Control system and method

Abstract

The control system is configured to: send a verification request signal to the remote device; listen for a verification request reply signal sent from the remote device; listen for a remote device status signal sent from the remote device providing remote device status information, wherein the verification request signal contains information including operation information indicating an operation to be performed, the operation information depending on the remote device status information; determine whether the information includes expected operation result information that is operation result information corresponding to an expected result of the operation, wherein the control system is configured to control motion of the vehicle in accordance with a correspondence between received operation result information and expected operation result information in response to a motion control signal received from the remote device, or to provide input to the system to control motion of the vehicle.

Description

Technical Field

[0001] This disclosure relates to control systems for vehicles and methods for controlling vehicles, and particularly, but not limited to, control systems for remote control that allows vehicle movement. Aspects of the invention relate to control systems, systems, vehicles, methods, computer software programs, and computer-readable storage media. Background Technology

[0002] Vehicle parking assistance systems are known to be provided to assist users in parking. Some parking assistance systems are configured to provide automatic parking functionality, wherein the vehicle parking assistance system is configured to autonomously control the vehicle's speed and steering to perform parallel parking operations without requiring the driver to provide any speed or direction control input to the vehicle. Some systems are configured to allow automatic perpendicular parking and garage parking. Some systems allow minor adjustments to the vehicle's position, wherein the vehicle moves forward or backward by a relatively small amount; this function is referred to as "avoidance" movement.

[0003] The applicant has recognized that it may be desirable to enable a driver to remotely activate an automatic parking function via a remote device such as a smartphone, smartwatch, or other device (e.g., a remote key with a touchscreen), the remote device running an appropriate software application (which may be referred to as an "application" or "widget"). It may also be desirable to allow the driver to independently control the vehicle's movement by controlling the direction of travel, speed, and steering angle via the same or similar devices. This functionality may be particularly useful in off-road situations requiring the vehicle to traverse challenging terrain. The applicant has also recognized that ensuring the reliability of the system used to control the vehicle's movement is important, especially in the case of remote operation. The inventors have recognized that communication failures between the smartphone and the parking assistance control system can lead to unreliable control of the vehicle. The object of the present invention is to improve this problem. Summary of the Invention

[0004] The present invention provides, in various aspects and embodiments, a control system, a remote device, and a method for controlling the movement of a vehicle.

[0005] According to one aspect of the invention, a control system comprising one or more controllers is provided, the control system being arranged to control the movement of a motor vehicle in response to a motion control signal received from a remote device, or to provide input to the system to control the movement of the motor vehicle, wherein the control system is arranged to execute a verification loop, in which the control system is configured to: send a verification request signal to the remote device; listen for a verification request response signal sent from the remote device in response to the sent verification request signal; and listen for a remote device status signal sent from the remote device providing remote device status information, the remote device status information indicating which of a plurality of predefined states the remote device is currently in. The system operates under the following conditions: the verification request signal contains information including operation information indicating the operation to be performed, the operation information depending on the remote device status information; the control system is further configured to determine whether the information contained in the verification request response signal received from the remote device includes expected operation result information, which is operation result information corresponding to the expected result of the operation defined by the operation information provided in the verification request signal; and the control system is configured to control the movement of the vehicle in response to a motion control signal received from the remote device, based on the correspondence between the received operation result information and the expected operation result information, or to provide input to the system to control the movement of the vehicle.

[0006] The advantage of embodiments of the present invention is that, because the control system can adjust the operations to be performed based on the current operating state of the remote device, the remote device may need to perform less computationally intensive operations (e.g., including one or more calculations such as division or multiplication) to verify the correct operation of the remote device in one or more specific states, in which the device does not need to perform computationally intensive operations as part of providing remote control functionality, relative to the operations required when the device is in other specific states. For example, in some embodiments, the remote device may be equipped with a touchscreen. In certain device states, the remote device may need to perform computationally intensive operations to provide the control system with information indicating, for example, the position of a user's finger on the touchscreen and / or the direction and / or speed of the user's finger movement to facilitate vehicle control. In other states, when a button displayed on the touchscreen is pressed, the remote device can simply be requested to provide an instruction to the control system. It should be understood that in the latter state, the remote device may need to perform fewer computationally intensive operations relative to the former state. Therefore, the verification loop in the latter state may require the remote device to perform less computationally intensive operations relative to the former state to sufficiently verify that the remote device is operating well enough to be allowed to continue providing input to the vehicle control process.

[0007] Optionally, the one or more controllers collectively include: at least one electronic processor having electrical inputs for receiving verification request response signals and remote device status signals and electrical outputs for sending verification request signals; and at least one storage device coupled to the at least one electronic processor and having instructions stored therein; wherein the at least one electronic processor is configured to access the at least one storage device and execute the instructions stored therein in order to control the movement of the motor vehicle or to provide input to the system to control the movement of the motor vehicle.

[0008] Optionally, the operation information dependent on the remote device state information includes operation information selected from a predetermined group of one or more operations associated with each of the plurality of predefined states in which the remote device can operate. Optionally, the one or more operations in each corresponding group of one or more operations are configured to cause the remote device to perform an operation that is expected to be performed as part of normal operation in the corresponding predefined state when the remote device is operating in that predefined state. It should be understood that in some embodiments, each operation in one or more operations in each corresponding group of one or more operations is such that it can be performed by the remote device as part of normal operation in the corresponding predefined state when the remote device is operating in that predefined state. Therefore, one or more operations that are not expected to be performed when the device is in a given state will not be part of the group of one or more operations associated with that state. Optionally, the one or more operations are selected from the following operations: addition, subtraction, multiplication, division, calculation of a predetermined power of a value (e.g., power 2 or power 3, etc.), logical AND, logical OR, and logical XOR.

[0009] Some embodiments of the present invention have the advantage that testing the remote device in a given predefined state does not require the remote device to perform operations that are not expected to be performed as part of normal operation in that state. Therefore, given that the correct operation of the remote device is confirmed, the computational burden imposed on the remote device by the control system is not excessive in the context of the remote device being in operation.

[0010] It should be understood that a group of one or more operations in each corresponding group consisting of one or more operations can be configured such that the remote device can expect to perform substantially all logical operations when performing operations in that state.

[0011] Optionally, the system is configured to determine expected operation result information and store the expected operation result information together with a corresponding identifier in a memory associated with the control system. The system is configured to include identifier information in a verification request signal, the identifier information being information indicating an identifier associated with the operation information included in the verification request signal. The system configured to determine whether the information contained in a verification request response signal received from a remote device includes expected operation result information includes a system configured to compare the received result information with the stored expected result information associated with the same identifier information.

[0012] Optionally, the system is configured to: once a verification request response signal containing identifier information has been received and the system has compared the received result information with the stored expected result information associated with the identifier information, the system is configured not to compare other received expected result information associated with the identifier information until new expected result information corresponding to the identifier information has been stored. Optionally, the system is configured to: once a verification request response signal containing identifier information has been received and the system has compared the received result information with the corresponding stored expected result information associated with the identifier information, the system is configured to delete the stored expected result information and corresponding identifier information from the memory. Optionally, the system is configured to prevent the vehicle from moving in response to a motion control signal received from a remote device based on the number of times the system receives a verification request response signal within a specified time period, wherein the received result information does not correspond to the corresponding stored expected result information. Optionally, the system is configured to prevent the vehicle from moving in response to a motion control signal received from a remote device based on whether the order in which consecutive verification request response signals are received corresponds to the order in which consecutive verification request signals are sent. Optionally, the system is configured to prevent the vehicle from moving in response to motion control signals received from a remote device based on the number of times the order in which consecutive verification request response signals are received within a given time period does not correspond to the order in which consecutive verification request signals are sent. Optionally, the system is configured to perform cyclic redundancy check (CRC) on the received data. Optionally, the verification request signal also includes parameter information indicating one or more parameters to be used in the operation to be performed.

[0013] In another aspect of the invention, a method for controlling the movement of a vehicle through a control system is provided. The method includes controlling the movement of a motor vehicle in response to a motion control signal received from a remote device, or providing input to the system to control the movement of the motor vehicle. The method includes performing a repetitive verification loop. The method further includes: sending a verification request signal to a remote device; listening to a verification request response signal sent from the remote device in response to the sent verification request signal; and listening to a remote device status signal sent from the remote device providing remote device status information, the remote device status information indicating which of a plurality of predefined states the remote device is currently operating in. The verification request signal includes information including operation information indicating an operation to be performed, the operation information depending on the remote device status information. The method further includes determining whether the information included in the verification request response signal received from the remote device includes expected operation result information, the expected operation result information being operation result information corresponding to the expected result of the operation defined by the operation information provided in the verification request signal. The method further includes controlling the movement of the vehicle based on a correspondence between the received operation result information and the expected operation result information in response to a motion control signal received from the remote device, or providing input to the system to control the movement of the vehicle.

[0014] Optionally, the method includes preventing vehicle movement in response to motion control signals received from a remote computing device based on a received expected verification request response signal. Optionally, the verification request signal also includes parameter information indicating one or more parameters to be used in the operation to be performed.

[0015] In another aspect of the invention, a remote device is provided, configured to communicate with a control system arranged to control the movement of a motor vehicle in response to a motion control signal received from the remote device, or to provide input to the system to control the movement of the motor vehicle. The remote device is configured to: send a remote device status signal to the control system, the remote device status signal providing information indicating which of a plurality of predefined states the remote device is currently operating in; listen for a verification request signal sent by the control system, wherein the verification request signal includes information including operation information indicating an operation to be performed; and, in response to receiving the verification request signal sent by the control system, perform an indicated predefined operation. The device is configured to, in response to receiving the verification request signal, send a verification request response signal after performing the predefined operation, the verification request response signal including information indicating the result of the indicated predefined operation.

[0016] Optionally, the remote device is configured to receive a verification request signal that also includes parameter information for an operation to be performed, and the remote device is configured to perform a predefined operation using the received parameter information. Optionally, the remote device is configured to receive a verification request signal that also includes identifier information, the identifier information being information indicating an identifier associated with the operation information included in the verification request signal, and the device is configured to include the identifier information indicating the identifier associated with the verification request signal in a verification request response signal in response to the transmission of the verification request signal.

[0017] In one aspect of the invention, a method for controlling the movement of a vehicle having a control system is provided. The method includes communicating with a control system via a remote device, the control system being arranged to control the movement of the vehicle in response to a motion control signal received from the remote device, or to provide input to the system to control the movement of the vehicle. The method includes: sending a remote device status signal to the control system, the remote device status signal providing information indicating which of a plurality of predefined states the remote device is currently operating in; listening for a verification request signal sent by the control system, wherein the verification request signal includes information including operation information indicating an operation to be performed; and, in response to receiving the verification request signal sent by the control system, performing an indicated predefined operation. The method further includes, in response to receiving the verification request signal, sending a verification request response signal from the remote device after performing the predefined operation, the verification request response signal including information indicating the result of the indicated predefined operation.

[0018] Optionally, the method includes receiving a verification request signal at a remote device, the verification request signal further including parameter information for an operation to be performed, and the method includes performing a predefined operation at the remote device using the received parameter information. Optionally, the method includes receiving a verification request signal at a remote device, the verification request signal further including identifier information as information indicating an identifier associated with the operation information included in the verification request signal, and the method includes including the information indicating the identifier associated with the verification request signal in a verification request response signal in response to the transmission of the verification request signal.

[0019] In one aspect of the invention, a control system including one or more controllers is provided, the control system being arranged to control the movement of a motor vehicle in response to a motion control signal received from a remote device, or to provide input to the system to control the movement of the motor vehicle, wherein the control system is arranged to execute a verification loop, in which the control system is configured to: send a verification request signal to the remote device; listen for a verification request response signal sent from the remote device in response to the sent verification request signal; and listen for a remote device status signal sent from the remote device providing remote device status information, the remote device status information indicating which of a plurality of predefined states the remote device is currently operating in, wherein the verification request... The request signal includes information, which includes parameter information and information indicating an operation to be performed using the parameter information. The information indicating the operation to be performed depends on the remote device status information. The system is also configured to determine whether the information included in a verification request response signal received from the remote device includes expected operation result information, which is operation result information corresponding to the expected result of the operation defined by the information indicating an operation to be performed using the parameter information provided in the verification request signal. The system is configured to control the movement of the vehicle in response to a motion control signal received from the remote device, based on the correspondence between the received operation result information and the expected operation result information, or to provide input to the system to control the movement of the vehicle.

[0020] Within the scope of this application, it is expressly intended that the various aspects, embodiments, examples, and alternatives set forth in the preceding paragraphs, claims, and / or the following description and drawings, and in particular their individual features, may be adopted independently or in any combination. That is, unless such features are incompatible, all embodiments and / or features of any embodiment may be combined in any manner and / or combination. The applicant reserves the right to amend any originally filed claim or accordingly file any new claim, including the right to modify any originally filed claim to include any feature subordinate to any other claim and / or to include any feature of any other claim, even though it was not initially claimed in this manner. Attached Figure Description

[0021] One or more embodiments of the invention will now be described by way of example only with reference to the accompanying drawings, in which:

[0022] Figure 1 (a) A schematic diagram of a vehicle according to an embodiment of the present invention, the vehicle having an in-vehicle environment perception and trajectory planning system in the form of a near field sensing system (NFS) in this embodiment, which can be controlled by a remote device in the form of a smartphone, and (b) A schematic diagram of the vehicle's center console.

[0023] Figure 2 This is a schematic diagram illustrating how a remote device communicates with NFS;

[0024] Figure 3 This is a schematic diagram illustrating how other vehicle components communicate with each other;

[0025] Figure 4 shows (a) the remote device GUI for vehicle control in obstacle avoidance mode, (b) the GUI for vehicle control while waiting for user confirmation to initiate control in parking assist mode, (c) the GUI during vehicle manipulation in parking assist mode, (d) the GUI for vehicle control during manipulation in free control operation mode, (e) the operation of NFS and remote device 1900 in more detail, (f) a table listing 16 predefined operations from which the challenge generator function can select, and (g) a schematic diagram of how NFS selects the operation to be performed via the remote device in an embodiment of the invention.

[0026] Figure 5 The accumulation of index values, local time information, and operation result information in non-volatile memory (NVM) is shown.

[0027] Figure 6 This is a flowchart illustrating NFS operations;

[0028] Figure 7 This is a flowchart illustrating the operation of a remote device;

[0029] Figure 8 The contents of the NVM are shown before (block T1) and after (block T1') receiving the first verification request response signal from the remote device;

[0030] Figure 9 This is a flowchart illustrating the operation of NFS when a verification request response signal is received from a remote device;

[0031] Figure 10 It shows in Figures 1 to 9 The method of the implementation method verifies the correspondence between the verification request signal and the verification request response signal;

[0032] Figure 11 The image shows a vehicle traveling along a path with a row of smart pillars along one side of the desired path to guide the vehicle's travel path; and

[0033] Figure 12 This is a simplified schematic diagram of a control system that can be adjusted, for example, according to an embodiment of the present invention. Detailed Implementation

[0034] This document describes a control system, system, vehicle, and method according to embodiments of the present invention with reference to the accompanying drawings. Figure 1 (a) is a schematic diagram of a vehicle 1000 according to an embodiment of the present invention. The vehicle 1000 is arranged to communicate with a suitably configured remote device 1900, and the remote device 1900 is able to control the parking assistance function of the vehicle 1000, thereby enabling the vehicle 1000 to be maneuvered at low speed via the remote device 1900. This system can be used to maneuver the vehicle into a parking space at low speed. In some cases, this system can be used to maneuver the vehicle on challenging terrain (e.g., challenging off-road terrain).

[0035] The remote device 1900 and vehicle 1000 are also configured such that the remote device 1900 can control a remote driving function, allowing the user to freely control the longitudinal and lateral movements of the vehicle using the remote device 1900, not limited to activating a parking assist function where the vehicle 1000 autonomously performs parking maneuvers. However, in some embodiments, the remote device 1900 may be configured to allow the user to activate the parking assist function and not allow the user to freely control the vehicle's movement. It should be understood that in this embodiment, the vehicle speed is limited to 2 kph when the vehicle is performing parking, and is limited to 8 kph when the remote driving function is implemented. It should be understood that in some embodiments, other values ​​for the maximum speed may be used for operation of one or both of these functions. For example, in some embodiments, the vehicle speed may be limited to 10 kph under the control of the remote device. In some alternative embodiments, the vehicle speed may be limited to 15 kph under the control of the remote device.

[0036] In the illustrated embodiment, the remote device 1900 is a user's smartphone. However, it should be understood that in some embodiments, the remote device may be associated with a substantially fixed facility such as a parking facility, vehicle charging facility, or other facility. Control signals may be generated by the remote device to guide the vehicle 1000 to park in a suitable location within the facility, such as a location where the vehicle 1000's battery can be charged. In some embodiments, the remote device 1900 may be a smartwatch with an HMI interface, which includes buttons and / or a touchscreen that allows the user to interact remotely with the vehicle 1000.

[0037] Figure 2This is a schematic diagram illustrating the communication method between the remote device 1900 and the vehicle 1000. The vehicle 1000 has a telematics control unit (TCU) 1100 (which can also be described as a vehicle domain controller (VDC)), a gateway module (GWM) 1200, and a near-field sensing system (NFS) 1300. The TCU 1100 provides an interface between the remote device 1900 and the vehicle controller area network (CAN) bus 1010, and the GWM 1200 and NFS 1300 are also connected to the CAN bus 1010. In this embodiment, the CAN bus 1010 uses Ethernet networking technology (IEEE 802.3) to facilitate communication between the connected systems. However, it should be understood that the invention is not limited to Ethernet technology, and any suitable networking technology can be used. It should be understood that in some embodiments, the remote device 1900 can communicate directly with the NFS 1300 without going through the GWM 1200. The remote device 1900 is configured to establish a wireless communication link or "connection" between the remote device and the TCU 1100 via a short-range wireless communication protocol. In this embodiment, the remote device 1900 is configured to establish a wireless communication link using the "Wi-Fi" protocol; however, other protocols such as Bluetooth (RTM) may be used alternatively or as a substitute. As mentioned above, it should be understood that the remote device 1900 can be any suitable device, such as a smartphone, smartwatch, tablet computer, or any other suitable programmable computing device. The remote device 1900 has an installed Remote Vehicle Control (RVC) software program or application. When the RVC application is running, the program enables the user of the remote device 1900 to control the movement of the vehicle using the remote device 1900. In this embodiment, the RVC program allows the user to remotely activate the vehicle's Parking Assist (PA) function. The PA function is implemented by the NFS 1300. The NFS 1300 is equipped with a Remote Parking Assist (RPA) function, thereby allowing the NFS 1300 to receive commands regarding the PA function from the remote device 1900.

[0038] In this embodiment, the user can control the vehicle 1000 via the central control panel 1001 located in the vehicle 1000 while driving the vehicle 1000. Figure 1(b) The PA function is activated by pressing the PA function activation button 1001B on the NFS. When the PA function is activated, the NFS 1300 is automatically configured to perform parallel parking maneuvers, wherein the NFS 1300 identifies a suitable parking space as the vehicle travels along the road and then determines the desired travel path of the vehicle 1000 to park the vehicle in that parking space. That is, the NFS 1300 controls the speed and steering angle of the vehicle 1000 to park the vehicle 1000 parallel to the road. The NFS 1300 uses sensors included in the vehicle 1000 to determine the proximity of other objects to the vehicle 1000. It should be understood that in some embodiments, other parking maneuvers may be performed alternatively or in lieu of other methods, such as perpendicular parking, garage parking (which drives the vehicle into a garage), or obstacle avoidance parking (whereby the vehicle is gradually moved forward or backward to properly position the vehicle in the desired location).

[0039] The RPA function can be activated by pressing button 1910 on the remote device 1900. In the illustrated embodiment, the remote device 1900 is a smartphone with a touchscreen 1903. Button 1910 is provided in the form of an icon displayed on the touchscreen 1903. In some alternative embodiments, the remote device may alternatively be provided with physical buttons. In some embodiments, the remote device 1900 may be configured to detect dynamic gestures via the touchscreen, such as swiping, for example, sliding a user's finger in a specific direction. In some embodiments, it may be necessary to perform a swipe and hold gesture to avoid accidental activation of the function. For example, a user may need to touch a specific location on the touchscreen and slide their finger to the given location in a specific direction, and then hold their finger in that location to activate a function, such as causing the vehicle to move forward or backward, optionally in a specific direction. In some embodiments, the steering direction of the vehicle may be controlled based on the direction in which the user slides their finger. In some embodiments, other arrangements may be useful.

[0040] like Figure 2As shown in this embodiment, when vehicle 1000 receives a signal from remote device 1900, vehicle 1000 is configured to transmit the information received from remote device 1900 to GWM 1200 via CAN bus 1010. GWM 1200 then transmits the received information to NFS 1300 via CAN bus 1010. In this embodiment, User Datagram Protocol (UDP) communication protocol is used for communication between TCU 100 and GWM 1200, and between GWM 1200 and NFS 1300. It should be understood that any suitable automotive communication protocol, such as FlexRay, Ethernet, Local Area Network (LIN), or any other suitable protocol, can be used on a wired network instead of CAN bus. It should be understood that in this embodiment, the communication between remote device 1900 and vehicle 1000 uses a Cyclic Redundancy Check (CRC) method to detect communication errors. However, embodiments of the present invention implement a more complex communication integrity verification method, which is more suitable for controlling vehicle movement via consumer-grade computing devices, such as smartphones, where the manufacturer of vehicle 1000 may have little or no control over its integrity and proper operation. Therefore, NFS 1300 is configured to verify the proper operation of remote device 1900 to ensure proper control of the movement of vehicle 1000.

[0041] Figure 3 This illustrates how other vehicle components communicate with each other in this embodiment. For example... Figure 3As shown, the NFS1300 also communicates with the GWM 1200 and additionally with the motion control unit (MCU) 1400 via a separate motion control communication bus 1020. The motion control communication bus 1020 allows independent communication between each of the GWM 1200, NFS 1300, and MCU 1400. The motion control unit 1400 is configured to communicate with the vehicle's anti-lock braking system (ABS), electronic parking assist system (EPAS), brake system control module (BSCM), powertrain control module (PCM), and transmission control module (TCM). The GWM 1200 also communicates with the remote key module (RFA) 1600 and body control module (BCM) 1500 via the BCM communication bus 1030. The RFA 1600 is configured to communicate with a remote key carried by the user. The remote key 1800 is equipped with radio frequency communication capabilities. RFA 1600 is periodically configured to attempt wireless communication with remote key 1800 to determine whether remote key 1800 is within communication range with RFA 1600. If RFA 1600 determines that remote key 1800 is within communication range, RFA 1600 notifies GWM 1200 via BCM communication bus 1030, so that GWM 1200 knows at a given time whether remote key 1800 is within communication range with RFA 1600. It should be understood that unless remote key 1800 is within communication range with RFA 1600, GWM 1200 is configured to prevent certain vehicle functions, such as vehicle movement (by preventing powertrain operation) and vehicle infotainment system activation. Therefore, motion control unit 1400 is configured to require indication from GWM 1200 that powertrain operation is permitted before it can allow powertrain operation. The remote key 1800 has three user-operable controls: a master lock control button 1805, a trunk (or "backpack") unlock button 1810, and a master unlock button 1815. In response to pressing any of buttons 1805, 1810, or 1815, the remote key 1800 sends a radio signal to the RFA 1600 indicating the pressed button. The RFA 1600 then sends a signal to the BCM 1500 indicating the pressed button. If the user has pressed the master lock button 1805, the BCM 1500 locks all the doors and trunk of vehicle 100. If the user has pressed the trunk unlock button 1810, the BCM 1500 unlocks only the trunk of vehicle 100. If the user has pressed the master unlock button 1815, the BCM 1500 unlocks all the doors and trunk of vehicle 100.

[0042] like Figure 2As shown, NFS 1300 is configured to communicate with remote device 1900 via GWM 1200 and TCU 1100. It should be understood that embodiments of the invention are configured to perform a verification loop to check whether the communication link between remote device 1900 and NFS 1300 is functioning correctly, and further, whether remote device 1900 is functioning correctly. To achieve this, NFS 1300 is configured to send a verification request signal to remote device 1900 via GWM 1200 and TCU 1100, and to listen for verification request response signals sent back to NFS 1300 by remote device 1900 via TCU 1100 in response to receiving the verification request signal. It should be understood that in this embodiment, the verification request signal and the verification request response signal are signals other than those transmitted between remote device 1900 and NFS 1300 for controlling vehicle 1000. These signals also include remote device status signals sent from remote device 1900 to NFS 1300, which are signals including remote device status information indicating the status of the remote device. The status signals depend on the vehicle control function and control phase selected by the user. In this embodiment, remote device 1900 is configured to display a different GUI screen for each of the different vehicle control functions. In this embodiment, each GUI screen is assigned a number, in this embodiment, a number ranging from 1 to 6. This number indicates the nature of the operation that remote device 1900 needs to perform when the user selects the control function corresponding to a given GUI screen. In this embodiment, there are six device states: 1. Connection approved state: After establishing a connection with NFS 1300, device 1900 is placed in this state; 2. Operation selection state, in which device 1900 invites the user to select the desired operation to be performed; 3. Operation confirmation state, in which device 1900 invites the user to confirm the desired operation to be performed; 4. Operation interruption state, which is adopted by device 1900 when operation cannot be allowed to continue; 5. A maneuvering (“movement in progress”) state, adopted by device 1900 when the vehicle is being maneuvered in response to one or more control signals generated by device 1900; and 6. Avoidance mode: In avoidance mode, the device 1900 responds to user input by causing the vehicle 1000 to move in a forward or backward direction by incremental steps of a predetermined distance.

[0043] In this embodiment, the NFS 1300 is configured to enable the user to perform the following operations: a) Activate the PA function, in which NFS 1300 enables vehicle 1000 to perform automatic parking operation; b) To operate the vehicle in an avoidance operation mode, wherein, as described above, the NFS 1300 causes the vehicle to move forward or backward in short increments of predetermined distances (e.g., 10 cm, 20 cm, 30 cm, 50 cm or any other suitable predetermined distance based on previously stored values); c) The vehicle is operated in a free control mode, wherein the NFS 1300 allows the user to control the direction of movement (forward or backward), the steering angle, and the speed of the vehicle 1000. It should be understood that the remote device 1900 is configured to allow the user to select one of the above functions via a GUI, and to cause the NFS 1300 to perform the selected function. The remote device 1900 sends a status signal to the NFS 1300 associated with the GUI screen that the remote device 1900 is displaying at a given time.

[0044] Figures 4(a) through 4(d) illustrate four different GUI screens that the remote device 1900 is configured to display based on user selection. Figure 4(a) shows the GUI screen associated with the obstacle avoidance operation mode (state 6), in which the user can move the vehicle forward whenever the user presses the "Execute Obstacle" button A, in this embodiment in increments of 20 cm. Instructions for this function are provided in text box B. The user can select the forward or reverse movement of the vehicle by selecting the forward button C or the backward button D. Figure 4(b) shows the GUI screen associated with the Parking Assist (PA) function. Once the PA function is selected in state 2, the remote device 1900 enters state 4 and displays the GUI screen shown in Figure 4(b). To start and continue the PA function, the user must continuously move their finger clockwise around the perimeter of the area defined by the image displayed in the lower area of ​​the screen (in this example, the vehicle manufacturer's logo). If the user wishes to cancel the PA function, they can press the cancel button B. Once the user has moved their finger clockwise around the logo image, the remote device 1900 enters state 5 (Figure 4(c)) and begins manipulation. As shown in Figure 4(c), if the user continues to move their finger clockwise around the logo image, the NFS 1300 causes the PA function to be executed. A horizontal progress bar appears above the graphic indicator of the vehicle and indicates the degree to which the manipulation has been completed. In the example shown, the horizontal bar gradually changes color from left to right, so that when the horizontal bar is fully colored, the parking maneuver performed by the PA function is completed. If the user stops moving their finger around the logo image before the manipulation is completed, the remote device 1900 enters state 4 (manipulation interrupted), and the NFS 1300 terminates the vehicle movement. Figure 4(d) shows the screen displayed when the remote device 1900 is in state 5 and the vehicle 1000 is operated in free control mode. In this mode, the remote device 1900 displays an image V of the vehicle 1000 at the bottom of the screen; when the screen is initially displayed, point A is superimposed on the vehicle image V. The vehicle's speed is displayed on the left side of image V. Buttons B and C are provided on the right side of image V, allowing the user to select the movement of vehicle 1000 in the forward (button B) or backward (button C) direction. A linear speed scale is provided along the left edge D of the screen, spanning from 0 to 4 kph in the example shown. In some implementations, other forms of speed scales, including non-linear speed scales, may be used. Other speed ranges may be provided.

[0045] As described above, when the screen is initially displayed, point A is superimposed on the vehicle image V, indicating that the vehicle is stationary. It should be understood that in this embodiment, control of the vehicle 1000 can only be initiated via the remote device 1900 when the vehicle 1000 is stationary. To move the vehicle in the forward or reverse direction, the user selects the driving direction via buttons B and C, and then drags point A upwards on the screen. It should be understood that moving the point upwards along the x-axis X accelerates the vehicle 1000 to a speed corresponding to the distance the point has moved in the direction of increasing speed along the speed scale. The driving direction is controlled by moving the point to the left or right of the x-axis X (i.e., in the y-direction parallel to the Y-axis). Therefore, dragging point A to position E will accelerate the vehicle 1000 to a speed of approximately 2.25 kph. Dragging the point to position G (to the right of the x-axis X) will change the vehicle's steering angle to approximately 10 degrees to the right, causing the vehicle 1000 to travel along a right-turning trajectory. In some implementations, the remote device 1900 can display the predicted vehicle trajectory on a GUI, as shown at F and H respectively for points E and G.

[0046] It should be understood that when the remote device 1900 is in state 5 (operation in progress), the remote device 1900 is configured to output data to the NFS 1300 indicating the position of the user's finger on the screen of the remote device 1900 at a given moment. In some embodiments, the remote device 1900 may also output data indicating the speed and direction of the user's finger movement at a given moment. Therefore, compared to when the remote device 1900 in this state only indicates when a specific button was pressed (e.g., when the desired vehicle control function was selected (state 2) and when the selection of the given control function was confirmed (state 3)), the remote device 1900 may need to perform relatively complex operations (e.g., which may include one or more calculations, such as division or multiplication).

[0047] Therefore, to ensure that the remote device 1900 operates correctly and can correctly execute the operations required by the RVC software program, the NFS 1300 is configured to cause the remote device 1900 to perform an operation whose complexity depends on the remote device status signal. The NFS 1300 then verifies whether the operation has been successfully executed. If the NFS 1300 determines that the remote device 1900 is not operating correctly, the NFS 1300 is configured to terminate the control of vehicle movement by the remote device 1900, as will be explained later.

[0048] Figure 4(e) illustrates the operation of the NFS 1300 and the remote device 1900 in more detail. The NFS 1300 is configured to provide a challenge generator function 1320, a random number generator function 1325, and a response validator function 1340 in the computer program code.

[0049] Random number generator function 1325 generates three consecutive random numbers (or pseudo-random numbers) and provides the generated numbers to challenge generator function 1320. Challenge generator function 1320 then determines, based on the remote device status signal, which predefined operations are allowed as the basis for challenging the remote device 1900, and selects one of the predefined operations. In this embodiment, challenge generator function 1320 uses one of the random numbers generated by random number generator function 1325 to select a predefined operation from a set of available operations for the current remote device status. Figure 4(f) is a table listing 16 predefined operations that challenge generator function 1320 can select from in this embodiment. Other embodiments may employ fewer or more predefined operations. The first column of the table lists the operation index number Op_Idx, which uniquely identifies each operation for both challenge generator function 1320 and remote device 1900. The second column lists the remote device status numbers (listed above) 1 to 6 applicable to the operation.

[0050] For example, if the remote device 1900 is in state 6 and displays (for example) the GUI screen of Figure 4(a) that allows the user to move the vehicle 1000 forward or backward, the challenge generator function sets the flag OperationAllowed for each predefined operation in the predefined operations to indicate whether it is available. The challenge generator function 1320 then uses a first random number generated by a random number generator to select one of the allowed operations. In some embodiments, the first random number N generated by the random number generator is in the range from 1 to the number of operations allowed in the current device state (7 in this example), and the challenge generator selects the Nth allowed operation from the table in Figure 4(f). In some embodiments, other methods of selecting the predetermined operation may be useful. The Op_Idx value of the selected operation can be referred to as operation information because it indicates the operation to be performed by the remote device 1900 to verify the correct functioning or operation of the remote device 1900.

[0051] Then, the challenge generator function 1320 uses two remaining random numbers provided by the random number generator function 1325 as parameters to execute the selected predefined operation, and stores the result of the predefined operation in the non-volatile memory (NVM) 1335 of the NFS 1300. The two numbers used as parameters for the operation can be referred to as parameter information for the operation. It should be understood that other types of memory, such as volatile memory (VM), can be used alternatively or in addition to the above. In some embodiments, VM may have the advantage of being able to be written to and / or read from at a faster speed than NVM. In this embodiment, each operation requires two parameters. However, in some embodiments, other operations that require only one parameter can be employed. In some embodiments, operations can be performed using more than two parameters.

[0052] For example, two random numbers can form two parameters (part 1 and part 2) of an operation performed by the challenge generator function 1320. In this embodiment, the parts are 8-bit unsigned. This has the advantage that the operation can be performed on any computing device with an 8-bit architecture or higher. It should be understood that each operation selected by the challenge generator function 1320 from it is arranged to use unsigned bits and avoid overflow. An example operation is as follows: Response = ((part 1) Part 2) >> (Part 1 && 0x0F) + (Part 1 ^ Part 1) << (Part 2 - Part 1)) / (0x03)) Here, the parameter "response" is the result of the operation, and therefore the response that the remote device 1900 expects when it performs the same operation. '>>' refers to a right shift operation, '<<' refers to a left shift operation, and '^' is an XOR operation. It should be understood that the above operation utilizes several different operations that the central processing unit (CPU) of the remote device 1900 is expected to reliably execute. Therefore, after the multiplication operation of part 1 and part 2, the result is right-shifted, so the data returns to an 8-bit range. It should be understood that "0x03" is an abbreviation for "000003" representing the quantity "3". The final step of dividing by 3 is intended to avoid dividing by very large numbers, which could result in a very small numerical result that might be shown as "000000". Such a result does not meet the criteria for a valid result.

[0053] It should be understood that by using an unsigned bit in the operation, a negative number cannot be generated as the result of the operation. This feature increases the compatibility of the operation with a range of different computer system architectures, some of which may not support negative numbers. It should be understood that the operations available for challenge generator function 1320 result in deterministic output independent of the programming language and compiler used, and thus provide greater flexibility for remote device development. More generally, equations that satisfy the following conditions are advantageous: (1) It does not depend on signed arithmetic and the representation of signed numbers; (2) It prevents division by zero; and (3) It utilizes all the basic operations (arithmetic, logical, bitwise) of a general-purpose central processing unit to provide greater confidence in the operating conditions of a remote device that can use consumer-grade electronics rather than the more advanced electronics used in vehicle control systems.

[0054] The local timer function 1330 provided by NFS 1300 provides local time information to the challenge generator 1320. NFS 1300 stores the result of an operation selected using given parameters generated by the random number generator function 1325 (the expected "response" or "expected operation result information"), the identifier of the selected operation (Op_Idx, which uniquely indicates the selected operation as described above), and the local time information provided by the local timer function 1330 if the operation result is stored in NVM 1335. In this embodiment, NFS 1300 is also configured to store the index value Idx together with (a) the operation result ("expected response") and the operation identifier Op_Idx, and (b) the corresponding local time information for each stored value. In this embodiment, the index value Idx increments by a predetermined amount for each consecutive operation result. It should be understood that this local timestamp will later be used to detect communication problems (slow response, no response). Using local timestamps avoids the need for a common clock / time information between the on-board electronic control units (ECUs) of the remote device 1900 and NFS 1300. This reduces network data exchange and eliminates the problem of synchronizing clocks between the remote device 1900 and NFS 1300. It should be understood that, as described below, the index Idx can be used to detect sequence errors and facilitates faster access to stored data.

[0055] Once the result of the selected predefined operation has been generated, NFS 1300 is configured to send a verification request signal to remote device 1900. The verification request signal includes (a) an index value Idx, (b) parameter information, in this embodiment, parameters for the operation (parts 1 and 2), and (c) operation information Op_Idx in the form of an identifier for the selected operation, which remote device 1900 requires to execute the operation. In some embodiments, the index value Idx may be omitted, and local time information and parameter information, serving as the index or identifier of the operation identifier Op_Idx, may be sent instead. It should be understood that an advantageous feature of this embodiment is that it does not require sending the local time from NFS 1300 to remote device 1900. NFS 1300, acting as an interrogator, manages its own time and does not need to synchronize with remote device 1900. This feature helps the NFS 1300 compensate for internal clock jitter and the different ways of storing local timestamp information, thereby avoiding the need to synchronize time between the two devices (in this case, the NFS 1300 and the remote device 1900).

[0056] Figure 4(g) is a schematic diagram of how NFS 1300 selects the operation to be performed by remote device 1900. At step S1, remote device 1900, acting as a responder, sends a signal indicating the state of remote device 1900 to NFS 1300, which also acts as a responder. In this embodiment, the signal depends on the GUI screen displayed by the remote device. Three possible GUI screens G1, G2, and G3 are shown in Figure 4(g). It should be understood that other screens may be displayed in this embodiment. At step S3, NFS 1300 determines which operations are permitted for the current state of remote device 1900 based on the received signal, using the stored information shown in Table T1 of Figure 4(g). The third (right) column of Table T1 shows the permitted states for a given operation among the 16 operations listed in the second column of Table T1. The index value Op_Idx for each operation is listed in the first (left) column.

[0057] In the example shown in Figure 4(g), the remote device 1900 is in state 1, "Connection Approved," listed above. Table T2 illustrates the permitted operations for state 1. It can be seen that there are 6 permitted operations for state 1. At step S5, the random number generator generates three random numbers. The first is a random number N in the range of 1 to 6 (because there are 6 permitted operations). At step S7, the challenge generator 1320 selects the Nth operation from the list of permitted operations in the order presented in Table T1 (and as summarized in Table T2), and uses the second and third random numbers as parameters to calculate the result of the Nth operation. At step S9, the NFS 1300 sends the following information to the remote device 1900: 1. The index value Idx used for challenge / transfer (described above and in more detail below); 2. The identifier Op_Idx that the remote device 1900 needs to perform; and 3. The parameters to be used in the operation are the second and third random numbers generated by the random number generator 1325 (other numbers of random numbers may be useful, such as 1, 3, 5, 7, 10 or any other suitable number).

[0058] Then, the remote device 1900 determines and executes the required operation by referring to the received value of Op_Idx and the stored data showing its contents in Table T1, which provides the operation associated with the received value of Op_Idx. The remote device 1900 uses the received parameter information for the operation. Then, the remote device 1900 sends back the received index value Idx and the operation result using the received parameter information to the NFS 1300. At step S11, the NFS 1300 checks whether the received operation result using the sent parameter information corresponds to the stored value of the operation result information associated with the index value Idx of the information received from the remote device 1900 (i.e., the stored value of the expected operation result). The result of the check performed by the NFS 1300 is to determine whether the received result does correspond (i.e., the remote device 1900 has "passed" the challenge set by the NFS 1300) or the received result does not correspond (i.e., the remote device 1900 "failed" the challenge set by the NFS 1300).

[0059] Figure 5The diagram illustrates the accumulation of the stored values ​​of index Idx, local time information, operation result information, and Op_Idx in the NVM 1335. Block T0 is a schematic diagram of the contents of the NVM 1335 at time t = T0. As shown, the NVM 1335 stores data associated with a single index value. The stored data is in the form of the index value (Idx) ("1" in this example), the local time value ("000000" in this example), and operation result information in three stored value forms ("0x31" (an abbreviation of "000031"), "0x55", and "0xFE" in this example). The Op_Idx value indicates that the remote device 1900 is in state 6 (and throughout). Figure 5 (The example remains the same).

[0060] Block T1 shows the contents of NVM 1335 at time t = T1 once data corresponding to each of the two index values ​​has been stored. As can be seen from the data, the time interval between operations using continuous parameter information is 30 ms. In some implementations, other values ​​for the time interval may be useful. Block T2 shows the contents of NVM 1335 at time t = T2 once 32 index values ​​with corresponding local time and operation result information have been stored. As can be seen from block T3, which shows the contents of NVM 1335 at time t = T3 30 ms after time T2, subsequent index values ​​after the 32nd index value are restored to "1", and the local time data and operation result information are overwritten with the previous such data corresponding to the same index value. Therefore, NFS 1300 implements a circular caching method for storing data in NVM 1335. It should be understood that using a circular caching method helps reduce memory usage and automatically purge old stored values ​​by rewriting with new values ​​more frequently. This makes the algorithm faster, and the system will discard responses (relatively old messages) that arrive too late. This reduces the risk of replay attacks on the system. A replay attack refers to a situation where data sent by remote device 1900 to control vehicle 1000 is fraudulently repeated or delayed by a third party. It should be understood that, depending on the actual protocol, electrical architecture, and system requirements, there are other values ​​for the number of index values ​​that can be stored before a flip occurs. The larger the value, the more memory is required to implement this method. However, a value that is too small will result in more frequent flips and may cause the system to be overly sensitive to electrical and / or electromagnetic noise.

[0061] Figure 6This is a flowchart illustrating the operation of the NFS 1300, which acts as an interrogator, in more detail. At step S101, the NFS 1300 initializes the local timer function 1330 by setting the initial value of the time information associated with it to a predetermined base timer value (e.g., zero). It should be understood that initialization can also be referred to as “resetting” the timer function 1330. The local timer function 1330 starts timing from the base timer value. At step S103, the random number generator function 1325 is also initialized (or “reset”). It should be understood that the random number generator function can be provided as a hardware-based true random number generator or a software-based pseudo-random number generator that requires a “seed” value to initialize the software. The initialization or reset of the random number generator function typically occurs after a saturation period (when the random number begins to repeat) or at each power cycle. In this embodiment, the random number generator function 1325 is implemented in software. At step S105, “old” data stored in the NVM 1335 is cleared. In some implementations, this is done by setting all stored values ​​to predetermined values, such as 0. Therefore, in this implementation, the stored values ​​corresponding to (a) the index value, (b) the result value of the operation, and (c) the local time information associated with the operation are set to predetermined values, such as 0. At step S107, the current value of the index, i.e., the current index value, is reset to a base value or starting value. In this implementation, the base value is "1". At step S109, NFS 1300 checks whether the remote device 1900 has established a communication connection with TCU 1100. If the remote device 1900 has not yet established a connection, NFS 1300 repeats step S109. That is, NFS 1300 does not generate any challenges through the challenge generator 1320 until the remote device 1900 successfully connects to the vehicle 1000. If a connection has been established with the remote device 1900, then at step 111, the NFS 1300 initiates the periodic timer function by storing a periodic timer start value in its memory, which is the current value of the time information output by the local timer function 1330. In this embodiment, the periodic timer start value is stored in the NVM 1335. In some embodiments, other methods of implementing the periodic timer function are useful.

[0062] At step S113, a random challenge is generated. The challenge generator 1320 generates the challenge in the form of an operation to be performed by the remote device 1900 in the manner described above (see, for example, Figure 4(g)). At step S115, the challenge generator 1320 performs the predefined operation described above. At step S117, the challenge generator 1320 determines whether the operation result meets a specific predefined criterion to consider it valid. If the result does not meet the criterion, it is considered invalid, and the method continues at step S113. If the result does meet the criterion, it is considered valid, and the method continues at step S119.

[0063] In this embodiment, for the operation result to be considered valid, the memory data bits representing the result cannot all be logic "1" or all be logic "0". It should be understood that one or more other criteria or conditions may be useful alternatively or in lieu of them. The function of the challenge generator 1320 in performing predefined operations has the advantage that the challenge generator 1320 can verify whether the result of the challenge meets the predefined criteria before the challenge is sent to the remote device 1900. It should be understood that if the result of the predefined operation is all memory bits are logic "1" or logic "0", the NFS 1300 may not be able to distinguish it from a corrupt response from the remote device 1900 where all bits are set to logic "1" or "0". Furthermore, by performing the operation at this stage and storing the result in the NVM 1335, rather than just storing parameter information, the NFS 1300 can determine more quickly whether the result of the operation performed by the remote device 1900 corresponds to a "correct" response to the given parameter information, because the NFS 1300 does not have to perform the operation after receiving the verification request response signal.

[0064] At step S119, the index value is incremented by a predetermined amount, which is "1" in this embodiment. At step S121, NFS 1300 determines whether the predetermined maximum value of the index has been reached, which is "32" in this embodiment. If the maximum value has been reached, the index value is reset to a predetermined index baseline value, which is "1" in this embodiment, at step S123. If the maximum value has not been reached, the method continues at step S125. It should be understood that this implementation of the circular cache technique enables the software to use a static array, which can help demonstrate deterministic behavior in the context of functional safety and compliance with required standards, such as the International Organization for Standardization (ISO) 26262 functional safety standard and the Software Reliability Association for the Automotive Industry (MISRA) standard. At step S125, NFS 1300 stores the current value of the index, the current value of the time output by timer function 1325, and the result of the operation using the generated parameter information in NVM 1335. At step S127, NFS 1300 sends the parameter information generated at step S113 and the value of Op_Idx (indicating the operation to be performed) together with the index value Idx stored in the NVM at step S125 to the remote device 1900. In other words, NFS 1300 sends a "challenge" to the remote device 1900 for execution by the remote device 1900, so that NFS 1300 can verify the correct function (or operation) of the remote device 1900.

[0065] At step S129, NFS 1300 determines the amount of time that has elapsed since the latest value of the periodic timer start value was stored. This is achieved by comparing the current value of the time information output by the local timer function 1330 with the stored periodic timer start value. If the difference between the values ​​exceeds a predetermined amount, NFS 1300 determines that the periodic timer function has expired, and the method continues at step S109; otherwise, step S129 is repeated. In this embodiment, the method is configured such that NFS 1300 waits until at least 30 ms has elapsed since the latest value of the periodic timer start value was stored before continuing at step S109. Therefore, NFS 1300 is configured such that at least 30 ms elapses between consecutive verification request signal transmissions. It should be understood that by periodically sending challenges, embodiments of the present invention can detect failures in the form of communication loss, regardless of the communication protocol used (whether Wi-Fi, Bluetooth, or others). Upon receiving a verification request signal from NFS 1300 (via GWM 1200 and TCU 1100), remote device 1900 provides the received index value Idx, time information, Op_Idx value, and parameter information to the response generator function 1920 (FIG. 4(e)) implemented by remote device 1900 in the form of computer program code. Response generator function 1920 is configured to perform the same predefined operation (defined by the value of Op_Idx) as the operation performed by challenge generator function 1320 of NFS 1300 using the received parameter information. Then, remote device 1900 sends a verification request response signal back to NFS 1300 via TCU 110 and GWM 1200. The verification request response signal includes the result of the predefined operation using the received parameter information and the corresponding index value, as well as the local time information received by remote device 1900 from NFS 1300.

[0066] Figure 7The operation of the remote device 1900 is shown in more detail. At step S201, the remote device 1900 checks whether a communication link has been established with the TCU 1100 of the vehicle 100. If a link has been established, the method continues at step S203; otherwise, the method repeats step S201. At step S203, the remote device 1900 checks whether a verification request signal has been received from the NFS 1300 of the vehicle 1000. That is, the remote device 1900 determines whether a new "challenge" has been received from the NFS 1300. If such a signal has been received, the method continues at step S205; otherwise, the NFS 1300 continues at step S201. At step S205, the response generator function 1920 performs a predefined operation using the received parameter information as described above. This predefined operation corresponds to the operation performed by the challenge generator function 1320 of the NFS 1300 and is indicated by the value of Op_Idx. In step S207, the remote device 1900 combines the result of the predefined operation with the index value and time information received from the NFS 1300 via a verification request signal. In step S209, the remote device 1900 sends the result of the predefined operation and the received index value to the NFS 1300 in the form of a verification request response signal. Therefore, the verification request response signal can be considered to include data corresponding to the remote device 1900's response to a challenge received from the NFS 1300. The method then continues in step S201.

[0067] Upon receiving a verification request response signal, NFS 1300 is configured to check whether the value of the result of a predefined operation performed by remote device 1900 (i.e., "received operation result information") corresponds to an expected value (i.e., expected operation result information) stored in NVM 1335 by NFS 1300. As shown in FIG4, NFS 1300 has a response verifier 1340 that receives the verification request response signal from remote device 1900. The response verifier 1340 retrieves from NVM 1300 an index value Idx that is the same as the index value contained in the received verification request response signal, and a previously stored value of the result of the predefined operation corresponding to the local time information stored in NVM 1300. The response verifier 1340 compares the stored value of the result of the predefined operation with the value contained in the received verification request response signal; if the values ​​are the same, the response verifier 1340 determines that a "correct response" has been received. If the values ​​do not match, the response verifier 1340 determines that an "incorrect response" has been received. Then, the response verifier 1340 rewrites the stored response to set the value of the result of the operation stored in NVM 1335 to a predetermined value, which is 0 in this embodiment. As discussed below, this function has the advantage of preventing malicious replay attacks.

[0068] The response verifier 1340 also checks the length of time elapsed between the time when the challenge generator 1320 stores the information associated with the index value in the NVM 1335 and the time when the response verifier 1344 receives the verification request response signal. This is achieved by storing the local time at which the response verifier 1340 receives the verification request response signal together with the information already stored in the NVM 1335 and associated with the same index value, and comparing the two values ​​of the stored time information. If the amount of time elapsed exceeds a predetermined “slow response” threshold, the response verifier 1340 determines that the verification request response signal corresponds to a “slow response.” Similarly, if the expected value of a predefined operation does not correspond to the value contained in the verification request response signal, the response verifier 1340 determines that an “erroneous response” has been received. If the number of slow responses or the number of erroneous responses exceeds a predetermined threshold within a predetermined time period, the response verifier 1340 is configured to stop the vehicle 100 and prevent further movement of the vehicle 100 in response to receiving a signal from the remote device 1900.

[0069] Figure 8 The contents of NVM 1335 before (block T1) and after (block T1') receiving the first authentication request response signal S from remote device 1900 are shown. Immediately before receiving the first authentication request response signal S, NVM 1335 has data associated with four index values ​​Idx = 1 to Idx = 4 stored therein. As can be seen from block T1, the local time storing the first index value Idx = 1 is time "000000", and subsequent index values ​​are stored at time intervals corresponding to 30 ms intervals of "000030". When the local time is "000130", the authentication request response signal S is received by the responding validator 1340. Therefore, as... Figure 8As shown in block T1', the response verifier 1340 stores the time of receiving the signal S in NVM 1335 and associates the stored time value with the index value contained in the signal S, i.e., with the index value Idx = 1. The response verifier 1340 then compares the value of the operation result with the value received in the verification request response signal S to determine if they match; in this example, they do match, and therefore, as also shown in block T1', the response verifier 1340 sets the stored value of the operation result to 0. It should be understood that, according to this embodiment, the NFS 1300 only begins checking for communication failures based on the time elapsed since the first response was received. This function reduces the computational burden on the NFS 1300 by allowing it to adapt to communication time delays associated with the system in this way. Furthermore, this function alleviates the problem of the NFS 1300 determining that a "timeout" failure has occurred when communication with the remote device 1900 was initially established. Therefore, once the first response is received, the NFS 1300 expects continuous responses to arrive periodically, in this embodiment, one response every 30 ms.

[0070] The operation of NFS 1300 in receiving authentication request response signals will now be described in more detail. (Refer to...) Figure 9 At step S301, the response verifier 1340 initializes an inactive timer. The response verifier 1340 can do this by setting the initial value of the inactive timer to a predetermined value, such as 0. At step S303, the response verifier 1340 checks whether the remote device 1900 has established a connection with the TCU 1100. If such a connection has been established, the response verifier 1340 continues at step S305; otherwise, it repeats step S303. At step S305, if the inactive timer has not yet been started, the response verifier 1345 starts the inactive timer. At step S307, the response verifier 1340 checks whether a new verification request response signal has been received. That is, whether a new response to the challenge sent to it by the NFS 1300 has been received from the remote device 1900. If a new verification request response signal has been received, the response verifier 1340 continues at step S311; otherwise, the response verifier 1340 continues at step S309. At step S309, the response validator checks whether the time elapsed since the inactivity timer started has exceeded the inactivity threshold. If the elapsed time has indeed exceeded the inactivity threshold, the response validator 1340 continues at step S339; otherwise, the response validator 1340 continues at step S303.

[0071] At step S311, the response verifier 1340 determines whether the received response is the first response since the response verifier 1340 determined the connection to the remote device at step S303. If so, the response verifier 1340 continues at step S313; otherwise, the response verifier 1340 continues at step S315. At step S313, the response verifier 1340 determines the total delay value, which is the sum of the current local time information generated by the local timer 1330 and the time between the current local time and the time between the current local time information generated by the local timer 1330 and the time between the current local time information ... Figure 6 In step S109, the time difference between the time the challenge generator 1320 sends the first verification request signal to the remote device 1900 after the connection to the remote device 1900 is determined. The time when the challenge generator 1320 sends the first verification request signal to the remote device 1900 is obtained by referring to the stored time information corresponding to the first index value (Idx = 1). It should be understood that this feature enables the NFS 1300 to automatically estimate the total delay of signal transmission from the NFS 1300 (acting as a challenger) to the remote device 1900 (acting as a responder) and back to the NFS 1300 (acting as a challenger), and eliminates the need for manual adjustment. In some embodiments, this measurement of delay is stored and can later be used to detect abnormal responses, such as responses that take an unacceptably long time to receive.

[0072] At step S315, the response verifier 1340 extracts the index value Idx from the newly received verification request response signal and records the current value of the local time information generated by the local timer function 1330. At step S317, the response verifier 1340 determines whether there is an entry in the NVM 1335 corresponding to the received index value Idx, i.e., an entry with the same index value. If a corresponding entry does exist, the response verifier 1340 continues at step S319; otherwise, the response verifier 1340 continues at step S323. At step S323, the response verifier 1340 increments the error response counter value and continues at step S325. It should be understood that the response verifier's checking for a corresponding entry with the same index value in the NVM 1335 and incrementing the error response counter if no such entry is found enables the system to prevent "brute-force" attacks by third parties adding signals with all possible combinations of parameter values ​​or combinations of randomly generated parameter values. This feature also detects situations where the responder incorrectly sends an index value back to the interrogator due to errors, such as those associated with hardware or software (in this embodiment, sent back to NFS 1300 by remote device 1900). At step S325, the response verifier 1340 checks whether the error response counter value exceeds the error response counter threshold; if the error response counter value does exceed the threshold, the response verifier 1340 continues at step S339; otherwise, the response verifier 1340 continues at step S307. It should be understood that the error response counter threshold can be set to any desired value, for example, a value that depends on the given application use case and the communication protocol employed. For example, the value could be 2, 3, 4, 5, 10, or any other suitable value. At step S339, the response verifier 1340 interrupts or cancels the remote device 1900's control over the vehicle 1000, meaning the NFS 1300 no longer allows the remote device 1900 to control the vehicle's movement. In this embodiment, the NFS 1300 causes the braking system of the vehicle 1000 to bring the vehicle to an immediate stop. As described above, if the response verifier 1340 determines in step S317 that an entry corresponding to the received index value Idx exists in the NVM 1335, the response verifier 1340 continues in step S319. In step S319, the response verifier 1340 retrieves the values ​​of the operation result information and local time information associated with the index value Idx corresponding to the index value of the received verification request response signal from the NVM 1335. In step S321, the response verifier 1340 determines whether the value of the operation result contained in the verification request response signal is the same as the corresponding operation result information retrieved from the NVM 1335. That is, the NFS 1300 determines whether the response from the remote device 1900 to the challenge sent by the NFS 1300 corresponds to the expected response (i.e., the correct response).If the value of the operation result contained in the verification request response signal differs from the corresponding operation result information retrieved from NVM 1335, the response verifier 1340 continues at step S323; otherwise, the response verifier 1340 continues at step S327. At step S327, the response verifier 1340 calculates a signal delay value, which is the difference between the local time information generated by the local timer 1330 when the verification request response signal is received and the time when the challenge generator 1320 stores the corresponding operation result information in NVM 1335. The signal delay value provides an indication of the elapsed time between NFS 1300 sending the verification request signal and NFS 1300 receiving the verification request response signal. At step S329, the response verifier 1340 determines whether the signal delay value exceeds a predetermined signal delay value threshold. If the signal delay value does exceed the threshold, the response verifier 1340 continues at step S331; otherwise, the response verifier 1340 continues at step S335. In this embodiment, the signal delay threshold is 30 ms, although other values ​​may be useful in some embodiments. It should be understood that in this embodiment, the signal delay threshold is set to a value that does not exceed the period between transmissions of the NFS 1300's authentication request signal to the remote device 1900. As discussed above, in some embodiments, the period between transmissions of the NFS 1300 is 30 ms.

[0073] In some implementations, NFS 1300 can be configured to set a predetermined “slow response” threshold to a value that depends on the estimated total delay value, such as equal to the estimated delay value multiplied by a predetermined factor. In some implementations, the delay value may be determined by the system to be approximately 10 ms, and the predetermined factor may be approximately 3 or any other suitable value. It should be understood that the factor can be selected such that the amount of time elapsed before stopping the vehicle from moving does not exceed a desired maximum value, such as 100 ms, 200 ms, 300 ms, 400 ms, 500 ms, 1000 ms, or any other desired maximum value. It should be understood that the value of the factor can be selected taking into account delays in other vehicle systems, such as delays associated with the vehicle braking system. It should be understood that the system can be configured such that the predetermined slow response threshold cannot be set to a value higher than a predetermined maximum permissible value. As described above, in this implementation, the signal delay threshold is set to a value that does not exceed the period between the transmission of the verification request signal from NFS 1300 to remote device 1900. It should be understood that in some implementations, the signal delay threshold may vary dynamically, at least in part, based on the total delay value determined at step S313. Alternatively, in some implementations, the signal delay threshold may be calculated at least in part based on the value of the signal delay value calculated at step S327 for a predetermined number of past values ​​(e.g., the average of a predetermined number of past values, such as the past 5, 10, 15, or any suitable number of consecutive past values).

[0074] At step S331, the response verifier 1340 increments the slow response counter and clears the stored operation result information about the index value associated with the received verification request response signal from the NVM 1335. At step S333, the response verifier 1340 determines whether the slow response counter exceeds a predetermined slow response counter threshold. If the slow response counter does exceed the predetermined slow response counter threshold, the response verifier 1340 continues at step S339 (as described above); otherwise, the method continues at step S307. It should be understood that this feature helps protect the system from replay attacks as described above, in which a correct response is received, but from a third-party (fraudulent) source. This feature also protects the system from the following error: the index value Idx is corrupted by the remote device 1900 or corrupted during transmission between the remote device 1900 and the NFS 1300, but the received response is still valid. The predetermined slow response counter threshold can be set to any suitable value, such as 3, 4, 5, 10, 15, 20, or any other suitable value. For example, it should be understood that if the estimated total latency is 10 ms and the predetermined factor is 3 (and therefore the slow response threshold will be 30 ms) and the predetermined slow response counter threshold is 3, then if the system becomes systematically slow and the response counter receives responses exceeding 30 ms in three consecutive moments, the NFS1300 will execute step S339 and will prevent the vehicle from moving. At step S335, the response verifier 1340 clears the stored operation result information about the index values ​​associated with the received verification request response signals from the NVM 1335. At step S337, the response verifier 1340 continues operation by proceeding to step S303.

[0075] Figure 10 It shows in Figures 1 to 9 The method in this implementation verifies the correspondence between the verification request signal and the verification request response signal. Figure 10 At step S401, the challenge generator 1320 executes the function Gen_challenge(), in which it receives three random numbers from the random number generator 1325. The first random number is used to select an operation from the list of allowed operations for the current remote device state (the selected operation is identified by the value of Op_Idx), while the remaining two random numbers form the parameters Chlng_Part1 and Chlng_Part2 (i.e., parameter information for the predefined operation), referred to above as Part 1 and Part 2, respectively. At step S403, the challenge generator associates the parameter information and the value of Op_Idx with the index value Idx for transmission to the remote device 1900. The challenge generator 1320 also assigns the local time value ( Figure 10(Not indicated in the text) is associated with this information; however, in this embodiment, the local time value is not sent to the remote device 1900.

[0076] At step S405, the challenge generator 1320 uses the function Gen_Response() to perform the operation defined by the value Op_Idx using the generated parameter information. At step S407, as described above, the challenge generator 1320 stores the result of the operation, the "response," in NVM 1335 after checking that the result meets the requirements for a valid result. In some embodiments, NFS 1300 is configured to prevent vehicle 1000 from moving in response to motion control signals received from remote device 1900 based on whether the order in which consecutive verification request response signals are received corresponds to the order in which consecutive verification request signals are sent to remote device 1900. If NFS 1300 receives out-of-order verification request response signals, NFS 1300 may increment an "out-of-order" counter. If the counter increments by more than a predetermined number within a predetermined time period, NFS 1300 may prevent vehicle 1000 from moving in response to motion control signals received from remote device 1900. In other words, NFS 1300 can be configured to prevent vehicle 1000 from moving in response to motion control signals received from remote device 1900 based on the number of times the order in which consecutive authentication request response signals are received does not correspond to the order in which consecutive authentication request signals are sent within a given time period. It should be understood that this embodiment is capable of detecting the number of possible errors in communication between the user and NFS 1300. If a hardware failure occurs associated with remote device 1900 or a Wi-Fi link failure occurs between remote device 1900 and vehicle 1000, NFS 1300 will not receive authentication request response signals in response to authentication request signals sent by NFS 1300. Furthermore, if authentication request signals or authentication request response signals are corrupted, the value of the result of an operation performed using the parameter information sent by NFS 1300 will not match the corresponding value stored in NVM 1335.

[0077] Some embodiments of the present invention can also distinguish between user inactivity and communication interruption failures. In some embodiments, NFS 1300 repeatedly requests a response from remote device 1900 by repeatedly sending authentication request signals. Therefore, if the expected authentication request response signal is received, NFS 1300 can determine that no communication interruption failure has occurred even if the user is idle. Furthermore, by requiring remote device 1900 to perform operations with new parameter information each time an authentication request signal is received, the result cannot be predicted before each authentication request signal and the parameter information it provides, allowing NFS 1300 to have increased confidence that remote device 1900 is operating correctly. The feature of response verifier 1340 recording slow and erroneous responses enables response verifier 1340 to detect when the communication state between the user and NFS 1300 may be unsuitable for continuing remote vehicle operation via remote device 1900, and to terminate remote vehicle operation. It should be understood that this feature allows the system to respond to user requests to stop vehicle 1000 within a given time limit even in the event of unexpected communication delays or failures. It should be understood that continuing to operate the system in the presence of large time delays may increase the time interval between the transmission of consecutive verification request signals, for example, from 30 ms to 60 ms. However, such a long time interval could, for example, prevent NFS 1300 from stopping vehicle 1000 quickly enough if a user requests vehicle 1000 to stop using remote device 1900, and could result in an excessive delay between NFS 1300 sending the verification request signal and NFS 1300 receiving the corresponding verification request response signal.

[0078] It should be understood that in this embodiment, NFS 1300 is configured to generate and send an authentication request signal to remote device 1900 only when remote device 1900 is connected to TCU 1100. If the connection is lost, for example, if remote device 1900 moves out of range or its Wi-Fi function is turned off, NFS 1300 stops sending the authentication request signal.

[0079] In some embodiments of the invention, NFS 1300 is configured to communicate with a remote device provided at a fixed location, and the remote device provides location information to NFS 1300 to assist NFS 1300 in guiding vehicle 1000 to a desired location by providing guidance information. In embodiments, such as Figure 11As schematically shown, smart pillars 2900 are positioned at intervals along the desired travel path of the vehicle. Each pillar 2900 is configured to sense the position of the vehicle 1000 relative to the pillar 2900 and provide relative position information to the NFS 1300, thereby enabling the NFS 1300 to guide the vehicle's path past the pillar 2900 without colliding with it. In some embodiments, the NFS 1300 may be configured to guide the vehicle 1000 along a trajectory that causes the vehicle 1000 to pass the pillar 2900 at a desired distance from it. Figure 11 As shown, a row of pillars 2900 can be provided along one side of the desired travel path of vehicle 1000. In some embodiments, the smart pillars 2900 can be positioned on both sides of the desired travel path of vehicle 1000. NFS 1300 can be configured to communicate with the smart pillars 2900 using a method similar to that used for communication between NFS 1300 and remote device 1900. That is, using the above reference... Figures 1 to 10 The question / response method described.

[0080] It should be understood that some embodiments of the present invention have the advantage of being able to be implemented substantially independently of the communication medium and protocol used. Some embodiments of the present invention have the advantage of being able to be implemented substantially independently of the operating system or programming language used for the remote device software. Some embodiments have the advantage of providing end-to-end protection by employing CRC technology. Some embodiments have the advantage of providing end-to-end protection by detecting errors, such as one or more sequence errors relating to a verification request response signal received by the vehicle in response to a verification request signal sent by the vehicle, computational errors, timing errors, and communication errors generated by the remote device based on a challenge received from the NFS acting as the challenger. Some embodiments have the advantage of being computationally faster and requiring fewer resources compared to methods employing complex data structures such as linked lists. Some embodiments have the advantage of being able to decouple the development environments of the vehicle acting as the challenger and the remote device acting as the responder. This enhances the flexibility of vehicle developers, at least by reducing constraints associated with devices or software provided by a particular manufacturer or software developer (also known as vendor bundling). This is at least in part because embodiments can be provided that are independent of the use of a particular programming language or particular computing hardware. As described herein, some embodiments of the present invention do not require clock synchronization between the vehicle and the remote device. This is at least in part because in some implementations, the vehicle control electronics (NFS 1300 in the implementation described above) use local timestamps and do not require time information to be provided by remote devices. It should be understood that many of the parameters described herein are configurable, as the values ​​adopted can be changed depending on the specific intended application. For example, the number of different index values ​​stored in memory before the index values ​​are overwritten can be changed depending on the intended application.

[0081] like Figure 12As shown, it should be understood that the NFS 1300 includes at least one controller 1360, which includes at least one electronic processor 1361 having one or more electrical inputs 1362 for receiving one or more input signals 1363 and one or more electrical outputs 1364 for outputting one or more output signals 1365. The controller 1360, or each controller 1360, also includes at least one storage device 1366 electrically coupled to the at least one electronic processor 1361 and having instructions 1368 stored therein. The at least one electronic processor 1361 is configured to access at least one storage device 1366 and execute instructions 1368 stored therein, arranged to control the movement of a motor vehicle in response to a signal received from a remote device, or to provide input to the system to control the movement of the motor vehicle, wherein the at least one controller 1360 is arranged to execute a verification loop, in which the control system is configured to: send a verification request signal to the remote device; listen for a verification request response signal sent from the remote device in response to the sent verification request signal; and listen for a remote device status signal sent from the remote device providing remote device status information indicating which of a plurality of predefined states the remote device is currently in. The system operates in a state where the verification request signal includes information indicating the operation to be performed using parameter information, and the information indicating the operation to be performed depends on the remote device state information. The system is also configured to determine whether the information included in the verification request response signal received from the remote device includes expected operation result information, which is operation result information corresponding to the expected result of the operation defined by the information indicating the operation to be performed provided in the verification request signal. The system is configured to control the movement of the vehicle in response to a motion control signal received from the remote device, based on the correspondence between the received operation result information and the expected operation result information, or to provide input to the system to control the movement of the vehicle.

[0082] The electronic processor or each electronic processor 1361 may include any suitable electronic processor (e.g., microprocessor, microcontroller, ASIC, etc.) configured to execute electronic instructions. The electronic storage device 1366 or each electronic storage device 1366 may include any suitable storage device and may store various data, information, thresholds, lookup tables, or other data structures and / or instructions therein or on it. In embodiments, the storage device 1366 has information and instructions stored therein or on it for software, firmware, programs, algorithms, scripts, applications, etc., which may govern all or part of the methods described herein. The processor or each electronic processor 1361 may access the storage device 1366 and execute and / or use the instructions and information or such instructions and information to implement or perform some or all of the functions and methods described herein. The at least one storage device 1366 may include a computer-readable storage medium (e.g., a non-transitory or non-transient storage medium), which may include information for storing machine or electronic processor / computing device / computer device in a readable form, including but not limited to: magnetic storage media (e.g., floppy disk); optical storage media (e.g., CD-ROM); magneto-optical storage media; read-only memory (ROM); random access memory (RAM); erasable programmable memory (e.g., EPROM or EEPROM); flash memory; or an electrical medium or other type of medium for storing such information / instructions.

[0083] As described above, it should be understood that controller 1360 or each controller 1360 may include a control unit or computing device having one or more electronic processors 1361 (e.g., microprocessors, microcontrollers, application-specific integrated circuits (ASICs), etc.), and may include a single control unit or computing device. Alternatively, different functions of controller 1360 or each controller 1360 may be embodied in or hosted in different control units or computing devices. As used herein, the terms “controller,” “control unit,” or “computing device” (or “computer device”) should be understood to include a single controller, control unit, or computing device, as well as multiple controllers, control units, or computing devices that operate together to provide the desired control functions. A set of instructions may be provided that, when executed, causes controller 1360 to perform some or all of the control techniques described herein, including some or all of the functions required by the methods described herein. This set of instructions may be embedded in the one or more electronic processors of controller 1360; or alternatively, this set of instructions may be provided as software to be executed in controller 1360. The first controller or control unit may be implemented in software running on one or more processors. One or more additional controllers or control units may be implemented in software running on one or more processors, optionally the same one or more processors as the first controller or control unit. Other arrangements may also be used. Example controller 1360 has been described as including at least one electronic processor 1361 configured to execute electronic instructions stored in at least one storage device 1366, which, when executed, cause the electronic processor 1360 to perform the methods described above. However, it is contemplated that the invention is not limited to implementation by a programmable processing device, and at least some of the functional and / or method steps of the invention, and in some embodiments all of them, can be implemented by non-programmable hardware, such as non-programmable ASICs, Boolean logic circuits, etc.

[0084] It should be understood that various changes and modifications can be made to this invention without departing from the scope of this application.

Claims

1. A control system comprising one or more controllers, the control system being arranged to control or provide inputs to the system to control the movement of a motor vehicle in response to motion control signals received from a remote device, wherein, The control system is arranged to execute a verification loop, in which the control system is configured to: Send a verification request signal to the remote device; Listen for the verification request response signal sent from the remote device in response to the sent verification request signal; Listen for remote device status signals sent from the remote device, which provide remote device status information indicating which of a plurality of predefined states the remote device is currently operating in. The verification request signal contains information, including operation information indicating the operation to be performed, which depends on the remote device status information. The control system is further configured to determine whether the information contained in the verification request response signal received from the remote device includes expected operation result information, which is operation result information corresponding to the expected result of the operation defined by the operation information provided in the verification request signal. The control system is configured to respond to a motion control signal received from the remote device by controlling the movement of the vehicle based on the correspondence between the received operation result information and the expected operation result information, or by providing input to the system to control the movement of the vehicle. The operation information, which depends on the remote device status information, includes operation information selected from a predetermined group of one or more operations associated with each of the plurality of predefined states that the remote device can operate.

2. The system according to claim 1, wherein, The one or more operations in each corresponding group of one or more operations are configured to cause the remote device to perform an operation that is expected to be performed as part of normal operation in the corresponding predefined state when the remote device is operating in that predefined state.

3. The system according to claim 1 or 2, wherein, The system is configured to determine expected operational outcome information and store the expected operational outcome information, along with a corresponding identifier, in a memory associated with the control system. The system is configured to include identifier information in the verification request signal, the identifier information being information indicating an identifier associated with the operational information contained in the verification request signal. The system configured to determine whether the information contained in the verification request response signal received from the remote device includes expected operation result information includes: a system configured to compare the received result information with the stored expected result information associated with the same identifier information.

4. The system according to claim 3, wherein, The system is configured such that once a verification request response signal containing identifier information has been received and the system has compared the received result information with the stored expected result information associated with the identifier information, the system is configured not to compare other received expected result information associated with the identifier information until new expected result information corresponding to the identifier information has been stored.

5. The system according to claim 4, wherein, The system is configured to delete the stored expected result information and the corresponding identifier information from the memory once a verification request response signal containing identifier information has been received and the system has compared the received result information with the corresponding stored expected result information associated with the identifier information.

6. The system of claim 1, wherein the system is configured to prevent the vehicle from responding to motion control signals received from the remote device based on the number of times the system receives a verification request response signal in which the received result information does not correspond to the corresponding stored expected result information within a specified time period.

7. The system of claim 1, wherein the system is configured to prevent the vehicle from moving in response to a motion control signal received from the remote device based on whether the order in which consecutive verification request response signals are received corresponds to the order in which consecutive verification request signals are sent.

8. The system according to claim 7, wherein, The system is configured to prevent the vehicle from responding to motion control signals received from the remote device based on the number of times the order in which consecutive verification request response signals are received within a given time period does not correspond to the order in which consecutive verification request signals are sent.

9. The system of claim 1, wherein the system is configured to perform cyclic redundancy check on the received data.

10. The system according to claim 1, wherein, The verification request signal also includes parameter information indicating one or more parameters to be used in the operation to be performed.

11. A method for controlling the motion of a vehicle via a control system, the method comprising controlling or providing input to the system in response to a motion control signal received from a remote device to control the motion of a motor vehicle, the method comprising executing a repetitive verification loop, the method comprising: Send a verification request signal to the remote device; Listen for the verification request response signal sent from the remote device in response to the sent verification request signal; Listen for remote device status signals sent from the remote device, which provide remote device status information indicating which of a plurality of predefined states the remote device is currently operating in. The verification request signal contains information including operation information indicating the operation to be performed. This operation information depends on the remote device state information, and the operation information dependent on the remote device state information includes operation information selected from a predetermined group of one or more operations associated with each of a plurality of predefined states operable by the remote device. The method further includes determining whether the information contained in the verification request response signal received from the remote device includes expected operation result information, wherein the expected operation result information is operation result information corresponding to the expected result of the operation defined by the operation information provided in the verification request signal. The method further includes responding to a motion control signal received from the remote device by controlling the movement of the vehicle based on the correspondence between the received operation result information and the expected operation result information, or by providing input to the system to control the movement of the vehicle.

12. A remote device configured to communicate with a control system, the control system being arranged to control or provide input to the system to control the movement of a motor vehicle in response to a motion control signal received from the remote device, wherein... The remote device is configured to: The system sends a remote device status signal to the control system. This remote device status signal provides remote device status information indicating which of a plurality of predefined states the remote device is currently operating in. Listen for verification request signals sent by the control system, wherein the verification request signals contain information including operation information indicating the operation to be performed, wherein the operation information, depending on the remote device status information, includes operation information selected from a corresponding predetermined group of one or more operations associated with each of the plurality of predefined states that the remote device can operate. In response to receiving a verification request signal from the control system, the system executes the indicated predefined operation. The device is configured to send a verification request response signal after performing the predefined operation in response to receiving the verification request signal, the verification request response signal containing information indicating the result of the indicated predefined operation.

13. The remote device of claim 12, wherein the remote device is configured to receive a verification request signal further comprising parameter information for an operation to be performed, the remote device being configured to perform the predefined operation using the received parameter information.

14. The remote device according to claim 12 or 13, wherein the remote device is configured to receive a verification request signal further comprising identifier information, the identifier information being information indicating an identifier associated with the operational information contained in the verification request signal, and the device is configured to include identifier information in the verification request response signal indicating an identifier associated with the verification request signal in response to which it sends the verification request response signal.

15. A method for controlling the motion of a vehicle having a control system, the method comprising communicating with a control system via a remote device, the control system being arranged to control or provide input to the system to control the motion of the motor vehicle in response to a motion control signal received from the remote device, the method comprising: The system sends a remote device status signal to the control system. This remote device status signal provides remote device status information indicating which of a plurality of predefined states the remote device is currently operating in. Listen for verification request signals sent by the control system, wherein the verification request signals contain information including operation information indicating the operation to be performed, wherein the operation information, depending on the remote device status information, includes operation information selected from a corresponding predetermined group of one or more operations associated with each of the plurality of predefined states that the remote device can operate. In response to receiving a verification request signal from the control system, the system executes the indicated predefined operation. The method includes, in response to receiving the verification request signal, sending a verification request response signal from the remote device after performing the predefined operation, the verification request response signal containing information indicating the result of the indicated predefined operation.

16. A non-transitory computer-readable storage medium having instructions stored thereon, the instructions, when executed by one or more electronic processors, causing the one or more electronic processors to perform the method of claim 11 or claim 15.

Images