Search papers, labs, and topics across Lattice.
This paper introduces the Connected Dependability Cage, an architectural framework for fail-operational behavior in AI-enabled perception systems for automated vehicles. The framework uses a Function Monitor that detects inconsistencies across perception pipelines via voting and an Anomaly Monitor that identifies novel objects excluded from the training dataset. Real-world vehicle testing validates the system's ability to enable graceful degradation and minimal-risk maneuvers when safety flags are raised, while also triggering automated data recording for continuous improvement.
Automated vehicles can achieve fail-operational capabilities by using a hierarchical monitoring framework that combines functional consistency checks with anomaly detection to handle system failures and unfamiliar scenarios.
The advancement of automated vehicles introduces complex safety challenges, particularly in dynamic and unpredictable environments where AI-enabled perception systems must operate reliably. Ensuring compliance with safety standards such as ISO 26262 and ISO/PAS 21448 (SOTIF) is essential for addressing system malfunctions and mitigating unsafe behavior in unknown scenarios. However, as automation levels increase, vehicles must go beyond conventional functional safety by incorporating fail-operational capabilities that enable continued safe operation during system or component failures and the handling of unfamiliar or degraded operational conditions. To address these safety concerns, we propose the Connected Dependability Cage, an architectural framework designed to enable hierarchical fail-operational behavior in AI-enabled perception systems. This framework integrates two complementary monitoring mechanisms: a Function Monitor that oversees multiple heterogeneous AI-based perception pipelines and detects inconsistencies through a voting mechanism, and an Anomaly Monitor that evaluates the reliability of AI perception by detecting unknown or novel objects in scenes that may be excluded from the training dataset. In the presence of critical discrepancies, the system supports graceful degradation, ultimately enabling a transition to a minimal-risk maneuver strategy. Furthermore, whenever either monitor raises a safety flag, an automated data recording process is initiated to facilitate iterative system development and continuous improvement. Both monitors have been implemented and validated through extensive vehicle testing, demonstrating their practical effectiveness in real-world applications.
