  To mitigate the high energy demand of Neural Network (NN) based Autonomous
Driving Systems (ADSs), we consider the problem of offloading NN controllers
from the ADS to nearby edge-computing infrastructure, but in such a way that
formal vehicle safety properties are guaranteed. In particular, we propose the
EnergyShield framework, which repurposes a controller ''shield'' as a low-power
runtime safety monitor for the ADS vehicle. Specifically, the shield in
EnergyShield provides not only safety interventions but also a formal,
state-based quantification of the tolerable edge response time before vehicle
safety is compromised. Using EnergyShield, an ADS can then save energy by
wirelessly offloading NN computations to edge computers, while still
maintaining a formal guarantee of safety until it receives a response
(on-vehicle hardware provides a just-in-time fail safe). To validate the
benefits of EnergyShield, we implemented and tested it in the Carla simulation
environment. Our results show that EnergyShield maintains safe vehicle
operation while providing significant energy savings compared to on-vehicle NN
evaluation: from 24% to 54% less energy across a range of wireless conditions
and edge delays.
