  We present the Neural Simplex Architecture (NSA), a new approach to runtime
assurance that provides safety guarantees for neural controllers (obtained e.g.
using reinforcement learning) of autonomous and other complex systems without
unduly sacrificing performance. NSA is inspired by the Simplex control
architecture of Sha et al., but with some significant differences. In the
traditional approach, the advanced controller (AC) is treated as a black box;
when the decision module switches control to the baseline controller (BC), the
BC remains in control forever. There is relatively little work on switching
control back to the AC, and there are no techniques for correcting the AC's
behavior after it generates a potentially unsafe control input that causes a
failover to the BC. Our NSA addresses both of these limitations. NSA not only
provides safety assurances in the presence of a possibly unsafe neural
controller, but can also improve the safety of such a controller in an online
setting via retraining, without overly degrading its performance. To
demonstrate NSA's benefits, we have conducted several significant case studies
in the continuous control domain. These include a target-seeking ground rover
navigating an obstacle field, and a neural controller for an artificial
pancreas system.
