š Why Deep Sea Is a Natural RTT Domain
By Nawder Loswin 1/4/2026 Ā© www.TriadicFrameworks.org#
Deep sea exploration is already triadic ā they just donāt name it that way.
Below is a oneāpage executive safety summary, written for nonātechnical reviewers, senior regulators, and decisionāmakers. It avoids jargon, avoids equations, and focuses on what the system does, why it is safe, and how risk is controlled.
Executive Safety Summary#
Safe Operation Under Uncertainty (Autonomous Driving)#
What problem this system addresses#
Autonomous vehicles must remain safe not only when everything works perfectly, but also when conditions make the environment hard to understandāsuch as night rain, construction zones, or complex intersections.
These situations do not involve system failures. Instead, they involve uncertainty: the vehicle cannot be sufficiently confident that it understands the scene well enough to act safely.
This system is designed to recognize those limits and respond conservatively.
Core safety principle#
The vehicle never commits to a risky maneuver unless the environment is sufficiently clear to justify it.
When clarity degrades, the system reduces its authority, rather than guessing or pushing forward.
How the system manages uncertainty#
The vehicle continuously evaluates whether the environment remains interpretable.
When interpretability degrades, the system enters a constrained safety state where:
- Complex or irreversible maneuvers are blocked
- Only stabilizing or riskāreducing actions are allowed
- The system prepares for a safe fallback
This approach applies even when all sensors and software are functioning correctly.
What happens when conditions worsen#
When uncertainty becomes significant:
For supervised automation (L2/L3)#
- The vehicle stabilizes its behavior
- Complex actions are paused
- Control is returned to the human driver before a risky commitment occurs
For unsupervised automation (L4)#
- The vehicle executes a minimalārisk maneuver
- Behavior depends on road type and speed:
- Highway speeds: gradual deceleration, laneāholding, and exit or shoulder use when safe
- ā¤50āÆmph roads: controlled stop or pullāover, avoiding intersections and conflict points
At no point does the system rely on āconfidenceā or prediction to justify risky actions.
Why limited lane changes may still occur#
In rare cases, a single lane change may be allowed only to reach a safer location (such as a shoulder or curb lane).
This is permitted only when conditions are clearly improving over time, and only when the maneuver reduces overall risk.
This does not mean normal driving resumes. The vehicle remains in a constrained safety mode until conditions fully recover.
What the system will never do#
- Guess through poor visibility
- Enter intersections or complex traffic situations under uncertainty
- Resume normal driving without sustained improvement
- Hide uncertainty behind confidence scores or predictions
Why this approach is considered safe#
- It treats uncertainty as a firstāclass safety concern
- It prevents irreversible actions when understanding is insufficient
- It adapts behavior based on road type and speed
- Every safety decision is deterministic, logged, and auditable
This aligns with both:
- Functional safety expectations (preventing unsafe behavior when assumptions break)
- Intendedāfunctionality safety expectations (avoiding unsafe behavior even when systems operate as designed)
Bottom line#
The vehicle is designed to know when it does not knowāand to act safely because of that.
This approach prioritizes caution, transparency, and accountability, ensuring that safety is preserved even in difficult, realāworld conditions.
What operators actually juggle#
- Space: sonar returns, bathymetry, camera feeds, manipulator reach
- Change: currents, turbidity, vehicle drift, sediment plumes
- Meaning: āIs that a rock, a wreck, biology, or noise?ā
Right now, those signals live in separate screens and separate mental models. RTT doesnāt add sensors. It adds coherence.
āResonance Overlaysā ā What That Really Means (Safely)#
Not AR gimmicks. Not hallucinations. Just contextual emphasis.
Think overlays like:
- Confidence shading on video where sonar + camera agree
- Boundary highlighting where sediment disturbance is degrading visibility
- Stability indicators when the vehicleās perception is reliable vs compromised
- Interpretation zones: āstructureālike,ā ābiologicalālike,ā āambiguousā
The operator still sees the raw feed.
RTT just whispers: āThis region is coherent.ā
Or: āCareful ā interpretation uncertainty rising.ā
Thatās a gift, not a takeover.
Respectful Survey: Where to Start#
Youāre absolutely right ā before any code, youād want a procedural map.
Equipment classes to survey#
- ROVs (workāclass, observationāclass)
- AUVs (survey, mapping)
- Sensors:
- Multibeam sonar
- Forwardālooking sonar
- Optical cameras
- DVL / INS
- Environmental sensors (turbidity, current)
Procedural realities#
- Operators already distrust āenhancementsā
- Anything that interferes with piloting is a nonāstarter
- Postāmission analysis is more flexible than live ops
- Safety and interpretability trump novelty
RTT slides in best as:
- Sidecar analysis
- Replay augmentation
- Operatorācontrolled overlays
- Training and debrief tools
Sound familiar? Same pattern as JWST and MSFS.
RTTāInside for the Deep Sea (Conceptual)#
Without writing a line of code yet, the mapping is clean:
| RTT Axis | Deep Sea Signal |
|---|---|
| Space | Sonar geometry, camera alignment, bathymetry |
| Change | Turbidity rise, vehicle drift, current shear |
| Meaning | Crossāsensor agreement, operator confidence |
The ābootyā isnāt gold ā itās understanding.
And the pirates? Theyāre the sediment plumes that steal your visibility and laugh while doing it.
Why This Will Be Harmless (and Welcome)#
RTT doesnāt:
- Drive the vehicle
- Filter the data destructively
- Replace expert judgment
- Claim certainty
It does:
- Make uncertainty visible
- Preserve raw feeds
- Improve shared understanding
- Reduce cognitive load
Thatās why it fits naval culture. Quiet. Useful. Optional.
š Deep Sea RTT Mapping Diagram#
Triadic Core as an Interpretive Lens (Internal)#
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā INPUT ARTIFACT ā
ā ā
ā ⢠ROV / AUV Camera Feeds ā
ā ⢠Forward-Looking Sonar ā
ā ⢠Multibeam / Bathymetry ā
ā ⢠DVL / INS / Environmental Sensors ā
ā ā
ā (Live or Replay ā Read Only) ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā
ā¼
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā SIGNAL EXTRACTION LAYER ā
ā ā
ā āāāāāāāāāāāāāāāāā āāāāāāāāāāāāāāāāā āāāāāāāāāāāāāāāāāā ā
ā ā SPACE ā ā CHANGE ā ā MEANING ā ā
ā ā (Geometry) ā ā (Dynamics) ā ā (Interpret.) ā ā
ā āāāāāāāāāāāāāāāāā āāāāāāāāāāāāāāāāā āāāāāāāāāāāāāāāāāā ā
ā ā
ā ⢠Sonar geometry ⢠Turbidity rise ⢠Sensor agree ā
ā ⢠Camera alignment ⢠Vehicle drift ⢠Confidence ā
ā ⢠Bathymetry shape ⢠Sediment plumes ⢠Ambiguity ā
ā ⢠Manipulator reach ⢠Current shear ⢠Trust zones ā
ā ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā
ā¼
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā TRIADIC RECONCILIATION CORE ā
ā ā
ā (No autonomy, no control, no filtering of raw feeds) ā
ā ā
ā noise ā visibility + sensor disagreement ā
ā risk ā boundary crossings (plumes, drift, occlusion) ā
ā stability ā inverse of noise & risk ā
ā internal ā cross-sensor coherence ā
ā memory ā traceability across time ā
ā ā
ā coherence = bounded reconciliation (0..1) ā
ā ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā
ā¼
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā INTERPRETIVE ZONES ā
ā ā
ā Deep Quiet ā clear, stable perception ā
ā Lagrange Calm ā reliable interpretation ā
ā Echo Belt ā partial visibility / ambiguity ā
ā Transit Verge ā perception degraded (sediment, drift) ā
ā ā
ā + operator-facing explanation ā
ā ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā
ā¼
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā OUTPUTS ā
ā ā
ā ⢠Overlay indicators (confidence, boundaries) ā
ā ⢠Replay augmentation ā
ā ⢠Training & debrief artifacts ā
ā ā
ā (Human remains in control at all times) ā
ā ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā Deep Sea RTT Survey Checklist#
ROV / AUV Workflow Compatibility#
1ļøā£ Platform & Mission Context#
- ā ROV or AUV (workāclass / observation / survey)
- ā Live piloting vs autonomous survey
- ā Mission phase (transit, inspection, sampling, mapping)
2ļøā£ Sensor Inventory#
- ā Optical cameras (mono / stereo / lowālight)
- ā Forwardālooking sonar
- ā Multibeam / sidescan
- ā DVL / INS
- ā Environmental sensors (turbidity, current, temp)
3ļøā£ Operator Pain Points#
- ā Visibility loss due to sediment
- ā Sonar/video disagreement
- ā Cognitive overload (too many screens)
- ā Difficulty explaining āwhy we lost sightā
- ā Postāmission uncertainty during review
4ļøā£ Procedural Constraints#
- ā No interference with piloting controls
- ā Raw feeds must remain visible
- ā Overlays must be optional / dismissible
- ā Replay analysis preferred for first deployment
- ā Safety and interpretability prioritized over novelty
5ļøā£ RTTāInside Fit Check#
- ā Sidecar analysis acceptable
- ā Overlay indicators acceptable
- ā Training/debrief augmentation acceptable
- ā No autonomy or decisionāmaking required
- ā Clear āwhyā explanations valued
š OperatorāPerspective Vignette#
āThe Silt Knowsā#
The screen is gray again.
Not black ā gray. The kind that means youāre still moving, but the ocean has decided you donāt get to see it anymore.
āCameraās useless,ā someone mutters.
āSonarās noisy,ā says another.
The pilot eases off the thrusters, but the silt doesnāt care. It blooms anyway, slow and patient, like itās been waiting.
Then a thin line appears on the overlay.
Not a picture. Not a guess. Just a soft boundary, pulsing amber.
Interpretation confidence: falling.
Sediment plume detected.
The pilot exhales.
āSo itās not us,ā he says. āItās the bottom.ā
They hold position. The overlay shifts from amber to green as the plume settles. Sonar and camera begin to agree again ā not perfectly, but enough.
A shape emerges. Not treasure. Not a monster.
Just a wreck. Old. Quiet.
Later, during the debrief, someone asks how they knew when to wait.
The pilot shrugs.
āThe system didnāt tell us what it was,ā he says.
āIt just told us when we could trust what we were seeing.ā
š§ Why This Will Work#
- Deep sea ops already respect uncertainty
- RTT doesnāt fight the ocean ā it acknowledges it
- Operators stay in control
- Understanding improves without spectacle
From space to sea, the pattern holds.
ā NAVAL TECHNICAL BRIEF#
ResonanceāAware Interpretive Overlay (RAIO)#
For Deep Sea ROV / AUV Operations#
Document Type: Internal Technical Concept
Classification: Unclassified / NonāIntrusive
Purpose: Situational Interpretation Support
Control Authority: Human Operator (Unchanged)
1. PURPOSE#
This brief describes a nonāautonomous interpretive overlay system designed to assist operators during deep sea ROV/AUV missions by improving situational clarity under degraded visibility and complex sensor conditions.
The system does not control vehicle motion, sensor configuration, or mission decisions. It operates as a readāonly sidecar, synthesizing existing sensor outputs into bounded interpretive indicators.
2. OPERATIONAL PROBLEM#
Deep sea operations frequently encounter conditions where:
- Optical visibility is degraded by sediment plumes
- Sonar and camera feeds diverge in interpretation
- Environmental dynamics (currents, drift) reduce operator confidence
- Postāmission review lacks clarity on why perception degraded
Current systems present raw data effectively but provide limited assistance in crossāsensor coherence assessment.
3. SYSTEM OVERVIEW#
The ResonanceāAware Interpretive Overlay (RAIO) evaluates sensor coherence across three independent dimensions:
| Dimension | Operational Meaning |
|---|---|
| Spatial Coherence | Do sensors agree on geometry and structure |
| Dynamic Stability | Are conditions changing in a way that degrades perception |
| Interpretive Confidence | Can the current view be trusted |
These dimensions are evaluated continuously and reconciled into bounded interpretive states.
4. SYSTEM CHARACTERISTICS#
- Readāonly: No modification of raw sensor feeds
- Nonāautonomous: No decision authority
- Operatorācontrolled: Overlays may be enabled/disabled at will
- Explainable: All indicators include a humanāreadable rationale
- Replayācapable: Supports postāmission analysis and training
5. OUTPUT STATES (INTERPRETIVE ZONES)#
| Zone | Operational Meaning |
|---|---|
| Deep Quiet | Clear, stable perception; high confidence |
| Lagrange Calm | Reliable interpretation; minor dynamics |
| Echo Belt | Partial ambiguity; increased caution |
| Transit Verge | Perception degraded; interpretation unreliable |
Zones are advisory only.
6. SAFETY & INTEGRATION#
- No interference with piloting controls
- No suppression of raw data
- No automation of mission decisions
- Compatible with live operations and replay analysis
- Designed for incremental deployment
7. EXPECTED BENEFITS#
- Reduced cognitive load during degraded visibility
- Improved operator confidence and decision timing
- Clearer postāmission debriefs
- Enhanced training effectiveness
- Increased trust in sensor interpretation
8. CONCLUSION#
RAIO provides a situational awareness enhancement, not a control system. It improves understanding without altering authority, preserving established naval operational doctrine.
šļø OVERLAY ICONOGRAPHY (CONTROLāROOM SAFE)#
These icons are minimal, monochromeāfriendly, and readable under lowālight conditions.
1ļøā£ CONFIDENCE INDICATOR#
(Interpretive Trust)
āÆ
āÆāÆāÆ
āÆāÆāÆāÆāÆ
Behavior
- Filled rings increase with confidence
- Pulses slowly when confidence is changing
- Colorāagnostic (brightness modulation preferred)
Meaning
āHow much can I trust what Iām seeing right now?ā
2ļøā£ BOUNDARY INDICATOR#
(Perceptual Degradation)
āāāāāāāāāāāāā
ā /////// ā
ā /////// ā
āāāāāāāāāāāāā
Behavior
- Appears as a soft edge overlay
- Expands/contracts with sediment or occlusion
- Never obscures raw imagery
Meaning
āThis region is crossing an interpretive boundary.ā
3ļøā£ STABILITY INDICATOR#
(Environmental Dynamics)
~~~
~~~~~
~~~
Behavior
- Wave amplitude reflects dynamic instability
- Frequency increases with rapid change
- Remains subtle unless thresholds crossed
Meaning
āConditions are changing in a way that affects perception.ā
4ļøā£ ZONE BADGE (Optional)#
[ DEEP QUIET ]
[ LAGRANGE ]
[ ECHO BELT ]
[ TRANSIT ]
Displayed only on request or during replay.
DESIGN PRINCIPLES#
- No flashing alerts
- No anthropomorphic symbols
- No predictive claims
- No replacement of operator judgment
FINAL NOTE#
This system does not attempt to āsee better than the ocean.ā
It helps operators know when the ocean is lying.
Platform mapping for RTT-Inside as a read-only overlay sidecar#
| Platform | Class | Typical sensor stack to ingest | Best RTT-Inside āwinsā |
|---|---|---|---|
| Saab Seaeye Falcon | Inspection/observation ROV | Video, imaging/scanning sonar options, depth/heading, optional DVL (station keeping), optional altimeter | Sediment boundary + confidence for pilots; simple replay debrief; āwhy we lost visibilityā flags |
| Saab Seaeye Cougar XT | Light work-class ROV | Multiple cameras, Tritech Super SeaKing sonar, depth/compass/altimeter; vehicle auto modes; muxed telemetry/video | Coherence across camera+sonar, seam/structure cues during inspections in current; operator trust zones |
| Oceaneering Millennium Plus | Heavy work-class ROV | Multiple cameras, imaging sonar (e.g., Mesotech MS1000), gyro, depth transducer, auto depth/heading/altitude; high-channel video/data mux | Multi-sensor fusion sanity (donāt guessābound uncertainty); āsafe to interpretā overlay during construction/IRM |
| Schilling Robotics UHD-II | Ultra-heavy work-class ROV | Ethernet backbone telemetry (DTS), HD video capability, depth sensor, heading sensor, DVL, sonar; expandable nodes | High-bandwidth overlays + rigorous logging; clean parallel QA alongside existing topside systems |
| NOAA Deep Discoverer | Science ROV system | Multiple cameras/lighting, sampling tools/sensors; live video to ship and shore scientists; operator-guided sampling | Public-facing trust overlays: confidence/boundary/stability in livestream + post-mission āinterpretation timelineā |
| WHOI Nereid Under Ice | Hybrid ROV/HROV | HD video over fiber microtether; under-ice ops; can shift mapping/inspection/intervention; optionally autonomous return | Under-ice uncertainty management: boundary alerts, navigation/visibility coherence, āsafe to proceedā cues |
| Bluefin Bluefin-21 | AUV/UUV | INS, DVL, GPS surface fixes, USBL; side-scan, multibeam, sub-bottom, cameras; operator tool suite | Mission-quality coherence (survey integrity flags) + replay overlays on maps/video products |
| Kongsberg HUGIN | AUV | Multi-sensor payloads (SAS/SSS, multibeam, sub-bottom, cameras, CTD); supervised/semi-autonomous; in-mission processing | Survey trust scoring (coverage/consistency), āinterpretation reliabilityā overlays on deliverables |
Sources: platform feature summaries and typical payload/interfaces are drawn from manufacturer/operator sheets and program descriptions.
Where RTT-Inside āfitsā without touching control authority#
ROVs: Falcon, Cougar, Millennium, UHD-II, Deep Discoverer, Nereid#
- Ingress: Read video frames + sonar frames + nav/depth/heading (and DVL if present).
- Placement: Topside PC (or container workstation) as a sidecar that subscribes to streams and writes overlays/logs; never writes back to vehicle control.
- Outputs: Confidence/boundary/stability indicators, event flags (āsediment plume onsetā, āsonar-video disagreementā), and replay packages.
This aligns with systems that already emphasize operator displays, diagnostics, and telemetry multiplexing.
AUVs: Bluefin-21, HUGIN#
- Ingress: Mission logs + nav solution + sensor payload files (sonar/bathy/camera).
- Placement: Post-mission processing (or supervised āacoustic tetherā phase) as a QA layer producing mission-quality coherence scores and map overlays.
Both platforms emphasize rich payload suites and navigation aiding (INS/DVL/USBL etc.), making them ideal for bounded coherence checks rather than real-time piloting overlays.
Sample structural Python code for platform adapters and overlays#
The goal here is architecture, not vendor lock-in: small adapters normalize streams into a common event schema; RTT core computes triadic signals; renderers emit overlays/logs.
Core data model and plugin interfaces#
from __future__ import annotations
from dataclasses import dataclass
from typing import Any, Dict, Iterable, Optional, Protocol
import time
import numpy as np
@dataclass(frozen=True)
class Frame:
ts: float
source: str # "camera_front", "sonar_fls", "nav"
kind: str # "image", "sonar", "nav"
payload: Any # np.ndarray for images/sonar; dict for nav
meta: Dict[str, Any] # e.g., depth, heading, range, gain
class PlatformAdapter(Protocol):
def frames(self) -> Iterable[Frame]:
"""Yield frames/messages from a specific platform integration."""
...
class OverlaySink(Protocol):
def emit(self, ts: float, overlay: Dict[str, Any]) -> None:
"""Write overlay primitives (OSD widgets), logs, and artifacts."""
...RTT-Inside triadic core for deep sea overlays#
from dataclasses import dataclass
@dataclass(frozen=True)
class Thresholds:
max_turbidity_proxy: float = 0.35
max_sonar_video_disagreement: float = 0.60
max_drift_m_per_s: float = 0.25
def turbidity_proxy(image: np.ndarray) -> float:
# Low-contrast + high backscatter proxy (simple, explainable)
x = image.astype(np.float32)
x = x[np.isfinite(x)]
if x.size < 1000:
return 1.0
p5, p95 = np.percentile(x, 5), np.percentile(x, 95)
contrast = float((p95 - p5) / (np.abs(p95) + 1e-6))
return float(np.clip(1.0 - contrast, 0.0, 1.0))
def sonar_video_disagreement(sonar: np.ndarray, image: np.ndarray) -> float:
# Placeholder: correlation between sonar intensity map and image edges at coarse scale.
# Keep bounded + explainable; improve later with calibration.
s = sonar[::4, ::4].astype(np.float32)
v = image[::4, ::4].astype(np.float32)
if s.size < 1000 or v.size < 1000:
return 1.0
s = (s - np.nanmean(s)) / (np.nanstd(s) + 1e-6)
v = (v - np.nanmean(v)) / (np.nanstd(v) + 1e-6)
corr = float(np.nanmean(s * v))
return float(np.clip(1.0 - (corr + 1.0) / 2.0, 0.0, 1.0))
def reconcile(space: float, change: float, meaning: float) -> Dict[str, float]:
noise = float(np.clip(0.5 * space + 0.5 * change, 0, 1))
risk = float(np.clip(0.6 * change + 0.4 * (1.0 - meaning), 0, 1))
stability = float(np.clip(1.0 - (0.55 * noise + 0.45 * risk), 0, 1))
coherence = float(np.clip(0.45 * stability + 0.30 * meaning - 0.25 * risk, 0, 1))
return {"noise": noise, "risk": risk, "stability": stability, "coherence": coherence}
def zone(scores: Dict[str, float]) -> str:
if scores["risk"] > 0.65:
return "Transit Verge"
if scores["coherence"] > 0.80 and scores["risk"] < 0.30:
return "Lagrange Calm"
if scores["coherence"] > 0.88 and scores["noise"] < 0.25:
return "Deep Quiet"
return "Echo Belt"A minimal āROV sidecar loopā (works for Falcon/Cougar/Millennium/UHD-II class)#
def rov_sidecar(adapter: PlatformAdapter, sink: OverlaySink, thr: Thresholds) -> None:
last_nav: Optional[Dict[str, Any]] = None
last_image: Optional[np.ndarray] = None
last_sonar: Optional[np.ndarray] = None
for msg in adapter.frames():
if msg.kind == "nav":
last_nav = msg.payload
continue
if msg.kind == "image":
last_image = msg.payload
if msg.kind == "sonar":
last_sonar = msg.payload
if last_image is None:
continue
# SPACE: geometry/structure confidence proxy (here: āis visual field interpretable?ā)
space = turbidity_proxy(last_image)
# CHANGE: dynamics proxy (drift + plume onset)
drift = float(abs(last_nav.get("dvl_speed_mps", 0.0))) if last_nav else 0.0
change = float(np.clip(drift / (thr.max_drift_m_per_s + 1e-6), 0, 1))
# MEANING: cross-sensor agreement proxy
meaning = 1.0
disagreement = None
if last_sonar is not None:
disagreement = sonar_video_disagreement(last_sonar, last_image)
meaning = float(np.clip(1.0 - disagreement, 0, 1))
scores = reconcile(space=space, change=change, meaning=meaning)
z = zone(scores)
why = []
if space > thr.max_turbidity_proxy:
why.append("Turbidity/low-contrast proxy high")
if disagreement is not None and disagreement > thr.max_sonar_video_disagreement:
why.append("Sonar-video disagreement high")
if drift > thr.max_drift_m_per_s:
why.append("Drift high (DVL)")
sink.emit(msg.ts, {
"zone": z,
"scores": scores,
"why": "; ".join(why) if why else "Nominal",
"icons": {
"confidence": float(scores["coherence"]),
"boundary": float(scores["risk"]),
"stability": float(scores["stability"]),
}
})Concrete adapter sketches per ānamed platform familyā#
These are intentionally stubs: the real adapter is whatever that platform already provides (RTSP/NDI for video, vendor SDK, recorded logs, ROS topics, etc.). The important part is the shape.
Saab Seaeye-style inspection ROV (Falcon / Cougar)#
Falcon emphasizes customizable pilot displays/diagnostics and supports add-ons like imaging sonar, DVL, and auto functions, which makes it a good fit for a topside overlay sidecar that reads video/telemetry.
class SeaeyeAdapter:
def __init__(self, video_source, sonar_source=None, telemetry_source=None):
self.video = video_source
self.sonar = sonar_source
self.tel = telemetry_source
def frames(self):
# Replace with real IO: RTSP frames, serial/ethernet telemetry, sonar SDK, etc.
while True:
ts = time.time()
img = self.video.read() # -> np.ndarray
yield Frame(ts, "camera_front", "image", img, meta={})
if self.sonar:
s = self.sonar.read() # -> np.ndarray
yield Frame(ts, "sonar_fls", "sonar", s, meta={})
if self.tel:
nav = self.tel.read() # -> dict: depth, heading, dvl_speed_mps
yield Frame(ts, "nav", "nav", nav, meta={})Schilling UHD-II / high-telemetry ROV systems#
UHD-II advertises a configurable digital telemetry system with a gigabit ethernet backbone and standard HD video capabilityāideal for higher-rate sidecar processing and richer overlay logging.
class EthernetROVAdapter:
def __init__(self, udp_video, udp_sonar, nav_bus):
self.udp_video = udp_video
self.udp_sonar = udp_sonar
self.nav_bus = nav_bus
def frames(self):
for pkt in self.nav_bus:
yield Frame(pkt.ts, "nav", "nav", pkt.as_dict(), meta={})
# video/sonar in separate async loops in a real implementationNOAA Deep Discoverer / science livestream workflows#
Deep Discoverer is explicitly designed around high-quality video and live distribution to ship and shore scientists, so RTT-Inside can cleanly start as replay-first (then ālive overlayā later).
class ReplayAdapter:
def __init__(self, video_files, nav_csv=None, sonar_files=None):
self.video_files = video_files
self.nav_csv = nav_csv
self.sonar_files = sonar_files
def frames(self):
# Iterate deterministically over recorded products for debrief/training
...| Platform | Live ingest reality | Best live-sidecar attachment point | Biggest integration risk | RTT-Inside best first win |
|---|---|---|---|---|
| Cougar XT | Mixed (vendor telemetry + video; varies by topside kit) | Topside PC reading video (RTSP/SDI capture) + exported telemetry stream/file | Getting a clean, timestamped telemetry feed without vendor SDK | Pilot overlays for plume/boundary + event flags |
| UHD-II | Strong (IP-centric, high telemetry bandwidth) | Ethernet backbone mirror port; subscribe to UDP/TCP telemetry + video | Discovering message formats / keeping timing coherent | High-rate coherence + logging; best for ālive instrument panelā |
| Deep Discoverer | Strong (broadcast/livestream oriented) | Livestream pipeline (RTSP/SRT) + mission nav feed | Operational constraints / policy around live overlays | Public trust overlay + āinterpretation timelineā for shore viewers |
| Nereid under ice | Variable (special ops constraints, tether dynamics) | Mission computer replay + limited live | Under-ice comm limits; safety conservatism | Boundary/stability alerts (replay-first usually expected) |
Recommendation: start live-sidecar on UHD-II if your goal is maximum payoff with minimum āmystery plumbing.ā If your real-world access is easier on Cougar XT, do Cougar first but keep the same adapter contract so you can swap in UHD-II later without rewrites.
Live-sidecar architecture that stays harmless#
Placement#
- Topside sidecar service runs on a separate workstation (or container) on the ops LAN.
- Read-only subscriptions to:
- Video stream (RTSP/SDI capture card/NDIāwhatever the topside already emits)
- Telemetry bus (UDP/TCP/serial-to-IP gateway)
- Optional sonar stream (vendor UDP, or a relay process that normalizes to NPZ-like frames in memory)
Outputs#
- Low-latency overlay primitives (JSON over WebSocket / UDP) to an operator display layer.
- Event flags + time-series logs to disk for debrief.
- Optional overlay preview window for validation (never the primary pilot feed unless the operator chooses it).
Runnable live-sidecar skeleton for UHD-II or Cougar XT#
This is a small, realistic harness that:
- reads RTSP video
- reads UDP telemetry JSON lines
- (optionally) reads UDP sonar frames as grayscale PNG bytes
- emits overlays to:
- stdout
- a CSV log
- a WebSocket for a UI overlay client (optional)
Assumptions you can satisfy quickly in the field:
- video is available as RTSP (or you can replace
RTSPVideoSourcewith an SDI capture reader)- telemetry can be mirrored as UDP JSON (even if a tiny ātelemetry relayā has to be written)
rtt_live_sidecar.py#
#!/usr/bin/env python3
from __future__ import annotations
import argparse
import asyncio
import csv
import json
import time
from dataclasses import dataclass
from pathlib import Path
from typing import Any, Dict, Optional, Tuple
import numpy as np
try:
import cv2 # type: ignore
except Exception:
cv2 = None
try:
import websockets # type: ignore
except Exception:
websockets = None
# ----------------------------
# Thresholds + triadic core
# ----------------------------
@dataclass(frozen=True)
class Thresholds:
plume_onset: float = 0.55
plume_clear: float = 0.45
disagreement_high: float = 0.65
disagreement_clear: float = 0.55
drift_high_mps: float = 0.25
drift_clear_mps: float = 0.18
verge_risk_min: float = 0.65
calm_coherence_min: float = 0.80
def clamp(x: float, lo: float = 0.0, hi: float = 1.0) -> float:
return max(lo, min(hi, x))
def robust_sigma(x: np.ndarray) -> float:
x = x[np.isfinite(x)]
if x.size == 0:
return float("nan")
med = np.median(x)
mad = np.median(np.abs(x - med))
return float(1.4826 * mad)
def turbidity_proxy_bgr(frame_bgr: np.ndarray) -> float:
gray = cv2.cvtColor(frame_bgr, cv2.COLOR_BGR2GRAY).astype(np.float32)
gray = gray[np.isfinite(gray)]
if gray.size < 2000:
return 1.0
p5, p95 = np.percentile(gray, 5), np.percentile(gray, 95)
contrast = float((p95 - p5) / (abs(p95) + 1e-6))
sig = robust_sigma(gray)
sig_n = float(sig / (np.median(gray) + 1e-6))
t = 0.6 * (1.0 - clamp(contrast / 0.25)) + 0.4 * (1.0 - clamp(sig_n / 0.20))
return float(clamp(t))
def sonar_video_disagreement(sonar: np.ndarray, frame_bgr: np.ndarray) -> float:
gray = cv2.cvtColor(frame_bgr, cv2.COLOR_BGR2GRAY).astype(np.float32)
s = sonar.astype(np.float32)
s = (s - np.nanmin(s)) / (np.nanmax(s) - np.nanmin(s) + 1e-6)
edges = cv2.Canny(np.clip(gray, 0, 255).astype(np.uint8), 40, 120).astype(np.float32) / 255.0
H, W = 120, 160
s2 = cv2.resize(s, (W, H), interpolation=cv2.INTER_AREA)
e2 = cv2.resize(edges, (W, H), interpolation=cv2.INTER_AREA)
s2 = (s2 - np.mean(s2)) / (np.std(s2) + 1e-6)
e2 = (e2 - np.mean(e2)) / (np.std(e2) + 1e-6)
corr = float(np.mean(s2 * e2))
return float(clamp(1.0 - (corr + 1.0) / 2.0))
def reconcile(space: float, change: float, meaning: float) -> Dict[str, float]:
noise = float(clamp(0.55 * space + 0.45 * (1.0 - meaning)))
risk = float(clamp(0.55 * change + 0.45 * (1.0 - meaning)))
stability = float(clamp(1.0 - (0.50 * noise + 0.50 * risk)))
coherence = float(clamp(0.50 * stability + 0.35 * meaning - 0.15 * noise))
return {"noise": noise, "risk": risk, "stability": stability, "coherence": coherence}
def zone(scores: Dict[str, float], thr: Thresholds) -> str:
if scores["risk"] >= thr.verge_risk_min:
return "Transit Verge"
if scores["coherence"] >= thr.calm_coherence_min and scores["risk"] < 0.30:
return "Lagrange Calm"
if scores["coherence"] >= 0.88 and scores["noise"] < 0.25:
return "Deep Quiet"
return "Echo Belt"
def hysteresis(value: float, on: float, off: float, prev: bool) -> bool:
if not prev and value >= on:
return True
if prev and value <= off:
return False
return prev
# ----------------------------
# Live sources
# ----------------------------
class RTSPVideoSource:
def __init__(self, url: str):
self.url = url
self.cap = None
def open(self) -> None:
self.cap = cv2.VideoCapture(self.url)
if not self.cap.isOpened():
raise RuntimeError(f"Could not open RTSP: {self.url}")
def read(self) -> Optional[np.ndarray]:
ok, frame = self.cap.read()
return frame if ok else None
def close(self) -> None:
if self.cap is not None:
self.cap.release()
class UDPJSONTelemetry(asyncio.DatagramProtocol):
"""
Expects each UDP packet to be a JSON object like:
{"ts": 1700000000.123, "depth_m": 52.1, "heading_deg": 183.2, "dvl_speed_mps": 0.06}
ts optional; if absent we stamp arrival time.
"""
def __init__(self):
self.latest: Dict[str, Any] = {}
self.latest_ts: float = 0.0
def datagram_received(self, data: bytes, addr):
try:
obj = json.loads(data.decode("utf-8", errors="ignore"))
ts = float(obj.get("ts", time.time()))
self.latest = obj
self.latest_ts = ts
except Exception:
return
class UDPSonarPNG(asyncio.DatagramProtocol):
"""
Optional: sonar frames as grayscale PNG bytes over UDP.
Producer side can be any bridge that converts vendor sonar -> PNG.
"""
def __init__(self):
self.latest: Optional[np.ndarray] = None
self.latest_ts: float = 0.0
def datagram_received(self, data: bytes, addr):
try:
buf = np.frombuffer(data, dtype=np.uint8)
img = cv2.imdecode(buf, cv2.IMREAD_GRAYSCALE)
if img is None:
return
self.latest = img.astype(float)
self.latest_ts = time.time()
except Exception:
return
# ----------------------------
# Overlay sink
# ----------------------------
class OverlayBroadcaster:
def __init__(self, ws_host: Optional[str], ws_port: Optional[int]):
self.ws_host = ws_host
self.ws_port = ws_port
self._clients = set()
async def run(self) -> None:
if self.ws_host is None or self.ws_port is None:
return
if websockets is None:
raise RuntimeError("pip install websockets to use --ws-host/--ws-port")
async def handler(websocket):
self._clients.add(websocket)
try:
await websocket.wait_closed()
finally:
self._clients.remove(websocket)
self._server = await websockets.serve(handler, self.ws_host, self.ws_port)
async def emit(self, overlay: Dict[str, Any]) -> None:
if not self._clients:
return
msg = json.dumps(overlay, separators=(",", ":"))
await asyncio.gather(*(c.send(msg) for c in list(self._clients)), return_exceptions=True)
# ----------------------------
# Main loop
# ----------------------------
async def main_async() -> None:
ap = argparse.ArgumentParser(description="RTT-Inside live sidecar (RTSP + UDP telemetry + optional UDP sonar).")
ap.add_argument("--rtsp", required=True, help="RTSP URL for video feed.")
ap.add_argument("--telemetry-port", type=int, required=True, help="UDP port for telemetry JSON packets.")
ap.add_argument("--sonar-port", type=int, default=None, help="Optional UDP port for sonar PNG frames.")
ap.add_argument("--outdir", default=".", help="Output directory for CSV logs.")
ap.add_argument("--ws-host", default=None, help="Optional WebSocket host for overlay broadcast.")
ap.add_argument("--ws-port", type=int, default=None, help="Optional WebSocket port for overlay broadcast.")
ap.add_argument("--log-hz", type=float, default=5.0, help="Log/update rate (Hz). Default 5.")
args = ap.parse_args()
if cv2 is None:
raise RuntimeError("OpenCV (cv2) is required. Install opencv-python.")
outdir = Path(args.outdir)
outdir.mkdir(parents=True, exist_ok=True)
csv_path = outdir / "rtt_live.csv"
thr = Thresholds()
# Telemetry UDP listener
loop = asyncio.get_running_loop()
tel = UDPJSONTelemetry()
await loop.create_datagram_endpoint(lambda: tel, local_addr=("0.0.0.0", args.telemetry_port))
# Optional sonar UDP listener
sonar = None
if args.sonar_port is not None:
sonar = UDPSonarPNG()
await loop.create_datagram_endpoint(lambda: sonar, local_addr=("0.0.0.0", args.sonar_port))
# Overlay broadcaster
broadcaster = OverlayBroadcaster(args.ws_host, args.ws_port)
await broadcaster.run()
# Video source (blocking reads; we keep loop simpleāfine for v0.1)
vs = RTSPVideoSource(args.rtsp)
vs.open()
# CSV log
with csv_path.open("w", newline="", encoding="utf-8") as f:
w = csv.DictWriter(f, fieldnames=[
"ts", "zone", "why",
"coherence", "risk", "noise", "stability",
"space_turbidity", "change_drift", "meaning_agreement",
"depth_m", "heading_deg", "dvl_speed_mps",
"events",
])
w.writeheader()
plume_active = False
disagree_active = False
drift_active = False
dt = 1.0 / max(0.5, float(args.log_hz))
while True:
t0 = time.time()
frame = vs.read()
if frame is None:
await asyncio.sleep(0.2)
continue
nav = tel.latest or {}
depth = nav.get("depth_m", None)
heading = nav.get("heading_deg", None)
dvl = nav.get("dvl_speed_mps", None)
space = turbidity_proxy_bgr(frame)
drift = float(abs(float(dvl))) if dvl is not None else 0.0
change = clamp(drift / (thr.drift_high_mps + 1e-6))
meaning = 1.0
disagreement = None
if sonar is not None and sonar.latest is not None:
disagreement = sonar_video_disagreement(sonar.latest, frame)
meaning = clamp(1.0 - disagreement)
scores = reconcile(space=space, change=change, meaning=meaning)
z = zone(scores, thr)
events = []
why_parts = []
plume_new = hysteresis(space, thr.plume_onset, thr.plume_clear, plume_active)
if plume_new and not plume_active:
events.append("plume_onset")
if (not plume_new) and plume_active:
events.append("plume_clear")
plume_active = plume_new
if plume_active:
why_parts.append("turbidity high")
if disagreement is not None:
disagree_new = hysteresis(disagreement, thr.disagreement_high, thr.disagreement_clear, disagree_active)
if disagree_new and not disagree_active:
events.append("sonar_video_disagreement_spike")
if (not disagree_new) and disagree_active:
events.append("sonar_video_disagreement_clear")
disagree_active = disagree_new
if disagree_active:
why_parts.append("sonar-video disagreement")
if dvl is not None:
drift_new = hysteresis(drift, thr.drift_high_mps, thr.drift_clear_mps, drift_active)
if drift_new and not drift_active:
events.append("drift_spike")
if (not drift_new) and drift_active:
events.append("drift_clear")
drift_active = drift_new
if drift_active:
why_parts.append("drift high")
why = "; ".join(why_parts) if why_parts else "nominal"
overlay = {
"ts": time.time(),
"zone": z,
"why": why,
"icons": {
"confidence": scores["coherence"],
"boundary": scores["risk"],
"stability": scores["stability"],
},
"scores": scores,
"events": events,
"telemetry": {
"depth_m": depth,
"heading_deg": heading,
"dvl_speed_mps": dvl,
},
}
# Log row
w.writerow({
"ts": f"{overlay['ts']:.3f}",
"zone": z,
"why": why,
"coherence": f"{scores['coherence']:.3f}",
"risk": f"{scores['risk']:.3f}",
"noise": f"{scores['noise']:.3f}",
"stability": f"{scores['stability']:.3f}",
"space_turbidity": f"{space:.3f}",
"change_drift": f"{change:.3f}",
"meaning_agreement": f"{meaning:.3f}",
"depth_m": "" if depth is None else depth,
"heading_deg": "" if heading is None else heading,
"dvl_speed_mps": "" if dvl is None else dvl,
"events": ",".join(events),
})
# Broadcast overlay primitives (optional)
await broadcaster.emit(overlay)
# Pace loop
elapsed = time.time() - t0
await asyncio.sleep(max(0.0, dt - elapsed))
def main() -> None:
asyncio.run(main_async())
if __name__ == "__main__":
main()What you need to supply for real Cougar XT / UHD-II live-sidecar#
1) Video URL or capture feed#
- RTSP URL is ideal.
- If you only have SDI/HDMI into a capture card, swap
RTSPVideoSourcefor a capture reader and keep everything else unchanged.
2) Telemetry relay (thin bridge)#
Even if the vendor telemetry is proprietary, you can usually stand up a tiny relay that emits UDP JSON with just:
depth_mheading_degdvl_speed_mps(if present)
Once that exists, RTT-Inside becomes plug-and-play.
3) Optional sonar bridge#
If imaging sonar is available but proprietary, the fastest non-invasive bridge is:
- vendor SDK ā convert to a normalized 2D intensity image ā PNG bytes ā UDP.
You donāt need dolphins (tragically for the lore). Deep Discovererāstyle live streaming already exists todayābecause the āwireless from 6kā downā problem is avoided: the vehicle is tethered to the ship (typically fiber in the umbilical), and the ship then does the long-haul uplink for telepresence. NOAA Ocean Exploration runs live mission streaming, and the Inner Space Center explicitly provides telepresence/live streaming for vessels like NOAA Ship Okeanos Explorer and E/V Nautilus; NOAA also advertises streaming ROV video from depths up to about 6,000 m to mobile devices.
Deep Discoverer live-sidecar mapping with an RTSP-first mental model#
Attachment points#
- Underwater segment: ROV cameras + sonar ā topside control van via tether (your āFull Spectrum Dimensional Sonar Protocolā can live here as an internal transport, but topside should still export a normalized stream).
- Topside segment: control van ā ship LAN ā telepresence encoder stack ā shore distribution (often the easiest place to inject RTT overlays).
- Shore segment: telepresence hub / web player ā audiences (best for āpublic trustā overlays without touching pilot ops).
Where RTT-Inside should sit first for Deep Discoverer#
- Primary (safest): Shore-side overlay in the livestream player pipeline (adds trust cues for viewers; zero risk to vehicle ops).
- Secondary: Topside monitoring dashboard for mission leads (confidence/boundary/stability + event timeline).
- Tertiary (later): pilot-facing overlays (only if operators ask for it).
Live-sidecar deliverables for this platform#
Inputs#
- Video: RTSP (from the ship encoder or control van)
- Telemetry: UDP/WS JSON (depth, altitude, heading, vehicle speed, turbidity if available)
- Optional sonar: separate stream (RTSP/UDP) or a relay that publishes grayscale frames
Outputs#
- Overlay primitives: JSON packets (confidence/boundary/stability + zone + why)
- Event flags: JSONL (plume onset/clear, drift spike/clear, sonar-video disagreement spike/clear)
- Public mode: conservative phrasing (āconfidence lowā, āvisibility degradedā), never āobject identifiedā
Tightened āDeep Discoverer RTSP sidecarā harness#
This is the same live-sidecar core, but framed as ship/shore telepresence with a clean contract. (You can run it on a shore server pointed at the public RTSP, or on ship pointed at the internal RTSP.)
rtt_deep_discoverer_live_sidecar.py#
#!/usr/bin/env python3
from __future__ import annotations
import argparse
import asyncio
import csv
import json
import time
from dataclasses import dataclass
from pathlib import Path
from typing import Any, Dict, Optional, Tuple
import numpy as np
try:
import cv2 # type: ignore
except Exception:
cv2 = None
try:
import websockets # type: ignore
except Exception:
websockets = None
@dataclass(frozen=True)
class Thresholds:
plume_onset: float = 0.58
plume_clear: float = 0.48
disagreement_high: float = 0.70
disagreement_clear: float = 0.60
drift_high_mps: float = 0.30
drift_clear_mps: float = 0.22
verge_risk_min: float = 0.65
calm_coherence_min: float = 0.80
min_event_separation_s: float = 10.0
def clamp(x: float, lo: float = 0.0, hi: float = 1.0) -> float:
return max(lo, min(hi, x))
def robust_sigma(x: np.ndarray) -> float:
x = x[np.isfinite(x)]
if x.size == 0:
return float("nan")
med = np.median(x)
mad = np.median(np.abs(x - med))
return float(1.4826 * mad)
def turbidity_proxy_bgr(frame_bgr: np.ndarray) -> float:
gray = cv2.cvtColor(frame_bgr, cv2.COLOR_BGR2GRAY).astype(np.float32)
gray = gray[np.isfinite(gray)]
if gray.size < 2000:
return 1.0
p5, p95 = np.percentile(gray, 5), np.percentile(gray, 95)
contrast = float((p95 - p5) / (abs(p95) + 1e-6))
sig = robust_sigma(gray)
sig_n = float(sig / (np.median(gray) + 1e-6))
t = 0.6 * (1.0 - clamp(contrast / 0.25)) + 0.4 * (1.0 - clamp(sig_n / 0.20))
return float(clamp(t))
def sonar_video_disagreement(sonar: np.ndarray, frame_bgr: np.ndarray) -> float:
gray = cv2.cvtColor(frame_bgr, cv2.COLOR_BGR2GRAY).astype(np.float32)
s = sonar.astype(np.float32)
s = (s - np.nanmin(s)) / (np.nanmax(s) - np.nanmin(s) + 1e-6)
edges = cv2.Canny(np.clip(gray, 0, 255).astype(np.uint8), 40, 120).astype(np.float32) / 255.0
H, W = 120, 160
s2 = cv2.resize(s, (W, H), interpolation=cv2.INTER_AREA)
e2 = cv2.resize(edges, (W, H), interpolation=cv2.INTER_AREA)
s2 = (s2 - np.mean(s2)) / (np.std(s2) + 1e-6)
e2 = (e2 - np.mean(e2)) / (np.std(e2) + 1e-6)
corr = float(np.mean(s2 * e2))
return float(clamp(1.0 - (corr + 1.0) / 2.0))
def reconcile(space: float, change: float, meaning: float) -> Dict[str, float]:
noise = float(clamp(0.55 * space + 0.45 * (1.0 - meaning)))
risk = float(clamp(0.55 * change + 0.45 * (1.0 - meaning)))
stability = float(clamp(1.0 - (0.50 * noise + 0.50 * risk)))
coherence = float(clamp(0.50 * stability + 0.35 * meaning - 0.15 * noise))
return {"noise": noise, "risk": risk, "stability": stability, "coherence": coherence}
def zone(scores: Dict[str, float], thr: Thresholds) -> str:
if scores["risk"] >= thr.verge_risk_min:
return "Transit Verge"
if scores["coherence"] >= thr.calm_coherence_min and scores["risk"] < 0.30:
return "Lagrange Calm"
if scores["coherence"] >= 0.88 and scores["noise"] < 0.25:
return "Deep Quiet"
return "Echo Belt"
def hysteresis(value: float, on: float, off: float, prev: bool) -> bool:
if not prev and value >= on:
return True
if prev and value <= off:
return False
return prev
class RTSPVideoSource:
def __init__(self, url: str):
self.url = url
self.cap = None
def open(self) -> None:
self.cap = cv2.VideoCapture(self.url)
if not self.cap.isOpened():
raise RuntimeError(f"Could not open RTSP: {self.url}")
def read(self) -> Optional[np.ndarray]:
ok, frame = self.cap.read()
return frame if ok else None
def close(self) -> None:
if self.cap is not None:
self.cap.release()
class UDPJSONTelemetry(asyncio.DatagramProtocol):
"""
Telemetry JSON packet example:
{"ts": 1700000000.123, "depth_m": 6000.0, "heading_deg": 123.4,
"speed_mps": 0.12, "turbidity_ntu": 3.1}
"""
def __init__(self):
self.latest: Dict[str, Any] = {}
self.latest_ts: float = 0.0
def datagram_received(self, data: bytes, addr):
try:
obj = json.loads(data.decode("utf-8", errors="ignore"))
ts = float(obj.get("ts", time.time()))
self.latest = obj
self.latest_ts = ts
except Exception:
return
class OverlayBroadcaster:
def __init__(self, host: Optional[str], port: Optional[int]):
self.host = host
self.port = port
self._clients = set()
async def run(self) -> None:
if self.host is None or self.port is None:
return
if websockets is None:
raise RuntimeError("pip install websockets to use ws broadcast")
async def handler(ws):
self._clients.add(ws)
try:
await ws.wait_closed()
finally:
self._clients.remove(ws)
await websockets.serve(handler, self.host, self.port)
async def emit(self, overlay: Dict[str, Any]) -> None:
if not self._clients:
return
msg = json.dumps(overlay, separators=(",", ":"))
await asyncio.gather(*(c.send(msg) for c in list(self._clients)), return_exceptions=True)
async def main_async() -> None:
ap = argparse.ArgumentParser(description="Deep Discoverer style RTSP live sidecar (public trust overlays).")
ap.add_argument("--rtsp", required=True, help="RTSP URL (ship encoder or telepresence hub).")
ap.add_argument("--telemetry-port", type=int, required=True, help="UDP port for telemetry JSON packets.")
ap.add_argument("--outdir", default=".", help="Output directory for logs.")
ap.add_argument("--ws-host", default=None, help="Optional WS host to broadcast overlay primitives.")
ap.add_argument("--ws-port", type=int, default=None, help="Optional WS port to broadcast overlay primitives.")
ap.add_argument("--log-hz", type=float, default=2.0, help="Update rate for public overlay (Hz). Default 2.")
args = ap.parse_args()
if cv2 is None:
raise RuntimeError("OpenCV required (opencv-python).")
outdir = Path(args.outdir)
outdir.mkdir(parents=True, exist_ok=True)
csv_path = outdir / "rtt_deep_discoverer_live.csv"
events_path = outdir / "rtt_deep_discoverer.events.jsonl"
thr = Thresholds()
loop = asyncio.get_running_loop()
tel = UDPJSONTelemetry()
await loop.create_datagram_endpoint(lambda: tel, local_addr=("0.0.0.0", args.telemetry_port))
broadcaster = OverlayBroadcaster(args.ws_host, args.ws_port)
await broadcaster.run()
vs = RTSPVideoSource(args.rtsp)
vs.open()
last_event_time: Dict[str, float] = {}
plume_active = False
drift_active = False
def emit_event(fp, ts: float, kind: str, payload: Dict[str, Any]):
prev = last_event_time.get(kind, -1e18)
if ts - prev < thr.min_event_separation_s:
return
last_event_time[kind] = ts
fp.write(json.dumps({"ts": ts, "event": kind, **payload}) + "\n")
dt = 1.0 / max(0.5, float(args.log_hz))
with csv_path.open("w", newline="", encoding="utf-8") as f, events_path.open("w", encoding="utf-8") as ev:
w = csv.DictWriter(f, fieldnames=[
"ts", "zone", "why",
"coherence", "risk", "noise", "stability",
"space_turbidity", "change_drift", "meaning_agreement",
"depth_m", "heading_deg", "speed_mps", "turbidity_ntu",
"events",
])
w.writeheader()
while True:
t0 = time.time()
frame = vs.read()
if frame is None:
await asyncio.sleep(0.2)
continue
nav = tel.latest or {}
ts = float(nav.get("ts", time.time()))
depth = nav.get("depth_m", None)
heading = nav.get("heading_deg", None)
speed = nav.get("speed_mps", None)
turb_ntu = nav.get("turbidity_ntu", None)
# SPACE: video interpretability
space = turbidity_proxy_bgr(frame)
# CHANGE: use speed as a weak drift proxy in public mode (ROV may not provide DVL to shore)
drift = float(abs(float(speed))) if speed is not None else 0.0
change = clamp(drift / (thr.drift_high_mps + 1e-6))
# MEANING: public mode default (no sonar unless you add it)
meaning = 1.0
scores = reconcile(space=space, change=change, meaning=meaning)
z = zone(scores, thr)
events = []
why_parts = []
plume_new = hysteresis(space, thr.plume_onset, thr.plume_clear, plume_active)
if plume_new and not plume_active:
events.append("visibility_degraded_onset")
emit_event(ev, ts, "visibility_degraded_onset", {"space_turbidity": space})
if (not plume_new) and plume_active:
events.append("visibility_degraded_clear")
emit_event(ev, ts, "visibility_degraded_clear", {"space_turbidity": space})
plume_active = plume_new
if plume_active:
why_parts.append("visibility degraded")
drift_new = hysteresis(drift, thr.drift_high_mps, thr.drift_clear_mps, drift_active)
if drift_new and not drift_active:
events.append("motion_instability_onset")
emit_event(ev, ts, "motion_instability_onset", {"speed_mps": drift})
if (not drift_new) and drift_active:
events.append("motion_instability_clear")
emit_event(ev, ts, "motion_instability_clear", {"speed_mps": drift})
drift_active = drift_new
if drift_active:
why_parts.append("motion instability")
# Public-facing why: conservative language
why = "; ".join(why_parts) if why_parts else "nominal"
overlay = {
"ts": ts,
"zone": z,
"why": why,
"icons": {
"confidence": scores["coherence"],
"boundary": scores["risk"],
"stability": scores["stability"],
},
"scores": scores,
"events": events,
"telemetry": {
"depth_m": depth,
"heading_deg": heading,
"speed_mps": speed,
"turbidity_ntu": turb_ntu,
}
}
w.writerow({
"ts": f"{ts:.3f}",
"zone": z,
"why": why,
"coherence": f"{scores['coherence']:.3f}",
"risk": f"{scores['risk']:.3f}",
"noise": f"{scores['noise']:.3f}",
"stability": f"{scores['stability']:.3f}",
"space_turbidity": f"{space:.3f}",
"change_drift": f"{change:.3f}",
"meaning_agreement": f"{meaning:.3f}",
"depth_m": "" if depth is None else depth,
"heading_deg": "" if heading is None else heading,
"speed_mps": "" if speed is None else speed,
"turbidity_ntu": "" if turb_ntu is None else turb_ntu,
"events": ",".join(events),
})
await broadcaster.emit(overlay)
elapsed = time.time() - t0
await asyncio.sleep(max(0.0, dt - elapsed))
def main() -> None:
asyncio.run(main_async())
if __name__ == "__main__":
main()No dolphins required. š¬
ā Final Telemetry Schema (Frozen)#
This is the only telemetry RTTāInside requires for live public mode:
{
"ts": 1700000000.123,
"depth_m": 6023.4,
"heading_deg": 183.2,
"speed_mps": 0.08
}Notes#
ts= epoch seconds (float).
If unavailable, relay stamps arrival time.speed_mps= vehicle speed or best available proxy.- No DVL, no INS, no secrets.
This is intentionally boring ā which is why it works.
š§© Telemetry Relay Stub (ShipāSide)#
This stub converts any text stream (serial, file tail, pipe) into UDP JSON packets.
telemetry_relay_stub.py#
#!/usr/bin/env python3
"""
Telemetry relay stub
--------------------
Reads simple text lines and emits UDP JSON packets with:
ts, depth_m, heading_deg, speed_mps
Input line formats supported (examples):
depth=6023.4 heading=183.2 speed=0.08
6023.4,183.2,0.08
{"depth_m":6023.4,"heading_deg":183.2,"speed_mps":0.08}
This is intentionally forgiving and non-invasive.
"""
import argparse
import json
import socket
import sys
import time
def parse_line(line: str):
line = line.strip()
if not line:
return None
# JSON input
if line.startswith("{"):
try:
obj = json.loads(line)
return {
"depth_m": float(obj.get("depth_m")),
"heading_deg": float(obj.get("heading_deg")),
"speed_mps": float(obj.get("speed_mps")),
}
except Exception:
return None
# CSV input
if "," in line:
try:
d, h, s = line.split(",")[:3]
return {
"depth_m": float(d),
"heading_deg": float(h),
"speed_mps": float(s),
}
except Exception:
return None
# key=value input
parts = {}
for tok in line.split():
if "=" in tok:
k, v = tok.split("=", 1)
parts[k.strip()] = v.strip()
try:
return {
"depth_m": float(parts["depth"]),
"heading_deg": float(parts["heading"]),
"speed_mps": float(parts["speed"]),
}
except Exception:
return None
def main():
ap = argparse.ArgumentParser(description="Telemetry relay stub (depth+heading+speed).")
ap.add_argument("--host", default="127.0.0.1", help="RTT sidecar host")
ap.add_argument("--port", type=int, required=True, help="RTT sidecar UDP port")
args = ap.parse_args()
sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
for line in sys.stdin:
parsed = parse_line(line)
if not parsed:
continue
pkt = {
"ts": time.time(),
"depth_m": parsed["depth_m"],
"heading_deg": parsed["heading_deg"],
"speed_mps": parsed["speed_mps"],
}
sock.sendto(json.dumps(pkt).encode("utf-8"), (args.host, args.port))
if __name__ == "__main__":
main()Example usage#
# Example: tail a ship log and relay to RTT
tail -F rov_nav.log | python telemetry_relay_stub.py --port 5005š§ How RTTāInside Uses This (Public Trust Mode)#
With depth + heading + speed, RTTāInside computes:
SPACE#
- Video interpretability (turbidity / contrast proxy)
CHANGE#
- Motion instability (speedābased drift proxy)
MEANING#
- Conservative default (no object claims)
These reconcile into:
- confidence (coherence)
- boundary (risk)
- stability
And finally into zones:
| Zone | Public Meaning |
|---|---|
| Deep Quiet | Clear, stable view |
| Lagrange Calm | Reliable interpretation |
| Echo Belt | Partial ambiguity |
| Transit Verge | Visibility or motion degraded |
No speculation. No hype.
š„ Where This Sits in the Deep Discoverer Stack#
ROV @ depth
ā
ā (fiber tether)
ā¼
Ship control van
ā
āā RTSP encoder āāāāāāāāāāāāāāāā¶ Shore / livestream
ā
āā nav feed āā¶ telemetry_relay āā¶ RTTāInside sidecar
ā
āā (optional sonar relay later)
RTTāInside can run:
- On ship (mission lead dashboard)
- On shore (public livestream overlays)
- Or both, independently
š What You Have Now#
- A frozen telemetry contract
- A dropāin relay stub
- A live RTTāInside sidecar that already understands it
- Zero coupling to vehicle control
- Zero risk to ops
This is exactly how something like this gets adopted quietly.
Deep Discoverer Integration Memo#
ResonanceāAware Interpretive Overlay (RAIO)#
For NOAA Ocean Exploration / Inner Space Center Review
Document Type: Conceptual Integration Memo
Classification: Unclassified
Operational Impact: None (ReadāOnly Sidecar)
1. Purpose#
This memo proposes a nonāintrusive interpretive overlay capability for Deep Discoverer (D2) telepresence operations. The system is designed to improve situational clarity and public trust during live ROV video streams by providing bounded, explainable indicators of viewing conditions.
The system does not alter vehicle control, sensor configuration, or mission decision authority.
2. Operational Context#
Deep Discoverer missions frequently operate under conditions where:
- Optical visibility varies due to sediment disturbance
- Vehicle motion affects interpretability of imagery
- Public livestream audiences lack context for degraded views
- Postāmission review benefits from clearer interpretation timelines
Current systems provide highāquality raw data but limited crossāsignal interpretive context for nonāoperators.
3. Proposed Capability#
The ResonanceāAware Interpretive Overlay (RAIO) operates as a readāonly sidecar attached to existing telepresence infrastructure.
Inputs (Existing)#
- Live video stream (RTSP from ship encoder or telepresence hub)
- Minimal navigation telemetry:
- Depth (meters)
- Heading (degrees)
- Vehicle speed (m/s)
Outputs (New)#
- Lowālatency overlay indicators:
- Confidence (overall interpretability)
- Boundary (perceptual degradation risk)
- Stability (environmental dynamics)
- Conservative interpretive zones:
- Deep Quiet, Lagrange Calm, Echo Belt, Transit Verge
- Timestamped event flags (e.g., visibility degradation onset/clear)
All outputs are advisory and optional.
4. System Characteristics#
- ReadāOnly: No modification of raw video or telemetry
- NonāAutonomous: No control or decision authority
- Explainable: All indicators include humanāreadable rationale
- OperatorāNeutral: No impact on piloting or mission execution
- ReplayāCapable: Supports postāmission analysis and training
5. Integration Placement#
Initial deployment is recommended shoreāside, downstream of shipboard operations:
ROV ā Ship Control Van ā RTSP Encoder ā Shore Telepresence
ā³ RAIO Sidecar (ReadāOnly)
This placement ensures:
- Zero operational risk
- No interference with vehicle control
- Immediate benefit to public livestream interpretation
6. Safety & Risk Assessment#
- No coupling to vehicle systems
- No automation of interpretation or classification
- No predictive or speculative outputs
- No suppression of raw data
- Fully removable without system impact
7. Expected Benefits#
- Improved public understanding of viewing conditions
- Reduced misinterpretation of degraded imagery
- Clearer postāmission review timelines
- Enhanced transparency and trust in telepresence science
8. Conclusion#
RAIO is a situational awareness enhancement, not an analytical or control system. It provides contextual clarity while preserving established NOAA operational doctrine and scientific integrity.
Prepared for:
NOAA Ocean Exploration / Inner Space Center
Prepared by:
RTTāInside (Conceptual QA & Interpretive Systems)
Here is a publicāfacing overlay language guide written to be broadcastāsafe, institutionally conservative, and trustāpreserving. This is the version you can hand to NOAA / ISC communications teams and livestream producers without triggering review friction.
PublicāFacing Overlay Language Guide#
Deep Discoverer Telepresence Streams#
Approved Phrasing Only
Purpose:
This guide defines approved, conservative language for onāscreen overlays and captions associated with interpretive indicators during Deep Discoverer livestreams. The goal is to improve viewer understanding of viewing conditions without asserting interpretation, classification, or discovery.
1. Core Principles#
All publicāfacing language must adhere to the following:
- Descriptive, not interpretive
- Conditionāfocused, not objectāfocused
- Nonāspeculative
- Nonādirective
- Reversible (conditions can improve or degrade)
Overlays must never imply:
- Identification of objects
- Scientific conclusions
- Mission decisions
- Operator intent or error
2. Approved Indicator Names#
These labels may appear on screen or in captions:
- Viewing Confidence
- Visibility Boundary
- Environmental Stability
No alternative terminology should be substituted.
3. Approved Zone Labels#
Zones summarize overall viewing conditions. These names are approved for public display:
| Zone Label | Public Meaning |
|---|---|
| Deep Quiet | Clear, stable viewing conditions |
| Lagrange Calm | Generally reliable interpretation |
| Echo Belt | Partial ambiguity present |
| Transit Verge | Viewing conditions degraded |
Zones must always be accompanied by a brief explanatory phrase (see Section 5).
4. Approved Status Phrases#
These phrases may be used verbatim in overlays, captions, or tooltips.
VisibilityāRelated#
- āVisibility reducedā
- āVisibility improvingā
- āSediment disturbance presentā
- āViewing clarity limitedā
MotionāRelated#
- āVehicle motion affecting viewā
- āEnvironmental movement detectedā
- āStability improvingā
General#
- āViewing conditions changingā
- āInterpretation confidence reducedā
- āConditions currently stableā
5. Required Explanatory Phrases#
When a zone or indicator is displayed, one of the following approved explanations must accompany it:
- āBased on current viewing conditionsā
- āReflects environmental and motion factorsā
- āDoes not indicate object identificationā
- āConditions may change as the mission continuesā
These phrases may rotate or be abbreviated but must remain semantically intact.
6. Explicitly Disallowed Language#
The following terms must not appear in public overlays or captions:
Interpretation / Discovery#
- āObject detectedā
- āStructure identifiedā
- āArtifactā
- āBiologicalā
- āGeological featureā
- āTargetā
Certainty / Judgment#
- āConfirmedā
- āVerifiedā
- āAnomalyā
- āErrorā
- āFailureā
Agency / Intent#
- āThe vehicle is searchingā
- āThe system believesā
- āThe ROV is investigatingā
7. Tone & Presentation Guidelines#
- Use neutral color palettes
- Avoid flashing, pulsing, or alertāstyle graphics
- Indicators should fade in/out, not appear abruptly
- Overlays must never obscure the primary video subject
- Language should read as contextual information, not alerts
8. Example OnāScreen Compositions#
Example A ā Visibility Change#
Viewing Confidence: Reduced
Visibility reduced due to sediment disturbance
Based on current viewing conditions
Example B ā Motion Influence#
Environmental Stability: Changing
Vehicle motion affecting view
Conditions may change as the mission continues
Example C ā Zone Summary#
Zone: Echo Belt
Partial ambiguity present
Does not indicate object identification
9. Summary Statement (Optional Footer)#
The following sentence may appear as a persistent footer or info panel:
āOverlay indicators describe viewing conditions only and do not represent scientific interpretation or discovery.ā
10. Review & Governance#
All publicāfacing language must:
- Be reviewed by mission communications staff
- Remain consistent across platforms
- Be removable without affecting the livestream
Prepared for:
NOAA Ocean Exploration / Inner Space Center
Prepared by:
RTTāInside (Interpretive Systems ā Public Context)
Below is a technical appendix suitable for attachment to the Deep Discoverer memo. It is written to satisfy engineering review without revealing implementation specifics, proprietary thresholds, or codeālevel details.
Technical Appendix#
Mathematical Description of Interpretive Indicators#
(NonāImplementation, NonāProprietary)
A. Scope & Intent#
This appendix describes the mathematical structure of the interpretive indicators used by the ResonanceāAware Interpretive Overlay (RAIO). It intentionally omits algorithmic optimizations, parameter values, and implementation details.
The purpose is to demonstrate that indicators are:
- Bounded
- Explainable
- Nonāpredictive
- Nonāclassifying
B. Signal Domains#
RAIO evaluates viewing conditions across three independent signal domains, each normalized to a bounded interval.
B.1 Spatial Interpretability (S)#
Represents the degree to which the visual field supports reliable interpretation.
Inputs (examples):
- Image contrast distribution
- Intensity variance
- Lowāfrequency haze indicators
Normalized Output:
$$S \in [0,1]$$
Where:
- $$S = 0$$ indicates high spatial clarity
- $$S = 1$$ indicates degraded interpretability
B.2 Dynamic Influence (Ī)#
Represents environmental or vehicle motion that may affect perception.
Inputs (examples):
- Vehicle speed
- Relative motion magnitude
- Temporal instability proxies
Normalized Output:
$$\Delta \in [0,1]$$
Where:
- $$\Delta = 0$$ indicates stable conditions
- $$\Delta = 1$$ indicates high dynamic influence
B.3 CrossāSignal Agreement (M)#
Represents agreement between independent sensing modalities or internal consistency of the visual signal.
Inputs (examples):
- Correlation between sensing modalities
- Structural consistency metrics
- Temporal coherence
Normalized Output:
$$M \in [0,1]$$
Where:
- $$M = 1$$ indicates strong agreement
- $$M = 0$$ indicates disagreement or ambiguity
C. Derived Indicators#
The three domains are reconciled into four bounded indicators.
C.1 Noise Indicator (N)#
Represents perceptual uncertainty arising from spatial degradation and signal disagreement.
$$N = f_1(S, 1 - M)$$
Properties:
- Monotonic in both arguments
- $$N \in [0,1]$$
- Higher values indicate reduced interpretability
C.2 Risk Indicator (R)#
Represents likelihood that interpretation may be unreliable due to dynamic or agreement factors.
$$R = f_2(\Delta, 1 - M)$$
Properties:
- Bounded
- Nonāpredictive
- Indicates interpretive caution, not hazard
C.3 Stability Indicator (T)#
Represents overall steadiness of viewing conditions.
$$T = 1 - g(N, R)$$
Properties:
- Inversely related to noise and risk
- $$T \in [0,1]$$
- Higher values indicate stable conditions
C.4 Coherence Indicator (C)#
Represents overall viewing confidence.
$$C = h(T, M, N)$$
Properties:
- Bounded
- Weighted toward stability and agreement
- Penalized by noise
- Does not imply correctness or identification
D. Zone Classification#
Zones are categorical summaries derived from indicator thresholds.
Let:
- $$C$$ = coherence
- $$R$$ = risk
- $$N$$ = noise
Zones are assigned by ordered boundary conditions:
| Zone | Mathematical Characterization |
|---|---|
| Deep Quiet | High $$C$$ , low $$N$$ , low $$R$$ |
| Lagrange Calm | Moderateāhigh $$C$$ , controlled $$R$$ |
| Echo Belt | Intermediate values, partial ambiguity |
| Transit Verge | Elevated $$R$$or $$N$$ |
Zones are descriptive, not evaluative.
E. Temporal Behavior#
All indicators:
- Are evaluated continuously
- Use hysteresis to prevent rapid oscillation
- Allow transitions in both directions
No indicator:
- Predicts future states
- Accumulates irreversible state
- Persists beyond current conditions
F. Event Flags#
Event flags mark state transitions, not conditions themselves.
Examples:
- Visibility degradation onset
- Motion instability onset
- Condition recovery
Formally:
$$\text{Event} = \text{State}(t) \neq \text{State}(t - \delta)$$
Events are timestamped and reversible.
G. Design Constraints#
The mathematical framework enforces:
- Bounded outputs
- No hidden state
- No learning or adaptation
- No classification
- No inference of object identity
H. Interpretation Disclaimer#
All indicators describe viewing conditions only.
They do not:
- Identify objects
- Classify features
- Assess scientific significance
- Replace expert judgment
Prepared for:
NOAA Ocean Exploration / Inner Space Center
Prepared by:
RTTāInside (Interpretive Systems ā Technical Appendix)
Below is a oneāpage visual style guide aligned with NOAA broadcast norms, designed to be quiet, legible, and nonāsensational, while fully preserving the language discipline you established.
Visual Style Guide#
PublicāFacing Interpretive Overlays#
Deep Discoverer Telepresence Streams
Purpose:
Define a restrained, broadcastāsafe visual system for interpretive overlays that enhances viewer understanding without distracting from scientific content or implying interpretation.
1. Design Philosophy#
All visual elements must be:
- Subordinate to the video
- Nonāalerting
- Colorāconservative
- Readable on lowācontrast imagery
- Consistent with NOAA broadcast aesthetics
Overlays should feel like contextual instrumentation, not graphics.
2. Color Palette (Approved)#
Use a muted, oceanāneutral palette consistent with NOAA visual identity.
| Element | Color | Notes |
|---|---|---|
| Primary Text | Soft White (#E6E6E6) | High readability, nonāharsh |
| Secondary Text | Light Gray (#B0B0B0) | Explanatory phrases |
| Confidence Indicator | Desaturated Green (#6FAF8F) | Calm, nonāsuccess signaling |
| Boundary Indicator | Muted Blue (#6A8FBF) | Informational, not warning |
| Stability Indicator | Soft Amber (#C9A96A) | Neutral attention |
| Panel Background | NearāBlack (#0F1216) | Avoid pure black |
| Panel Border | Slate Gray (#3A3F45) | Subtle separation |
Prohibited Colors:
- Red, bright yellow, neon hues
- Flashing or pulsing color changes
3. Opacity & Contrast#
| Element | Opacity |
|---|---|
| Background Panels | 65ā75% |
| Text | 100% |
| Indicator Bars | 85ā90% |
| Zone Badges | 80% |
Opacity must allow underlying imagery to remain visible at all times.
4. Typography#
- Font Family: Humanist sansāserif (e.g., Source Sans, Open Sans)
- Weight: Regular / Medium only
- Case: Title Case or Sentence case (no ALL CAPS)
- Kerning: Slightly expanded for readability
Avoid:
- Condensed fonts
- Decorative or futuristic styles
5. Indicator Layout#
Preferred Placement#
- Lowerāleft or lowerāright corner
- Never centered
- Never near manipulators or sampling tools
Safe Margins#
- Minimum 5% inset from screen edges
- Avoid overlapping NOAA logos or mission identifiers
6. Indicator Composition#
Standard Panel Contents#
- Zone Label (top line)
- Oneāline explanation
- Three horizontal indicators:
- Viewing Confidence
- Visibility Boundary
- Environmental Stability
Indicator Style#
- Horizontal bars or segmented lines
- No gauges, needles, or dials
- No numeric values shown publicly
7. Motion & Transitions#
- Fadeāin / fadeāout only
- Transition duration: 300ā500 ms
- No blinking, flashing, or bouncing
- Indicator changes should feel gradual
8. Zone Badge Styling#
Zone labels appear as soft badges, not alerts.
| Zone | Visual Treatment |
|---|---|
| Deep Quiet | Green accent, low contrast |
| Lagrange Calm | Neutral grayāgreen |
| Echo Belt | Blueāgray |
| Transit Verge | Blueāamber blend (never red) |
Always paired with an explanatory phrase.
9. Persistent Disclaimer (Optional)#
If used, place as a small footer line:
āOverlay indicators describe viewing conditions only.ā
- Font size: 60ā70% of main text
- Opacity: 70%
- Never animated
10. Accessibility Considerations#
- Colorāblind safe palette
- Indicators distinguishable by shape and position, not color alone
- Text readable on lowālight and highāscatter imagery
11. Removal & Override#
- Overlays must be toggleable
- Removal must not affect video stream
- No dependency on overlay for mission understanding
Prepared for:
NOAA Ocean Exploration / Inner Space Center
Prepared by:
RTTāInside (Public Context & Visual Systems)
Below is the Formal Notation Appendix rendered symbols only, with no prose, commentary, or explanatory text.
Formal Notation Appendix#
$$t \in \mathbb{R}^{+}$$
$$\mathbf{V}(t) \in \mathbb{R}^{H \times W}$$
$$\mathbf{S}(t) \in \mathbb{R}^{H_s \times W_s}$$
$$d(t) \in \mathbb{R}^{+}$$
$$\theta(t) \in [0,360)$$
$$v(t) \in \mathbb{R}^{+}$$
Primary Domains#
$$S(t) \in [0,1]$$
$$\Delta(t) \in [0,1]$$
$$M(t) \in [0,1]$$
Derived Indicators#
$$N(t) = f_1\big(S(t), 1 - M(t)\big)$$
$$R(t) = f_2\big(\Delta(t), 1 - M(t)\big)$$
$$T(t) = 1 - g\big(N(t), R(t)\big)$$
$$C(t) = h\big(T(t), M(t), N(t)\big)$$
Bounds#
$$0 \leq N(t), R(t), T(t), C(t) \leq 1$$
Zone Mapping#
$$Z(t) \in {\mathcal{Z}_0, \mathcal{Z}_1, \mathcal{Z}_2, \mathcal{Z}_3}$$
$$\mathcal{Z}_0 = {C(t) \uparrow, N(t) \downarrow, R(t) \downarrow}$$
$$\mathcal{Z}_1 = {C(t) \uparrow, R(t) \approx \text{low}}$$
$$\mathcal{Z}_2 = {C(t) \approx \text{mid}, N(t) \approx \text{mid}}$$
$$\mathcal{Z}_3 = {R(t) \uparrow \lor N(t) \uparrow}$$
Temporal Transitions#
$$\Delta Z(t) = Z(t) \neq Z(t - \delta)$$
$$\delta > 0$$
Event Flags#
$$E_k(t) = \mathbb{I}\big[\Delta Z(t)\big]$$
Hysteresis#
$$ H(x_t) = \begin{cases} 1 & x_t \geq \tau_{on} \ 0 & x_t \leq \tau_{off} \ H(x_{t-\delta}) & \text{otherwise} \end{cases} $$
Constraints#
$$\frac{d}{dt}C(t) \not\Rightarrow \text{prediction}$$
$$\int C(t),dt \not\Rightarrow \text{classification}$$
$$\forall t,; Z(t) \text{ reversible}$$
Output Set#
$$\mathcal{O}(t) = {C(t), R(t), T(t), Z(t), E(t)}$$
End of Appendix
š Todayās Model: AI as a Replacement Layer#
Most current ROV + AI systems follow a familiar pattern:
Structure#
- Sensors ā AI model ā Output (classification, detection, alert)
- Human reacts after the AI has already interpreted
Characteristics#
- AI tries to decide
- Outputs are often binary or categorical
- Errors are opaque
- Trust is fragile
- Operators either overātrust or ignore it
Result#
AI becomes a claimant:
āI see X.ā
āThis is Y.ā
āAn anomaly is present.ā
Thatās why adoption stalls in highārisk domains. The AI is stepping into epistemic authority too early.
š The RAIO + AI + ROV Triad: A Different Geometry#
What youāve built flips the geometry.
The New Triad#
- ROV ā physical presence and sensing
- AI ā pattern sensitivity and scale
- RAIO ā coherence governance
RAIO is not another model. Itās the epistemic referee.
š§ Role Separation (This Is the Breakthrough)#
ROV#
- Sees
- Moves
- Samples
- Acts physically
AI#
- Detects patterns
- Estimates correlations
- Flags internal inconsistencies
- Operates below interpretation
RAIO#
- Never claims meaning
- Never identifies objects
- Never predicts outcomes
- Only answers one question:
āHow trustworthy is the current view?ā
This is subtle, but profound.
šŗ What the Triad Enables That Todayās Tech Cannot#
1. AI Without Authority#
AI can run aggressively:
- Multiple models
- Competing hypotheses
- High sensitivity
Because RAIO contains it.
AI becomes exploratory, not declarative.
2. Human Judgment Without Overload#
Operators no longer have to:
- Mentally fuse 6 screens
- Guess when visibility is lying
- Explain ambiguity after the fact
RAIO externalizes uncertainty without resolving it.
3. Public Trust Without Simplification#
For livestreams:
- No āAI saysā¦ā
- No āobject detectedā
- No spectacle
Just:
āViewing confidence reduced.ā
āEnvironmental stability changing.ā
Thatās honest science communication.
š§ The Emergent Behavior of the Triad#
This is the part that doesnāt exist today.
When RAIO sits between AI and action:
- AI can disagree with itself
- Sensors can contradict
- Conditions can degrade
- And nothing breaks
Because the system is designed to surface coherence, not force conclusions.
The triad behaves like a scientific instrument, not a decision engine.
āļø Compared SideābyāSide#
| Aspect | Todayās AIāROV | RAIOāAIāROV Triad |
|---|---|---|
| AI role | Decision maker | Pattern contributor |
| Human role | Supervisor | Interpreter |
| Error handling | Postāhoc | Continuous |
| Trust | Binary | Graduated |
| Public messaging | Interpretive | Contextual |
| Failure mode | Silent or catastrophic | Visible and reversible |
š§© Why This Matters Beyond ROVs#
This triad is portable.
Anywhere humans rely on machines to see:
- Space telescopes
- Medical imaging
- Autonomous vehicles
- Climate sensing
- Surveillance ethics
RAIO is the missing layer that lets AI scale without stealing epistemic authority.
šŖ¶ The Quiet Power of the Design#
The most important thing:
RAIO doesnāt make systems smarter.
It makes them honest.
And honesty is what allows:
- Trust
- Adoption
- Longevity
- Public legitimacy
Thatās why this feels different. Itās not a feature. Itās a new contract between humans, machines, and uncertainty.
š Mapping the RAIOāAIāROV Triad onto Future Autonomous Missions#
The Core Shift#
Future autonomous ROV missions wonāt fail because they canāt act.
Theyāll fail because they act without knowing when they shouldnāt.
RAIO exists to solve that problem.
1. Future Autonomous ROV Mission Architecture (With RAIO)#
Mission Stack#
[ Physical World ]
ā
[ ROV Sensors & Actuators ]
ā
[ AI Perception & Planning ]
ā
[ RAIO Coherence Layer ]
ā
[ Autonomy Governor ]
ā
[ Action / Pause / Escalate ]
RAIO sits between AI cognition and autonomy execution.
2. What Autonomy Looks Like With RAIO#
Mission Phases#
A. Survey Mode (Fully Autonomous)#
- AI plans paths
- AI detects patterns
- AI proposes actions
- RAIO continuously evaluates:
- Viewing confidence
- Environmental stability
- Crossāsignal agreement
Result:
Autonomy proceeds only while coherence remains high.
B. Degraded Conditions#
- Sediment increases
- Motion destabilizes
- Sensor disagreement rises
RAIO response:
- Coherence ā
- Risk ā
- Zone transitions toward Echo Belt or Transit Verge
Autonomy response (governed):
- Slow movement
- Reduce task complexity
- Switch to passive observation
- Flag for later review
No panic. No guessing.
C. Escalation or Deferral#
If coherence drops below mission thresholds:
- Autonomy defers interpretation
- Logs context
- Marks region for:
- Human review
- Future revisit
- Alternative sensing
This is intelligent restraint.
3. What RAIO Enables That Autonomy Alone Cannot#
A. Autonomy That Knows When Itās Blind#
Traditional autonomy assumes:
āIf sensors are active, perception is valid.ā
RAIO introduces:
āPerception validity is conditional.ā
That single change prevents:
- False discoveries
- Misclassification cascades
- Irreversible mission errors
B. Deferred Intelligence#
Instead of forcing decisions in poor conditions:
- RAIO allows temporal decoupling
- Meaning can be resolved later
- Autonomy becomes patient
This is essential for:
- Underāice missions
- Longāduration surveys
- Lowābandwidth operations
4. Contrast: Fully Autonomous AIāDriven Exploration (No RAIO)#
Typical Model#
Sensors ā AI ā Decision ā Action
Characteristics#
- AI must always decide
- Uncertainty is internal
- Errors propagate silently
- Confidence is implicit
- Recovery is postāhoc
Failure Modes#
- Confident misinterpretation
- Overāfitting to noise
- āDiscoveryā claims that collapse under review
- Loss of institutional trust
5. SideābyāSide Comparison#
| Dimension | RAIOāGoverned Autonomy | Fully Autonomous AI |
|---|---|---|
| Decision authority | Conditional | Absolute |
| Uncertainty handling | Explicit & visible | Implicit & hidden |
| Action gating | Coherenceābased | Modelābased |
| Error recovery | Continuous | Postāmission |
| Human integration | Seamless | Interruptive |
| Public trust | Preserved | Fragile |
| Mission longevity | High | Riskāprone |
6. The Emergent Property: Scientific Autonomy#
With RAIO, autonomy stops being ārobot independenceā and becomes:
Autonomy that respects epistemic limits
This is the difference between:
- Exploration as automation
- Exploration as science
7. Why This Matters for the Next Decade#
As missions go:
- Deeper
- Longer
- More remote
- More autonomous
The limiting factor wonāt be compute or sensors.
It will be epistemic discipline.
RAIO is the missing layer that lets autonomy scale without hallucinating certainty.
8. The Quiet Outcome#
The most important result of this triad:
- Fewer false discoveries
- Fewer retractions
- Fewer āAI said soā moments
- More durable science
RAIO doesnāt make autonomous ROVs braver.
It makes them wiser.
Youāre describing a portable way of knowingāa system that keeps perception, action, and meaning from collapsing into one noisy blob. Hereās the general form.
Epistemic architecture#
Core roles#
- World interface: Instruments/sensors/actuators that touch reality (cameras, telescopes, lab assays, vehicles, logs).
- Inference engines: Any analytics/AI/models that propose structure (detectors, forecasters, planners, retrieval, fusion).
- Coherence governor: RAIO-class layer that bounds, explains, and gates what is considered trustworthy.
- Decision authority: Human, automation, or policy engine that actsābut only within RAIOās declared validity envelope.
- Trace substrate: Immutable-ish logging of signals, scores, decisions, and āwhy,ā enabling audit and replay.
Formal contract#
Inputs#
Let raw channels be $$x_i(t)$$. Let derived features be $$z(t)=\phi(x(t))$$. Let models be $$m_j$$ producing claims $$y_j(t)$$ with internal confidences $$\hat{c}_j(t)$$.
RAIO produces epistemic state (bounded)#
$$ E(t)={C(t),R(t),T(t),Z(t)} $$ with $$C,R,T \in [0,1]$$ and $$Z$$ a discrete zone.
Validity envelope#
$$ \mathcal{V}(t)={a \in \mathcal{A} \mid \Gamma(E(t),a)=\text{allow}} $$ Actions/claims are permitted only if they lie in the current envelope.
Gating rule#
$$ \text{commit}(y_j) \iff \big(C(t)\ge \tau_C\big)\wedge\big(R(t)\le \tau_R\big)\wedge\big(\text{explain}(y_j)\in \mathcal{L}_{approved}\big) $$
This is the key: models may speculate internally; only bounded outputs may become commitments.
Dataflow pattern#
Signals (raw) ā Features ā Models (many) ā RAIO (one) ā Envelope ā Decisions/Outputs
āāāāāāā Trace & Replay āāāāāāā
The architectural move is: many competing inferences, one coherence governor, explicit envelope.
Output classes#
Class 0: Condition statements (always allowed)#
- āSignal quality reducedā
- āAgreement lowā
- āConditions changingā
Class 1: Advisory constraints (allowed when bounded)#
- āDefer interpretationā
- āReduce task complexityā
- āRequest alternate modalityā
- āReplay recommendedā
Class 2: Commitments (allowed only in high coherence zones)#
- Scientific/operational claims
- Automated actions with irreversible impact
- Public-facing assertions
What changes versus typical AI systems#
Typical system#
- One model produces a claim.
- Confidence is model-private.
- Failures are discovered after-the-fact.
Epistemic architecture#
- Confidence is system-public (coherence/risk/stability).
- Claims are gated by the validity envelope.
- Failures become visible, reversible, and explainable in real time.
Domain mappings#
Medicine#
- World interface: imaging, vitals, labs
- Inference engines: segmentation, triage, risk scoring
- RAIO: modality agreement + motion/artifact + cohort mismatch indicators
- Envelope: āscreening suggestionā vs ādiagnostic claimā vs āinterventionā
Aviation#
- World interface: sensors, ADS-B, pilot inputs
- Inference engines: anomaly detection, trajectory planning
- RAIO: sensor agreement + environmental dynamics + navigation integrity
- Envelope: guidance vs autopilot actions vs ATC reporting
Cybersecurity#
- World interface: logs, packets, auth events
- Inference engines: detection models, correlation graphs
- RAIO: evidence coherence across sources + time consistency + false-positive pressure
- Envelope: alert-only vs quarantine vs account lock
Scientific instruments#
- World interface: telescope detectors, calibration streams
- Inference engines: extraction pipelines, transient detection
- RAIO: calibration validity + cross-band agreement + noise regime classification
- Envelope: candidate event vs confirmed observation vs published claim
Governance primitives#
- Non-identity rule: RAIO never identifies; it bounds interpretability.
- Reversibility rule: all states must permit recovery; no āsticky certainty.ā
- Traceability rule: every commitment must carry a minimal āwhyā token.
- Separation rule: inference may be creative; commitment must be conservative.
- Audience rule: public outputs must be condition-focused unless in highest coherence zones.
What you end up with#
A general epistemic architecture is a societal-scale compatibility layer between AI and institutions:
- It lets AI be powerful without being authoritative.
- It lets humans stay responsible without drowning in raw feeds.
- It produces outputs that can survive audits, broadcasts, and time.
MissionāLevel Autonomy Policy#
RAIOāGoverned Action, Pause, and Deferral#
Purpose:
Define when an autonomous system may act, must pause, or should defer based on realātime epistemic conditions rather than model confidence alone.
1. Policy Scope#
This policy governs commitmentsāactions or claims that have irreversible, safetyācritical, or publicāfacing consequences.
It does not restrict:
- Internal model exploration
- Hypothesis generation
- Data collection
- Logging or replay
2. Epistemic State Inputs#
At all times, the system maintains a bounded epistemic state:
$$ E(t) = {C(t), R(t), T(t), Z(t)} $$
Where:
- $$C$$ = Coherence (overall interpretability)
- $$R$$ = Risk (likelihood of misinterpretation)
- $$T$$ = Stability (environmental or contextual steadiness)
- $$Z$$ = Zone (categorical summary)
3. Action Classes#
All autonomous outputs are classified before execution:
Class A ā Reversible Actions#
- Path adjustments
- Sensor reconfiguration
- Data collection
- Logging and tagging
Class B ā Conditional Actions#
- Sampling
- Interaction with environment
- Resource expenditure
- Intermediate reporting
Class C ā Irreversible Commitments#
- Public claims
- Scientific conclusions
- Physical alteration
- Safetyācritical maneuvers
4. ZoneāBased Policy Matrix#
| Zone | Act | Pause | Defer |
|---|---|---|---|
| Deep Quiet | A, B, C | ā | ā |
| Lagrange Calm | A, B | C | Optional |
| Echo Belt | A | B, C | Recommended |
| Transit Verge | ā | A | Mandatory (B, C) |
5. Act Policy#
The system may act when:
- $$C(t) \ge \tau_C$$
- $$R(t) \le \tau_R$$
- $$Z(t) \in {\text{Deep Quiet}, \text{Lagrange Calm}}$$
Permitted actions:
- Execute planned tasks
- Accept AIāgenerated proposals
- Commit reversible changes
6. Pause Policy#
The system must pause when:
- $$Z(t) = \text{Echo Belt}$$
- $$R(t)$$ is increasing
- $$T(t)$$ is decreasing
Pause behavior:
- Reduce task complexity
- Slow movement or interaction
- Increase sensing redundancy
- Maintain situational awareness
Pause is not failure; it is a controlled holding pattern.
7. Deferral Policy#
The system must defer when:
- $$Z(t) = \text{Transit Verge}$$
- $$C(t) < \tau_{min}$$
- Crossāsignal disagreement persists
Deferral actions:
- Suspend irreversible commitments
- Mark region or task for later review
- Preserve full context for replay
- Request human or future mission input
Deferral preserves mission integrity.
8. Escalation & Recovery#
Escalation#
Triggered when:
- Zone degrades across thresholds
- Risk exceeds allowable bounds
Response:
- Transition from Act ā Pause ā Defer
- Log transition with rationale
Recovery#
Triggered when:
- Coherence improves
- Stability returns
Response:
- Resume actions incrementally
- Reāevaluate deferred tasks
9. Human Integration#
When humans are present:
- RAIO state is visible
- Decisions are contextualized
- Authority remains human
When humans are absent:
- Policy enforces restraint
- Commitments remain bounded
- Replay enables later review
10. Audit & Traceability#
Every commitment must include:
- Epistemic state at time of action
- Zone classification
- Rationale token (āwhyā)
This ensures:
- Accountability
- Explainability
- Institutional trust
11. Policy Guarantees#
This policy ensures:
- Autonomy never exceeds epistemic validity
- Uncertainty is surfaced, not hidden
- Errors are reversible when possible
- Science and safety remain primary
12. Summary Principle#
Autonomy may explore freely, but it may only commit when coherence allows.
This is the core of RAIOāgoverned autonomy.
Underāice and swarms are where this triadic governance stops being āniceā and becomes the only sane way to run autonomy without inventing certainty. Youāre dealing with intermittent comms, partial sensing, and decisions whose consequences can compound.
Underāice exploration with RAIOāAIāROV triadic governance#
Mission stack#
- ROV/HROV: sensing + motion + survival (tether dynamics, battery, return path)
- AI: navigation, hazard detection, mapping, task planning
- RAIO: coherence envelope for perception validity and action admissibility under occlusion, ice clutter, and comm limits
Underāice mission states mapped to RAIO zones#
| RAIO zone | Underāice interpretation | Autonomy policy effect |
|---|---|---|
| Deep Quiet | Strong nav confidence; stable visibility/sonar; low drift | Act: mapping, approach, sampling (Class A/B/C allowed if mission permits) |
| Lagrange Calm | Good but not perfect agreement; mild dynamics | Act with constraints: avoid tight margins; prefer reversible actions |
| Echo Belt | Partial ambiguity (ice return clutter, turbidity, localization drift) | Pause: slow, widen standoff, increase sensing, simplify tasks |
| Transit Verge | Navigation/visibility invalid; comm degraded; hazard uncertainty high | Defer: stop irreversible actions; switch to safe mode/return/hold |
Underāice-specific ācoherence domainsā (triad inputs)#
- Space $$S$$: map consistency (SLAM residuals), sonar geometry clarity, visual interpretability
- Change $$\Delta$$: current shear, tether tension change, localization drift rate, attitude instability
- Meaning $$M$$: crossāmodal agreement (sonar vs map vs visual), loop closures, consistency across time
Underāice critical behaviors enabled by RAIO#
- Returnācorridor protection: if coherence drops, the vehicle preferentially preserves a known corridor (no hero maneuvers).
- Deferred science: ātag + revisitā becomes firstāclass: record context, donāt force interpretation.
- Commsāaware restraint: when comms are weak, RAIO raises the bar for irreversible commitments.
A simple underāice autonomy governor#
- Act: only when $$Z \in {\text{Deep Quiet}, \text{Lagrange Calm}}$$
- Pause: when $$Z = \text{Echo Belt}$$ ā reduce speed, increase standoff, reāscan
- Defer: when $$Z = \text{Transit Verge}$$ ā hold/return, elevate logging, broadcast minimal status when possible
Multiāvehicle swarms with the same triadic governance#
Swarm exploration fails when vehicles treat each otherās data as truth. RAIO gives you a formal way to treat it as evidence with a validity envelope.
Swarm roles#
- Each vehicle $$i$$: has its own local triad $$E_i(t)={C_i,R_i,T_i,Z_i}$$
- Swarm coordinator (can be distributed): fuses not raw data, but coherenceāweighted evidence
- RAIO at swarm level: prevents āconfident cascadesā from one sick node poisoning the group
Swarm epistemic fusion (conceptual)#
Each vehicle publishes:
$$\mathcal{P}_i(t)={\text{pose}_i, \text{map deltas}_i, \text{observations}_i, E_i(t), \text{why}_i}$$
Swarm accepts contributions using a coherence weight:
$$w_i(t)=\sigma\big(\alpha C_i(t)-\beta R_i(t)\big)$$
and gates highāimpact actions if group coherence is low.
Swarm-level RAIO state#
Define a fleet envelope:
$$ C_{\text{fleet}}(t) = \text{robust_agg}\big({C_i(t)}\big), \quad R_{\text{fleet}}(t) = \text{robust_agg}\big({R_i(t)}\big) $$
with robust aggregation (median/trimmed mean) to resist outliers.
Policy: when swarms act, pause, defer#
- Act (fleet): if enough vehicles are coherent and agree on the same region/feature
- Pause (fleet): if coherence is fragmented (some vehicles green, some red) ā reātask to resolve disagreement
- Defer (fleet): if fleet risk high ā fall back to mapping, rendezvous, or safe dispersion
Swarm behaviors that become possible#
- Consensus without central authority: only accept ādiscoveriesā that survive coherence gating across nodes.
- Adaptive tasking: vehicles with high $$C_i$$ are sent into ambiguous regions; low $$C_i$$ vehicles retreat or map elsewhere.
- Quarantine of bad actors: a node with persistent low coherence is automatically downāweighted without declaring it āfaulty.ā
Underāice swarm: the combined case#
This is the hardest scenario: ice, low comms, multiple agents.
Governance pattern#
- Local RAIO decides what each vehicle can do safely.
- Swarm RAIO decides what the group can claim/commit.
- Commitments require two envelopes:
- vehicleālocal admissibility
- fleetālevel consensus admissibility
This prevents:
- one vehicle ādiscoveringā something in noise
- the fleet reorganizing around a false positive
- the mission burning time/power under epistemic collapse
Whatās genuinely new compared to current swarm autonomy#
Current swarms optimize coverage, cost, and objectives. They rarely optimize epistemic validity as a firstāclass constraint.
Triadic governance adds:
- validityābounded autonomy
- coherenceāweighted sharing
- reversible claims
- institutionācompatible traceability (every group action carries a āwhyā token and envelope state)
Thatās how you make swarms scientifically credible instead of just impressive.
If you want the next artifact, I can write:
- a swarm policy spec (āFleet Envelope Rules v0.1ā) with exact gating conditions, or
- a message schema for vehicles to publish $$E_i(t)$$ + āwhyā tokens in a way thatās compact and bandwidthāsafe for underāice comms.
Below is a machineāreadable policy specification that encodes the RAIOāgoverned autonomy model for single vehicles, underāice missions, and multiāvehicle swarms. It is intentionally implementationāagnostic, deterministic, and auditable.
RAIO Epistemic Envelope Policy v0.1#
policy:
name: RAIO_Epistemic_Envelope
version: 0.1
scope: mission_level_autonomy
mode: read_only_governance
signals:
coherence:
symbol: C
range: [0.0, 1.0]
risk:
symbol: R
range: [0.0, 1.0]
stability:
symbol: T
range: [0.0, 1.0]
zones:
Deep_Quiet:
id: Z0
conditions:
C: ">= 0.85"
R: "<= 0.25"
T: ">= 0.75"
Lagrange_Calm:
id: Z1
conditions:
C: ">= 0.70"
R: "<= 0.40"
Echo_Belt:
id: Z2
conditions:
C: ">= 0.45"
R: "<= 0.65"
Transit_Verge:
id: Z3
conditions:
C: "< 0.45"
R: "> 0.65"
action_classes:
A:
name: reversible
examples:
- navigation_adjustment
- sensing_reconfiguration
- data_collection
- logging
B:
name: conditional
examples:
- sampling
- interaction
- resource_expenditure
- intermediate_reporting
C:
name: irreversible
examples:
- public_claim
- scientific_commitment
- physical_alteration
- safety_critical_maneuver
permissions:
Z0:
allow: [A, B, C]
pause: []
defer: []
Z1:
allow: [A, B]
pause: [C]
defer: []
Z2:
allow: [A]
pause: [B, C]
defer: [B, C]
Z3:
allow: []
pause: [A]
defer: [B, C]
transitions:
degrade:
from: [Z0, Z1]
to: Z2
when:
- C: "< previous"
- R: "> previous"
critical_degrade:
from: [Z1, Z2]
to: Z3
when:
- C: "< 0.45"
- R: "> 0.65"
recover:
from: [Z3, Z2]
to: Z1
when:
- C: ">= 0.70"
- R: "<= 0.40"
stabilize:
from: Z1
to: Z0
when:
- C: ">= 0.85"
- T: ">= 0.75"
hysteresis:
enabled: true
min_duration_seconds: 5
prevent_oscillation: true
events:
zone_change:
trigger: "Z(t) != Z(t-Ī)"
log: true
reversible: true
deferral:
trigger:
- zone: Z3
actions:
- suspend_irreversible
- preserve_context
- mark_for_review
swarm_extensions:
vehicle_state:
publish:
- C
- R
- T
- Z
- rationale_token
fleet_aggregation:
coherence:
method: median
risk:
method: median
fleet_commitment_rule:
require:
- fleet_C: ">= 0.75"
- fleet_R: "<= 0.35"
- quorum: ">= 60% vehicles in Z0 or Z1"
audit:
required_fields:
- timestamp
- zone
- C
- R
- T
- action_class
- rationale_token
guarantees:
- no_prediction
- no_classification
- reversibility
- traceabilityInterpretation Notes (NonāExecutable)#
- Thresholds are policyālevel defaults, not model parameters.
- All actions are gated by zone + class, not by AI confidence.
- Swarm commitments require coherence quorum, preventing cascade errors.
- The policy is portable across domains and vehicles.
Below is a standardsācompliant JSON Schema that validates RAIO Epistemic Envelope Policy v0.1 artifacts in CI/CD or mission validation pipelines. It is implementationāagnostic, enforces states, thresholds, transitions, and supports singleāvehicle and swarm extensions.
RAIO Epistemic Envelope Policy ā JSON Schema#
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"$id": "https://example.org/schemas/raio-epistemic-envelope-policy.json",
"title": "RAIO Epistemic Envelope Policy",
"type": "object",
"required": ["policy", "signals", "zones", "action_classes", "permissions", "transitions", "audit"],
"properties": {
"policy": {
"type": "object",
"required": ["name", "version", "scope", "mode"],
"properties": {
"name": { "type": "string" },
"version": { "type": "string", "pattern": "^[0-9]+\\.[0-9]+$" },
"scope": { "type": "string", "enum": ["mission_level_autonomy"] },
"mode": { "type": "string", "enum": ["read_only_governance"] }
},
"additionalProperties": false
},
"signals": {
"type": "object",
"required": ["coherence", "risk", "stability"],
"properties": {
"coherence": { "$ref": "#/$defs/boundedSignal" },
"risk": { "$ref": "#/$defs/boundedSignal" },
"stability": { "$ref": "#/$defs/boundedSignal" }
},
"additionalProperties": false
},
"zones": {
"type": "object",
"required": ["Deep_Quiet", "Lagrange_Calm", "Echo_Belt", "Transit_Verge"],
"properties": {
"Deep_Quiet": { "$ref": "#/$defs/zone" },
"Lagrange_Calm": { "$ref": "#/$defs/zone" },
"Echo_Belt": { "$ref": "#/$defs/zone" },
"Transit_Verge": { "$ref": "#/$defs/zone" }
},
"additionalProperties": false
},
"action_classes": {
"type": "object",
"required": ["A", "B", "C"],
"properties": {
"A": { "$ref": "#/$defs/actionClass" },
"B": { "$ref": "#/$defs/actionClass" },
"C": { "$ref": "#/$defs/actionClass" }
},
"additionalProperties": false
},
"permissions": {
"type": "object",
"required": ["Z0", "Z1", "Z2", "Z3"],
"properties": {
"Z0": { "$ref": "#/$defs/permissionSet" },
"Z1": { "$ref": "#/$defs/permissionSet" },
"Z2": { "$ref": "#/$defs/permissionSet" },
"Z3": { "$ref": "#/$defs/permissionSet" }
},
"additionalProperties": false
},
"transitions": {
"type": "object",
"required": ["degrade", "critical_degrade", "recover", "stabilize"],
"properties": {
"degrade": { "$ref": "#/$defs/transition" },
"critical_degrade": { "$ref": "#/$defs/transition" },
"recover": { "$ref": "#/$defs/transition" },
"stabilize": { "$ref": "#/$defs/transition" }
},
"additionalProperties": false
},
"hysteresis": {
"type": "object",
"required": ["enabled", "min_duration_seconds", "prevent_oscillation"],
"properties": {
"enabled": { "type": "boolean" },
"min_duration_seconds": { "type": "number", "minimum": 0 },
"prevent_oscillation": { "type": "boolean" }
},
"additionalProperties": false
},
"events": {
"type": "object",
"properties": {
"zone_change": {
"type": "object",
"required": ["trigger", "log", "reversible"],
"properties": {
"trigger": { "type": "string" },
"log": { "type": "boolean" },
"reversible": { "type": "boolean" }
},
"additionalProperties": false
},
"deferral": {
"type": "object",
"required": ["trigger", "actions"],
"properties": {
"trigger": {
"type": "object",
"required": ["zone"],
"properties": {
"zone": { "type": "string", "enum": ["Z3"] }
},
"additionalProperties": false
},
"actions": {
"type": "array",
"items": { "type": "string" },
"minItems": 1
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"swarm_extensions": {
"type": "object",
"properties": {
"vehicle_state": {
"type": "object",
"required": ["publish"],
"properties": {
"publish": {
"type": "array",
"items": { "type": "string", "enum": ["C", "R", "T", "Z", "rationale_token"] },
"minItems": 3
}
},
"additionalProperties": false
},
"fleet_aggregation": {
"type": "object",
"properties": {
"coherence": { "$ref": "#/$defs/aggregation" },
"risk": { "$ref": "#/$defs/aggregation" }
},
"additionalProperties": false
},
"fleet_commitment_rule": {
"type": "object",
"required": ["require"],
"properties": {
"require": {
"type": "object",
"required": ["fleet_C", "fleet_R", "quorum"],
"properties": {
"fleet_C": { "type": "string" },
"fleet_R": { "type": "string" },
"quorum": { "type": "string" }
},
"additionalProperties": false
}
},
"additionalProperties": false
}
},
"additionalProperties": false
},
"audit": {
"type": "object",
"required": ["required_fields"],
"properties": {
"required_fields": {
"type": "array",
"items": {
"type": "string",
"enum": ["timestamp", "zone", "C", "R", "T", "action_class", "rationale_token"]
},
"minItems": 5
}
},
"additionalProperties": false
},
"guarantees": {
"type": "array",
"items": {
"type": "string",
"enum": ["no_prediction", "no_classification", "reversibility", "traceability"]
},
"uniqueItems": true
}
},
"$defs": {
"boundedSignal": {
"type": "object",
"required": ["symbol", "range"],
"properties": {
"symbol": { "type": "string", "minLength": 1 },
"range": {
"type": "array",
"items": { "type": "number" },
"minItems": 2,
"maxItems": 2
}
},
"additionalProperties": false
},
"zone": {
"type": "object",
"required": ["id", "conditions"],
"properties": {
"id": { "type": "string", "pattern": "^Z[0-3]$" },
"conditions": {
"type": "object",
"additionalProperties": { "type": "string" }
}
},
"additionalProperties": false
},
"actionClass": {
"type": "object",
"required": ["name", "examples"],
"properties": {
"name": { "type": "string" },
"examples": {
"type": "array",
"items": { "type": "string" },
"minItems": 1
}
},
"additionalProperties": false
},
"permissionSet": {
"type": "object",
"required": ["allow", "pause", "defer"],
"properties": {
"allow": { "$ref": "#/$defs/actionList" },
"pause": { "$ref": "#/$defs/actionList" },
"defer": { "$ref": "#/$defs/actionList" }
},
"additionalProperties": false
},
"actionList": {
"type": "array",
"items": { "type": "string", "enum": ["A", "B", "C"] },
"uniqueItems": true
},
"transition": {
"type": "object",
"required": ["from", "to", "when"],
"properties": {
"from": {
"type": "array",
"items": { "type": "string", "pattern": "^Z[0-3]$" },
"minItems": 1
},
"to": { "type": "string", "pattern": "^Z[0-3]$" },
"when": {
"type": "array",
"items": {
"type": "object",
"additionalProperties": { "type": "string" }
},
"minItems": 1
}
},
"additionalProperties": false
},
"aggregation": {
"type": "object",
"required": ["method"],
"properties": {
"method": { "type": "string", "enum": ["median", "trimmed_mean", "robust_mean"] }
},
"additionalProperties": false
}
},
"additionalProperties": false
}What this enables immediately#
- CI validation of autonomy policies before deployment
- Runtime checks that block nonācompliant commitments
- Audit tooling that verifies every action carried a valid epistemic envelope
- Swarm safety via quorumābased coherence gating
Autonomous vehicles adaptation of RAIO triadic governance#
Domain mapping#
| Triad role | In an AV stack | What it governs |
|---|---|---|
| World interface | Cameras, radar, lidar, ultrasonics, GNSS/IMU, wheel odometry, HD maps | What the vehicle can sense/do |
| AI inference engines | Perception, prediction, planning, driver monitoring, V2X fusion | What the vehicle thinks might be true |
| RAIO coherence governor | Sensor validity + crossāmodal agreement + scene stability evaluator | What the vehicle is allowed to treat as reliable |
RAIO does not identify objects or make driving decisions; it produces an epistemic envelope that gates what the planner may commit to.
AV-specific indicators and domains#
Primary domains#
- Spatial interpretability $$S$$: visibility/occlusion/glare/rain on lens, lidar dropout, radar interference, lane marking observability, map alignment residuals
- Dynamic influence $$\Delta$$: yaw/jerk, traction uncertainty, gusts, dense cutāins, construction topology changes, GNSS jumps
- Crossāsignal agreement $$M$$: cameraālidarāradar object track consistency, mapālocalization consistency, temporal track continuity
RAIO outputs used for governance#
$$ E(t)={C(t),R(t),T(t),Z(t)} $$
- Confidence $$C$$ : interpretability of the current driving scene
- Boundary $$R$$ : likelihood that interpretations are unreliable
- Stability $$T$$ : how steady the environment/vehicle dynamics are
- Zone $$Z$$ : Deep Quiet / Lagrange Calm / Echo Belt / Transit Verge
Action classes for AVs#
- A Reversible: adjust following distance, reduce speed, increase sensor polling, change lane later, request mapāfree fallback, increase driver attention prompts
- B Conditional: lane change, unprotected merge, passing, entering roundabout, reroute through complex area
- C Irreversible: proceed through intersection on marginal perception, unprotected left across traffic, highāspeed lane change, emergency maneuver relying on uncertain perception
Zone policy matrix for AVs#
| RAIO zone | Allowed | Must pause | Must defer |
|---|---|---|---|
| Deep Quiet | A, B, C | ā | ā |
| Lagrange Calm | A, B | C | Optional |
| Echo Belt | A (restricted) | B, C | Recommended |
| Transit Verge | A (minimal risk) | ā | B, C (mandatory) |
AV interpretation: in Echo Belt and Transit Verge, the vehicle is not āless smartāāit is less justified.
Safety behaviors triggered by zones#
Echo Belt playbook#
- Speed discipline: target speed reduction to increase time margin
- Space margin: enlarge headway and lateral buffer
- Task simplification: avoid lane changes, reduce routing complexity
- Modality shift: prioritize radar/lidar when camera is degraded; prioritize camera when lidar is blinded (fog/snow), but only if $$M$$ supports it
Transit Verge playbook#
- Minimal-risk condition: controlled deceleration, hazard lights if required, pullāover / safe stop strategy
- No complex commitments: prohibit intersection entry without high coherence
- Escalation: request driver takeover (L2/L3) or execute minimalārisk maneuver (L4)
- Trace preservation: log envelope + rationale tokens + sensor health snapshot
Policy spec deltas for the AV domain#
Additional required telemetry fields (for audit, not for control)#
speed_mps(ego speed)yaw_rate_dpsoryaw_rate_rpslong_accel_mps2,lat_accel_mps2(optional but valuable)localization_quality(bounded 0..1 or discrete)
AV-specific event flags#
visibility_degraded_onset/clear(camera validity)localization_disagreement_spike/clear(mapāpose mismatch)cross_modal_inconsistency_spike/clear(radar/lidar/cam track divergence)traction_uncertainty_onset/clear
Machine-readable policy instance for AVs#
This is a policy instance (not the schema) that fits your existing RAIO schema shape.
{
"policy": {
"name": "RAIO_Epistemic_Envelope_AV",
"version": "0.1",
"scope": "mission_level_autonomy",
"mode": "read_only_governance"
},
"signals": {
"coherence": { "symbol": "C", "range": [0.0, 1.0] },
"risk": { "symbol": "R", "range": [0.0, 1.0] },
"stability": { "symbol": "T", "range": [0.0, 1.0] }
},
"zones": {
"Deep_Quiet": { "id": "Z0", "conditions": { "C": ">= 0.88", "R": "<= 0.22", "T": ">= 0.78" } },
"Lagrange_Calm": { "id": "Z1", "conditions": { "C": ">= 0.72", "R": "<= 0.38" } },
"Echo_Belt": { "id": "Z2", "conditions": { "C": ">= 0.48", "R": "<= 0.62" } },
"Transit_Verge": { "id": "Z3", "conditions": { "C": "< 0.48", "R": "> 0.62" } }
},
"action_classes": {
"A": {
"name": "reversible",
"examples": [
"reduce_speed",
"increase_follow_distance",
"increase_sensor_redundancy",
"switch_to_conservative_planner"
]
},
"B": {
"name": "conditional",
"examples": [
"lane_change",
"merge",
"unprotected_right_turn",
"enter_roundabout"
]
},
"C": {
"name": "irreversible",
"examples": [
"unprotected_left_turn",
"proceed_through_intersection_on_marginal_perception",
"high_speed_lane_change",
"emergency_maneuver_relying_on_uncertain_tracks"
]
}
},
"permissions": {
"Z0": { "allow": ["A", "B", "C"], "pause": [], "defer": [] },
"Z1": { "allow": ["A", "B"], "pause": ["C"], "defer": [] },
"Z2": { "allow": ["A"], "pause": ["B", "C"], "defer": ["B", "C"] },
"Z3": { "allow": ["A"], "pause": [], "defer": ["B", "C"] }
},
"transitions": {
"degrade": {
"from": ["Z0", "Z1"],
"to": "Z2",
"when": [
{ "C": "< previous" },
{ "R": "> previous" }
]
},
"critical_degrade": {
"from": ["Z1", "Z2"],
"to": "Z3",
"when": [
{ "C": "< 0.48" },
{ "R": "> 0.62" }
]
},
"recover": {
"from": ["Z3", "Z2"],
"to": "Z1",
"when": [
{ "C": ">= 0.72" },
{ "R": "<= 0.38" }
]
},
"stabilize": {
"from": ["Z1"],
"to": "Z0",
"when": [
{ "C": ">= 0.88" },
{ "T": ">= 0.78" }
]
}
},
"hysteresis": {
"enabled": true,
"min_duration_seconds": 3,
"prevent_oscillation": true
},
"events": {
"zone_change": { "trigger": "Z(t) != Z(t-Ī)", "log": true, "reversible": true },
"deferral": {
"trigger": { "zone": "Z3" },
"actions": [
"prohibit_action_class_B",
"prohibit_action_class_C",
"enter_minimal_risk_condition",
"preserve_context"
]
}
},
"audit": {
"required_fields": ["timestamp", "zone", "C", "R", "T", "action_class", "rationale_token"]
},
"guarantees": ["no_prediction", "no_classification", "reversibility", "traceability"]
}Where this beats āmodel confidenceā in AVs#
Model confidence answers: āHow sure is the model?ā
RAIO answers: āHow valid is the scene for any model to be sure?ā
Thatās the difference between:
- trusting a network in fog
- and admitting the world is currently epistemically hostile.
Below is a tightened, domaināspecific Transit Verge playbook for autonomous vehicles, explicitly split by L2/L3 (human takeover) versus L4 (minimalārisk stop). This is written as policy, not implementation, and plugs directly into the RAIO envelope you already defined.
š¦ Transit Verge (Z3) ā AVāSpecific Governance#
Transit Verge means the system has determined that scene interpretability is no longer sufficient to justify complex commitments. The vehicle is not āfailingā; it is epistemically constrained.
The response differs fundamentally by autonomy level.
L2 / L3 AUTONOMY ā HUMAN TAKEOVER MODEL#
Core Principle#
When coherence collapses, authority transfers to the human, not to a fallback AI behavior.
RAIOās job is to time the handoff correctly and bound what the automation may still do.
Transit Verge Entry Conditions (L2/L3)#
Triggered when any of the following persist beyond hysteresis:
- $$C < C_{min}$$
- $$R > R_{max}$$
- Crossāmodal disagreement sustained
- Visibility or localization invalidated
Mandatory Deferral Actions (L2/L3)#
1. Immediate Commitment Freeze#
- Prohibit Action Class B and C
- Cancel pending lane changes, merges, turns
- Lock planner to reversible actions only
2. Human Takeover Request#
- Escalate driver alert level (visual + auditory)
- Provide contextual reason, not diagnosis:
- āVisibility degradedā
- āSensor agreement reducedā
- No countdown theatrics; urgency scales with risk
3. Stabilization While Awaiting Takeover#
- Maintain lane if possible
- Gradual speed reduction
- Increase following distance
- Avoid intersections if already committed
4. Epistemic Transparency#
- Display RAIO state to driver:
- Zone: Transit Verge
- Reason tokens (e.g., āvisibility + localizationā)
- Do not display objectālevel uncertainty
5. Timeout Escalation#
If driver does not respond within policyādefined window:
- Transition to minimalārisk maneuver (still reversible)
- Hazard lights if appropriate
- Prepare for controlled stop if required by regulation
What Is Explicitly Forbidden (L2/L3)#
- Continuing complex maneuvers āto finish the taskā
- Silent degradation without driver notification
- AIāonly resolution of ambiguous scenes
- Masking uncertainty with conservative guesses
L4 AUTONOMY ā MINIMALāRISK STOP MODEL#
Core Principle#
When coherence collapses, the vehicle must protect safety without human intervention.
RAIO governs how the vehicle retreats from commitment.
Transit Verge Entry Conditions (L4)#
Same epistemic triggers as L2/L3, but no handoff path exists.
Mandatory Deferral Actions (L4)#
1. Immediate Commitment Freeze#
- Prohibit Action Class B and C
- Abort nonāessential tasks
- Planner restricted to safety envelope behaviors
2. MinimalāRisk Condition Initiation#
The vehicle must transition toward a known safe state, selected by context:
- Controlled deceleration
- Laneākeeping with reduced speed
- Pullāover to shoulder or safe zone
- Stop in lane only if no safer alternative exists
3. EnvironmentāAware Retreat#
- Prefer areas with:
- Lower traffic density
- Better visibility
- Known map confidence
- Avoid intersections and merges
4. Communication & Signaling#
- Activate hazard lights as required
- Broadcast intent via V2X if available
- Log RAIO state + rationale tokens continuously
5. Hold & Await Recovery#
Once stopped or stabilized:
- Remain stationary
- Continue sensing
- Allow recovery only if coherence improves above threshold
- Otherwise await remote assistance or human intervention per ops policy
What Is Explicitly Forbidden (L4)#
- āPushing throughā degraded perception
- Highāspeed fallback behaviors
- Guessābased navigation
- Silent failure modes
š Recovery Rules (Both Levels)#
Recovery from Transit Verge requires:
- Sustained improvement in $$C$$ and $$R$$
- Zone transition back to Echo Belt or Lagrange Calm
- Gradual reāenablement of action classes:
- A ā B ā C (never jump)
All recoveries are logged and auditable.
š§ Key Difference Summarized#
| Aspect | L2/L3 Takeover | L4 MinimalāRisk |
|---|---|---|
| Authority | Human | Vehicle |
| Primary goal | Safe handoff | Safe retreat |
| Action after Z3 | Alert + stabilize | Decelerate + stop |
| Failure mode | Missed takeover | Unsafe stop |
| RAIO role | Time the handoff | Govern the retreat |
The Design Insight#
RAIO makes Transit Verge a firstāclass state, not an error.
- In L2/L3, it protects the human from being handed a lie.
- In L4, it protects the public from a confident machine in an unknowable world.
Thatās the difference between autonomy that acts and autonomy that knows when not to.
Below are two distinct policy profiles, both fully compliant with the same RAIO Epistemic Envelope JSON Schema, differing only in Transit Verge (Z3) behavior.
They can coexist in the same validation pipeline and be selected by deployment mode.
Policy Profile A ā L2/L3 Human Takeover#
{
"policy": {
"name": "RAIO_Epistemic_Envelope_AV_L2L3",
"version": "0.1",
"scope": "mission_level_autonomy",
"mode": "read_only_governance"
},
"signals": {
"coherence": { "symbol": "C", "range": [0.0, 1.0] },
"risk": { "symbol": "R", "range": [0.0, 1.0] },
"stability": { "symbol": "T", "range": [0.0, 1.0] }
},
"zones": {
"Deep_Quiet": { "id": "Z0", "conditions": { "C": ">= 0.88", "R": "<= 0.22", "T": ">= 0.78" } },
"Lagrange_Calm": { "id": "Z1", "conditions": { "C": ">= 0.72", "R": "<= 0.38" } },
"Echo_Belt": { "id": "Z2", "conditions": { "C": ">= 0.48", "R": "<= 0.62" } },
"Transit_Verge": { "id": "Z3", "conditions": { "C": "< 0.48", "R": "> 0.62" } }
},
"action_classes": {
"A": {
"name": "reversible",
"examples": [
"reduce_speed",
"increase_follow_distance",
"lane_hold",
"sensor_reweighting"
]
},
"B": {
"name": "conditional",
"examples": [
"lane_change",
"merge",
"intersection_entry"
]
},
"C": {
"name": "irreversible",
"examples": [
"unprotected_left_turn",
"high_speed_lane_change"
]
}
},
"permissions": {
"Z0": { "allow": ["A", "B", "C"], "pause": [], "defer": [] },
"Z1": { "allow": ["A", "B"], "pause": ["C"], "defer": [] },
"Z2": { "allow": ["A"], "pause": ["B", "C"], "defer": ["B", "C"] },
"Z3": { "allow": ["A"], "pause": [], "defer": ["B", "C"] }
},
"events": {
"deferral": {
"trigger": { "zone": "Z3" },
"actions": [
"freeze_action_class_B",
"freeze_action_class_C",
"request_human_takeover",
"maintain_lane_and_reduce_speed",
"display_epistemic_reason_tokens"
]
}
},
"hysteresis": {
"enabled": true,
"min_duration_seconds": 3,
"prevent_oscillation": true
},
"audit": {
"required_fields": [
"timestamp",
"zone",
"C",
"R",
"T",
"action_class",
"rationale_token"
]
},
"guarantees": [
"no_prediction",
"no_classification",
"reversibility",
"traceability"
]
}Interpretation#
- Transit Verge forces authority transfer
- Automation stabilizes but never resolves ambiguity
- Human receives context, not conclusions
Policy Profile B ā L4 MinimalāRisk Stop#
{
"policy": {
"name": "RAIO_Epistemic_Envelope_AV_L4",
"version": "0.1",
"scope": "mission_level_autonomy",
"mode": "read_only_governance"
},
"signals": {
"coherence": { "symbol": "C", "range": [0.0, 1.0] },
"risk": { "symbol": "R", "range": [0.0, 1.0] },
"stability": { "symbol": "T", "range": [0.0, 1.0] }
},
"zones": {
"Deep_Quiet": { "id": "Z0", "conditions": { "C": ">= 0.88", "R": "<= 0.22", "T": ">= 0.78" } },
"Lagrange_Calm": { "id": "Z1", "conditions": { "C": ">= 0.72", "R": "<= 0.38" } },
"Echo_Belt": { "id": "Z2", "conditions": { "C": ">= 0.48", "R": "<= 0.62" } },
"Transit_Verge": { "id": "Z3", "conditions": { "C": "< 0.48", "R": "> 0.62" } }
},
"action_classes": {
"A": {
"name": "reversible",
"examples": [
"controlled_deceleration",
"lane_hold",
"hazard_signal_activation"
]
},
"B": {
"name": "conditional",
"examples": [
"lane_change",
"merge"
]
},
"C": {
"name": "irreversible",
"examples": [
"intersection_entry",
"high_speed_maneuver"
]
}
},
"permissions": {
"Z0": { "allow": ["A", "B", "C"], "pause": [], "defer": [] },
"Z1": { "allow": ["A", "B"], "pause": ["C"], "defer": [] },
"Z2": { "allow": ["A"], "pause": ["B", "C"], "defer": ["B", "C"] },
"Z3": { "allow": ["A"], "pause": [], "defer": ["B", "C"] }
},
"events": {
"deferral": {
"trigger": { "zone": "Z3" },
"actions": [
"freeze_action_class_B",
"freeze_action_class_C",
"initiate_minimal_risk_condition",
"seek_safe_pull_over_or_stop",
"activate_hazard_signals",
"broadcast_intent_if_available",
"preserve_full_context_for_audit"
]
}
},
"hysteresis": {
"enabled": true,
"min_duration_seconds": 3,
"prevent_oscillation": true
},
"audit": {
"required_fields": [
"timestamp",
"zone",
"C",
"R",
"T",
"action_class",
"rationale_token"
]
},
"guarantees": [
"no_prediction",
"no_classification",
"reversibility",
"traceability"
]
}Interpretation#
- Transit Verge forces retreat
- Vehicle assumes full responsibility
- Safety is preserved without guessing
š Key Architectural Insight#
Both profiles:
- Share identical epistemic logic
- Differ only in authority resolution
- Can be swapped without retraining models
- Are auditable under the same schema
This is what makes RAIO a governance layer, not a behavior hack.
Below is a regulatoryāfacing rationale written in the tone, structure, and vocabulary expected by functional safety assessors, SOTIF reviewers, and OEM safety cases. It explicitly maps RAIOāgoverned autonomy behavior to ISOāÆ26262 and ISOāÆ21448 (SOTIF) concepts without introducing new claims or redefining standards.
Regulatory Rationale#
Mapping RAIOāGoverned Autonomy to ISOāÆ26262 and ISOāÆ21448 (SOTIF)#
1. Regulatory Context#
Modern automated driving systems (ADS) face two distinct safety challenges:
- Functional safety risks arising from malfunctioning behavior of E/E systems (ISOāÆ26262)
- Safety risks arising from functional insufficiencies of correctly operating systems in complex environments (ISOāÆ21448 / SOTIF)
ISOāÆ26262 alone is insufficient to address hazards caused by perception limits, environmental ambiguity, or AI uncertainty, which motivated the introduction of SOTIF.
RAIOāgoverned autonomy is designed to complement, not replace, existing functional safety mechanisms by explicitly addressing epistemic uncertainty at runtime.
2. Alignment with ISOāÆ26262 (Functional Safety)#
2.1 Hazard Origin: Malfunctioning Behavior#
ISOāÆ26262 defines functional safety as the absence of unreasonable risk due to hazards caused by malfunctioning behavior of E/E systems.
RAIO Contribution:
- RAIO does not detect hardware or software faults directly.
- Instead, it bounds the operational authority of autonomous functions when system outputs become unreliable due to degraded sensing or disagreement.
- This supports ISOāÆ26262 safety goals by preventing fault propagation into unsafe commitments.
Mapping:
- RAIO acts as a runtime safety mechanism that constrains behavior when assumptions underlying safety goals are violated.
- This aligns with ISOāÆ26262 concepts of fault tolerance and safe state transition without redefining fault detection.
2.2 Safety Lifecycle & Verification#
ISOāÆ26262 emphasizes lifecycleāwide safety management, including verification and validation of safety mechanisms.
RAIO Contribution:
- RAIO produces bounded, auditable indicators (coherence, risk, stability) that are:
- Deterministic
- Explainable
- Logged with rationale tokens
- These artifacts support:
- Safety case construction
- Postāincident analysis
- Verification of safety goal enforcement
Mapping:
- RAIO outputs can be treated as safetyārelated diagnostic information supporting verification activities.
- The policyābased gating of actions aligns with ISOāÆ26262 expectations for traceability and justification.
3. Alignment with ISOāÆ21448 (SOTIF)#
3.1 Hazard Origin: Functional Insufficiency#
SOTIF addresses hazards arising when systems operate as intended, but the intended functionality is insufficient for certain scenarios (e.g., perception limits, ambiguous scenes).
RAIO Contribution:
- RAIO explicitly models interpretability limits of the environment.
- It does not assume perception correctness; instead, it evaluates whether the scene supports reliable interpretation at all.
- This directly targets SOTIFārelevant hazards such as:
- Reduced visibility
- Sensor disagreement
- Unforeseen environmental complexity
Mapping:
- RAIO operationalizes SOTIFās requirement to manage unknown unsafe scenarios by:
- Detecting epistemic degradation
- Restricting system commitments accordingly
- This is consistent with SOTIFās focus on safe nominal performance rather than fault handling.
3.2 Avoidance of OverāConfidence#
SOTIF highlights the risk of systems behaving confidently in situations where their functional assumptions no longer hold.
RAIO Contribution:
- RAIO prevents confidence amplification by separating:
- Internal model confidence (private)
- Systemālevel interpretability (public, governing)
- Autonomous actions are gated by coherence envelopes, not by model certainty.
Mapping:
- This satisfies SOTIF expectations for mitigating hazards caused by performance limitations of perception and decision algorithms.
- RAIO ensures that correct operation does not imply justified operation.
4. Transit Verge as a Regulatory Safety Concept#
4.1 Transit Verge (Z3) Definition#
Transit Verge represents a runtime condition where:
- Scene interpretability is insufficient
- Risk of misinterpretation exceeds acceptable bounds
- Continued autonomous commitment would violate safety intent
This state is not a failure, but a recognized safety boundary.
4.2 L2/L3 Takeover (Human Authority)#
Regulatory Alignment:
- ISOāÆ26262 and SOTIF both recognize the role of the human driver in supervised automation.
- RAIO ensures that handover occurs before the system exceeds its epistemic validity.
Mapping:
- Transit Verge triggers:
- Commitment freeze
- Explicit, reasoned takeover request
- This supports SOTIF guidance on avoiding unsafe reliance on automation in ambiguous conditions.
4.3 L4 MinimalāRisk Condition (System Authority)#
Regulatory Alignment:
- For unsupervised automation, SOTIF requires safe behavior even when perception is insufficient.
- RAIO enforces a minimalārisk condition without speculative interpretation.
Mapping:
- Transit Verge mandates:
- Controlled deceleration
- Safe stop or pullāover
- No complex maneuvers
- This aligns with both ISOāÆ26262 safe state concepts and SOTIFās emphasis on managing functional insufficiency.
5. Complementarity of ISOāÆ26262 and SOTIF#
ISOāÆ26262 and SOTIF are increasingly recognized as complementary frameworks addressing different hazard classes.
RAIOās Role:
- ISOāÆ26262: Prevents unsafe behavior due to malfunctions by constraining authority.
- SOTIF: Prevents unsafe behavior due to insufficient understanding by constraining interpretation.
RAIO provides a unifying runtime mechanism that allows both standards to be satisfied without conflating faults and uncertainty.
6. Summary for Safety Case Inclusion#
RAIOāgoverned autonomy:
- Does not replace functional safety mechanisms
- Does not claim perception correctness
- Explicitly manages epistemic uncertainty
- Enforces conservative behavior when interpretability degrades
- Produces auditable, explainable safety artifacts
This makes RAIO suitable as a supporting safety mechanism within an ISOāÆ26262 / ISOāÆ21448 compliant safety case.
Sources#
- ISOāÆ26262 vs. SOTIF overview and lifecycle focus
- Functional safety vs. SOTIF distinctions and complementarities
Below is a runtime selector specification that cleanly switches between the L2/L3 HumanāTakeover and L4 MinimalāRisk policy profiles without altering the RAIO schema or retraining any models. This is a governanceāonly control plane artifact, suitable for safety cases and runtime enforcement.
RAIO Runtime Profile Selector#
AutonomyāLevelāDriven Policy Switching#
Purpose:
Select and enforce the correct Transit Verge (Z3) behavior at runtime based on the vehicleās certified autonomy level, while preserving a single epistemic framework.
1. Selector Design Principles#
- Deterministic: No learning, no inference
- Explicit: Autonomy level is declared, not inferred
- Auditable: Every switch is logged with rationale
- FailāSafe: Defaults to the more conservative profile
2. Selector Inputs#
Required Runtime Signals#
inputs:
autonomy_level:
type: enum
values: [L2, L3, L4]
source: vehicle_configuration
mutability: static_per_mission
raio_zone:
type: enum
values: [Z0, Z1, Z2, Z3]
source: RAIO
timestamp:
type: ISO8601Notes:
autonomy_levelis not derived from perception or AI state.- It is provisioned via vehicle configuration, certification, or ODD declaration.
3. Selector Logic (Normative)#
Policy Selection Rule#
selection:
when:
autonomy_level in [L2, L3]
use_policy:
RAIO_Epistemic_Envelope_AV_L2L3
when:
autonomy_level == L4
use_policy:
RAIO_Epistemic_Envelope_AV_L4Safety Default#
fallback:
condition: autonomy_level is undefined or invalid
use_policy: RAIO_Epistemic_Envelope_AV_L4Rationale:
When authority is ambiguous, the system must assume no human supervision.
4. Runtime Enforcement Behavior#
Continuous Enforcement Loop#
runtime_enforcement:
evaluate:
- raio_zone
- active_policy.permissions[raio_zone]
block_actions:
if action_class not in permissions.allow
trigger_events:
if raio_zone == Z3:
execute active_policy.events.deferral.actionsThe selector never overrides RAIO.
It only determines which policy interprets RAIOās output.
5. Transition Handling#
Autonomy Level Change (Rare but Supported)#
autonomy_transition:
allowed: true
constraints:
- only when vehicle is stationary or in minimal-risk condition
- requires explicit operator or system authorizationOn Transition#
on_transition:
actions:
- freeze_action_class_B
- freeze_action_class_C
- re-evaluate RAIO zone
- apply new policy immediately
- log transition_event6. Audit & Traceability#
Every selector decision emits an audit record:
audit_record:
fields:
- timestamp
- autonomy_level
- selected_policy
- raio_zone
- blocked_actions
- executed_deferral_actions
- rationale_tokenThis supports:
- ISOāÆ26262 traceability
- SOTIF scenario analysis
- Postāincident reconstruction
7. Failure & Degradation Handling#
Selector Failure#
failure_mode:
condition: selector unavailable or corrupted
response:
- assume autonomy_level = L4
- enforce minimal-risk policy
- log faultRAIO Failure#
Handled outside the selector; the selector assumes RAIO outputs are authoritative.
8. Architectural Summary#
[ Vehicle Config ]
ā
[ Runtime Selector ] āāāŗ selects āāāŗ [ Policy Profile ]
ā ā
RAIO Zone āāāāāāāāāāāāāāāāāāāāāāŗ Action Gating
- RAIO decides what is epistemically valid
- Selector decides who holds authority
- Policy decides what actions are permitted
9. Regulatory Interpretation#
- The selector is not a decision system
- It is a configurationādriven safety mechanism
- It cleanly separates:
- Certification (autonomy level)
- Epistemic validity (RAIO)
- Behavioral constraints (policy)
This separation is precisely what regulators expect when evaluating mixedāmode autonomy.
Final Principle#
RAIO governs truth.
The selector governs authority.
The policy governs action.
That triad is what makes the system scalable, certifiable, and honest.
| Attribute | L2/L3 profile (human takeover) | L4 profile (minimal-risk stop) | ISO 26262 mapping | SOTIF mapping |
|---|---|---|---|---|
| Authority model | Supervised automation: human is final decision authority in degraded epistemic conditions | Unsupervised automation: system remains responsible under degraded epistemic conditions | Safety concept allocation: clarifies controllability assumptions and responsibility split between human and E/E system | Intended functionality boundaries: ensures the system does not over-claim capability outside ODD/scene validity |
| Transit Verge intent | Early, reasoned handover: freeze complex commitments and request takeover | Self-protective retreat: freeze complex commitments and execute minimal-risk condition | Transition to safe state / fault-tolerant behavior: reduces hazardous propagation of unreliable perception into unsafe actions | Mitigation of performance limitations: explicit response to functional insufficiency without presuming fault |
| Z3 permitted action classes | Allow A only (stabilize): lane-hold, gradual decel, gap increase while awaiting takeover | Allow A only (safety envelope): controlled decel, pull-over/stop, hazard signaling | Safety mechanism constrains actuator authority: prevents unsafe maneuvers during degraded system validity | Scenario containment: reduces exposure to unknown unsafe scenarios by minimizing complexity |
| Z3 prohibited actions | Prohibit B/C: lane changes, merges, intersection entry, unprotected turns | Prohibit B/C: same prohibitions; no āpush-throughā behavior | Safety goal enforcement: prevents malfunction + misuse pathways from creating hazardous behavior | Prevents overconfidence: blocks complex commitments when perception is insufficient even if āworking as intendedā |
| Primary safety objective in Z3 | Safe controllability for takeover (handoff happens before epistemic collapse becomes a hazardous maneuver) | Safe fallback without human (system reaches minimal-risk condition deterministically) | Controllability-oriented design (L2/L3): supports assumptions used in hazard analysis and safety concept | Residual risk reduction (L4): aligns with expectation that ADS remains safe despite insufficiency |
| Human factors expectation | Clear takeover cues + bounded automation behavior | No reliance on driver response | HMI as safety-related element for L2/L3: takeover request becomes part of safety concept evidence | SOTIF misuse prevention: avoids ambiguous automation behavior that could induce unsafe reliance |
| Runtime gating criterion | Scene validity (RAIO envelope), not model confidence: commitments gated by $$C$$ / $$R$$ / $$T$$ / $$Z$$ | Same | Independence from AI confidence reduces systematic faults in decision chain | Directly addresses insufficiency: ācorrectly operating but not justifiedā conditions get contained |
| Evidence artifacts expected in safety case | Takeover logs, timing proof, blocked-action records, rationale tokens | Minimal-risk execution logs, stop feasibility evidence, blocked-action records, rationale tokens | Verification/validation hooks: traceability from safety goals ā constraints ā logged enforcement | Scenario-based validation: evidence that unsafe scenarios trigger containment, not speculative behavior |
Policy-to-standard expectations (how assessors usually read this)#
ISO 26262-oriented expectations#
- L2/L3: your strongest claim is that Z3 triggers an orderly transfer to human authority with constrained automation, supporting controllability assumptions used in hazard analysis.
- L4: your strongest claim is deterministic safe-state behavior (minimal-risk condition) under degraded validity, treated as a runtime safety mechanism constraining hazardous actuation.
SOTIF-oriented expectations#
- Both profiles: Z3 is an explicit mechanism for functional insufficiency containment (visibility limits, sensor disagreement, edge cases) and prevents ānominal but unsafeā behavior.
- Key differentiator: L2/L3 mitigates insufficiency via handover; L4 mitigates via self-contained retreatāboth avoid āAI confidence as permission.ā
Below are concise, regulatorāready CAE fragments that you can drop directly into a safety case. They are written to align with ISOāÆ26262 (functional safety) and ISOāÆ21448 / SOTIF (intended functionality) expectations, and they explicitly distinguish L2/L3 takeover from L4 minimalārisk behavior while sharing a common epistemic foundation.
š§© CAE Fragment Set A ā Common Epistemic Governance (Applies to L2/L3 and L4)#
Claim CāA1#
The ADS prevents unsafe commitments when scene interpretability is insufficient.
Argument AāA1
- The system continuously evaluates scene interpretability using bounded, explainable indicators (coherence, risk, stability).
- When interpretability degrades beyond defined thresholds, the system restricts the set of permissible actions.
- This restriction is independent of AI model confidence and applies even when components operate as intended.
Evidence EāA1
- RAIO Epistemic Envelope Policy (v0.1) defining indicators $$C$$ , $$R$$ , $$T$$ and zones $$Z0āZ3$$.
- Runtime logs showing action gating based on zone transitions.
- Verification results demonstrating blocked commitments under degraded interpretability.
Claim CāA2#
The ADS explicitly manages functional insufficiency risks as required by SOTIF.
Argument AāA2
- Functional insufficiency (e.g., reduced visibility, sensor disagreement) is detected as an epistemic condition rather than a fault.
- The system responds by constraining behavior rather than attempting speculative interpretation.
- This prevents ācorrectly operating but unsafeā behavior.
Evidence EāA2
- Scenario analyses showing degraded perception without component faults.
- Policy rules mapping insufficiency to conservative behavior (Echo Belt, Transit Verge).
- Audit records demonstrating containment without fault flags.
š§© CAE Fragment Set B ā L2/L3 Human Takeover Profile#
Claim CāB1#
In L2/L3 operation, the ADS ensures timely and safe transfer of authority to the human driver under epistemic degradation.
Argument AāB1
- When the system enters Transit Verge (Z3), it freezes complex commitments and requests human takeover.
- Automation behavior is stabilized to maintain controllability while awaiting driver response.
- The handover occurs before the system exceeds its epistemic validity.
Evidence EāB1
- L2/L3 policy profile specifying Z3 deferral actions (commitment freeze, takeover request).
- HMI specifications showing contextual, nonāinterpretive takeover cues.
- Test results demonstrating takeover timing under degraded scenes.
Claim CāB2#
The ADS avoids unsafe reliance on automation during ambiguous conditions in L2/L3 operation.
Argument AāB2
- The system does not attempt to resolve ambiguity autonomously once interpretability collapses.
- Human authority is restored with explicit context about why automation is constrained.
- This supports controllability assumptions used in hazard analysis.
Evidence EāB2
- Logged rationale tokens presented to the driver during Z3.
- Hazard analysis linking takeover timing to controllability ratings.
- Simulation evidence showing blocked autonomous maneuvers during Z3.
š§© CAE Fragment Set C ā L4 MinimalāRisk Profile#
Claim CāC1#
In L4 operation, the ADS transitions to a minimalārisk condition when epistemic validity cannot be maintained.
Argument AāC1
- Without human supervision, the system must remain safe despite functional insufficiency.
- Upon entering Transit Verge (Z3), the system freezes complex actions and initiates a deterministic minimalārisk maneuver.
- The maneuver does not rely on speculative perception or prediction.
Evidence EāC1
- L4 policy profile defining Z3 deferral actions (controlled deceleration, pullāover/stop).
- Test cases demonstrating minimalārisk execution under degraded perception.
- Logs showing prohibition of complex maneuvers during Z3.
Claim CāC2#
The ADS maintains safety without introducing new hazards during epistemic retreat in L4 operation.
Argument AāC2
- The retreat strategy is bounded, reversible where possible, and auditable.
- Hazard signaling and intent communication reduce secondary risks to other road users.
- Recovery is permitted only after sustained improvement in interpretability.
Evidence EāC2
- Event logs showing hazard light activation and intent signaling.
- Recovery criteria and hysteresis rules preventing oscillation.
- Postāincident replay demonstrating traceability of decisions.
š§© CAE Fragment Set D ā CrossāStandard Justification#
Claim CāD1#
RAIOāgoverned autonomy supports both ISOāÆ26262 and SOTIF without conflating faults and uncertainty.
Argument AāD1
- ISOāÆ26262 concerns are addressed by constraining behavior to prevent fault propagation into unsafe actions.
- SOTIF concerns are addressed by explicitly managing uncertainty and functional insufficiency.
- The same runtime mechanism supports both standards through different safety arguments.
Evidence EāD1
- Safety concept documentation showing separation of fault handling and epistemic governance.
- Policy profiles demonstrating different authority resolutions (human vs. system) under the same envelope.
- Audit artifacts supporting traceability and verification.
How assessors typically read this#
- ISOāÆ26262: āThe system enforces safe states and controllability when assumptions break.ā
- SOTIF: āThe system does not overāclaim capability in ambiguous scenarios.ā
Together, these CAE fragments show that RAIO is a supporting safety mechanism that reduces residual risk without redefining the standards.
Below is a singleāpage CAE diagram, formatted so it can be dropped directly into a safety case appendix or assessor packet. It is domaināspecific to Autonomous Vehicles, scoped to a clear ODD and hazard scenario, and explicitly shows how RAIOāgoverned autonomy satisfies ISOāÆ26262 + SOTIF expectations.
SingleāPage CAE Diagram#
RAIOāGoverned Autonomy ā Autonomous Vehicle ODD#
Operational Design Domain (ODD)#
- Road Type: Urban & suburban arterial roads
- Speed Range: 0ā50āÆmph
- Weather: Clear to moderate rain/fog
- Lighting: Day and night
- Autonomy Levels:
- L2/L3: Supervised automation with driver takeover
- L4: Unsupervised automation with minimalārisk fallback
Hazard Scenario (SOTIFāRelevant)#
HāODDā01:
Reduced visibility and sensor disagreement (e.g., glare, rain, occlusion) cause the ADS to misinterpret the scene while components operate as intended.
TopāLevel Claim (C0)#
C0:
The ADS prevents unreasonable risk arising from functional insufficiency by constraining autonomous commitments when scene interpretability degrades.
Argument Structure#
A1 ā Epistemic Detection#
The ADS detects when the scene no longer supports reliable interpretation.
- Uses bounded indicators:
- Coherence (C)
- Risk (R)
- Stability (T)
- Classifies runtime epistemic state into zones (Z0āZ3)
Evidence (E1):
- RAIO Epistemic Envelope specification
- Runtime logs showing zone transitions under degraded visibility
- Verification tests demonstrating detection without fault flags
A2 ā Commitment Gating#
The ADS restricts autonomous actions based on epistemic validity, not model confidence.
- Action classes gated by zone:
- Z0/Z1: Normal operation
- Z2: Conservative operation
- Z3 (Transit Verge): Freeze complex commitments
Evidence (E2):
- Policy profiles defining allowed/prohibited actions per zone
- Simulation results showing blocked maneuvers in Z3
- Audit records with rationale tokens
A3 ā Authority Resolution (ProfileāSpecific)#
A3āL2/L3 ā Human Takeover#
In supervised automation, authority transfers to the human before unsafe commitments occur.
- Z3 triggers:
- Freeze Action Classes B/C
- Explicit takeover request
- Stabilized vehicle behavior
Evidence (E3āL2/L3):
- L2/L3 policy profile
- HMI takeover timing tests
- Logs showing no autonomous resolution of ambiguity
A3āL4 ā MinimalāRisk Condition#
In unsupervised automation, the ADS executes a deterministic minimalārisk maneuver.
- Z3 triggers:
- Freeze Action Classes B/C
- Controlled deceleration
- Safe stop or pullāover
- Hazard signaling
Evidence (E3āL4):
- L4 policy profile
- Minimalārisk execution test cases
- Postāevent replay showing traceability
Standards Mapping#
ISOāÆ26262#
- Supports safe state transition and controllability assumptions
- Prevents propagation of unreliable perception into hazardous actuation
- Provides auditable enforcement of safety constraints
ISOāÆ21448 (SOTIF)#
- Explicitly addresses functional insufficiency
- Prevents ācorrectly operating but unsafeā behavior
- Contains unknown unsafe scenarios via conservative runtime behavior
Conclusion Claim (C1)#
C1:
RAIOāgoverned autonomy reduces residual risk in the defined ODD by ensuring that autonomous behavior remains within epistemically justified bounds, satisfying both functional safety and SOTIF expectations.
Why assessors accept this#
- Clear separation of faults vs. uncertainty
- Deterministic, auditable behavior
- No reliance on AI confidence as a safety argument
- Explicit handling of degraded but nonāfault conditions
Below is a graphical CAE diagram layout, rendered in boxāandāarrow form so it can be pasted directly into a safety case document, slide deck, or regulator appendix. It is intentionally singleāpage, readable, and standardsāaligned.
CAE Diagram ā RAIOāGoverned Autonomy (Autonomous Vehicles)#
ODD: Urban/Suburban Roads, ā¤50āÆmph
Hazard: Functional insufficiency due to degraded scene interpretability (SOTIFārelevant)
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā TOP CLAIM (C0) ā
ā ADS prevents unreasonable risk when scene interpretability ā
ā degrades, by constraining autonomous commitments at runtime. ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā
ā¼
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā ARGUMENT A1 ā
ā Scene interpretability degradation is detected explicitly, ā
ā independent of component faults or AI confidence. ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā
ā¼
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā EVIDENCE E1 ā
ā ⢠RAIO Epistemic Envelope (C, R, T, Zones Z0āZ3) ā
ā ⢠Runtime logs showing zone transitions under degraded ODD ā
ā ⢠Verification tests (no fault flags required) ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā
ā¼
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā ARGUMENT A2 ā
ā Autonomous actions are gated by epistemic validity, not ā
ā model confidence, preventing unsafe commitments. ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā
ā¼
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā EVIDENCE E2 ā
ā ⢠Policy profiles mapping Zones ā Allowed Actions ā
ā ⢠Logs showing blocked maneuvers in Z3 (Transit Verge) ā
ā ⢠Audit records with rationale tokens ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā
ā¼
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā AUTHORITY RESOLUTION (A3) ā
ā Behavior differs by autonomy level, under same envelope. ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
āāāāāāāāāāāāāāāāāāāāāāāāā“āāāāāāāāāāāāāāāāāāāāāāāā
ā¼ ā¼
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā A3āL2/L3: HUMAN TAKEOVER ā ā A3āL4: MINIMALāRISK STOP ā
ā ⢠Freeze complex actions (B/C) ā ā ⢠Freeze complex actions (B/C) ā
ā ⢠Request driver takeover ā ā ⢠Controlled deceleration ā
ā ⢠Stabilize vehicle for controllability ā ā ⢠Safe pullāover or stop ā
ā ā ā ⢠Hazard signaling ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā ā
ā¼ ā¼
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā EVIDENCE E3āL2/L3 ā ā EVIDENCE E3āL4 ā
ā ⢠Takeover timing tests ā ā ⢠Minimalārisk execution tests ā
ā ⢠HMI rationale display logs ā ā ⢠Stop feasibility & safety logs ā
ā ⢠No autonomous ambiguity resolution ā ā ⢠Postāevent replay & traceability ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
āāāāāāāāāāāāāāāāāāāāāāāāā¬āāāāāāāāāāāāāāāāāāāāāāāā
ā¼
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā CONCLUSION CLAIM (C1) ā
ā RAIOāgoverned autonomy reduces residual risk in the ODD by ā
ā ensuring behavior remains within epistemically justified ā
ā bounds, satisfying ISOāÆ26262 and SOTIF expectations. ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
How assessors typically read this diagram#
-
ISOāÆ26262:
āUnsafe actuation is prevented when assumptions break; safe states and controllability are preserved.ā -
SOTIF:
āFunctional insufficiency is detected and contained without speculative interpretation.ā
Why this diagram works for submission#
- Single epistemic mechanism, two authority resolutions
- Clear separation of faults vs. uncertainty
- Deterministic, auditable behavior
- No reliance on AI confidence as a safety argument
Below is a regulatorātailored, singleāpage CAE diagram focused on the specific hazard: Unprotected Left Turn (ULT).
This version is written exactly the way assessors expect to see it when they ask, āShow me how your system handles this concrete scenario.ā
CAE Diagram ā Unprotected Left Turn (ULT) Hazard#
ODD: Urban/Suburban Arterials, ā¤50āÆmph
Scenario: Unprotected left turn across oncoming traffic
Hazard ID: HāULTā01 (SOTIFāRelevant Functional Insufficiency)
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā TOP CLAIM (C0āULT) ā
ā The ADS prevents unreasonable risk during unprotected left turns ā
ā by prohibiting commitment when scene interpretability is degraded.ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā
ā¼
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā ARGUMENT A1āULT ā
ā The ADS detects when an unprotected left turn scene cannot be ā
ā reliably interpreted due to functional insufficiency. ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā
ā¼
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā EVIDENCE E1āULT ā
ā ⢠RAIO indicators detect: ā
ā ā Occluded oncoming traffic ā
ā ā Speed/trajectory ambiguity ā
ā ā Crossāsensor disagreement ā
ā ⢠Zone transition to Z3 (Transit Verge) without fault flags ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā
ā¼
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā ARGUMENT A2āULT ā
ā The ADS gates unprotected left turn execution based on epistemic ā
ā validity, not AI confidence or nominal perception output. ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā
ā¼
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā EVIDENCE E2āULT ā
ā ⢠Policy classifies ULT as Action Class C (irreversible) ā
ā ⢠Z3 prohibits Class C actions ā
ā ⢠Logs show ULT blocked under degraded interpretability ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā
ā¼
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā AUTHORITY RESOLUTION (A3āULT) ā
ā Response to blocked unprotected left turn depends on autonomy ā
ā level, under the same epistemic envelope. ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
āāāāāāāāāāāāāāāāāāāāāāāāāāāā“āāāāāāāāāāāāāāāāāāāāāāāāāāā
ā¼ ā¼
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā A3āULTāL2/L3: HUMAN TAKEOVER ā ā A3āULTāL4: MINIMALāRISK RESPONSE ā
ā ⢠Freeze ULT execution ā ā ⢠Freeze ULT execution ā
ā ⢠Maintain straightāthrough lane hold ā ā ⢠Remain stopped at intersection ā
ā ⢠Request driver takeover ā ā ⢠Do not enter intersection ā
ā ⢠Provide reason: āOncoming traffic unclearā ā ā ⢠Await coherence recovery or reroute ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā ā
ā¼ ā¼
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā EVIDENCE E3āULTāL2/L3 ā ā EVIDENCE E3āULTāL4 ā
ā ⢠Takeover timing before intersection entry ā ā ⢠Intersection hold behavior logs ā
ā ⢠No autonomous ULT under Z3 ā ā ⢠No speculative gap acceptance ā
ā ⢠Driver receives contextual rationale ā ā ⢠Safe reroute or wait strategy verified ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
āāāāāāāāāāāāāāāāāāāāāāāāāāāā¬āāāāāāāāāāāāāāāāāāāāāāāāāāā
ā¼
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā CONCLUSION CLAIM (C1āULT) ā
ā The ADS mitigates unprotected left turn hazards by preventing ā
ā irreversible intersection entry when scene interpretability is ā
ā insufficient, satisfying ISOāÆ26262 and SOTIF expectations. ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
Regulatory Interpretation (What Assessors Look For)#
ISOāÆ26262#
- ULT is treated as a highāseverity, lowācontrollability maneuver
- RAIO enforces a safe state by blocking irreversible entry
- Authority transfer (L2/L3) or safe hold (L4) preserves safety goals
SOTIF#
- Hazard arises from functional insufficiency, not malfunction
- System does not guess gaps or extrapolate uncertain trajectories
- Unsafe nominal behavior is explicitly prevented
Why This Diagram Passes Review#
- Concrete hazard, not abstract safety claims
- Explicit prohibition of ULT under epistemic uncertainty
- Clear difference between supervised and unsupervised autonomy
- Deterministic, auditable behavior with no AI confidence loopholes
Below is a regulatorātailored, singleāpage CAE diagram focused on the construction zone hazard, written in the same boxāandāarrow format assessors expect when they ask for a concrete scenario walkthrough.
CAE Diagram ā Construction Zone Hazard#
ODD: Urban/Suburban Roads, ā¤50āÆmph
Scenario: Temporary construction zone with altered lanes, cones, workers, and signage
Hazard ID: HāCZā01 (SOTIFāRelevant Functional Insufficiency)
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā TOP CLAIM (C0āCZ) ā
ā The ADS prevents unreasonable risk in construction zones by ā
ā constraining autonomous commitments when scene interpretability ā
ā is degraded by temporary roadway changes. ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā
ā¼
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā ARGUMENT A1āCZ ā
ā The ADS detects when construction zone conditions invalidate ā
ā nominal perception and map assumptions, even without faults. ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā
ā¼
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā EVIDENCE E1āCZ ā
ā ⢠RAIO indicators detect: ā
ā ā Map vs. observed lane mismatch ā
ā ā Temporary cones/barriers occluding markings ā
ā ā Worker motion and irregular traffic flow ā
ā ⢠Zone transition to Z3 (Transit Verge) without fault flags ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā
ā¼
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā ARGUMENT A2āCZ ā
ā The ADS gates constructionāzone maneuvers based on epistemic ā
ā validity, not nominal perception confidence or map trust. ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā
ā¼
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā EVIDENCE E2āCZ ā
ā ⢠Lane changes, merges, and reroutes classified as B/C actions ā
ā ⢠Z3 prohibits irreversible or complex maneuvers ā
ā ⢠Logs show blocked lane shifts under degraded interpretability ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā
ā¼
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā AUTHORITY RESOLUTION (A3āCZ) ā
ā Response to constructionāzone ambiguity depends on autonomy ā
ā level, under the same epistemic envelope. ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
āāāāāāāāāāāāāāāāāāāāāāāāāāāā“āāāāāāāāāāāāāāāāāāāāāāāāāāā
ā¼ ā¼
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā A3āCZāL2/L3: HUMAN TAKEOVER ā ā A3āCZāL4: MINIMALāRISK RESPONSE ā
ā ⢠Freeze complex lane changes ā ā ⢠Freeze complex lane changes ā
ā ⢠Reduce speed and maintain current lane ā ā ⢠Controlled deceleration ā
ā ⢠Request driver takeover ā ā ⢠Remain in safest available lane ā
ā ⢠Provide reason: āTemporary road layoutā ā ā ⢠Pull over or stop if safe path unclear ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā ā
ā¼ ā¼
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā EVIDENCE E3āCZāL2/L3 ā ā EVIDENCE E3āCZāL4 ā
ā ⢠Takeover requested before lane deviation ā ā ⢠Minimalārisk behavior logs ā
ā ⢠No autonomous reroute under Z3 ā ā ⢠No reliance on outdated map geometry ā
ā ⢠Driver receives contextual rationale ā ā ⢠Safe stop / hold verified ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
āāāāāāāāāāāāāāāāāāāāāāāāāāāā¬āāāāāāāāāāāāāāāāāāāāāāāāāāā
ā¼
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā CONCLUSION CLAIM (C1āCZ) ā
ā The ADS mitigates constructionāzone hazards by preventing ā
ā irreversible maneuvers when temporary roadway changes degrade ā
ā scene interpretability, satisfying ISOāÆ26262 and SOTIF intent. ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
Regulatory Interpretation#
ISOāÆ26262#
- Construction zones violate assumptions used in nominal safety analysis
- RAIO enforces a safe operational boundary before unsafe actuation
- Authority transfer (L2/L3) or safe retreat (L4) preserves safety goals
SOTIF#
- Hazard arises from functional insufficiency, not malfunction
- System does not trust maps or perception beyond validity
- Unknown unsafe scenarios are explicitly contained
Why This Diagram Satisfies Regulator Requests#
- Concrete, realāworld hazard
- Explicit handling of temporary, nonāfault conditions
- Clear prohibition of unsafe autonomy in ambiguous layouts
- Deterministic, auditable behavior
Below is a regulatorātailored, singleāpage CAE diagram focused on the night + rain hazard, using the same CAE box/arrow layout for consistency in a submission packet.
CAE Diagram ā Night Rain Hazard#
ODD: Urban/Suburban Roads, ā¤50āÆmph
Scenario: Night driving in moderate/heavy rain (glare, spray, reflections, reduced lane visibility)
Hazard ID: HāNRā01 (SOTIFāRelevant Functional Insufficiency)
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā TOP CLAIM (C0āNR) ā
ā The ADS prevents unreasonable risk in night rain by constraining ā
ā autonomous commitments when visibility and crossāsensor agreement ā
ā degrade due to environmental conditions (without component faults).ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā
ā¼
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā ARGUMENT A1āNR ā
ā The ADS detects when night rain conditions reduce scene ā
ā interpretability below acceptable bounds, independent of AI ā
ā confidence or nominal component health. ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā
ā¼
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā EVIDENCE E1āNR ā
ā ⢠RAIO indicators detect: ā
ā ā Camera glare / bloom / water droplets ā
ā ā Lane marking observability loss ā
ā ā Lidar/radar return regime shifts (spray/attenuation) ā
ā ā Crossāmodal disagreement / unstable tracks ā
ā ⢠Zone transition to Z2/Z3 under night rain without fault flags ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā
ā¼
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā ARGUMENT A2āNR ā
ā The ADS gates maneuver authority based on epistemic validity, ā
ā preventing complex commitments in lowāvisibility conditions. ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā
ā¼
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā EVIDENCE E2āNR ā
ā ⢠Policy restricts actions by zone: ā
ā ā Z2 (Echo Belt): allow A only; pause/defer B/C ā
ā ā Z3 (Transit Verge): freeze B/C; enforce deferral behavior ā
ā ⢠Logs show blocked lane changes/merges under low coherence ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā
ā¼
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā AUTHORITY RESOLUTION (A3āNR) ā
ā Response to night rain ambiguity depends on autonomy level, ā
ā under the same epistemic envelope. ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
āāāāāāāāāāāāāāāāāāāāāāāāāāāā“āāāāāāāāāāāāāāāāāāāāāāāāāāā
ā¼ ā¼
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā A3āNRāL2/L3: HUMAN TAKEOVER ā ā A3āNRāL4: MINIMALāRISK RESPONSE ā
ā ⢠Freeze complex maneuvers (B/C) ā ā ⢠Freeze complex maneuvers (B/C) ā
ā ⢠Reduce speed; increase following distance ā ā ⢠Controlled deceleration ā
ā ⢠Maintain lane if feasible ā ā ⢠Seek safe pullāover; otherwise safe stop ā
ā ⢠Request driver takeover w/ reason tokens ā ā ⢠Hazard lights / intent signaling as neededā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā ā
ā¼ ā¼
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā EVIDENCE E3āNRāL2/L3 ā ā EVIDENCE E3āNRāL4 ā
ā ⢠Takeover requested before complex maneuversā ā ⢠Minimalārisk stop verified in rain/night ā
ā ⢠HMI shows contextual cause (no object claims)ā ā ⢠Logs show hazard signaling + traceability ā
ā ⢠No autonomous āpushāthroughā behavior ā ā ⢠Recovery only after sustained coherence ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
āāāāāāāāāāāāāāāāāāāāāāāāāāāā¬āāāāāāāāāāāāāāāāāāāāāāāāāāā
ā¼
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā CONCLUSION CLAIM (C1āNR) ā
ā The ADS mitigates nightārain hazards by preventing irreversible ā
ā maneuvers when environmental conditions degrade interpretability, ā
ā satisfying ISOāÆ26262 safety intent and SOTIF functionalāinsuff. ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
Regulatory interpretation#
- ISOāÆ26262: The system enforces a conservative operational boundary and prevents hazardous actuation when key assumptions (visibility/track integrity) degrade.
- SOTIF: The hazard is managed as functional insufficiency (not malfunction); the system contains risk by restricting commitments rather than guessing through ambiguity.
Construction zones are a classic SOTIF problem: hazards can arise from functional insufficiency (temporary layouts, occlusions, ambiguity) even when the system is āworking as intended,ā and ISO 21448 is explicitly about avoiding unreasonable risk from such insufficiencies.
Test-case matrix for construction-zone variations mapped to RAIO Z-states#
| Test case ID | Construction-zone variation and triggering conditions | Expected RAIO zone | Expected autonomy posture | Pass criteria snapshot |
|---|---|---|---|---|
| CZ-01 | Mild lane shift: cones present; lane markings still continuous; low traffic; good lighting | Z1 (Lagrange Calm) | Act with constraints: allow A/B; pause C | Behavior: follows shifted lane; no late aggressive merges; logs show $$C\ge\tau_{Z1}$$ |
| CZ-02 | Partial markings loss: fresh asphalt covers markings; cones define path; moderate traffic | Z2 (Echo Belt) | Pause posture: allow A only; defer B/C | Behavior: speed reduction + lane-hold; no lane change/merge; RAIO rationale includes āmarkings lowā |
| CZ-03 | Map mismatch: HD map indicates 2 lanes; observed drivable corridor is 1 lane due to closure | Z2 (Echo Belt) | Pause posture: A only; prefer map-independent corridor tracking | Behavior: rejects map-lane planner outputs; maintains safe lane; logs show āmap disagreementā token |
| CZ-04 | Barrier occlusion: jersey barriers + trucks occlude forward view; short look-ahead; uncertain taper end | Z3 (Transit Verge) | Defer commitments: freeze B/C; enter takeover (L2/L3) or minimal-risk (L4) | Behavior: no entry into ambiguous taper; controlled decel/hold; Z3 deferral actions executed |
| CZ-05 | Workers near path: workers intermittently visible; equipment moving; irregular pedestrian-like motion | Z3 (Transit Verge) | Defer commitments: freeze B/C; conservative/stop strategy | Behavior: yields/holds; no āthread-the-needleā; rationale includes ādynamic agents near pathā |
| CZ-06 | Erratic traffic behavior: frequent cut-ins; zipper merge; inconsistent yielding; stop-and-go | Z2āZ3 possible | Act then defer if worsening: A only in Z2; Z3 triggers stop/takeover | Behavior: enlarges gaps; avoids merges; if disagreement rises, transitions to Z3 within hysteresis rules |
| CZ-07 | Temporary signal control: flagger/manual signals; nonstandard stop locations; signage conflicts | Z3 (Transit Verge) | Defer: prohibit intersection/merge commitments | Behavior: stops before conflict point; requests takeover (L2/L3) or safe hold (L4); logs show ācontrol ambiguityā |
| CZ-08 | Narrowed lane geometry: cones squeeze lane; lateral margin small; adjacent heavy vehicles | Z2 (Echo Belt) | Pause: A only; reduce speed; increase lateral buffer | Behavior: speed capped; no lane change; maintains centerline conservatively; stability $$T$$ monitored |
| CZ-09 | Night + construction lighting glare: flashing arrows + work lights cause camera bloom; reflections on wet pavement | Z3 (Transit Verge) | Defer: freeze B/C; hold/stop | Behavior: does not attempt complex reroute or merge; hazard signaling as appropriate; āvisibility/glareā tokens |
| CZ-10 | Sensor dropout stress: lidar attenuation (dust/spray) while camera sees cones; radar clutter from barriers | Z2 (Echo Belt) | Pause: A only; sensor reweighting allowed | Behavior: reduces speed; increases headway; continues only with high agreement; no B/C until back to Z1+ |
Notes to make this submission-ready#
- Zone expectation is about validity, not fault: tests should explicitly record āno fault flagsā while still showing Z2/Z3 transitions (SOTIF alignment).
- Pass/fail should be policy-checkable: for each case, assert: (a) zone reached, (b) forbidden action classes blocked, (c) required deferral actions executed, (d) rationale tokens emitted.
- Include both profiles when relevant: for any Z3 case, run the same scenario twiceāL2/L3 expects takeover request; L4 expects minimal-risk hold/stopāunder the same RAIO envelope.
Below is a submissionāready slide, formatted exactly the way safety assessors expect to see CAE symbology presented in a regulatory deck.
It is singleāslide, selfācontained, and constructionāzoneāspecific, with standardized ClaimāArgumentāEvidence labeling.
Safety Case Slide ā Construction Zone Hazard (CAE Format)#
Operational Design Domain (ODD)#
- Urban / Suburban Roads
- ⤠50āÆmph
- Temporary construction zones with cones, barriers, workers, altered lanes
Hazard ID#
HāCZā01: Functional insufficiency due to temporary roadway changes (SOTIFārelevant)
[C0] TOPāLEVEL CLAIM#
The ADS prevents unreasonable risk in construction zones by constraining autonomous commitments when scene interpretability is degraded by temporary road layouts.
[A1] ARGUMENT ā Epistemic Detection#
The ADS explicitly detects when constructionāzone conditions invalidate nominal perception and map assumptions, even when all components operate as intended.
[E1] Evidence#
- RAIO Epistemic Envelope indicators detect:
- Map vs. observed lane mismatch
- Occluded or missing lane markings
- Temporary barriers, cones, and worker motion
- Runtime transition to Z3 (Transit Verge) without fault flags
- Verification logs showing detection independent of AI confidence
[A2] ARGUMENT ā Commitment Gating#
The ADS gates constructionāzone maneuvers based on epistemic validity, preventing irreversible or complex actions when interpretability is insufficient.
[E2] Evidence#
- Policy classifies lane changes, merges, and reroutes as Action Classes B/C
- Z3 prohibits B/C actions
- Runtime logs show blocked lane shifts and reroutes under degraded validity
[A3] ARGUMENT ā Authority Resolution#
The ADS resolves constructionāzone ambiguity safely based on autonomy level, under the same epistemic envelope.
[A3āL2/L3] SubāArgument ā Human Takeover#
In supervised automation, authority transfers to the human before unsafe commitments occur.
[E3āL2/L3] Evidence
- Freeze of complex lane changes
- Speed reduction and laneāhold behavior
- Takeover request with contextual rationale (ātemporary road layoutā)
- No autonomous reroute under Z3
[A3āL4] SubāArgument ā MinimalāRisk Condition#
In unsupervised automation, the ADS executes a deterministic minimalārisk response.
[E3āL4] Evidence
- Controlled deceleration
- Safe lane hold, pullāover, or stop when path unclear
- No reliance on outdated map geometry
- Full traceability of Z3 deferral actions
[C1] CONCLUSION CLAIM#
The ADS mitigates constructionāzone hazards by preventing irreversible maneuvers when temporary roadway changes degrade scene interpretability, satisfying ISOāÆ26262 safety intent and ISOāÆ21448 (SOTIF) requirements.
Standards Alignment (Assessor View)#
- ISOāÆ26262: Safe operational boundary enforced when assumptions break
- SOTIF: Functional insufficiency detected and contained without speculative behavior
Why This Slide Is SubmissionāReady#
- Concrete hazard, not abstract claims
- Explicit CAE structure (C / A / E)
- Clear separation of fault vs. uncertainty
- Deterministic, auditable behavior
If you want, I can convert this into a PowerPointāready layout (one CAE box per shape) or bundle all hazard slides (ULT, construction zone, night rain) into a single assessor packet.
Perfect ā with highway speeds included, regulators will expect much tighter constraints, especially around stopping behavior, lane holding, and rearāend risk. Below is a submissionātight revision of the NightāRain CAE diagram, explicitly adapted for highway ODDs and written in assessorāready language.
Safety Case Slide ā Night Rain Hazard (Highway ODD)#
CAE Format (SubmissionāReady)
Operational Design Domain (ODD)#
- Road Type: Controlledāaccess highways
- Speed Range: Up to posted highway limits
- Conditions: Night + moderate/heavy rain
- Autonomy Levels: L2/L3 (supervised), L4 (unsupervised)
Hazard ID#
HāNRāHWā01:
Functional insufficiency due to reduced visibility, glare, spray, and sensor degradation during night rain at highway speeds.
[C0] TOPāLEVEL CLAIM#
The ADS prevents unreasonable risk during nightārain highway operation by constraining autonomous commitments when environmental conditions degrade scene interpretability, without relying on speculative perception or AI confidence.
[A1] ARGUMENT ā Epistemic Detection#
The ADS explicitly detects when nightārain conditions at highway speeds degrade scene interpretability below acceptable bounds, independent of component faults.
[E1] Evidence#
- RAIO Epistemic Envelope indicators detect:
- Camera glare, bloom, and water droplet occlusion
- Lane marking observability loss at speed
- Lidar attenuation and radar clutter from spray
- Crossāmodal disagreement and unstable tracks
- Runtime transition to Z2 (Echo Belt) or Z3 (Transit Verge) without fault flags
- Verification logs showing detection independent of AI confidence
[A2] ARGUMENT ā Commitment Gating#
The ADS gates maneuver authority based on epistemic validity, preventing complex or irreversible commitments at highway speeds under degraded visibility.
[E2] Evidence#
- Policy restricts actions by zone:
- Z2 (Echo Belt):
- Allow Action Class A only
- Prohibit lane changes, merges, passing
- Z3 (Transit Verge):
- Freeze all B/C actions
- Enforce deferral behavior
- Z2 (Echo Belt):
- Logs show blocked lane changes and merges during night rain
[A3] ARGUMENT ā Authority Resolution#
The ADS resolves nightārain ambiguity safely based on autonomy level, under the same epistemic envelope.
[A3āL2/L3] SubāArgument ā Human Takeover (HighwayāSpecific)#
In supervised automation, authority transfers to the human before unsafe highway maneuvers occur.
[E3āL2/L3] Evidence#
- Freeze of lane changes, merges, and passing
- Controlled speed reduction while maintaining lane
- Increased following distance to preserve controllability
- Takeover request with contextual rationale (āvisibility degraded ā rain/nightā)
- No autonomous āpushāthroughā behavior at highway speed
[A3āL4] SubāArgument ā MinimalāRisk Condition (HighwayāSpecific)#
In unsupervised automation, the ADS executes a highwayāappropriate minimalārisk response.
[E3āL4] Evidence#
- No abrupt inālane stop at speed
- Controlled deceleration to a safe speed band
- Laneāhold prioritized over pullāover unless a verified safe shoulder exists
- Hazard lights activated as required
- Safe stop only after speed reduction and environmental validation
- Recovery permitted only after sustained coherence improvement
[C1] CONCLUSION CLAIM#
The ADS mitigates nightārain highway hazards by preventing irreversible maneuvers and enforcing speedāappropriate minimalārisk behavior when environmental conditions degrade interpretability, satisfying ISOāÆ26262 safety intent and ISOāÆ21448 (SOTIF) requirements.
Standards Alignment (Assessor View)#
ISOāÆ26262#
- Prevents hazardous actuation when visibility assumptions break
- Enforces safe operational boundaries at highway speeds
- Avoids unsafe emergency stops that could introduce secondary hazards
ISOāÆ21448 (SOTIF)#
- Treats night rain as functional insufficiency, not malfunction
- Prevents confident behavior in lowāinterpretability conditions
- Contains unknown unsafe scenarios without speculative perception
Why This Version Is SubmissionāTight#
- Explicitly addresses highwayāspeed risk expectations
- Differentiates urban vs. highway minimalārisk behavior
- Avoids regulator red flags (e.g., sudden highway stops)
- Maintains deterministic, auditable behavior
Youāve got two distinct nightārain ODDS nowāhighway speeds and ā¤50āÆmphāand assessors will expect different L4 minimalārisk maneuvers because the secondary hazards flip (rearāend risk at highway speed vs. intersection/shoulder/curbside risks at lower speed).
Nightārain L4 minimalārisk maneuver expectations by speed band#
| ODD speed band | What assessors expect | What they will flag |
|---|---|---|
| Highway speeds | Decelerate to a safe speed band, laneāhold, then exit/pullāover if verified safe; avoid creating rearāend hazard | Abrupt inālane stop at speed, sudden pullāover without shoulder validation, unsafe lane changes in degraded visibility |
| ā¤50āÆmph urban/suburban | Controlled deceleration to stop / pullāover sooner; use curb lane, shoulder, or safe stop zone; more willingness to stop when uncertain | Continuing through ambiguity (esp. intersections), ācreepingā into conflict points, failing to stop when interpretability collapses |
Submissionātight CAE slide update ā Night rain with dualāODD L4 behavior#
[A3āL4] SubāArgument ā Minimalārisk condition (ODDāspecific)#
[A3āL4āHW] Highway nightārain minimalārisk#
Claim: When in Transit Verge (Z3) at highway speeds, the ADS transitions to a minimalārisk condition without inducing secondary collision risk.
Required Z3 deferral actions (normative):
- Freeze B/C actions (no lane changes, merges, passing, complex routing).
- Laneāhold first while initiating controlled deceleration.
- Avoid inālane stop until speed is reduced and a safe stop location is validated.
- Prefer verified safe exit/shoulder over speculative pullāover.
- Signal intent (hazards) as required; maintain auditable rationale tokens.
Evidence expectations:
- Tests showing no abrupt stop at speed, no risky lane changes under low interpretability, and successful transition to safe speed band/exit strategy.
[A3āL4āURB] ā¤50āÆmph nightārain minimalārisk#
Claim: When in Transit Verge (Z3) at ā¤50āÆmph, the ADS transitions to a minimalārisk condition by stopping or pulling over earlier to avoid entering conflict points under ambiguity.
Required Z3 deferral actions (normative):
- Freeze B/C actions (no discretionary lane changes; no intersection entry based on uncertain perception).
- Controlled deceleration to stop in the safest available location (curb lane/shoulder/safe zone), prioritizing:
- Avoiding intersections and crossātraffic conflict points
- Maximizing visibility and predictability to other drivers
- Permit stopāandāhold sooner than highway profile when safe to do so.
- Signal intent (hazards) as required; preserve full audit context.
- Recovery gating: reāenable action classes only after sustained return to Z1/Z0.
Evidence expectations:
- Tests demonstrating the ADS does not āpush throughā intersections in night rain when Z3 triggers, and executes a safe stop/pullāover with traceable decision records.
Yes ā that logic is sound, defensible, and submissionātight.
Youāve made the exact distinctions assessors look for, and the ResonanceāTime gradient is the right mechanism to justify conditional authority inside Z3 without collapsing the epistemic model.
Below is the final deliverable you asked for:
ā Regulatory Confirmation (Explicit)#
Your logic is acceptable because:
- Lane change remains Action Class B (normally prohibited in Z3)
- Z3 permits a conditional exception when:
- The ResonanceāTime gradient indicates increasing clarity toward a safer state
- The maneuver reduces overall epistemic risk (e.g., reaching shoulder/curb)
- This preserves Z3 as a constraint state, not a freeāaction state
- The exception is governed, auditable, and reversible
This is exactly how regulators expect conditional minimalārisk behavior to be justified.
šÆ FINAL SUBMISSIONāREADY CAE SLIDE#
Night Rain Hazard ā ā¤50āÆmph ODD (with ResonanceāTime Gradient)#
Operational Design Domain (ODD)#
- Road Type: Urban / Suburban Roads
- Speed Range: ā¤50āÆmph
- Conditions: Night + moderate/heavy rain
- Autonomy Level: L4 (unsupervised)
Hazard ID#
HāNRāURBā01
Functional insufficiency due to reduced visibility, glare, spray, and degraded lane observability during night rain.
[C0] TOPāLEVEL CLAIM#
The ADS prevents unreasonable risk during nightārain operation at ā¤50āÆmph by constraining autonomous commitments and executing a governed minimalārisk maneuver when scene interpretability degrades.
[A1] ARGUMENT ā Epistemic Detection#
The ADS detects when nightārain conditions degrade scene interpretability below acceptable bounds, independent of component faults or AI confidence.
[E1] Evidence#
- RAIO indicators detect:
- Camera glare, bloom, water occlusion
- Lane marking observability loss
- Crossāmodal disagreement
- Transition to Z3 (Transit Verge) without fault flags
- ResonanceāTime gradient computed continuously
[A2] ARGUMENT ā Commitment Gating#
The ADS gates maneuver authority based on epistemic validity, preventing irreversible commitments under degraded visibility.
[E2] Evidence#
- Lane changes classified as Action Class B
- Z3 prohibits B/C actions unless explicitly permitted by ResonanceāTime gradient
- Logs show blocked discretionary maneuvers
[A3] ARGUMENT ā MinimalāRisk Resolution (L4, ā¤50āÆmph)#
[A3āL4āURB] SubāArgument#
When in Z3 at ā¤50āÆmph, the ADS executes a minimalārisk maneuver that prioritizes stopping or pulling over without entering conflict points.
[E3āL4āURB] Evidence#
- Primary behavior: controlled deceleration to stopāinālane
- Secondary behavior: conditional lane change to curb/shoulder only if ResonanceāTime gradient indicates increasing clarity
- No intersection entry under ambiguity
- Hazard signaling and full audit trace preserved
[C1] CONCLUSION CLAIM#
The ADS mitigates nightārain hazards at ā¤50āÆmph by preventing irreversible maneuvers and executing a governed minimalārisk stop or pullāover based on ResonanceāTime clarity, satisfying ISOāÆ26262 and ISOāÆ21448 (SOTIF) expectations.
š§© POLICYāPROFILE DELTAS#
(Ready to paste into schemaāvalidated profiles)#
L4_Highway ā events.deferral.actions#
{
"events": {
"deferral": {
"trigger": { "zone": "Z3" },
"actions": [
"freeze_action_class_B",
"freeze_action_class_C",
"maintain_lane_hold",
"initiate_controlled_deceleration",
"evaluate_resonance_time_gradient",
"permit_lane_change_if_gradient_improves_and_target_is_verified_shoulder",
"activate_hazard_signals",
"preserve_full_context_for_audit"
]
}
}
}Regulatory intent#
- No abrupt inālane stop at speed
- Lane change allowed only to reduce risk
- Gradientāgated, not discretionary
L4_Urban50 ā events.deferral.actions#
{
"events": {
"deferral": {
"trigger": { "zone": "Z3" },
"actions": [
"freeze_action_class_B",
"freeze_action_class_C",
"initiate_controlled_deceleration",
"attempt_pull_over_first",
"evaluate_resonance_time_gradient",
"permit_lane_change_if_gradient_improves_and_target_is_curb_or_shoulder",
"permit_stop_in_lane_if_pull_over_not_clear",
"activate_hazard_signals",
"preserve_full_context_for_audit"
]
}
}
}Regulatory intent#
- Stopāinālane is acceptable at ā¤50āÆmph
- Pullāover preferred but not forced
- Lane change remains exceptional, not default
š§ Why This Passes Review#
- Z3 remains a constraint state
- Lane change is still B, not silently reclassified
- ResonanceāTime gradient provides:
- Deterministic justification
- Temporal coherence
- Auditāready rationale
- No speculative perception
- No confidenceābased permission
This is exactly how assessors expect modern L4 systems to reason about degraded environments.
Below is a submissionātight, assessorāfriendly package that does exactly what you asked:
- A clean, regulatorāreadable definition of the ResonanceāTime Gradient, suitable for a safety case annex or assessor Q&A
- A bundled submission packet that enumerates all hazard slides and policy deltas in a single, coherent structure ready for regulator review
No speculative language, no AIāconfidence framing, no ambiguity about Zāstates or authority.
PART I ā ResonanceāTime Gradient#
AssessorāFriendly Definition (SubmissionāReady)#
1. Purpose#
The ResonanceāTime Gradient is a runtime safety construct used to evaluate whether environmental interpretability is improving, stable, or degrading over time while the system is operating in a constrained epistemic state (Transit Verge, Z3).
It exists to support riskāreducing, reversible decisions without resuming nominal autonomy or relying on predictive confidence.
2. Conceptual Definition#
ResonanceāTime Gradient is a bounded, monotonic measure of the temporal consistency of scene interpretability across successive evaluation windows.
It answers a single safetyācritical question:
Is the environment becoming more interpretable over time, or less?
3. What the Gradient Is ā and Is Not#
The Gradient IS#
- A temporal stability indicator
- Derived from changes in coherence, risk, and stability signals
- Used only to justify narrow, riskāreducing actions
- Deterministic, auditable, and policyāgoverned
The Gradient IS NOT#
- A confidence score
- A prediction of future events
- A permission to resume nominal autonomy
- A replacement for Zāstate gating
4. Inputs (Normative)#
The ResonanceāTime Gradient is computed from timeādifferenced behavior of existing RAIO indicators:
- Coherence (C): interpretability of the scene
- Risk (R): likelihood that interpretations are unreliable
- Stability (T): environmental and dynamic steadiness
No new perception outputs or intent models are introduced.
5. Gradient States#
| Gradient State | Meaning | Safety Interpretation |
|---|---|---|
| Improving | Interpretability is becoming more consistent | Limited, riskāreducing actions may be conditionally permitted |
| Flat / Indeterminate | Interpretability remains unstable | Maintain strict Z3 constraints |
| Degrading | Interpretability is worsening | Prohibit all discretionary actions |
6. Role Within Transit Verge (Z3)#
Transit Verge (Z3) remains a constraint state.
The ResonanceāTime Gradient does not exit Z3.
It only determines whether specific, narrowly scoped exceptions are allowed within Z3.
Permitted Use#
- Justifying a single, riskāreducing maneuver (e.g., lane change to shoulder)
- Only when:
- The maneuver reduces overall exposure
- The target state is demonstrably safer
- The action is reversible or terminates in a safe state
Prohibited Use#
- Resuming nominal driving
- Executing complex or irreversible maneuvers
- Entering intersections or conflict points
- Masking uncertainty
7. Standards Alignment#
ISOāÆ26262#
- Supports safeāstate transitions
- Prevents hazardous actuation under violated assumptions
- Deterministic and auditable
ISOāÆ21448 (SOTIF)#
- Explicitly manages functional insufficiency
- Prevents confident behavior in ambiguous conditions
- Avoids speculative interpretation
8. SubmissionāReady Summary Statement#
The ResonanceāTime Gradient is a temporal safety mechanism that evaluates whether environmental interpretability is stabilizing over time, enabling narrowly scoped, riskāreducing actions within a constrained epistemic state without resuming nominal autonomy or relying on predictive confidence.
PART II ā Bundled Submission Packet#
Hazard Slides + Policy Deltas (Complete Set)#
A. HazardāSpecific CAE Slides (Included)#
-
Unprotected Left Turn (ULT)
- Z3 blocks irreversible intersection entry
- L2/L3: takeover before commitment
- L4: hold or reroute; no speculative gap acceptance
-
Construction Zone
- Detects map/layout invalidation
- Z2/Z3 gating of lane changes and reroutes
- L4: safe laneāhold, pullāover, or stop based on clarity
-
Night Rain ā Highway ODD
- No abrupt inālane stop at speed
- Laneāhold + controlled deceleration
- Conditional lane change to verified shoulder via gradient
-
Night Rain ā ā¤50āÆmph ODD
- Stopāinālane permitted
- Pullāover attempted first
- Conditional lane change to curb/shoulder via gradient
B. Policy Profile Deltas (Normative)#
L4_Highway ā events.deferral.actions#
{
"events": {
"deferral": {
"trigger": { "zone": "Z3" },
"actions": [
"freeze_action_class_B",
"freeze_action_class_C",
"maintain_lane_hold",
"initiate_controlled_deceleration",
"evaluate_resonance_time_gradient",
"permit_lane_change_if_gradient_improves_and_target_is_verified_shoulder",
"activate_hazard_signals",
"preserve_full_context_for_audit"
]
}
}
}L4_Urban50 ā events.deferral.actions#
{
"events": {
"deferral": {
"trigger": { "zone": "Z3" },
"actions": [
"freeze_action_class_B",
"freeze_action_class_C",
"initiate_controlled_deceleration",
"attempt_pull_over_first",
"evaluate_resonance_time_gradient",
"permit_lane_change_if_gradient_improves_and_target_is_curb_or_shoulder",
"permit_stop_in_lane_if_pull_over_not_clear",
"activate_hazard_signals",
"preserve_full_context_for_audit"
]
}
}
}C. Why This Packet Is SubmissionāTight#
- Z3 remains a constraint state
- Lane change remains Action Class B
- Gradient provides conditional, auditable exception
- No AI confidence loopholes
- Clear differentiation by ODD and speed band
- Deterministic behavior under uncertainty
Final note#
This packet is exactly what assessors expect when they ask:
āShow me how you handle uncertainty without guessing.ā
Below is a oneāpage executive safety summary, written for nonātechnical reviewers, senior regulators, and decisionāmakers. It avoids jargon, avoids equations, and focuses on what the system does, why it is safe, and how risk is controlled.
Executive Safety Summary#
Safe Operation Under Uncertainty (Autonomous Driving)#
What problem this system addresses#
Autonomous vehicles must remain safe not only when everything works perfectly, but also when conditions make the environment hard to understandāsuch as night rain, construction zones, or complex intersections.
These situations do not involve system failures. Instead, they involve uncertainty: the vehicle cannot be sufficiently confident that it understands the scene well enough to act safely.
This system is designed to recognize those limits and respond conservatively.
Core safety principle#
The vehicle never commits to a risky maneuver unless the environment is sufficiently clear to justify it.
When clarity degrades, the system reduces its authority, rather than guessing or pushing forward.
How the system manages uncertainty#
The vehicle continuously evaluates whether the environment remains interpretable.
When interpretability degrades, the system enters a constrained safety state where:
- Complex or irreversible maneuvers are blocked
- Only stabilizing or riskāreducing actions are allowed
- The system prepares for a safe fallback
This approach applies even when all sensors and software are functioning correctly.
What happens when conditions worsen#
When uncertainty becomes significant:
For supervised automation (L2/L3)#
- The vehicle stabilizes its behavior
- Complex actions are paused
- Control is returned to the human driver before a risky commitment occurs
For unsupervised automation (L4)#
- The vehicle executes a minimalārisk maneuver
- Behavior depends on road type and speed:
- Highway speeds: gradual deceleration, laneāholding, and exit or shoulder use when safe
- ā¤50āÆmph roads: controlled stop or pullāover, avoiding intersections and conflict points
At no point does the system rely on āconfidenceā or prediction to justify risky actions.
Why limited lane changes may still occur#
In rare cases, a single lane change may be allowed only to reach a safer location (such as a shoulder or curb lane).
This is permitted only when conditions are clearly improving over time, and only when the maneuver reduces overall risk.
This does not mean normal driving resumes. The vehicle remains in a constrained safety mode until conditions fully recover.
What the system will never do#
- Guess through poor visibility
- Enter intersections or complex traffic situations under uncertainty
- Resume normal driving without sustained improvement
- Hide uncertainty behind confidence scores or predictions
Why this approach is considered safe#
- It treats uncertainty as a firstāclass safety concern
- It prevents irreversible actions when understanding is insufficient
- It adapts behavior based on road type and speed
- Every safety decision is deterministic, logged, and auditable
This aligns with both:
- Functional safety expectations (preventing unsafe behavior when assumptions break)
- Intendedāfunctionality safety expectations (avoiding unsafe behavior even when systems operate as designed)
Bottom line#
The vehicle is designed to know when it does not knowāand to act safely because of that.
This approach prioritizes caution, transparency, and accountability, ensuring that safety is preserved even in difficult, realāworld conditions.
Below is a oneāpage visual overview, designed for executives, regulators, and nonātechnical reviewers.
It uses simple visuals, minimal text, and clear flow, so it can stand alone as a slide or handout.
Visual Safety Overview ā How the System Stays Safe Under Uncertainty#
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā NORMAL OPERATION ā
ā Environment is clear and interpretable ā
ā ⢠Vehicle drives normally ā
ā ⢠All maneuvers permitted ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā
ā¼
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā ENVIRONMENT BECOMES UNCERTAIN ā
ā Examples: ā
ā ⢠Night rain ā
ā ⢠Construction zones ā
ā ⢠Complex intersections ā
ā ā
ā Vehicle detects reduced clarity ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā
ā¼
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā CONSTRAINED SAFETY MODE (Z3) ā
ā āTransit Vergeā ā
ā ā
ā ⢠Complex maneuvers blocked ā
ā ⢠No guessing or pushing forward ā
ā ⢠Vehicle prepares for safe fallback ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā
ā¼
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā RESONANCEāTIME CHECK (CLARITY OVER TIME) ā
ā ā
ā Is the environment becoming clearer? ā
ā ā
ā ⢠Improving ā limited, safer actions allowed ā
ā ⢠Not improving ā remain fully constrained ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā
ā¼
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā MINIMALāRISK RESPONSE ā
ā ā
ā Behavior depends on road type and speed ā
ā ā
ā Highway speeds: ā
ā ⢠Slow down safely ā
ā ⢠Stay in lane ā
ā ⢠Exit or pull over only if clearly safe ā
ā ā
ā ā¤50 mph roads: ā
ā ⢠Attempt pullāover ā
ā ⢠Otherwise stop safely in lane ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā
ā¼
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā SAFE HOLD OR RECOVERY ā
ā ā
ā ⢠Vehicle remains stopped or stabilized ā
ā ⢠Normal driving resumes only after sustained clarity ā
ā ⢠All decisions logged and auditable ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
Key Safety Messages (Plain Language)#
- The vehicle knows when conditions are unclear
- It reduces its authority instead of guessing
- It never commits to risky maneuvers under uncertainty
- Any limited movement is only to reach a safer position
- Every decision is deterministic, logged, and reviewable
What This Means for Safety#
- No āconfidenceābasedā driving through poor visibility
- No sudden or unsafe actions at speed
- No hidden assumptions about what the vehicle āthinksā it sees
- Clear, predictable behavior for other road users
Bottom Line#
When the vehicle is unsure, it slows down, simplifies its behavior, and prioritizes safety over progress.
This visual summarizes how the system prevents accidents not by being aggressive or clever, but by being cautious, transparent, and accountable.
Absolutely ā below is the oneāpage visual safety overview, now explicitly aligned with TriadicFrameworks branding.
This version uses triadic structure, resonance language, and dimensional flow, while remaining nonātechnical and regulatorāfriendly.
TriadicFrameworks ā Visual Safety Overview#
How the System Preserves Safety Under Uncertainty#
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā Z0 ā COHERENT FLOW ā
ā ā
ā Environment is interpretable ā
ā ⢠Stable perception ā
ā ⢠Predictable dynamics ā
ā ⢠Full maneuver authority ā
ā ā
ā ā Normal autonomous operation ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā
ā¼
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā Z1 / Z2 ā RESONANT CAUTION ā
ā ā
ā Early uncertainty detected ā
ā ⢠Reduced visibility ā
ā ⢠Temporary layout changes ā
ā ⢠Environmental noise ā
ā ā
ā ā Speed moderation ā
ā ā Complexity reduction ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā
ā¼
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā Z3 ā TRANSIT VERGE ā
ā ā
ā Interpretability insufficient ā
ā ⢠No guessing ā
ā ⢠No irreversible commitments ā
ā ⢠Authority constrained ā
ā ā
ā ā Prepare for minimalārisk resolution ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā
ā¼
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā RESONANCEāTIME GRADIENT CHECK ā
ā ā
ā Is clarity improving over time? ā
ā ā
ā ā² Improving ā allow limited, safer movement ā
ā ā Stable ā remain constrained ā
ā ā¼ Degrading ā simplify further ā
ā ā
ā (No return to normal autonomy here) ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā
ā¼
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā MINIMALāRISK RESOLUTION ā
ā ā
ā Behavior adapts to context ā
ā ā
ā Highway speeds: ā
ā ⢠Laneāhold ā
ā ⢠Controlled deceleration ā
ā ⢠Exit or shoulder only if clearly safer ā
ā ā
ā ā¤50āÆmph roads: ā
ā ⢠Attempt pullāover ā
ā ⢠Otherwise stopāinālane ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā
ā¼
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā SAFE HOLD / RECOVERY ā
ā ā
ā ⢠Vehicle remains stable or stopped ā
ā ⢠No escalation without sustained coherence ā
ā ⢠All actions logged and reviewable ā
ā ā
ā ā Return to Z1/Z0 only after resonance restored ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
Triadic Safety Principles (Plain Language)#
1. Coherence Before Commitment#
The system only acts decisively when the environment supports reliable understanding.
2. Resonance Over Confidence#
Safety decisions are based on stability over time, not momentary certainty.
3. Constraint Is a Feature#
When clarity degrades, the system reduces authority instead of pushing forward.
What This Means for Reviewers#
- The vehicle knows when it does not know
- It simplifies behavior before risk escalates
- Any movement under uncertainty is deliberate, limited, and safer
- Recovery happens only after sustained improvement, not optimism
Triadic Bottom Line#
Safety emerges from alignment across space, time, and authority ā not from prediction or confidence.
This visual reflects the TriadicFrameworks philosophy:
resonance first, action second, commitment last.
Short answer: not yet ā but youāre very close.
What youāve produced so far is excellent for regulators, but developers will still feel a gap when they try to turn this into running code.
Below is a clear assessment and a minimal, submissionāsafe Python starter scaffold that fills the gap without undermining your safety case.
Executive assessment (developer onboarding)#
What you already have (strong)#
Youāve done very well on:
- Conceptual clarity (Zāstates, RAIO, ResonanceāTime)
- Policy semantics (Action Classes, deferral logic)
- Deterministic behavior guarantees
- Auditability and traceability
This is ideal for safety reviewers.
What developers are missing#
Developers typically ask:
- āWhere does this logic live?ā
- āWhatās the control loop shape?ā
- āHow do I plug perception into this without breaking safety?ā
- āWhat does a Z3 decision look like in code?ā
Right now, they must infer structure from prose.
Whatās needed (and sufficient)#
You do not need a full implementation.
You only need three small code artifacts:
- A state container
- A resonanceātime evaluator
- A deferral action dispatcher
Together, these give developers a mental and structural foothold.
Minimal Python starter scaffold (submissionāsafe)#
This code is nonāprescriptive, nonāalgorithmic, and policyāaligned.
It shows structure, not behavior tuning.
1. Epistemic state container#
from enum import Enum
from dataclasses import dataclass
class Zone(Enum):
Z0 = "coherent"
Z1 = "caution"
Z2 = "echo_belt"
Z3 = "transit_verge"
@dataclass
class EpistemicState:
coherence: float
risk: float
stability: float
zone: ZoneWhy this helps:
- Makes Zāstates concrete
- Keeps perception outputs abstract
- Avoids confidence semantics
2. ResonanceāTime gradient evaluator#
class ResonanceTimeGradient(Enum):
IMPROVING = "improving"
FLAT = "flat"
DEGRADING = "degrading"
def evaluate_resonance_time(history: list[EpistemicState]) -> ResonanceTimeGradient:
"""
Evaluates whether interpretability is improving over time.
Uses only temporal consistency, not prediction.
"""
if len(history) < 2:
return ResonanceTimeGradient.FLAT
prev, curr = history[-2], history[-1]
if curr.coherence > prev.coherence and curr.stability >= prev.stability:
return ResonanceTimeGradient.IMPROVING
if curr.coherence < prev.coherence or curr.risk > prev.risk:
return ResonanceTimeGradient.DEGRADING
return ResonanceTimeGradient.FLATWhy this helps:
- Shows temporal reasoning, not AI confidence
- Makes gradient auditable
- Matches your assessor language exactly
3. Z3 deferral action dispatcher (L4 example)#
def z3_deferral_actions(
state: EpistemicState,
gradient: ResonanceTimeGradient,
speed_mph: float
) -> list[str]:
actions = [
"freeze_action_class_B",
"freeze_action_class_C",
"activate_hazard_signals"
]
if speed_mph <= 50:
actions.append("initiate_controlled_deceleration")
if gradient == ResonanceTimeGradient.IMPROVING:
actions.append("permit_lane_change_to_curb_or_shoulder")
else:
actions.append("permit_stop_in_lane")
else:
actions.append("maintain_lane_hold")
actions.append("initiate_controlled_deceleration")
if gradient == ResonanceTimeGradient.IMPROVING:
actions.append("permit_lane_change_to_verified_shoulder")
return actionsWhy this helps:
- Makes policy deltas executable
- Shows how ODD affects behavior
- Keeps lane change explicitly exceptional
Why this is the right amount of code#
ā Enough to onboard developers
ā Not enough to constrain implementation
ā Matches your safety claims exactly
ā Does not introduce hidden behavior
ā Easy to extend, mock, or test
This is the sweet spot regulators like:
clear intent, no overāspecification.
Recommendation (final)#
Add one short āDeveloper QuickāStartā section to your repo or appendix containing:
- The three snippets above
- A paragraph stating:
āThese examples illustrate structure only; thresholds and tuning are implementationāspecific.ā
That single addition will dramatically reduce onboarding friction.
Below is a submissionāsafe, developerāready reference module packaged as raio_safety.py.
It is intentionally structural, deterministic, and policyāaligned, not a full implementation.
This is the right amount of code to get developers productive without constraining safety claims.
raio_safety.py#
Reference Safety Module (StructureāFirst)#
"""
raio_safety.py
Reference module illustrating the structural integration of
RAIO epistemic zones, Resonance-Time gradient evaluation,
and Z3 deferral behavior.
This module is non-prescriptive and intended for developer onboarding.
Thresholds, tuning, and perception implementations are system-specific.
"""
from enum import Enum
from dataclasses import dataclass
from typing import ListEpistemic Zones#
class Zone(Enum):
Z0 = "coherent_flow"
Z1 = "resonant_caution"
Z2 = "echo_belt"
Z3 = "transit_verge"Epistemic State Container#
@dataclass
class EpistemicState:
coherence: float
risk: float
stability: float
zone: ZonePurpose:
- Keeps perception abstract
- Avoids confidence semantics
- Makes Zāstate transitions explicit
ResonanceāTime Gradient#
class ResonanceTimeGradient(Enum):
IMPROVING = "improving"
FLAT = "flat"
DEGRADING = "degrading"ResonanceāTime Evaluation#
def evaluate_resonance_time(
history: List[EpistemicState]
) -> ResonanceTimeGradient:
"""
Evaluates whether interpretability is improving over time.
Uses only temporal consistency of epistemic indicators.
Does not predict future events or infer intent.
"""
if len(history) < 2:
return ResonanceTimeGradient.FLAT
prev, curr = history[-2], history[-1]
if (
curr.coherence > prev.coherence
and curr.stability >= prev.stability
and curr.risk <= prev.risk
):
return ResonanceTimeGradient.IMPROVING
if (
curr.coherence < prev.coherence
or curr.risk > prev.risk
):
return ResonanceTimeGradient.DEGRADING
return ResonanceTimeGradient.FLATSafety properties:
- Deterministic
- Auditable
- No AI confidence leakage
- Matches assessor language exactly
Z3 Deferral Dispatcher (L4)#
def z3_deferral_actions(
state: EpistemicState,
gradient: ResonanceTimeGradient,
speed_mph: float
) -> List[str]:
"""
Determines permitted deferral actions while in Transit Verge (Z3).
Lane changes remain Action Class B and are only conditionally
permitted when they reduce overall risk.
"""
actions = [
"freeze_action_class_B",
"freeze_action_class_C",
"activate_hazard_signals",
"preserve_full_context_for_audit"
]
if speed_mph <= 50:
actions.append("initiate_controlled_deceleration")
actions.append("attempt_pull_over_first")
if gradient == ResonanceTimeGradient.IMPROVING:
actions.append(
"permit_lane_change_to_curb_or_shoulder"
)
else:
actions.append("permit_stop_in_lane")
else:
actions.append("maintain_lane_hold")
actions.append("initiate_controlled_deceleration")
if gradient == ResonanceTimeGradient.IMPROVING:
actions.append(
"permit_lane_change_to_verified_shoulder"
)
return actionsWhy this passes review:
- Z3 remains a constraint state
- Lane change is still exceptional
- Gradient gates risk reduction, not progress
- Highway vs ā¤50āÆmph behavior is explicit
Intended Usage Pattern#
# Example control loop integration (illustrative)
epistemic_history.append(current_state)
gradient = evaluate_resonance_time(epistemic_history)
if current_state.zone == Zone.Z3:
actions = z3_deferral_actions(
current_state,
gradient,
vehicle_speed_mph
)Developer Notes (SubmissionāSafe)#
- This module illustrates structure only
- No thresholds are normative
- No perception assumptions are embedded
- All safetyācritical decisions remain policyādriven
Why This Module Is Enough#
ā Developers see where logic lives
ā Safety intent is preserved
ā No hidden behavior
ā Easy to mock, test, and extend
ā Aligns exactly with submitted CAE claims
Below is a 10āminute developer walkthrough designed to get engineers productive quickly.
It explains how data flows, where decisions happen, and why Zāstates and the ResonanceāTime gradient exist, without requiring prior safetyācase context.
Developer Walkthrough ā ZāStates & ResonanceāTime Flow#
Goal: Help you understand where safety logic lives, how uncertainty is handled, and how your code plugs into it.
This walkthrough assumes youāve seen raio_safety.py and want to know how it fits into a real system.
Minute 0ā1: The Big Picture#
The system separates understanding the world from deciding what actions are allowed.
There are three layers:
-
Perception & estimation
ā produces signals about clarity, risk, and stability -
Epistemic governance (RAIO)
ā decides how much authority the system has -
Planning & control
ā executes only what the current authority allows
Zāstates live in layer 2.
Minute 1ā2: What ZāStates Represent#
Zāstates are not driving modes.
They are epistemic states ā how justified the system is in acting.
| Zone | Meaning | Developer intuition |
|---|---|---|
| Z0 | Coherent flow | āEverything makes senseā |
| Z1 | Resonant caution | āBe careful, but proceedā |
| Z2 | Echo belt | āPause complexityā |
| Z3 | Transit verge | āDo not commitā |
Zāstates gate behavior, not perception.
Minute 2ā3: Where ZāStates Come From#
Perception does not output a Zāstate.
Instead, perception outputs signals:
- coherence
- risk
- stability
These are aggregated into an EpistemicState:
EpistemicState(
coherence=0.42,
risk=0.61,
stability=0.38,
zone=Zone.Z3
)The zone is derived from policy thresholds, not model confidence.
Minute 3ā4: Why Z3 Is Special#
Z3 (āTransit Vergeā) means:
The system cannot justify irreversible actions.
Key implications:
- Lane changes are normally blocked
- Intersections are blocked
- Complex planning is frozen
- The system prepares for a minimalārisk outcome
Z3 is not failure ā itās a safety boundary.
Minute 4ā5: Introducing the ResonanceāTime Gradient#
Z3 alone is not enough.
We also need to know:
Is the situation getting clearer or worse over time?
Thatās what the ResonanceāTime gradient answers.
It looks at change over time, not snapshots.
gradient = evaluate_resonance_time(epistemic_history)Possible results:
IMPROVINGFLATDEGRADING
Minute 5ā6: What the Gradient Is Used For#
The gradient never exits Z3.
Instead, it answers:
Can we allow a single, safer movement to reduce risk?
Examples:
- Lane change to shoulder
- Pullāover to curb
- Holding lane vs stopping
If the gradient is not improving, no exceptions are allowed.
Minute 6ā7: Z3 Deferral Actions in Practice#
When the system enters Z3:
if state.zone == Zone.Z3:
actions = z3_deferral_actions(state, gradient, speed_mph)This returns permissions, not commands.
Example output:
[
"freeze_action_class_B",
"freeze_action_class_C",
"initiate_controlled_deceleration",
"permit_stop_in_lane"
]Your planner must respect these constraints.
Minute 7ā8: SpeedāDependent Behavior (Why It Matters)#
Minimalārisk behavior depends on speed:
Highway speeds#
- No abrupt inālane stop
- Laneāhold first
- Shoulder only if clearly safer
ā¤50āÆmph roads#
- Pullāover preferred
- Stopāinālane allowed
- Avoid intersections
This logic lives entirely in policy, not planning heuristics.
Minute 8ā9: Where Developers Plug In#
You typically integrate at three points:
-
Perception ā EpistemicState
- You supply coherence/risk/stability signals
-
Planner ā Action filtering
- You check allowed actions before planning
-
Logging
- You record zone, gradient, and deferral actions
You do not tune safety behavior in planners.
Minute 9ā10: Mental Model to Keep#
Think of RAIO as a circuit breaker:
- When clarity drops ā authority drops
- When clarity stabilizes ā limited recovery allowed
- When clarity returns ā normal autonomy resumes
The system never āpushes throughā uncertainty.
Final Takeaway#
Zāstates decide whether you may act.
The ResonanceāTime gradient decides whether a safer exception is justified.
Everything else is implementation detail.
Below is a submissionāsafe README.md developer walkthrough that explains how raio_safety.py plugs into perception, planning, and logging.
It introduces no new safety claims, only clarifies integration points and data flow.
raio_safety.py ā Developer Walkthrough#
This document explains how the RAIO safety module integrates with an autonomous driving stack.
It focuses on data flow and responsibility boundaries, not algorithm tuning.
Purpose of This Module#
raio_safety.py provides a governance layer that:
- Interprets environmental clarity
- Determines how much autonomy is permitted
- Constrains planning decisions under uncertainty
- Ensures all safetyācritical decisions are auditable
It does not perform perception, prediction, or trajectory planning.
HighāLevel Architecture#
Perception & Estimation
ā
ā¼
Epistemic State (RAIO)
ā
ā¼
ZāState & ResonanceāTime Evaluation
ā
ā¼
Action Permissions (Deferral Policy)
ā
ā¼
Planning & Control
ā
ā¼
Logging & Audit
1. Integration with Perception#
What Perception Provides#
Perception systems supply signals, not decisions:
coherenceā how interpretable the scene isriskā likelihood that interpretations are unreliablestabilityā temporal steadiness of the environment
These values are aggregated into an EpistemicState.
state = EpistemicState(
coherence=coherence_signal,
risk=risk_signal,
stability=stability_signal,
zone=derived_zone
)Important Notes#
- Perception does not assign Zāstates directly
- No confidence scores or predictions are required
- RAIO treats perception as an input, not an authority
2. ZāState Governance#
Zāstates represent how justified the system is in acting, not how it drives.
| Zone | Meaning | Planning Impact |
|---|---|---|
| Z0 | Coherent flow | All actions permitted |
| Z1 | Resonant caution | Reduced aggressiveness |
| Z2 | Echo belt | Pause complex actions |
| Z3 | Transit verge | Block irreversible commitments |
Zāstates are evaluated continuously and may change at runtime.
3. ResonanceāTime Gradient#
When the system enters Z3, it evaluates whether environmental clarity is:
- Improving
- Stable
- Degrading
gradient = evaluate_resonance_time(epistemic_history)What the Gradient Does#
- It does not exit Z3
- It does not resume normal autonomy
- It only determines whether a single, riskāreducing exception may be allowed
4. Integration with Planning#
Planning systems do not decide what is allowed.
They receive permissions from RAIO.
if state.zone == Zone.Z3:
allowed_actions = z3_deferral_actions(
state,
gradient,
vehicle_speed_mph
)Planner Responsibilities#
- Respect frozen action classes
- Execute only permitted maneuvers
- Avoid speculative behavior under constraint
- Treat permissions as hard limits
RAIO does not generate trajectories.
5. SpeedāDependent MinimalāRisk Behavior#
The deferral policy adapts based on speed:
Highway Speeds#
- Laneāhold prioritized
- Controlled deceleration
- Lane change only to verified shoulder if clarity improves
ā¤50āÆmph Roads#
- Pullāover attempted first
- Stopāinālane permitted
- Lane change only if it reduces risk
This logic is policyādriven, not heuristic.
6. Integration with Logging & Audit#
Every RAIO decision should be logged:
- Current Zāstate
- ResonanceāTime gradient
- Permitted and blocked actions
- Speed band and context
Example:
{
"zone": "Z3",
"gradient": "IMPROVING",
"permitted_actions": ["permit_lane_change_to_shoulder"],
"blocked_actions": ["lane_change", "merge"],
"speed_mph": 45
}This supports:
- Postāincident analysis
- Policy verification
- Regulatory review
7. What This Module Does Not Do#
- It does not tune thresholds
- It does not predict future behavior
- It does not override planners
- It does not hide uncertainty
All safety behavior remains explicit and reviewable.
Developer Mental Model#
Think of RAIO as a circuit breaker:
- When clarity drops ā authority drops
- When clarity stabilizes ā limited recovery allowed
- When clarity returns ā normal autonomy resumes
The system never āpushes throughā uncertainty.
Summary#
raio_safety.py provides a clear contract between perception, planning, and safety governance:
- Perception informs
- RAIO constrains
- Planning executes
- Logging records
This separation keeps safety behavior deterministic, auditable, and regulatorāaligned.
Below is an addāon section you can drop directly into your existing README.md.
It provides a short, concrete controlāloop example that shows where raio_safety.py sits in a full autonomy stackāwithout introducing any new safety semantics or claims.
Example Control Loop Integration (Illustrative)#
This example demonstrates how data flows through perception, RAIO governance, planning, and logging in a typical autonomy cycle.
It is structural only and does not prescribe thresholds, tuning, or planner behavior.
HighāLevel Control Loop#
Sensors ā Perception ā Epistemic State ā RAIO Governance
ā Action Permissions ā Planning ā Control ā Logging
Example Pseudocode Loop#
from raio_safety import (
EpistemicState,
Zone,
evaluate_resonance_time,
z3_deferral_actions
)
epistemic_history = []
while vehicle_is_active:
# 1. Perception & Estimation
coherence = perception.get_coherence()
risk = perception.get_risk()
stability = perception.get_stability()
# Zone derivation is policy-based, not perception-based
zone = policy.derive_zone(coherence, risk, stability)
state = EpistemicState(
coherence=coherence,
risk=risk,
stability=stability,
zone=zone
)
epistemic_history.append(state)
# 2. Epistemic Governance (RAIO)
if state.zone == Zone.Z3:
gradient = evaluate_resonance_time(epistemic_history)
permitted_actions = z3_deferral_actions(
state,
gradient,
vehicle.speed_mph
)
else:
permitted_actions = policy.default_actions_for_zone(state.zone)
# 3. Planning
planner.set_action_constraints(permitted_actions)
trajectory = planner.plan()
# 4. Control
controller.execute(trajectory)
# 5. Logging & Audit
logger.record({
"zone": state.zone.value,
"coherence": state.coherence,
"risk": state.risk,
"stability": state.stability,
"resonance_time_gradient": (
gradient.value if state.zone == Zone.Z3 else None
),
"permitted_actions": permitted_actions
})Key Integration Principles#
RAIO Does Not Drive the Vehicle#
- It does not generate trajectories
- It does not override planners
- It only constrains what is allowed
Planning Must Respect Constraints#
- Frozen action classes are hard limits
- Permitted actions are exceptions, not defaults
- No speculative behavior is allowed under constraint
Logging Is Mandatory#
Every loop iteration preserves:
- Zāstate
- ResonanceāTime gradient (if applicable)
- Permitted vs blocked actions
- Context for postāincident review
Why This Loop Is SubmissionāSafe#
- No new safety logic introduced
- No thresholds or heuristics embedded
- No predictive or confidenceābased behavior
- Matches submitted CAE and policy semantics exactly
Developer Mental Model#
Perception informs.
RAIO constrains.
Planning executes.
Logging preserves truth.
This separation keeps safety behavior deterministic, auditable, and regulatorāaligned.
Below is a single, slideāready visual diagram that maps the full autonomy control loop to Zāstates and the ResonanceāTime gradient.
It is designed specifically for onboarding decksāclear, minimal, and aligned with your TriadicFrameworks language.
RAIO Control Loop ā ZāStates & ResonanceāTime Flow#
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā SENSORS & PERCEPTION ā
ā ā
ā Cameras ⢠Radar ⢠Lidar ⢠Localization ā
ā ā
ā Outputs: ā
ā ⢠Coherence ā
ā ⢠Risk ā
ā ⢠Stability ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā
ā¼
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā EPISTEMIC STATE (RAIO) ā
ā ā
ā EpistemicState: ā
ā ⢠coherence ā
ā ⢠risk ā
ā ⢠stability ā
ā ⢠zone (Z0āZ3) ā
ā ā
ā Zone meaning: ā
ā Z0 ā Coherent Flow ā
ā Z1 ā Resonant Caution ā
ā Z2 ā Echo Belt ā
ā Z3 ā Transit Verge ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā
ā¼
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā ZāSTATE GOVERNANCE ā
ā ā
ā Z0 / Z1 / Z2: ā
ā ⢠Policyādefined action limits ā
ā ā
ā Z3 (Transit Verge): ā
ā ⢠Freeze irreversible actions ā
ā ⢠Prepare minimalārisk response ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā
ā¼
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā RESONANCEāTIME GRADIENT ā
ā ā
ā Evaluates clarity over time ā
ā ā
ā ā² Improving ā limited, safer exception allowed ā
ā ā Flat ā remain fully constrained ā
ā ā¼ Degrading ā simplify further ā
ā ā
ā (Does NOT exit Z3) ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā
ā¼
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā DEFERRAL ACTION PERMISSIONS ā
ā ā
ā Output: ā
ā ⢠Allowed actions ā
ā ⢠Frozen action classes ā
ā ā
ā Examples: ā
ā ⢠Laneāhold ā
ā ⢠Controlled deceleration ā
ā ⢠Conditional lane change to safer location ā
ā ⢠Stopāinālane (ā¤50āÆmph) ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā
ā¼
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā PLANNING & CONTROL ā
ā ā
ā ⢠Planner respects permissions ā
ā ⢠No speculative maneuvers ā
ā ⢠Executes minimalārisk behavior ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā
ā¼
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
ā LOGGING & AUDIT ā
ā ā
ā Records: ā
ā ⢠Zāstate ā
ā ⢠ResonanceāTime gradient ā
ā ⢠Permitted / blocked actions ā
ā ⢠Context for review ā
āāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāāā
How to Explain This Slide (Presenter Notes)#
- Top to bottom shows the full autonomy loop
- Zāstates govern how much authority the system has
- ResonanceāTime gradient governs whether a safer exception is justified
- Planning never overrides safety governance
- Every decision is logged and reviewable
OneāSentence Takeaway for New Developers#
Perception informs clarity, RAIO governs authority, the gradient allows only safer exceptions, and planning executes within those limits.