Separating driving automation from safety assurance

Overview

The author proposes an L4 architecture separating normal driving from safety assurance. Independent fault-containment units for monitoring, fault-tolerant decisions and critical-event handling use design diversity to address residual design faults.