Hybrid Safety Middleware
- Hybrid safety middleware is a runtime layer that mediates between decision components and physical systems by enforcing safety protocols through model-based checks and anomaly detection.
- It integrates heterogeneous mechanisms—centralized and decentralized, deterministic and learned—to ensure system behavior stays within a safe envelope.
- Practical implementations span cyber-physical systems, AI safety orchestrators, and automotive middleware, emphasizing auditability, fail-safe continuity, and trade-offs with operational performance.
Hybrid safety middleware denotes a class of runtime safety and security layers that mediate between high-performance, opaque, or untrusted decision components and the actuated system they influence. Across the literature, it appears as a hybrid monitor spanning cyber and physical layers in cyber-physical systems, a safety orchestrator between sensors/actuators and end-to-end AI models, a runtime enforcer between controller and plant, a partition-boundary protocol over isolated domains, and a governance-centric gate between a proposer and a safety oracle (Aguma et al., 2018, Pitale et al., 23 Jul 2025, Sarwar et al., 10 Jun 2026, Yen et al., 5 May 2026, Malomgré et al., 28 Feb 2026). In each case, the middleware combines heterogeneous mechanisms—centralized and decentralized supervision, deterministic and learned checks, model-based verification and online editing, or nominal and fallback control—to keep execution inside a safe envelope while preserving operational continuity.
1. Definitional lineage and conceptual scope
The earliest works in this lineage already treated safety middleware as a model-based runtime intermediary rather than as a mere message bus. AWDRAT formalized a cognitive middleware in which an Execution Monitor interprets runtime observations against predictions generated from a System Architectural Model, checks entry and exit events against preconditions and postconditions, marks states as compromised when inconsistencies arise, and invokes diagnosis and recovery (Khan et al., 2014). The 2018 cyber-physical systems work defined a “hybrid monitor” as safety/security middleware that is simultaneously virtual and physical, central and distributed: virtual monitor components are implemented as hidden algorithms in SCADA units, while an independent physical monitor oversees them over a separate network (Aguma et al., 2018).
Subsequent work broadened the term without discarding that runtime-interposition role. HySAFE-AI described middleware as a safety orchestrator layer between sensors/actuators and end-to-end AI models and planners, intercepting data and control flows, aggregating telemetry, performing runtime risk estimation and anomaly or OOD detection, enforcing safety policies, selecting fallbacks, and logging evidence for safety cases (Pitale et al., 23 Jul 2025). Runtime enforcement for safety hybrid automata cast the enforcer as middleware between controller outputs and actuators, with continuous monitoring between synchronization points and the ability to suppress, delay, or insert events at arbitrary instants (Sarwar et al., 10 Jun 2026). Jiao, by contrast, located hybrid safety middleware on top of hardware-enforced isolation, treating the partition boundary itself as a safety interface through which non-expert integrators can customize behavior while a Safe IO Cell, a Parameter Synchronization Service, and a Safety Communication Layer preserve end-to-end safety (Yen et al., 5 May 2026).
This suggests that the phrase is best understood as a design pattern rather than a single standardized stack. What remains stable across uses is the presence of an intervening runtime layer with authority to validate, reject, modify, reroute, or replace unsafe behavior before that behavior reaches safety-critical state.
2. Recurrent architectural patterns
Despite substantial domain variation, the published architectures converge on a small set of recurring structural forms.
| Representative form | Runtime position | Characteristic mechanisms |
|---|---|---|
| Hybrid monitor for CPS (Aguma et al., 2018) | SCADA/controllers plus independent physical overseer | Physical invariants, randomized independent paths, rerouting, isolation |
| AI safety orchestrator (Pitale et al., 23 Jul 2025) | Between sensors/actuators and E2E models/planners | OOD detection, uncertainty calibration, hazard/risk service, gating, fallback |
| Partition-boundary robotics middleware (Yen et al., 5 May 2026) | Across Non-RT, RT, and safety cells | Safe IO override, atomic parameter sync, CRC-32C, sequence numbers, heartbeats |
| Runtime enforcer for hybrid automata (Sarwar et al., 10 Jun 2026) | Between controller and plant | Suppression, delay, insertion, runtime reachability |
| Governance-centric Proposer–Oracle middleware (Malomgré et al., 28 Feb 2026) | Between autonomous decision generator and deployment surface | Oracle querying, explicit policy engine, audit queues, signed patching, staged rollout |
HySAFE-AI made this decomposition especially explicit by enumerating interface adapters, runtime monitoring and anomaly or OOD detection, a hazard analysis and risk estimation service, policy enforcement and gating, an arbiter with fallback or failover control, logging and traceability, and safety case evidence generation with standards hooks (Pitale et al., 23 Jul 2025). A closely related pattern appears in the Alignment Flywheel, whose Proposer, Safety Oracle, Enforcement layer, and Governance MAS separate decision generation from safety governance and make the safety artifact versioned, patchable, and auditable without retraining the proposer (Malomgré et al., 28 Feb 2026).
Two additional architectural motifs recur. First, many systems split supervision across distributed local monitors and an independent overseer. The CPS hybrid monitor places a virtual monitor at each controller or SCADA node and a central physical monitor on a separate network; Jiao similarly distributes control across Non-RT, RT, and Safe IO partitions while reserving hardware override authority to the safety cell (Aguma et al., 2018, Yen et al., 5 May 2026). Second, many architectures combine a high-performance nominal path with a conservative verified fallback. This is explicit in Runtime Assurance or Simplex-like switching in HySAFE-AI, in the hybrid safe-by-construction collision-avoidance controller, in HJ-based safety-aware hybrid control, and in Synergistic Simplex (Pitale et al., 23 Jul 2025, Wang et al., 2021, Vertovec et al., 2022, Bansal et al., 5 May 2026).
The result is not architectural uniformity but a consistent separation of concerns: capability-producing components remain optimized for performance, while safety middleware concentrates verification, enforcement, and evidence production in a smaller and more governable runtime surface.
3. Formal assurance mechanisms
The literature couples middleware with explicit mathematical objects that define when intervention is necessary and what guarantees follow. In the CPS hybrid monitor, the core detection mechanism is validation against physical invariants, defined as logical properties of a CPS that cannot be transformed by cyber entities and should always hold. The work supplements this with Shannon entropy and Multiple Security Domain Nondeducibility. Its entropy argument starts from
and shows that randomized independent multipath routing increases the sample space from two possible flow events to $2(n+1)$ events, yielding
so attacker uncertainty increases monotonically with the number of independent paths (Aguma et al., 2018). Its MSDND argument shows that adding a monitor domain with a valuation function grounded in physical invariants changes the system from MSDND secure, where attacks can remain undeducible, to notMSDND secure, where attacks become deducible (Aguma et al., 2018).
Model-based semantic monitoring provides a second formal strand. AWDRAT defines denotational semantics for events, observations, state, environment, and resources; its monitor predicate checks whether each observed runtime event corresponds to a predicted event in the architectural model and whether component-level preconditions and postconditions hold (Khan et al., 2014). Runtime enforcement with safety hybrid automata extends this idea from observation to intervention. Safety properties are encoded in a hybrid automaton with a trap Sink, and the enforcer can suppress unsafe events with stutter, delay them until guards hold, or insert corrective events when continuous evolution would otherwise violate invariants before the next synchronization point (Sarwar et al., 10 Jun 2026).
A third strand is control-theoretic. For stochastic hybrid systems, augmented control barrier certificates unify continuous evolution and instantaneous jumps through the one-step inequality
which yields explicit finite-horizon bounds on the probability of reaching unsafe regions (Lavaei et al., 2022). For hybrid-system verification, safe-neighborhood computation constructs a tube around a nominal trajectory and reasons about guard proximity, reset maps, and event-time uncertainty so that all initial states in the neighborhood remain safe over the horizon (Deng et al., 2015). In HJ reachability for airborne wind energy, safety is characterized by a reach–avoid value function and a switching law that activates the safety controller when the state approaches the backward reachable set boundary (Vertovec et al., 2022). In the hybrid safe-by-construction collision-avoidance controller, the safe layer computes
so the selected target speed never exceeds the maximal safe speed implied by current headway and maximum deceleration (Wang et al., 2021).
AI-oriented middleware adds statistical hazard analysis to these mechanisms. HySAFE-AI adapts FMEA and FTA to foundation models, using
OOD scoring via Mahalanobis distance
predictive entropy, calibration error, and runtime risk aggregation to raise or lower the threshold for gating and fallback (Pitale et al., 23 Jul 2025). Synergistic Simplex formalizes when a safety layer may consume selected ML outputs without destroying deterministic guarantees: outputs may be used only if they are structurally independent of the Simplexed function in the system’s fault-propagation DAG; upstream use is inadmissible because it violates the original Perception Simplex guarantee (Bansal et al., 5 May 2026).
4. Domain-specific instantiations
In cyber-physical infrastructure, hybrid safety middleware is motivated by the inadequacy of firewall-only defenses. The hybrid monitor paper analyzes cyber-only attacks such as ransomware, physical-only attacks such as cut cables or broken sensors, and cyber-physical attacks such as Stuxnet. It places virtual monitors adjacent to DGI or SCADA nodes, validates field-device outputs against physical invariants, generates randomized information-flow paths, isolates infected nodes, reroutes traffic through uncompromised nodes, and aims to keep critical functions running while damage is repaired (Aguma et al., 2018).
In AI-heavy autonomy, HySAFE-AI turns FMEA and FTA results into concrete runtime services for ADS and robotics. Its case study reports high-RPN hazards including quantization-induced hallucinations and temporal reasoning failure at RPN 252 before mitigation, dataset staleness at RPN 216, feature extraction degradation and constraint-adherence failure at RPN 150, and semantic misinterpretation at RPN 100. After the middleware interventions, the example deltas reported are detection index reduced and RPN $2(n+1)$0 for quantization-induced hallucinations and temporal reasoning failure, $2(n+1)$1 for dataset staleness, $2(n+1)$2 for hallucinations, and $2(n+1)$3 for feature extraction degradation (Pitale et al., 23 Jul 2025). Synergistic Simplex addresses a narrower but formally analyzed slice of the same problem: in CARLA obstacle-detection experiments, PS and SS both maintained collision rate $2(n+1)$4 where the ML baseline failed in the in-lane missed-obstacle case, while SS improved route completion rate from $2(n+1)$5 to $2(n+1)$6 in a nearby-lane obstacle scenario by using admissible lane information to replace unnecessary braking with throttle release (Bansal et al., 5 May 2026).
For health-adjacent assistants, the middleware role becomes a last-mile guard rather than a controller switch. The Tessa case study proposes a single-call, fail-closed layer with deterministic lexical gates, an in-line LLM policy filter that emits a strict JSON verdict, final deterministic rescanning, and escalation routes. In its synthetic evaluation, the single-call JSON verdict method blocked $2(n+1)$7 malicious prompts, matching the recall of two-call LLM-judge pipelines but at approximately $2(n+1)$8 latency and $2(n+1)$9 token overhead, compared with approximately 0–1 latency and 2 tokens for multi-stage stacks (Reddy et al., 7 Sep 2025).
Automotive and robotics deployments emphasize temporal determinism, health supervision, and communication integrity. The ROS 2 versus AUTOSAR Adaptive comparison reports that ROS 2 fulfills 13 middleware requirements, partially fulfills 1, and does not fulfill 19, whereas AUTOSAR AP fulfills 23, partially fulfills 1, and does not fulfill 9; the most pronounced gap across both platforms is scheduling, while AUTOSAR AP provides PHM, EM, and DM mechanisms absent from ROS 2 (Hegerath et al., 24 Apr 2026). Jiao addresses mixed-criticality robotics on shared multicore hardware with a Safe IO Cell, a Parameter Synchronization Service, and a Safety Communication Layer; empirically, partition isolation reduces jitter standard deviation from 3 to 4, improves 5 from 6 to 7, improves 8 from 9 to 0, and eliminates all 1 excursions (Yen et al., 5 May 2026).
A separate automotive line focuses on transport freshness as a safety property. Sensor-in-Memory keeps latency-critical intra-host data paths in native shared-memory layouts beside ROS 2 rather than inside its standard transport. On an NVIDIA Jetson Orin Nano it reduces data-transport latency by up to 98%, mean latency by about 95%, and 2 tails by around 96%; in an Autoware.Universe deployment it increases localization frequency from 7.5 Hz to 9.5 Hz and cuts perception-to-decision latency from 521.91 ms to 290.26 ms, corresponding at 40 mph to a reduction of emergency braking reaction distance by approximately 13.6 ft (He et al., 13 Oct 2025).
5. Implementation, interfaces, and operational governance
Implementation practice is defined by where the middleware attaches and what authority it possesses over data and control flow. In CPS, virtual monitors are implemented as hidden algorithms in SCADA or controller nodes, intercept input and output to control loops, touch the network stack for path selection and rerouting, validate messages at sensor and actuator interfaces, and communicate with a central physical monitor over an entirely different network than that used by the rest of the CPS (Aguma et al., 2018). In Jiao, ivshmem channels and doorbell interrupts are treated as untrusted transports wrapped by a Safety Communication Layer that adds CRC-32C, monotonic sequence numbers, timestamps, heartbeats, timeouts, and progressive degradation semantics, while the RT domain applies parameter sets atomically and retains last-known-good values on failure (Yen et al., 5 May 2026).
In AI systems, the interface surface is often more semantic than electrical. HySAFE-AI instruments sensor feeds, encoded latents, planner outputs, and control commands, exposes telemetry schemas to downstream safety services, and exports structured artifacts aligned with ISO 26262, ISO 21448, IEC 61508, ISO/PAS 8800, ISO/TS 5083, and related AI standards (Pitale et al., 23 Jul 2025). The Tessa safeguard uses strict function boundaries—3, 4, rescan, aggregate, render—and fail-closed control logic in which invalid JSON, parse failure, timeout, or schema mismatch default to refusal or escalation rather than delivery (Reddy et al., 7 Sep 2025). The Alignment Flywheel generalizes this into deployable governance middleware through a stable Safety Oracle API, a runtime policy engine, append-only knowledge-base records, signed patch commits, anti-rollback checks, and staged rollout rules based on uncertainty and canary metrics (Malomgré et al., 28 Feb 2026).
Platform integration has therefore become part of the safety argument. The automotive middleware comparison advocates a pragmatic hybrid in which ASIL C/D functions remain inside AUTOSAR AP under EM, PHM, and DM governance, while ROS 2 hosts QM features and bridges DDS topics or services to AUTOSAR COM or RDS interfaces with bounded, strongly typed data models (Hegerath et al., 24 Apr 2026). Sensor-in-Memory adopts a still narrower hybridization: ROS 2 remains responsible for inter-host communication, discovery, QoS, and tooling, while only latency-critical intra-host publish or subscribe paths are replaced with lock-free bounded double buffers, sequence numbers, a writer heartbeat, and optional checksums (He et al., 13 Oct 2025).
Across these implementations, two operational themes dominate. One is fail-safe continuity: rerouting around compromised nodes, switching to certified fallback controllers, engaging emergency braking, or deasserting motor enables through hardware override (Aguma et al., 2018, Pitale et al., 23 Jul 2025, Yen et al., 5 May 2026). The other is auditability: logs, diagnostic events, traceability matrices, verdict records, and release ledgers are not ancillary instrumentation but part of the middleware’s intended output.
6. Limitations, trade-offs, and open problems
The common strength of hybrid safety middleware—runtime interposition using richer cross-domain evidence—also defines its principal limitations. Most designs presuppose the existence of online-checkable invariants, reliable valuation functions, or sound verification procedures. The CPS hybrid monitor assumes physical invariants exist and can be validated online, while also noting that invariant generation may require domain expertise or automated techniques such as machine learning or association rule mining (Aguma et al., 2018). Barrier-certificate and safe-neighborhood approaches assume sufficiently regular dynamics, guard structure, and tractable dimensionality; the SHS work notes that polynomial SOS barriers can be conservative and that scalability to high-dimensional SHS remains challenging (Lavaei et al., 2022, Deng et al., 2015).
AI-oriented variants inherit additional epistemic limits. HySAFE-AI explicitly identifies opaque latent representations, distribution shift, brittle OOD detectors, computational overhead, and verification difficulty at scale as unresolved issues (Pitale et al., 23 Jul 2025). The health-assistant safeguard reports only a small synthetic evaluation, does not assess statistical significance, and acknowledges overblocking, multilingual gaps, indirect framings, adversarial bypasses, privacy constraints, and correlated failures when the same model backbone is reused for generation and judging (Reddy et al., 7 Sep 2025). Synergistic Simplex preserves guarantees only under structural independence assumptions; upstream ML-to-safety use is formally inadmissible, and the AV instantiation additionally assumes static obstacles, nominal sensors, and lane-detection correctness for the scenarios considered (Bansal et al., 5 May 2026).
Systems-oriented variants expose a different trade-off: safety often improves by constraining flexibility. SIM deliberately favors freshness over completeness, so consumers may skip intermediate frames by design; it is intra-host only and assumes a single writer per stream (He et al., 13 Oct 2025). Jiao attains freedom from interference and safe customization at the cost of a static partitioning regime, a custom black-channel protocol, and an extra safety partition (Yen et al., 5 May 2026). The ROS 2 versus AUTOSAR analysis shows that stronger deployment-oriented safety control is accompanied by continuing gaps in advanced runnable-level determinism, which remain largely an OSI or OS concern (Hegerath et al., 24 Apr 2026).
A further open question concerns the middleware itself as an attack surface and certification target. The CPS monitor paper explicitly notes that advanced attackers might target the monitor and that future work must harden and diversify monitor nodes (Aguma et al., 2018). Jiao discusses IEC 61508 and common SIL 2 patterns but does not report completed certification, while the automotive comparison does not report ISO 26262 certification status for either ROS 2 or AUTOSAR AP, and SIM states that formal certification would require additional process, verification, and safety cases (Yen et al., 5 May 2026, Hegerath et al., 24 Apr 2026, He et al., 13 Oct 2025). Current work therefore trends toward standardizing telemetry schemas, monitor APIs, and arbitration policies; expanding audit and evidence pipelines; improving formal timing analysis; and developing explicit defenses against attacks on the safety layer itself (Pitale et al., 23 Jul 2025, He et al., 13 Oct 2025, Aguma et al., 2018).
In that sense, hybrid safety middleware is less a settled middleware category than an evolving synthesis of runtime assurance, model-based verification, safety-oriented communications, and operational governance. Its unifying proposition is that safety can be externalized into an intervening layer with stronger guarantees, narrower interfaces, and clearer audit semantics than the high-capability components it supervises.