💻 computer science

Formally Guaranteed Control Adaptation for ODD-Resilient Autonomous Systems

This paper introduces a control adaptation approach for autonomous systems that dynamically extends their operational capabilities to handle out-of-ODD scenarios while simultaneously providing formal quantitative guarantees to ensure reliable performance under unforeseen conditions.

Original authors: Gricel Vázquez, Calum Imrie, Sepeedeh Shahbeigi, Nawshin Mannan Proma, Tian Gan, Victoria J Hodge, John Molloy, Simos Gerasimou

Published 2026-04-10

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Gricel Vázquez, Calum Imrie, Sepeedeh Shahbeigi, Nawshin Mannan Proma, Tian Gan, Victoria J Hodge, John Molloy, Simos Gerasimou

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you are teaching a self-driving boat how to navigate a busy harbor. You spend months training it, showing it every possible scenario it might face: other boats passing by, calm waters, foggy mornings, and even a few unexpected seagulls. You define a "Safe Zone" (called the Operational Design Domain, or ODD) where the boat knows exactly what to do.

But here's the problem: The real world is messy. What happens if the boat suddenly encounters a giant, speeding cargo ship it was never trained on? Or a sudden, violent storm? The boat's "Safe Zone" map is now useless. It's like a driver who only learned to drive in a parking lot suddenly finding themselves on a highway during a blizzard. They might panic, freeze, or make a dangerous mistake.

This paper introduces a solution called SAVE (Situation-Aware Verification and control synthEsis). Think of SAVE as a super-smart, real-time co-pilot that doesn't just follow a map, but constantly redraws the map while driving to keep you safe.

Here is how it works, broken down into simple concepts:

1. The "Situation Grid" (The Map)

Before the boat even leaves the dock, SAVE creates a giant grid of "what-if" scenarios. It breaks the ocean down into tiny boxes based on things like:

How many other boats are nearby?
How fast are they moving?
How much time do we have before we crash?

It then runs thousands of simulations to figure out the odds of crashing in each box. This creates a Probabilistic Model—basically, a weather forecast for safety. It tells the boat: "If you are in this specific box, there is a 95% chance you are safe, but a 5% chance you might hit a rock."

2. The "Criticality Score" (The Danger Meter)

When the boat is out on the water, SAVE constantly checks its location on this grid. It assigns a Criticality Score to the current situation.

Low Score: "All clear! Keep cruising."
High Score: "Danger! We are entering a zone where the rules we learned no longer apply."

If the score gets too high, it means the boat has drifted into an "Out-of-ODD" situation—something it wasn't explicitly trained for, or the conditions have changed too much.

3. The "Emergency Brake" (The Adaptation)

This is where SAVE is truly special. In older systems, if the boat got confused, it might just stop or crash because it didn't know what to do.

SAVE acts like a smart traffic controller. When it detects a high danger score:

It stops the old plan: It says, "The controller we are using right now is unsafe for this specific situation."
It builds a wall: It mathematically "blocks off" that dangerous path. Imagine a construction crew instantly putting up a barrier around a pothole so the car cannot drive into it.
It invents a new plan: It quickly calculates a new set of rules (a new controller) that avoids that specific danger. It might tell the boat: "Don't try to pass the big ship; instead, slow down and wait."

4. The "Proof of Safety" (The Guarantee)

The coolest part is that SAVE doesn't just guess. It uses a mathematical method called Probabilistic Model Checking. Think of this as a safety inspector who runs a super-fast simulation in the boat's brain before the boat actually moves.

The inspector checks: "If we take this new path, is there a 0% chance of violating our safety rules?"

If Yes: The boat takes the new path.
If No: The inspector tries a different path.

This happens in milliseconds. The boat is constantly checking, adapting, and re-checking, ensuring that even in a chaotic, unpredictable storm, it never does something that violates its core safety rules.

The Real-World Test

The authors tested this on a simulated autonomous ship. They threw "curveballs" at it—like suddenly making a nearby ship move 50% faster than expected.

The Old Way (Baseline): The ship got confused, violated safety rules, and eventually collided.
The SAVE Way: The system spotted the danger, realized its current plan was broken, blocked off the dangerous route, and switched to a safer, slower maneuver. It avoided the crash every time.

The Bottom Line

SAVE is like a self-driving system that admits when it's out of its depth. Instead of blindly following a script that might kill it, it pauses, looks at the new reality, mathematically proves a new safe path exists, and then takes it. It turns the scary unknown of "what if something goes wrong?" into a manageable, solvable math problem, ensuring that autonomous systems can survive the unexpected.

1. Problem Statement

Autonomous systems (AS) are designed to operate safely within a predefined Operational Design Domain (ODD). However, real-world environments are dynamic and complex, leading to situations where the system encounters conditions outside its ODD (out-of-ODD).

The Challenge: When an AS encounters out-of-ODD conditions, its behavior becomes inherently uncertain because the design-time models no longer apply.
Limitations of Current Approaches:
- Static Updates: Redesigning or retraining the system at runtime is often infeasible due to cost and time constraints.
- Runtime Verification (RV): Existing RV methods can detect deviations from expected behavior but lack a framework to dynamically adapt the system's underlying models to safely handle new situations while providing formal quantitative guarantees.
- Safety Risk: Without adaptation, the system may violate safety requirements, leading to catastrophic failures in safety-critical domains (e.g., maritime, healthcare).

2. Methodology: The SAVE Approach

The authors propose SAVE (Situation-Aware Verification and control synthEsis), an ODD-driven, situation-centric approach that integrates probabilistic modeling, model checking, and runtime adaptation. The approach follows a MAPE-K (Monitor, Analyze, Plan, Execute, Knowledge) loop structure.

A. Pre-Deployment Phase

SCG Augmentation (Situation Coverage Grid):
- The ODD is decomposed into a discrete set of situations (defined as $n$ -tuples of attribute values).
- An SCG is generated to represent these situations.
- Augmentation: Transition probabilities between situations are derived from empirical test data. Failures are explicitly modeled as "sink states."
- Model Generation: A set of Discrete-Time Markov Chains (DTMCs) is generated, where each DTMC represents the system starting from a specific situation.
Critical Situations Analysis:
- Probabilistic Model Checking (PMC): Tools like PRISM are used to verify safety properties (e.g., "Probability of failure < 0.99") against the DTMCs.
- Criticality Scoring: A metric is calculated based on the degree of property violation. A score of 0 indicates compliance; higher scores indicate greater deviation from safety bounds.
- Outcome: Stakeholders identify and prioritize the most critical situations to refine controllers before deployment.

B. Deployment Phase (Runtime Adaptation)

Monitoring (M): The system continuously monitors the current situation ( $\rho_t$ ) and detects failures ( $\xi$ ).
Model Update & Analysis (A):
- Transition probabilities in the SCG are updated using frequentist or Bayesian approaches based on new runtime data.
- The system re-evaluates the criticality score of the current situation using PMC.
- Decision Logic: If the criticality score indicates a violation (score > 0), the system triggers adaptation.
Controller Synthesis (P):
- Iterative Exclusion: The system identifies the situation with the worst criticality score.
- Barrier Creation: The transitions leading to this critical situation are removed (set to probability 0), effectively turning that state into a "sink" or barrier.
- Re-evaluation: The criticality scores of all remaining situations are recalculated. This cycle repeats until all active situations satisfy safety requirements or a maximum iteration limit is reached.
- Selection: If multiple safe controllers exist, the one minimizing the probability of reaching out-of-ODD situations is selected.
Execution (E): The newly synthesized, verified-safe controller is deployed to the managed system.

3. Key Contributions

Novel Situation-Centric Framework: A method that extracts situations directly from the ODD to generate probabilistic models, enabling the synthesis of controllers with formal quantitative guarantees on safety and performance.
Dynamic Criticality Assessment: A mechanism for encoding probabilistic transitions between encountered situations and failures, incorporating a criticality score metric that drives data-driven updates to transition probabilities.
Runtime Verification-Driven Adaptation Loop: A closed-loop system that detects safety violations at runtime and synthesizes updated controllers that remain safe even under ODD drift, preventing the system from entering unsafe states.

4. Results and Evaluation

The authors evaluated SAVE using a Maritime Autonomous Surface Ship (MASS) case study involving collision avoidance with two types of crewed vessels.

Effectiveness (RQ1): In experiments with 20 variants of out-of-ODD perturbations (e.g., increased vessel velocity), SAVE successfully avoided requirement violations in 14 out of 20 cases (70%), whereas the baseline (fixed controller) failed in all cases.
Adaptation (RQ2): In a specific scenario where a baseline system predicted a collision within 50 timesteps, SAVE detected the risk, adapted the controller to exclude the high-risk situation, and prevented the collision entirely, satisfying both safety properties ( $\Phi_1$ and $\Phi_2$ ) post-adaptation.
Scalability (RQ3):
- The number of states in the model increases linearly with the number of situations.
- The number of transitions increases exponentially (worst-case scenario where every state connects to every other state).
- Despite this, execution times for generating criticality scores suggest the approach is feasible for runtime verification in critical systems, though optimization for large-scale systems is noted as future work.

5. Significance

Bridging the Gap: SAVE bridges the gap between design-time verification and runtime adaptation, ensuring that safety guarantees hold even when the system encounters unforeseen conditions.
Formal Guarantees: Unlike heuristic adaptation methods, SAVE provides mathematically proven (via PMC) safety guarantees for the adapted controller.
Resilience: The approach allows autonomous systems to degrade gracefully (by blocking unsafe paths) rather than failing catastrophically when operating outside their original design domain.
Traceability: It establishes explicit traceability between the ODD, testing data, and runtime verification, a feature often missing in existing self-adaptive frameworks.

In conclusion, SAVE demonstrates that autonomous systems can be made resilient to ODD violations by dynamically adapting their control logic based on formal verification of probabilistic models, ensuring continued safe operation in unpredictable environments.