GNSS / IMU / vehicle abstraction
Sensors and vehicle context
OwnsRaw observation, validity and clock
Must not inferInvalid evidence never becomes a default location or moving state
AutoBuild your programPublic reference architecture
Embedded Navigation
One authoritative route across IVI, cluster, HUD and degraded operation.
Keep raw, fused, matched and route position distinct; bind content and runtime compatibility; derive every cockpit surface from one route revision.
Authority by layer
Know which component owns the state—and what it must never infer.
Every layer exposes an authoritative responsibility and an explicit non-authority boundary.
FW-01
Location
OwnsFused position, uncertainty and ranked map candidates
Must not inferMatch confidence remains separate from raw evidence
FW-02
Route and guidance
OwnsActive route revision, maneuver sequence and progression
Must not inferA display cannot create or advance a route
APP-01 / cluster / HUD
Cockpit projections
OwnsMoving-state presentation and user intent
Must not inferSecondary surfaces are derived and independently immutable
End-to-end operating flow
State advances through evidence—not optimistic UI.
Each transition names both the action and the identity or version evidence that makes it reproducible.
- 01
Qualify position
Fuse current observations and publish uncertainty plus candidate context.
sensor profile · clock · confidence · map version - 02
Calculate alternatives
Use compatible installed content, vehicle profile and declared online context.
route IDs · objective · content/runtime versions - 03
Activate
Accept one exact alternative against context and plan revisions.
route revision · actor · moving policy - 04
Guide
Progress ordered maneuvers without claiming physical delivery or driver compliance.
sequence · position basis · validity - 05
Reroute or arrive
Create immutable lineage from the prior route and preserve terminal evidence.
trip ID · prior/new route · reason · clocks
Contract families
Interfaces that a production program must own.
Location
Raw/fused/matched position, confidence, source clocks and candidates.
Routing
Alternatives, objectives, costs, assumptions and content lineage.
Guidance
Active revision, maneuver sequence, lane/junction and reroute events.
Surfaces
Moving IVI, cluster, HUD, audio and companion projections.
Designed degradation
Failure states stay truthful and useful.
Flyover or parallel-road ambiguity
Retain candidates and withhold confident route progression until evidence resolves.
Tunnel / GNSS loss
Use bounded dead reckoning, grow uncertainty and expire rather than coast indefinitely.
Cloud/traffic unavailable
Continue the installed offline route and label stale/absent live context.
Content incompatibility
Do not calculate or activate a route; retain last compatible active content.
Security & privacy controls
Privilege follows the narrowest useful boundary.
- ✓Least-privilege signal profiles and vehicle adapters
- ✓Signed compatible map/content/runtime artifacts
- ✓Moving-state interaction policy from qualified vehicle evidence
- ✓No arbitrary cloud text or data enters safety-relevant projections
- ✓Privacy-safe route/location replay with bounded retention
Release evidence
A green demo is not a production acceptance case.
- 01Golden routes and deterministic replay by territory/profile
- 02Urban canyon, flyover, tunnel and reacquisition scenarios
- 03Moving/parked HMI, accessibility and distraction evidence
- 04Content/runtime/vehicle-profile compatibility matrix
- 05Boot, memory, thermal, storage and rollback tests on target IVI
Independently scopeable products
Compose the system without collapsing product ownership.
Each product can be bought and operated independently while sharing identity, context and lifecycle contracts.
OEM program workshop
Turn the Embedded Navigation reference into your program architecture.
Confirm target products, vehicle and cloud boundaries, source systems, contract versions, deployment, validation and lifecycle ownership.