Does your perception carry physics forward — or judge each frame alone?
A per-frame stack answers “what does this frame support”. A safety case asks “does the interpretation hold across time and across physics”. Take the 60-second tour, then set up your own stack and watch it drive.
Does a reading from a moment ago still exist when the sensor misses it for a frame?
A continuity-gated world model carries the track through the occlusion — the dashed PREDICTED box stays on the child even while the camera can’t see them. A per-frame stack lets them vanish, and the brake comes too late.
A digital twin doesn’t only remember the past — it predicts the future.
Mass can neither vanish nor jump through space. Because Newton’s laws hold, a co-simulated twin projects the motion forward — an optimal track and a widening probability cone on the ground. That foresight is the braking margin a snapshot never has.
Are physically impossible readings rejected — before they become truth?
A physics gate treats a detection that violates inertia, occlusion or geometry as an error, not a detection. The phantom is gated instead of triggering a phantom brake.
Does each failure mode trace to a safety goal — or does the spine go missing?
Evidence usually exists on both sides. What decides the release is the spine connecting a known failure mode to a safety goal. That seam is where most stacks are not defensible — and it is exactly the gap this tool maps.
Level setup — describe your perception stack
Your loadout. Pick an architecture as a starting point, or set the properties yourself — then play it against the scene. Everything downstream reacts to what you set here.
Evidence on both sides is common; the spine between them is what goes missing.
The game: keep them tracked through occlusion
Your stack, driving. Pick a scene, switch the world model, and watch what happens to the child behind the occluder.
Where your stack lands
A continuous evidence field. Horizontally, how much the interpretation holds across time; vertically, how much it is gated and traced to physics and safety goals. The surface shades from a defensible evidence trace to residual risk you cannot argue away. The marker sits at your stack. Hover to read any point.
The seam & your evidence trace
Evidence usually exists on both sides. What decides the release is the spine connecting a known failure mode to a safety goal.
Evidence checklist
The obligations your profile triggers, mapped to the public clause structure of each framework. Set a status and add evidence; the readiness score and gap count update live. Only controls relevant to your profile are shown.
Classes, calculation, and normative sources
The evidence field combines three properties into one coordinate. The horizontal axis is temporal consistency (per-frame → digital twin). The vertical axis is evidence gating & trace, built from physics gating, redundancy independence and whether the temporal mitigation is traced to a safety goal. A reading that violates physics is treated as an error the system can know without a label; a failure mode without a trace to a safety goal is treated as a gap regardless of how good the perception is. The shading is an orientation aid, not a score of record.
- ISO 26262 — functional safety; independence of redundant measures, safety case structure.
- ISO 21448 (SOTIF) — safety of the intended functionality; triggering conditions, unknown-unsafe reduction.
- ISO/PAS 8800 — safety for AI in road vehicles; AI-specific insufficiencies and evidence.
- UNECE WP.29 — type approval and audit expectations for automated driving.