  A framework is presented for handling a potential loss of observability of a
dynamical system in a provably-safe way. Inspired by the fragility of
data-driven perception systems used by autonomous vehicles, we formulate the
problem that arises when a sensing modality fails or is found to be
untrustworthy during autonomous operation. We cast this problem as a
differential game played between the dynamical system being controlled and the
external system factor(s) for which observations are lost. The game is a
zero-sum Stackelberg game in which the controlled system (leader) is trying to
find a trajectory which maximizes a function representing the safety of the
system, and the unobserved factor (follower) is trying to minimize the same
function. The set of winning initial configurations of this game for the
controlled system represent the set of all states in which safety can be
maintained with respect to the external factor, even if observability of that
factor is lost. This is the set we refer to as the Eyes-Closed Safety Kernel.
In practical use, the policy defined by the winning strategy of the controlled
system is only needed to be executed whenever observability of the external
system is lost or the system deviates from the Eyes-Closed Safety Kernel due to
other, non-safety oriented control schemes. We present a means for solving this
game offline, such that the resulting winning strategy can be used for
computationally efficient, provably-safe, online control when needed. The
solution approach presented is based on representing the game using the
solutions of two Hamilton-Jacobi partial differential equations. We illustrate
the applicability of our framework by working through a realistic example in
which an autonomous car must avoid a dynamic obstacle despite potentially
losing observability.
