Response to Subsequent Functions when an Abnormality is Detected in the Sensor Input

[Motsu-san]

Background

The system has an abnormality detection function to make the system fail safe against an abnormality related to localization.
Currently, the Autoware input stage (vehiclle_interface) does not perform basic signal checks of LiDAR point cloud, velocity, and angular velocity (out of range, sudden fluctuation, sticking, etc.).
There are a need to comply with ISO 26262 etc., and such functions are expected to be added in the future.

As the title says, I would like to know how sensor components should response to subsequent functions when an abnormality is detected in the sensor input stage.
Is there any autoware guideline against sensor abnormalities?

Ideas

In localization, when an abnormality in velocity, angular velocity, or point cloud is detected, it is desirable to “not output TOPIC”.
The localization components already have a system that alerts us if a topic does not come in, and TIER IV L/M think that it is fail safe to have it disconnected, rather than to continue to use the inputs or intermediate outputs that is likely to be broken in other modules.