A deterministic safety barrier in pure Rust between the neural driving planner and the drive-by-wire actuators. No command that violates a kinematic envelope reaches a steering or braking motor.
An end-to-end neural driving policy is a black box that can be fooled by pixels. Treating it as anything else is what puts a statistical safety argument in the path of a deterministic physical limit.
TransitOS interposes itself between the planner and the actuator bus and treats every command as untrusted input. When the planner asks for a hard turn at speed, the gate evaluates it against Kamm's friction circle: longitudinal braking and lateral acceleration together cannot exceed what the tyres can hold. A request outside the circle is not softened or averaged — it is rejected, and the nearest verified-safe command is dispatched in its place.
The friction circle is enforced continuously: combined lateral and longitudinal demand stays inside the tyre limit, which is what keeps a commanded turn from becoming a loss of control.
The time-to-collision invariant is a stopping-distance proof rather than a warning threshold. Under worst-case road adhesion, the distance required to stop is shown to remain strictly less than the obstacle clearance measured by radar and LiDAR. If that cannot be shown, the command does not pass.
Deterministic fallback. When the planner crashes, desynchronises or times out, the gate takes control in under a millisecond and brings the vehicle to a minimum-risk stop. The failure mode of the planner is not the failure mode of the vehicle.
| Characteristic | Direct end-to-end AI stack | TransitOS actuator safety gate |
|---|---|---|
| safety argument | statistical probability over empirical miles | deterministic mathematical proof |
| adversarial input | susceptible to optical illusion attacks | physics invariants cannot be fooled by pixels |
| execution predictability | variable GPU inference, 20–80 ms | deterministic hard real-time, ≤ 0.5 ms |
| certification path | near-impossible ISO 26262 ASIL D audit | a formally proven safe subset, amenable to ASIL D |
git clone https://github.com/KELLERBABG/TransitOS.git cd TransitOS && cargo test # the safety gate test suite