A body pose model that scores well on keypoint accuracy has told you almost nothing about whether it behaves safely when a passenger is half-hidden behind a deployed airbag flap, a child is folded sideways in a booster seat, or a pedestrian is truncated at the frame edge in low light. That gap — between nominal accuracy and safe behaviour under the conditions the function will actually meet — is where most automotive pose-estimation validation packs get sent back for a clarification round. The usual approach treats body pose estimation as a self-contained accuracy problem. You train a keypoint model, report PCK on a benchmark, and assume the number satisfies whatever integrity level the function inherited. That works right up until a reviewer reads the function’s ASIL as a statement about how its failures propagate — and asks for evidence you never planned to produce. How does body pose estimation work? Body pose estimation is the task of locating a person’s anatomical landmarks — shoulders, elbows, wrists, hips, knees — from an image or video, and connecting them into a skeleton that describes posture. In automotive perception it answers questions object detection cannot: is the occupant leaning into the airbag deployment zone, is a pedestrian’s gait suggesting they are about to step off the curb, is the driver’s head and torso oriented toward the road. Mechanically, most modern pose estimators fall into two families. Top-down methods first detect a person (often with a detector in the YOLO or DETR lineage) and then regress keypoints inside that box — accurate when the detection is clean, but fragile when the box is wrong. Bottom-up methods detect all keypoints in the frame first and then group them into individuals, which degrades more gracefully in crowded or partially occluded scenes but costs more in the grouping step. Frameworks like OpenPose popularised the bottom-up route; most production stacks today run a top-down keypoint head trained in PyTorch and exported through ONNX or TensorRT for the target inference hardware. The practical meaning is that a pose model is a chain of decisions — detect, crop, regress, group — and each link has its own failure surface. A single number summarising the last link tells you nothing about the first. What outputs does a pose model produce, and how are they measured? The output of a pose model is a set of keypoints, each with an image coordinate and a confidence score, wired together into a skeleton with a defined joint topology. The confidence channel is the part teams most often ignore and reviewers most often ask about, because it is the model’s own signal about when it is uncertain — and uncertainty handling is exactly what higher integrity levels demand. Accuracy is typically reported with metrics like PCK (Percentage of Correct Keypoints), which counts a keypoint as correct if it lands within a threshold distance of ground truth, and OKS-based average precision, which weights keypoints by their expected localisation difficulty. These are useful engineering metrics. They are also aggregate metrics computed on curated benchmark distributions — and, as we cover in what each machine learning performance metric actually proves, an aggregate that pools easy and hard cases hides precisely the tail behaviour a safety reviewer cares about. Quick answer — what PCK does and does not tell you. PCK reports the fraction of predicted keypoints within a distance threshold of ground truth on a chosen dataset (benchmark-class evidence, only as strong as the dataset it was measured on). It does not tell you how the model localises those keypoints under occlusion, how confidence collapses in low light, or whether a mislocated joint produces a confident-but-wrong output that a downstream restraint decision will act on. Those are separate measurements the metric was never designed to carry. Where does body pose estimation appear in automotive perception? Two places dominate. Inside the cabin, occupant monitoring uses pose to estimate posture, seating position, and out-of-position states that change how a restraint system should behave — this is the same evidence discipline we describe for in-cabin sensing and how ASIL shapes what it must show. Outside the vehicle, vulnerable-road-user perception uses pose to read pedestrian and cyclist intent — a torso rotation or a raised arm can precede a movement a bounding box alone cannot anticipate. Both use cases share a structural property that matters more than the model architecture: the pose estimate feeds a decision that can act on the physical world. When that decision is airbag suppression or an automatic braking input, the pose function inherits an integrity level, and the integrity level rewrites what its validation must demonstrate. How does a pose function’s ASIL change the evidence its validation pack must carry? ASIL is not a difficulty rating for the model. It is a classification of how badly things go if the function fails — the product of the hazard’s severity, the exposure of the driving situation, and the controllability of the outcome. A pose function whose error can suppress an airbag for an in-position occupant, or trigger a hard brake for a misread pedestrian, sits at a higher ASIL precisely because a keypoint error can propagate to a hazardous behaviour. The reframe is this: your pose function’s ASIL is a statement about failure propagation, and your validation pack owes evidence structured around that propagation — not around nominal accuracy. A reviewer at a higher ASIL expects to see how the model behaves under occlusion, truncation, and low light; how fault detection catches a keypoint the confidence channel flagged as unreliable; how the function degrades gracefully instead of emitting a confident wrong answer; and how a bad estimate is rolled back before it reaches the actuator. A pack that offers PCK alone triggers the clarification cycle a reviewer-structured pack avoids. This is the same logic we walk through in machine learning and automotive safety demands — the integrity level determines the evidence, not the other way round. Which failure modes does a reviewer expect degradation evidence for? The failure modes that survive benchmark evaluation are the ones a curated dataset under-represents. For pose estimation those cluster into a predictable set, and structuring evidence around them is what proportionate validation looks like. Failure mode Why the benchmark misses it Evidence the ASIL implies Occlusion (airbag flap, seatbelt, other occupants) Benchmarks favour clean full-body views How keypoint confidence drops and whether occluded joints are suppressed vs. hallucinated Truncation (frame edge, close crop) Datasets crop around whole people Behaviour when only a partial skeleton is visible; no fabricated off-frame joints Low light / IR-only cabin Test sets skew to daylight RGB Degradation curve across illumination; whether confidence tracks the real drop Unusual postures (child folded, sleeping, reaching) Long-tail postures are rare in training data Fault detection for out-of-distribution poses rather than a confident wrong estimate Motion blur Static-frame benchmarks under-sample it Temporal stability and whether a blurred frame is flagged or trusted The evidence class matters here: the failure-mode coverage above is an observed-pattern across automotive perception engagements, not a benchmarked leaderboard result. It describes where packs get sent back, not a guaranteed defect rate for any specific model. Where does pose accuracy stop asserting anything about safe behaviour? This is the divergence point, and it is worth stating plainly. Keypoint accuracy asserts something about localisation on the distribution it was measured on. It asserts nothing about what the function does when localisation fails. A model can post excellent PCK and still emit a confident, well-localised-looking skeleton for a posture it has never seen — and a downstream restraint or braking logic has no way to know the estimate is fiction unless the pack demonstrated the fault-detection and degradation path. That gap is why the validation pack, not the accuracy report, is the artifact that carries safety meaning. The pack has to show fault detection, graceful degradation, and rollback for the specific failure modes the ASIL implies. This maps directly onto the cross-vertical reliability discipline of a production AI monitoring harness — the same fault-detection-and-degradation evidence surface, graded to an automotive integrity demand. It is also the reliability argument we generalise in our work on perception failure modes that survive benchmarks, where the recurring lesson is that the tail, not the mean, decides whether a function is safe. How can pose estimation support monitoring without a people-surveillance framing? Occupant monitoring reads posture to protect the person in the seat — not to identify or track them. The distinction is architectural, not rhetorical. A well-scoped in-cabin pose function estimates seating state and out-of-position risk, uses the output transiently for a restraint or attention decision, and does not persist identity-linked skeletal records. Keeping the function scoped to the safety decision it serves is what separates occupant protection from surveillance, and it is a scoping choice the validation pack should make explicit rather than leave implied. FAQ What matters most about body pose estimation in practice? It locates a person’s anatomical landmarks — shoulders, elbows, hips, knees — from an image and connects them into a skeleton describing posture. Top-down methods detect a person then regress keypoints inside the box; bottom-up methods detect all keypoints then group them. In practice it is a chain of detect–crop–regress–group decisions, each with its own failure surface, which is why one summary number tells you little. What outputs does a pose-estimation model produce, and how are they measured? Each keypoint carries an image coordinate and a confidence score, wired into a skeleton with a defined joint topology. Accuracy is reported with metrics like PCK (fraction of keypoints within a distance threshold) and OKS-based average precision. These are aggregate benchmark metrics; the confidence channel — the model’s own uncertainty signal — is the output most relevant to safety and most often overlooked. Where does body pose estimation appear in automotive perception? Two dominant places: in-cabin occupant monitoring, where pose estimates seating position and out-of-position states that change restraint behaviour; and vulnerable-road-user perception, where pose reads pedestrian or cyclist intent that a bounding box cannot anticipate. Both feed decisions that can act on the physical world, so the pose function inherits an integrity level. How does a pose function’s ASIL change the evidence its validation pack must carry? ASIL classifies how badly the function’s failure propagates, not how hard the model is. A higher ASIL means a keypoint error can reach a hazardous restraint or braking behaviour, so the reviewer expects evidence of occlusion, truncation, and low-light behaviour, fault detection, graceful degradation, and rollback — not just nominal keypoint accuracy. A pack offering PCK alone triggers a clarification round. What failure modes does a reviewer expect degradation and fault-detection evidence for? Occlusion (airbag flaps, seatbelts, other occupants), truncation at the frame edge, low-light or IR-only cabin conditions, unusual long-tail postures such as a folded child or a reaching occupant, and motion blur. These are the cases curated benchmarks under-represent, so the reviewer wants to see how confidence drops and whether the model suppresses uncertain joints rather than hallucinating them. Where does pose-estimation accuracy stop asserting anything about safe behaviour? Accuracy asserts something about localisation on the measured distribution and nothing about what happens when localisation fails. A model can score well on PCK yet emit a confident, plausible-looking skeleton for a posture it has never seen. The validation pack — showing fault detection, degradation, and rollback — is the artifact that carries safety meaning, not the accuracy report. How can body pose estimation support monitoring without a people-surveillance framing? By scoping the function to the safety decision it serves. Occupant monitoring estimates seating state and out-of-position risk, uses the output transiently for a restraint or attention decision, and does not persist identity-linked skeletal records. Keeping the function scoped to protection rather than identification is what separates it from surveillance, and the pack should make that scope explicit. The practical takeaway is a scoping discipline, not a modelling trick: read the pose function’s ASIL first, then decide what to measure. Test failure-mode coverage proportionate to the integrity demand — occlusion, truncation, low light, out-of-distribution posture — rather than over-indexing on a benchmark number that was never designed to answer the reviewer’s real question. The teams that do this see fewer clarification rounds and less late rework, because the pack demonstrates the behaviour the ASIL implied instead of forcing the reviewer to ask for it.
