DETAILED ACTION
Notice of Pre-AIA or AIA Status
1. The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Status of Claims
2. This office action is in response to application number 17/932,177 filed on 09/14/2022, in
which the amendments and arguments filed on 07/26/2026.
Claims 1 and 11 has been amended.
No claims have been added.
No claims have been cancelled.
Claims 1-20 are currently pending and have been examined.
Information Disclosure Statement
3. The information disclosure statement (IDS) submitted on 09/14/2022 and 03/09/2023 has
been received and considered.
Response to Amendment
4. Applicant' s amendments to the Claims have overcome each and every objection
previously set forth in the Non-Final Office Action mailed 04/27/2026. Applicants
arguments, see page 8-10 filed on 07/26/2026, with respect to the rejection(s) of claim(s)
1-18 under 35 USC 103 have been fully considered and are persuasive. Therefore, the rejection has been withdrawn. A new grounds for rejection is made under 35 USC 103 as necessitated by amendment over Lopez (US 20210179121 A1) in view of Yousuf (US 20180370540 A1) further in view of (US 12524021 B2) Dadkhah Tehrani and further in view of King (US 20200148201 A1).
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
5. Claim(s) 1-4, 7-14, and 17-18 is/are rejected under 35 U.S.C. 103 as being unpatentable over (US 20210179121 A1) to Lopez et al. (hereinafter Lopez) and in view of (US 20180370540 A1) to Yousuf et al. (hereinafter Yousuf).
Regarding claim 1, Lopez discloses An automation controller, comprising: a first plurality of computers configured to implement a processing pipeline to process sensor data from a plurality of sensors on a robotically-controlled mobile machine to generate an output trajectory to be followed by the robotically-controlled mobile machine, (Lopez Paragraph 0020: “Although discussed in the context of an autonomous vehicle, the methods, apparatuses, and systems described herein can be applied to a variety of systems (e.g., a sensor system or a robotic platform), and is not limited to autonomous vehicles.”) (Lopez Paragraph 0056: “The prediction component 534 can generate predictions of object behavior based at least in part on sensor data received form the sensor system 506. For example, the prediction component 534 may generate one, or multiple, predicted trajectories for an object detected in the environment.”) (Lopez Paragraph 0058: “The fault monitor component 528 may receive fault indications from various systems of the vehicle, such as the sensor systems 506, the drive systems 514, localization component 520, the perception component 522, the system controllers 526,”) wherein the first plurality of computers are configured to provide fail degraded protection for a portion first stage of the processing pipeline and fail operational protection for a remainder second stage of the processing pipeline, wherein the fail degraded protection allows the robotically-controlled mobile machine to operate after a failure of one of the first plurality of computers with one or more constraints, wherein the fail operational protection allows the robotically-controlled mobile machine to continue to operate after a failure without application of the one or more constraints; (Lopez Paragraph 0018: “For instance, the fault monitor system may map a first fault indication to a voltage constraint having a voltage threshold instruction, and may map a second fault indication to a dynamic constraint having a speed threshold instruction. Based on the presence of both fault indications (despite the constraints being otherwise unrelated), the fault monitor system may output a pull-over constraint that instructs the vehicle to pull over within a predetermined amount of time to receive maintenance in place of the voltage threshold instruction and the speed threshold instruction.”) (Note: Robot pulling over=fail-safe and robot have a speed and voltage threshold = fail-degraded) (Note: First and second constraint will be interpreted as the fail degraded and the third constraint will be interpreted as the fail operational) and a second plurality of computers coupled to the first plurality of computers and configured to control a plurality of actuators in the robotically-controlled mobile machine to cause the robotically-controlled mobile machine to follow the output trajectory, (Lopez Paragraph 0012: “The vehicle system may be a drive manager system,”) (Lopez Paragraph 0103: “The method of any of claims E-G, wherein the vehicle system comprises: a drive manager system that controls operations of vehicle components to execute a trajectory;”) (Note: Second Plurality of computers = Drive manager system)
PNG
media_image1.png
377
537
media_image1.png
Greyscale
Lopez does not disclose […] wherein the second plurality of computers implement a dual lockstep, doubly redundant mechanism to provide fail operational protection.
However, Yosuf does teach […] wherein the second plurality of computers implement a dual lockstep, doubly redundant mechanism to provide fail operational protection. (Yousuf Paragraph 0119: “In the example shown, the third processor 206 may comprise a different type of processor (e.g., Aurix or Xavier) including an LS (Lock-Step) Tricore 324 and two non-LS TriCores 325. The third processor 206 may include a safety management unit (SMU) 318, and bus interfaces 320, 322. As is well known, lockstep systems are fault-tolerant computer systems that run the same set of operations at the same time (e.g., offset by a few cycles) in parallel; the redundancy allows error detection and error correction since the output from lockstep operations can be compared to determine if there has been a fault and potentially corrected with error correction techniques.”) (Yousuf Paragraph 0183: “If processor 206 experiences a category 2 fault, control is switched to processors 202, 204 (one of these acts as a backup for the other; the operation remains safe and the driver is notified.”) (Note: lockstep tricore is also dual lockstep)
Therefore, it would have been obvious to one of ordinary skill in art before the effective filing date of the claimed invention to have modified Lopez to include […] wherein the second plurality of computers implement a dual lockstep, doubly redundant mechanism to provide fail operational protection taught by Yousuf. This would have been for the benefit to provide a centralized fault monitor system for receiving faults from different vehicle systems, mapping the received faults to associated fault constraints, prioritizing different and shared parameters between the fault constraints, and communicating the constraint parameters to appropriate vehicle systems accordingly to determine how the autonomous vehicle will handle a fault or error may, at times, present challenges. [Yousuf Paragraph 0001 and 0012]
Regarding claim 2, Lopez in view of Yousuf teaches claim 1, accordingly, the rejection of claim 1 is incorporated above.
Lopez does not disclose The automation controller as recited in claim 1, wherein respective computers of the first plurality of computers are configured to process sensor data from non-overlapping subsets of the plurality of sensors; and wherein the first plurality of computers are configured to provide fail degraded protection for processing of the sensor data from the subsets.
However, Yousuf does teach The automation controller as recited in claim 1, wherein respective computers of the first plurality of computers are configured to process sensor data from non-overlapping subsets of the plurality of sensors; (Yousuf Paragraph 0110: “As discussed above, processors 202, 204, 206 may use deep neural networks to perform some or all of the high-level functions shown. In response to vehicle motion sensors such as the inertial sensing system and other input from vehicular SAS (semi-autonomous systems) 81, the controller performs sensor data processing 140, redundant (see above) sensor data processing 142,”) and wherein the first plurality of computers are configured to provide fail degraded protection for processing of the sensor data from the subsets. (Yousuf Paragraph 0183: “If a category 3 fault occurs, the system is able to exercise only limited control and the driver is notified to take over driving (if a passenger vehicle) and to take the vehicle for service.”) (Yousuf Paragraph 0203: “FIG. 11D shows what happens when both of processors 202, 204 fail (once again, as indicated by the cross-hatched lines). If this should occur, processor 206 makes all of its dormant functions (662, 664, 666, 668) active, changes its original braking blocks (642, 644, 648, 652) from active to dormant, and also begins running redundant localization (670, 676) tracking (672, 6780 and path planning (674, 680) instances in both LS and non-LS cores. The driver receives a warning and as above. In this case, the example system does not have confidence to continue autonomous operation, so it executes a chauffeur to safe stop (note the control line reconfiguration from these now-active blocks (664, 668) to braking module 700, steering module 62, and propulsion module 56)”)
Therefore, it would have been obvious to one of ordinary skill in art before the effective filing date of the claimed invention to have modified Lopez to include The automation controller as recited in claim 1, wherein respective computers of the first plurality of computers are configured to process sensor data from non-overlapping subsets of the plurality of sensors; and wherein the first plurality of computers are configured to provide fail degraded protection for processing of the sensor data from the subsets taught by Yousuf. This would have been for the benefit to provide a centralized fault monitor system for receiving faults from different vehicle systems, mapping the received faults to associated fault constraints, prioritizing different and shared parameters between the fault constraints, and communicating the constraint parameters to appropriate vehicle systems accordingly to determine how the autonomous vehicle will handle a fault or error may, at times, present challenges. [Yousuf Paragraph 0001 and 0012]
Regarding claim 3, Lopez in view of Yousuf teaches claim 2, accordingly, the rejection of claim 2 is incorporated above.
Lopez does not disclose The automation controller as recited in claim 2, wherein the first plurality of computers are configured to further process a result of the processing of the non- overlapping subsets; wherein the further processing is performed over the sensor data from the result as a whole; and wherein the first plurality of computers are configured to provide fail operational protection for the further processing.
However, Yousuf does teach The automation controller as recited in claim 2, wherein the first plurality of computers are configured to further process a result of the processing of the non- overlapping subsets; (Yousuf Paragraph 0110: “As discussed above, processors 202, 204, 206 may use deep neural networks to perform some or all of the high-level functions shown. In response to vehicle motion sensors such as the inertial sensing system and other input from vehicular SAS (semi-autonomous systems) 81, the controller performs sensor data processing 140, redundant (see above) sensor data processing 142,”) wherein the further processing is performed over the sensor data from the result as a whole; and wherein the first plurality of computers are configured to provide fail operational protection for the further processing. (Yousuf Paragraph 0201: “FIG. 11C shows what happens when processor 206 fails (as indicated in the cross-hatched lines in the center of the drawing). In this case, processors 202, 204 continue as before but make their dormant functions (656, 657, 658, 660) active to compensate for the failure of processor 206 and direct the outputs of this blocks to the external interfaces instead of providing them to/through now-failed processor 206.”)
Therefore, it would have been obvious to one of ordinary skill in art before the effective filing date of the claimed invention to have modified Lopez to include The automation controller as recited in claim 2, wherein the first plurality of computers are configured to further process a result of the processing of the non- overlapping subsets; wherein the further processing is performed over the sensor data from the result as a whole; and wherein the first plurality of computers are configured to provide fail operational protection for the further processing taught by Yousuf. This would have been for the benefit to provide a centralized fault monitor system for receiving faults from different vehicle systems, mapping the received faults to associated fault constraints, prioritizing different and shared parameters between the fault constraints, and communicating the constraint parameters to appropriate vehicle systems accordingly to determine how the autonomous vehicle will handle a fault or error may, at times, present challenges. [Yousuf Paragraph 0001 and 0012]
Regarding claim 4, Lopez discloses The automation controller as recited in claim 1, wherein the first plurality of computers are configured to process data describing a plurality of objects surrounding the robotically-controlled mobile machine to generate a plurality of potential actions by the robotically-controlled mobile machine and the plurality of objects; (Lopez Paragraph 0056: “For example, the prediction component 534 may generate one, or multiple, predicted trajectories for an object detected in the environment. Additionally, in some cases, the prediction component 534 can determine variances in position, location, speed, acceleration, and the like for each predicted trajectory generated for a particular object.”) and wherein the first plurality of computers are configured to provide fail operational protection to generate the plurality of potential actions. (Lopez Paragraph 0018: “Based on the presence of both fault indications (despite the constraints being otherwise unrelated), the fault monitor system may output a pull-over constraint that instructs the vehicle to pull over within a predetermined amount of time to receive maintenance in place of the voltage threshold instruction and the speed threshold instruction.”)
Regarding claim 7, The automation controller as recited in claim 1, wherein the first plurality of computers are configured to detect a failure of a first one of the first plurality of computers and to continue operation of the robotically-controlled mobile machine in fail degraded mode based on the failure. (Lopez Paragraph 0018: “For instance, the fault monitor system may map a first fault indication to a voltage constraint having a voltage threshold instruction, and may map a second fault indication to a dynamic constraint having a speed threshold instruction.”) (Lopez Paragraph 0060: “In some examples, the constraint mapping component 530 may determine a different constraint to apply to one or more vehicle systems that does not necessarily directly map to individual faults themselves. In an illustrative example, a first constraint may instruct the vehicle to proceed in one direction (rather than bi-directionally)”)
Regarding claim 8, Lopez discloses The automation controller as recited in claim 1, wherein the first plurality of computers are configured to detect a failure of at least two of the first plurality of computers and to bring the robotically-controlled mobile machine to a stop based on the failure. (Lopez Paragraph 0018: “Based on the presence of both fault indications (despite the constraints being otherwise unrelated), the fault monitor system may output a pull-over constraint that instructs the vehicle to pull over within a predetermined amount of time to receive maintenance in place of the voltage threshold instruction and the speed threshold instruction.”) (Lopez Paragraph 0050: “The vehicle 502 can include vehicle computing device(s) 504,”)
Regarding claim 9, Lopez discloses The automation controller as recited in claim 1, wherein the one or more constraints include operating the robotically-controlled mobile machine at a reduced speed compared to fail operational mode. (Lopez Paragraph 0011: “On the other hand, some conventional systems allow a vehicle to continue operating as normal despite the presence of faults, which may endanger passengers and surrounding persons and objects, or cause additional damage to the vehicle.”) (Lopez Paragraph 0018: “For instance, the fault monitor system may map a first fault indication to a voltage constraint having a voltage threshold instruction, and may map a second fault indication to a dynamic constraint having a speed threshold instruction. ”) (Note: Vehicle continues to operate despite a fault is fail operational and a speed threshold is applied when the robot is in a fail degraded)
Regarding claim 10, Lopez discloses The automation controller as recited in claim 1, wherein the one or more constraints include operating the robotically-controlled mobile machine while preventing one or more actions that the robotically-controlled mobile machine is permitted to perform when the first plurality of computers are operating. (Lopez Paragraph 0018: “For instance, the fault monitor system may map a first fault indication to a voltage constraint having a voltage threshold instruction, and may map a second fault indication to a dynamic constraint having a speed threshold instruction. Based on the presence of both fault indications (despite the constraints being otherwise unrelated), the fault monitor system may output a pull-over constraint that instructs the vehicle to pull over within a predetermined amount of time to receive maintenance in place of the voltage threshold instruction and the speed threshold instruction.”) (Note: Constraint = speed threshold)
Regarding claim 11, A machine, comprising: a plurality of sensors; and an automation controller coupled to the plurality of sensors, wherein the automation controller comprises: a first plurality of computers configured to process sensor data from the plurality of sensors to generate an output trajectory to be followed by the machine, (Lopez Paragraph 0020: “Although discussed in the context of an autonomous vehicle, the methods, apparatuses, and systems described herein can be applied to a variety of systems (e.g., a sensor system or a robotic platform), and is not limited to autonomous vehicles.”) (Lopez Paragraph 0056: “The prediction component 534 can generate predictions of object behavior based at least in part on sensor data received form the sensor system 506. For example, the prediction component 534 may generate one, or multiple, predicted trajectories for an object detected in the environment.”) (Lopez Paragraph 0058: “The fault monitor component 528 may receive fault indications from various systems of the vehicle, such as the sensor systems 506, the drive systems 514, localization component 520, the perception component 522, the system controllers 526,”) wherein the first plurality of computers are configured to provide fail degraded protection for a first processing stage of the processing and fail operational protection for a second, different processing stage of the processing, wherein the fail degraded protection allows the machine to operate after a failure of one of the first plurality of computers with one or more constraints, wherein the one or more constraints are not applied to machine operation after a failure of one of the first plurality of computers with fail operational protection; (Lopez Paragraph 0018: “For instance, the fault monitor system may map a first fault indication to a voltage constraint having a voltage threshold instruction, and may map a second fault indication to a dynamic constraint having a speed threshold instruction. Based on the presence of both fault indications (despite the constraints being otherwise unrelated), the fault monitor system may output a pull-over constraint that instructs the vehicle to pull over within a predetermined amount of time to receive maintenance in place of the voltage threshold instruction and the speed threshold instruction.”) (Note: Robot pulling over=fail-safe and robot have a speed and voltage threshold = fail-degraded) (Note: First and second constraint will be interpreted as the fail degraded and the third constraint will be interpreted as the fail operational) and a second plurality of computers coupled to the first plurality of computers and configured to control a plurality of actuators in the machine to cause the machine to follow the output trajectory, (Lopez Paragraph 0012: “The vehicle system may be a drive manager system,”) (Lopez Paragraph 0103: “The method of any of claims E-G, wherein the vehicle system comprises: a drive manager system that controls operations of vehicle components to execute a trajectory;”) (Note: Second Plurality of computers = Drive manager system)
PNG
media_image1.png
377
537
media_image1.png
Greyscale
Lopez does not disclose […] wherein the second plurality of computers implement a dual lockstep, doubly redundant mechanism to provide fail operational protection.
However, Yosuf does teach […] wherein the second plurality of computers implement a dual lockstep, doubly redundant mechanism to provide fail operational protection. (Yousuf Paragraph 0119: “In the example shown, the third processor 206 may comprise a different type of processor (e.g., Aurix or Xavier) including an LS (Lock-Step) Tricore 324 and two non-LS TriCores 325. The third processor 206 may include a safety management unit (SMU) 318, and bus interfaces 320, 322. As is well known, lockstep systems are fault-tolerant computer systems that run the same set of operations at the same time (e.g., offset by a few cycles) in parallel; the redundancy allows error detection and error correction since the output from lockstep operations can be compared to determine if there has been a fault and potentially corrected with error correction techniques.”) (Yousuf Paragraph 0183: “If processor 206 experiences a category 2 fault, control is switched to processors 202, 204 (one of these acts as a backup for the other; the operation remains safe and the driver is notified.”) (Note: lockstep tricore is also dual lockstep)
Therefore, it would have been obvious to one of ordinary skill in art before the effective filing date of the claimed invention to have modified Lopez to include […] wherein the second plurality of computers implement a dual lockstep, doubly redundant mechanism to provide fail operational protection taught by Yousuf. This would have been for the benefit to provide a centralized fault monitor system for receiving faults from different vehicle systems, mapping the received faults to associated fault constraints, prioritizing different and shared parameters between the fault constraints, and communicating the constraint parameters to appropriate vehicle systems accordingly to determine how the autonomous vehicle will handle a fault or error may, at times, present challenges. [Yousuf Paragraph 0001 and 0012]
Regarding claim 12, Lopez in view of Yousuf teaches claim 11, accordingly, the rejection of claim 11 is incorporated above.
Lopez does not disclose The machine as recited in claim 11, wherein respective computers of the first plurality of computers are configured to process sensor data from non-overlapping subsets of the plurality of sensors; and wherein the first plurality of computers are configured to provide fail degraded protection for processing of the sensor data from the subsets.
However, Yousuf does teach The machine as recited in claim 11, wherein respective computers of the first plurality of computers are configured to process sensor data from non-overlapping subsets of the plurality of sensors; (Yousuf Paragraph 0110: “As discussed above, processors 202, 204, 206 may use deep neural networks to perform some or all of the high-level functions shown. In response to vehicle motion sensors such as the inertial sensing system and other input from vehicular SAS (semi-autonomous systems) 81, the controller performs sensor data processing 140, redundant (see above) sensor data processing 142,”) and wherein the first plurality of computers are configured to provide fail degraded protection for processing of the sensor data from the subsets. (Yousuf Paragraph 0183: “If a category 3 fault occurs, the system is able to exercise only limited control and the driver is notified to take over driving (if a passenger vehicle) and to take the vehicle for service.”) (Yousuf Paragraph 0203: “FIG. 11D shows what happens when both of processors 202, 204 fail (once again, as indicated by the cross-hatched lines). If this should occur, processor 206 makes all of its dormant functions (662, 664, 666, 668) active, changes its original braking blocks (642, 644, 648, 652) from active to dormant, and also begins running redundant localization (670, 676) tracking (672, 6780 and path planning (674, 680) instances in both LS and non-LS cores. The driver receives a warning and as above. In this case, the example system does not have confidence to continue autonomous operation, so it executes a chauffeur to safe stop (note the control line reconfiguration from these now-active blocks (664, 668) to braking module 700, steering module 62, and propulsion module 56)”)
Therefore, it would have been obvious to one of ordinary skill in art before the effective filing date of the claimed invention to have modified Lopez to include The machine as recited in claim 11, wherein respective computers of the first plurality of computers are configured to process sensor data from non-overlapping subsets of the plurality of sensors; and wherein the first plurality of computers are configured to provide fail degraded protection for processing of the sensor data from the subsets taught by Yousuf. This would have been for the benefit to provide a centralized fault monitor system for receiving faults from different vehicle systems, mapping the received faults to associated fault constraints, prioritizing different and shared parameters between the fault constraints, and communicating the constraint parameters to appropriate vehicle systems accordingly to determine how the autonomous vehicle will handle a fault or error may, at times, present challenges. [Yousuf Paragraph 0001 and 0012]
Regarding claim 13, Lopez in view of Yousuf teaches claim 12, accordingly, the rejection of claim 12 is incorporated above.
Lopez does not disclose The machine as recited in claim 12, wherein the first plurality of computers are configured to further process a result of the processing of the non-overlapping subsets; and wherein the further processing is performed over the sensor data as a whole, and wherein the first plurality of computers are configured to provide fail operational protection for the further processing.
However, Yousuf does teach The machine as recited in claim 12, wherein the first plurality of computers are configured to further process a result of the processing of the non-overlapping subsets; (Yousuf Paragraph 0110: “As discussed above, processors 202, 204, 206 may use deep neural networks to perform some or all of the high-level functions shown. In response to vehicle motion sensors such as the inertial sensing system and other input from vehicular SAS (semi-autonomous systems) 81, the controller performs sensor data processing 140, redundant (see above) sensor data processing 142,”) and wherein the further processing is performed over the sensor data as a whole, and wherein the first plurality of computers are configured to provide fail operational protection for the further processing. (Yousuf Paragraph 0201: “FIG. 11C shows what happens when processor 206 fails (as indicated in the cross-hatched lines in the center of the drawing). In this case, processors 202, 204 continue as before but make their dormant functions (656, 657, 658, 660) active to compensate for the failure of processor 206 and direct the outputs of this blocks to the external interfaces instead of providing them to/through now-failed processor 206.”)
Therefore, it would have been obvious to one of ordinary skill in art before the effective filing date of the claimed invention to have modified Lopez to include The machine as recited in claim 12, wherein the first plurality of computers are configured to further process a result of the processing of the non-overlapping subsets; and wherein the further processing is performed over the sensor data as a whole, and wherein the first plurality of computers are configured to provide fail operational protection for the further processing taught by Yousuf. This would have been for the benefit to provide a centralized fault monitor system for receiving faults from different vehicle systems, mapping the received faults to associated fault constraints, prioritizing different and shared parameters between the fault constraints, and communicating the constraint parameters to appropriate vehicle systems accordingly to determine how the autonomous vehicle will handle a fault or error may, at times, present challenges. [Yousuf Paragraph 0001 and 0012]
Regarding claim 14, Lopez discloses The machine as recited in claim 13, wherein the first plurality of computers are configured to process a second result of the further processing to generate a plurality of potential actions by the machine and other objects indicated in the second result; (Lopez Paragraph 0056: “For example, the prediction component 534 may generate one, or multiple, predicted trajectories for an object detected in the environment. Additionally, in some cases, the prediction component 534 can determine variances in position, location, speed, acceleration, and the like for each predicted trajectory generated for a particular object.”) and wherein the first plurality of computers are configured to provide fail operational protection to generate the plurality of potential actions. (Lopez Paragraph 0018: “Based on the presence of both fault indications (despite the constraints being otherwise unrelated), the fault monitor system may output a pull-over constraint that instructs the vehicle to pull over within a predetermined amount of time to receive maintenance in place of the voltage threshold instruction and the speed threshold instruction.”)
Regarding claim 17, Lope discloses The machine as recited in claim 11, wherein the first plurality of computers are configured to detect a failure of a first one of the first plurality of computers and to continue operation of the machine in fail degraded mode based on the failure. (Lopez Paragraph 0018: “For instance, the fault monitor system may map a first fault indication to a voltage constraint having a voltage threshold instruction, and may map a second fault indication to a dynamic constraint having a speed threshold instruction.”) (Lopez Paragraph 0060: “In some examples, the constraint mapping component 530 may determine a different constraint to apply to one or more vehicle systems that does not necessarily directly map to individual faults themselves. In an illustrative example, a first constraint may instruct the vehicle to proceed in one direction (rather than bi-directionally)”)
Regarding claim 18, Lopez discloses The machine as recited in claim 17, wherein the first plurality of computers are configured to detect a failure of at least two of the first plurality of computers and to bring the machine to a stop based on the failure. (Lopez Paragraph 0018: “Based on the presence of both fault indications (despite the constraints being otherwise unrelated), the fault monitor system may output a pull-over constraint that instructs the vehicle to pull over within a predetermined amount of time to receive maintenance in place of the voltage threshold instruction and the speed threshold instruction.”) (Lopez Paragraph 0050: “The vehicle 502 can include vehicle computing device(s) 504,”)
6. Claim(s) 5 and 15 is/are rejected under 35 U.S.C. 103 as being unpatentable over Lopez (US 20210179121 A1) in view of Yousuf (US 20180370540 A1) and further in view of (US 12524021 B2) to Dadkhah Tehrani et al. (hereinafter Dadkhah Tehrani).
Regarding claim 5, Lopez in view of Yousuf teaches claim 4, accordingly, the rejection of claim 4 is incorporated above.
Lopez in view of Yousuf does not teach The automation controller as recited in claim 4, wherein respective computers of the first plurality of computers are configured to compute a plurality of trajectories from non-fully overlapping subsets of the plurality of potential actions; and wherein the first plurality of computers are configured to provide fail degraded operation protection to compute the plurality of trajectories.
However, Dadkhah Tehrani does teach The automation controller as recited in claim 4, wherein respective computers of the first plurality of computers are configured to compute a plurality of trajectories from non-fully overlapping subsets of the plurality of potential actions; and wherein the first plurality of computers are configured to provide fail degraded operation protection to compute the plurality of trajectories. (Dadkhah Tehrani Column 1, line number 18-19: “A vehicle may include a motion planner to generate flight trajectories”) (Dadkhah Tehrani Column 4, line number 11-20: “In response to a detection of the fault, a command model of the control system may provide a degradation to a capability of the vehicle related to performance or maneuverability to the motion planner. Using the degraded capabilities of the vehicle due to the detected fault, the motion planner can adjust or modify a trajectory model for the vehicle. The modified trajectory model can specify a refined envelope of possible trajectories that can be carried out by the vehicle in view of the degradation in the capabilities due to the fault.”) (Dadkhah Tehrani Column 5, line number 42-48: “To effectuate the flight path 160, the motion planner 130 of the path executor 115 may retrieve, receive, or otherwise identify environmental data about the environment or terrain through which the air vehicle 105 is navigating. The environmental data may be received from the instrumentation or sensors in one or more components 125 of the air vehicle 105.”) (Dadkhah Tehrani Column 5, line number 66-Column 6, line number 1: “The trajectory predictor 135 of the path executor 115 may be a dynamic system to model the behavior of the air vehicle 105 with the component controller 155.”)
Therefore, it would have been obvious to one of ordinary skill in art before the effective filing date of the claimed invention to have modified Lopez in view of Yousuf to include The automation controller as recited in claim 4, wherein respective computers of the first plurality of computers are configured to compute a plurality of trajectories from non-fully overlapping subsets of the plurality of potential actions; and wherein the first plurality of computers are configured to provide fail degraded operation protection to compute the plurality of trajectories taught by Dadkhah Tehrani. This would have been for the benefit to provide the fault-tolerant fly-by-wire control system and the motion planner which may coordinate operations when a fault is detected on the vehicle, thus in response to a detection of the fault, a command model of the control system may provide a degradation to a capability of the vehicle related to performance or maneuverability to the motion planner. [Dadkhah Tehrani Column 4, line number 8-14]
Regarding claim 15, Lopez in view of Yousuf teaches claim 14, accordingly, the rejection of claim 14 is incorporated above.
Lopez in view of Yousuf does not teach The machine as recited in claim 14, wherein the respective computers of the first plurality of computers are configured to compute a plurality of trajectories from non-fully overlapping subsets of the plurality of potential actions; and wherein the first plurality of computers are configured to provide fail degraded operation protection to compute the plurality of trajectories.
However, Dadkhah Tehrani does teach The machine as recited in claim 14, wherein the respective computers of the first plurality of computers are configured to compute a plurality of trajectories from non-fully overlapping subsets of the plurality of potential actions; and wherein the first plurality of computers are configured to provide fail degraded operation protection to compute the plurality of trajectories. (Dadkhah Tehrani Column 1, line number 18-19: “A vehicle may include a motion planner to generate flight trajectories”) (Dadkhah Tehrani Column 4, line number 11-20: “In response to a detection of the fault, a command model of the control system may provide a degradation to a capability of the vehicle related to performance or maneuverability to the motion planner. Using the degraded capabilities of the vehicle due to the detected fault, the motion planner can adjust or modify a trajectory model for the vehicle. The modified trajectory model can specify a refined envelope of possible trajectories that can be carried out by the vehicle in view of the degradation in the capabilities due to the fault.”) (Dadkhah Tehrani Column 5, line number 42-48: “To effectuate the flight path 160, the motion planner 130 of the path executor 115 may retrieve, receive, or otherwise identify environmental data about the environment or terrain through which the air vehicle 105 is navigating. The environmental data may be received from the instrumentation or sensors in one or more components 125 of the air vehicle 105.”) (Dadkhah Tehrani Column 5, line number 66-Column 6, line number 1: “The trajectory predictor 135 of the path executor 115 may be a dynamic system to model the behavior of the air vehicle 105 with the component controller 155.”)
Therefore, it would have been obvious to one of ordinary skill in art before the effective filing date of the claimed invention to have modified Lopez in view of Yousuf to include The machine as recited in claim 14, wherein the respective computers of the first plurality of computers are configured to compute a plurality of trajectories from non-fully overlapping subsets of the plurality of potential actions; and wherein the first plurality of computers are configured to provide fail degraded operation protection to compute the plurality of trajectories taught by Dadkhah Tehrani. This would have been for the benefit to provide the fault-tolerant fly-by-wire control system and the motion planner which may coordinate operations when a fault is detected on the vehicle, thus in response to a detection of the fault, a command model of the control system may provide a degradation to a capability of the vehicle related to performance or maneuverability to the motion planner. [Dadkhah Tehrani Column 4, line number 8-14]
7. Claim(s) 6 is/are rejected under 35 U.S.C. 103 as being unpatentable over Lopez (US 20210179121 A1) in view of Yousuf (US 20180370540 A1) and further in view of (US 20200148201 A1) to King et al. (hereinafter King).
Regarding claim 6, Lopez in view of Yousuf teaches claim 1, accordingly, the rejection of claim 1 is incorporated above.
Lopez in view of Yousuf does not teach The automation controller as recited in claim 1, wherein the first plurality of computers are configured to evaluate a plurality of trajectories against a predetermined cost function to select the output trajectory wherein the first plurality of computers are configured to check the output trajectory to ensure that the output trajectory has at least a specified minimum probability of avoiding a collision and wherein the first plurality of computers are configured to provide fail operational protection to evaluate the plurality of trajectories to select the output trajectory and to ensure that the output trajectory has at least the specified minimum probability.
However, King does teach The automation controller as recited in claim 1, wherein the first plurality of computers are configured to evaluate a plurality of trajectories against a predetermined cost function to select the output trajectory (King Paragraph 0046: “As illustrated, the secondary system 108 includes an estimation and validation component 210, a data processing component(s) 212, a localization component 214, a perception/prediction component 216, a trajectory validation component 218, a trajectory modification component 220, and a trajectory selection component 222. In examples, the estimation and validation component 210, the data processing component(s) 212, the localization component 214, the perception/prediction component 216, the trajectory validation component 218, the trajectory modification component 220, and/or the trajectory selection component 222 may implement a model that is based on physics and/or statistics.”) wherein the first plurality of computers are configured to check the output trajectory to ensure that the output trajectory has at least a specified minimum probability of avoiding a collision (King Paragraph 0061: “The trajectory validation component 218 may validate a trajectory of the autonomous vehicle 102 received from the primary system 106. For example, the trajectory validation component 218 may determine if a trajectory is collision-free. Here, the trajectory validation component 218 may compare a trajectory of the autonomous vehicle 102 (e.g., an estimated path if the autonomous vehicle 102 maintains the trajectory) with data received from the perception/prediction component 216 (e.g., secondary perception data, data regarding a track of an object, etc.). If the comparison indicates that the trajectory of the autonomous vehicle 102 will intersect with a track or predicted trajectory of an object (or a probability of the intersection is above a threshold), the trajectory validation component 218 may determine that the trajectory is invalid.”) and wherein the first plurality of computers are configured to provide fail operational protection to evaluate the plurality of trajectories to select the output trajectory and to ensure that the output trajectory has at least the specified minimum probability. (King Paragraph 0008: “For example, upon a failure of the primary system or upon determining a collision is imminent, the secondary system may control the vehicle to decelerate along a trajectory or perform another maneuver. In at least some examples, the secondary system may exchange information with the primary system (e.g., by sending information about potential collisions to the primary system).”) (King Paragraph 0024: “Further, in some examples, the secondary system 108 takes over control of the autonomous vehicle 102 when there is a primary system error 128. In one example, the secondary system 108 may detect the primary system error 128 when the primary system 106 is offline (e.g., the primary system 106 has experienced a hardware or software failure, power to the primary system 106 was disrupted, etc.)”) (King Paragraph 0029: “In some examples, the primary system 106 may generate multiple trajectories, such as a main trajectory and one or more contingent trajectories. In examples, the secondary system 108 may adjust the main trajectory and/or a contingent trajectory when the predicted collision 120 and/or the primary system error 128 are detected.”) (King Paragraph 0090: “Alternatively, if the second system 304 determines that the probability does not meet or exceed the probability threshold (e.g., the “no” path), the process 300 may proceed to operation 322.”) (Note: because it is determined the object is small and the minimum probability of getting into a collision is not likely the vehicle continues to follow the desired path.)
Therefore, it would have been obvious to one of ordinary skill in art before the effective filing date of the claimed invention to have modified Lopez in view of Yousuf to include The automation controller as recited in claim 1, wherein the first plurality of computers are configured to evaluate a plurality of trajectories against a predetermined cost function to select the output trajectory wherein the first plurality of computers are configured to check the output trajectory to ensure that the output trajectory has at least a specified minimum probability of avoiding a collision and wherein the first plurality of computers are configured to provide fail operational protection to evaluate the plurality of trajectories to select the output trajectory and to ensure that the output trajectory has at least the specified minimum probability taught by King. This would have been for the benefit to include a vehicle including a primary system for controlling the vehicle and a secondary system that operates on the vehicle to validate operation of the primary system and to control the vehicle to avoid collisions. Thus, solving the problem of systems that have highly effective collision detection systems, these systems may be inoperable or ineffective on rare occasions. [King Paragraph 0001 and 0008]
8. Claim(s) 16 is/are rejected under 35 U.S.C. 103 as being unpatentable over Lopez (US 20210179121 A1) in view of Yousuf (US 20180370540 A1) further in view of Dadkhah Tehrani (US 12524021 B2) and further in view of King (US 20200148201 A1).
Regarding claim 16, Lopez in view of Yousuf and further in view of Dadkhah Tehrani teaches claim 15, accordingly, the rejection of claim 15 is incorporated above.
Lopez in view of Yousuf further in view of Dadkhah Tehrani does not teach The machine as recited in claim 15, wherein the first plurality of computers are configured to evaluate the plurality of trajectories to select the output trajectory; wherein the first plurality of computers are configured to check the output trajectory to ensure that the output trajectory has at least a specified minimum probability of avoiding a collision; and wherein the first plurality of computers are configured to provide fail operational protection to evaluate the plurality of trajectories to select the output trajectory and to ensure that the output trajectory has at least the specified minimum probability.
However, King does teach The machine as recited in claim 15, wherein the first plurality of computers are configured to evaluate the plurality of trajectories to select the output trajectory; (King Paragraph 0046: “As illustrated, the secondary system 108 includes an estimation and validation component 210, a data processing component(s) 212, a localization component 214, a perception/prediction component 216, a trajectory validation component 218, a trajectory modification component 220, and a trajectory selection component 222. In examples, the estimation and validation component 210, the data processing component(s) 212, the localization component 214, the perception/prediction component 216, the trajectory validation component 218, the trajectory modification component 220, and/or the trajectory selection component 222 may implement a model that is based on physics and/or statistics.”) wherein the first plurality of computers are configured to check the output trajectory to ensure that the output trajectory has at least a specified minimum probability of avoiding a collision; (King Paragraph 0061: “The trajectory validation component 218 may validate a trajectory of the autonomous vehicle 102 received from the primary system 106. For example, the trajectory validation component 218 may determine if a trajectory is collision-free. Here, the trajectory validation component 218 may compare a trajectory of the autonomous vehicle 102 (e.g., an estimated path if the autonomous vehicle 102 maintains the trajectory) with data received from the perception/prediction component 216 (e.g., secondary perception data, data regarding a track of an object, etc.). If the comparison indicates that the trajectory of the autonomous vehicle 102 will intersect with a track or predicted trajectory of an object (or a probability of the intersection is above a threshold), the trajectory validation component 218 may determine that the trajectory is invalid.”) and wherein the first plurality of computers are configured to provide fail operational protection to evaluate the plurality of trajectories to select the output trajectory and to ensure that the output trajectory has at least the specified minimum probability. (King Paragraph 0008: “For example, upon a failure of the primary system or upon determining a collision is imminent, the secondary system may control the vehicle to decelerate along a trajectory or perform another maneuver. In at least some examples, the secondary system may exchange information with the primary system (e.g., by sending information about potential collisions to the primary system).”) (King Paragraph 0024: “Further, in some examples, the secondary system 108 takes over control of the autonomous vehicle 102 when there is a primary system error 128. In one example, the secondary system 108 may detect the primary system error 128 when the primary system 106 is offline (e.g., the primary system 106 has experienced a hardware or software failure, power to the primary system 106 was disrupted, etc.)”) (King Paragraph 0029: “In some examples, the primary system 106 may generate multiple trajectories, such as a main trajectory and one or more contingent trajectories. In examples, the secondary system 108 may adjust the main trajectory and/or a contingent trajectory when the predicted collision 120 and/or the primary system error 128 are detected.”) (King Paragraph 0090: “Alternatively, if the second system 304 determines that the probability does not meet or exceed the probability threshold (e.g., the “no” path), the process 300 may proceed to operation 322.”) (Note: because it is determined the object is small and the minimum probability of getting into a collision is not likely the vehicle continues to follow the desired path.)
Therefore, it would have been obvious to one of ordinary skill in art before the effective filing date of the claimed invention to have modified Lopez in view of Yousuf further in view of Dadkhah Tehrani to include The machine as recited in claim 15, wherein the first plurality of computers are configured to evaluate the plurality of trajectories to select the output trajectory; wherein the first plurality of computers are configured to check the output trajectory to ensure that the output trajectory has at least a specified minimum probability of avoiding a collision; and wherein the first plurality of computers are configured to provide fail operational protection to evaluate the plurality of trajectories to select the output trajectory and to ensure that the output trajectory has at least the specified minimum probability taught by King. This would have been for the benefit to include a vehicle including a primary system for controlling the vehicle and a secondary system that operates on the vehicle to validate operation of the primary system and to control the vehicle to avoid collisions. Thus, solving the problem of systems that have highly effective collision detection systems, these systems may be inoperable or ineffective on rare occasions. [King Paragraph 0001 and 0008]
Allowable Subject Matter
9. Claim 19 and 20 allowed.
The following is a statement of reasons for the indication of allowable subject matter: Claim 19 is allowed due to the complex architecture of zonal and central processing of sensor data while the zonal architecture using fail operational protection and the central architecture of the invention using fail degradation protection.
Claim 20 is allowed by virtue of dependency.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to KEVIN J HARVEY whose telephone number is (571)272-5327. The examiner can normally be reached 8:00AM-5:00PM M-Th, 8:00AM-4:00PM F.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Kito Robinson can be reached at 571-270-3921. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/K.J.H./Junior Patent Examiner, Art Unit 3664
/KITO R ROBINSON/Supervisory Patent Examiner, Art Unit 3664
Prosecution Insights