Perception System Safety

Because the handover from perception to planning is an interface between two engineering organizations, and every field of it is a promise. Object identity, class taxonomy, pose and velocity conventions, covariance consistency, existence probability and its calibration, track age, sensor provenance, free-space state, per-sector range validity, health flags and timestamps each have at least one documented way of being misread. Misreadings are a failure class of their own: both sides can be internally consistent under different assumptions while vehicle behaviour is still wrong. The guide treats units and frames, score-versus-probability drift, absent-versus-unknown collapse, enum drift and timestamp semantics as interface analysis and verification items.

Less than the word suggests, unless its coverage and its deadline are both established. Perception cannot self-certify because the estimate and the estimate of its quality are computed by the same machinery: a filter with an unmodelled bias reports a narrow covariance, and a detector blinded by glare reports no objects with no alarm. The guide sorts monitors into input-integrity, statistical, cross-modality plausibility, model-based plausibility and operating-condition classes, each with a characteristic blindness and a characteristic latency, then builds a coverage matrix that doubles as a specification tool. A detector becomes part of a safety mechanism only when its requirement, reaction, timing and coverage are specified and verified.

Enough that the number of eligible independent encounters, not the raw frame count, carries the claim. The guide works through the zero-event binomial bound and its rule-of-three approximation, so a per-encounter target tightened by a factor of ten costs roughly ten times as many clean encounters under the same assumptions. It also separates open-loop replay, which is statistically powerful but blind to consequences, from closed-loop evaluation, which can tell an error the planner absorbs apart from one that reaches the bumper, and shows why per-slice results must be reported before an exposure-weighted average hides the low-exposure cells where hazards live.

The course has 14 chapters: what perception owes the planner, the four sensing modalities and their failure physics, the derivation from vehicle hazards to perception requirements, the four assurance perspectives routed across one pipeline, the eight-stage pipeline and its failure disguises, fusion architectures and their effect on the safety argument, the environment model as a contract, uncertainty a planner can act on, time and frames and calibration, degradation without failure, monitors and diversity and the simple checking channel, degraded modes and the perception bench, building the verification and validation evidence, and a worked safety-case fragment with its residual-risk statement. A single highway reference function runs through all fourteen chapters, and its numbers are illustrative teaching values rather than product data.