Robotics / AI systems · Preprint · research prototype

Admissible Motion: Runtime Safety as an Admission-Control Problem, Not a Model-Capability Problem

Safety for a system that moves should be a property of the runtime, not of the model that proposes actions. We factor the safety argument through a deterministic admission layer that verifies every candidate control against grounded invariants before it reaches the actuator — and prove the closed loop stays in the safe set for any controller.

Perslis Research · kist × Perslis · 2026-09-24

Download the formal white paper (PDF) ↓ See it drive — Perslis Motion ↗ Preprint · research prototype (simulation) · moat-scrubbed

Empirical companion: Runtime Admission Control on a Photoreal Driving Simulator — the same admission framing measured in CARLA against a hostile controller and frontier models at the wheel.

Controller-independent safety Runtime-assurance shielding MetaDrive demonstration

Abstract

Safety cases for learned motion policies are, at bottom, unfalsifiable: a policy of arbitrary quality can still propose a fatal control, and no amount of measured capability proves that it will not. We argue that "safe because the model is good" is not a safety argument, and offer an alternative that is. We factor the safety argument through an admission layer: any controller — random, rule-based, a local model, a frontier model, or a full autonomy stack — only proposes a control; a deterministic floor verifies each candidate against grounded safety invariants over a bounded reachability horizon and admits, clamps, denies, or overrides it before it reaches the actuator. We formalize the runtime as State → Reachability → Invariants → Admission → Actuation → Verification and prove a controller-independent forward-invariance theorem: if the system starts in the safe set and a safe fallback exists at every state, admission keeps the system in the safe set for every controller, because the controller never appears in the invariant. We instantiate the architecture in the open MetaDrive autonomous-vehicle simulator. An adversarial tailgating controller that corrupts exactly the channel the floor governs rear-ends traffic with the floor off (crash at step 70, 70 km/h into the lead) and holds a safe following gap the whole way with the floor on — 164 brake-overrides, no crash, without changing the controller. Model capability governs how much useful work completes; the runtime governs what may be executed. This is a demonstration of the architecture in a single simulated domain, not a vehicle controller, and it shares one engine with the bio and legal admission floors of the broader Perslis program.

Safety should not depend on — and should not degrade with — the intelligence of the thing that proposes the action.

1 · Introduction

An autonomous system that moves can hurt someone. The dominant paradigm for making such systems safe is to make the policy that drives them better: more data, larger models, more training, more evaluation. This improves average behavior, and it is necessary work. But it does not, and cannot, produce a safety guarantee. A policy is a function from states to proposed controls; nothing about its measured competence rules out the existence of a state at which it proposes something catastrophic. "The model scored well" is evidence about a distribution of situations already seen. Safety is a claim about a situation not yet seen — including one an adversary or a rare fault constructs on purpose.

This paper takes the position that the safety argument for a moving system should be relocated. Instead of asking the proposer to be trustworthy, we interpose a deterministic admission layer between any proposer and the actuator. The proposer proposes; the admission layer verifies each proposal against grounded safety invariants over a bounded look-ahead and admits it, clamps it to the nearest safe control, or overrides it with a designated safe fallback. The controller is never trusted with the actuator directly. The safety guarantee then factors through the admission map, not through the proposer — and holds for every proposer, including ones we did not build and cannot inspect.

Our contributions are: (i) a formal model of runtime motion safety as an admission-control problem, with a controller-independent forward-invariance theorem and an explicit statement of its standing assumptions; (ii) a reachability-aware form of the following-distance invariant that brakes early enough to hold the gap, together with an observed failure of the naive reactive form; (iii) an empirical demonstration in the open MetaDrive simulator in which an adversarial controller crashes with the floor off and is provably kept safe with it on, without modifying the controller; and (iv) the observation that this is one instance of a cross-domain pattern — the same admission spine gates fabricated protein facts in a bio floor and fabricated case law in a legal floor, and here gates unsafe control in a motion floor.

2 · The problem: capability is not a safety argument

Consider a learned policy \(\pi\) that has been evaluated over a large test set and performs well. What have we established? That \(\pi\) tends to propose good controls on states drawn from the evaluation distribution. The property we actually need for safety is different in kind: for all reachable states, the executed control keeps the system out of collision, off the shoulder, within the speed limit, and inside the geofence. A capability metric aggregates over situations; a safety property quantifies over them. No finite evaluation closes that gap, and an adversary or an unlucky sensor fault can drive the system to precisely the state the evaluation never sampled.

This is why "safe because the model is good" is not falsifiable in the way a safety claim must be. There is no experiment on the policy alone whose failure would let us conclude the policy is unsafe in general, and no experiment whose success would let us conclude it is safe in general; the state space is too large and the tail is where the harm lives. Certification and insurance need a claim that can be discharged against invariants and evidence, not a claim about a model's average competence. We therefore stop asking the proposer to carry the safety argument at all.

3 · The inversion — an admission layer

The move is to separate the proposer from admission. The proposer's job is to be useful: to make progress, keep the lane, complete the route. Admission's job is narrow and deterministic: given the current state and a proposed control, decide what — if anything — is allowed to reach the actuator. We arrange the runtime as a pipeline:

\[ \text{State} \;\rightarrow\; \text{Reachability} \;\rightarrow\; \text{Invariants} \;\rightarrow\; \text{Admission} \;\rightarrow\; \text{Actuation} \;\rightarrow\; \text{Verification} \]

The proposer sits before this pipeline and only supplies a candidate. The invariants encode the safe set. Reachability projects the candidate forward over a bounded horizon. Admission is the decision — allow, clamp, or override — and it is the only thing with authority over the actuator. Verification logs what was admitted and why, so every override is an inspectable receipt: the action was verified before it acted. This is the runtime-assurance / Simplex lineage [1] and the shielding lineage from safe reinforcement learning [6]; our emphasis is that the safety case is carried entirely by the admission map and is therefore indifferent to which proposer is upstream.

The controller only proposes. A deterministic floor decides what may be executed.

4 · Formal model

Let world state be \(x \in \mathcal{X}\) — position, velocity, orientation, nearby objects, boundaries, and actuator state — and control be \(u \in \mathcal{U}\), with discrete dynamics \(x_{t+1} = f(x_t, u_t)\). The safe set is defined by invariant predicates \(g_i(x) \le 0\) — on-road, speed limit, following distance, geofence, separation, actuator limits:

\[ \mathcal{S} = \{\, x \in \mathcal{X} : g_i(x) \le 0 \ \ \forall i \,\}. \]

Define the reachable set over a horizon \(H\):

\[ \mathrm{Reach}_H(x, u) = \{\, x' : x'\ \text{reachable from}\ x\ \text{under}\ u\ \text{within}\ H\ \text{steps} \,\}. \]

The admission map \(A : \mathcal{X} \times \mathcal{U} \to \mathcal{U}\) is then

\[ A(x,u) = \begin{cases} u & \text{(ALLOW) if } \mathrm{Reach}_H(x,u) \subseteq \mathcal{S},\\[4pt] u' & \text{(CLAMP) nearest } u' \text{ with } \mathrm{Reach}_H(x,u') \subseteq \mathcal{S},\\[4pt] u_{\mathrm{safe}}(x) & \text{(DENY / EMERGENCY) otherwise — brake, hover, halt.} \end{cases} \]

The closed loop under an arbitrary controller \(\pi\) is

\[ u_t = A\big(x_t,\, \pi(x_t)\big), \qquad x_{t+1} = f(x_t, u_t). \]

Note that \(\pi\) enters only inside \(A\)'s argument and is discarded whenever admission clamps or overrides. This is the structural fact the theorem exploits.

5 · The safety theorem

Theorem 1 (controller-independent forward invariance). Suppose (a) \(x_0 \in \mathcal{S}\); (b) a safe fallback exists at every state, i.e. \(\forall x \in \mathcal{S},\ \mathrm{Reach}_H\big(x, u_{\mathrm{safe}}(x)\big) \subseteq \mathcal{S}\); and (c) admission \(A\) is applied at every step. Then \(x_t \in \mathcal{S}\) for all \(t \ge 0\) and for every controller \(\pi\).

Proof sketch. By induction on \(t\). Base case: \(x_0 \in \mathcal{S}\) by (a). Inductive step: assume \(x_t \in \mathcal{S}\). Admission returns one of three values. If it ALLOWs \(u\), then \(\mathrm{Reach}_H(x_t,u) \subseteq \mathcal{S}\) by the ALLOW condition, so in particular \(x_{t+1} \in \mathcal{S}\). If it CLAMPs to \(u'\), then \(\mathrm{Reach}_H(x_t,u') \subseteq \mathcal{S}\) by the CLAMP condition, so \(x_{t+1} \in \mathcal{S}\). If neither exists, admission executes \(u_{\mathrm{safe}}(x_t)\), and \(\mathrm{Reach}_H(x_t, u_{\mathrm{safe}}(x_t)) \subseteq \mathcal{S}\) by (b), so \(x_{t+1} \in \mathcal{S}\). In every branch \(x_{t+1} \in \mathcal{S}\). The controller \(\pi\) never appears in the invariant; it only influences which in-set control is chosen, never whether the chosen control keeps the system in \(\mathcal{S}\). \(\square\)

Corollary (model-independence). The safety guarantee is invariant to \(\pi\). Swapping random → rule-based → learned → frontier changes the quality of admitted behavior but not membership in \(\mathcal{S}\). Model capability governs how much useful work completes; the runtime governs what may be executed.

We state the standing assumptions plainly, because they are exactly the interfaces a physical deployment must discharge. Theorem 1 assumes: the state \(x_t\) fed to the invariants is exact; the actuator has adequate authority to realize \(u_{\mathrm{safe}}\) (e.g. enough braking to stop in the available gap); and the invariants \(g_i\) correctly encode the intended safe set. Where these hold, safety is a theorem. Where they do not, the guarantee is only as good as the weakest interface — and that is a claim about perception, actuation, and specification, not about the proposer. Isolating that fact is the point of the paper.

6 · The following-distance invariant, made reachability-aware

We work one invariant end-to-end: keep a safe following gap behind a lead vehicle. Let the lead be at distance \(d\), ego speed \(v\), lead speed \(v_\ell\), and closing rate \(c = v - v_\ell\). A purely reactive rule keeps a gap

\[ g_{\mathrm{safe}} = \max\big(d_{\min},\ v\,\tau\big) \]

for a headway \(\tau\), and brakes in proportion to how far inside \(g_{\mathrm{safe}}\) the vehicle already is. This form engages too late: once a tailgater has built speed, the gap it must recover exceeds what braking can buy in time, and the vehicle crashes even while logging overrides. We observed exactly this — a reactive gap-keeper crashed despite roughly 120 admission overrides — which motivated a reachability-aware form.

The reachability form asks a forward question: what constant deceleration would be needed to stop closing before the gap falls to \(d_{\min}\)? For \(c > 0\),

\[ a_{\mathrm{req}} = \frac{c^2}{2\,(d - d_{\min})}. \]

The floor then commands a brake magnitude

\[ b = \min\!\left(1,\ \max\!\left(\frac{g_{\mathrm{safe}} - d}{g_{\mathrm{safe}}} + 0.3,\ \ \frac{a_{\mathrm{req}}}{a_{\max}}\right)\right), \]

so that braking rises as soon as the required deceleration approaches the actuator's authority \(a_{\max}\), not merely once the gap is already violated. This guarantees the projected gap never falls below \(d_{\min}\) under the assumed authority.

Invariants compose, and the composition order matters. The speed-limit cap and the following brake apply in sequence: the speed limit caps throttle at zero but does not preempt the following brake. An early version let the speed-limit guard short-circuit the pipeline and suppress the brake command — a bug we found and fixed by making the guards compose rather than compete. This is a small instance of a general obligation: when several invariants govern the same actuator, admission must respect all of them, not the first to fire.

7 · Empirical demonstration (Figures 1–2)

The reference implementation, drive_floor, runs on the open MetaDrive autonomous-vehicle simulator [9]. The proposer is a SymbolicDriver — geometric lane-keeping plus adaptive cruise, with no deep network — and two adversaries, a Tailgater and a Drifter, each of which corrupts exactly one channel so that the induced failure is precisely the invariant the floor governs. This is a deliberate experimental choice: we test the floor against an adversary that attacks the channel it is responsible for, before ever introducing a sophisticated model, so a pass cannot be a lucky miss. The floor is a SafetyShield.verify call that returns the nearest safe action plus a logged override — verified before acting. The wired invariants are on-road, speed limit, and following distance.

Figure 1 — interactive. Headline result on the same MetaDrive highway. The adversarial tailgater rear-ends traffic with the floor off and holds a safe gap with the floor on — the controller is identical in both rows.

Run	Crash	Floor overrides	Outcome
Tailgater · floor OFF	Yes — step 70, 70 km/h into the lead	0	Rear-ends traffic
Tailgater · floor ON	No	164	Holds a safe gap the whole way
Symbolic driver · floor ON	No	15	Drives cleanly, rarely needs the floor

The two tailgater rows differ only in whether admission is applied; the controller is byte-for-byte the same. The floor turned a crashing controller safe without changing the controller. The symbolic-driver row shows the complementary point: a controller that already respects the invariants is rarely touched — 15 overrides — so the floor imposes little cost on a competent proposer while still standing ready.

Figure 2 — interactive. Longitudinal admission trace from our controlled reproduction. With the floor off the gap collapses to zero (collision); with it on, the shield brakes as the gap closes and holds a steady following distance.

To inspect the mechanism at higher resolution we built a controlled longitudinal reproduction carrying the same invariant (safe gap, reachability-aware brake) with \(a_{\max}^{\text{brake}} = 9\ \mathrm{m/s^2} > a_{\max}^{\text{acc}} = 3\ \mathrm{m/s^2}\). The tailgater proposes full throttle throughout. With the floor off the gap closes to zero and the vehicles collide. With the floor on, the shield brakes as the gap closes, slows the ego from \(15.3\ \mathrm{m/s}\) to \(6.3\ \mathrm{m/s}\) to match the lead, and holds a roughly \(9.7\ \mathrm{m}\) gap the whole way with about 400 admission overrides; the closing rate settles to approximately zero. No crash. The trace shows the theorem's mechanism concretely: every step the proposer's full-throttle command is discarded in favor of an admitted brake, and the gap invariant is never violated.

8 · Reachability and model-swap invariance (Figures 3–4)

Figure 3 — interactive. Required deceleration \(a_{\mathrm{req}} = c^2 / \big(2(d - d_{\min})\big)\) as a function of gap for a fixed closing rate. The floor engages once \(a_{\mathrm{req}}\) crosses a threshold, guaranteeing the projected gap stays at or above \(d_{\min}\); a purely reactive gap-keeper engages too late and crashes even with overrides logged.

Figure 3 makes the case for the reachability form. Required deceleration grows sharply as the gap shrinks for a fixed closing rate; a reactive rule that waits until the gap is already inside \(g_{\mathrm{safe}}\) engages on the flat part of the curve and cannot recover once \(a_{\mathrm{req}}\) has climbed past the actuator's authority. The reachability form engages when \(a_{\mathrm{req}}\) first crosses a threshold below \(a_{\max}\), which is exactly what keeps the projected gap at or above \(d_{\min}\). The observed crash of the reactive gap-keeper despite roughly 120 overrides is the empirical shadow of this curve: overrides fired, but too late to matter. This is the reachability-analysis discipline [4][5] applied to a single scalar invariant.

Figure 4 — interactive. Conceptual: crash-rate versus controller (rule / random / adversary), floor OFF versus floor ON. With the floor off, crash-rate varies wildly with the proposer and the adversary crashes; with the floor on it is flat at zero across the proposer axis. Safety does not move with the controller; only work-quality does.

Figure 4 is the corollary drawn as a picture. Along the proposer axis — rule-based, random, adversarial — the floor-off crash-rate swings from tolerable to certain. The floor-on crash-rate is flat: the safety property does not move as the controller changes, because the controller is not in the invariant. What does move along that axis is the amount of useful work completed, which the runtime deliberately does not govern. This is the separation the paper argues for, made visual: one axis for capability, an orthogonal guarantee for safety.

9 · One engine: cars, drones, robots

Nothing in Sections 4–5 is specific to a car. The admission map is defined over an abstract state \(x\), an abstract control \(u\), and a set of invariant predicates \(g_i\); the theorem uses only that a safe fallback exists and that admission is applied every step. To move the engine to a drone, one swaps the state (adds altitude and attitude), the invariants (separation, geofence, minimum altitude, battery-to-home), and the fallback (\(u_{\mathrm{safe}}\) becomes hover-and-hold). To move it to a manipulator, the invariants become joint limits, workspace boundaries, and human-separation, and the fallback becomes halt. The proposer changes freely; the admission spine is the same code shape.

This also fixes the experimental method for any new domain: the adversarial-channel planner. Before introducing any sophisticated model, test the floor against an adversary that corrupts exactly the channel the floor governs. If the floor holds against a proposer purpose-built to violate the invariant it protects, a pass is a real result rather than a lucky catch — and only then is it worth measuring how well a capable proposer does the useful work on top.

10 · Admission control for model-mediated systems

The motion floor is one instance of a pattern that runs through the Perslis program: a learned or otherwise untrusted component earns authority only by passing a deterministic verifier it cannot game. The verifier asks the same shape of question in every domain — may this thing enter trusted state? — and answers it against grounded invariants, never against the proposer's confidence.

Science. A bio floor asks: may this claim enter trusted state? Fabricated protein facts are rejected because they are not grounded in a source; the model's fluency buys it nothing.
Law. A legal floor asks: may this citation enter trusted state? Fabricated or miscited case law is rejected against a real citation database; a confidently written brief does not admit a case that does not exist.
Motion. This floor asks: may this action reach the actuator? An unsafe control is clamped or overridden against grounded safety invariants; a competent-looking policy does not admit a control that leaves the safe set.

The same inversion runs through the program's inference-placement work: a learned component is granted authority only in proportion to a verifier's admission, not to the component's own capability. In each case the safety or integrity argument factors through the admission map, not the proposer — which is what lets the same argument be reused as the proposer is upgraded. Admission control is, in this framing, the trust layer for model-mediated systems, and motion is the case where the actuator makes the stakes physical.

11 · Limitations and scope

This is a demonstration of an architecture — runtime-assurance shielding — in a single simulated domain: MetaDrive longitudinal control plus our controlled longitudinal reproduction. It is not a vehicle controller and is not for any real car. The following-distance invariant is shown end-to-end; the on-road and speed-limit guards are wired but the off-road demonstration needs single-lane geometry we have not yet built (future work).

The grounding throughout is the simulator's ground-truth state. A real deployment does not have that luxury: the invariants must be fed by verified perception, which is out of scope here and is where the hard physical problems live — sensor uncertainty, latency, actuator faults, timing, redundancy, and certification. Theorem 1's assumptions (exact state, adequate fallback authority, correct invariants) are precisely the interfaces such a deployment must discharge; we do not claim to have discharged them, and we do not claim the floor is a better driver. The floor is not a driver at all. It is a guarantee wrapped around any driver, enforcing the safe set it is given. If the safe set is wrong, the floor faithfully enforces the wrong thing. The contribution is to isolate the software-control question — can a runtime keep the system in a given safe set regardless of the proposer? — and to answer it independent of the model, so that the remaining problems are named honestly and left where they belong.

12 · Conclusion

We argued that safety for a moving system should be a property of the runtime rather than of the model that proposes actions, and we made that concrete. By interposing a deterministic admission layer between any proposer and the actuator, and by projecting each candidate control forward against grounded invariants, the closed loop provably stays in the safe set for every controller — the proposer never appears in the invariant. In the MetaDrive simulator an adversarial controller that crashes with the floor off is kept safe with it on, without any change to the controller. Model capability decides how much useful work gets done; the runtime decides what is allowed to happen. That separation is the same one that lets a bio floor reject fabricated facts and a legal floor reject fabricated citations — admission control as the trust layer for model-mediated systems, now with the actuator on the other side of the gate.

The floor does not make a better driver. It makes a guarantee that holds around any driver.

References

L. Sha. "Using Simplicity to Control Complexity." IEEE Software, 18(4):20–28, 2001.
A. D. Ames, X. Xu, J. W. Grizzle, and P. Tabuada. "Control Barrier Function Based Quadratic Programs for Safety Critical Systems." IEEE Transactions on Automatic Control, 62(8):3861–3876, 2017.
A. D. Ames, S. Coogan, M. Egerstedt, G. Notomista, K. Sreenath, and P. Tabuada. "Control Barrier Functions: Theory and Applications." European Control Conference (ECC), 2019.
I. M. Mitchell, A. M. Bayen, and C. J. Tomlin. "A Time-Dependent Hamilton–Jacobi Formulation of Reachable Sets for Continuous Dynamic Games." IEEE Transactions on Automatic Control, 50(7):947–957, 2005.
M. Althoff. "An Introduction to CORA 2015." Proc. Workshop on Applied Verification for Continuous and Hybrid Systems (ARCH), 2015.
M. Alshiekh, R. Bloem, R. Ehlers, B. Könighofer, S. Niekum, and U. Topcu. "Safe Reinforcement Learning via Shielding." AAAI Conference on Artificial Intelligence, 2018.
S. Shalev-Shwartz, S. Shammah, and A. Shashua. "On a Formal Model of Safe and Scalable Self-Driving Cars." arXiv:1708.06374, 2017.
E. Bartocci and Y. Falcone (eds.). Lectures on Runtime Verification: Introductory and Advanced Topics. Springer LNCS 10457, 2018.
Q. Li, Z. Peng, L. Feng, Q. Zhang, Z. Xue, and B. Zhou. "MetaDrive: Composing Diverse Driving Scenarios for Generalizable Reinforcement Learning." IEEE Transactions on Pattern Analysis and Machine Intelligence, 2022.

How to cite

@techreport{perslis2026motion,
  title       = {Admissible Motion: Runtime Safety as an Admission-Control
                 Problem, Not a Model-Capability Problem},
  author      = {{Perslis Research}},
  institution = {Perslis Research},
  year        = {2026},
  month       = {9},
  note        = {Preprint, research prototype (simulation). Moat-scrubbed.},
  url         = {https://research.perslis.com/motion.html}
}