Perception System Safety

It is the treatment of the perception subsystem as a safety-relevant engineered element rather than a machine-learning research problem. The subsystem begins where an interface-valid sensor measurement exists and ends where the environment model is published, and the requirements attached to that boundary are derived from vehicle-level hazardous events. ISO 26262 governs the part where malfunctioning behaviour of the E/E system causes hazards: memory corruption in a tracker, a failed imager region, a missed inference deadline, a monitor whose reaction chain does not fire in time. The guide keeps that scope explicit and shows where it stops.

ISO 26262 addresses hazards caused by malfunctioning behaviour of E/E systems, so hardware faults, systematic software faults, timing violations and the faults of a monitor implementation belong to it. ISO 21448 addresses unreasonable risk from functional and performance insufficiencies and their triggering conditions, excluding faults already covered by ISO 26262: a radar multipath ghost produced with no E/E fault, or a camera that is simply insufficient in fog. The scopes overlap rather than partition cleanly. A fog case, for example, can be a SOTIF triggering condition exposing an insufficiency while the implemented condition monitor and its reaction chain remain within the malfunction-oriented scope. The guide routes eight worked cases with the reasoning for each.

Because the handover from perception to planning is an interface between two engineering organizations, and every field of it is a promise. Object identity, class taxonomy, pose and velocity conventions, covariance consistency, existence probability and its calibration, track age, sensor provenance, free-space state, per-sector range validity, health flags and timestamps each have at least one documented way of being misread. Misreadings are a failure class of their own: both sides can be internally consistent under different assumptions while vehicle behaviour is still wrong. The guide treats units and frames, score-versus-probability drift, absent-versus-unknown collapse, enum drift and timestamp semantics as interface analysis and verification items.

Less than the word suggests, unless its coverage and its deadline are both established. Perception cannot self-certify because the estimate and the estimate of its quality are computed by the same machinery: a filter with an unmodelled bias reports a narrow covariance, and a detector blinded by glare reports no objects with no alarm. The guide sorts monitors into input-integrity, statistical, cross-modality plausibility, model-based plausibility and operating-condition classes, each with a characteristic blindness and a characteristic latency, then builds a coverage matrix that doubles as a specification tool. A detector becomes part of a safety mechanism only when its requirement, reaction, timing and coverage are specified and verified.

Enough that the number of eligible independent encounters, not the raw frame count, carries the claim. The guide works through the zero-event binomial bound and its rule-of-three approximation, so a per-encounter target tightened by a factor of ten costs roughly ten times as many clean encounters under the same assumptions. It also separates open-loop replay, which is statistically powerful but blind to consequences, from closed-loop evaluation, which can tell an error the planner absorbs apart from one that reaches the bumper, and shows why per-slice results must be reported before an exposure-weighted average hides the low-exposure cells where hazards live.

The course has 14 chapters: what perception owes the planner, the four sensing modalities and their failure physics, the derivation from vehicle hazards to perception requirements, the four assurance perspectives routed across one pipeline, the eight-stage pipeline and its failure disguises, fusion architectures and their effect on the safety argument, the environment model as a contract, uncertainty a planner can act on, time and frames and calibration, degradation without failure, monitors and diversity and the simple checking channel, degraded modes and the perception bench, building the verification and validation evidence, and a worked safety-case fragment with its residual-risk statement. A single highway reference function runs through all fourteen chapters, and its numbers are illustrative teaching values rather than product data.