Conformal Recovery-Deadline Certificates for Runtime Assurance of Adapting Controllers

Runtime assurance (RTA) typically uses a 'latching' rule: if a controller violates a safety condition, the system immediately switches to a verified fallback controller and stays there. While this is effective for controllers that are diverging, it is pathological for online-adapting controllers. These controllers often need to perform a 'diagnostic probe'—a temporary, bounded excursion outside the safe set—to identify and correct for faults. A standard latching shield interprets this necessary diagnostic behavior as a failure, permanently suppressing the controller and potentially dismantling the very recovery process it was designed to protect.

To resolve this, the author proposes a conformal recovery-deadline certificate. Instead of reacting to the instantaneous state of the system, the shield uses a statistical upper bound on the controller's recovery time. This deadline is calculated using split-conformal inference, a distribution-free method that provides a rigorous coverage guarantee (e.g., 95% confidence that the controller will recover within the deadline).

This approach creates a 'reliability-asymmetric' design. The autonomy of the adapting controller is governed by the statistical certificate, while the safety of the system remains governed by a verified backstop (a hard critical limit). If the controller fails to recover within the certified deadline, the verified backstop triggers, ensuring that safety is never compromised regardless of the statistical performance of the certificate.

This mechanism allows for the safe deployment of high-performance, adaptive controllers in safety-critical environments like spacecraft or robotics. By distinguishing between a controller that is 'recovering' and one that is 'diverging,' the system can maintain autonomy for capable controllers while still providing a formal safety guarantee. The author demonstrates that this is a domain-general mechanism, showing consistent results across both a 6-DOF spacecraft attitude controller and a torque-controlled inverted pendulum.