# US 12,007,766 B2 · Secure communication between vehicle components via bus guardians > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,007,766 B2 - Document ID: US12007766B2 - Status: Granted - Kind: B2 - Application number: 17/027,001 - Filed: 2020-09-21 - Published: 2021-03-11 - Granted: 2024-06-11 - Earliest claimed: 2018-04-20 - Assignees: Woven by Toyota, U.S., Inc. - Applicants: Woven by Toyota, U.S., Inc. - Inventors: Helen Ruth Lurie; George James Hansel; James Allen-White Hoffacker; Osama M. Salem - Web page: https://patentgrep.com/patent/US12007766B2 ## CPC - B60W 60/0059: {Estimation of the risk associated with autonomous or manual driving, e.g. situation too complex, sensor failure or driver incapacity} - H04L 12/40026: {Details regarding a bus guardian} - B60W 50/0205: {Diagnosing or detecting failures; Failure detection models} - B60W 50/082: {Selecting or switching between different modes of propelling} - B60W 50/10: Interpretation of driver requests or demands - B60W 50/14: Means for informing the driver, warning the driver or prompting a driver intervention - B60W 60/0053: {from vehicle to occupant} - G05D 1/00: Control of position, course, altitude or attitude of land, water, air or space vehicles, e.g. using automatic pilots (drive control systems specially adapted for autonomous road vehicles B60W60/00) - G05D 1/0077: {using redundant signals or controls} - G05D 1/0246: {using a video camera in combination with image processing means} - G05D 1/81: Handing over between on-board automatic and on-board manual control - G05D 1/87: using redundant control arrangements - H04L 9/14: using a plurality of keys or algorithms - H04L 9/3236: {using cryptographic hash functions} - H04L 9/3247: {involving digital signatures} - H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)} - H04L 67/12: specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks - H04L 67/62: Establishing a time schedule for servicing the requests - H04W 4/38: for collecting sensor information - H04W 4/48: for in-vehicle communication - B60W 2050/0215: {Sensor drifts or sensor failures} - B60W 2050/022: {Actuator failures} - B60W 2050/146: {Display means} - H04L 2012/40215: {Controller Area Network CAN} - H04L 2012/40234: {Local Interconnect Network LIN} - H04L 2012/40273: {the transportation system being a vehicle} - H04L 2209/84: Vehicles - B60W: CONJOINT CONTROL OF VEHICLE SUB-UNITS OF DIFFERENT TYPE OR DIFFERENT FUNCTION; CONTROL SYSTEMS SPECIALLY ADAPTED FOR HYBRID VEHICLES; ROAD VEHICLE DRIVE CONTROL SYSTEMS FOR PURPOSES NOT RELATED TO THE CONTROL OF A PARTICULAR SUB-UNIT - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G05D: SYSTEMS FOR CONTROLLING OR REGULATING NON-ELECTRIC VARIABLES - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract In particular embodiments, a computing system may receive, by a processor in communication with an actuator of a vehicle, an instruction associated with an environment external to the vehicle and configured for controlling the actuator of the vehicle. The system may receive, by the processor, sensor data associated with the environment and generated by one or more sensors associated with the vehicle. The system may determine, by the processor, a state associated with an operation mode of the vehicle based on the received sensor data. The system may evaluate, by the processor, whether the instruction is invalid based on the state associated with the operating mode of the vehicle. The system may, subsequent to determining that the instruction is invalid, based on the evaluation, prevent transmission of the instruction to the actuator of the vehicle. ## Claims ### Claim 1 A method comprising: receiving, by a processor in communication with an actuator of a vehicle, an instruction associated with an environment external to the vehicle and configured for controlling the actuator of the vehicle; receiving, by the processor, sensor data associated with the environment and generated by one or more sensors associated with the vehicle; determining, by the processor, a state associated with an operation mode of the vehicle based on the sensor data; evaluating, by the processor, whether the instruction is invalid based on the state associated with the operating mode of the vehicle; and subsequent to determining that the instruction is invalid, based on the evaluation, preventing transmission of the instruction to the actuator of the vehicle. ### Claim 2 (depends on 1) The method of claim 1, further comprising: subsequent to evaluating that the instruction is invalid, causing an indication of the instruction to be signaled; or altering the operating mode of the vehicle from an autonomous driving mode to a manual driving mode. ### Claim 3 (depends on 1) The method of claim 1, wherein the instruction is configured for controlling the actuator of the vehicle, and a movement of the vehicle is responsive to the actuator receiving the instruction. ### Claim 4 (depends on 1) The method of claim 1, further comprising sending, by the processor, the instruction to the actuator of the vehicle via one or more non-redundant communication networks subsequent to determining that the instruction is valid. ### Claim 5 (depends on 1) The method of claim 1, further comprising: subsequent to evaluating that the instruction is invalid, receiving one or more second instructions from one or more redundant communication networks; and evaluating the instruction based on the one or more second instructions received from the one or more redundant communication networks. ### Claim 6 (depends on 1) The method of claim 1, further comprising: generating a second instruction by the processor based on one or more pre-determined instruction generating rules; and evaluating the instruction based on the second instruction generated by the processor. ### Claim 7 (depends on 1) The method of claim 1, wherein the instruction is determined to be invalid based on an inconsistency of the instruction with respect to the state associated with the operating mode of the vehicle. ### Claim 8 (depends on 1) The method of claim 1, wherein the instruction is determined to be invalid based on one or more pre-determined rules, wherein each pre-determined rule is associated with a scenario encountered by the vehicle in a surrounding environment, and wherein that pre-determined rule is associated with one or more pre-determined actions for the vehicle to take under the scenario. ### Claim 9 (depends on 1) The method of claim 1, wherein the instruction is determined to be invalid upon determining that the instruction has an authentication issue, further comprising: subsequent to the determination that the instruction has the authentication issue, causing a second processor to stop receiving or transmitting subsequent instructions. ### Claim 10 (depends on 9) The method of claim 9, further comprising: subsequent to determining that the instruction has the authentication issue, disconnecting the processor and one or more second processors from one or more communication networks connected to the vehicle. ### Claim 11 (depends on 1) The method of claim 1, further comprising: storing the state of the vehicle and associated configurations, settings, and events into a computer storage; and analyzing data packets of the instruction based on the state of the vehicle and the associated configurations, settings, and events stored in the computer storage. ### Claim 12 (depends on 1) The method of claim 1, wherein the state of the vehicle is based on one or more parameters associated with the vehicle or a surrounding environment of the vehicle, the parameters comprising one or more of: a vehicle velocity, a vehicle moving direction, a vehicle acceleration, a vehicle position, a vehicle configuration, a vehicle operation mode, a battery level, a fuel level, a tire condition, a brake condition, a sensor condition, an odometer parameter, a navigation parameter, or a passenger input. ### Claim 13 A system associated with an actuator of a vehicle comprising: one or more processors in communication with the actuator; and one or more computer-readable non-transitory storage media in communication with the one or more processors that are in communication with the actuator, the one or more computer-readable non-transitory storage media comprising instructions operable, when executed by the one or more processors, to cause the system associated with the actuator, to perform operations comprising: receiving, by a processor of the one or more processors in communication with an actuator of a vehicle, an instruction associated with an environment external to the vehicle and configured for controlling the actuator of the vehicle; receiving, by the processor, sensor data associated with the environment and generated by one or more sensors associated with the vehicle; determining, by the processor, a state associated with an operation mode of the vehicle based on the sensor data; evaluating, by the processor, whether the instruction is invalid based on the state associated with the operating mode of the vehicle; and subsequent to determining that the instruction is invalid, based on the evaluation, preventing transmission of the instruction to the actuator of the vehicle. ### Claim 14 (depends on 13) The system of claim 13, wherein the system is further configured to perform operations comprising: subsequent to evaluating that the instruction is invalid, causing an indication of the instruction to be signaled; or altering the operating mode of the vehicle from an autonomous driving mode to a manual driving mode. ### Claim 15 (depends on 13) The system of claim 13, wherein the instruction is configured for controlling the actuator of the vehicle, and a movement of the vehicle is responsive to the actuator receiving the instruction. ### Claim 16 (depends on 13) The system of claim 13, wherein the system is further configured to perform operations comprising sending, by the processor, the instruction to the actuator of the vehicle via one or more non-redundant communication networks subsequent to determining that the instruction is valid. ### Claim 17 One or more computer-readable non-transitory storage media embodying software that is operable, when executed, to cause one or more processors in communication with an actuator of a vehicle to perform operations comprising: receiving, by a processor in communication with an actuator of a vehicle, an instruction associated with an environment external to the vehicle and configured for controlling the actuator of the vehicle; receiving, by the processor, sensor data associated with the environment and generated by one or more sensors associated with the vehicle; determining, by the processor, a state associated with an operation mode of the vehicle based on the sensor data; evaluating, by the processor, whether the instruction is invalid based on the state associated with the operating mode of the vehicle; and subsequent to determining that the instruction is invalid, based on the evaluation, preventing transmission of the instruction to the actuator of the vehicle. ### Claim 18 (depends on 17) The one or more computer-readable non-transitory storage media of claim 17, further embodying software to perform operations comprising: subsequent to evaluating that the instruction is invalid, causing an indication of the instruction to be signaled; or altering the operating mode of the vehicle from an autonomous driving mode to a manual driving mode. ### Claim 19 (depends on 17) The one or more computer-readable non-transitory storage media of claim 17, wherein the instruction is configured for controlling the actuator of the vehicle, and a movement of the vehicle is responsive the actuator receiving the instruction. ### Claim 20 (depends on 17) The one or more computer-readable non-transitory storage media of claim 17, wherein the software is further configured to perform operations comprising sending, by the processor, the instruction to the actuator of the vehicle via one or more non-redundant communication networks subsequent to determining that the instruction is valid.