+VLFBERHT+ | Automotive
Automotive AI Governance
When AI reasoning quality drops, the speed limit drops with it.
Following documented industry incidents—fleet suspensions, federal investigations, recalls triggered by unverified OTA updates—the industry knows behavioral AI governance is not optional. Ulfberht translates AI quality scores directly into physical safety parameters in real time.
When governance quality degrades, safety thresholds tighten automatically—not by operator decision, but by architecture.
The Problem
The automotive AI stack has four distinct failure surfaces.
Documented industry incidents share a common pattern: not a single catastrophic AI failure, but a chain of small, undetected quality degradations across perception, prediction, planning, and control. Each subsystem appeared functional in isolation. Governance that only monitors outputs misses the degradation in progress.
Risk 01
PERC
Perception Hallucination Under Distribution Shift
Object detection models trained on clear-weather data produce silent confidence inflation under fog, rain, or low-angle sun. The model reports high confidence on a misclassified obstacle. No disagreement surfaces because all sensors received the same degraded input.
Ulfberht detects perception model behavioral drift using statistical analysis. Silent confidence inflation triggers verification escalation before the planning layer acts.
Risk 02
CHAIN
Error Compounding Across the Decision Chain
A 5% uncertainty introduced at perception grows to 18% uncertainty by the time it reaches the planning layer. Multi-model chains amplify errors. Each handoff degrades quality. By the time a flawed input reaches actuator commands, its origin is invisible to output-layer monitors.
Ulfberht tracks information quality at every handoff in the decision chain. Compounding errors are caught before the degradation reaches control systems.
Risk 03
OTA
OTA Update Capability-Governance Gap
When a model update extends operational design domain—new weather handling, new scenario types, higher autonomous capability—the governance infrastructure supporting it does not automatically update. Capability and governance become misaligned. Documented incidents have involved fleets operating updated models against governance logic written for predecessor behavior.
Ulfberht monitors the gap between AI capability and governance coverage. If updated capability outpaces governance readiness, fleet rollout is blocked until governance infrastructure is verified.
Risk 04
EDGE
On-Vehicle Governance Compute Contention
In high-demand scenarios—dense urban environments, severe weather, complex merge situations—the vehicle's compute is under maximum load. Governance systems competing for the same hardware create a dangerous choice: skip governance to maintain latency, or run governance and slow the response. Most architectures skip silently.
Ulfberht provides dedicated on-vehicle governance within a minimal compute budget. Governance degrades gracefully and transparently—never silently fails, never competes with safety-critical actuation.
How It Works
Five-stage ADAS decision verification chain.
Every safety-critical driving decision passes through a sequential verification pipeline. No stage is skipped. Each stage produces a structured output that the next stage consumes. The full chain completes in under 8ms on ASIL-D hardware.
Sensor Fusion Consensus
Camera, LiDAR, radar, and ultrasonic data cross-validated against each other. Agreement threshold computed per sensor combination. Unresolved disagreements do not proceed—they route to conservative fallback. Majority voting is explicitly rejected as insufficient for ASIL-D decisions.
ASIL Classification
The decision is classified per ISO 26262: QM, ASIL-A through ASIL-D. Classification considers vehicle speed, maneuver type, scenario reversibility, and presence of vulnerable road users. Each ASIL level routes to the corresponding verification depth. ASIL-D completes the full chain. QM exits early.
Harm Zone Computation
Before the actuator command is authorized, the system computes the maximum zone of physical harm if the decision is wrong—at current velocity, trajectory, and environment. Actions are classified by reversibility. High-irreversibility actions require proportionally higher governance quality to proceed.
Governance Quality Check
The current verification score is checked against the required threshold for this decision's safety level and reversibility classification. If the score does not meet the threshold, the safety envelope tightens or the action is blocked.
Authorization or Block
The decision is authorized with adjusted safety parameters, held pending additional verification, or blocked with fallback behavior triggered. Every outcome generates a cryptographically signed audit record with the full chain state. On-vehicle attestation means the record exists even when the vehicle has no connectivity.
Physical Safety Translation
The only automotive AI governance system that moves the speed limit.
Most governance systems observe and log. Ulfberht directly translates AI behavioral quality into physical operating parameters. When reasoning quality degrades, the safety envelope contracts automatically—no operator decision required.
Score 1.0—0.85 / Nominal
AI behavioral quality within expected bounds. Fabrication rate low. Constraint compliance high. Behavioral scores within operating threshold. Full operational envelope active. All ASIL-D decisions route through standard verification chain.
Score 0.84—0.60 / Degraded
Governance quality degradation detected. Fabrication rate rising or constraint compliance falling. Harm zone computation triggers automatic speed reduction. ASIL-D verification requirements increase. High-irreversibility maneuvers require elevated quality confirmation before proceeding.
Score below 0.60 / Critical
Governance quality below minimum operational threshold. Safety circuit breaker engages. Vehicle initiates controlled safe pullover sequence. No further autonomous decisions authorized. All actions switch to deterministic fallback behavior until governance quality is restored and verified by a full system check.
Physical Safety Translation—Action-level thresholds
Different actions require different governance quality.
Not all driving decisions carry the same consequence if they are wrong. Ulfberht classifies every action by its potential for physical harm and how reversible it is once committed. The required verification score scales with consequence level—a high-speed lane change demands higher verified quality than a minor speed adjustment.
This relationship is enforced by architecture, not configuration. There is no parameter that allows a high-consequence, low-reversibility action to proceed at a governance quality level designed for low-consequence decisions. The higher the potential for irreversible physical harm, the higher the quality bar required to authorize the action.
Capabilities
Six capabilities. One integrated automotive governance stack.
Each capability addresses a specific failure pattern. They compose into a unified decision verification pipeline.
Physical Safety
Physical Safety Translation
Converts AI behavioral quality scores into real-time physical safety parameters. Speed limits, force thresholds, and workspace boundaries adjust automatically with verified AI quality. Safety envelopes scale continuously with verified quality—not fixed at design time. ISO 26262 and ISO 13482 pending.
Velocity Matching
Adaptive Governance Scaling
Monitors capability acceleration across multiple dimensions. OTA updates that increase model capability trigger governance readiness verification before fleet deployment is authorized. If capability outpaces governance readiness, rollout escalates to human review. Closes the post-update governance gap responsible for documented industry incidents.
Edge Processing
Edge Governance
On-vehicle governance operating within a minimal, fixed compute budget. Degrades gracefully under load—governance coverage reduces proportionally, never silently drops to zero. Cryptographic offline compliance attestation produces signed audit records without connectivity. The vehicle never makes an ungoverned decision.
Model Adaptation
Black-Box Model Adaptation
Automatically fingerprints any perception or planning model across behavioral dimensions without requiring model access or documentation. When OEMs switch suppliers or models are updated, governance recalibrates automatically. Statistical drift detection catches silent model regressions between updates.
Circuit Breaker
Safety Circuit Breaker
Pre-execution physical harm computation for every actuator command. Actions classified by reversibility and consequence level. When AI behavioral quality degrades, the circuit breaker tightens thresholds automatically. At critical degradation, the breaker fires and routes all decisions to deterministic fallback behavior.
Chain Governance
Multi-Model Chain Governance
Perception, prediction, planning, and control are a four-model decision chain. Information quality degrades at each handoff. Ulfberht measures chain integrity across every transition, detects compounding errors before they reach actuators, and isolates which model in the chain introduced the degradation.
Use Cases
How automotive teams can deploy Ulfberht.
Scenario 01
Level 3 Highway Pilot
An OEM deploying a Level 3 highway autopilot can integrate Ulfberht into the on-board compute stack at the ASIL-D processing domain. Every safety-critical decision—lane changes, speed adjustments, merge acceptance, emergency maneuvers—passes through the five-stage verification chain before actuator commands are issued. The Physical Safety Translation layer runs continuously: as highway traffic complexity increases and the AI encounters conditions near the edge of its training distribution, Ulfberht's quality score degrades predictably, and the speed envelope contracts to match. The driver handover system receives structured quality state from Ulfberht, allowing it to calibrate handover urgency based on governance quality rather than a fixed timeout.
On-vehicle edge governance runs within the ASIL compute budget, leaving full processing headroom for the AD stack during complex scenarios. Every decision produces a cryptographically signed audit record. At the end of each trip, audit chains can be uploaded to fleet infrastructure and cross-referenced against sensor fusion logs for post-incident analysis. ASIL-D documentation output is formatted for ISO 26262 Part 6 type approval submissions.
Scenario 02
Robotaxi Fleet Operations
A robotaxi operator running a fleet of hundreds of vehicles can use Ulfberht's Adaptive Governance Scaling system to gate every OTA model update before fleet-wide deployment. When a perception model update extends the operational design domain—new weather handling, improved night performance, additional object classes—Ulfberht verifies that governance infrastructure can handle the updated behavioral profile before a single vehicle in the fleet receives the update. If capability acceleration outpaces governance coverage, the update deploys to a shadow fleet for extended behavioral testing before general rollout is authorized.
Statistical drift detection runs against the reliability profile of every perception model in the fleet after each update. Silent regressions—where model performance degrades on edge cases not covered by standard test suites—are caught through distributional shift in behavioral signatures rather than requiring those edge cases to be enumerated explicitly. Fleet operators receive governance readiness reports showing per-vehicle and per-update-version coverage state before and after each deployment cycle.
Scenario 03
ADAS Tier-1 Supplier
A Tier-1 ADAS supplier integrating AI-based perception components across multiple OEM customers can use Ulfberht to provide each OEM with governed, traceable evidence of behavioral quality across their specific vehicle integration. The Multi-Model Chain Governance system tracks chain integrity across the full Perception-Prediction-Planning-Control chain, with component-level isolation identifying when degradation originates in the supplier's perception component versus the OEM's planning stack. This distinction is critical for liability tracing and allows both parties to maintain accurate audit documentation for type approval submissions.
Ulfberht's ASIL-compliant audit output is formatted to support ISO 26262 Part 8 (Supporting Processes) requirements for software tool qualification. Suppliers gain a defensible record demonstrating that their AI components operated within verified governance bounds across the test and validation lifecycle, providing OEM customers with documentation they need for UNECE WP.29 cybersecurity management system (CSMS) submissions and national homologation processes in EU, US, and Asian markets.
<8ms
full 5-stage verification
chain on ASIL-D hardware
ZERO
ungoverned decisions—
governance adapts, never silently fails
4
chain stages verified—
perception through control
100%
decision chain
audit coverage
+VLFBERHT+ | Automotive
Verify your automotive AI stack.
Schedule a technical deep-dive with our automotive safety team. We will demonstrate Physical Safety Translation, chain governance, and edge governance against your specific ADAS architecture, sensor configuration, and ASIL requirements.
Bring your current governance architecture documentation. We will show you exactly which failure surfaces our verification stack closes—and which gaps remain in what you have today.
Standards posture
Standards posture represents design intent and framework alignment. Type approval and homologation support documentation available on request. Formal certification requires engagement with a notified body.