control//safety filter

A safety filter is a small, verifiable component placed between a high-performance controller and the actuators that passes the controller's commands when they are safe and corrects or overrides them when they are not, and it is how learned, adaptive or otherwise uncertified controllers are allowed to touch real hardware. The design separates two roles: a controller that is good at the task (a network, an MPC, an adaptive law) and a guardian that is simple enough to analyse, test and certify.

A safety filter is a small, verifiable component placed between a high-performance controller and the actuators that passes the controller's commands when they are safe and corrects or overrides them when they are not, and it is how learned, adaptive or otherwise uncertified controllers are allowed to touch real hardware. The design separates two roles: a controller that is good at the task (a network, an MPC, an adaptive law) and a guardian that is simple enough to analyse, test and certify.

The most deployed safety filter in the world is unglamorous and entirely industry: command and rate limits (saturate the amplitude and the slew rate of every command), a geofence (a spatial boundary the vehicle may not cross), flight envelope protection (limits that keep an aircraft inside its safe region of speed, angle of attack and load), and a watchdog timer that switches to a safe mode if the controller stops answering. More structured forms exist. The Simplex architecture switches control to a verified simple controller when the state nears the edge of the region from which it can still recover. A control barrier function solves a tiny optimization every period to find the command closest to the proposed one that keeps the system in a safe set. A predictive safety filter checks a future horizon with an MPC before letting a command through (research).

Whatever learns is deployed behind a safety filter and, in a fleet, by stages with a way back.

Wrap critical networks with monitoring of whether their inputs look like the training data, limits on their outputs and a verified classical fallback; roll updates out in shadow mode first, then to a small share of units, with rollback prepared (staged rollout). One bad update deployed everywhere at once is a common-mode failure.

A filter is only as trustworthy as the signals it watches. If it reads the same estimate the controller uses, a bad estimate fools both, so critical limits are checked on independent measurements where they exist (a separate altimeter for a geofence floor, a hard-wired limit switch).

It must be fast and cheap: a barrier QP with one or two constraints solves in microseconds on the flight microcontroller, and a limiter costs nothing. A filter that needs a companion computer has become a second complex controller.

Certification standards assume behaviour can be specified and traced to code, which a network breaks; the usual way out is architectural, with the uncertified component monitored by a certified one, which aeronautics calls run-time assurance (functional safety).

Maturity: limits, geofences, envelope protection and watchdogs are industry; Simplex and barrier functions are growing niche; predictive filters are research (learning-based control).