Using simplicity to control complexity

2 min read

Sha argues that building diverse, redundant versions of complex software does not by itself buy reliability, because a fixed budget split three ways gives three weaker versions. What helps is a small, simple, verifiable core that guarantees the critical requirements while the complex part delivers performance. For control systems this becomes the Simplex architecture: a high-assurance controller (classical, verified, conservative) and a high-performance controller (anything, including learned components), with decision logic that hands control to the safe one before the plant state leaves a recovery region. The recovery region is a Lyapunov ellipsoid inside the polytope of operating constraints, found with linear matrix inequalities, so that once the safe controller takes over the state stays admissible and converges to the set-point.

I could not get the article itself. This note is from the abstract and a course summary of the paper, so treat the details as second-hand.

Findings

  • The paper frames feedback control as forward recovery: you correct errors after they happen instead of trying to prevent every one.
  • The switching rule cannot be the constraint boundary itself (you cannot stop a car just before the wall). It has to be a set from which the safe controller provably recovers.
  • Demonstrated on an inverted pendulum testbed, where new control software can be uploaded while the system runs, and the safe controller takes back control when a buggy upload degrades performance.

Limits

  • The guarantee needs a plant model good enough to compute the recovery region. Where no precise model exists (chemical processes, for example) the region has to be found experimentally.
  • The safe controller and the decision logic must themselves be correct, and they trust the state measurement. A spoofed sensor fools the switch as easily as the controller.
  • Recovery means returning to a set-point. For a robot with a mission, holding a set-point can be the same as stopping.

Relevance

Simplex is the ancestor of most runtime assurance in robotics: SOTER adds a principled switch back to the advanced controller, shields and shielded RL do the same with automata, and CBF safety filters replace the switch with a continuous correction. See runtime monitoring, safe control and failure recovery.