Paper tests last-moment checks for stale industrial control commands
Original title: Execution-Time Validation of Context-Carrying Action Intents in Industrial Cyber-Physical Systems
Only a check inside the controller scan closed a pause window that replica checks missed.
A cs.CR paper defines an execution gap: industrial commands can become wrong after inference and transport, for example after an operator pause. The Action Intent Schema records how long a decision stays valid, and runtime XAIR rechecks intents before release, including version-conditional commands. In ablations on emulated and physical cells, replica checks always left an unprotected interval. A controller-local interlock or version-conditional command closed it for state that controller owns.
Unconfirmed: Results come from controlled ablations with declared ground truth, not production incidents.
- Pauses written a few to over 100 ms after submission escaped replica checks.
- A global version revoked valid commands after unrelated updates.
- Predicate-scoped versions avoided false revocations on continuous signals.
- On one embedded-board core, XAIR validated 148-168 intents per second.
- Tests used OpenPLC and ARM and RISC-V boards.
From the original article
1 min read at arxiv.orgIn industrial cells, commands from learned policies, operators and schedulers reach the controller after inference, confirmation and transport, and the plant may have changed meanwhile, for instance by an operator pause. Such a command is released, or takes effect, when it is no longer correct. We call this the execution gap and ask which component should make the last check, and against which version of which state.
By Luca D'Agati · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.