Buy the Recovery Boundary, Not the Compute Peak
An accelerator hang must not take vehicle control down with the perception workload it serves. Before committing to a central vehicle computer, require the vendor to trace that failure through memory access, scheduling, reset propagation and actuator command ownership. The procurement risk lies in resources that appear partitioned in software but remain coupled in hardware.
Make the containment boundary visible
Ask the vendor to identify every resource shared by the AI accelerator and the safety control partition, then expose the risk behind that question: a hung workload can retain access to resources that the surviving function still needs. A hypervisor can separate processor execution and an input output memory management unit can constrain device access, but neither alone establishes bounded interference on shared memory or guarantees that outstanding device transactions can be retired. Require an annotated dependency map covering memory arbitration, interrupt routing, device drivers, reset domains and the supervision path, with each claimed containment boundary tied to implementation evidence. Automotive functional safety evidence under ISO 26262 should support the claimed freedom from interference for the delivered configuration, rather than merely establish that an individual component has suitable development credentials. Separate hardware can strengthen containment, but its value depends on whether the allegedly independent control path still relies on the central computer for data, supervision or command authorization.
Independence ends at the actuator
Ask which controller retains actuator authority while the accelerator is unavailable, because a fallback partition that needs the affected compute domain to validate its inputs or release its commands provides no independent path to continued control.
Put a deadline on usable control
Ask the vendor to demonstrate a bounded transition to degraded control, exposing the difference between restarting a process and restoring a function the vehicle can safely use. For a procurement test, specify an illustrative acceptance target of 50 ms from the injected accelerator hang to a valid fallback command at the actuator interface, subject to replacement by the timing allocation from the vehicle safety analysis. That interval must include detection, isolation, authority transfer and command delivery, while the test also establishes that fallback inputs remain fresh enough for the intended operating condition. An AUTOSAR Adaptive application reporting readiness proves neither that its dependencies are usable nor that the zonal network and receiving controller have accepted the new command source. Keeping fallback execution continuously active reduces dependence on restart and state reconstruction, but consumes reserved compute and communication capacity during normal operation, which the vendor must include in its performance offer.
Demand evidence that survives the quotation
With limited lab access, ask for a witnessed injection of the accelerator hang under representative concurrent workloads, accompanied by synchronized traces from the supervisor, surviving control function and actuator interface. The risk is a demonstration that measures recovery inside the central computer while omitting the downstream authority transfer that determines whether the vehicle remains controllable. Require the supplier to disclose the injection mechanism, since terminating an application does not establish how a hardware accelerator hang interacts with transactions already issued, and to bind the evidence to the offered hardware, hypervisor configuration and resource reservations. Apply one decision rule: retain the architecture only if the supplied evidence shows that the fallback path delivers valid commands within the allocated deadline without depending on the affected domain. If that evidence is unavailable, the next purchase decision is whether to fund an independent control path or narrow the functions entrusted to the central computer, accepting the corresponding cost or capability limit.