Let any intelligence lead. Only admissible actions reach the platform.
Machine learning is good at perception and at proposing courses of action. It is not something you can certify on a critical path. The answer the field has converged on is runtime assurance: let the capable, unverified controller propose, and let a small, verifiable layer decide what executes.
Perslis is that layer. A learned model, a symbolic planner or a crew can sit on top of it; whatever it proposes, the platform only ever executes an admissible action or a safe hold — and every refusal is written down with the evidence behind it.
The pattern, and whose it is
Runtime assurance is not our invention. The Simplex architecture (Sha, 2001) hands control from an unverified controller to a verified one near the edge of the safe set; shielding (Alshiekh et al., 2018) filters a learning agent's actions against a specification; ASTM F3269 standardises bounding the behaviour of unmanned aircraft that contain complex functions. We build on them. What Perslis adds:
- The authority is computed first. The admissible set comes from sourced rules and human orders before the proposer chooses, so the proposer only ever chooses among admissible actions — a prior restriction, not a veto after the fact (the runtime).
- Orders only narrow. A standing order outranks any amount of experience (Theorem 2 in Fail-First Models).
- Learning cannot widen it. The floor learns from failures as readable rules, each citing the failures behind it, and it is proved that learning can remove and reorder options but never add one (Theorem 1, pinned by tests in the same paper).
The evidence
| on top of the floor | result | written up in |
|---|---|---|
| A hostile controller CARLA, photoreal driving | Over a continuous 40,052 m run it emitted 64,952 invariant-violating commands; the floor overrode all of them, with 0 collisions. With the floor removed, the same proposals reached the actuator: 43 dangerous commands admitted, 2 collisions within seconds. | CARLA admission control |
| Language models at the wheel frontier and local models, CARLA | 0 collisions under the floor, but a measured ~0.8–2.0 s glance latency: a model holds a stale command and drives ~10 m blind at 40 km/h. Every language model crawled at ~8–10 km/h; the classical controller drove at 34 km/h. | CARLA admission control |
| Language models in a real-time 3D tank arena BZFlag, one headline match | Rules 20–20 on 60,140 decisions; DeepSeek 10–18 at ~1.0 s per decision; a frontier model reached through its command-line interface 1–15 at 7.6 s per decision (58 decisions — a transport limit, not a model measurement). BZFlag's own AI beat our rules. | Rules at the Wheel |
| The game's own bot AI as the planner Quake III Arena engine, skill-5 opponents | In progress: paired matches, the same bot with the floor on and off. Reported here with its sample size when measured. | — |
What the floor guarantees, and what it does not
- Guarantees (proved, and pinned by tests in VDSG): every executed action lies in the admissible set or is a safe hold, for every state the learner can reach; an order outranks experience.
- Does not make the proposer competent. A correct floor can refuse the mission: on Freeway, three correct rules blocked the only scoring move (−12%).
- Does not certify anything. Nothing here carries a functional-safety qualification, and a sensor that lies to the floor lies to the proof. See limits.
The edge
Tempo and accountability together. The proposer runs as fast as it can think; the floor checks ground truth every cycle (20 Hz in CARLA) and writes down every refusal with its evidence — so the team gets machine-tempo decisions and an account of every one of them it can put in front of a safety board.