Context-dependent Runtime Construction of Safe Regions of Attraction from Design-Time Identification for Multi-Candidate Simplex Architectures

Georg Jäger; Nils-Jonathan Friedrich; Norman Seyffer; José Cecílio; António Casimiro

cs.ROOct 26, 2026

Context-dependent Runtime Construction of Safe Regions of Attraction from Design-Time Identification for Multi-Candidate Simplex Architectures

Authors: Georg Jäger, Nils-Jonathan Friedrich, Norman Seyffer, José Cecílio, António Casimiro

Organizations: Faculty of Mathematics and Computer Science, TU Bergakademie Freiberg, Freiberg, Germany · LASIGE, Faculty of Sciences, University of Lisbon, Lisbon, Portugal

Abstract

Deploying safety-critical cyber-physical systems requires control strategies that reconcile high performance and adaptability with rigorous safety guarantees. Classical control strategies offer stability proofs but are conservative, while advanced optimization- and learning-based controllers achieve high performance but lack formal verification. Runtime Assurance (RTA) architectures bridge this gap by introducing their own (dis-)advantages. Safety filters use online optimization and introduce chattering, while Simplex permissiveness is bounded by the tightness of the certified Region of Attraction (RoA) of its High-Assurance (HA) controller. Targeting this conservatism, we present a two-stage RoA certification procedure leveraging contraction-based stability to establish a target set for Taylor-model-based reachability analysis. We then treat the closed-loop system under HA control as a switched system, enabling: (a) runtime construction of context-dependent safe RoA and (b) safe switching between HA candidates to optimize recovery and maximize the operating envelope of the uncertified High-Performance (HP) controller. We validate this framework on a robotic path-tracking task using a three-stage evaluation: Ordinary Differential Equation (ODE) simulation for theoretical verification, high-fidelity Gazebo simulation under unmodeled dynamics, and experiments on physical hardware. Results show that the Simplex architecture maintains safety under fault injection and successfully shields a behavioral-cloning-trained HP controller. Crucially, the decision module introduces negligible overhead (0.028 ms average, 4.13 ms worst-case), consuming under 10 % of the control period.

Figures & tables

$\gamma_{i}$	$v_{\text{des}}$ [m/s]	$L_{\text{min}}$ [m]	$t_{h}$ [s]	$R_{\text{min}}$ [m]	Safe Cells
$\gamma_{4}$	1.00	0.35	1.00	0.30	752
$\gamma_{15}$	1.50	0.70	0.70	0.30	664

TABLE I : Summary of roa Calculations

Panel of Figure 3 — Fig. 4 : Exemplary trajectory during ode -based simulation for $C_{RPP,\gamma 4,\gamma_{15}}$ showing recovery into the safe roa

Config.	$T_{\text{HA}}$ [s]			$\|e_{y}\|_{\text{switch}}$ [m]			$\|e_{y}\|_{\text{max}}$ [m]
Config.	Min	Mean	Max	Min	Mean	Max	$\|e_{y}\|_{\text{max}}$ [m]
(1) $\gamma_{4}$	0.500	2.819	4.450	0.001	0.406	0.601	0.982
(2) $\gamma_{15}$	0.700	2.337	4.450	0.000	0.392	0.656	0.964
(3) $\{\gamma_{4},\gamma_{15}\}$	0.800	2.463	4.400	0.001	0.439	0.706	0.967
(RO) $\{\gamma_{4},\gamma_{15}\}$	0.450	2.414	4.300	0.001	0.438	0.678	0.977

TABLE II : Summary of ODE-based Monte-Carlo Simplex Simulation Results (

N=1000

Runs per Row)

Panel of Figure 5 — Fig. 5 : Gazebo simulation visualized by RViz2 with active failure injection. Green indicates the reference path, red is the ground truth provided by Gazebo, blue is the localization as seen by the robot.

Config.	$h$	$\alpha=0.8$		$\alpha=0.9$		$\alpha=1.0$
Config.	$h$	$\max(\|e_{y}\|)$	$\mu(\|e_{y}\|)$	$\max(\|e_{y}\|)$	$\mu(\|e_{y}\|)$	$\max(\|e_{y}\|)$	$\mu(\|e_{y}\|)$
$\gamma_{15}$	$1$	2.445	0.631	3.275	0.642	2.661	0.605
$\gamma_{15}$	$2$	1.690	0.544	1.657	0.566	1.693	0.553
$\gamma_{15}$	$5$	1.187	0.489	1.220	0.490	1.149	0.501
$\gamma_{15}$	$10$	0.774	0.314	0.670	0.295	0.812	0.367
$\gamma_{15}$	$15$	0.452	0.199	0.404	0.208	0.458	0.204

TABLE III : Summary of Gazebo simulation for circular path (

\kappa_{\text{ref}}=0.2

) with varying prediction horizons

h

and hysteresis thresholds

\alpha

Config.	$h$	$\kappa_{\text{ref}}=0.2$			$\kappa_{\text{ref}}=0.5$			$\kappa_{\text{ref}}=0.9$
		$e_{y}^{\max}$	$N_{\text{a}}/N_{\text{v}}$	$\bar{T}_{\text{HA}}$	$e_{y}^{\max}$	$N_{\text{a}}/N_{\text{v}}$	$\bar{T}_{\text{HA}}$	$e_{y}^{\max}$	$N_{\text{a}}/N_{\text{v}}$	$\bar{T}_{\text{HA}}$
$\gamma_{15}$	1	5.40	6/2	5.3	7.20	11/4	4.9	9.46	3/3	19.6
$\gamma_{15}$	5	1.87	5/3	4.9	2.31	7/5	5.3	2.13	6/6	6.4
$\gamma_{15}$	10	0.94	28/0	3.1	0.87	11/0	2.1	0.62	6/0	8.8
$\gamma_{15}$	15	0.52	6/0	2.0	0.68	11/0	3.2	0.42	4/0	12.7
$\gamma_{4}$	1	6.40	6/5	12.0	8.54	8/3	7.0	11.44	2/2	24.5

TABLE IV : Real-world path-tracking results under reference curvatures

\kappa_{\text{ref}}\in\{0.2,0.5,0.9\}

across different prediction horizons

h

e_{y}^{\max}

is the maximum lateral deviation (

\mathrm{m}

N_{\text{a}}/N_{\text{v}}

is the number of active ha interventions / safety violations, and

\bar{T}_{\text{HA}}

is the mean intervention duration (

\mathrm{s}

$\max(T_{\text{HA}})$ [s]	$\max(\|e_{y}\|)$ [m]
0.850	0.3741
1.050	0.3877
0.751	0.4109

TABLE V : Simplex metrics under BC (

h=12

), skipping first/last blocks.

Safety-Critical Control

Safety-critical control designs controllers that keep physical systems within hard safety constraints despite uncertainty, disturbances, and limited actuation.

See all 128 papers

Conformal Recovery-Deadline Certificates for Runtime Assurance of Adapting Controllers
Jun 24, 2026Alireza ShojaeiSafety-Critical Control Conformal Prediction
Myers-Lawson School of Construction, Virginia Tech, Blacksburg, VA 24061 USA
Synergistic Simplex: Cooperative Runtime Assurance for Safety-Critical Autonomous Systems
May 5, 2026Ayoosh Bansal, Mikael Yeghiazaryan, Artyom Khachatryan +4Safety-Critical Control Autonomous Driving
University of Illinois Urbana-Champaign (UIUC), Urbana, IL, USA · Center for Scientific Innovation and Education (CSIE), Yerevan, Armenia · California Institute of Technology (Caltech), Pasadena, CA, USA +1
RTD-RAX: Fast, Safe Trajectory Planning for Systems under Unknown Disturbances
Mar 23, 2026Evanns Morales-Cuadrado, Long Kiu Chung, Shreyas Kousik +1Safe Motion Planning Motion Planning
S. Coogan is also with the School of Civil and Environmental Engineering.

Jun 24, 2026J/K move · Enter open · S save

Conformal Recovery-Deadline Certificates for Runtime Assurance of Adapting Controllers

Alireza Shojaei

Myers-Lawson School of Construction, Virginia Tech, Blacksburg, VA 24061 USA

Safety-Critical Control Conformal Prediction Conformal Risk Control Runtime Assurance Adaptive Control

Open paper AskPDF arXiv

Runtime assurance (RTA) protects a safety-critical system by switching from an advanced controller to a verified safe controller when a monitored condition is violated. The standard latching rule, which trips on the first breach of the safe set and then coasts, is correct for a diverging controller but pathological for a capable online-adapting one. Such a controller is unsafe by design during a bounded recovery transient. It must excite the plant to identify the fault before it can correct it, so a latching shield trips on that transient and suppresses a controller that would have recovered. We introduce the conformal recovery-deadline certificate, a split-conformal, distribution-free, finite-sample upper bound on the adapting controller's recovery time that licenses delayed fallback with a coverage guarantee, backstopped by a verified monitor at a hard critical limit. The certified deadline discriminates capable from incapable controllers, keeping the recoverer autonomous while catching the diverger. The construction separates autonomy, governed by statistical coverage, from safety, governed by the verified backstop, as an instance of reliability-asymmetric design. We prove marginal coverage, a weighted extension that restores coverage under a known fault-distribution shift, and group-conditional Mondrian coverage. We demonstrate all three on two unrelated Simplex testbeds: a 6-DOF spacecraft attitude controller and a torque-controlled inverted pendulum. Both show the same suppression pathology and the same cure, making the certificate a domain-general mechanism rather than a single-system trick.

Abstract

Safety-Critical Control

Explore similar work

Conformal Recovery-Deadline Certificates for Runtime Assurance of Adapting Controllers

Synergistic Simplex: Cooperative Runtime Assurance for Safety-Critical Autonomous Systems

RTD-RAX: Fast, Safe Trajectory Planning for Systems under Unknown Disturbances