Anti-failure, anti-shielding and anti-interference vehicle-mounted supervision device and method

Abstract

The present application relates to the field of vehicle-mounted intelligent supervision and wireless environment sensing technology, and discloses a kind of anti-failure anti-shielding anti-interference vehicle-mounted supervision equipment and method.Equipment detects the demodulation quality of the wireless receiving channel of different working frequency bands, the background power of different frequency bands and the spatial synchronous response of multiple capacitive sensing electrodes in the radio frequency silence measurement time slot, identifies shielding, interference and regional signal loss.During the wireless abnormal period, the rhythm observation time and sensor trigger reference event are recorded with a monotone count value;After the wireless condition recovers, the event time is reconstructed according to the trusted time reference points before and after the abnormal window, and the route is verified according to the phase random matching risk value, the steering comparison and the mileage backtracking between reference events.The evidence record is reported to the supervision platform by the security unit calculating the message authentication code.The present application can save verifiable route supervision evidence during power supply anomaly or wireless denial.

Description

Technical Field

[0001] This invention relates to the fields of vehicle-mounted intelligent monitoring, radio environment sensing, and disconnection and battery life verification, specifically to a vehicle-mounted monitoring device and method that is resistant to failure, shielding, and interference. Background Technology

[0002] Vehicle-mounted monitoring equipment typically uses satellite positioning trajectories, cellular network backhaul, and geofences to determine whether a vehicle is traveling along a predetermined route, supplemented by backup power, inertial estimation, or recorded digests to preserve data during periods of disconnection. Existing multi-source detection also compares changes in satellite visibility, cellular reception strength, or other wireless channels to identify positioning interruptions and communication anomalies. However, metallic cladding, suppression interference, tunnel underpasses, and insufficient network coverage can all cause demodulation quality degradation, making it difficult to determine the physical cause simply by voting on multi-channel thresholds; the automatic gain control of the service receiver is also easily affected by the local transmit and receive sensitivity and frequency band noise floor. After satellite timing is interrupted, wheel speed estimation accumulates mileage errors, and the local clock accumulates timing errors; if an intersection event is triggered based on pre-stored mileage and the route is then verified using the same estimated mileage, the triggering and verification bases come from the same data source, making it difficult to form independent route evidence. Ordinary digest chains may also be completely recalculated when the device key and the verified record digests stored on the platform are missing. Therefore, there is a need for vehicle surveillance technology that can distinguish between shielding, interference, and regional signal loss within seconds, and continuously obtain independent route evidence, restore standard event times, and prevent the reconstruction of evidence records within the wireless denial window. Summary of the Invention

[0003] To address the problems of existing vehicle-mounted monitoring equipment, such as difficulty in distinguishing between conductive material coating, suppression interference and regional signal loss, lack of reliable standard time for route events during power supply abnormalities or reliable time synchronization interruptions, single source of route verification data and easy reconstruction of evidence records, this invention provides a vehicle-mounted monitoring device and method that combines wireless environment identification, sensor-triggered reference events, reconstruction of reliable time synchronization reference points before and after, and authentication and evidence storage, and is designed to prevent failure, shielding and interference.

[0004] To achieve the above objectives, the technical solution adopted by the present invention is as follows: This invention provides a vehicle-mounted monitoring device that is resistant to failure, shielding, and interference. It includes a main control unit, multiple wireless receiving channels operating at different frequency bands, a multi-band background power detection unit, a wheel speed sensor, an inertial measurement unit, a capacitance detection circuit, a safety unit, a safety storage unit, a main power interface, a backup battery, and a local clock that outputs monotonic count values. The capacitance detection circuit connects to multiple capacitive sensing electrodes located on different surfaces of the device housing. The main control unit is configured to: collect the background power of each frequency band during its local radio frequency silence measurement time slot; and identify wireless anomalies based on the demodulation quality of the wireless receiving channels, the direction of background power change in the corresponding frequency band, and the spatial synchronization response of the multiple capacitive sensing electrodes. Shielding corresponds to a decrease in demodulation quality, a decrease in background power at the same frequency, and a spatial synchronization response of the capacitance; interference corresponds to a decrease in demodulation quality, an increase in background power at the same frequency, and a change in capacitance. Stable regional signal loss corresponds to a decrease in demodulation quality, stable or decreased background power at the same frequency, and stable capacitance. An anomaly window is determined based on the identification results. Within the anomaly window, the rhythmic observation times of signalized intersections on the pre-stored route, as well as parking and starting events and turning events directly triggered by wheel speed and inertial signals, are recorded using monotonic count values. These parking and starting events and turning events are referred to as sensor-triggered reference events. After the anomaly window ends, the reconstructed event time is uniquely determined by two qualified and reliable time synchronizations before and after the window, along with their monotonic count values. The route verification conclusion is output based on the matching results between the reconstructed event time and the pre-stored phase template, the phase random matching risk value, and the route structure evidence formed by the sensor-triggered reference events. The security unit generates a message authentication code for the evidence record containing the monotonic count value. The backup battery maintains anomaly identification, event recording, and evidence storage when the main power supply is interrupted.

[0005] Furthermore, the wireless receiving channel includes a satellite positioning module, a cellular communication module, a vehicle and road infrastructure communication receiving module, and an FM broadcast receiving module; the multi-band background power detection unit includes a broadband receiving antenna, an RF switch, and filtering branches corresponding to the operating frequency bands of each wireless receiving channel. Each filtering branch is connected to a low-noise amplifier and a logarithmic power detector, and the RF switch polls and selects each filtering branch; the receiving antenna, broadband receiving antenna, and capacitive sensing electrode of each wireless receiving channel are all located within the equipment housing. The capacitive sensing electrode includes three self-capacitance sensing electrodes respectively located on the upper surface and two opposite sides of the equipment housing.

[0006] Furthermore, the local clock is driven by a temperature-compensated crystal oscillator; qualified and reliable time synchronization includes satellite time synchronization that has passed integrity checks and cellular network time synchronization with a supervisory platform signature and round-trip delay compensation, with each qualified and reliable time synchronization accompanied by time synchronization uncertainty; the security unit has a built-in key and monotonic counter; the backup battery maintains the receiving functions of the main control unit, local clock, wheel speed and inertial measurement interface, security unit, secure storage unit, capacitor detection circuit, multi-band background power detection unit and wireless receiving channel during the main power interruption, and the main control unit writes power switching events and interface self-test results into the storage record.

[0007] Furthermore, the main control unit pre-stores intersection mileage tables, phase templates, and road attribute tables. The intersection mileage tables record the mileage position, turning actions, template route mileage between adjacent intersections, stop line near-end start reference intervals, and phase-related group identifiers of periodically timed signalized intersections. The phase templates record the signal cycle duration, green light start reference time, green light duration, allowable dissipation duration, and phase template uncertainty. The road attribute tables record open road sections, underground or underpass sections, vehicle-road infrastructure communication coverage areas, and non-intersection turning exemption areas. Within a qualified sampling window where satellite positioning is effective, vehicles are in open road sections, and capacitive sensing electrode readings are stable, the main control unit establishes demodulation quality baselines, frequency band background power baselines, and capacitance baselines. The baseline state machine freezes these baselines in candidate states, confirmed states, and recovery observation states when wireless anomalies occur. Wireless receiving channels that meet the corresponding reception thresholds and coverage conditions are considered valid wireless receiving channels.

[0008] Furthermore, the main control unit calculates the driving distance and planar heading based on the outputs of the wheel speed sensor and the inertial measurement unit, and establishes an observation interval for the signalized intersection according to the intersection odometer. Only events where the position uncertainty interval falls completely into the unique observation interval are associated with the corresponding intersection. The moment when the vehicle changes from stationary to continuous driving after stopping within the observation interval is taken as the rhythmic observation moment for the stopping and starting situation, and the moment when the vehicle speed is not lower than the set passing speed and crosses the intersection mileage position is taken as the rhythmic observation moment for the driving and passing situation. The difference between the rhythmic observation moment and the green light start reference moment is divided by the signal cycle duration to obtain the delay amount. According to the time uncertainty, the basic allowable duration is double-ended outward at the beginning and end of the signal cycle to form an allowable window. When the delay amount falls into the allowable window, it is recorded as a hit. The time uncertainty includes the timing uncertainty, the local clock holding error, the phase template uncertainty, and the upper bound of the event detection error.

[0009] Furthermore, the main control unit uses the ratio of the union length of the allowable window of each verification intersection within one signal cycle to the signal cycle duration as the random hit probability of the corresponding intersection. Under the model where the phase residuals of the intersections included in the statistics are independent, the unit calculates the phase random matching risk value based on the random hit probability of each phase, which is greater than or equal to the verification set size minus 1. Intersections with phase correlation are grouped, and only the intersection with the highest random hit probability in each group is included in the verification set. The main control unit compares the direction of the turning event with the turning action in the intersection odometer, and uses the turning event and the stop-start event located in the starting reference interval near the stop line as mileage reference events. The unit also compares the wheel speed integral mileage between adjacent mileage reference events with the template route mileage. When the number of hits, the phase random matching risk value, the turning action, and the mileage between reference events meet the preset verification conditions, the unit outputs a route compliance conclusion. When no effective mileage between reference events is formed, a smaller risk threshold is used. When a route structure contradiction occurs, the unit outputs a suspected route deviation conclusion. In other cases, the unit outputs a conclusion of insufficient verification basis.

[0010] Furthermore, the main control unit periodically sets a radio frequency silence measurement time slot, pauses local radio frequency transmission during the radio frequency silence measurement time slot, and polls and collects background power of each frequency band after the radio frequency front-end stabilizes; when the demodulation quality of the effective wireless receiving channel drops more than the corresponding threshold relative to the frozen baseline, a channel collapse event is formed; the frequency band with a preset measurement margin of the background power baseline is the power effective frequency band, and the change of its current background power relative to the frozen baseline is divided into energy decrease, energy increase, or energy stability; when at least two capacitive sensing electrodes produce an absolute change exceeding the corresponding threshold within the same determination window, a capacitive spatial synchronization response is formed.

[0011] Furthermore, within the same judgment window, when at least three effective wireless receiving channels, including satellite positioning modules and cellular communication modules, experience channel collapse events, and at least two of the corresponding effective power frequency bands show energy decrease and capacitance spatial synchronization response is established, a shielding window is formed; when at least one effective wireless receiving channel experiences a channel collapse event, and the corresponding frequency bands of each channel experiencing a channel collapse event show energy increase and each capacitance sensing electrode remains in the vicinity of the capacitance baseline, an interference window is formed; when the corresponding frequency bands of each channel experiencing a channel collapse event show stable or decreasing energy and each capacitance sensing electrode remains in the vicinity of the capacitance baseline, a regional signal loss window is formed; within the same judgment window... Within a defined window, if at least one valid wireless receiving channel experiences a channel collapse event, at least one power-effective frequency band experiences an energy increase or decrease, or at least one capacitive sensing electrode extends beyond the capacitor baseline neighborhood, and the formation conditions for the shielding window, interference window, and regional signal loss window are not met, an unclassified wireless anomaly window is formed. Once any window is formed, the local endurance monitoring mode is entered. The window start point is the earliest anomaly sample time that triggers the candidate state, and the window end point is the time when the corresponding anomaly continuously returns to the frozen baseline neighborhood and meets the preset recovery conditions. When a vehicle leaves the certified vehicle and road infrastructure communication coverage area, the communication channel does not participate in the recovery judgment.

[0012] Furthermore, in the local endurance monitoring mode, the main control unit continuously records the rhythm observation time and sensor-triggered reference events using monotonic count values. The last qualified and reliable time synchronization before the start of the window and its monotonic count value constitute the pre-time synchronization reference point, and the first qualified and reliable time synchronization after the end of the window and its monotonic count value constitute the post-time synchronization reference point. The standard time and monotonic count values ​​of the two time synchronization reference points are strictly increasing, and when the possible counting frequency range derived by taking into account the time synchronization uncertainty intersects with the allowable range of the local clock, the main control unit only records the event monotonic count value between the two time synchronization reference points. Linear interpolation is performed on the ratio between the time intervals to obtain the reconstructed time of the event. Route verification within the window is performed with time uncertainty taking into account the timing, local clock, phase template, and event detection error. If the timing reference point is unqualified, the original monotonic count value is retained and the conclusion of insufficient verification basis is output. Each evidence record includes the record number, event monotonic count value, record content, and the summary value of the previous evidence record. The security unit uses the built-in key to calculate the message authentication code. The main control unit reports the evidence record and route verification conclusion to the regulatory platform and saves the latest verified record summary returned by the regulatory platform.

[0013] This invention also provides a vehicle-mounted monitoring method for preventing failure, shielding, and interference. This method is executed by a vehicle-mounted monitoring device equipped with three or more different-frequency wireless receiving channels, a multi-band background power detection unit, multiple capacitive sensing electrodes distributed on different surfaces of the device housing, a wheel speed sensor, an inertial measurement unit, a local clock, a safety unit, a backup battery, and a secure storage unit. The wireless receiving channels include at least a satellite positioning channel and a cellular communication channel. The method includes: establishing a demodulation quality baseline, a frequency-band background power baseline, and a capacitance baseline within a qualified sampling window under normal wireless conditions; freezing the baselines during periods of wireless anomaly; detecting rhythmic observation times, stop / start events, and turning events at pre-stored signalized intersections along the route; and storing the rhythmic observation times... The difference between the reference time of the green light activation and the time of the green light activation is divided by the signal cycle duration and a non-negative remainder is used to determine the hit according to the allowable window that expands outward at the beginning and end of the cycle based on the time uncertainty. The phase random matching risk value is calculated based on the proportion of the allowable window to the signal cycle, representing the probability that the number of hits under random phase conditions reaches more than 1 of the number of verified intersections. The route verification conclusion is output in combination with the turning action and the mileage between reference events. The time uncertainty includes the timing, clock, phase template, and event detection errors. The background power of the frequency band is collected during the radio frequency silent measurement time slot when the local radio frequency transmission is suspended. The demodulation quality baseline meets the reception threshold and coverage conditions. At least three effective channels have collapsed and include satellite positioning channels and cellular communication channels. The background power baseline has A shielding window is formed when at least two energy levels in the corresponding frequency band with measurement margin decrease and multiple capacitive sensing electrodes form a spatially synchronized response. An interference window is formed when the channel collapses, the energy in the corresponding frequency band increases, and each capacitive sensing electrode remains within the vicinity of the capacitance baseline. A regional signal loss window is formed when the channel collapses, the energy in the corresponding frequency band stabilizes or decreases, and each capacitive sensing electrode remains within the vicinity of the capacitance baseline. Within the same decision window, if at least one effective channel collapses, at least one power-effective frequency band experiences an energy increase or decrease, or at least one capacitive sensing electrode extends beyond the vicinity of the capacitance baseline, and the formation conditions for the shielding window, interference window, and regional signal loss window are not met, then an unclassified wireless anomaly window is formed. The earliest abnormal sample is taken as the starting point. The window ends when the corresponding abnormal quantity continuously meets the recovery conditions. During the window, the time and event are recorded with monotonic count values. When the main power is interrupted, the backup battery maintains operation. After the window ends, the last qualified and reliable time synchronization before the window and the first qualified and reliable time synchronization after the window and their monotonic count values ​​are used to form the previous time synchronization reference point and the subsequent time synchronization reference point. When the standard time and monotonic count values ​​of the two time synchronization reference points are strictly increasing and the counting frequency range derived by taking into account the time synchronization uncertainty intersects with the allowable range of the local clock, the event time is linearly reconstructed according to the ratio of the event monotonic count value between the two time synchronization reference points. The route verification within the window is performed at the reconstructed time. Otherwise, the original monotonic count value is retained and the conclusion of insufficient verification basis is output.The security unit generates a message authentication code from the stored record, which includes the event monotonic count value and the digest value of the previous record, and reports the stored record and route verification conclusion to the regulatory platform.

[0014] The present invention has the following beneficial effects: This invention utilizes the demodulation quality of the wireless receiving channel, the direction of background power variation in each frequency band, and the spatial synchronization response of multiple capacitive sensing electrodes for joint judgment. Background power is measured during the time slot when the local unit pauses RF transmission, reducing the impact of local transmission on the measurement results. Conductive material coating, external suppression interference, and regional signal loss are identified using different criteria; cases with insufficient or contradictory evidence are recorded as unclassified wireless anomalies and are not directly marked with a shielding identification flag. The baseline state machine freezes the baseline before the anomaly during candidate, confirmed, and recovery observation states to prevent continuous abnormal measurements from entering baseline updates. During wireless anomalies, the device uses monotonic count values ​​to record the times of stopping / starting, turning, and rhythmic observations. After communication is restored, the event times are reconstructed based on the previous and subsequent timing reference points. The phase random matching risk value is calculated according to the allowable window and valid samples at each intersection and is used in conjunction with sensor-triggered reference events, turning comparisons, and measured mileage between reference events for route verification. Backup batteries maintain sensing, timing, and secure storage; message authentication codes, hardware monotonic counters, and platform confirmation chain summaries are used to detect record deletion, modification, reversal, and rollback, enabling the regulatory platform to recalculate anomaly types, window boundaries, and route verification conclusions. Attached Figure Description

[0015] Figure 1 This is a schematic diagram showing the planar arrangement of the receiving antennas, capacitive sensing electrodes, and key monitoring components within the device housing in an embodiment of the present invention.

[0016] Figure 2 This is a schematic diagram of the normalized filter response and RF silence measurement time slot of the multi-band background power detection unit in an embodiment of the present invention, wherein, Figure 2 (a) shows the normalized filter responses for the four filter branches. Figure 2 (b) shows the timing of radio frequency silent measurements within one sampling period.

[0017] Figure 3 This is a schematic diagram illustrating the principle of multi-band incident energy attenuation and capacitance spatial synchronous response when the device is covered by a metal shield in an embodiment of the present invention.

[0018] Figure 4 This is a schematic diagram illustrating the differences between shielding, suppressing interference, and regional signal loss on three observation axes in an embodiment of the present invention. Figure 4 (a) shows the relationship between channel demodulation quality variation and background power variation in the effective power band. Figure 4 (b) shows the changes of the three capacitive sensing electrodes relative to the frozen capacitor baseline.

[0019] Figure 5 This is a schematic diagram illustrating the principle of verifying the route structure using sensor-triggered reference events and mileage reference events in an embodiment of the present invention.

[0020] Figure 6 This is a schematic diagram illustrating the principle of phase modulus calculation and time uncertainty in the allowable window being expanded at both ends in an embodiment of the present invention.

[0021] Figure 7 This is a schematic diagram illustrating the reconstruction of time using the previous and subsequent time reference points within an abnormal window in an embodiment of the present invention.

[0022] Figure 8 This is a graph showing the change in the phase random matching risk value with the size of the verification set under different single-intersection random hit probabilities in an embodiment of the present invention. Detailed Implementation

[0023] This implementation method is applicable to vehicles requiring continuous verification of predetermined routes. The V2I receiving module referred to in this implementation method is the receiving module for vehicle-to-road infrastructure communication. When the wireless signal is normal, the device comprehensively uses satellite positioning results, wheel speed information, inertial information, and predetermined route data for routine monitoring. When the device is subjected to conductive material coverage, suppression of wireless interference, satellite positioning spoofing, natural obstruction, or vehicle power interruption, it does not directly conclude intentional behavior based on the failure of any single channel. Instead, it first determines the physical type of the abnormal window and then continuously collects verifiable events in local continuous monitoring mode. After wireless conditions are restored, the device reconstructs the standard time of the abnormal window and performs route backtracking verification. The following describes an implementable structure, parameter configuration, and operating process in conjunction with the accompanying drawings.

[0024] See Figure 1 The equipment housing 100 can be made of flame-retardant engineering plastic, with dimensions of 180 mm × 125 mm × 55 mm, and is installed in a location within the vehicle's cab where it is unlikely to be touched by everyday items. The satellite receiving antenna 110, cellular receiving antenna 120, FM broadcast receiving antenna 130, V2I receiving antenna 140, and broadband receiving antenna 150 are all located within the equipment housing 100. Adjacent antenna edges maintain a spacing of at least 20 mm. The broadband receiving antenna 150 and cellular receiving antenna 120 are orthogonally polarized, and the antenna feed lines do not extend beyond the housing or connect to external antennas. Therefore, the metal cover covering the entire equipment housing 100 simultaneously acts on both the service reception channel and the background power measurement channel, preventing the broadband receiving antenna from being exposed outside the shielding material and thus emitting energy in the opposite direction.

[0025] The upper surface capacitive sensing electrode 161 is attached to the inner side of the upper surface of the device housing 100, and the first side capacitive sensing electrode 162 and the second side capacitive sensing electrode 163 are respectively attached to the inner sides of two opposite sides. Each capacitive sensing electrode is formed of copper foil with a thickness of 35 micrometers, and the effective sensing area is 40 mm × 30 mm. A 1 mm to 3 mm insulating medium is maintained between the electrode and the outer surface, and a clearance of more than 25 mm is maintained with the receiving antenna feed structure. The three capacitive sensing electrodes are located on non-coplanar surfaces. In daily life, a single-sided touch usually only causes a change in capacitance of one electrode, while the adjacent conductors surrounding the upper surface and sides will simultaneously change the edge electric field of multiple electrodes. Local grounding isolation strips and time-division excitation are used to suppress the coupling of the capacitance detection signal to the wireless front end.

[0026] The main control unit is implemented using an automotive-grade microprocessor and features wheel speed pulse input, inertial measurement data input, analog signal acquisition, serial communication, and a security unit communication interface. The internal scheduling cycle is 10 milliseconds, and the monitoring sampling cycle is 0.5 seconds. Monotonic count values ​​are generated by a 64-bit unsigned counter with a nominal counting frequency of 1000 Hz, incrementing once every 1 millisecond and not wrapping around within the device's design life. Calendar time and monotonic count values ​​are stored separately; any clock correction only generates the mapping parameters between the two and does not modify recorded events. The security storage unit can use a 32 gigabyte non-volatile memory that supports power-down atomic writes, storing original measurements, template versions, and classification results in sequence according to record number.

[0027] The broadband receiving antenna of the multi-band background power detection unit is time-division multiplexed through an RF switch to select four filter branches. (See also...) Figure 2 (a) A set of optional network configuration passbands is as follows: FM broadcast band 88 MHz to 108 MHz, satellite band 1559 MHz to 1605 MHz, cellular band 1710 MHz to 2690 MHz, and V2I band 5905 MHz to 5925 MHz. The cellular passband does not represent all cellular deployment bands; when using other service bands, the cellular band filtering branch uses a tunable filter, and the passband is set according to the current service downlink band reported by the cellular communication module. Each branch is sequentially equipped with a low-noise amplifier and a logarithmic power detector, with a detection dynamic range of [missing information]. 100 dBmW to 20 dB / mW. During manufacturing and calibration, at least 8 known power points were input to each branch to establish a piecewise linear relationship between the detector voltage and the equivalent input power, and the equivalent input noise floor when a 50-ohm matched load was connected was recorded.

[0028] Energy decrease is only used as evidence of shielding identification in power-effective frequency bands with measurable margin and controlled dispersion of clean samples. If the frozen background power baseline of a filter branch is more than 10 dB higher than the equivalent input noise floor of that branch, and the median absolute deviation of clean samples does not exceed 2 dB, the corresponding frequency band is recorded as a power-effective frequency band. Frequency bands that do not meet the above conditions are still recorded with their current power, but power decrease is not used as a shielding identification condition. The power of civilian satellite spread spectrum signals is usually lower than the receiver noise floor. Satellite channel demodulation may be normal, but the satellite frequency band may not necessarily belong to the power-effective frequency band; these two are determined separately. If external interference causes the current power to be higher than the specified margin of the equivalent input noise floor and to rise above the frozen baseline by more than the energy increase threshold, even if the frozen baseline is close to the noise floor, it can still be used as evidence of co-frequency energy injection.

[0029] See Figure 2 (b) Within each 0.5-second sampling period, a 10-millisecond RF silent measurement time slot is set. Before the time slot begins, the main control unit suspends the cellular communication module and other local RF transmissions via the transmit prohibition interface. After entering the time slot, it waits for 1 millisecond to allow power amplifier leakage and RF front-end transient attenuation, and then polls according to the satellite, cellular, FM broadcast, and V2I bands. Each branch occupies 2.25 milliseconds, of which 0.25 milliseconds are used for switching and detector stabilization, followed by taking the median of no less than 8 analog-to-digital conversion samples. The RF switching and sampling are controlled by a hardware timer, and a scheduling margin is reserved outside the 10-millisecond time slot for the 0.5-second sampling period. Each wireless receiving module outputs a module timestamp, and the sample age used for classification does not exceed 0.5 seconds; old samples older than this age are considered invalid. If emergency communication prevents the formation of a complete silent time slot in this cycle, the background power vector is marked as invalid and the power value contaminated by local transmission is not used for classification. If the complete background power vector required for classification cannot be obtained in two consecutive decision windows and a channel collapse event has occurred, an unclassified wireless anomaly event is formed, and the baseline state machine is not allowed to remain in the candidate state for a long time.

[0030] The capacitance detection circuit sequentially measures the self-capacitance of three capacitance sensing electrodes at a fixed excitation frequency of 62.5 kHz, with a sampling frequency of no less than 20 times / second for each electrode. The median of the results is taken for each monitoring sampling cycle. Internal temperature of the casing is simultaneously collected within a qualified sampling window without any covering. Piecewise linear temperature compensation curves are established for calibration points ranging from 30°C to 70°C. For each electrode, the frozen capacitance baseline, baseline neighborhood, and capacitance change threshold are stored separately. The capacitance change threshold is the maximum value among 6 times the standard deviation of the clean-state noise, 0.5% of full scale, and 0.8 picofarads. The baseline neighborhood can be 0.4 picofarads. The actual threshold is written to the device calibration area and verified by the safety unit; it cannot adaptively decrease under abnormal confirmation conditions.

[0031] Whether a conductive material is grounded will change the direction of its self-capacitance. A floating metal shield may increase the reading, and a metal shield connected to the vehicle ground may change the return path, causing the reading of a certain electrode to decrease. Therefore, the equipment judges the absolute change without pre-setting a positive or negative sign. Figure 3 The diagram shows that when the metal shielding is brought close to the equipment housing, the incident energy of the multi-frequency bands is reflected and absorbed at the conductive boundary, while the termination position of the electric field lines changes. Figure 4 (b) In the given example of threshold consistency, during shielding, the three electrodes changed by +24% relative to the frozen baseline. At least two chips exceeded their respective absolute change thresholds: 21% and +18%. Even when interference was suppressed and regional signal loss occurred, each chip remained within the baseline neighborhood. The data in the figure are used to illustrate the relationship between the determination direction and the threshold, and are not intended as fixed measurement results for different installation environments.

[0032] The local clock is driven by a 10 MHz temperature-compensated crystal oscillator, with a maximum full-temperature frequency error of one part per million. Trusted time synchronization includes satellite time synchronization and cellular network time synchronization with a regulatory platform digital signature and round-trip delay compensation. Satellite time synchronization is only accepted if the receiver integrity check passes, no suspected spoofing features are found, and the short-term satellite trajectory matches the calculated trajectory formed by wheel speed and yaw rate. Cellular network time synchronization requests include a device identifier, a random number, a monotonic count value, and a request sequence number; the platform response returns the same random number, server standard time, signature, and validity period. The device records the monotonic count values ​​of the request and response, using half the round-trip delay as the one-way delay estimate. Responses with signature failure, inconsistent random numbers, sequence number rollback, or round-trip delays exceeding 2 seconds are not considered trusted time synchronization reference points. Time synchronization that passes the above integrity and authentication checks is recorded as qualified trusted time synchronization. The standard time adopts the continuous time scale including date specified by the regulatory platform, counting continuously across days without resetting to zero at midnight.

[0033] Each reliable time synchronization comes with timing uncertainty. Satellite timing uncertainty is synthesized from receiver time accuracy, internal timestamp resolution, and integrity margin; cellular network timing uncertainty includes at least platform clock error, upper bound of round-trip path asymmetry, device transmit / receive timestamp error, and quantization error. The equipment uses a conservative method of directly adding the upper bounds of each error, rather than using mean square synthesis to narrow the boundary. For example, with a round-trip delay of 240 milliseconds, a platform clock upper bound of 20 milliseconds, an upper bound of path asymmetry of 80 milliseconds, a device timestamp error of 20 milliseconds, and a quantization error of 5 milliseconds, the uncertainty of this cellular timing synchronization can be raised to 125 milliseconds.

[0034] The main power interface is compatible with vehicle power supplies from 9V to 36V and features reverse connection, surge, and undervoltage protection. The backup battery is a 38Wh lithium iron phosphate battery, which takes over power within 20 milliseconds after a main power outage. The power path switching circuit and energy storage capacitor maintain the power rail voltage above the minimum operating voltage of the main control unit during the takeover period. A power interruption event latch circuit latches the monotonic counter value corresponding to the moment of interruption when the main power drops; this value is read and written to the record by the main control unit after the power supply stabilizes. Under the most unfavorable low-power condition for continuous reception, the total power consumption of the main control unit, local clock, monotonic counter, wheel speed and inertial measurement interface, safety unit, safety storage unit, capacitor detection circuit, multi-band background power detection unit, and all necessary receiving functions is controlled below 6W, allowing for continuous operation for approximately 6 hours under typical conditions. In clean state, the FM broadcast receiving module and V2I receiving module wake up at 0.5-second intervals, enter the candidate state, and continuously receive until they return to the clean state after recovery observation. When the vehicle interfaces are simultaneously disconnected, the recording interface fails, the missing wheel speed data is not replaced by software interpolation, and the corresponding route output is limited to insufficient verification basis.

[0035] Before equipment deployment, a template package containing a version number, validity period, summary, and digital signature is received from the monitoring platform. The intersection odometer, with the predetermined route start point as zero, records the number, mileage position, turning action markings (straight, left, or right turn), template route mileage between adjacent intersections, the reference interval for starting near the stop line, and phase-related group identifiers for periodically signalized intersections. The road attribute table marks open road sections, tunnel sections, underpass sections, underground sections, V2I coverage areas, and non-intersection turning exemption areas verified by road geometry. Structures that may reach turning thresholds, such as sharp bends, roundabouts, and ramps, are pre-included in the exemption areas; obvious turns not included in the exemption areas and not within the intersection observation area create route structure contradictions.

[0036] The phase template stores the signal cycle duration, the green light start reference time for the vehicle's direction of travel, the green light duration, the allowable dissipation time, and the phase template uncertainty according to the timing period. The green light start reference time is taken as the actual green light start standard time of any complete cycle within the timing period, and other cycles are derived from the cycle duration. The phase template uncertainty includes at least the green light start reference time acquisition error, the cumulative upper bound of the cycle duration error from the selected reference cycle to the current cycle, and the upper bound of the signal controller clock deviation; if any error upper bound is unknown, or if the intersection is at the timing period switching boundary or the expanded allowable window covers the entire signal cycle, the corresponding intersection will not be included in the verification set. The dissipation duration is allowed to use the same event definition as the vehicle detection: The platform collects no less than 200 valid stop-start samples for the same direction and the same timing period, and removes accident, temporary control, interface failure and non-traffic stop samples. For each sample, the modulus delay relative to the most recent green light start time is calculated according to formula (1), and the vehicle speed is required to be no less than 5 km / h for 1 second from the rhythm observation time. The 95th percentile value of the modulus delay is taken. This duration is greater than 0 and less than the signal period, preferably not exceeding the green light duration. Intersections with uncertain boundaries of inductive timing or time period switching are not included in the verification set.

[0037] Baseline calibration is performed only within a qualified sampling window where satellite positioning is effective, the road is an open section, the satellite trajectory matches the estimated trajectory, and the three capacitive sensing electrodes are stable and free of wireless anomalies. Initial calibration lasts for 10 minutes, obtaining at least 1200 samples. Robust baselines are established for demodulation quality, background power in each frequency band, and capacitance readings using the median and median absolute deviation, respectively. In clean mode, the device generates a median of qualified samples every 60 seconds and slowly updates the baseline by 1% of the difference between the current baseline and this median. In candidate, confirmed, and resumed observation states, the last updated clean mode baseline before entering the candidate state is frozen; abnormal measurements are not included in baseline updates.

[0038] The validity of the wireless receiving channel is determined based on its cleanliness before freezing and remains unchanged as a set of valid channels during anomaly classification. The wireless receiving channels corresponding to the satellite positioning module, cellular communication module, FM broadcast receiving module, and V2I receiving module are respectively referred to as satellite channel, cellular channel, FM broadcast channel, and V2I channel. The satellite channel is valid when the number of visible satellites is not less than 4 and the average carrier-to-noise ratio is higher than the receiving threshold; the cellular channel is valid when it is normally deployed and the received strength is higher than the sensitivity threshold, and its demodulation quality is expressed as the received signal strength; the frozen demodulation quality baseline of the FM broadcast channel must be higher than the receiving threshold, and the demodulation quality is the received field strength measured under fixed receiving bandwidth and fixed calibration gain, expressed in decibels; the V2I channel also requires that the frozen message receiving count baseline be higher than the count threshold and that the device be located within the V2I coverage area recorded in the road attribute table. When there are fewer than 3 valid channels, the shielding identification conditions are not lowered, but the incomplete combination is recorded as an unclassified wireless anomaly event. The deployment route is optimized to ensure at least one long-term valid channel in addition to satellite and cellular channels.

[0039] Wheel speed scaling factor is calibrated on open road sections where satellite positioning is reliable. The main control unit robustly fits the cumulative wheel speed pulse value with a reliable driving distance of no less than 3 kilometers to obtain the effective rolling circumference of the tires; recalibration is performed when tires are replaced, long-term deviations exceed 1%, or slippage events occur frequently. At start-up, the satellite positioning point that has passed the integrity check is projected onto the predetermined route centerline; initial mileage alignment is established when the lateral distance does not exceed 30 meters, the difference between the vehicle's heading and the route direction does not exceed 20 degrees, and the vehicle is located in the starting verification area; otherwise, no automatic route compliance conclusion is output. The inertial measurement unit updates the yaw rate zero bias when the vehicle is stationary for more than 30 seconds. When the vehicle is moving, the yaw rate is integrated to form a planar heading change, and a 150-meter sliding distance window is established using wheel speed mileage. A turning event is formed when the net heading change reaches 60 degrees and the peak heading change rate reaches more than 8 degrees / second and lasts for at least 0.3 seconds. Temporally adjacent peaks with the same direction are de-jittered and merged within 2 seconds, and short-term lane changes will not generate duplicate events.

[0040] The main control unit saves the last reliable route start-point alignment result and cumulative mileage before the loss of connection. An observation interval is activated when the estimated mileage reaches 100 meters before and after a certain intersection's mileage position. The overlapping interval is uniquely divided by the midpoint between the two intersection mileage positions. Mileage uncertainty increases according to the upper limit of wheel speed proportional error, the cumulative distance after the loss of connection, and the detected slippage margin. An event is only associated with the corresponding intersection if the entire interval consisting of the event's estimated mileage and its uncertainty falls within the unique observation interval and does not cross the boundary of adjacent observation intervals; otherwise, the event is marked as lacking verification evidence. When the mileage uncertainty exceeds 80 meters, subsequent events are still stored as evidence based on the original monotonic count value, but new automatic intersection associations are stopped, and insufficient verification evidence is output. After the wheel speed remains at 0 for 3 seconds, the moment when the vehicle accelerates from a standstill and first reaches 5 km / h is cached as a starting candidate, and the vehicle speed must be maintained at no less than 5 km / h for 1 second from that moment. If there are multiple following starts within the same observation interval, only the last starting candidate that meets the aforementioned maintenance condition and subsequently crosses the intersection mileage position is retained as the rhythmic observation moment. When the vehicle speed is consistently no less than 10 km / h within the observation interval, the moment when the calculated mileage crosses the intersection position is used as the rhythmic observation moment for the passage situation. Intersections with slow-moving traffic but no sustained 3-second stop cannot stably correspond to a green light window, are not recorded as rhythmic observation moments, and the corresponding intersections are not included in the verification set.

[0041] Turning events and stop-start events are directly triggered by sensor signals before the associated intersection, collectively referred to as sensor-triggered reference events. Intersections marked as left or right turns must be associated with exactly one same-direction turning event; mismatched directions, missing expected turns, or duplicate associations are each counted as one turning comparison conflict. Straight-ahead intersections are required to have no turning events and the net heading change within the observation range must not exceed 15 degrees. Turning events within non-intersection turning exemption zones are not counted as conflicts, while turning events outside other observation ranges are counted as conflicts; parking outside the observation range is only documented. If both turning and stop-start events occur simultaneously at the same intersection, they are merged into one composite sensor-triggered reference event according to the intersection number and counted as only one sensor-triggered reference event.

[0042] Queue length can cause the starting point to be far from the stop line. Therefore, only when the calculated distance from the starting position to the corresponding intersection reference position is within the starting reference interval near the stop line as defined by the platform (e.g., 0 meters to 20 meters before the stop line) will the corresponding stop-start event be used as a mileage reference event. Other stop-start events will still participate in phase verification and event sequence recording. The position of a turning event is taken as the mileage corresponding to the peak of the heading change rate, and can be directly used as a mileage reference event. This model sets 400 meters as the preset minimum reference event interval. For two adjacent mileage reference events related to different intersections, both ends of the measured mileage and the template route mileage use reference positions consistent with the corresponding event type. When the reference event interval is not less than 400 meters, and there is no wheel slippage, vehicle interface abnormality, or construction detour sign, the mileage obtained by wheel speed integration is recorded as the valid measured reference event interval. Events that do not meet any of the conditions are only used for auxiliary evidence.

[0043] Figure 5 A route structure example is provided. The measured distance between reference event A (starting near the stop line) and reference event B (left turn) is 308 meters, while the template route distance is 310 meters; the measured distance between reference event B (left turn) and reference event C (right turn) is 632 meters, while the template route distance is 640 meters; the measured distance between reference event C (right turn) and reference event D (starting near the stop line) is 405 meters, while the template route distance is 410 meters. The first segment, with a preset minimum reference event interval of less than 400 meters, serves only as auxiliary evidence and does not constitute a valid measured reference event interval; the second and third segments form valid measured reference event intervals, with relative deviations of 1.25% and approximately 1.22%, respectively, both not exceeding 5%. Hollow circles correspond to passing events and only participate in phase verification. Turning events located outside the observation range of all intersections and not belonging to the exemption range create sequence contradictions.

[0044] For each intersection entering the verification set, the main control unit calculates the delay using the rhythm observation time, the green light start reference time, and the signal cycle duration, as shown in equation (1). Modulo operation ensures that the vehicle queue retains its phase position relative to the most recent green light start even after crossing an integer number of cycles.

[0045] (1) In equation (1), Indicates the first The delay at each intersection, in seconds; Indicates the first The rhythmic observation time at each intersection, in seconds; Indicates the first The reference time for the green light to turn on in the direction of travel at each intersection, in seconds; Indicates the first The signal cycle duration at each intersection, in seconds; Indicates the intersection number in the verification set; This indicates a non-negative remainder operation, with the result ranging from 0 to the duration of the signal period, excluding the duration of the signal period.

[0046] Figure 6 This illustrates the relationship between the modulus and the expansion of time uncertainty at both ends. The basic allowable duration for the stop-start scenario is the allowable dissipation duration, and the basic allowable duration for the travel scenario is the green light duration. Time uncertainty expands both towards the end of the window after the start of the cycle and maps the portion of the actual time that might be slightly later than the reconstructed time to the end of the previous cycle. The illustrated cycle is 90 seconds, the green light duration is 35 seconds, the allowable dissipation duration is 15 seconds, and the time uncertainty is 1 second; the start time of 12 seconds and the travel time of 104 seconds are hit, while the observed time of 168 seconds is not hit. If the expansion intervals at the beginning and end overlap, the calculation is based on the union length within one cycle, and double counting is not allowed.

[0047] The standard time reconstruction after the end of the abnormal window adopts Equation (2). This relationship is determined only by the pre-time reference point and the post-time reference point before and after the loss of connection. No phase hit data is used to select clock parameters, and no deviation search is performed within the cycle range.

[0048] (2) In equation (2), Indicates the monotonic count value The reconstruction time corresponding to the event, in seconds; and These represent the standard times of the preceding and subsequent time reference points, respectively, in seconds; and These represent the monotonic count values ​​of the preceding and following time reference points, respectively. This represents the monotonic count value of the event to be converted. The monotonic count values ​​use the same counting unit, the proportional term is dimensionless, and satisfy the following conditions: the standard time of the subsequent time reference point is greater than the standard time of the previous time reference point, and the monotonic count value of the subsequent time reference point is greater than the monotonic count value of the previous time reference point.

[0049] The allowable window length is the smaller of the base allowable duration plus twice the total time uncertainty and the signal cycle duration. Therefore, the union length of the allowable windows within one cycle will not exceed the cycle duration. Intersections whose allowable window union length equals the signal cycle duration are not included in the verification set. The probability of a random hit at a single intersection is equal to the allowable window union length divided by the signal cycle duration, and its value is greater than 0 and less than 1. For coordinated green wave intersections with phase-related group identifiers, only the intersection with the highest random hit probability per intersection is retained in the verification set size and hit count for each group. The remaining intersections continue to form corresponding evidence records, but are not used to reduce the risk value of random phase matching to avoid counting related phase offsets as independent samples.

[0050] The phase random matching risk value for phase random conditions that has a number of hits exceeding the size of the verification set minus 1 is calculated according to formula (3). This formula adds the cases where all intersections are hit to the cases where exactly one intersection is not hit.

[0051] (3) In equation (3), This indicates the risk value for random phase matching; This indicates the size of the verification set included in the statistics after screening by the phase correlation group; Indicates the first The probability of random phase hits at each intersection; Indicates the first The probability of random phase hits at each intersection; and All represent from 1 to The intersection number; the product symbol indicates multiplying the probabilities within the specified range of numbers, and the summation symbol indicates multiplying the probabilities from the first to the last number. Add the terms together.

[0052] The phase random matching risk value is based on the assumption that the phase residuals of each verification intersection included in the verification set follow a uniform distribution and are independent within the model. It is a verification adequacy indicator and is not directly equivalent to the actual false acceptance rate, which needs to be confirmed through road tests. For road segments where correlation still exists, the platform can use random time misalignment samples to calculate empirical correction values ​​and take the larger of the empirical correction value and the original value. Figure 8 The theoretical curves calculated according to equation (3) are shown: when the random hit probability at a single intersection is 0.19 and the verification set size is 5, the corresponding risk is approximately 0.553%; when the verification set size is 6, the corresponding risk is approximately 0.125%. When the random hit probability at a single intersection is 0.47 and the verification set size is 10, the corresponding risk is approximately 0.646%; when the verification set size is 12, the corresponding risk is approximately 0.169%. Green wave road segments with wider allowable windows can only meet the corresponding risk threshold after the verification set size is increased.

[0053] When there are two or more mileage reference events and at least one set of valid measured mileage between these events is formed, the automatically output route compliance conclusion must simultaneously meet the following conditions: the verification set size is no less than four, the number of hits is at least the verification set size minus one, the phase random matching risk value after correlation processing does not exceed 1%, there are no contradictions in the turning comparison, and the relative deviation of mileage between all valid measured reference events does not exceed 5%. When no valid measured mileage between events is formed, the route compliance judgment does not use the mileage consistency condition, and the risk threshold is tightened to 0.2%, while requiring all associated turning events to be consistent. Results that do not meet the compliance conditions and do not yet have clear contradictions are submitted to the regulatory platform for review to distinguish between situations such as traffic congestion, template failure, and insufficient samples.

[0054] When within V2I coverage, the V2I receiving module verifies the roadside message signature, intersection number, map association, and message freshness. It then updates the green light activation reference time and signal cycle duration for the corresponding intersection using certified signal phase and timing messages. The update result includes a source identifier and validity period. Once an anomaly window begins, the template version used in that window is frozen. A receive count of 0 outside V2I coverage is normal and does not participate in the channel collapse assessment. When there is no V2I coverage, the device continues to use the periodic template signed by the regulatory platform; intersections with expired templates are removed from the verification set.

[0055] The three types of identification are performed within a rolling decision window of 2 seconds in length and 0.5 seconds in step. A channel collapse event is defined as follows: a 30 dB decrease in cellular received signal strength compared to the frozen baseline; a 20 dB decrease in FM broadcast demodulation quality; a satellite visibility count dropping to 0 or an average carrier-to-noise ratio dropping to 15 dB; or a message count dropping to 0 within the V2I coverage area. A background power decrease of more than 6 dB relative to the frozen baseline is defined as an energy decrease; an increase of more than 6 dB is defined as an energy increase; and all others are defined as stable energy. A spatial synchronization response of capacitance is established when the absolute change of at least two of the three capacitive sensing electrodes exceeds their respective thresholds, and the change begins at the same decision window.

[0056] Shielding identification employs a conservative criterion that simultaneously meets the following conditions: at least three valid channels collapse within the same decision window, including both satellite and cellular channels; at least two of the power-effective frequency bands corresponding to these collapsed channels exhibit energy degradation; and the capacitance spatial synchronization response is simultaneously established. If the satellite frequency band does not meet the noise floor margin requirement, a reduction in its detection power is not required. Suppression interference manifests as a decrease in channel demodulation quality, an increase in background power at the same frequency, and all three electrodes maintaining their baseline neighborhood; a location band interference event is formed when only the satellite channel collapses and the satellite frequency band power increases. Regional signal loss manifests as channel collapse, stable or decreasing energy in the corresponding frequency band, and stable capacitance. Within the same decision window, if at least one valid wireless receiving channel experiences a channel collapse event, at least one power-effective frequency band shows an energy increase or decrease, or at least one capacitance sensing electrode extends beyond the capacitance baseline neighborhood, and the conditions for shielding, interference, and regional signal loss are not met, an unclassified wireless anomaly event is formed.

[0057] See Figure 4 (a) Shielding examples fall in the region where the power effective frequency band energy decreases and demodulation quality decreases, interference suppression falls in the region where the energy increases and demodulation quality decreases, and regional signal loss falls in the region where the energy is stable or slightly decreased. Figure 4 (b) The third observation axis shows whether the capacitance changes synchronously. Classification matches each collapsed channel with its corresponding frequency band item by item; a power increase in another frequency band cannot replace evidence of energy at the same frequency. If the metal shield is not close to the housing, the absorbing material blocks the signal, or there are insufficient effective channels, the device may not be able to set the shield identification mark, but will instead create an unclassified wireless anomaly window and enter local endurance monitoring mode, continuously writing evidence to the record.

[0058] In the clean state, if any effective channel collapses, any effective power frequency band experiences an energy increase or decrease, or any electrode crosses the baseline neighborhood, the baseline state machine enters a candidate state and freezes the baseline. The age of the output samples from each module does not exceed 0.5 seconds, and expired samples are not reused to form collapse events. The candidate state completes classification within two consecutive decision windows, and enters the confirmation state after satisfying any classification. If at least one of the aforementioned anomalies persists, and the conditions for shielding, interference, and regional signal loss are not met, the state enters the unclassified wireless anomaly confirmation state. The window start point is the sampling time of the earliest sample in the anomaly observation that triggered the candidate state, and is determined retrospectively after classification is completed. After the anomaly quantity meets the corresponding window recovery conditions, the state first enters the recovery observation state. Only after three consecutive decision windows meet the recovery conditions does the state return to the clean state. If the anomaly crosses the boundary again during this period, the state returns to the confirmation state and the original frozen baseline is used. The longest time from the occurrence of an anomaly to its sampling and formation of a complete 2-second decision window is approximately 2.5 seconds, plus a classification calculation time of no more than 1 second, resulting in a worst-case identification delay of approximately 3.5 seconds.

[0059] Upon entering the candidate state, the device freezes the set of valid channels used for classification. During recovery judgment, channels that actually experienced channel collapse events are first recorded as channels to be recovered. Only when the entire mileage interval formed by the estimated mileage and its uncertainty is outside the V2I coverage interval marked by the platform signature template are V2I channels excluded from the list of channels to be recovered, and the exclusion time, estimated mileage, mileage uncertainty, and template version are recorded; the excluded channels to be recovered constitute the set of abnormal recovery channels. The shielding window ends when all three capacitive sensing electrodes return to their respective baseline neighborhoods, and at least one of the following conditions is met for 5 seconds: the satellite regains effective positioning or the cellular network re-establishes itself. The interference window ends when the background power of the interfered frequency band returns to the baseline neighborhood, and the demodulation quality of all channels in the abnormal recovery channel set returns to the baseline neighborhood for 5 seconds. For regional signal loss windows, if there are at least two abnormal recovery channels, at least two of them must recover for 5 seconds; if there is only one, that channel must recover for 5 seconds. If there are no abnormal recovery channels, the window ends when at least one non-excluded radio receiving channel continuously meets the preset validity conditions and its demodulation quality remains within the corresponding baseline neighborhood for 5 seconds. For unclassified radio anomaly windows, all anomalies involved in classification, except for the demodulation quality of excluded V2I channels, must recover for 5 seconds. If there are no anomalies to be recovered after exclusion, the window also ends when at least one non-excluded radio receiving channel continuously meets the preset validity conditions and its demodulation quality remains within the corresponding baseline neighborhood for 5 seconds. The window ends at the moment when the corresponding recovery conditions are first continuously met for the specified duration. The monitoring platform only signs and publishes the updated road attribute table after multiple events with overlapping uncertain location intervals, route realignment after signal recovery, and confirmation.

[0060] The suspected satellite spoofing conclusion is generated jointly by signal statistics and track consistency. A suspected spoofing window is formed when, within a set of selectable thresholds, the average carrier-to-noise ratio (CNR) of at least four satellites rises by more than 6 dB above the frozen baseline, the standard deviation of the CNR of each currently participating satellite decreases by more than 50% compared to the frozen baseline, and the lateral deviation between the satellite positioning trajectory and the track calculated from wheel speed and yaw rate exceeds 50 meters and persists for 5 seconds. The frozen baseline for the CNR standard deviation is established from samples within the same number of satellites under clean conditions. When a CNR change occurs alone, only statistical anomalies are recorded; when the wheel speed interface fails and the calculated track is unusable, no suspected spoofing conclusion is output. The starting point of the suspected spoofing window is the sampling time of the earliest anomalous sample. The pre-synchronization reference point is the last qualified and reliable time synchronization before that sampling time, and it must not be taken from the time synchronization of a suspected spoofed satellite; the post-synchronization reference point uses cellular network time synchronization with platform signature and round-trip delay compensation.

[0061] In the local endurance monitoring mode, wheel speed mileage, heading changes, sensor-triggered reference events, and rhythm observation times continue to be written to the secure storage unit as monotonic count values. After the window ends, the standard time and monotonic count value of the last qualified and reliable time synchronization before the start of the window are taken for the previous time synchronization reference point, and the standard time and monotonic count value of the first qualified and reliable time synchronization after the end of the window are taken for the subsequent time synchronization reference point; the standard time uses a time scale that includes the date and spans consecutive days. Before establishing the mapping of formula (2), the equipment verifies that both standard times and both monotonic count values ​​are strictly increasing. The equipment uses the standard time of the subsequent time synchronization reference point minus the standard time of the previous time synchronization reference point to form the time difference of the time synchronization reference point, and expands the sum of the two time synchronization uncertainties outward to both ends of the time difference; when the lower bound of the expanded time difference is greater than 0, the difference of the monotonic count values ​​is divided by the upper bound and the lower bound of the time difference respectively, and the previous quotient is used as the lower bound and the next quotient is used as the upper bound to obtain the possible counting frequency range. Based on a nominal counting frequency of 1000 Hz and a local clock frequency error limit of one part per million, this model defines the allowable counting frequency range as 999.999 Hz to 1000.001 Hz. When the possible counting frequency range intersects with this allowable counting frequency range, mapping is only established for events whose monotonic count values ​​lie between two timing reference points. If verification fails, the subsequent timing reference point is discarded and the system waits for the next reliable timing. If a qualified subsequent timing reference point cannot be obtained, the original monotonic count value is retained, the output verification basis is insufficient, and the reliable timing reference point is not replaced by a phase template.

[0062] Figure 7 This diagram illustrates the affine time mapping determined by the preceding and following time reference points. This mapping corrects for initial timescale deviations and average frequency deviations between the two time reference points; residual errors caused by nonlinear variations in crystal oscillator frequency within the interval are included in the time uncertainty. The total time uncertainty used for expanding the phase allowable window is the sum of the preceding time reference point's timing uncertainty, the following: the product of the preceding and following time reference point's timing uncertainty, the upper limit of the crystal oscillator frequency error and the time span of the time reference point, the corresponding intersection phase template uncertainty, and the upper bound of the event detection error. In the example diagram, the preceding time reference point's timing uncertainty is 0.050 seconds, the following following time reference point's timing uncertainty is 0.250 seconds, the product of the 2100.290-second span and the upper limit of the frequency error (parts per million) is 0.002100 seconds, and the first three terms total 0.302100 seconds; after adding the 0.200-second phase template uncertainty, the result is 0.502100 seconds, which is recorded as 0.502 seconds to three decimal places. Figure 7 The boundary was not included in the upper bound of the event detection error determined separately for each intersection. When performing verification, this item should also be added to the total time uncertainty of the corresponding intersection.

[0063] For example, the standard time of the pre-synchronization reference point is 50400.120 seconds in the continuous standard time scale, corresponding to a monotonic count value of 18000000; the standard time of the post-synchronization reference point is 52500.410 seconds, corresponding to a monotonic count value of 20100290. The event monotonic count value of 19050145 is located at the midpoint of the two monotonic count values, and the reconstruction time of 51450.265 seconds is obtained according to formula (2). The counting frequency corresponding to the center value of the two timing reference points is 1000 Hz; the actual verification is still performed according to the frequency range after the timing uncertainty is expanded. The equipment then recalculates all delays, allowable windows, hit results and phase random matching risk values ​​with the reconstruction time, and then performs steering comparison and mileage comparison between effective measured reference events. The intersection phase hit results are not involved in the determination of the reconstruction time mapping parameters.

[0064] When the normal compliance conditions are met within the window, a route compliance conclusion is output for that window period. If the number of hits is no greater than the verification set size minus 3, at least one turning comparison contradiction occurs, or the relative deviation of mileage between any valid measured reference events exceeds 5%, a suspected route deviation conclusion is output and the platform is requested to review it. In other boundary cases, insufficient verification evidence is output. For suspected deception windows, the suspected deception conclusion is maintained only if the phase random matching risk value, turning structure, and mileage between reference events all meet the corresponding route compliance conditions, and the satellite positioning trajectory still contradicts the calculated trajectory. The calculated trajectory is not used as absolute position evidence, and contradictory data from multiple sources are retained for verification by the regulatory platform.

[0065] Each evidence record uses a fixed field sequence encoding, including at least the device identifier, record sequence number, event monotonic counter value, record type, original measurement, template version, classification or verification conclusion, and the digest value of the previous record. Field length, byte order, and default values ​​are fixed in the protocol to prevent the same data from generating multiple encodings. The monotonic counter of the security unit increments before record submission, using a device key that cannot be read in plaintext by the master control unit. A message authentication code algorithm based on a secure hash function is used to calculate the message authentication code, with an output length of 256 bits. If a record write fails after the counter increments, a write failure record is generated on the next startup. The platform can identify power failure or storage anomalies from the sequence number gap.

[0066] The monitoring platform receives the latest record every 30 seconds. After verifying the message authentication code and record sequence number, the platform saves the record's digest value and generates a receipt with the platform's digital signature; the latest verified record digest in the receipt is called the platform confirmation chain digest. Records within the shielding window, interference window, regional signal loss window, and unclassified wireless anomaly window are cached in the secure storage unit according to their original sequence number. After the connection is restored, retransmission begins within 30 seconds, and the event time is not regenerated due to retransmission. The message authentication code prevents attackers from recalculating the entire digest chain without knowing the device key. The hardware monotonic counter can reveal record deletion and reversal. The platform confirmation chain digest is used to limit tail rollback. The clock correction record separately stores the standard time, monotonic count value, various uncertainties, template version, and message authentication code generated by the security unit for two timing reference points; the monitoring platform independently converts the correction time based on this, and the monotonic count value in the original record is always retained.

[0067] The equipment performs antenna continuity checks, vehicle interface checks, and safety storage self-tests during startup, main / backup power switching, and preset inspection cycles. Antenna open circuits or short circuits can be identified via front-end bias current or standing wave detection. If the inertial measurement unit detects vehicle movement but the wheel speed interface has no pulses for an extended period, a wheel speed interface anomaly is recorded. If the yaw rate is saturated or the zero bias exceeds the limit, an inertial interface anomaly is recorded. The main control unit is also equipped with a hardware watchdog; if no watchdog refresh signal is received for two consecutive scheduling cycles, the unit resets and generates a reset reason record. Failure of any verification data source reduces the available verification set, making judgments tend to be based on insufficient verification evidence; the equipment does not use estimated values ​​as sensor trigger reference events.

[0068] In any optional implementation, the multi-band background power detection unit can employ four parallel detectors, or a single detector combined with a radio frequency switch for time-division multiplexing. The background power of all four bands should be obtained within the same radio frequency silence measurement time slot. A fourth capacitive sensing electrode can be added to the bottom surface to accommodate suspended installation, but the shielding judgment is still calculated according to the pre-calibrated spatial combination. Illumination and barometric pressure sensors can be used as optional circumstantial evidence: sudden drops in illuminance, stable or short-term changes in barometric pressure in open road sections are evidenced by the classification results, but this does not change the established classification conditions constituted by the channel demodulation quality, the energy direction of the frequency bands, and the spatial synchronization response of the capacitance.

[0069] Another optional implementation is applicable to routes lacking V2I coverage. V2I channels are not counted as valid channels; demodulation quality conditions for shielding identification can still be met when all three channels—satellite, cellular, and FM broadcast—are valid. If the FM broadcast baseline is below the reception threshold, shielding is not identified, resulting in an unclassified wireless anomaly window. For straight-ahead green wave road sections under coordinated control within the same period, the platform conservatively corrects the phase random matching risk value using phase correlation group screening or random time misalignment road data, outputting a route compliance conclusion only after more independent intersection samples meet the risk threshold. For routes lacking sufficient periodic intersections, where the starting point cannot be reliably aligned, or where preceding and following timing reference points are missing for extended periods, the equipment continues to authenticate and store evidence, report anomalies, and output a conclusion of insufficient verification basis.

[0070] The equipment can be road tested as follows: Conducting tests on open roads with the conductive shield fully encased, controlled co-frequency signal injection, and natural underpass. Each condition should be repeated at least 30 times, recording demodulation quality, background power in four frequency bands, readings of three electrodes, classification delay, and recovery time. The shielding test verifies satellite and cellular demodulation collapse, at least two power-effective frequency band drops, and capacitor synchronization response; the interference test verifies the co-frequency energy increase in the collapsed channel; and the natural underpass test verifies capacitor stability. Route verification can be performed by repeated driving on routes including intersections with known standard time periods, and additionally using staggered time and non-target route data to calculate empirical risk upper bounds. Test data is used to determine the baseline margin and thresholds for the equipment model and does not replace the frozen baseline, trusted timing reference point, and original event records during operation.

[0071] This method embodiment is executed by the aforementioned vehicle-mounted monitoring equipment. Before the vehicle departs, the main control unit verifies the digital signature, version number, and validity period of the monitoring platform for the template package, aligns the predetermined route start point with the satellite positioning point that has passed the integrity check, and loads the intersection odometer, phase template, and road attribute table. The standard time adopts a time scale that includes the date and spans multiple days. The equipment continuously samples for 10 minutes on an open road section, obtaining no less than 1200 sets of data with a sampling period of 0.5 seconds, and establishes the demodulation quality baseline, background power baseline, and capacitance baseline of the three capacitive sensing electrodes for each wireless receiving channel; if the timestamp of any channel sample exceeds 0.5 seconds or the capacitance reading is unstable, the corresponding sample is not included in the initial baseline.

[0072] After the vehicle starts moving, the main control unit calculates the mileage and planar heading based on the wheel speed pulse and yaw rate. Only when the calculated mileage and its uncertainty range fall completely within the unique observation range are the stop-start event, the driving through event, and the turning event associated with the corresponding intersection. The timing uncertainty of the most recent reliable timing, the crystal oscillator holding error, the phase template uncertainty, and the upper bound of the event detection error together form the time uncertainty of each intersection. In one verification, after screening by the phase correlation group, 6 intersections are retained, with corresponding random hit probabilities of 0.19, 0.18, 0.20, 0.16, 0.22, and 0.17, respectively. According to formula (3), the phase random matching risk value is 0.001125448, which is about 0.113%. When 5 out of 6 intersections are hit, the number of hits meets the condition of the verification set size minus 1 or more.

[0073] The vehicle was covered by a conductive shield after entering an open road section. The main control unit obtained the complete background power vector during the radio frequency silence measurement time slot; within the same decision window, channel collapse events occurred in the satellite channel, cellular channel, and FM broadcast channel. Among them, the background power of the cellular band decreased by 11 dB from the frozen baseline, and the FM broadcast band decreased by 9 dB. Both bands met the power effective band conditions. The three capacitive sensing electrodes changed by +24% and -24% respectively relative to the frozen baseline. The changes of 21% and +18% both occurred within the same 2-second decision window. The main control unit determined the window start point by backtracking the sampling time of the earliest abnormal sample that triggered the candidate state, and placed a masking identification flag 1 second after the decision window ended. If the power vector is invalid for two consecutive decision windows, the above energy data is not used to determine masking, and an unclassified wireless anomaly window is formed.

[0074] Within the shielded window, the device is powered by a backup battery, maintaining the operation of the local clock, monotonic counter, wheel speed and inertial measurement interface, safety unit, safety storage unit, capacitance detection circuit, and necessary receiving functions. Rhythm observation times, steering events, stop-start events, and power switching events are all written to the safety storage unit with the original monotonic count values. After the conductive shield is removed, the three capacitive sensing electrodes return to the baseline neighborhood, and the cellular communication module re-registers for 5 seconds, at the end of which the shielded window ends. The main control unit then requests time synchronization from the cellular network with a supervisory platform signature and round-trip delay compensation to obtain the post-synchronization reference point.

[0075] In this example, the standard time of the pre-synchronization reference point is 50400.120 seconds, corresponding to a monotonic count value of 18000000; the standard time of the post-synchronization reference point is 52500.410 seconds, corresponding to a monotonic count value of 20100290. Both standard times and monotonic count values ​​are strictly increasing. The possible counting frequency range derived after expanding the synchronization uncertainty intersects with the allowable counting frequency range of 999.999 Hz to 1000.001 Hz. The event monotonic count value 19050145 is located at the midpoint of the two monotonic count values, and the reconstructed time of 51450.265 seconds is obtained according to equation (2). The uncertainties before and after the timing are 0.050 seconds and 0.250 seconds, respectively. The upper limit of the crystal oscillator error corresponding to the 2100.290-second span is 0.002100 seconds. After adding the 0.200-second phase template uncertainty, the total is 0.502100 seconds. When performing verification at each intersection, the upper limit of the corresponding event detection error is added.

[0076] The main control unit recalculates the delay, allowable window, hit flag, and phase random matching risk value for each intersection within the window based on the reconstruction time, and performs steering comparison and mileage comparison between reference events. The measured mileage from left-turn reference event B to right-turn reference event C is 632 meters, the template route mileage is 640 meters, and the relative deviation is 1.25%; the measured mileage from right-turn reference event C to starting reference event D is 405 meters, the template route mileage is 410 meters, and the relative deviation is approximately 1.22%. Under the conditions that 5 out of the aforementioned 6 intersections are hit, the phase random matching risk value is approximately 0.113%, there are no steering comparison contradictions, and the relative deviations of the two segments do not exceed 5%, the main control unit outputs a route compliance conclusion for the window period. If a qualified post-timing reference point cannot be obtained or the counting frequency verification fails, time mapping is not performed, the original monotonic count value is retained, and a conclusion of insufficient verification basis is output.

[0077] Each original event, classification result, clock correction parameter, and route verification conclusion is encoded in a fixed field order. The security unit first increments the monotonic record sequence number, then writes the event monotonic count value, record content, and the digest value of the previous evidence record into the current record, and calculates a 256-bit message authentication code using the built-in key. After communication is restored, the device begins to retransmit the evidence records in the masked window according to the original record sequence number within 30 seconds; after verifying the message authentication code and record sequence number, the monitoring platform saves the latest record digest and returns a platform confirmation chain digest with the platform's digital signature. The retransmission does not change the monotonic count value of the original event, and the monitoring platform independently calculates the correction time based on the clock correction record.

Claims

1. A vehicle-mounted monitoring device that is resistant to failure, shielding, and interference, characterized in that: It includes a main control unit, multiple wireless receiving channels with different operating frequency bands, a multi-band background power detection unit, a wheel speed sensor, an inertial measurement unit, a capacitance detection circuit, a safety unit, a safety storage unit, a main power interface, a backup battery, and a local clock that outputs monotonic count values. The capacitance detection circuit is connected to multiple capacitive sensing electrodes located on different surfaces of the device housing. The main control unit is configured to: collect background power in the frequency band during the local radio frequency silence measurement time slot; identify wireless anomalies based on the demodulation quality of the wireless receiving channel, the direction of background power change in the corresponding frequency band, and the spatial synchronization response of multiple capacitive sensing electrodes; shielding corresponds to a decrease in demodulation quality, a decrease in background power at the same frequency, and a change in capacitive spatial synchronization response; interference corresponds to a decrease in demodulation quality, an increase in background power at the same frequency, and stable capacitance; and regional signal loss corresponds to a decrease in demodulation quality, stable or decreased background power at the same frequency, and stable capacitance. Based on the identification results, an anomaly window is determined, and within the anomaly window, pre-stored signalized intersections on the route are recorded using monotonic count values. The rhythmic observation time and the parking and starting events and steering events directly triggered by wheel speed and inertial signals are referred to as sensor-triggered reference events. After the abnormal window ends, the reconstructed event time is uniquely determined by two qualified and reliable time synchronizations before and after the window and their monotonic count values. The route verification conclusion is output based on the matching result of the reconstructed event time and the pre-stored phase template, the phase random matching risk value, and the route structure evidence formed by the sensor-triggered reference events. The security unit generates a message authentication code for the evidence record containing the monotonic count value. The backup battery maintains abnormal identification, event recording, and evidence storage when the main power is interrupted.

2. The device according to claim 1, characterized in that, The wireless receiving channel includes a satellite positioning module, a cellular communication module, a vehicle and road infrastructure communication receiving module, and an FM broadcast receiving module; the multi-band background power detection unit includes a broadband receiving antenna, an RF switch, and filter branches corresponding to the operating frequency bands of each wireless receiving channel. Each filter branch is connected to a low-noise amplifier and a logarithmic power detector. The RF switch polls and selects each filter branch; the receiving antenna, broadband receiving antenna, and capacitive sensing electrode of each wireless receiving channel are all located within the equipment housing. The capacitive sensing electrode includes three self-capacitance sensing electrodes respectively located on the upper surface and two opposite sides of the equipment housing.

3. The device according to claim 2, characterized in that, The local clock is driven by a temperature-compensated crystal oscillator; qualified and reliable time synchronization includes satellite time synchronization that has passed integrity checks and cellular network time synchronization with a supervisory platform signature and round-trip delay compensation, with each qualified and reliable time synchronization accompanied by time synchronization uncertainty; the security unit has a built-in key and monotonic counter; the backup battery maintains the receiving functions of the main control unit, local clock, wheel speed and inertial measurement interface, security unit, secure storage unit, capacitance detection circuit, multi-band background power detection unit and wireless receiving channel during the main power interruption, and the main control unit writes power switching events and interface self-test results into the storage record.

4. The device according to claim 3, characterized in that, The main control unit pre-stores intersection mileage tables, phase templates, and road attribute tables. The intersection mileage tables record the mileage position of the periodically timed signalized intersection, turning actions, template route mileage between adjacent intersections, reference interval for starting near the stop line, and phase-related group identifiers. The phase templates record the signal cycle duration, green light start reference time, green light duration, allowable dissipation time, and phase template uncertainty. The road attribute tables record open road sections, underground or underpass road sections, vehicle and road infrastructure communication coverage areas, and non-intersection turning exemption areas. Within a qualified sampling window where satellite positioning is effective, the vehicle is in an open road section, and the capacitive sensing electrode reading is stable, the main control unit establishes a demodulation quality baseline, a frequency band background power baseline, and a capacitance baseline. The baseline state machine freezes the baselines in the candidate state, the confirmed state, and the recovery observation state of wireless anomalies. Wireless receiving channels that meet the corresponding reception threshold and coverage conditions are considered valid wireless receiving channels.

5. The device according to claim 4, characterized in that, The main control unit calculates the driving distance and planar heading based on the output of the wheel speed sensor and the inertial measurement unit, and establishes an observation interval for the signalized intersection according to the intersection odometer. Only events where the position of an uncertain interval falls completely into the unique observation interval are associated with the corresponding intersection. The moment when a vehicle changes from stationary to continuous driving after stopping within the observation interval is taken as the rhythmic observation moment for the stopping and starting situation. The moment when the vehicle speed is not lower than the set passing speed and crosses the intersection mileage position is taken as the rhythmic observation moment for the driving and passing situation. The difference between the rhythmic observation moment and the green light start reference moment is divided by the signal cycle duration to obtain the delay amount. According to the time uncertainty, the basic allowable duration is double-ended outward at the beginning and end of the signal cycle to form an allowable window. When the delay amount falls into the allowable window, it is recorded as a hit. The time uncertainty includes the timing uncertainty, the local clock holding error, the phase template uncertainty, and the upper bound of the event detection error.

6. The device according to claim 5, characterized in that, The main control unit uses the ratio of the union length of the allowable window of each verification intersection within one signal cycle to the signal cycle duration as the random hit probability of the corresponding intersection. Under the model where the phase residuals of the intersections included in the statistics are independent, the main control unit calculates the phase random matching risk value based on the random hit probability of each phase, which reaches more than 1 times the size of the verification set. Intersections with phase correlation are grouped, and only the intersection with the highest random hit probability in each group is included in the verification set. The main control unit compares the direction of the turning event with the turning action in the intersection odometer, uses the turning event and the stop-start event located in the starting reference interval near the stop line as mileage reference events, and compares the wheel speed integral mileage between adjacent mileage reference events with the template route mileage. When the number of hits, the risk value of random phase matching, the steering action, and the mileage between reference events meet the preset verification conditions, the route compliance conclusion is output. When no valid mileage between reference events is formed, a smaller risk threshold is used. When a route structure contradiction occurs, the route deviation suspected conclusion is output. In other cases, the verification basis is insufficient conclusion is output.

7. The device according to claim 6, characterized in that, The main control unit periodically sets the radio frequency silence measurement time slot, pauses the local radio frequency transmission during the radio frequency silence measurement time slot, and polls and collects the background power of each frequency band after the radio frequency front-end stabilizes. A channel collapse event occurs when the demodulation quality of the effective wireless receiving channel drops more than a corresponding threshold relative to the frozen baseline; the frequency band with a preset measurement margin for the background power baseline is the power effective frequency band, and the change in its current background power relative to the frozen baseline is classified as energy decrease, energy increase, or energy stability. A spatial synchronous response is formed when at least two capacitive sensing electrodes produce an absolute change exceeding the corresponding threshold within the same determination window.

8. The device according to claim 7, characterized in that, A shielding window is formed when at least three effective wireless receiving channels, including satellite positioning modules and cellular communication modules, experience channel collapse events within the same judgment window, and at least two of the corresponding effective power frequency bands show energy degradation and capacitance space synchronization response is established. An interference window is formed when at least one effective wireless receiving channel experiences a channel collapse event, the corresponding frequency bands of the channels experiencing channel collapse events all show energy increases, and each capacitive sensing electrode remains in the vicinity of the capacitive baseline. A regional signal loss window is formed when the corresponding frequency bands of the channels experiencing channel collapse events all show stable or decreasing energy, and each capacitive sensing electrode remains in the vicinity of the capacitive baseline. Within the same judgment window, if at least one effective wireless receiving channel experiences a channel collapse event, at least one power-effective frequency band shows energy increases or decreases, or at least one capacitive sensing electrode moves beyond the vicinity of the capacitive baseline, and the formation conditions for the shielding window, interference window, and regional signal loss window are not met, an unclassified wireless anomaly window is formed. After any window is formed, the local endurance monitoring mode is entered. The window start point is the earliest abnormal sample time that triggers the candidate state, and the window end point is the time when the corresponding abnormal quantity continuously returns to the frozen baseline vicinity and meets the preset recovery conditions. When a vehicle leaves the certified vehicle and road infrastructure communication coverage area, that communication channel does not participate in the recovery judgment.

9. The device according to claim 8, characterized in that, In local endurance monitoring mode, the main control unit continuously records the rhythm observation time and sensor-triggered reference events using monotonic count values. The last qualified and reliable time synchronization before the start of the window and its monotonic count value constitute the pre-time synchronization reference point, and the first qualified and reliable time synchronization after the end of the window and its monotonic count value constitute the post-time synchronization reference point. The standard time and monotonic count values ​​of both time synchronization reference points are strictly increasing, and when the possible counting frequency range derived by taking into account the time synchronization uncertainty intersects with the allowable range of the local clock, the main control unit only records the event monotonic count value between the two time synchronization reference points. The proportional linear interpolation is used to obtain the reconstructed time of the event, and the route verification within the window is performed with time uncertainty taking into account the timing, local clock, phase template, and event detection error. If the timing reference point is unqualified, the original monotonic count value is retained and the conclusion of insufficient verification basis is output. Each evidence record includes the record number, event monotonic count value, record content, and the summary value of the previous evidence record. The security unit uses the built-in key to calculate the message authentication code. The main control unit reports the evidence record and route verification conclusion to the supervision platform and saves the latest verified record summary returned by the supervision platform.

10. A vehicle-mounted monitoring method for preventing failure, shielding, and interference, characterized in that, The method is performed by an on-board monitoring device equipped with at least three different-frequency wireless receiving channels, a multi-band background power detection unit, multiple capacitive sensing electrodes distributed on different surfaces of the device housing, a wheel speed sensor, an inertial measurement unit, a local clock, a safety unit, a backup battery, and a safety storage unit. The wireless receiving channels include at least a satellite positioning channel and a cellular communication channel. The method includes: establishing a demodulation quality baseline, a frequency-band background power baseline, and a capacitance baseline within a qualified sampling window under normal wireless conditions; freezing the baselines during periods of wireless anomalies; detecting the rhythmic observation time, stop-start events, and turning events at signalized intersections on a pre-stored route; taking the non-negative remainder of the difference between the rhythmic observation time and the green light start reference time divided by the signal cycle duration to adjust for time uncertainty. The hit is determined within the allowable window that expands outward at the beginning and end of the cycle. The phase random matching risk value, representing the probability that the number of hits under random phase conditions reaches more than 1 times the number of verified intersections, is calculated based on the proportion of the allowable window to the signal cycle. This risk value is combined with the turning action and the mileage between reference events to output the route verification conclusion. The time uncertainty includes timing, clock, phase template, and event detection errors. During the radio frequency silent measurement time slot when the local radio frequency transmission is paused, the background power of the frequency band is collected. A screen is formed when at least three effective channels that meet the reception threshold and coverage conditions of the demodulation quality baseline collapse, including satellite positioning and cellular communication channels, and at least two energy drops in the corresponding frequency band where the background power baseline has a measurement margin, and multiple capacitive sensing electrodes form a spatial synchronous response. A shielding window is formed when a channel collapses, the energy of the corresponding frequency band increases, and each capacitive sensing electrode remains in the vicinity of the capacitance baseline. A regional signal loss window is formed when a channel collapses, the energy of the corresponding frequency band stabilizes or decreases, and each capacitive sensing electrode remains in the vicinity of the capacitance baseline. Within the same determination window, if at least one effective channel collapses, at least one power-effective frequency band experiences an energy increase or decrease, or at least one capacitive sensing electrode extends beyond the vicinity of the capacitance baseline, and the formation conditions for the shielding window, interference window, and regional signal loss window are not met, then an unclassified wireless anomaly window is formed. The window starts with the earliest anomaly sample and ends when the corresponding anomaly quantity continuously meets the recovery conditions. During the window period, the time and events are recorded using monotonic count values. When the main power supply is interrupted, the backup battery maintains operation. After the window ends, the last qualified and reliable time synchronization before the window and the first qualified and reliable time synchronization after the window, along with their monotonic count values, constitute the pre-time synchronization reference point and the post-time synchronization reference point. When the standard time and monotonic count values ​​of the two time synchronization reference points strictly increase and the counting frequency range derived by taking into account the time synchronization uncertainty intersects with the allowable range of the local clock, the event time is linearly reconstructed according to the ratio of the event monotonic count value between the two time synchronization reference points. The route verification within the window is performed at the reconstructed time. Otherwise, the original monotonic count value is retained and the conclusion of insufficient verification basis is output. The security unit generates a message authentication code for the evidence record containing the event monotonic count value and the previous record summary value, and reports the evidence record and route verification conclusion to the regulatory platform.

Images