Intel's Self-Driving Safety Patent Can Pull an Autonomous Car Over
A self-driving car that disagrees with itself about what time it is can misjudge the road. Mobileye's patent application describes a way to catch that disagreement and, if needed, bring the car to a safe stop.
What Mobileye's clock double-check actually does
A self-driving car stamps every camera frame and sensor reading with the moment it was captured, and its driving software assumes all those clocks agree. The usual way of keeping them in sync passes time along through network switches and chips, and any of them can get congested or bogged down without anyone noticing. If the clocks drift apart, the car's picture of the road gets slightly wrong.
Mobileye's patent adds a second opinion. A part of the car gets the time two ways: relayed from box to box, and straight from the main clock over a fast lane. The car then compares how long each trip seems to have taken.
If the two answers differ by too much, the car treats it as a safety problem. It can alert the driver or carry out a minimal risk maneuver, such as safely pulling over and stopping.
… computing a difference between the second time delay and the third time delay; and triggering a minimal risk maneuver if the difference between the second time delay and the third time delay is outside of a predefined range.
Translation: The car pulls itself over safely if the internal clocks disagree too much.
How the two timing paths get compared
The filing describes three kinds of devices. A master time transmitter holds the reference clock (it may itself get its time from GPS). An intermediate time receiver, typically an Ethernet switch (a box that passes data between the car's computers), relays the time. An endpoint time receiver, such as a chip processing sensor data, is the final stop.
First, time travels the relay route using a step-wise protocol (IEEE 802.1AS, an automotive timing standard). The switch syncs to the master and computes a first delay. The endpoint syncs to the switch, and its second delay is the first delay plus the switch-to-endpoint hop.
Then comes the cross-check. The master also sends time straight to the endpoint using an end-to-end protocol (IEEE 1588). Switches give those packets top priority, even slowing or dropping other traffic, so the measurement stays fast and clean. That produces a third delay.
- The endpoint compares the second and third delays.
- If the gap falls outside a preset range, the car triggers a minimal risk maneuver.
- The description gives 100 to 200 microseconds (millionths of a second) as an example threshold.
Because the direct check uses more network resources, it can run on a configurable schedule rather than constantly. Optional follow-up messages can improve accuracy when the network is busy.
Why one safe master clock could cut costs
The practical payoff is about proving timing is trustworthy without gold-plating every part. The filing says that certifying each switch and chip to automotive safety grades (known as ASIL) is costly and sometimes unrealistic. With a running cross-check, the safety-certified piece can live in the master node alone, while everything downstream is verified by its results.
For you, the most visible result would be a rare event: a car that spots an internal timing fault and stops safely, or hands control back to you, instead of driving on with data that no longer lines up. The filing names Mobileye's EyeQ chips as example endpoint devices, so this could apply to vehicles built around them.
Intel's seventh filing we've tracked in self-driving sensing race since September follows earlier Mobileye work like one grading lane paint quality and one judging darkness from cameras.
Timing errors sound trivial until you remember that a self-driving car lines up camera, GPS and motion readings in time to build its picture of the road. If the clocks disagree, that picture is slightly wrong, and nothing in the data announces it. That makes the problem real, and it is expensive to solve by brute force.
The fix matches the size of the problem. Rather than certify every switch and chip along the path to safety-grade standards, which the filing calls costly and sometimes impractical, the car checks the result and reacts when the answer looks off.
The verdict: it is plumbing, and sensible plumbing. Few riders will ever think about it, but a built-in fail-safe that brings the car to a stop on a bad clock is a sensible thing to have.
Get our take in your Top Stories
Liked this breakdown? Add Patentlyze as a preferred source on Google, and our plain-English take shows up more often in your Top Stories the next time Intel patent news breaks.
There are more where this came from
We read every patent application Big Tech publishes and send you the ones worth knowing. Plain English, free, every week.
The drawings
4 drawing sheets from US 2026/0322518 A1 · click any drawing to enlarge
Want this weekly breakdown for a company we don't cover? Patentlyze Pro →
Be the first to weigh in