fail-operational vehicle architecture