Context-dependent Runtime Construction of Safe Regions of Attraction from Design-Time Identification for Multi-Candidate Simplex Architectures

Georg Jäger; Nils-Jonathan Friedrich; Norman Seyffer; José Cecílio; António Casimiro

cs.ROOct 26, 2026

Context-dependent Runtime Construction of Safe Regions of Attraction from Design-Time Identification for Multi-Candidate Simplex Architectures

Authors: Georg Jäger, Nils-Jonathan Friedrich, Norman Seyffer, José Cecílio, António Casimiro

Organizations: Faculty of Mathematics and Computer Science, TU Bergakademie Freiberg, Freiberg, Germany · LASIGE, Faculty of Sciences, University of Lisbon, Lisbon, Portugal

Abstract

Deploying safety-critical cyber-physical systems requires control strategies that reconcile high performance and adaptability with rigorous safety guarantees. Classical control strategies offer stability proofs but are conservative, while advanced optimization- and learning-based controllers achieve high performance but lack formal verification. Runtime Assurance (RTA) architectures bridge this gap by introducing their own (dis-)advantages. Safety filters use online optimization and introduce chattering, while Simplex permissiveness is bounded by the tightness of the certified Region of Attraction (RoA) of its High-Assurance (HA) controller. Targeting this conservatism, we present a two-stage RoA certification procedure leveraging contraction-based stability to establish a target set for Taylor-model-based reachability analysis. We then treat the closed-loop system under HA control as a switched system, enabling: (a) runtime construction of context-dependent safe RoA and (b) safe switching between HA candidates to optimize recovery and maximize the operating envelope of the uncertified High-Performance (HP) controller. We validate this framework on a robotic path-tracking task using a three-stage evaluation: Ordinary Differential Equation (ODE) simulation for theoretical verification, high-fidelity Gazebo simulation under unmodeled dynamics, and experiments on physical hardware. Results show that the Simplex architecture maintains safety under fault injection and successfully shields a behavioral-cloning-trained HP controller. Crucially, the decision module introduces negligible overhead (0.028 ms average, 4.13 ms worst-case), consuming under 10 % of the control period.

Figures & tables

$\gamma_{i}$	$v_{\text{des}}$ [m/s]	$L_{\text{min}}$ [m]	$t_{h}$ [s]	$R_{\text{min}}$ [m]	Safe Cells
$\gamma_{4}$	1.00	0.35	1.00	0.30	752
$\gamma_{15}$	1.50	0.70	0.70	0.30	664

TABLE I : Summary of roa Calculations

Panel of Figure 3 — Fig. 4 : Exemplary trajectory during ode -based simulation for $C_{RPP,\gamma 4,\gamma_{15}}$ showing recovery into the safe roa

Config.	$T_{\text{HA}}$ [s]			$\|e_{y}\|_{\text{switch}}$ [m]			$\|e_{y}\|_{\text{max}}$ [m]
Config.	Min	Mean	Max	Min	Mean	Max	$\|e_{y}\|_{\text{max}}$ [m]
(1) $\gamma_{4}$	0.500	2.819	4.450	0.001	0.406	0.601	0.982
(2) $\gamma_{15}$	0.700	2.337	4.450	0.000	0.392	0.656	0.964
(3) $\{\gamma_{4},\gamma_{15}\}$	0.800	2.463	4.400	0.001	0.439	0.706	0.967
(RO) $\{\gamma_{4},\gamma_{15}\}$	0.450	2.414	4.300	0.001	0.438	0.678	0.977

TABLE II : Summary of ODE-based Monte-Carlo Simplex Simulation Results (

N=1000

Runs per Row)

Panel of Figure 5 — Fig. 5 : Gazebo simulation visualized by RViz2 with active failure injection. Green indicates the reference path, red is the ground truth provided by Gazebo, blue is the localization as seen by the robot.

Config.	$h$	$\alpha=0.8$		$\alpha=0.9$		$\alpha=1.0$
Config.	$h$	$\max(\|e_{y}\|)$	$\mu(\|e_{y}\|)$	$\max(\|e_{y}\|)$	$\mu(\|e_{y}\|)$	$\max(\|e_{y}\|)$	$\mu(\|e_{y}\|)$
$\gamma_{15}$	$1$	2.445	0.631	3.275	0.642	2.661	0.605
$\gamma_{15}$	$2$	1.690	0.544	1.657	0.566	1.693	0.553
$\gamma_{15}$	$5$	1.187	0.489	1.220	0.490	1.149	0.501
$\gamma_{15}$	$10$	0.774	0.314	0.670	0.295	0.812	0.367
$\gamma_{15}$	$15$	0.452	0.199	0.404	0.208	0.458	0.204

TABLE III : Summary of Gazebo simulation for circular path (

\kappa_{\text{ref}}=0.2

) with varying prediction horizons

h

and hysteresis thresholds

\alpha

Config.	$h$	$\kappa_{\text{ref}}=0.2$			$\kappa_{\text{ref}}=0.5$			$\kappa_{\text{ref}}=0.9$
		$e_{y}^{\max}$	$N_{\text{a}}/N_{\text{v}}$	$\bar{T}_{\text{HA}}$	$e_{y}^{\max}$	$N_{\text{a}}/N_{\text{v}}$	$\bar{T}_{\text{HA}}$	$e_{y}^{\max}$	$N_{\text{a}}/N_{\text{v}}$	$\bar{T}_{\text{HA}}$
$\gamma_{15}$	1	5.40	6/2	5.3	7.20	11/4	4.9	9.46	3/3	19.6
$\gamma_{15}$	5	1.87	5/3	4.9	2.31	7/5	5.3	2.13	6/6	6.4
$\gamma_{15}$	10	0.94	28/0	3.1	0.87	11/0	2.1	0.62	6/0	8.8
$\gamma_{15}$	15	0.52	6/0	2.0	0.68	11/0	3.2	0.42	4/0	12.7
$\gamma_{4}$	1	6.40	6/5	12.0	8.54	8/3	7.0	11.44	2/2	24.5

TABLE IV : Real-world path-tracking results under reference curvatures

\kappa_{\text{ref}}\in\{0.2,0.5,0.9\}

across different prediction horizons

h

e_{y}^{\max}

is the maximum lateral deviation (

\mathrm{m}

N_{\text{a}}/N_{\text{v}}

is the number of active ha interventions / safety violations, and

\bar{T}_{\text{HA}}

is the mean intervention duration (

\mathrm{s}

$\max(T_{\text{HA}})$ [s]	$\max(\|e_{y}\|)$ [m]
0.850	0.3741
1.050	0.3877
0.751	0.4109

TABLE V : Simplex metrics under BC (

h=12

), skipping first/last blocks.

Safety-Critical Control

Safety-critical control designs controllers that keep physical systems within hard safety constraints despite uncertainty, disturbances, and limited actuation.

See all 128 papers

Jun 24, 2026

Conformal Recovery-Deadline Certificates for Runtime Assurance of Adapting Controllers

Runtime assurance (RTA) protects a safety-critical system by switching from an advanced controller to a verified safe controller when a monitored condition is violated. The standard latching rule, which trips on the first breach of the safe set and then coasts, is correct for a diverging controller but pathological for a capable online-adapting one. Such a controller is unsafe by design during a bounded recovery transient. It must excite the plant to identify the fault before it can correct it, so a latching shield trips on that transient and suppresses a controller that would have recovered. We introduce the conformal recovery-deadline certificate, a split-conformal, distribution-free, finite-sample upper bound on the adapting controller's recovery time that licenses delayed fallback with a coverage guarantee, backstopped by a verified monitor at a hard critical limit. The certified deadline discriminates capable from incapable controllers, keeping the recoverer autonomous while catching the diverger. The construction separates autonomy, governed by statistical coverage, from safety, governed by the verified backstop, as an instance of reliability-asymmetric design. We prove marginal coverage, a weighted extension that restores coverage under a known fault-distribution shift, and group-conditional Mondrian coverage. We demonstrate all three on two unrelated Simplex testbeds: a 6-DOF spacecraft attitude controller and a torque-controlled inverted pendulum. Both show the same suppression pathology and the same cure, making the certificate a domain-general mechanism rather than a single-system trick.

Alireza Shojaei

Myers-Lawson School of Construction, Virginia Tech, Blacksburg, VA 24061 USA

Safety-Critical Control Conformal Prediction Conformal Risk Control Runtime Assurance Adaptive Control

Ask PDF

May 5, 2026

Synergistic Simplex: Cooperative Runtime Assurance for Safety-Critical Autonomous Systems

Autonomous systems increasingly rely on machine-learning (ML) components for safety-critical tasks such as perception and control in autonomous vehicles (AVs). While ML enables essential capabilities, it inevitably exhibits long-tail faults that make it unsuitable for safety-critical tasks. Runtime assurance (RTA) mitigates this issue by pairing ML components with verifiable safety monitors, e.g., Control Simplex and Perception Simplex architectures. However, the limited performance of safety monitors remains a major bottleneck. The Synergistic Simplex (SS) architecture improves system performance by enabling bidirectional integration between ML components and safety monitors while preserving formal safety guarantees. The key innovation here is allowing safety monitors to use ML outputs, which is typically prohibited in RTA systems. We formally derive conditions under which this integration preserves safety and demonstrate the performance benefits. We present the design, analysis, and evaluation of SS for AV obstacle detection.

Ayoosh Bansal, Mikael Yeghiazaryan, Artyom Khachatryan +4

University of Illinois Urbana-Champaign (UIUC), Urbana, IL, USA · Center for Scientific Innovation and Education (CSIE), Yerevan, Armenia · California Institute of Technology (Caltech), Pasadena, CA, USA +1

Safety-Critical Control Autonomous Driving Autonomous Driving Perception Runtime Assurance

Ask PDF

Mar 23, 2026

RTD-RAX: Fast, Safe Trajectory Planning for Systems under Unknown Disturbances

Reachability-based Trajectory Design (RTD) is a provably safe, real-time trajectory planning framework that combines offline reachable-set computation with online trajectory optimization. However, standard RTD implementations suffer from two key limitations: conservatism induced by worst-case reachable-set overapproximations, and an inability to account for real-time disturbances during execution. This paper presents RTD-RAX, a runtime-assurance extension of RTD that utilizes a non-conservative RTD formulation to rapidly generate goal-directed candidate trajectories, and utilizes mixed monotone reachability for fast, disturbance-aware online safety certification. When proposed trajectories fail safety certification under real-time uncertainty, a repair procedure finds nearby safe trajectories that preserve progress toward the goal while guaranteeing safety under real-time disturbances.

Evanns Morales-Cuadrado, Long Kiu Chung, Shreyas Kousik +1

S. Coogan is also with the School of Civil and Environmental Engineering.

Safe Motion Planning Motion Planning Trajectory Optimization Runtime Assurance Reachability Analysis

Ask PDF

Abstract

Safety-Critical Control

Explore similar work

Conformal Recovery-Deadline Certificates for Runtime Assurance of Adapting Controllers

Synergistic Simplex: Cooperative Runtime Assurance for Safety-Critical Autonomous Systems

RTD-RAX: Fast, Safe Trajectory Planning for Systems under Unknown Disturbances