  Autonomous driving systems (ADSs) integrate sensing, perception, drive
control, and several other critical tasks in autonomous vehicles, motivating
research into techniques for assessing their safety. While there are several
approaches for testing and analysing them in high-fidelity simulators, ADSs may
still encounter additional critical scenarios beyond those covered once they
are deployed on real roads. An additional level of confidence can be
established by monitoring and enforcing critical properties when the ADS is
running. Existing work, however, is only able to monitor simple safety
properties (e.g., avoidance of collisions) and is limited to blunt enforcement
mechanisms such as hitting the emergency brakes. In this work, we propose
REDriver, a general and modular approach to runtime enforcement, in which users
can specify a broad range of properties (e.g., national traffic laws) in a
specification language based on signal temporal logic (STL). REDriver monitors
the planned trajectory of the ADS based on a quantitative semantics of STL, and
uses a gradient-driven algorithm to repair the trajectory when a violation of
the specification is likely. We implemented REDriver for two versions of Apollo
(i.e., a popular ADS), and subjected it to a benchmark of violations of Chinese
traffic laws. The results show that REDriver significantly improves Apollo's
conformance to the specification with minimal overhead.
