  We present Barrier Certificate-based Simplex (BC-Simplex), a new, provably
correct design for runtime assurance of continuous dynamical systems.
BC-Simplex is centered around the Simplex Control Architecture, which consists
of a high-performance advanced controller which is not guaranteed to maintain
safety of the plant, a verified-safe baseline controller, and a decision module
that switches control of the plant between the two controllers to ensure safety
without sacrificing performance. In BC-Simplex, Barrier certificates are used
to prove that the baseline controller ensures safety. Furthermore, BC-Simplex
features a new automated method for deriving, from the barrier certificate, the
conditions for switching between the controllers. Our method is based on the
Taylor expansion of the barrier certificate and yields computationally
inexpensive switching conditions. We consider a significant application of
BC-Simplex to a microgrid featuring an advanced controller in the form of a
neural network trained using reinforcement learning. The microgrid is modeled
in RTDS, an industry-standard high-fidelity, real-time power systems simulator.
Our results demonstrate that BC-Simplex can automatically derive switching
conditions for complex systems, the switching conditions are not overly
conservative, and BC-Simplex ensures safety even in the presence of adversarial
attacks on the neural controller.
