SOTER: A Runtime Assurance Framework for Programming Safe Robotics Systems

3 min read

SOTER is a publish-subscribe programming language for robot software with Simplex-style runtime assurance built in. An RTA module pairs an uncertified advanced controller (AC) with a certified safe controller (SC) and a decision module (DM) that the compiler generates. Every period the DM asks whether the system could leave the safe set within under any control; if so it hands control to the SC. It hands control back once the state is inside a smaller set from which the system stays safe for under any controller. Modules compose, so a whole stack (planner, motion primitives, battery) can be protected one component at a time.

Findings

  • Theorem 3.1: a well-formed module (period, safety, liveness and switch-back conditions stated as reachability properties) keeps every reachable state in the safe set. Theorem 4.1 extends this to compositions of modules.
  • Drone case study (3DR Iris with PX4, plus Gazebo): going from g1 to g4 takes 10 s with the unsafe AC alone (which can collide), 14 s with the RTA module, and 24 s with the SC alone.
  • 104 hours of software-in-the-loop simulation, about 1505 km flown: 109 disengagements where an SC took over and avoided a failure, and the AC was in control more than 96% of the time.
  • There were 34 crashes. In all of them the DM did switch, but the SC was not scheduled in time. The authors expect a real-time OS to fix this.
  • Battery module: switch to a certified landing planner when charge minus the worst-case discharge falls below the charge needed to land. Return to AC only above 85%.

Limits

  • The guarantee rests on trusted state estimators and an accurate reachability model; the authors assume the estimators “accurately provide the system state within bounds”. A spoofed or faulty estimate breaks the argument.
  • Obstacles are static and known, with no wind.
  • The choice of trades conservatism against reaction time, and the timing assumption is what failed in the 34 crashes. Deployment on a real-time OS is future work.
  • Recovery here means “hand the wheel to a safe controller” and, for the battery, land. The paper leaves open what should happen when the safe controller itself cannot make progress on the mission.

Relevance

SOTER is one of the few runtime-assurance designs with a principled switch back to the advanced controller, a step most robots skip; see runtime monitoring and failure recovery. It builds directly on Simplex, and its safe controllers come from reachability, the same family as CBF-based safety filters.