Autonomous vehicle platform and safety architecture

A safety-critical system comprising:

• a plurality of components to support operations of the safety-critical system;
• and
• a safety architecture implemented to enable the safety-critical system to continue operations with failed components, the safety architecture including safety managers instantiated for the plurality of components, each safety manager instantiated to:
• monitor output of a respective component of the plurality of components to determine whether the output of the respective component indicates occurrence of a same event as the outputs of linked components of the plurality of components, the respective and linked components configured to produce the output indicative of the same event independently based on different input information;
• responsive to a determination that the output of the respective component does not indicate the occurrence of the same event and the outputs of the linked components do indicate the occurrence of the same event, identify the respective component as having failed;
• and
• notify the safety managers that the output of the respective component is not to be used to carry out one or more of the operations of the safety-critical system.

An autonomous vehicle comprising:

• a plurality of vehicle components to support driving the autonomous vehicle through a driving environment;
• and
• a safety architecture implemented to enable the autonomous vehicle to continue driving safely with failed components, the safety architecture including safety managers instantiated for the plurality of vehicle components, each safety manager instantiated to:
• analyze outputs of at least three linked components of the plurality of vehicle components to determine whether each of the outputs indicates occurrence of a same event, the at least three linked components configured to produce the output indicative of a same event independently from the other linked components by using different input information than the other linked components;
• responsive to determining that a different output of one linked component does not indicate the occurrence of the same event as the outputs of the other linked components that do indicate the occurrence of the same event, identify the one linked component as having failed;
• and
• cause the outputs of the other linked components to be used in connection with driving the autonomous vehicle through the driving environment without using the different output of the failed component.