Runtime assurance and simplex architectures for ML in flight

Runtime assurance (RTA) is a design pattern: a trusted monitor watches a less-trusted function and, when a safety property is about to fail, switches to a trusted backup. Official NASA technical reports and a peer-reviewed 1998 IEEE paper describe that pattern. ASTM publishes a practice for using it on aircraft. None of the pages we cite is an FAA or EASA acceptable means of compliance for machine-learning airborne software.

Status as of 14 October 2026: NASA/TM–20220015734 is still dated January 2023 on the live PDF (the NTRS citation page timed out this pass). ASTM still marks F3269-21 Active. IEEE Xplore returned an empty body this pass; the 1998 Simplex record is kept from the last successful fetch of the same URL. The FAA Roadmap HTML 403ed; we still found no sentence on that page, from earlier fetches, that adopts F3269 or NASA/TM–20220015734 as a means of compliance. EASA Concept Paper Issue 02 still downloaded.

The Simplex architecture (1998)

Danbing Seto, Bruce Krogh, Lui Sha and Alongkrit Chutinan published The Simplex architecture for safe online control system upgrades in the Proceedings of the 1998 American Control Conference (IEEE Cat. No. 98CH36207). IEEE Xplore dates the conference 26 June 1998 and lists the DOI 10.1109/ACC.1998.703255.

The IEEE abstract says they describe the Simplex architecture, a real-time software technology which supports the safe, reliable introduction of control system upgrades while the system is running. The paper’s own abstract (same record) adds that they introduce its basic structure in control systems, discuss its fault-tolerance feature, and investigate the control issues when the technology is employed.

The 1998 paper is about control-system upgrades, not aviation machine learning. Our reading of the 2024 NASA record below, not a claim in the 1998 abstract: NASA later treats Simplex as an instance of RTA used with an untrusted controller.

What NASA means by runtime assurance

NASA/TM–20220015734, Runtime Assurance of Aeronautical Products: Preliminary Recommendations (Guillaume Brat and Ganesh Pai, Ames Research Center, January 2023), is a NASA Technical Memorandum. NASA’s STI profile in that PDF says a Technical Memorandum reports scientific and technical findings that are preliminary or of specialized interest.

The authors define three terms they say the literature often mixes:

• Runtime monitoring (RTM) — observation of an executing system of interest, its functions, or its environment.
• Runtime verification (RV) — a specialization of RTM, where the response of the monitor is the result of an online verification procedure.
• Runtime assurance (RTA) — the combination of RTM and one or more functions triggered by RTM, such as recovery, failover, warning alarm, or shutdown.

The schematic in the memorandum wraps a complex function—which may be implemented using emerging untrusted technologies such as Machine Learning (ML) with high-assurance functions. The runtime safety monitor can observe (one or all of) the inputs, outputs, and computation of the less-trusted or untrusted complex function. On a detected safety violation it disconnect[s] the complex function and … switch[es] to a high assurance alternative function to maintain safe system state.

NASA decomposes RTA into input assurance, monitoring, switching decision logic, and alternative or backup function. The backup need not be a completely functional equivalent of the primary and may rather deliver a reduced level of service.

Trusted RTA, in the memorandum’s words, should be simple (simpler than the system under observation), benign, realizable, verifiable and dependable.

The report’s stated purpose is to inform the aviation community, in particular the US civil aviation regulator—the Federal Aviation Administration (FAA)—and the flight safety foundation, and to aid the development of the appropriate regulations and aviation industry consensus guidance. That is a briefing to the regulator, not an FAA issuance.

ASTM F3269-21

ASTM International publishes F3269-21, Standard Practice for Methods to Safely Bound Behavior of Aircraft Systems Containing Complex Functions Using Run-Time Assurance, marked Active, committee F38, DOI 10.1520/F3269-21.

ASTM’s public significance statement says the practice provides an architectural framework for developing an RTA system, which provides run-time assurance as an alternative to design-time assurance to fulfill safety requirements for an unassured or complex function. It describes the architectural components and requirements for designing the RTA system. The same page says this practice was developed with UAS in mind and may be applicable for aspects of manned aircraft certification/approval, as well as aviation ground systems. It is also envisioned to allow a variety of aircraft implementations where a human may perform the role of either the Complex Function or a Recovery Function. ASTM anticipates that the practice will provide a means to accept complex automation/autonomy aircraft functions that have been difficult to certify using traditional methods. That is ASTM’s anticipation, not an FAA acceptance statement.

NASA’s explicit disagreement with using RTA as a substitute

The NASA memorandum examined its recommendations against ASTM F3269-21. The authors record a notable difference: the ASTM F3269-21 standard advocates the use of RTA with untrusted functions that have not undergone traditional development assurance processes, while this report explicitly does not relieve the assurance obligations on the SUO despite the use of RTA. The rationale they give is that safety must be demonstrated for the integrated system. They also quote ASTM’s own caution that The designer should not use RTA as a substitute for poor complex function design and/or implementation, and add that for complex functions that are implemented using novel emerging technologies such as ML, there are assurance challenges as yet unanswered despite using RTA.

Simplex RTA with a black-box ML controller

NASA’s 2024 NTRS record A Verification Framework for Runtime Assurance of Autonomous UAS (PDF) states that the simplex architecture is an instance of RTA, where the action taken is to hand control of the overall system to a trusted controller when an untrusted one violates a safety property. It says Simplex RTA is emerging as a method for allowing AI/ML and other unverified software to be integrated into safety-critical applications like aircraft, and that ASTM and NASA have each published guidelines on the use of RTA in such systems.

In that framework a system has an advanced controller (AC) and a reversionary controller (RC). The AC runs until a monitor trips; then the RC takes over. The paper does not address the many difficulties in deploying RTA in an industrial-level system. It formalizes the pattern in PVS so that an untrusted black box component, such as an AI/ML controller, can be kept abstract.

What FAA and EASA pages on this site do not say

The FAA Roadmap for Artificial Intelligence Safety Assurance describes project-specific issue papers and special conditions for learned AI. We searched that page for “runtime assurance” and “simplex” and do not treat the roadmap as adopting F3269 or NASA/TM–20220015734 as a means of compliance.

EASA’s Concept Paper Issue 02 proposes learning assurance as an extension of traditional development assurance. That paper does not constitute final detailed guidance. We have not found, on the EASA pages we cite, a statement that a simplex wrapper is an acceptable substitute for learning-assurance data sets.

DO-178C remains the core airborne-software document on RTCA’s page. An RTA monitor that is itself airborne software is still software. NASA’s memorandum does not relieve the assurance obligations on the SUO.

Questions

Is runtime assurance an FAA or EASA means of compliance for airborne ML?

Not on the official pages we cite. NASA/TM–20220015734 is preliminary and written to inform the FAA. ASTM F3269-21 anticipates a path for complex functions; that is not an FAA advisory circular.

Does wrapping an ML controller in Simplex remove the need to assure the model?

NASA’s 2023 memorandum explicitly does not relieve the assurance obligations on the SUO and says assurance challenges for ML remain despite using RTA. ASTM’s public page still says the designer should not use RTA as a substitute for poor complex function design.