GB2558762A

GB2558762A - Configuring a vehicle

Info

Publication number: GB2558762A
Application number: GB1719271.7A
Authority: GB
Inventors: Malygin Sergey; Larin Alexsey
Original assignee: Arrival Ltd
Current assignee: Arrival UK Ltd
Priority date: 2016-11-24
Filing date: 2017-11-21
Publication date: 2018-07-18
Anticipated expiration: 2037-11-21
Also published as: GB2558762B; GB201719271D0

Abstract

Apparatuses and methods are disclosed for controlling a vehicle comprising a plurality of modules (Fig.1, 102-104). A method comprises receiving at least one identifier e.g. MAC or serial number, of at least one vehicle component and using the identifier to determine whether the vehicle component is in accordance with or matches a predefined vehicle configuration. The vehicle component is authenticated or approved in response to determining that the component is in accordance with the predefined vehicle configuration 430. The operation of the component or the vehicle may only be permitted 440, 450 if it has been authenticated. An indication of the authentication may be provided on a display screen. The modules may include components such as electric motors, fuel tanks, lighting, pumps etc. The authentication may be performed by transmitting the identifier of the component to an external server and receiving a comparison result indicating whether the identifier matches at least one of those in the vehicle configuration.

Description

(71) Applicant(s):

Arrival Limited

Unit 2, Southam Road, Banbury, Oxfordshire, OX16 2DJ, United Kingdom (51) INT CL:

B60W10/30 (2006.01) B60S 5/00 (2006.01) G07C5/00 (2006.01) (56) Documents Cited:

EP 2623359 A1 US 20040003243 A1 (58)

B60R 16/023 (2006.01) B62D 65/00 (2006.01)

US 8798852 B1 US 20040003234 A1

Field of Search:

INT CL B60L, B60R, B60S, B60W, B62D, G07C Other: EPODOC, WPI (72) Inventor(s):

Sergey Malygin Alexsey Larin (74) Agent and/or Address for Service:

Venner Shipley LLP

200 Aldersgate, LONDON, EC1A 4HD,

United Kingdom (54) Title of the Invention: Configuring a vehicle

Abstract Title: Authenticating vehicle components (57) Apparatuses and methods are disclosed for controlling a vehicle comprising a plurality of modules (Fig. 1,

102-104). A method comprises receiving at least one identifier e.g. MAC or serial number, of at least one vehicle component and using the identifier to determine whether the vehicle component is in accordance with or matches a predefined vehicle configuration. The vehicle component is authenticated or approved in response to determining that the component is in accordance with the predefined vehicle configuration 430. The operation of the component or the vehicle may only be permitted 440, 450 if it has been authenticated. An indication of the authentication may be provided on a display screen. The modules may include components such as electric motors, fuel tanks, lighting, pumps etc. The authentication may be performed by transmitting the identifier of the component to an external server and receiving a comparison result indicating whether the identifier matches at least one of those in the vehicle configuration.

Figure 4

1/6

100

Figure ι

2/6 ο

co

ο ο

Figure 2

200

3/6

102 103 104

Figure 3

4/6

Figure 4

5/6

Generate signal permitting vehicle operation

650

Figure 5

6/6

Figure 6

Application No. GB1719271.7

RTM

Date :11 May 2018

Intellectual

Property

Office

The following terms are registered trade marks and should be read as such wherever they occur in this document:

MAC (page 13)

Intellectual Property Office is an operating name of the Patent Office www.gov.uk/ipo

- 1 CONFIGURING A VEHICLE

Field

This specification relates to a method and apparatus for configuring a vehicle. Particularly, but not exclusively, this specification relates to a method and apparatus for authenticating components of a vehicle and ensuring that the vehicle is configured in a correct manner.

Background

Vehicles have been developed in which aftermarket components can be added to the vehicle or used to replace original equipment manufacturer (OEM) components. As vehicles, particularly aircraft and road vehicles, must meet certain criteria in order to be permitted for public use, it may be a significant safety risk to allow vehicles to operate with components not tested and/or approved by the manufacturer.

Summary

This specification provides a method of authenticating at least one component of a vehicle, comprising: receiving at least one identifier of at least one vehicle component; in response to receipt of the at least one identifier, using the at least one identifier to determine whether the at least one vehicle component is in accordance with a predefined vehicle configuration; and authenticating the at least one vehicle component in response to determining that the at least one vehicle component is in accordance with the predefined vehicle configuration.

The method may comprise: in response to authenticating the at least one vehicle component, permitting operation of the at least one vehicle component in a vehicle.

The method may comprise: in response to authenticating the at least one vehicle component, permitting operation of a vehicle comprising the at least one vehicle component.

The method may comprise: in response to authenticating the at least one vehicle component, causing an indication of the authentication of the at least one vehicle component to be displayed at a display screen.

-2.The method may comprise: not authenticating the at least one vehicle component in response to determining that the at least one vehicle component is not in accordance with the predefined vehicle configuration.

The method may comprise: in response to not authenticating the at least one vehicle component, preventing operation of the at least one vehicle component in a vehicle.

The method may comprise: in response to not authenticating the at least one vehicle component, preventing operation of a vehicle comprising the at least one vehicle component.

The method may comprise: in response to not authenticating the at least one vehicle component, causing an indication of the non-authentication of the at least one vehicle component to be displayed at a display screen.

Using the at least one identifier to determine whether the at least one vehicle component is in accordance with a predefined vehicle configuration may comprise: comparing the received at least one identifier to at least one identifier in the predefined vehicle configuration.

Authenticating the at least one vehicle component in response to determining that the at least one vehicle component is in accordance with the predefined vehicle configuration may comprise: identifying a match between the received at least one identifier and at least one identifier in the predefined vehicle configuration.

The at least one identifier in the predefined vehicle configuration may indicate at least one authentic vehicle component of the predefined vehicle configuration.

This specification also provides an apparatus comprising: at least one computer processor; and at least one computer memory storing computer executable instructions which, when executed by the at least one computer processor, cause the method to be performed.

This specification also provides a computer program comprising computer executable instructions which, when executed by at least one computing apparatus, cause the method to be performed.

-3This specification also provides a computer readable medium storing computer executable instructions which, when executed by at least one computing apparatus, cause the method to be performed.

The computer readable medium may comprise a non-transitory computer readable medium.

This specification also provides an apparatus for controlling a modular vehicle comprising a plurality of modules, the apparatus being configured to: receive at least one identifier from at least one of the plurality of modules; compare the at least one received identifier to a predefined vehicle configuration defining at least one predefined identifier for each of the plurality of modules; and permit operation of the vehicle if the at least one received identifier matches the predefined vehicle configuration.

The apparatus may be configured to compare the at least one received identifier to the vehicle configuration by transmitting the at least one received identifier to an external server and receiving a comparison result indicating whether the received at least one identifier matches at least one of the at least one predefined identifiers in the vehicle configuration.

The apparatus may be configured to control a power source to provide power to each module independently.

This specification also provides a vehicle comprising: the apparatus; at least one power source; and a plurality of independently controllable modules.

Each of the plurality of modules may be arranged to receive power from the at least one power source.

This specification also provides an apparatus comprising: an interface for receiving at least one module connection request from a vehicle controller, the at least one module connection request including at least one identifier for a module; at least one memory for storing a vehicle configuration defining at least one predetermined identifier for each of a plurality of modules; and at least one computing apparatus for generating a signal for permitting operation of the vehicle if the received at least one identifier

-4matches the vehicle configuration, wherein the signal is transmitted to the vehicle through the interface.

This specification also provides a method of controlling a modular vehicle comprising a plurality of modules, the method comprising: receiving at least one identifier from at least one of the plurality of modules; comparing the received at least one identifier to a vehicle configuration defining at least one predetermined identifier for each of the plurality of modules; and permitting operation of the vehicle if the received at least one identifier matches the vehicle configuration.

The method may comprise: transmitting the received at least one identifier to an external server; and receiving, from the external server, a comparison result indicating whether the received at least identifier matches at least one of the at least one predetermined identifiers defined in the vehicle configuration.

This specification also provides a computer-readable storage medium storing computer executable instructions which, when executed by at least one computing apparatus, perform the method. The computer-readable storage medium may be non-transitory.

This specification also provides an apparatus comprising: at least one computer processor; and at least one computer memory containing computer executable instructions which, when executed by the at least one computer processor, cause the method of claim to be performed.

All features described herein (including any accompanying claims, abstract and drawings), and/or all of the steps of any method or process so disclosed, may be combined with any of the above aspects in any combination, except combinations where at least some of such features and/or steps are mutually exclusive.

Brief Description of the Figures

Embodiments of the present invention will now be described, by way of example only, with reference to the accompanying drawings, in which:

Figure l is a schematic diagram of a modular vehicle;

Figure 2 is a schematic diagram of a modular vehicle system;

Figure 3 is another schematic diagram of a modular vehicle system;

-5Figure 4 is a flow chart showing a method of installing a new module in a modular vehicle;

Figure 5 is a flow chart showing a method of operating a computing apparatus such as a server to install a new module in a modular vehicle; and

Figure 6 is a flow chart of a method of authenticating one or more components of a vehicle.

Detailed Description

In the following detailed description, only certain exemplary embodiments of the present invention have been shown and described, simply by way of illustration. As those skilled in the art would realize, the described embodiments may be modified in various different ways, all without departing from the scope of the present invention. Accordingly, the drawings and description are to be regarded as illustrative in nature and not restrictive. Like reference numerals designate like elements throughout the specification.

The following disclosure is made in the context of a modular vehicle, which comprises a plurality of modules assembled together to form the vehicle. Each of the modules is associated with a particular function in the vehicle, as described below, and may operate with one or more of the other modules in order provide its associated functionality. For example, one or more of the modules in the vehicle may be electrically coupled together for the purposes of supplying power between the modules. Additionally or alternatively, one or more of the modules may be electrically coupled together for the purposes of facilitating communication between the modules by electronic communication signal.

The aspects described herein relate to a process for ensuring that a modular vehicle is assembled or otherwise configured in a safe, reliable and efficient manner. As described below, the process may be carried out during assembly of the vehicle from the various modules, i.e. when the vehicle is in a part-assembled state, and/or maybe carried out after assembly of the vehicle has been completed. If carried out during vehicle assembly, the process may involve comparing an identifier of a particular module to a predefined vehicle configuration as a next step following the installation of the module in the vehicle. In other words, newly installed modules may be compared against the predefined vehicle configuration before any further modules are installed in the vehicle. This allows the vehicle to be built-up in stages, with the identity of one or

-6more modules being compared against the predefined vehicle configuration following each stage of the assembly. Following each successful comparison, assembly of the vehicle may continue with confidence that the vehicle as-assembled so far is in accordance with the predefined vehicle configuration.

If the process is carried out after vehicle assembly has been completed, one or more modules of the vehicle may be tested individually or in groups in order to verify that the configuration of the assembled vehicle is in accordance with the predefined vehicle configuration.

The specificity of the comparison process may ensure that any aspects of the vehicle which are not in accordance with the predefined configuration can be identified to individual components, or groups of components, in an efficient manner. Furthermore, the provision of the automated authentication process facilitates vehicles to be assembled correctly and safely in a non-centralized environment, such as in an individual customer’s workshop rather than on a specialized assembly line.

Figure l shows a modular vehicle 100. The vehicle includes front wheels 107, rear wheels 108, and a power source 105 coupled to a chassis 101. The power source 105 is for example a battery pack or internal combustion engine. While a vehicle 100 having four wheels 107, 108 is shown, it would be readily appreciated that the concepts described herein could equally be applied to vehicles 100 with any number of wheels.

A plurality of modules 102, 103, 104 are further coupled to the chassis 101. One or more of these modules may perform functions that are associated with the general operation of the vehicle 100. Such modules may include one or more electric motors, for example for driving the wheels 107, 108 of the vehicle 100, one or more power sources 105, for example for supplying electrical power to the electric motors via a power inverter apparatus, or one or more other modules such as vehicle lighting systems or a steering pump. Others of the modules may optionally be provided for more specific functionality associated with particular types of vehicle, such as one or more hydraulic pumps for use with a tipper body or a crane, or additional fuel tanks.

Figure 2 shows a system 200 for authenticating a modular vehicle 100. The system 200 includes an electrical power source 120, which supplies electrical power for the purposes of authenticating the modules 102, 103, 104 in the vehicle 100. The power

-Ίsource 120 may be the same power source 105 used to drive the vehicle too, or may be a separate power source which is dedicated to the authentication system 200. The system 200 also includes a controller 110, such as an electronic microcontroller, for controlling the operation of one or more of the modules 102, 103, 104 installed in the vehicle too. The controller 110 is arranged to control the supply of electrical power from the power source 120 to each of the modules 102,103 104 either independently or simultaneously.

Each of the modules 102, 103, 104 includes a memory 112, 113, 114. These memories are computer readable memories, as discussed further below. Each module 102, 103, 104 also includes a communication interface 122,123,124 for data transfer between the controller 110 and the respective modules 102, 103, 104. The memory 112, 113, 114 of each module 102,103,104 stores an identifier for identifying the module 102,103,104. The identifiers may be unique to the particular module 102,103,104 in which they are present. The identifier may include, for example, the module’s serial number which uniquely identifies that particular module. The identifier may additionally or alternatively include metadata, or other data, which indicates the type of the module.

As shown in Figure 2, the system 200 includes a user interface apparatus 130 for receiving user inputs relating to authenticating one or more modules 102, 103, 104 of the vehicle too. In the example of Figure 2, the user interface apparatus 130 is located on-board the vehicle too. In this configuration, the user interface apparatus 130 may be well suited for use in the authentication of one or more modules 102,103,104 of the vehicle too after the assembly of the vehicle too has been completed. The module(s) 102,103,104 being tested at this stage may, for example, have been fitted to the vehicle too after its initial assembly and thus may not have been part of an authentication process carried out during the initial assembly. Such modules 102, 103, 104 may, for example, be replacements for initial modules which developed a fault at some point after the initial vehicle assembly.

The user interface apparatus 130 may comprise a display and a user input apparatus for providing inputs to the system 200. The display and the user input apparatus may, for example, be embodied together as a touch-sensitive display screen via which a user can provide inputs to the system 200 by providing touch inputs to the screen.

-8The user interface apparatus 130 is configured to display visible information which can be used by a user of the system 200 to implement one of more authentication operations relating to modules 102, 103, 104 in the vehicle 100. For example, as described below, the user interface apparatus 130 may be configured to display a graphical user interface (UI) in which one or more interactive, user-selectable elements may be present relating to the assembly and/or authentication of one or modules 102, 103, 104 in the vehicle 100. The user interface (UI) displayed in the user interface apparatus 130 may, for example, be used by a user to select a module 102,103,104 for authentication. Alternatively, authentication of the module may be carried out automatically upon its installation in the vehicle 100. The user interface (UI) may also display a result of the authentication process. For example, the user interface (UI) may display a positive/negative result associated with an attempted authentication of one or more modules 102,103,104 in the vehicle 100.

Although in Figure 2 the user interface apparatus 130 is shown as being part of the vehicle 100, this is not necessarily the case. The user interface apparatus 130 may alternatively be located remotely from the vehicle 100. As will be explained further below, for example, a user interface apparatus 130 which is located separately and remotely from the vehicle 100 may be well suited for use in authenticating one or more modules 102,103,104 of the vehicle 100 during initial assembly of the vehicle 100.

As shown in Figure 2, the system 200 also includes a storage apparatus 115 for storing information relating to the module authentication process. The storage apparatus 115 comprises one or more computer readable memories, as discussed further below. In the example of Figure 2, the storage apparatus 115 is located on-board the vehicle 100 and is in communication with the controller 110 referred to above. This on-board configuration of the storage apparatus 115, in which the storage apparatus 115 is part of the vehicle 100 itself, may be suited for use in the authentication of one or more modules 102,103,104 of the vehicle 100 after the assembly of the vehicle 100 has been completed.

As is discussed in more detail below, the storage apparatus 115 may be arranged to receive the identifier of each module 102,103,104 installed in the vehicle 100 from the controller 110 of the system 200. Further, as also explained below, the storage apparatus 115 may include software control instructions for operating the controller 110 during the authentication process. For example, the controller 110 operating under the

-9control of instructions in the storage apparatus 115 may facilitate one or more identifiers of one or more particular modules 102, 103, 104 in the vehicle too to be compared against a predefined configuration for the vehicle too. The predefined vehicle configuration may, for example, specify particular identifiers for modules to be included in the vehicle. In the system 200 illustrated in figure 2, the predefined vehicle configuration may be stored in the storage apparatus 115. Alternatively, the predefined vehicle configuration may be stored on a computer memory which is integrated in the controller 110.

The predefined vehicle configuration, which represents an authentic configuration of the vehicle too, may be loaded into the storage apparatus 115 and/or an integrated memory of the controller 110 by, for example, connecting the storage apparatus 115 and/or the controller 110 to an external memory device containing the predefined configuration. The connection may be an internet or other network-based connection, or may, for example, comprise a temporary wired connection.

The storage apparatus 115 may further include computer readable instructions for implementing the user interface (UI) at the user interface apparatus 130. As discussed above, the user interface (UI) may facilitate a result of a module authentication process to be viewed at the user interface apparatus 130. The user interface (UI) may be specific to the authentication process. However, some aspects of the user interface (UI) may alternatively relate to a wider range of operations at the vehicle too. For example, as described in more detail below, the authentication result may be displayed in the user interface (UI) as part of a set of assembly instructions for assembling the vehicle too from the modules 102,103,104. Aspects of the user interface (UI) may also relate to a testing process for testing the operation of one or more of the modules in the vehicle too.

In some embodiments, the storage apparatus 115 further includes a list of modules that can be replaced by a user without a module identification check and corresponding authentication operation being performed. This list may be part of the predefined vehicle configuration. An advantage of the processes and apparatus described herein may be to prevent key vehicle components, such as motors and/or controllers, being replaced with parts that could have a detrimental impact on the safety of the vehicle. Therefore, it may be unnecessary to perform an identification check and corresponding

- 10 authentication operation on every module - particularly those modules which do not have an impact on the safety or running reliability of the vehicle 100.

Figure 3 shows another configuration of a system 300 for authenticating a modular vehicle 100. Here, the storage apparatus 340 for storing the predefined vehicle configuration and other stored elements referred to above with respect to the storage apparatus 115 shown in figure 2 is located externally to the vehicle 100 in a separate computing apparatus 330, such as a server, of the system 300. The vehicle 100 comprises a transceiver 310 for transmitting and receiving information to/from the external computing apparatus 330. The transceiver 310 is communicatively coupled to the controller 110 referred to above so that data, for example in the form of instructions, can be sent between the controller no in the vehicle 100 and the external computing apparatus 330. The transceiver 310 may be configured to communicate with the external computing apparatus 330 over a wired or wireless interface, in a suitable manner known to those skilled in the art. Information transmitted from the controller no to the external computing apparatus 330 may, for example, comprise one or more module connection requests for determining whether one or more new modules are authentic and/or approved for use in the vehicle 100. Such a determination may involve identifying, at the external computing apparatus 330, whether the one or more modules are in accordance with the predefined vehicle configuration stored in the storage apparatus 340. The above-mentioned module connection request may include an identifier corresponding to the one or more modules 102,103,104 which are the subject of the request. These identifier(s) maybe compared with identifier(s) present in the predefined vehicle configuration stored in the external computing apparatus 330 in order to determine whether the module(s) are authentic and in accordance with the predefined vehicle configuration. The modules which are identified in the module connection request may have been recently connected to the vehicle 100 and the request may have been initiated automatically by the controller no of the system 300 in response to the modules being connected to the vehicle. The connection(s) may, for example, comprise one or more electrical connections, such as digital connections, between the newly installed module(s) and one or more module(s) which are pre-existing in the vehicle 100, such as the controller no. Such pre-existing modules may, for example, have already been successfully authenticated against the predefined vehicle configuration following their installation in the vehicle.

- 11 The system 300 shown in figure 3 makes use of a communication network 320, via which messages between the vehicle transceiver 310 and the external computing apparatus 330 may be transmitted. The network 320 may, for example, comprise the internet or another wide area network. The network 320 may additionally or alternatively comprise one or more local area networks, as known in the art. Both the controller no, via the transceiver 310, and the external computing apparatus 330 are communicatively coupled to the network 320. In alternative embodiments, the external computing apparatus 330 is communicatively coupled to the vehicle transceiver 310 through a peer-to-peer connection, such that the network 320 is not necessary.

In some embodiments, the external computing apparatus 330 comprises a user interface apparatus 360, in addition to an electronic controller, computer readable storage apparatus 340, and other standard computing components. As with the user interface apparatus 130 previously described with respect to figure 2, the user interface apparatus 360 of the external computing apparatus 330 may comprise a display and a user input apparatus for providing inputs to the system 300. The display and the user input apparatus may, for example, be embodied together as a touch-sensitive display screen via which a user can provide inputs to the system 300 by providing touch inputs to the screen. As with the user interface apparatus 130 described with respect to figure 2, the user interface apparatus 360 of the external computing apparatus 330 is configured to display visible information which can be used by a user of the external computing apparatus 330 to implement one of more authentication checks of modules 102,103,104 in the vehicle 100.

For example, the user interface apparatus 360 may be configured to display the graphical user interface (UI) referred to above. The storage apparatus 340 of the external computing apparatus 330, which comprises at least one computer readable memory, may store the information referred to above in relation to the storage apparatus 115 in the vehicle 100. In this way, some or all of the instructions and information used by the controller no to facilitate authentication of one or more of the modules 102, 103, 104 of the vehicle 100 may be stored in the external computing apparatus 330 rather than in the vehicle 100 itself. Instructions and/or other information stored in the memory of the external computing apparatus 330 may be transmitted to the controller 110 of the vehicle 100, via the transceiver 310, in order to control and implement the authentication process. Additionally, or alternatively, the

- 12 memory of the external computing apparatus 330 may also contain instructions for implementing the user interface (UI) at the user interface apparatus 360 of the external apparatus 330. This provides the option for the user interface apparatus 130 shown in Figure 2 to be dispensed with, at least during the initial assembly process of the vehicle too, whilst still facilitating authentication of individual modules 102, 103, 104 of the vehicle too.

Various example methods of authenticating one or more modules of the vehicle too, either as part of an initial assembly process with the vehicle too in a partially assembled state, or at a later time after the initial assembly has been completed, are described below. As mentioned above, the user interface (UI) from which the authentication process may be controlled by a user of the authentication system may offer the authentication functionality as part of a wider set of vehicle assembly instructions. For example, after installation of a particular module in the vehicle, a user of the system may provide an input to the user interface (UI) to confirm that the module has been installed. In response, the system may be configured to automatically implement an authentication test of the newly installed module to ensure that it is safe and approved for use in the vehicle. The authentication test of the module is then carried out and the results of the test may be displayed in the user interface (UI). If the result of the test is that the module is authentic, the user interface instructions, as stored in one or more of the various storage apparatuses discussed above, may be configured to present instructions for installing the next module of the vehicle too in order to continue the vehicle assembly process.

Figure 4 shows a method of operating a vehicle too to ensure only permitted modules 102, 103, 104 are installed. In a first step 400, the vehicle too receives a vehicle configuration. The vehicle configuration comprises a list of allowed module identifiers (i.e. identifiers representing allowed modules). As described below, these identifiers facilitate newly-connected modules to be authenticated before they are approved for use in the vehicle too.

In some embodiments, the vehicle configuration is pre-programmed into the storage apparatus 115 or an internal memory of the controller 110. For example, the vehicle configuration maybe stored in the storage apparatus 115 and/or an internal memory of the controller 110 before the controller 110 and the other modules of the vehicle are shipped to a customer for assembly. Alternatively, the vehicle configuration may be

-13programmed into the storage apparatus 115 or an internal memory of the controller 110 after the controller 110 and the other modules has been shipped for assembly, such as at the time of vehicle assembly. The vehicle configuration may be received at the storage apparatus 115 from a separate storage medium, such as a USB, which is temporarily communicatively coupled to the storage apparatus 115 by physical connection such as via a data port. Alternatively, the vehicle configuration may be received at the storage apparatus 115 by over-the-air transfer, through the transceiver 310, from another computing apparatus. The vehicle configuration may comprise a unique identifier of each of a plurality of modules which are approved for use in the vehicle. These identifiers may be received at the controller 110 as part of the vehicle configuration.

In step 410, the vehicle configuration is stored in the storage apparatus 115 or in an internal memory of the controller 110. In other words, the vehicle configuration is stored on-board the vehicle too.

Next, in step 420, the controller 110 receives a connection request for a new module. The connection request is automatically generated when the new module is coupled to the vehicle too and powered up. The connection request includes a unique identifier for the new module, such as a serial number or MAC number.

In step 430, the controller 110 determines whether the identifier received in the connection request matches an identifier stored as part of the vehicle configuration. Alternatively, the controller 110 may determine whether the current vehicle configuration, including the new module, matches the stored vehicle configuration. In this alternative implementation, it may be that the modules are not independently checked against individual identifiers in the stored vehicle configuration.

If the received identifier matches an identifier of the stored vehicle configuration, in step 440 the controller 110 determines that the new module is authentic and permits the new module and/or the vehicle too as a whole to operate. This may include allowing the vehicle’s brakes, such as a parking brake, to release, or closing a switch to allow power to be provided to the vehicle’s too motors.

If the received identifier does not match an identifier of the stored vehicle configuration, in step 450, the controller 110 determines that the new module is not

-14authentic and does not permit the new module and/or the vehicle 100 as a whole to operate. In other words, the controller no prevents the module and/or the vehicle too from operating. This may include applying a brake, such as a parking brake, or opening a switch to prevent power being delivered to the motors.

Figure 5 shows a method of operating a computing apparatus 330 in order to permit operation of a vehicle 100. The method is described below in the context of a scenario in which the computing apparatus 330 comprises a network server. However, this should not be taken as a limiting example and a skilled person will appreciate that the aspects described below with respect to the network server could alternatively be implemented in one or more other computing apparatuses, such as an electronic user device such as smart-phone or a personal computer.

The server 330 is communicatively coupled to the vehicle 100 via a wired or wireless communication coupling. For example, the server 330 and the vehicle 100 may be coupled through a network 320, which may comprise the internet, as shown in figure 3.

In a first step 600, the server 330 receives a vehicle configuration. The vehicle configuration comprises a list of allowed module identifiers, as previously discussed with respect to figure 4.

The vehicle configuration may be programmed into the storage apparatus 340 of the server 330 at an appropriate time, for example before assembly of the vehicle from a plurality of modules begins. The vehicle configuration may be received at the storage apparatus 340 from a separate storage medium, such as a USB, which is temporarily communicatively coupled to the server 330 by physical connection such as via a data port. Alternatively, the vehicle configuration may be received at the server 330 by overthe-air transfer from another computing apparatus. As described previously with respect to figure 4, the vehicle configuration may comprise a unique identifier of each of a plurality of modules which are approved for use in the vehicle. These identifiers maybe received at the server 330 as part of the vehicle configuration.

In step 610, the vehicle configuration is stored in the storage apparatus 340 of the server 330. In other words, the vehicle configuration is stored on the server 330.

-15Next, in step 620, the server 330 receives a connection request for a new module. The connection request may, for example, be automatically generated at the controller 110 of the vehicle too when the new module is coupled to the vehicle too and powered up. The connection request includes a unique identifier for the new module, such as a serial number or MAC number. The connection request is received from the vehicle too through the wired or wireless connection. For example, the connection request may be received at the server 330 over the network 320.

In step 630, the server 330 determines whether the identifier received in the connection request matches an identifier stored as part of the vehicle configuration. Alternatively, the server 330 may determine whether the current vehicle configuration (e.g. as so-far assembled), including the new module, matches the stored vehicle configuration. In this alternative implementation, it may be that the modules are not independently checked against individual identifiers in the stored vehicle configuration.

If the received identifier matches an identifier of the stored vehicle configuration, in step 650 the server 330 generates a signal containing information for permitting operation of the new module and/or the vehicle too as a whole. The signal may contain an indication that the new module has been authenticated successfully against the stored vehicle configuration. The signal may include, for example, information for controlling at least one of a brake, power supply or motor, as previously discussed with respect to figure 3. The signal is then transmitted to the controller 110 of the vehicle too.

If the received identifier does not match an identifier of the stored vehicle configuration, in step 640, the server 330 generates a signal containing information for preventing operation of the new module and/or the vehicle too as a whole. The signal may contain an indication that the new module has not been successfully authenticated against the stored vehicle configuration. The signal may include information for controlling at least one of a brake, power supply or motor, for example in order to prevent the vehicle from being driven as previously discussed. The signal is then transmitted to the controller 110 of the vehicle too.

Figure 6 shows another method of operating a computing apparatus in order to authenticate one or more components (referred to above as modules) installed in a vehicle too and, following successful authentication of the components, permit

-ι6operation of the vehicle too. The method may be implemented in a computing apparatus at the vehicle too, such as the controller no referred to above and shown in figures 2 and 3. Alternatively, the method may be implemented in one or more computing apparatuses outside the vehicle too, such as the network server 330 and/or a separate electronic user device 370 in communication with the controller no of the vehicle too. The electronic user device 370, if used, may, for example, comprise a user interface apparatus 380 similar to the UI apparatus 360 referred to above with respect to the server 330. The user interface apparatus 380 of the electronic user device 370 may display information from the server 330 and/or the controller no of the vehicle too. The displayed information may relate to the authentication of one or more components (otherwise referred to as modules) of the vehicle too. For example, the user interface apparatus 380 of the device 370 may be configured to receive information from the controller no of the vehicle too and/or from the server 330 regarding whether one or more particular components of the vehicle are in accordance with a stored, approved vehicle configuration. In general, in all of the methods described herein, information may optionally be displayed to the user in the user interface apparatus 380 of an electronic device 370.

In a first step 700 of the method, at least one identifier of at least one vehicle component is received at the computing apparatus. The at least one identifier may be received from the component itself via a communicative coupling between the component and the controller 110. For example, the component may comprise an internal memory 112-114 which stores a unique identifier, as discussed previously. Upon the memory being powered-up when the component is connected to the vehicle, the controller 110 may automatically receive the identifier over the communicative coupling. The coupling may, for example, be an electronic connection capable of supporting digital messaging between the controller 110 of the vehicle too and the memory in the component.

In a second step 710 of the method, in response to receipt of the at least one identifier, the computing apparatus uses the at least one identifier to determine whether the at least one vehicle component identified by the identifier is in accordance with a predefined vehicle configuration. As previously discussed, this may involve comparing the identifier with identifiers included in the predefined vehicle configuration.

-17In a third step 720 of the method, the computing apparatus is configured to authenticate the at least one vehicle component in response to determining that the at least one vehicle component is in accordance with the predefined vehicle configuration. This may involve generating a signal which is indicative of the component having been authenticated. This signal may be received at the controller 110, which may be configured to respond by permitting operation of the component and/or the vehicle 100.

If the component is found to be not authentic, for example because of a failure to find a matching identifier in the stored vehicle configuration, the computing apparatus may generate a signal which is indicative of the component having not been authenticated successfully. This signal may be received at the controller 110, which may be configured to respond by preventing operation of the component and/or the vehicle too.

It will be appreciated that in the embodiments in which the computer readable instructions for implementing the user interface (UI) and/or the authentication process are stored at the network server 330, the user interface (UI) and/or the authentication process as a whole may be made available to a large number of users. As such, the users may each assemble a fully authenticated modular vehicle too in the manner described above, from a centralized system which can be easily maintained and kept up to date. Such an arrangement is particularly efficient, as it ensures that large numbers of vehicles can be assembled, in accordance with regulatory vehicle standards, at multiple locations in a safe manner by multiple different personnel. The instructions could be obtained ‘live’ from the server 330, during the authentication process, or could be downloaded, e.g. in the form of an application program, immediately before commencing assembly and/or authentication of one or modules of the vehicle too. If an application program is used, this could be updated on all devices by over the air update to ensure that the user interfaces (UI) and authentication process being implemented by all users of the system remains up-to-date.

Embodiments of the present disclosure may be implemented in software, hardware, application logic or a combination of software, hardware and application logic. The software, application logic and/or hardware may reside on memory, or any computer media. In an example embodiment, the application logic, software or an instruction set is maintained on any one of various conventional computer-readable media. In the

-18context of this document, a “computer-readable medium” may be any media or means that can contain, store, communicate, propagate or transport the instructions for use by or in connection with an instruction execution system, apparatus, or device, such as a computer.

A computer-readable medium may comprise a computer-readable storage medium that may be any tangible media or means that can contain or store the instructions for use by or in connection with an instruction execution system, apparatus, or device, such as a computer as defined previously.

According to various embodiments of the previous aspect of the present disclosure, the computer program according to any of the above aspects, may be implemented in a computer program product comprising a tangible computer-readable medium bearing computer program code embodied therein which can be used with a processor for the implementation of the functions described above.

Reference to “computer-readable storage medium”, “computer program product”, “tangibly embodied computer program” etc, or a “processor” or “processing circuit” etc. should be understood to encompass not only computers having differing architectures such as single/multi processor architectures and sequencers/parallel architectures, but also specialised circuits such as field programmable gate arrays FPGA, application specify circuits ASIC, signal processing devices and other devices. References to computer program, instructions, code etc. should be understood to express software for a programmable processor firmware such as the programmable content of a hardware device as instructions for a processor or configured or configuration settings for a fixed function device, gate array, programmable logic device, etc.

By way of example, and not limitation, such “computer-readable storage medium” may mean a non-transitory computer-readable storage medium which may comprise RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage, or other magnetic storage devices, flash memory, or any other medium that can be used to store desired program code in the form of instructions or data structures and that can be accessed by a computer. An exemplary non-transitory computer-readable storage medium is an optical storage disk such as a CD. Also, any connection is properly termed a “computer-readable medium”. For example, if instructions are transmitted from a website, server, or other remote source using a coaxial cable, fiber optic cable,

-19twisted pair, digital subscriber line (DSL), or wireless technologies such as infrared, radio, and microwave, then the coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technologies such as infrared, radio, and microwave are included in the definition of medium. It should be understood, however, that “computer-readable storage medium” and data storage media do not include connections, carrier waves, signals, or other transient media, but are instead directed to non-transient, tangible storage media. Disk and disc, as used herein, include compact disc (CD), laser disc, optical disc, digital versatile disc (DAD), floppy disk and Blu-ray disc, where disks usually reproduce data magnetically, while discs reproduce data optically with lasers. Combinations of the above should also be included within the scope of “computerreadable medium”.

Instructions may be executed by one or more processors, such as one or more digital signal processors (DSPs), general purpose microprocessors, application specific integrated circuits (ASICs), field programmable logic arrays (FPGAs), or other equivalent integrated or discrete logic circuitry. Accordingly, the term “processor,” as used herein may refer to any of the foregoing structure or any other structure suitable for implementation of the techniques described herein. In addition, in some aspects, the functionality described herein may be provided within dedicated hardware and/or software modules. Also, the techniques could be fully implemented in one or more circuits or logic elements.

If desired, the different steps discussed herein may be performed in a different order and/or concurrently with each other. Furthermore, if desired, one or more of the above-described steps maybe optional or maybe combined.

Whilst certain embodiments of the invention have been described herein with reference to the drawings, it will be understood that many variations and modifications will be possible without departing from the scope of the invention as defined in the accompanying claims.

Claims

1. A method of authenticating at least one component of a vehicle, comprising: receiving at least one identifier of at least one vehicle component;

in response to receipt of the at least one identifier, using the at least one identifier to determine whether the at least one vehicle component is in accordance with a predefined vehicle configuration;

authenticating the at least one vehicle component in response to determining that the at least one vehicle component is in accordance with the predefined vehicle configuration.

2. The method of claim l, comprising:

in response to authenticating the at least one vehicle component, permitting operation of the at least one vehicle component in a vehicle.

3. The method of claim l or 2, comprising:

in response to authenticating the at least one vehicle component, permitting operation of a vehicle comprising the at least one vehicle component.

4. The method of any preceding claim, comprising:

in response to authenticating the at least one vehicle component, causing an indication of the authentication of the at least one vehicle component to be displayed at a display screen.

5. The method of any preceding claim, comprising:

not authenticating the at least one vehicle component in response to determining that the at least one vehicle component is not in accordance with the predefined vehicle configuration.

6. The method of claim 5, comprising:

in response to not authenticating the at least one vehicle component, preventing operation of the at least one vehicle component in a vehicle.

7. The method of claim 5 or 6, comprising:

in response to not authenticating the at least one vehicle component, preventing operation of a vehicle comprising the at least one vehicle component.

- 21

8. The method of any of claims 5 to 7, comprising:

in response to not authenticating the at least one vehicle component, causing an indication of the non-authentication of the at least one vehicle component to be displayed at a display screen.

9. The method of any preceding claim, wherein using the at least one identifier to determine whether the at least one vehicle component is in accordance with a predefined vehicle configuration comprises:

comparing the received at least one identifier to at least one identifier in the predefined vehicle configuration.

10. The method of any preceding claim, wherein authenticating the at least one vehicle component in response to determining that the at least one vehicle component is in accordance with the predefined vehicle configuration comprises:

identifying a match between the received at least one identifier and at least one identifier in the predefined vehicle configuration.

11. The method of claim 9 or 10, wherein the at least one identifier in the predefined vehicle configuration indicates at least one authentic vehicle component of the predefined vehicle configuration.

12. An apparatus comprising:

at least one computer processor; and at least one computer memory storing computer executable instructions which, when executed by the at least one computer processor, cause the method of any preceding claim to be performed.

13. A computer program comprising computer executable instructions which, when executed by at least one computing apparatus, cause the method of any of claims 1 to 12 to be performed.

14. A computer readable medium storing computer executable instructions which, when executed by at least one computing apparatus, cause the method of any of claims 1 to 12 to be performed.

- 22

15- The computer readable medium of claim 14, comprising a non-transitory computer readable medium.

16. Apparatus for controlling a modular vehicle comprising a plurality of modules, the apparatus being configured to:

receive at least one identifier from at least one of the plurality of modules; compare the at least one received identifier to a predefined vehicle configuration defining at least one predefined identifier for each of the plurality of modules; and permit operation of the vehicle if the at least one received identifier matches the predefined vehicle configuration.

17. The apparatus according to claim 16, the apparatus being configured to compare the at least one received identifier to the vehicle configuration by transmitting the at least one received identifier to an external server and receiving a comparison result indicating whether the received at least one identifier matches at least one of the at least one predefined identifiers in the vehicle configuration.

18. The apparatus according to claim 16 or 17, the apparatus being configured to control a power source to provide power to each module independently.

19. A vehicle comprising:

the apparatus of any of claims 16 to 18;

at least one power source; and a plurality of independently controllable modules.

20. The vehicle of claim 19, wherein each of the plurality of modules are arranged to receive power from the at least one power source.

21. An apparatus comprising:

an interface for receiving at least one module connection request from a vehicle controller, the at least one module connection request including at least one identifier for a module;

at least one memory for storing a vehicle configuration defining at least one predetermined identifier for each of a plurality of modules; and

-23at least one computing apparatus for generating a signal for permitting operation of the vehicle if the received at least one identifier matches the vehicle configuration, wherein the signal is transmitted to the vehicle through the interface.

5

22. A method of controlling a modular vehicle comprising a plurality of modules, the method comprising:

receiving at least one identifier from at least one of the plurality of modules; comparing the received at least one identifier to a vehicle configuration defining at least one predetermined identifier for each of the plurality of modules; and io permitting operation of the vehicle if the received at least one identifier matches the vehicle configuration.

23. The method according to claim 22, comprising:

transmitting the received at least one identifier to an external server; and 15 receiving, from the external server, a comparison result indicating whether the received at least identifier matches at least one of the at least one predetermined identifiers defined in the vehicle configuration.

24. A computer-readable storage medium storing computer executable instructions 20 which, when executed by at least one computing apparatus, perform the method of claim 22 or 23.

25. An apparatus comprising:

at least one computer processor; and

25 at least one computer memory containing computer executable instructions which, when executed by the at least one computer processor, cause the method of claim 22 or 23 to be performed.

Intellectual

Property

Office

Application No: GB1719271.7 Examiner: Mr Vivek Raghavan