The problem: vehicles fail because they act when they should have stopped

Most published autonomous-vehicle disengagements and a large fraction of reported Level 2 and above incidents share a structure. The vehicle did not lack a rule; it lacked the recognition that it had drifted outside the conditions under which its perception, prediction, and planning were trustworthy. A sensor degraded in glare or precipitation. The scene contained an actor the prediction model had never been trained on. The localization solution drifted. In each case the stack kept issuing actuation commands because nothing told it to stop. Conventional safety architectures respond reactively: they catch a fault after a component fails, or they trip a watchdog after a bound is already violated. By then the vehicle has already committed an irreversible physical action.

The regulatory instruments cited above all point at the missing primitive. SAE J3016's operational design domain is a statement that competence is conditional. UNECE R157's transition demand and minimum risk maneuver are statements that the system must withdraw from execution and reach a safe state when those conditions lapse. ISO 21448 (SOTIF) is explicitly about hazards that arise from performance limitations rather than component faults, which is precisely the regime where nothing has technically broken yet the system is no longer competent to act. What these instruments require, but do not themselves supply, is an architecture in which the permission to actuate is continuously earned and revocably granted.

The solution: execution as a revocable permission, gated on computed confidence

Confidence Governance, disclosed in United States Patent Application 19/647,395, supplies that architecture. Its core move is to treat execution not as the default state interrupted only by failure, but as a conditional privilege that must be continuously re-earned. A confidence governor computes, every evaluation cycle, whether the conditions under which actuation was authorized still obtain. When they do not, it withdraws authorization. The governor is a hard gate: it cannot be overridden by the vehicle's urgency to keep moving, by an optimistic self-assessment, or by reprioritization of intent. Authorization is granted by the governor and revoked by the governor, and no actuation pathway bypasses it.

Applied to a vehicle, the disclosed primitives map directly:

  • Confidence as a first-class computed state variable. Confidence is not a heuristic score or a metadata annotation. It is a structurally defined, continuously computed scalar within a defined range, written each cycle to a designated field and tracked in lineage. For a vehicle, the confidence value expresses the aggregate assessed sufficiency of the driving stack to keep acting safely in the current situation.
  • A composite evaluator over agent-state and task-state inputs. The disclosed confidence computation applies a deterministic evaluation function to structured inputs spanning capability sufficiency, resource availability, internal integrity state, and uncertainty magnitude. In a vehicle these inputs carry concrete meaning: capability sufficiency becomes whether the perception and planning stack covers the present operational design domain; resource availability becomes sensor health, compute headroom, and localization quality; uncertainty magnitude becomes unresolved ambiguity in the scene. Confidence is admitted only on the concurrent satisfaction of confidence sufficiency, integrity compliance, and capability confirmation, so a single high-scoring subsystem cannot mask a deficient one.
  • Trajectory projection and pre-emptive suspension. The governor computes not only the absolute confidence value but a rate of change, and it projects the trajectory forward to an estimated time-to-threshold. When confidence is decaying fast enough that projected threshold crossing falls inside a configurable safety margin, the governor initiates an orderly suspension before the value crosses the line. This is the architectural answer to the failure mode above: the vehicle stops itself during the interval of collapsing competence instead of committing actuation in the gap between onset and threshold.
  • Three authorization states. The disclosed gate operates in authorized (confidence above threshold, no alarm conditions, actuation permitted), suspended (below threshold or pre-emptively halted, actuation prohibited but cognition continues), and locked (a severe integrity or catastrophic-resource condition requiring external review). For a vehicle the suspended state is exactly the regime where it executes a minimum risk maneuver: perception, prediction, and planning keep running while the actuation pathway is structurally decoupled.
  • Non-executing cognitive mode. Suspension is not idle. The disclosed structural separation of execution from cognition means a suspended agent keeps forecasting, planning, and generating inquiries. In a vehicle this is the substrate of a competent minimum risk maneuver and transition demand: while actuation is gated, the stack continues to project trajectories, plan a path to a safe stop, and surface a structured request for human takeover.
  • Hysteresis on recovery. The disclosed transition from suspended back to authorized requires confidence to exceed the threshold by a configurable hysteresis margin, preventing oscillation when the value fluctuates near the line. For a vehicle this prevents the dangerous chatter of repeatedly re-engaging and disengaging autonomy at the boundary of its competence.

Why this is the right shape for vehicle safety

The decisive property is that the gate is structural, not advisory. The disclosure implements authorization withdrawal as a decoupling of the execution subsystem's output pathway, so the actuation stack cannot produce effects regardless of its internal state or the urgency of its intent. A vehicle built this way cannot talk itself into continuing. It also cannot interpret confidence as merely an input to a planner that weighs it against schedule pressure; confidence is a precondition for actuation existing at all, evaluated before any planning output can reach the actuators.

The composite, concurrent-satisfaction structure addresses the SOTIF regime specifically. Performance-limitation hazards are precisely those where no component has faulted, so a fault-tree architecture sees nothing wrong. A confidence governor that folds capability sufficiency, uncertainty magnitude, and integrity state into a single revocable gate trips on the condition that matters, namely that the stack is no longer competent for the scene, even though every component reports nominal.

Embodiments and deployment options

The application is not limited to a single instance. Among the variations a skilled implementer could build on the disclosed mechanisms:

  • Confidence-input configurations. The confidence computation can be sourced from any subset of the disclosed input dimensions, weighted for the platform: a highway pilot emphasizing localization and sensor-resource availability; an urban system emphasizing uncertainty magnitude from dense, mixed-actor scenes; a low-speed shuttle emphasizing capability-envelope coverage of its fixed route.
  • Task-class differentiation. The disclosed task-class differentiation maps onto maneuver classes. Irreversible, high-cost maneuvers (committing to an intersection crossing, an overtake) are treated as the conservative, state-preserving class, where suspension prioritizes reaching the earliest safe stopping point; lower-stakes maneuvers tolerate redirection.
  • Suspension behaviors. The suspended-state response can be configured per platform as a graduated transition demand, an in-lane controlled stop, a pull-to-shoulder minimum risk maneuver, or a handover-with-countdown, each implemented as the non-executing cognitive mode driving a pre-planned safe-state path while actuation stays gated.
  • Locked-state policy. Catastrophic conditions (a trusted-perception integrity violation, total loss of a redundant sensing channel) route to the locked state requiring external review or service intervention rather than autonomous recovery.
  • Trajectory-projection horizons and safety margins. The time-to-threshold safety margin is configurable per maneuver class and per operating speed, so a fast-moving vehicle pre-empts earlier than a slow one for the same confidence decay rate.
  • Fleet and multi-agent extension. The disclosure's confidence propagation across agents supports fleet-level use: a vehicle that has entered suspension in a given microlocation can propagate a reduced-confidence prior to following vehicles, so the fleet degrades gracefully rather than each vehicle independently rediscovering the same competence gap.

A reference implementation would expose the confidence value, its rate of change, the active authorization state, and the lineage of each transition to the vehicle's logging and reporting subsystem, directly serving the audit and incident-reporting obligations of NHTSA Standing General Order 2021-01 and the traceability expectations of ISO 21448.

Disclosure Scope

This article describes an application of the confidence governance architecture disclosed in United States Patent Application 19/647,395. The autonomous-vehicle domain framing, regulatory mapping, and deployment scenarios are illustrative applications and are not themselves claims of the cited application. The underlying technology, namely confidence as a first-class computed state variable, the confidence governor as a hard revocable gate, the composite admissibility evaluator, trajectory projection with pre-emptive suspension, the three authorization states, the non-executing cognitive mode, and hysteresis on recovery, is disclosed in United States Patent Application 19/647,395. No threshold values, latencies, or benchmark figures are asserted beyond what that application discloses.