SanDRA Research: Reasoning & Safe Driving

• SanDRA is a term referring to two independent systems: one for neuro-symbolic inference using the DnS ontology and one for safe decision making in automated vehicles.
• In the neuro-symbolic domain, SanDRA integrates vector representations with deductive reasoning to classify values based on role-filling and geometric inference.
• In automated driving, SanDRA leverages large language models combined with reachability analysis and temporal logic to ensure legally compliant, safe maneuvers.

Searching arXiv for the relevant SanDRA papers to ground the article and confirm the metadata. SanDRA is a name used in arXiv literature for two technically distinct systems. In one usage, sandra denotes a neuro-symbolic reasoner that combines vectorial representations with deductive reasoning, builds a vector space constrained by an ontology, and performs reasoning over it; it is based on the Description and Situation (DnS) ontology design pattern, a formalization of frame semantics (Lazzari et al., 2024). In another usage, SanDRA denotes a safe large-language-model-based decision making framework for automated vehicles using reachability analysis, combining LLMs with reachability-based formal verification to provide provably safe and, where possible, legally compliant driving actions (Lin et al., 8 Oct 2025). The overlap in nomenclature makes disambiguation necessary in scholarly use.

1. Nomenclature and scope

A common source of confusion is that the label SanDRA refers to two independent research lines rather than to a single evolving system. The distinction is domain-specific: one system is situated in neuro-symbolic reasoning and ontology-grounded inference, while the other is situated in automated-vehicle decision making and formal safety verification.

Usage	Domain	Core description
sandra	Neuro-symbolic reasoning	combines vectorial representations with deductive reasoning
SanDRA	Automated vehicles	safe large-language-model-based decision making using reachability analysis

The neuro-symbolic usage is introduced by “Sandra -- A Neuro-Symbolic Reasoner Based On Descriptions And Situations” (Lazzari et al., 2024). The automated-driving usage is introduced by “SanDRA: Safe Large-Language-Model-Based Decision Making for Automated Vehicles Using Reachability Analysis” (Lin et al., 8 Oct 2025). This suggests that the shared name should not be taken to imply methodological continuity.

2. Neuro-symbolic foundation in Descriptions and Situations

In the neuro-symbolic line, Sandra is presented as a reasoner whose central operation is to build a vector space constrained by an ontology and to perform reasoning over it. Its geometric nature allows its combination with neural networks, with the stated aim of bridging the gap with symbolic knowledge representations. The system is based on the Description and Situation ontology design pattern, and the original formulation states that, given a set of facts, viewed as a situation, it allows one to infer all possible perspectives, viewed as descriptions, that can provide a plausible interpretation for it, even in presence of incomplete information; the method is proved correct with respect to the DnS model (Lazzari et al., 2024).

A concrete ontological instantiation appears in the value-classification setting. There, DnS treats both descriptions and situations as n-ary relations. A Description $D$ defines a set of Roles $R_1 \ldots R_n$, and a Situation $S$ associates concrete individuals to roles; if $S$ “fits” $D$, in the sense that it fills all of its roles, then “$S$ satisfies $D$.” The application introduces the classes ValueDescription, Situation, and Role, together with the object properties hasRole, hasParticipant, satisfiesDescription, and satisfiedBySituation (Lazzari et al., 2024).

The same application also gives representative DL axioms. Among them are:

$$\text{ValueDescription} \sqsubseteq \geq 1\ \text{hasRole.Role}$$

$$\text{Situation} \sqsubseteq \geq 1\ \text{hasParticipant.Role}$$

and a role-filling interpretation under which a situation satisfies a description iff it fills all roles of that description. In that setting, the role-filling test is performed by SanDRA’s geometric reasoner rather than by OWL/DL entailment alone (Lazzari et al., 2024).

3. Inference pipeline and integration with distributional semantics

In the value-classification workflow, the high-level pipeline has four stages: an input sentence in raw text form; a parser or semantic role labeler, specified as BART-based, that produces a Situation $S$; the ontology reasoner SanDRA, which computes $R_1 \ldots R_n$0 for each ValueDescription $R_1 \ldots R_n$1; and an optional fusion stage with distributional features to obtain a final score or class (Lazzari et al., 2024).

The sentence-to-situation conversion is specified through semantic role labeling. In the example “If you choose to be a police officer you are responsible to uphold justice…”, the BART SRL model tags spans as roles such as Agent, Role, and Theme, and exports a Situation with assertions of the form S(hasParticipant, Agent, you) and S(hasParticipant, Role, police_officer). Each role-to-span pair becomes an individual and a typed role-filler in the situation (Lazzari et al., 2024).

SanDRA’s inference layer is described geometrically. Each Description $R_1 \ldots R_n$2 and each Situation $R_1 \ldots R_n$3 is embedded into a high-dimensional “conceptual space” derived from the DnS pattern. The reasoner then computes a “satisfaction score” $R_1 \ldots R_n$4 via

$R_1 \ldots R_n$5

where $R_1 \ldots R_n$6 is logistic, $R_1 \ldots R_n$7 is a learned role-alignment transform, and $R_1 \ldots R_n$8 is dot-product (Lazzari et al., 2024).

The same study specifies an explicit fusion strategy with distributional semantics. Let $R_1 \ldots R_n$9 be a vector-space similarity between a sentence embedding and a prototype embedding for value $S$0. Then the final score is

$S$1

with $S$2 as a tuning hyper-parameter. A second integration strategy concatenates the vector of SanDRA inference scores with either TF-IDF or sBERT features and feeds the result into standard classifiers including LogisticRegression, SVM, RandomForest, DecisionTree, LightGBM, MLP, NaïveBayes, and KNN (Lazzari et al., 2024).

4. Evaluation, interpretability, and visualization in value classification

The value-classification study evaluates SanDRA on a synthetic dataset generated via Mistral-7B in a role-play, cloze, few-shot style. The generation process starts from 3 manually curated sentences evoking a target value and prompts the model to “Generate a new sentence that includes these roles … ” with randomly 2–15 roles from ValueNet’s 513. The total generated volume is 10,000 sentences, or 1,000 per value; after filtering approximately 10% hallucinations and poorly formatted outputs, the final dataset contains 6,844 Situation annotations, with a split of $S$3 train and $S$4 test (Lazzari et al., 2024).

The reported test-set accuracy shows that the best overall result is LightGBM with TF-IDF+SanDRA at 0.62 accuracy, with an improvement over neural-only features, specifically sBERT, by +17%. The study further reports that SanDRA alone already outperforms naïve baselines and that fusion yields consistent +5–15% gains across all classifiers. These observations are consistent with the more general claim in the original Sandra abstract that, without increasing complexity, the reasoner outperforms all the baselines, provides interpretability in the classification process, and allows control over the vector space, which is designed a priori (Lazzari et al., 2024, Lazzari et al., 2024).

Interpretability is treated as a first-class property. For LogisticRegression, learned weights are inspected for each feature, whether a TF-IDF token or a SanDRA score; the example given states that satisfiesDescription:Authority is the strongest feature for Authority. For LightGBM, feature importance across decision trees is used to identify which SanDRA scores or tokens drive splits. The corresponding online visualization tool at http://xmv.geomeaning.com/ accepts a user-provided sentence, applies BART-based SRL to highlight spans and assigned roles, produces a bar chart of satisfaction degrees for each Moral Foundations Theory dimension, and includes a Sentiment.VADER meter and interactive panels showing which roles were matched and which roles are missing; the tool can also be used in data annotation by allowing users to refine role labels and immediately see updated moral-value satisfactions (Lazzari et al., 2024).

5. Safe large-language-model-based decision making for automated vehicles

In the automated-driving line, SanDRA is defined as a framework that combines the commonsense reasoning of LLMs with the provable guarantees of reachability-based formal verification in the decision layer of an automated vehicle. The framework starts from a comprehensive description of the driving scenario, prompts an LLM to generate and rank feasible driving actions, translates these actions into temporal logic formulas that incorporate formalized traffic rules, and integrates them into reachability analysis to eliminate unsafe actions; the first remaining action is then executed, optionally with its reachable “tube” passed to a lower-level trajectory planner (Lin et al., 8 Oct 2025).

The formal scenario representation is given in discrete time $S$5 with step size $S$6. The ego state is

$S$7

with control input

$S$8

and dynamics

$S$9

In curvilinear coordinates on a lane $S$0, the state is specified as $S$1. Obstacles have predicted occupancies $S$2, and the forbidden-state set is defined as

$S$3

Traffic rules are drawn from an explicit catalog, with examples for Germany given as the safe-distance rule R_G1, the no-unnecessary-braking rule R_G2, and the speed limit rule R_G3 (Lin et al., 8 Oct 2025).

Prompting is structured into four blocks: system prompt, ego-vehicle prompt, traffic rules, and obstacles. The action space is pre-filtered to the longitudinal set

$S$4

and the lateral set $S$5, restricted to options that are geometrically and legally feasible in the current lane structure. The LLM is asked to return the top $S$6 advisable action pairs ranked best to worst, and in practice $S$7 (Lin et al., 8 Oct 2025).

Each maneuver pair is translated into an $S$8 specification. The grammar is given as

$S$9

with $D$0 meaning “always on this finite horizon” and $D$1 meaning “eventually within the finite horizon.” Action formulas include, for example, keep: $D$2, accelerate: $D$3, stop: $D$4, and follow-lane: $D$5. Rule formulas are conjoined with action formulas; for the safe-distance rule,

$D$6

Reachability analysis then computes an over-approximation $D$7 of the set of reachable states satisfying the specification while avoiding collisions. If $D$8 ever becomes empty, the candidate is declared unsafe. A fail-safe backup, such as full brake to stop in place, is always maintained for infinite-horizon safety (Lin et al., 8 Oct 2025).

6. Empirical performance, limitations, and conceptual relation

The automated-driving SanDRA is evaluated in both open-loop and closed-loop settings. In open-loop evaluation, the dataset comprises 1,200 scenarios from highD used for fine-tuning and 800 scenarios from MONA for testing. The metrics include Safe@$D$9, defined as the fraction of scenarios in which at least one of the top $S$0 maneuvers is provably safe, and Top-$S$1 accuracy against a human label. GPT-4o and a local Qwen3 (8B) with LoRA fine-tuning are used. The reported results state that fine-tuned models achieve Safe@1 $S$2, Safe@3 $S$3, and Top-1 accuracy improves from $S$4; Qwen3-8B runs in 0.7 s versus GPT-4o in 5.6 s (Lin et al., 8 Oct 2025).

In closed-loop simulation, the environment is highway-env with four- or five-lane highways at densities $S$5. The metrics include success rate with no collision, collision-free steps, rule-compliant steps per rule, combined success steps defined as collision-free and all-rules, traveled distance, and fail-safe rate. Four SanDRA variants are tested: most-likely predictions without rules in reachability, most-likely with rules, set-based predictions without rules, and set-based with rules. At density 3 on a five-lane highway, the baseline DiLu has success $S$6, while S+set+rules reaches success 100%; 27.6 of 30 steps are collision-free and R_G3-compliant, R_G1 \approx 23.3 steps, and R_G2 \approx 20.2, with fail-safe engaged at approximately 26% of steps. The paper attributes perfect success at all densities to set-based predictions and notes that adding rule constraints raises fail-safe usage while still improving overall safe-plus-legal success steps (Lin et al., 8 Oct 2025).

The limitations are explicit. Prediction fidelity depends on bounded accelerations of other vehicles; conservatism can enlarge the fail-safe footprint and reduce average speed; cloud calls to GPT-4o take 5–6 s and are acceptable for 1 Hz planning but too slow for 10 Hz; and a fixed horizon $S$7 may be suboptimal across urban and highway settings (Lin et al., 8 Oct 2025).

Taken together, the literature supports a strict disambiguation of the term SanDRA. One line concerns ontology-constrained geometric reasoning over descriptions and situations, including explainable value classification (Lazzari et al., 2024). The other concerns LLM-generated high-level maneuvers filtered by temporal logic and reachability analysis for automated vehicles (Lin et al., 8 Oct 2025). This suggests that the shared name denotes a nominal coincidence rather than a unified research program.