AIAA SciTech Forum 10.2514/6.

2023-0696
23-27 January 2023, National Harbor, MD & Online
AIAA SCITECH 2023 Forum

Run-Time Assurance via Real-time Generation of Backup

Trajectories and Transverse Dynamics Regulation Laws

Ibrahim Alomar∗
King Abdulaziz City for Science and Technology, Riyadh, Saudi Arabia

Fatema Alhani†
King Abdullah University of Science and Technology, Thuwal, Saudi Arabia

Abdulaziz Alfaadehl‡
King Abdulaziz City for Science and Technology, Riyadh, Saudi Arabia

Eric Feron§
Downloaded by Ibrahim Alomar on January 14, 2025 | http://arc.aiaa.org | DOI: 10.2514/6.2023-0696

King Abdullah University of Science and Technology, Thuwal, Saudi Arabia

Hesham Shageer¶
King Abdulaziz City for Science and Technology, Riyadh, Saudi Arabia

Mohamad Shahab‖
King Abdullah University of Science and Technology, Thuwal, Saudi Arabia

In safety or mission-critical environments, Run-Time Assurance is about performing actions

with full consciousness of opt-out options and the willingness to exercise such options when
they are about to run-out. This paper proposes a new framework for run time assurance for
nonlinear dynamical systems that enjoy intelligent interaction with complex environments. This
framework exploits the concept of transverse dynamics to compute closed-loop control laws for
"Plan B" trajectories in complex obstacle environments in real-time, thereby increasing the
confidence in their value, should they be used. Three-state and six-state examples illustrate the
approach in complex obstacle environments.

I. Nomenclature

𝑥 = State vector
𝑥f = Final state vector
𝑠 = Arc length and progression state
𝑥r (.) = Reference trajectory vector
𝑇 (.) = progression direction unit vector
𝑁𝑖 (.) = 𝑖th orthonormal vector
𝑂 (.) = The matrix [𝑁1 𝑁2 ...𝑁 𝑛−1 ] (.)
𝑢 r (.) = Reference control vector
𝑢 b (𝑥) = Backup controller
𝑓 = Dynamics
𝑓T = Transverse Dynamics
𝜌 = Transverse state vector

∗ Researcher, Center of Excellence for Aeronautics and Astronautics, Riyadh 11442, ibrahimalimer@gmail.com, corresponding author.
† Student, Electrical and Computer Engineering, Thuwal 23955, fatema.alhani@gmail.com
‡ Researcher, Center of Excellence for Aeronautics and Astronautics, Riyadh 11442, aalfaadhel@kacst.edu.sa
§ Professor, Electrical, Computer, and Mechanical Engineering, Thuwal 23955, AIAA Fellow, eric.feron@kaust.edu.sa
¶ Assistant Professor, Joint Centers of Excellence Program, Riyadh 11442, hshageer@kacst.edu.sa
‖ Postdoctoral Research Fellow, Electrical and Computer Engineering, Thuwal 23955, mohamad.shahab@kaust.edu.sa

Copyright © 2023 by King Abdulaziz City for Science and Technology. Published by the American Institute of Aeronautics and Astronautics, Inc., with permission.
 II. Introduction
ith the vast promise of autonomous systems across different sectors such as transportation, aerospace, and robotic
W surgery to name a few, the need to assure safety of these systems when integrated with advanced control system
designs is higher than ever. One available method to maintain safety guarantees is Run-Time Assurance (RTA), defined
in [1] as “a proposed online verification methodology to allow unproven autonomous controllers to perform within a
predetermined envelope of acceptable behavior.” RTA provides a real-time mechanism to handle control system failures
before they rise to preserve the system’s safety when needed; the system architecture may switch control to a more
reliable backup controller when the system reaches a pre-defined limit. An important quality of an RTA system is that
the assurance mechanism can be constructed in a way that is entirely agnostic to the underlying structure of the primary
controller[2]. Unlike other safety mechanisms, Run-Time Assurance does not require exhaustive validation of its proper
functioning by systematic exploration of the state-space. One advantage of using RTA is that it eliminates the need to
design a complex primary control structure that rises to the needed safety standards. As a result, RTA is now considered
to be a valid safety backup system for autonomous and semi-autonomous systems [3],[4],[5],[6],[7]; It can be used in
different applications such as manned and unmanned vehicles, aircraft, and space robotics. In this paper, a framework
for Run-Time Assurance is proposed via real-time trajectory generation and using transverse dynamics for designing
Downloaded by Ibrahim Alomar on January 14, 2025 | http://arc.aiaa.org | DOI: 10.2514/6.2023-0696

the control law. The core principle behind Run-Time Assurance is that it only takes over control if there is a failure in
generating a new trusted backup trajectory.
In the context of this paper, developing the RTA requires the fast generation of guidance laws. Many trajectory
generation algorithms prove highly successful in both industry and research settings. See, for example, the reviews [8]
and [9]. See also recent instances of trajectory generation algorithms, such as Lossless convexification (LCvx) [10] and
Guaranteed Sequential Trajectory Optimisation (GuSTO) [11], which will be used later in this paper. In general however,
we consider trajectory generation to be a black box planner; this allows us to use any trajectory generation algorithm
to support RTA, provided it can be used in real-time. As will soon be seen, such planners may even be failure-prone
without endangering the safety of the system.
The process of regulating the system to follow the generated trajectory can be achieved via different design
approaches, such as point-to-point control, reference point tracking, the Frenet-Serret frame, or transverse dynamics. In
point-to-point or waypoint-based motion control, e.g. [12], the objective is to ensure that, at a finite set of prescribed
time instants, the system output matches a corresponding set of desired values; however, in point-to-point approaches,
a full trajectory is not generated for all times, which is essential for Run-Time Assurance. The Frenet-Serret frame
[13] describes the kinematic properties of a moving plant along a continuous, differentiable curve in 3-dimensional
space, which can be a convenient frame for curve tacking with a low torsion rate. However, the curve formulas [14] are
described in terms of derivatives of the tangent, normal, and bi-normal vectors to the curve; this sometimes results in a
change in the axis of motion which makes it inconsistent for tracking. Transverse dynamics [15], which is inspired by
and generalizes the Frenet frame concept, expresses the system dynamics in a new set of coordinates, where the desired
trajectory acts as "the origin" or, putting it more rigorously, an invariant 1-dimensional set. Using the framework of the
transverse dynamics, we can easily construct smooth linear-like dynamics that govern the evolution of the system along
the reference trajectory. Following that step, we can then quickly compute trusted feedback laws [12].
The simultaneous generation of backup trajectories and tracking feedback laws forms the foundation of the RTA
discussed in this paper. There exist numerous alternate approaches for integrated real-time trajectory generation and
tracking, such as [16],[17], [18], which could have been used as well.
Summarizing, the RTA approach taken in this paper is to generate backup trajectories together with trajectory
regulation laws in real-time. These trajectories are ready for execution when "loss of safety" is anticipated, which
manifests itself precisely by the impossibility of creating such regulated backup trajectories in the near future. The need
for anticipating the trajectory of the system under consideration to verify the continued presence of a backup trajectory
with the desired trajectories can either be assumed by the predictability of the primary guidance algorithm, on the one
hand, or via short-term, model-based trajectory extrapolation, on the other hand.
The high-level algorithmic approach to generate backup trajectories and their regulation laws for Run-Time Assurance
purposes follows the steps below, each of which will be discussed in detail later in this paper.
1) Generate a reference trajectory, taking system from current state to "safe state" together with the corresponding
reference control input,
2) Derive the transverse dynamics with respect to the reference trajectory,
3) Design a trajectory regulation mechanism from the transverse dynamics,
4) Identify RTA triggering criteria.
It is perhaps easiest to begin with setting the RTA triggering criterion: Run time assurance should be triggered as

2
 soon as the system fails to compute properly regulated backup strategies. The possible reasons for failing to compute
regulated backup trajectories are many, one of them being the presence of an obstacle that cannot be avoided anymore.
However, other valid reasons are explored in this paper.
In section III, this paper introduces the problem statement, which is followed by the adopted methodology to address
it. The details of the work begin with the trajectory generation process in section IV, followed by a discussion of the
transverse dynamics in section V. The regulation law and backup trajectory are then discussed in section VI. Finally, in
section VII, examples of the framework are discussed in detail.

III. Problem statement and solution approach

A. Problem statement
We consider the general dynamical system
𝑑𝑥
= 𝑓 (𝑥, 𝑢), (1)
𝑑𝑡
Downloaded by Ibrahim Alomar on January 14, 2025 | http://arc.aiaa.org | DOI: 10.2514/6.2023-0696

where 𝑥 ∈ R𝑛 is the system’s state and 𝑢 ∈ R 𝑝 is a control variable. We assume the function 𝑓 : R𝑛 × R 𝑝 → R𝑛 is
sufficiently regular so as not to pose issues with existence and unicity of solutions to (1). In applied contexts, this format
may capture a single or multiple vehicles, homogeneous or heterogeneous, and many other scenarios. The control input
𝑢 may be nominally produced by a high-level guidance algorithm, or it may also be the input generated by a human
operator. We consider "dangerous areas" defined by specific constraints on the state and control variables of the generic
form
𝑔(𝑥, 𝑢) ≤ 0. (2)
Such a general constraint format is sufficient to capture many practical requirements, such as minimum or maximum
speed constraints, collision avoidance constraints, and others. We are interested in meeting the following requirement:
Add a control mechanism, named Run-Time Assurance (RTA) to make sure that the constraints 2 are satisfied while
minimizing the intrusiveness of this control logic relative to the nominal inputs. Thus, in a way similar to a gentle
driving instructor, the RTA mechanism only claims full control when it is about to run out of "backup options". It then
executes the current "backup option" and steers the system towards a state deemed to be "permanently safe", named
𝑥recovery . A trivial extension of the material presented in this paper is extending 𝑥recovery to mean a set of permanently
safe states, e.g. obstacle-free states whose velocity components are zero.

Fig. 1 RTA Framework Fig. 2 Trusted Backup

Figure 1 describes a generic abstracted architecture for RTA in a block diagram form, similar to the Simplex
Architecture [2]. The "Arbitrary Controller" is an arbitrary agent acting on the plant with its desired control 𝑢 des . The
agent may be an arbitrary computer-based control structure or a human operator. The "Closed-Loop Backup Control Law
Generator" serves the pivotal purposes of planning a trajectory to a safe state in real-time and generating a closed-loop
trajectory regulation law. The "decision logic" decides on the value of the control 𝑢. In its simplest form, this value

3
 is nominally the output of the arbitrary controller 𝑢 des . It is precisely when the "Closed-Loop Backup Control Law
Generator" is about to run out of options that the decision logic must switch to using the last available backup trajectory
and corresponding tracking law.
Figure 2 is a schematic drawing showing the relationship between the actual system trajectory shown as a plain
black line, the backup trajectory shown as a dashed black line, the system state 𝑥, the state constraints, and the recovery
state 𝑥 recovery . As long as a recovery trajectory exists, the vehicle may follow its own 𝑢 des . When the vehicle reaches the
boundary between "a recovery trajectory exists" and "a recovery trajectory does not exist" is when the backup trajectory
must be followed.

B. RTA Methodology
The method we propose for solving the problem introduced in III.A is to is to populate the foregoing "Closed-Loop
Backup Control Law Generator" with a block labeled "Open-loop trajectory generation" in figure 3 that generates a
reference backup trajectory that starts from the predicted state of the system over a short time horizon and ends in
a "safe state", together with a trajectory regulation closed-loop law labeled "Transverse Dynamics". The Arbitrary
controller assumes complete control over the system until the planning algorithm fails to generate well-regulated backup
Downloaded by Ibrahim Alomar on January 14, 2025 | http://arc.aiaa.org | DOI: 10.2514/6.2023-0696

trajectories. If no regulated backup trajectory can be found in the near future, the RTA Decision Logic 3 then switches
to the available transverse dynamics feedback control law.

Fig. 3 Transverse Dynamics RTA Mechanism

IV. Trajectory generation and conditioning for transverse dynamics analysis

Trajectory generation can be formulated as an optimization or as a feasibility problem, where the cost function is a
problem-dependent choice. While our work treats the trajectory generation part as a black box, we consider a free final
time problem with an obstacle environment [11] to illustrate our work; a standard class of cost functions is chosen,
which penalizes the final time, control effort, and obstacles collision. A cost function can be formulated as
∫ 𝑡f
𝐽 (𝑡f , 𝑥, 𝑢) = 𝛼𝑡f + ∥𝑢(𝑡) ∥ 22 + ℎ(𝑥(𝑡)) 𝑑𝑡, (3)
0

where
• ℎ(𝑥) is a penalty function for the vehicle to avoid obstacles,
• 𝑡 f is the final time,
• and 𝛼 > 0 is a constant.
The dynamical constraints are represented by the dynamics 1, and the final state 𝑥f is the recovery state 𝑥recovery , which
can be defined as a hard constraint or included in the cost function 3. For convenience and based on the authors’
prior exposure, the trajectory optimization solver GuSTO [11] is used throughout this paper to solve the foregoing

4
 optimal control problem. Solving this optimal control problem yields the times series 𝑥 r (𝑘), 𝑘 ∈ {1, 2, ..., 𝑁 }, and
𝑢 r (𝑘), 𝑘 ∈ {1, 2, ..., 𝑁 − 1}.
The time series 𝑥r and 𝑢 r are used to prepare the derivation of transverse dynamics for the system (1). Parameterizing
𝑥r with the arc length 𝑠, creates the "curvilinear position" series 𝑠(𝑘), 𝑘 ∈ {1, 2, . . . , 𝑁 }, such that, 𝑠(1) = 0, and
𝑠(𝑁) = 𝐿, where 𝐿 is the total length of the reference trajectory. Once 𝑠 is computed, it can be used to create a spline
(piecewise polynomial) interpolation of 𝑥r and 𝑢 r , where 𝑥r (𝑠) is obtained by fitting 𝑥 r (𝑘) and 𝑠(𝑘), and 𝑢 r (𝑠) is obtained
by fitting 𝑢 r (𝑘) and 𝑠(𝑘).

V. Transverse dynamics derivation

A. Definition:
The transverse dynamics of the system (1) relative to a reference trajectory is a representation of (1) as it operates
in the vicinity of that trajectory. Early work on transverse dynamics include, for example, Hauser and Chung [19].
Analogous to kinematic trajectory analyses based on Frenet-Serret bases, transverse dynamics is captured in the vicinity
Downloaded by Ibrahim Alomar on January 14, 2025 | http://arc.aiaa.org | DOI: 10.2514/6.2023-0696

of a given trajectory by defining a frame and resulting state-space coordinate system that moves along the trajectory.
The following elements are sufficient to construct transverse dynamics for System (1):
1) First, there is the state of progress along the reference trajectory, 𝑠, also named progression state, which, in this
paper, is chosen to be the arc length 𝑠.
2) Second, there is a set of orthonormal basis vectors {𝑁1 , 𝑁2 , ..., 𝑁 𝑛−1 , 𝑇 } for each 𝑠 where 𝑇 = 𝑇 (𝑠) is the
unit vector (assumed to be unique) tangent to the trajectory 𝑥r pointing in the direction of increasing 𝑠, and
𝑁𝑖 , 𝑖 = 1, . . . , 𝑛 − 1 is an orthonormal vector to 𝑇. Orthonormality of {𝑁1 , 𝑁2 , ..., 𝑁 𝑛−1 , 𝑇 } is, however, not
necessary to define transverse dynamics.
3) Last, there is the transverse state vector 𝜌 ∈ R𝑛−1 , which is chosen to be the position vector of the system’s state
𝑥 at 𝑠 expressed in the foregoing orthonormal basis. As a result, we can compactly describe the state vector 𝑥 in
the vicinity of the reference trajectory in the following translation-rotation transformation

𝑥 = 𝑥r (𝑠) + 𝑂 (𝑠) 𝜌, (4)

where 𝑂 (𝑠) is the matrix [𝑁1 𝑁2 ...𝑁 𝑛−1 ] at the curvilinear state 𝑠, and 𝜌 ∈ R𝑛−1 is the transverse state vector.
Figure 4 illustrates the construction of the transverse coordinates for a dynamical system evolving in R3 . The transverse

Fig. 4 Transverse coordinates

coordinates have dimension 2 and, together with 𝑠, they form a coordinate system for the entire system state.

5
 B. Dynamics:
There are several ways to capture transverse dynamics, we formulate the following three differential equations to
capture one full description of the dynamics in the transverse coordinates:
• First, there are infinitely many dynamics that can govern the evolution of the reference frame along the reference
trajectory. The differential equation
𝑑𝑂 𝑑𝑇 𝑇
= −𝑇 (𝑠) 𝑂 (𝑠) (5)
𝑑𝑠 𝑑𝑠
defines a smooth frame evolution by minimizing the torsion components of the orthogonal plane. In section VII,
we show an example of this operation for a three-dimensional state trajectory.
• Second, the progression dynamics describe the curvilinear motion along the reference trajectory, which is defined
as the projection of the velocity vector onto the tangent vector

𝑑𝑠 𝑇 𝑇 (𝑠) 𝑓 (𝑥 r (𝑠), 𝑢 r (𝑠))

= . (6)
𝑑𝑡 𝑑𝑂
1 − 𝑇 𝑇 (𝑠) 𝜌
𝑑𝑠
Downloaded by Ibrahim Alomar on January 14, 2025 | http://arc.aiaa.org | DOI: 10.2514/6.2023-0696

• Finally, the transverse state vector’s rate of change along the reference trajectory, that is, the transverse dynamics,
is obtained as
𝑑𝜌 𝑂 𝑇 (𝑠) 𝑓 (𝑂 (𝑠) 𝜌(𝑠) + 𝑥r (𝑠), 𝑢 r (𝑠) + 𝛿𝑢)
𝑓T (𝜌, 𝑠, 𝛿𝑢) := = , (7)
𝑑𝑠 𝑑𝑠
𝑑𝑡
where 𝛿𝑢 is the control component devoted to regulating the system around its nominal trajectory (𝑥r , 𝑢 r ).

VI. Regulation law and backup trajectory

Although finding a "backup trajectory" in real-time is important to implement an efficient RTA architecture, more
assurance about the executability of this trajectory, should it be needed, is obtained from also identifying an appropriate
backup trajectory regulation law. This paper approaches this problem using the Linear quadratic regulator (LQR) [20]
with backward integration of the Riccati equation solution, which is common, trusted, and computationally tractable
in real-time. The purpose is to regulate the transverse states of the system to ensure nominal trajectory tracking.
Consequently, we linearize (7) around 𝜌 = 0 and 𝛿𝑢 = 0 to yield
𝑑𝜌
= 𝐴(𝑠) 𝜌 + 𝐵(𝑠)𝛿𝑢, (8)
𝑑𝑠
where
𝜕 𝑓T
• 𝐴(𝑠) = ( )𝜌=0, 𝛿𝑢=0 ,
𝜕𝜌
𝜕 𝑓T
• and 𝐵(𝑠) = ( )𝜌=0, 𝛿𝑢=0 .
𝜕𝛿𝑢
We then use the performance index
∫ 𝐿
1 𝑇 1
𝐽= 𝜌 (𝐿)𝐹𝐿 𝜌(𝐿) + 𝜌𝑇 (𝑠)𝑄 𝜌(𝑠) + 𝛿𝑢𝑇 (𝑠)𝑅𝛿𝑢(𝑠) 𝑑𝑠, (9)
2 2 0

where 𝑄 is a symmetric positive semi-definite matrix, and 𝐹𝐿 and 𝑅 are symmetric positive definite matrices. The
optimal control solution is
𝛿𝑢 = −𝐾 (𝑠) 𝜌, 𝐾 (𝑠) = 𝑅 −1 𝐵(𝑠) 𝑇 𝑃(𝑠), (10)
where 𝐾 is the optimal gain matrix and 𝑃 is computed by backward integration of the Riccati matrix differential equation
𝑑𝑃
= −𝑃 𝐴(𝑠) − 𝐴(𝑠) 𝑇 𝑃 − 𝑄 + 𝑃𝐵(𝑠)𝑅 −1 𝐵(𝑠) 𝑇 𝑃 (11)
𝑑𝑠
with the final condition 𝑃(𝐿) = 𝐹𝐿 . Solving Equations (5) and (11) simultaneously with 𝑃(𝐿) = 𝐹𝐿 and 𝑂 (𝐿) is
any matrix [𝑁1 𝑁2 ...𝑁 𝑛−1 ] such that {𝑁1 , 𝑁2 , ..., 𝑁n−1 , 𝑇 (𝐿)} forms a set of orthonormal basis vectors, produce the

6
 orthonormal basis 𝑂 (𝑠) and the gain matrix 𝐾 (𝑠) for all values of the curvilinear abscissa 𝑠. Therefore, we define the
backup trajectory 𝛾 to be the reference trajectory and its regulation law, that is,

𝛾 := {𝑥r (𝑠), 𝑢 r (𝑠), 𝑂 (𝑠), 𝐾 (𝑠)}. (12)

The closed-loop "backup system" dynamics is then

𝑑𝑥
= 𝑓 (𝑥, 𝑢 r (𝑠) − 𝐾 (𝑠) 𝜌)
𝑑𝑡
𝑑𝑠 𝑑𝑥 (13)
= 𝑇 (𝑠) 𝑇
𝑑𝑡 𝑑𝑡
𝜌 = 𝑂 (𝑠) 𝑇 (𝑥 − 𝑥r (𝑠))

with the initial condition

𝑠0 = arg min ∥𝑥 − 𝑥 r (𝑠) ∥ . (14)
𝑠
Downloaded by Ibrahim Alomar on January 14, 2025 | http://arc.aiaa.org | DOI: 10.2514/6.2023-0696

VII. Numerical Experiments

To illustrate the results of this paper, we leverage two dynamical systems operating in environments with obstacles.
First, in VII.A we present a three-state dynamical system with two control variables. Secondly, in VII.B a six-state
system with two control inputs illustrates the framework in a real-time collision-avoidance scenario.

A. Three-state dynamical system example

Consider the kinematic system
𝑥¤1  𝑢 1 cos(𝑥3 ) 
𝑑𝑥    
= 𝑥¤2  =  𝑢 1 sin(𝑥3 ) 

(15)
𝑑𝑡    
𝑥¤3   𝑢2 
   
where the control inputs 𝑢 1 and 𝑢 2 are the velocity and the angular velocity of a disc evolving in the plane parameterized
by 𝑥 1 and 𝑥2 . In this example we explore the dynamics (15) to illustrate the following:
• the capability of this work to handle dynamics constraints violations,
• and the tracking capability of the framework.

Fig. 5 Kinematic model for planar spacecraft

1. Handling backup trajectory planner failures with RTA

We now illustrate our work in a context where failures of the backup trajectory planner must be handled. The desired
trajectory is a straight line in a complex environment. The nominal trajectory is magnified in the top left corner of
Figure 6.

7
Downloaded by Ibrahim Alomar on January 14, 2025 | http://arc.aiaa.org | DOI: 10.2514/6.2023-0696

Fig. 6 Desired trajectory Fig. 7 Backup trajectories

Figures 6 and 7 demonstrate the RTA dynamics for which the plant moves in a straight line. The RTA system
computes a backup trajectory. In this example, exercising the backup option is made necessary by a failure of the backup
trajectory computation itself, and not by any risk of colliding with any obstacle. The red trajectory in Figure 7 is the
backup trajectory 𝑥r computed by GuSTO and projected on the 𝑥1 , 𝑥 2 plane. Upon real-time evaluation, it is found that
𝑥r and the corresponding control input 𝑢 r violate the system dynamics (15), thus triggering the Run-Time Assurance by
forcing the system to track the last available backup trajectory, as shown in Figure. 8.

Fig. 8 Total Trajectory

2. Trajectory tracking via transverse dynamics: An illustration

The foregoing three-state example makes it especially convenient to illustrate the tracking design procedures
expressed in Sections V and VI. For that purpose, we focus our attention on the last backup trajectory computed in the
foregoing section along with its transverse dynamics tracking law shown in Figure 9. Secondly, Figure 10 illustrates the
smooth evolution of the normal plane along the reference trajectory by solving Equation 5.

8
Downloaded by Ibrahim Alomar on January 14, 2025 | http://arc.aiaa.org | DOI: 10.2514/6.2023-0696

Fig. 9 Backup Trajectory

Fig. 10 Transverse coordinate evolution

Finally, as a result of calculating the backup trajectory 𝛾 in Section VI, Figures 11 and 12 illustrate the tracking
capability enabled by the transverse dynamics framework by selecting different initial conditions far from the reference
trajectory. All trajectories converge to the reference trajectory in Figures 9 and 10 or equivalently, show convergence to
zero in the transverse plane as shown in Figure. 13.

Fig. 12 Tracking in obstacle space

Fig. 11 Tracking in state-space

Fig. 13 Transverse trajectories

9
 B. RTA-enabled collision avoidance for a six-state system
This example considers a similar model to the model (5) discussed in Section VII.A. The model, however, is
now kinetic, that is, it includes inertial effects. The control variables are the force 𝑢 1 and the moment 𝑢 2 acting on a
free-flying disc. Figure 14 shows the model with all state information, which is governed by the differential equation
𝑥¤1   𝑥4 
   
𝑥¤2  
   
𝑥5 
   
𝑑𝑥 𝑥¤3  
   𝑥6 
= = , (16)
𝑑𝑡 𝑥¤4  𝑢 1 cos(𝑥3 )/𝑚 
𝑥¤5   𝑢 1 sin(𝑥 3 )/𝑚 
   
   
𝑥¤6   𝑢 2 /𝐽 
   
where the states 𝑥 4 and 𝑥5 are the linear velocity components in the x-direction and y-direction, the state 𝑥6 is the angular
velocity, and 𝑚 = 1kg is the mass, and 𝐽 = 1kg.m2 is the moment of inertia.
Downloaded by Ibrahim Alomar on January 14, 2025 | http://arc.aiaa.org | DOI: 10.2514/6.2023-0696

Fig. 14 Kinetic model for planar spacecraft

Exploiting the dynamics (16), we create a simple scenario where an arbitrary controller decides to steer the system
along a circular trajectory towards the small obstacle shown in pink in Figures 15 and 16. In the meantime, the RTA
mechanism is computing backup trajectories as the plant approaches the obstacle. Figure 15 shows the motion of the
plant, whereas Figure 16 illustrates the real-time computation of backup trajectory computations and their tracking
control laws.

Fig. 15 Desired trajectory Fig. 16 Backup trajectories

10
 In Figure 16, the arbitrary controller is allowed to steer the system by virtue of existing backup trajectory with its
transverse dynamics closed-loop law. Eventually, the trajectory generation algorithm fails to generate new backups
because the plant is about to become unable to avoid the obstacle. Therefore the RTA Decision logic in block diagram
3 activates the backup controller, resulting in the obstacle avoidance trajectory shown in Figure 17. The RTA, by
triggering the execution of the backup trajectory at the last possible instant, implicitly maximizes the freedom of the
arbitrary controller in block diagram 3.
Downloaded by Ibrahim Alomar on January 14, 2025 | http://arc.aiaa.org | DOI: 10.2514/6.2023-0696

Fig. 17 Total trajectory

VIII. Conclusion
This paper presents a simple and efficient framework for Run-Time Assurance using real-time backup trajectory
generation and controller design for trajectory regulation by expressing transverse dynamics of the system relative to
backup trajectories computed in real-time. Implementation of the framework assumes knowledge of the environment
and the system dynamics. The trajectory generation can be treated as a black box to replace the one used in this paper.
In the examples covered here, the Run-Time Assurance guarantees collision avoidance and safe system recovery when
needed, that is, when the backup trajectory and regulation synthesis mechanism is not able to produce trusted results.
Future work will include an experimental validation of the work introduced here. Moreover, the real-time interactive
RTA simulation environment developed and used in this paper will be made available on GitHub.

References
[1] Gross, K. H., Clark, M. A., Hoffman, J. A., Swenson, E. D., and Fifarek, A. W., “Run-time assurance and formal methods
analysis nonlinear system applied to nonlinear system control,” Journal of Aerospace Information Systems, Vol. 14, No. 4, 2017,
pp. 232–246.

[2] Mote, M. L., “Optimization-based approaches to safety-critical control with applications to space systems,” Ph.D. thesis,
Georgia Institute of Technology, 2021.

[3] Feron, E. M., Sanni, O., Mote, M., Delahaye, D., Khamvilai, T., Gariel, M., and Saber, S. I., Ariadne: A common-sense
thread for enabling provable safety in air mobility systems with unreliable components, American Institute of Aeronautics and
Astronautics, 2022. https://doi.org/10.2514/6.2022-0057, URL https://arc.aiaa.org/doi/abs/10.2514/6.2022-0057.

[4] Hobbs, K., Mote, M., Abate, M., Coogan, S., and Feron, E., “Run Time Assurance for Safety-Critical Systems: An Introduction
to Safety Filtering Approaches for Complex Control Systems,” , 2021. URL http://hdl.handle.net/10754/672817.

11
 [5] Phan, D., Yang, J., Grosu, R., Smolka, S. A., and Stoller, S. D., “Collision avoidance for mobile robots with limited
sensing and limited information about moving obstacles,” Formal Methods in System Design, Vol. 51, 2017, pp. 62–86.
https://doi.org/10.1007/s10703-016-0265-4, URL https://doi-org.libproxy.kaust.edu.sa/10.1007/s10703-016-0265-4.

[6] Schierman, J. D., Neal, D., Wong, E., and Chicatelli, A. K., “Runtime assurance protection for advanced turbofan engine
control,” 2018 AIAA Guidance, Navigation, and Control Conference, 2018, p. 1112.

[7] Avram, R., Zhang, X., Muse, J. A., and Clark, M., “Nonlinear adaptive control of quadrotor uavs with run-time safety assurance,”
AIAA Guidance, Navigation, and Control Conference, 2017, p. 1896.

[8] Betts, J. T., “Survey of numerical methods for trajectory optimization,” Journal of guidance, control, and dynamics, Vol. 21,
No. 2, 1998, pp. 193–207.

[9] Delahaye, D., Puechmorel, S., Tsiotras, P., and Féron, E., “Mathematical models for aircraft trajectory design: A survey,” Air
Traffic Management and Systems, Springer, 2014, pp. 205–247.

[10] Harris, M. W., and Açıkmeşe, B., “Lossless convexification of non-convex optimal control problems for state constrained linear
systems,” Automatica, Vol. 50, No. 9, 2014, pp. 2304–2311. https://doi.org/https://doi.org/10.1016/j.automatica.2014.06.008,
Downloaded by Ibrahim Alomar on January 14, 2025 | http://arc.aiaa.org | DOI: 10.2514/6.2023-0696

URL https://www.sciencedirect.com/science/article/pii/S0005109814002362.

[11] Bonalli, R., Cauligi, A., Bylard, A., and Pavone, M., “GuSTO: Guaranteed Sequential Trajectory optimization via Sequential
Convex Programming,” 2019 International Conference on Robotics and Automation (ICRA), 2019, pp. 6741–6747.
https://doi.org/10.1109/ICRA.2019.8794205.

[12] Freeman, C. T., Cai, Z., Rogers, E., and Lewin, P. L., “Iterative Learning Control for Multiple Point-to-Point Tracking
Application,” IEEE Transactions on Control Systems Technology, Vol. 19, No. 3, 2011, pp. 590–600. https://doi.org/10.1109/
TCST.2010.2051670.

[13] Tapp, K., Curves, Springer International Publishing, Cham, 2016, pp. 1–60. https://doi.org/10.1007/978-3-319-39799-3_1,
URL https://doi.org/10.1007/978-3-319-39799-3_1.

[14] Erkan, E., and Yüce, S., “Serret-Frenet Frame and Curvatures of Bézier Curves,” Mathematics, Vol. 6, No. 12, 2018.
https://doi.org/10.3390/math6120321, URL https://www.mdpi.com/2227-7390/6/12/321.

[15] Afman, J.-P., Feron, E., and Hauser, J., “Nonlinear Maneuver Regulation for Reduced-G Atmospheric Flight,” 2018 IEEE
Conference on Decision and Control (CDC), 2018, pp. 731–736. https://doi.org/10.1109/CDC.2018.8618690.

[16] Woo, J. W., An, J.-Y., Cho, M. G., and Kim, C.-J., “Integration of path planning, trajectory generation and trajectory tracking
control for aircraft mission autonomy,” Aerospace Science and Technology, Vol. 118, 2021, p. 107014. https://doi.org/https:
//doi.org/10.1016/j.ast.2021.107014, URL https://www.sciencedirect.com/science/article/pii/S1270963821005241.

[17] Son, C. Y., Seo, H., Jang, D., and Kim, H. J., “Real-Time Optimal Trajectory Generation and Control of a Multi-Rotor With
a Suspended Load for Obstacle Avoidance,” IEEE Robotics and Automation Letters, Vol. 5, No. 2, 2020, pp. 1915–1922.
https://doi.org/10.1109/LRA.2020.2967279.

[18] Renny Simba, K., Uchiyama, N., and Sano, S., “Real-time smooth trajectory generation for nonholonomic mobile robots
using Bézier curves,” Robotics and Computer-Integrated Manufacturing, Vol. 41, 2016, pp. 31–42. https://doi.org/https:
//doi.org/10.1016/j.rcim.2016.02.002, URL https://www.sciencedirect.com/science/article/pii/S0736584516300552.

[19] Chung, C. C., and Hauser, J., “Nonlinear control of a swinging pendulum,” Automatica, Vol. 31, No. 6, 1995, pp. 851–
862. https://doi.org/https://doi.org/10.1016/0005-1098(94)00148-C, URL https://www.sciencedirect.com/science/article/pii/
000510989400148C.

[20] Kirk, D., Kirk, D., and Kreider, D., Optimal Control Theory: An Introduction, Networks series, Prentice-Hall, 1970. URL
https://books.google.com.sa/books?id=GWF4ugEACAAJ.

12
 This article has been cited by:

1. Ibrahim A. Alomar, Abdulaziz Alfaadehl, Eric Feron, Hesham Shageer. Rapid generation of backup trajectories for run-time
assurance of vehicles and other dynamical systems . [Abstract] [PDF] [PDF Plus]
Downloaded by Ibrahim Alomar on January 14, 2025 | http://arc.aiaa.org | DOI: 10.2514/6.2023-0696