# Certified Control: An Architecture for Verifiable Safety of Autonomous Vehicles

arXiv: https://arxiv.org/abs/2104.06178 · HTML: https://mlsanity.com/paper/2104.06178/

## Key facts

- Cited by 5 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 29 Mar 2021.

## Built on by (most cited first, 5 of 5)

- [Architecting Safer Autonomous Aviation Systems](https://mlsanity.com/paper/2301.08138/) (2023)
- [Certified Control for Train Sign Classification](https://mlsanity.com/paper/2311.09778/) (2023)
- [Outline of an Independent Systematic Blackbox Test for ML-based Systems](https://mlsanity.com/paper/2401.17062/) (2024)
- [Using Formal Models, Safety Shields and Certified Control to Validate AI-Based Train Systems](https://mlsanity.com/paper/2411.14374/) (2024)
- [Probabilistic Modelling of Operational Design Domains, A New Approach for Testing AI Systems](https://mlsanity.com/paper/2609.24397/) (2026)

## Abstract (arXiv)

Widespread adoption of autonomous cars will require greater confidence in their safety than is currently possible. Certified control is a new safety architecture whose goal is two-fold: to achieve a very high level of safety, and to provide a framework for justifiable confidence in that safety. The key idea is a runtime monitor that acts, along with sensor hardware and low-level control and actuators, as a small trusted base, ensuring the safety of the system as a whole. Unfortunately, in current systems complex perception makes the verification even of a runtime monitor challenging. Unlike traditional runtime monitoring, therefore, a certified control monitor does not perform perception and analysis itself. Instead, the main controller assembles evidence that the proposed action is safe into a certificate that is then checked independently by the monitor. This exploits the classic gap between the costs of finding and checking. The controller is assigned the task of finding the certificate, and can thus use the most sophisticated algorithms available (including learning-enabled software); the monitor is assigned only the task of checking, and can thus run quickly and be smaller and formally verifiable. This paper explains the key ideas of certified control and illustrates them with a certificate for LiDAR data and its formal verification. It shows how the architecture dramatically reduces the amount of code to be verified, providing an end-to-end safety analysis that would likely not be achievable in a traditional architecture.