sufficient records to know who and why the AV was stopped and non-repudiation of receipt is required so the origin (ownership) of the AV can be verified.

Depicted inFIG. 7are LSS illuminator400with Transmitter (TX)401and Receiver (RX)402, and LSS AV Sensor420with Receiver (RX)421and Transmitter (TX)422. LSS AV Sensor420acts as a server, listening for a LSS illuminator400communication to be initiated via Receiver421; its Transmitter422is inactive. When LSS illuminator400is activated it initiates a Transport Layer Security version 1.2 (TLSv1.2) handshake with mutual authentication; if the LSS AV Sensor420Receiver421is in its beam410as shown, the LSS AV Sensor420responds via Transmitter422and completes the handshake. Immediately after the handshake is completed, the LSS illuminator400transmits command(s) and waits on a response from the LSS AV Sensor402. When the command(s) are acknowledged, the LSS illuminator400issues a TLSv1.2 shutdown command to terminate the link; this ends the TLS session. Those of ordinary skill in the art will appreciate that protocols other than TLSv1.2 may be used to achieve the necessary link security; however, they will also recognize non-repudiation of origin and non-repudiation of receipt are required whether provided as an extension to TLS or as part of the application layer.

Typical necessary commands (or their equivalent) that are envisioned are the emergency commands, “EmergencyStop”, “Stop”, and “Fence”, and the normal commands, “Acknowledge”, “Identify”, “Manifest”, “PullOverPark”, and “ResumeOperation”; once the AV is at a full stop, further actions can be initiated via other communication paths. The command “EmergenctStop” is issued only when imminent danger necessitates the AV must apply all means to halt motion; this may necessitate a separate control path be implemented, one that bypasses the AV's controller and operates directly on the motor feed and braking mechanisms. The command “Stop” is issued in situations that require immediate AV halt; however, normal safety rules remain in place except the AV does not need to clear traffic lanes. The command “Fence” is issued in fixed locations that require the AV recognize a restricted area that the AV may not enter, this command transmits the GPS coordinates of its location so the AV may reroute. The command “Acknowledge” requires the AV respond to a sensor query to verify the health of the LSS System. The command “Identify” requires the vehicle return AV identification data. The command “Manifest” requires the AV respond with the current vehicle manifest data. The command “PullOverPark” is intended for normal situations where vehicle inspection e.g., load inspection, vehicle weight, etc., or other lawful stop of the AV is required where the AV needs to be clear traffic lanes. The command “ResumeOperation” is intended to allow the AV continue its operation after interruption; however, no internal AV control may be applied until enabled by receipt of this command. Additionally, some commands could requires sub-commands for added functionality, the “PullOverPark” command could include sub-commands to indicate why the AV was pulled over, e.g., “MobileScale”, “LoadInspection”, “EquipmentViolation”, or others as required. Those of ordinary skill in the art will appreciate that design requirements, regulatory requirements, field experience, etc., may require commands be added, modified, and/or removed.

With reference now toFIG. 8, a block diagram illustrating components of a LSS illuminator500used by authorized personnel to mitigate and/or prevent autonomous vehicle misuse is depicted in accordance with a preferred embodiment of the present invention. The LSS illuminator described herein communicates directly with the LSS Sensor described in the paragraph below. In this illustrative example, the components organized into the following subsystems: processing, transmit chain, receive chain, user interface and dispatch interface. Those of ordinary skill in the art will appreciate that the hardware depicted inFIG. 8may vary; e.g., other components may be used in the transmit and/or receive chain, or other subsystems.

The transmit chain is comprised of Oscillator501which generates the carrier frequency, the Modulator503which modulates the carrier, Amplifier505which amplifies the signal, the Transmitter507which emits the modulated beam530intended for the LSS Sensor. The receive chain is comprised of the Receiver515which receives the modulated beam532from the LSS Sensor, Signal Conditioner and Amplifier513which synchronizes to the incoming signal and amplifies to the proper level, and Demodulator511which recovers the information content from the modulated carrier wave and sends for processing. The processing chain is comprised of Processor509, and the RAM/NVRAM517. The Processor509performs all processing tasks including generating transmit signals, interpreting receive signals, user input/output functions, and interfacing to dispatch; it interfaces to RAM/NVRAM517where program and data are stored, interfaces to USB Interface521which provides means to load necessary system data, reads User Input519, drives Status Indicators523, and drives the Dispatch Interface525which insures all device (LSS Illuminator) usage is externally monitored to preserve usage records. Optionally, for electronic fence applications, a GPS Receiver527and GPS Antenna529can be integrated. It is recommended high-accuracy GPS be implemented.

With reference now toFIG. 9, a diagram illustrating components of an LSS Manual Controller600intended to communicate with the AV and used to manage the autonomous vehicle is depicted in accordance with a preferred embodiment of the present invention. The LSS Manual Controller described herein communicates directly with the LSS AV Override System via an attached cable or by wireless link; the details of cable or wireless link are not illustrated. In this illustrative example, the components organized into the following subsystems: processing, transmit chain, receive chain, and user interface. Those of ordinary skill in the art will appreciate that the hardware depicted inFIG. 9may vary; e.g., other components may be used in the transmit and/or receive chain, or other subsystems.

The transmit chain is comprised of Oscillator601which generates the carrier frequency, the Modulator603which modulates the carrier, Amplifier605which amplifies the signal, the Transmitter607which emits the modulated signal630to the LSS AV Override System, either via wired or wireless means. The receive chain is comprised of the Receiver615which receives the modulated signal632from the LSS AV Override System, again, either via wired or wireless means, Signal Conditioner and Amplifier613which synchronizes to the incoming signal and amplifies to the proper level, and Demodulator611which recovers the information content from the modulated carrier wave and sends for processing. The processing chain is comprised of Processor609, and the RAM/NVRAM617. The Processor609performs all processing tasks including generating transmit signals, interpreting receive signals, user input/output functions, and interfacing to dispatch; it interfaces to RAM/NVRAM617where program and data are stored, interfaces to USB Interface621which provides means to load necessary system data, reads User Input619, and drives Status Indicators623. When LSS Manual Controller600is activated it initiates a TLSv1.2 handshake with mutual authentication; immediately after the handshake is completed, the LSS Manual Controller600transmits command(s) and waits on a response from the LSS AV Override System. When the command(s) are acknowledged, the LSS Manual Controller600issues a TLSv1.2 shutdown command to terminate the link; this ends the TLS session. Those of ordinary skill in the art will appreciate that protocols other than TLSv1.2 may be used to achieve the necessary link security.

Typical necessary commands (or their equivalent) that are envisioned are the proportional commands, “PullForward”, “BackUp”, “TurnLeft”, and “TurnRight” and fixed commands, “Stop”, “DownloadVehicleIdentification”, “UnlockLoadCompartment”, “ContactTerminal”, and “ResumeOperation”; proportional commands carry rate information and are used to move the vehicle locally at low rates of speed. The command “Stop” is issued in situations that require immediate AV halt. The command “DownloadVehicleIdentification” is intended for situations where vehicle inspection requires the vehicle produce documentation such as: identification (the motor carrier's name or trade name and the motor carrier's Department of Transportation (DOT) registration number, manifest, proof of insurance, maintenance records, accident records, licenses, permits, planned route and actual route, etc.; this information is downloaded to the controller's USB drive for review and storage. The command “UnlockLoadCompartment” is used to perform vehicle load inspections. The command “ContactTerminal” is intended to notify the vehicle's owner/operator that additional assistance is required. The command “ResumeOperation” is intended to allow the AV continue its operation after interruption; however, no internal AV control may be applied until enabled by receipt of this command. Those of ordinary skill in the art will appreciate that design requirements, regulatory requirements, field experience, etc., may require commands be added, modified, and/or removed.

With reference now toFIG. 10, a diagram illustrating components of a LSS AV Override System Controller700mounted on the AV used to mitigate and/or prevent autonomous vehicle misuse and vehicle management is depicted in accordance with a preferred embodiment of the present invention. The LSS AV Override System described herein communicates directly with the LSS illuminator described in the paragraph above and communicates with the LSS Manual Controller described below. In this illustrative example, the components organized into the following subsystems: processing, transmit chain, receive chain, user interface and dispatch interface; the subsystems may be appropriately separated into physically different enclosures with the transmit and receive chains located in one package mounted on top of the AV and the remainder in a more accessible location. Additionally, the components may be integrated into existing AV sensors such as LIDAR, radar, GNSS, or ultrasonic, etc.; furthermore, significant anti-tampering characteristics of the LSS AV Override System may be gained through the use of integrated sensors. e.g., if an integrated LSS/LIDAR sensor were tampered, the LIDAR system would also be downgraded and the system fail. Additionally, some components, such as receiver and/or transmitter, may be integrated into the vehicle's running, braking, or emergency lighting. Those of ordinary skill in the art will appreciate that the hardware depicted inFIG. 10may vary, e.g., other components may be used in the transmit and/or receive chain, or other subsystems.

The transmit chain is comprised of Oscillator701which generates the carrier frequency, the Modulator703which modulates the carrier, Amplifier705which amplifies the signal, the Transmitter707which emits the modulated beam730intended for the LSS Illuminator. The receive chain is comprised of the Receiver715which receives the modulated beam732from the LSS Illuminator, Signal Conditioner and Amplifier713which synchronizes to the incoming signal and amplifies to the proper level, and Demodulator711which recovers the information content from the modulated carrier wave and sends for processing, The processing chain is comprised of Processor709, and the RAM/NVRAM717. The Processor709performs all processing tasks including generating transmit signals, interpreting receive signals, user input/output functions, and interfacing to dispatch; it interfaces to RAM/NVRAM717where program and data are stored, interfaces to USB Interface721which provides means to load necessary system data, reads User Input719, drives Status Indicators723, and drives the Dispatch Interface725which insures all device (LSS Illuminator) usage is externally monitored to preserve usage records, interfaces to the External Control Interface727which allows the AV be controlled by an external device, and interfaces to the AV Computer Interface729which sends override commands to the AV control system computer, or to a separate control implemented to bypasses the AV's controller and operates directly on the motor feed and braking mechanisms via the Emergency Override Interface728.

A high-accuracy GPS Receiver720and GPS Antenna724provide accurate LSS location data that is independent of the AV control system. LSS location data is used in conjunction with “Fence” commands received from LSS electronic fence installations. As the vehicle approaches a restricted area marked with the LSS fence, the AV controller may be notified to avoid the restricted area. In the case the LSS AV Override System detects actual AV intrusion into a LSS electronic fenced area, the vehicle is reliably stopped by bypassing the AV's controller via the Emergency Override Interface728, operating directly on the motor feed and braking mechanisms. Once the AV has been stopped using the Emergency Override Interface728, it can only be restarted by law enforcement. LSS AV Override System location data can also be sent to the AV control system to increase its reliability. To reduce misuse and increase route reliability, the Native AV Controller can transmit the route map to the LSS AV Override System via the AV Computer Interface729where the route is continuously checked by the LSS Override System. Small route deviations can be transmit back to the AV controller for correction resulting in higher route reliability, whereas large route deviations will result in activation of the Emergency Override Interface and subsequent AV stop. Those of ordinary skill in the art will appreciate that the LSS AV Override System and all interfaces to the AV must have sufficient physical and logical protection to prevent misuse and/or tampering; therefore, manufacturers should consider FIPS 140-2 Level 4 certification or its equivalent.

With reference now toFIG. 8, a diagram illustrating components of a LSS illuminator500andFIG. 9, a diagram illustrating components of an LSS Manual Controller600, show significant similarities such that the handheld LSS Illuminator and a LSS Manual Controller may be integrated into a single package.

With reference now toFIG. 11, a block diagram of a LSS Override System Controller and Autonomous Vehicle Controller800showing the relationship and connections between the LSS Override System Controller801, the AV Controller and Support System803, and the External Control Interfaces805and807. The LSS Override System Controller801is purposefully shown above the AV Controller and Support System803because it can override the AV Controller and Support System803which must respond to the direction of LSS Override System Controller801.

The LSS Override System Controller801is fully explained in the description ofFIG. 10above, the AV Controller and Support System803and the External Control Interfaces805and807are fully explained in the description ofFIG. 2.

With reference now toFIG. 12, a concept drawing of a driver-less AV900having LSS Sensor902and Control Port904depicted in accordance with a preferred embodiment of the present invention. LSS Sensor902may be an independent sensor, or may be integrated into the AV navigation sensors such as LIDAR, RADAR, camera or other; however, integrated sensors offer increased anti-tampering security, and are therefore preferred. Control Port904is depicted with attached Control Cable912and LSS Manual Controller910; Control Port904is attached internally to the External Control Interface527shown inFIG. 8. LSS Control Cable912and LSS Manual Controller910are attached to provide local management of the AV900after the AV has stopped. Upon connection of LSS Manual Controller910, all internal control functions are overridden, including remote AV control via other pathways.

With reference now toFIG. 13a concept drawing of a driver-less AV900A having LSS Sensor902A and Control Port904A depicted in accordance with an alternate embodiment of the present invention. LSS Sensor904A may be an independent sensor, or may be integrated into the AV navigation sensors such as LIDAR, RADAR, camera or other; however, integrated sensors offer increased anti-tampering security, and are therefore preferred. The LSS Manual Controller920A communicates to the LSS Sensor902A via wireless signal and provides local management of the AV900A after stopped. Upon establishment of LSS Manual Controller910A control, all internal control functions are overridden, including remote AV control via other pathways. Control Port904A is unused in this example.

With reference now toFIG. 12andFIG. 13, whether wired or wireless, the AV can be moved locally as necessary using the LSS Manual Controller; in terminal this can aid in vehicle maintenance, vehicle fueling for non-electric vehicles such as diesel or hydrogen fuels, and charging for electric vehicles, load and unload tasks, in transit this can aid in mobile or Port of Entry weight inspections, and/or load inspection. Additional the AV Controller can be used in terminal for final inspection to verify route information, and verify all required documentation is present, available, and correct. Although a driver-less AV was used in these examples, those of ordinary skill in the art will appreciate that the AV could be with driver present, with driver facilities but no driver, or driver-less, i.e., no driver facilities, as this will probably be the development sequence for fully autonomous driver-less vehicles.

AVAutonomous Vehicle, for the purposes of thisinvention, refers to SAE specification J3016,Level 2 and higher vehicle.Federal InformationPublicly announced standards developed byProcessingthe United States federal government for use inStandardscomputer systems by non-military governmentagencies and government contractors.FIPSSee Federal Information Processing StandardsGlobal NavigationThe standard generic term for satellite navigationSatellite Systemsystems that provide autonomous geo-spatialpositioning with global coverage.Global PositioningThe US Government's implementation of GNSSSystemGNSSSee Global Navigation Satellite SystemGPSSee Global Positioning SystemIASSee Intrusion Analysis SoftwareLawful Stop andRefers to a situation where law enforcement maySearchlegally request a vehicle to pull over and search(inspect) the vehicleLSSSee Lawful Stop and SearchLIDARAn acronym for Light Detection and Ranging,which is a remote sensing method that uses pulsedlaser light to perform range measurements; it is andfor control and navigation for autonomous vehicles.National Institute ofA United States government non-regulatory federalStandards andagency Department of Commerce; its mission is toTechnologypromote US. innovation and industrialcompetitiveness by advancing measurement science,standards, and technology in ways that enhanceeconomic security and improve our quality of life.NISTSee National Institute of Standards and TechnologySAESociety of Automotive EngineersV2IVehicle to InfrastructureV2VVehicle to VehicleV2XV2I and V2V