Oracle/Controller Runtime

• Oracle/controller runtimes are formally specified mechanisms that supervise, verify, and adapt controller systems in safety-critical domains, ensuring compliance using models like edit automata and CSP.
• They employ synthesis algorithms such as PLC monitor synthesis, CSP-based verification, and imitation learning for graceful enforcement with guaranteed transparency, soundness, and efficiency.
• Operating in real time alongside controllers, these runtimes intercept, correct, or advise on actions to prevent safety breaches and enhance system reliability in applications like autonomous driving and industrial control.

An Oracle/Controller Runtime is a formally specified, operational mechanism that supervises, verifies, enforces, or dynamically adapts the behavior of a controller system—typically in safety-critical, cyber-physical, or high-performance settings—during its execution. This runtime entity, which may act as a "monitor," "enforcer," "oracle," or more recently as a "consultant," operates in parallel or in-line with the controller, intercepting, correcting, or advising on every observable action, with the primary objective of ensuring compliance with system specifications, safety requirements, or quantitative performance criteria. Recent research formalizes diverse methodologies ranging from edit automata-based enforcement for programmable logic controllers, discrete-timed automata contract managers for adaptive CPS controllers, CSP-driven verification oracles, consultant-driven value maximization, assured CBF-based safety filters, and low-latency imitation-learned scheduling oracles.

1. Formal Foundations and Taxonomy

Oracle/controller runtimes are grounded in formal models that capture both the control system's execution and the specification or property to be enforced or verified.

• Timed Process Language (TPL): Used for PLC-style controllers, TPL organizes control logic into discrete scan-cycles with sensor readings, actuator commands, channel communications, and tick synchronization (Lanotte et al., 2021).
• Edit Automata (Ligatti et al. subclass): Defines monitors that can allow, suppress, or insert actions to enforce correctness properties in a deterministic, finite-state manner.
• Valued Discrete Timed Automata (VDTA): In adaptive CPS frameworks, contracts are defined as VDTAs that operate over input/output traces, encoding safety as reachability of accepting locations within the automaton (Pearce et al., 2021).
• Communicating Sequential Processes (CSP): Models a system as an LTS, enabling offline or online runtime verification of event traces against processes representing system requirements (Luckcuck, 2020, Luckcuck et al., 17 Jun 2025).
• Runtime Consultants: Proactive, recommendation-generating algorithms for Black-box value functions on infinite words; generalize monitors and oracles, providing sets of recommended actions per prefix based on the value or specification (Fisman et al., 3 Aug 2025).
• Assured CBF-based Filters: Runtime assurance mechanisms for disturbed nonlinear systems, combining control barrier functions, backup sets, and online reachability approximations (Abate et al., 2020).
• Imitation-Learned Scheduling Oracles: Schedulers trained offline via DAgger-style imitation learning to approximate offline optimal scheduling policies on heterogeneous compute platforms (Krishnakumar et al., 2020).

2. Monitor and Enforcer Synthesis Algorithms

The process of constructing runtime enforcement or verification oracles is algorithmically formalized.

• PLC Monitor Synthesis: For each timed correctness property $e$, a deterministic edit-automaton-based monitor $\mathcal{M}_P(e)$ is synthesized via a compositional procedure: sequential composition for concatenation ($p_1;p_2$), automaton product for intersections ($p_1\cap p_2$), and summation for choice constructs ($\bigcup$). Special logic ensures the allowance or suppression/insertion of events to maintain cycle-level correctness; see pseudocode in Table 6 (Lanotte et al., 2021).
• Runtime Interchange Manager: At each tick, input/output traces are validated against mode contracts (VDTAs), with precondition/postcondition checks guaranteeing the acceptability of mode switches. The architecture loops over controller groups, applies input/output monitors, and performs suspension and selection in $O(p)$ time (Pearce et al., 2021).
• CSP Monitor Synthesis: CSP process is parsed into an explicit LTS ($S$, $s_0$, $\Sigma$, $→$), from which a monitor oracle is synthesized as a state-event-next mapping. Event checking is a constant-time table lookup (Luckcuck et al., 17 Jun 2025).
• Runtime Consultant Construction: For $\omega$-regular and quantitative properties, strong and weak recommendation sets are precomputed per automaton state (using reachability, cycle detection, mean-payoff or robustness criteria), then queried in $O(1)$ time at runtime (Fisman et al., 3 Aug 2025).
• CBF-based Assured Controller: As a "filter-QP," the runtime executes: (i) backup barrier computation via mixed-monotonicity reachability (embedding system); (ii) constrained QP solving for each state; (iii) fallback to backup control if the desired control input is unsafe (Abate et al., 2020).
• Imitation-Learned Scheduler: Hierarchical state-feature representation drives cluster and PE-selection policies; regression tree or MLP classifiers are trained from offline Oracle traces using DAgger to mitigate covariate shift (Krishnakumar et al., 2020).

3. Formal Guarantees and Theoretical Properties

Constructed runtime oracles/enforcers verify or enforce a suite of properties vital for operational reliability and compliance.

Guarantee	PLC Monitors (Lanotte et al., 2021)	Interchange (Pearce et al., 2021)	Consultant (Fisman et al., 3 Aug 2025)
Transparency	Monitor leaves correct runs untouched	Output passes iff contract satisfied	Recommendations only constrain possible future acceptance
Soundness	All emitted traces satisfy $e$	No execution allowed into a contract's trap state	Subset of actions always preserves possible value
Deadlock/Div-Free	Never blocks or infinite suppressions	Never deadlocks or diverges	Adaptation to wrong turns is instantaneous

• Transparency: Good traces (those conforming to properties) are unmodified; the oracle/interchange only acts on violations.
• Soundness: Every monitored or enforced execution conforms to the property or invariant.
• Deadlock Freedom: Monitors are constructed to avoid deadlock, provided initial sleep or tick conditions are met.
• Divergence Freedom: The runtime does not induce infinite suppressions or inactivity.
• Adaptivity: Runtime consultants, CBF-filters and interchange frameworks are designed to accommodate deviation, updating recommendations or falling back as needed.
• Complexity: Synthesis and per-tick runtime complexities are polynomial in model size, with constant-time execution in most cases.

4. Runtime Architectures and Execution Models

Oracles and runtime enforcement mechanisms vary by system type, input/output modalities, and integration depth.

• PLC Enforcement Oracle: The edit automata wrap the controller in-line, intercepting cycle-level actions for immediate correction or suppression; suppressions and insertions are timed to fit scan-cycle semantics (Lanotte et al., 2021).
• CSP Offline Monitor: An external tool (e.g. Varanus) collects controller logs, maps events via JSON, and applies the LTS monitor to the entire trace; pass/fail decisions are issued via model checker APIs (Luckcuck, 2020, Luckcuck et al., 17 Jun 2025).
• Runtime Interchange: The manager orchestrates mode selection, input-output monitoring, and contract state updates every tick; suspension and safe selection are performed for each controller group (Pearce et al., 2021).
• Consultant/Advisor: Runs in lock-step, continuously observing and recomputing recommendations per prefix, adapting immediately to unheeded advice (Fisman et al., 3 Aug 2025).
• Assured Controller (ASIF): A filter-QP composed at each state selects either the provided input or backup control, conditioned on barrier feasibility (Abate et al., 2020).
• Imitation-Learning Scheduler: On every scheduling event, the runtime extracts state features, traverses trained trees or networks, and chooses mappings with microsecond latency (Krishnakumar et al., 2020).

5. Complexity, Scalability, and Empirical Evaluation

• PLC Monitors: Synthesis of monitors with $m$ operators and $k$ intersections runs in $O(|P|\cdot m^{k+1})$ time. Product of automata has $O(|P|\cdot v_1 v_2)$ cost. Scalability is ensured for controller networks under maximal synchronization, with no added complexity for composition (Lanotte et al., 2021).
• Interchange Manager: Per-tick overhead is $O(p)$ for $p$ modes, with empirical overhead $\approx 2.2\%$ and low single-digit microsecond latency per controller group (Pearce et al., 2021).
• CSP Monitor: Monitor synthesis is $O(|S|+|T|)$ (number of states, transitions). Event checking is $O(1)$. Stress-tests with $N\sim10^4$ showed linear performance; 100k-event traces verified in $\sim$20s (average $\sim$5000 events/s) (Luckcuck et al., 17 Jun 2025).
• Runtime Consultant: Synthesis for most value functions is polynomial (coNP for mean-payoff cyclic, quantitative robustness), per-step lookup $O(1)$ (Fisman et al., 3 Aug 2025).
• Assured Controller (ASIF): Each time-step requires embedding system simulation, soft-min evaluation, gradient calculation, and QP solution; empirical runtimes of $\sim$0.5s/QP for moderate models, expected drastically lower in optimized C-code (Abate et al., 2020).
• Imitation-Learned Scheduler: Trained policies yield $<1.2\,\mu$s per decision, with total policy size $<20$kB. Generalizes to unseen applications, SoC configurations, and noise perturbations, typically achieving $<1.01\times$ Oracle slowdown (Krishnakumar et al., 2020).

6. Interoperability, Applications, and Case Studies

• Industrial Water Treatment (PLC): Monitors synthesized for SWaT slice constrained tanks, valves and pumps against malware-induced misbehavior: overflow, valve chattering, and pump dry-run eliminated during monitored execution (Lanotte et al., 2021).
• Autonomous Driving (Interchange): F1/10 car used multiple modes/contracts to handle changing encounts (pedestrians, followers), with switching rate $\approx$1.5% and crash-rate reduction from up to 85% to $<$1% (Pearce et al., 2021).
• MASCOT Teleoperation (CSP Oracle): CSP monitors caught underspecification-induced deadlocks in fusion reactor teleoperated manipulators, verified trace compliance for $>$100k events/log (Luckcuck, 2020).
• Rover Mission (Varanus CSP Monitor): Detected radiation sensor faults and move order errors, checking traces in $<0.0004\,s$/event (Luckcuck et al., 17 Jun 2025).
• Runtime Consultant Examples: Call distributor automaton, weighted Sup/Inf graphs, and ω-regular robustness models guiding trajectories or alerting on inevitable violations (Fisman et al., 3 Aug 2025).
• Many-core Scheduling (Imitation-Learned Oracle): IL-scheduler approximated offline Oracle policy within $<1.01\times$ across varied workloads and heterogeneity (Krishnakumar et al., 2020).
• ORCHA Performance System: Milhoja runtime orchestrated varied CPU/GPU mappings for multiphysics simulation, enabling rapid exploration of mapping configuration for performance portability (Lee et al., 12 Jul 2025).

7. Limitations, Future Directions, and Open Challenges

• Manual Model Construction: CSP and TPL monitor specifications require careful mapping from informal documentation; automation remains ongoing (Luckcuck, 2020).
• Non-determinism and Partial Observability: Current CSP-based monitors require deterministic processes; non-deterministic extensions are planned (Luckcuck et al., 17 Jun 2025).
• Corrective Feedback: Standard monitors detect but do not synthesize corrective actions; runtime enforcement and predictive monitoring research seek to close this loop (Lanotte et al., 2021, Luckcuck et al., 17 Jun 2025).
• Adaptive Runtime Enforcement: Runtime Interchange and Consultant architectures propose dynamic adaptation and proactive recommendation, but the space of quantitative contracts and optimal steering policies warrants further exploration (Pearce et al., 2021, Fisman et al., 3 Aug 2025).
• Efficiency and Real-time Constraints: Reaching acceptable computational cost at higher problem scales, richer value functions, or in deeply embedded systems is an active area (Abate et al., 2020, Krishnakumar et al., 2020).
• Integration with System Middleware: Upcoming work includes ROS-level integrations, stand-alone CSP parsing, predictive multi-monitor orchestration (Luckcuck et al., 17 Jun 2025).

Oracle/controller runtime frameworks have established a robust foundation for assurance, adaptability, and compliance in the supervision of controller systems, offering scalable formal techniques covering enforcement, verification, consulting, and adaptive switch mechanisms under diverse operational and adversarial conditions.