Safety Assurance for Autonomous Systems at Design Time and Runtime
Name
edwards-blakete-sm-aeroastro-2026-thesis.pdf
Size
3.8 MB
Format
Adobe PDF
Checksum (MD5)
3c11246ff58d0658d089fadfbe1e05e4
Author(s)
Edwards, Blake T.
Advisor(s)
How, Jonathan P.
Date Issued
May 2026
Publisher
Massachusetts Institute of Technology
Abstract
Autonomous systems deployed in safety-critical domains require assurance that they will satisfy their mission requirements. This assurance is needed across the system lifecycle: at design time, where the architecture determines which safety properties admit feasible formal verification, and at runtime, where the controller must remain safe as the environment shifts.
At design time, architecture-driven assurance toolchains such as BriefCASE verify component-level contracts and confirm structural compliance, but these checks can pass even when the architecture lacks domain axioms needed for the system-level property to hold. The design is correct but not sufficient. At runtime, latent safety filters enforce constraints via Hamilton-Jacobi reachability in learned world models, but existing methods represent epistemic uncertainty as a single global scalar over the full latent state. Under partial distributional shift, this global signal mixes informative and uninformative sources of uncertainty, triggering excessive intervention that degrades task performance with no accompanying safety benefit.
This thesis presents two contributions addressing these gaps. First, we introduce the Mechanized Sufficiency Engine (MSE), a pre-verification sufficiency layer for AADL-based architecture-driven assurance that checks grounding (that formalized requirements are anchored in the architecture) and sufficiency (that the design enforces them via SMT-backed bounded model checking). Demonstrated on the AFRL OpenUxAS architecture within the BriefCASE pipeline, the MSE identifies missing domain axioms (unbounded communication latency that permits a 5 km geofence breach, missing re-attestation that permits unbounded message staleness), and the proofs close once each MSE-identified missing axiom is added. Second, we introduce decomposed latent safety filtering, which factors the safety value function per-subsystem using object-centric world models with per-subsystem uncertainty. On a vision-based robotic manipulation task under partial distributional shift, the decomposed filter outperforms the prior state of the art across all conditions, preserving up to 61 percentage points more task completion at equal or lower violation rates and composing to additional constraints with no further training.
MIT Department
Massachusetts Institute of Technology. Department of Aeronautics and Astronautics
Terms of Use
In Copyright - Educational Use Permitted
Copyright retained by author(s)
Persistent DSpace Link
