Perception · Taj

Perception that admits
what it doesn't know.

Taj builds the world model Kirra governs against — and every stage is designed around the honest failure: a corridor that can only shrink under uncertainty, redundancy that treats disagreement as a fault, and derates that stop the vehicle instead of guessing.

The corridor pipeline

Fusion may tighten. Never loosen.

Phase A derives a geometric drivable corridor and objects from lidar. Phase B fuses semantic hazards — water, obstacles — and may only clip the corridor tighter. The rule “fusion may never extend Phase A” is a hard zero in CI: a single ForbiddenLoosen differential row fails the gate.

Hazard clipping

clip_corridor_to_hazards finds the binding hazard and pulls the corridor's far edge in. The safety-weighted eval harness scores every frame as UnsafeMiss, OverConservative, or Correct — because a miss and an over-caution are not the same kind of wrong.

crates/kirra-taj

Differential gating

Phase A vs Phase B run over a shared ground-truth corpus with per-fault-family negative controls that must breach — proving the gate can actually see the fault class it claims to catch.

crates/kirra-kpi-gateci/scenario_kpi_thresholds.json

Plausibility guard

Before objects reach the checker, a kinematic-plausibility contract bounds them — teleporting or physically impossible tracks are rejected, with the guard's worst case under its own WCET CI gate.

crates/kirra-core/src/perception_monitor.rssrc/wcet_gate.rs:139

True redundancy

Two channels must agree — or the ego stops

A single perception stack fails silently. Kirra's divergence monitor requires two independent channels to agree: a phantom, a miss, a speed mismatch, or a silent secondary all resolve to a zero-speed minimum-risk cap. Losing redundancy is itself a fault.

True-redundancy perception cross-check Two independent perception channels feed a cross-check. Agreement passes through. A phantom object, a missed object, a speed mismatch, or a silent secondary channel all resolve to a zero-speed minimum-risk cap. Channel A primary objects Channel B independent secondary cross_check agree ⇒ pass through agreement phantom · miss · mismatch · silence Checker sees objects normal RSS evaluation Speed cap → 0.0 m/s MRC floor via apply_perception_cap

crates/kirra-trajectory/src/perception_redundancy.rs:224crates/kirra-core/src/perception_monitor.rsdocs/adr/0018-perception-divergence-monitor.md

Derate-only composition: every predictive perception bound — redundancy, occlusion, VRU — is fail-closed and derate-only. Absent input is a no-op (the Nominal hot path is byte-identical); a fault is a speed cap toward stillness, never a relaxation. The WCET-critical per-pose path is unchanged.

Vulnerable road users

Armed and silent means stop

The pedestrian channel has three states, resolved by a pure function: disarmed — the checker no-ops; armed and fresh — a live pedestrian scene feeds an omnidirectional bound; armed but silent — an MRC-floor cap. A dead pedestrian sensor stops the vehicle; it never lets it drive blind.

crates/kirra-trajectory/src/vru_channel.rscrates/kirra-trajectory/src/vru.rsdocs/safety/PEDESTRIAN_RSS.md

On real hardware

The perception path runs on the ROSMASTER R2 testbed: a TG30 lidar at ~10 Hz feeding the corridor pipeline on a Jetson Orin NX — the same code paths exercised in CI, validated during the July 2026 bring-up.

robot/install/README.mddocs/adr/0015-rosmaster-r2-perception-layer.md

Freshness is configuration

Every subscription carries a staleness budget (KIRRA_SUBSCRIPTION_STALENESS_MS). Feeds degrade explicitly — a stale tracker yaw quietly downgrades prediction to constant-velocity rather than trusting old rotation data.

crates/kirra-trajectory/src/prediction.rs:199

READ THE SOURCE

Perception is a safety input, not a demo.

Read the corridor pipeline, the redundancy monitor, and the eval harness that scores unsafe misses differently from over-caution.

View the repository Browse the documentation