3. Safety-relevant response characteristics

Correlation corridor selection is not a search for the "most similar" signal in an abstract sense. It is the act of binding a safety-relevant response to the evidence that justifies it, under a deadline, with a known and bounded set of failure modes. Four characteristics dominate that decision: how fast the response must be produced, how repeatable the timing must be, how the system behaves when evidence is missing or contradictory, and what it costs when the binding is wrong. These four are coupled — tightening one usually loosens another — so corridor selection is fundamentally a trade-off design, not a lookup.

Latency constraints: the budget, not the average

Every safety-relevant response has a deadline derived from the hazard analysis. If a protective action must be asserted within 40 ms of the hazardous condition appearing, that 40 ms is the total budget, and it must be decomposed across the entire chain: sensor sampling, transport, correlation, decision, and actuation. Correlation does not get the whole budget; it gets the remainder after everything else is accounted for.

A useful discipline is to write the budget as an explicit allocation rather than a single number. Consider a representative example (illustrative values, not measured results): a 40 ms response deadline, with 6 ms for sensor acquisition and transport, 4 ms reserved for actuation and output stage, and 5 ms of scheduling and jitter margin. That leaves 25 ms for correlation and decision. Within that 25 ms, the corridor search must complete — including the worst case, not the typical case.

The critical distinction is between mean latency and worst-case latency. A corridor search that averages 3 ms but occasionally takes 60 ms is unusable for a 25 ms budget, because the occasional case is exactly the one that coincides with the hazard. Corridor width, candidate count, and window length all drive worst-case cost: a wider corridor admits more candidates, a longer correlation window requires more history, and both increase the tail. The practical rule is to size the corridor so that the worst-case search fits the residual budget with margin, and to reject any corridor design whose tail cannot be bounded.

Determinism: bounded and repeatable, not merely fast

Determinism means that for the same input sequence and the same internal state, the correlation result and its timing are identical on every execution. This matters more than raw speed because safety arguments are built on reproducible behavior: a response that is correct 99.9% of the time and late the rest cannot be certified by reasoning about the average.

Three sources of non-determinism typically intrude on corridor selection. First, data-dependent iteration: a search that terminates early when it finds a match has a runtime that depends on the input, so the worst case is the no-match case. Second, dynamic allocation and unbounded queues: memory pressure or queue depth changes the timing in ways that are hard to bound. Third, shared-resource contention: correlation running on a general-purpose core alongside other tasks inherits their scheduling jitter.

The engineering response is to make the corridor search statically bounded. Fix the candidate set size at design time, iterate over all candidates regardless of early match, preallocate all buffers, and place the correlation task in a time-triggered or priority-ceiling schedule where its worst-case execution time is known. A deterministic 8 ms is worth more than a variable 2–30 ms, because only the former can be subtracted from a deadline with confidence.

When reviewing a corridor design, ask for the worst-case execution time and the conditions that produce it. If the answer is "typically a few milliseconds," the design is not yet deterministic — it is merely usually fast.

Fault tolerance: behavior when evidence is absent or contradictory

Correlation inputs fail in characteristic ways: a sensor drops out, a timestamp arrives stale, two sources disagree, or the corridor contains no candidate above threshold. Fault tolerance is the specification of what the response does in each of these cases, decided in advance rather than discovered at runtime.

A workable structure separates three outcomes. Confirmed correlation — a candidate satisfies both the value and timing criteria — permits the safety response to proceed. Ambiguous correlation — candidates exist but none clears the threshold, or multiple candidates tie — should route to a defined degraded mode, typically the conservative action with an annunciation, rather than silently selecting the best-scoring candidate. Absent correlation — no candidate at all, or stale data — must be distinguished from "no hazard," because treating missing evidence as a negative result is a classic and dangerous error.

Fault tolerance also requires that the corridor itself be robust to a single bad source. If two independent measurements feed the correlation and one is faulty, the design should either detect the disagreement and flag it, or use a voting or plausibility scheme so that one corrupt input cannot drag the correlation into a false confirmation. The corridor width interacts directly here: a corridor wide enough to tolerate sensor drift is also wide enough to admit a wrong candidate, so tolerance and discrimination pull against each other.

The cost of mis-correlation

Mis-correlation has two directions, and they are not symmetric. A false positive binds the response to the wrong evidence: the system asserts a protective action when the true hazard is elsewhere or absent. A false negative fails to bind: the hazard is present but the corridor does not confirm it, and the response is withheld or delayed. In safety terms the false negative is usually the more severe, because it defeats the protection entirely, while the false positive typically costs availability and may itself create a hazard through spurious actuation.

The cost is therefore measured in both safety and availability, and corridor selection is where that balance is struck. Narrowing the corridor reduces false positives but raises false negatives under drift and noise; widening it does the reverse. The defensible approach is to set the corridor from the characterized uncertainty of the sources — sensor accuracy, timestamp resolution, expected drift — and then verify the resulting false-positive and false-negative rates against the hazard analysis, rather than tuning the corridor until the demonstration passes.

Correlation corridor trade-off: latency budget, determinism, fault tolerance, and mis-correlation cost A diagram showing a response deadline decomposed into budget segments, a corridor width axis trading false positives against false negatives, and three correlation outcomes routed to permitted, degraded, and conservative responses. Response deadline budget (example: 40 ms) Acquire + transport 6 ms Correlation + decision (residual budget) worst case must fit here — 25 ms Actuate 4 ms Jitter margin 5 ms t = 0 (hazard appears) t = 40 ms (response required) Corridor width trade-off corridor width (tolerance) → error rate false negatives ↓ false positives ↑ operating point Correlation outcomes Confirmed value + timing pass Ambiguous below threshold / tie Absent no candidate / stale Response permitted within deadline Degraded mode conservative + annunciate Never treat as "no hazard" flag missing evidence Design rule Set corridor width from characterized source uncertainty, then verify false-positive and false-negative rates against the hazard analysis. Bound the worst-case search statically; a deterministic 8 ms beats a variable 2–30 ms when the residual budget is 25 ms.

Putting the four characteristics together

The four characteristics are not independent knobs. Widening the corridor to improve fault tolerance against drift increases the candidate set, which raises worst-case search time and threatens the latency budget; it also raises false positives, which costs availability. Making the search deterministic by evaluating all candidates regardless of early match also raises the worst-case time, consuming the same budget. Every relaxation in one dimension must be paid for in another, and the payment should be explicit.

A practical selection procedure follows from this. First, derive the residual correlation budget from the response deadline and reserve margin for jitter. Second, characterize the source uncertainty — sensor accuracy, timestamp resolution, expected drift — and set the initial corridor width from it. Third, bound the candidate set and search cost statically so the worst case fits the residual budget. Fourth, define the three outcome paths (confirmed, ambiguous, absent) and verify that absent evidence never maps to "no hazard." Fifth, compute or bound the false-positive and false-negative rates at the chosen operating point and check them against the hazard analysis. If the rates are unacceptable, adjust the corridor and repeat — but adjust with the trade-off in view, not by tuning until a demonstration passes.

The recurring failure mode in practice is optimizing one characteristic in isolation. A team tightens the corridor to eliminate spurious trips and quietly raises the false-negative rate; or adds a fallback path for missing evidence that treats absence as a negative result; or accepts a variable-latency search because it is fast on average. Each of these looks like a local improvement and is a systemic regression. The discipline of corridor selection is to hold all four characteristics in view at once and to document, for the chosen operating point, the latency bound, the determinism argument, the fault-handling behavior, and the mis-correlation cost.

Treating "no candidate found" as equivalent to "no hazard present" is the single most consequential mis-correlation error. Absent evidence is a fault condition requiring a defined response, not a negative measurement.
← Previous 📖 Contents Next →