The safety partition
A learned perception stack is not a component you can argue to a safety case. So it does not carry the safety case. It proposes, and something simpler disposes.
Every autonomy programme eventually meets the same question from a regulator, an insurer or a customer’s safety officer: how do you know it will not do the unacceptable thing?
For a neural perception stack, the honest answer is that you do not know, not in the sense the question is asking. You have test coverage, field hours and a simulation suite. You do not have a proof. And no amount of validation converts a statistical argument into a deterministic one.
So we stopped trying to make the AI compute safe and made it irrelevant to safety instead.
OmegaMTL runs on two computers that are deliberately not peers. The AI compute does perception and planning — the parts that need to be clever. Alongside it, on its own supply, its own clock and its own small set of sensors, sits a real-time safety MCU. It holds the operating envelope, the geofence and the stop condition. It is small enough to reason about completely.
The AI compute proposes a trajectory. The MCU checks it against the envelope and either passes it through or clamps it. If the AI compute produces something outside the envelope, the MCU does not care why. If the AI compute stops answering the watchdog entirely, the MCU is already in control of the outcome and brings the platform to a defined safe state.
This is not a novel idea — it is how flight control has been partitioned for decades. What is worth stating plainly is the consequence: the safety case does not depend on the behaviour of the learned system. It depends on a bounded piece of firmware and the independence of its power and clock. Those are things you can actually argue.
It also disciplines the architecture in a useful way. Every time someone proposes moving a responsibility onto the safety side, they have to justify making the provable component bigger. That is a good conversation to have to keep having.