The recent drive towards achieving greater autonomy and intelligence in\nrobotics has led to high levels of complexity. Autonomous robots increasingly\ndepend on third party off-the-shelf components and complex machine-learning\ntechniques. This trend makes it challenging to provide strong design-time\ncertification of correct operation.\n To address these challenges, we present SOTER, a robotics programming\nframework with two key components: (1) a programming language for implementing\nand testing high-level reactive robotics software and (2) an integrated runtime\nassurance (RTA) system that helps enable the use of uncertified components,\nwhile still providing safety guarantees. SOTER provides language primitives to\ndeclaratively construct a RTA module consisting of an advanced,\nhigh-performance controller (uncertified), a safe, lower-performance controller\n(certified), and the desired safety specification. The framework provides a\nformal guarantee that a well-formed RTA module always satisfies the safety\nspecification, without completely sacrificing performance by using higher\nperformance uncertified components whenever safe. SOTER allows the complex\nrobotics software stack to be constructed as a composition of RTA modules,\nwhere each uncertified component is protected using a RTA module.\n To demonstrate the efficacy of our framework, we consider a real-world\ncase-study of building a safe drone surveillance system. Our experiments both\nin simulation and on actual drones show that the SOTER-enabled RTA ensures the\nsafety of the system, including when untrusted third-party components have bugs\nor deviate from the desired behavior.\n