PaperlayerView exact revision on arXiv

Source-linked AI summary

Compiling Spatial Certificates into Temporal Contracts for Latency-Aware Control

Avinash malik

arXiv:2608.25228v1eess.SY

TL;DR

Real-time CPS schedulers must decide whether safety certificates will remain valid through computation and handoff latency, but online plant integration is costly and may require unavailable models. CIPS compiles spatial certificates offline into normalized temporal contracts for generic sampled-data scheduling, proving global hybrid safety invariance and matching LA-ETC safety with 60.5× lower evaluation overhead in the benchmark.

  • Problem

    Safety certificates are spatial, while predicting their validity during computation and handoff latency requires costly online plant integration that scheduling middleware may not support.

  • Method

    CIPS compiles heterogeneous spatial certificates offline into normalized, unit-rate temporal persistence contracts consumed by a plant-model-independent sampled-data scheduler.

  • Results

    60.5× lower evaluation overhead than LA-ETC was achieved while preserving the same safety outcome and minimum-gap bound across evaluated latency and sampling settings.

  • Takeaways & Limitations

    CIPS provides provable global hybrid safety invariance under bounded latency and sampling while eliminating online numerical integration from runtime scheduling.

Abstract

from arXiv · show

We introduce CIPS, a contract-driven execution abstraction for managing computational latency and sampled-data updates in safety-critical cyber-physical systems (CPS). A fundamental challenge in real-time control is that physical safety certificates are defined spatially, yet predicting their validity under non-zero computation and handoff latency requires online numerical integration of plant dynamics. CIPS resolves this operational dichotomy by systematically compiling heterogeneous spatial safety certificates into normalized, unit-rate temporal contracts entirely offline. This transformation abstracts complex plant dynamics, exposing a deterministic, O(1) temporal budget to a generic sampled-data scheduler. We formally prove that this architecture guarantees global hybrid safety invariance under bounded computational latency and asynchronous execution. Finally, we validate the framework via an autonomous vehicle braking benchmark, demonstrating a 60.5 times reduction in micro-architectural evaluation overhead compared to latency-aware event-triggered control (LA-ETC) while preserving safety bounds.

I. INTRODUCTION

CIPS addresses the mismatch between spatial safety certificates and latency-sensitive sampled-data execution by compiling offline persistence contracts for plant-model-independent scheduling. Its contract abstraction supports formal safety guarantees while accounting for computational staleness and asynchronous regeneration.

  • Motivation: Spatial safety certificates become computationally stale during non-zero execution latency, making continuous evaluation and updated control synthesis impractical.The resulting divergence motivates discrete sampled-data execution and explicit temporal handling of certificate validity.
  • Motivation: A 20 ms regeneration task can exceed a certificate’s 19 ms remaining validity, which Boolean validity alone cannot reveal to a scheduler.The example contrasts naive Boolean scheduling with latency-aware deadline prediction requiring online plant simulation.
  • Core abstraction: CIPS exposes certified remaining validity as a consumable temporal persistence budget compiled entirely offline, eliminating online plant simulations for runtime scheduling.The scheduler need not access a perfectly specified continuous plant model once a sound contract has been compiled.
  • Core abstraction: The architecture transforms offline spatial certificates into normalized temporal contracts consumed by a plant-model-independent runtime scheduler.The pipeline separates certificate derivation from runtime scheduling while preserving the certificate’s operational meaning.
  • Contributions: Persistence compilation, contract-based scheduling, and a safety composition theorem connect certificate degradation, asynchronous execution, fallback, and global hybrid invariance.The scheduler explicitly accounts for regeneration latency, asynchronous completion, rejection, and terminal fallback.
  • Formal basis: The persistence functional is a conservative lower bound on the exact physical safety horizon, and its certified horizon satisfies 0 ≤ ΦI(x) ≤ τ*(x; I).The guarantee holds when ΦI(x) ≥ 0 and follows from the temporal persistence contract while the trajectory remains in the certified domain.

III. OFFLINE CERTIFICATE COMPILATION

CIPS compiles spatial certificate degradation bounds into continuous persistence functionals that satisfy the temporal contract. The framework also supports composing multiple valid certificates under a common trajectory.

  • Compilation framework: The CIPS application proof obligation is to construct a domain certificate and compile it into a persistence functional ΦI(x).The contract is an abstract specification rather than a replacement for application-specific certification.
  • Certificate-to-persistence compilation: A continuously differentiable certificate hI with threshold hmin and decay bound α enables an explicit certificate-to-persistence compilation.The construction assumes continuous trajectories and a differential inequality of the form ḣI(x) ≥ −α(hI(x)).
  • Certificate-to-persistence compilation: The compiled functional satisfies the CIPS Contract on every trajectory up to the first exit from the certificate domain.Integrating the normalized decay inequality establishes the unit-rate temporal persistence axiom.
  • Certificate-to-persistence compilation: The compiled functional preserves the certified domain because ΦI(x) ≥ 0 if and only if hI(x) ≥ hmin.Negative distance penalization outside the domain yields exact domain equivalence.
  • Interpretation: The integral transform differs from finite-time stability analysis because it bounds remaining time before a safety certificate reaches its validity boundary.Its input is a safety-certificate degradation inequality rather than a Lyapunov decay inequality targeting equilibrium.
  • Certificate composition: For certificates sharing a common vector field, finite intersection is closed under composition through the composite certificate Φ(x) = min_i Φi(x).The minimum functional defines the composite admissible region while retaining CIPS validity.

IV. RUNTIME ENGINE AND INTERFACE IMPLEMENTATION

The CIPS runtime engine uses sampled evaluations and asynchronous completions to manage certificate persistence, regeneration latency, handoff, rejection, and fallback. Its plant-model-independent interface evaluates persistence through runtime contracts rather than online simulation.

  • Runtime model: CIPS models execution as a hybrid system with active object I, scheduler mode σ, and physical state x.The scheduler mode takes the values idle, pending, or terminal.
  • Runtime interface: The runtime contract includes a persistence oracle, regeneration-latency bound, sampling interval, operational-age limit, reset margin, verification function, and terminal fallback object.The oracle evaluates persistence from current measurements without online numerical simulation.
  • Latency accounting: Lreg is the worst-case trigger-to-certified-handoff latency, including computation, communication, verification, and handoff.It satisfies Lreg ≥ Lgeneration + Lcommunication + Lverification + Lhandoff.
  • Event handling: The scheduler wakes on sampled evaluations every ∆t or asynchronous completions and uses separate trigger and reset margins.The trigger threshold is ρtrigger = Lreg + 2∆t, while accepting a new object requires ρreset > ∆t.
  • Fallback behavior: If a candidate passes verification and satisfies the reset margin, it is handed off; otherwise, fallback preserves safety but regeneration liveness is not guaranteed.Fallback is engaged upon threshold violations, while delayed or rejected candidates may leave the system without a regenerated controller.

V. LATENCY-AWARE RUNTIME SCHEDULING AND GLOBAL SAFETY

The safety analysis establishes global hybrid invariance for CIPS under bounded latency, periodic sampling, sound handoffs, and compatible fallback. Sampled margins preserve safety during regeneration and support safe terminal switching.

  • Assumptions: The architecture assumes bounded latency and periodic sampling, immutable active objects during regeneration, continuous handoffs, sound verification, and a forward-invariant terminal mode.It also specifies instantaneous fallback and sample-event priority when sampling and completion coincide.
  • Fallback compatibility: Offline fallback compatibility requires every reachable set with 0 < ΦI(x) ≤ ∆t to lie inside the terminal controller’s safe domain.This condition ensures that approaching certificate expiry leads to a state safe for terminal operation.
  • Latency safety: If regeneration starts with ΦIactive(x(tk)) > Lreg + ∆t, the active object retains more than ∆t of certified persistence at every completion within Lreg.This sampled latency-safety result directly covers asynchronous completion during bounded regeneration.
  • Global invariance: Under the stated assumptions, CIPS guarantees that the hybrid state remains in the controller-indexed safety invariant Q for all t ≥ 0.The theorem requires ρreset > ∆t > 0, an initially sufficient persistence margin, valid trigger execution, and fallback when persistence is at most ∆t.
  • Hybrid cases: The proof covers normal inter-sample execution, pending or rejected regeneration, successful handoff, and fallback transitions.For lower initial margins, safety is maintained until the next sample; successful handoff requires state continuity and ΦInext(x(tsw)) ≥ ρreset > ∆t.

A. Experimental Setup

The evaluation uses a dynamic Adaptive Cruise Control leader–follower benchmark in which the follower must regenerate control actions safely under bounded computational latency and strict kinematic constraints.

  • Benchmark: The ACC benchmark models the physical state as x = [plead, vlead, pfollow, vfollow]T.The follower tracks a leader while regenerating its control action under latency.
  • Constraints: The benchmark enforces ab = 6.0 m/s2, umax = 2.0 m/s2, vmax = 20.0 m/s, dmin = 3.0 m, and η = 0.5 m.These parameters specify braking, acceleration, velocity, collision-threshold, and measurement-uncertainty constraints.

B. CIPS Certificate Derivation

The certificate derivation converts the ACC braking envelope into a conservative temporal persistence functional. The resulting functional has unit-rate degradation and can be evaluated deterministically without online ODE propagation.

  • Safety threshold: The robust safety threshold is drobust = dmin + η + dkin = 5.55 m, combining the collision boundary, uncertainty margin, and kinematic buffer.The braking and actuator-latency buffer is dkin = 2.05 m.
  • Spatial certificate: The spatial certificate is h(x) = (plead − pfollow) − drobust, with margin depletion governed by relative closing speed.The derivation uses −ḣ(x) = vrel and a worst-case relative acceleration of arelmax = umax + ab = 8.0 m/s2.
  • Operating domain: The certified operating domain is restricted to states satisfying the kinematic braking envelope enforced by offline certificate and controller construction.At h(x) = 0, the boundary closing speed is vb = 4.0 m/s, yielding the degradation bound used for compilation.
  • Temporal compilation: Applying certificate-to-persistence compilation maps the spatial state into a temporal persistence functional for runtime scheduling.The construction is intended to provide certified validity time rather than require online computation of the exact physical horizon.
  • Runtime evaluation: The resulting functional satisfies Φ̇(x) ≥ −1 along valid trajectories and is evaluable in O(1) deterministic execution time without online ODE propagation.This establishes the unit-rate temporal contract used by the runtime scheduler.

C. Scheduler Implementations

The evaluated schedulers differ in their trigger conditions and runtime inputs. LA-ETC uses online plant-model propagation, whereas CIPS consumes a precompiled persistence functional without forward propagation.

  • Five runtime scheduling policies were evaluated under latency constraints, with Table II specifying their trigger conditions and evaluation inputs.
  • LA-ETC integrates closed-loop dynamics forward over Lpred = Lreg + 2∆t using the complete plant model f(x) and RK4 at each sample.The integration uses a 1 ms step under worst-case leader braking.
  • CIPS performs no forward propagation and consumes only the precompiled scalar persistence functional ΦI(x).

D. Experimental Results & Evaluation Methodology

The evaluation sweeps regeneration latency and sampling interval, measures execution timing on an embedded ARM platform, and compares safety, efficiency, and overhead across scheduling policies. CIPS matches LA-ETC's reported safety outcome while substantially reducing evaluation overhead and retaining high latency-budget efficiency.

  • Evaluation methodology: Regeneration latency Lreg and sampled evaluation interval ∆t were varied in structured robustness sweeps.Algorithms were compiled in C++-20 with -O2 optimizations.
  • Evaluation methodology: Evaluation latency was measured on a Pico-W Cortex-M0+ ARM architecture, using median execution time per evaluation over 10,000 iterations.The platform ran up to 133 MHz with 16 KB shared L1 cache and 256 KB SRAM.
  • Scheduling trade-offs: 4.8% latency efficiency occurred for periodic scheduling at Lreg = 100 ms, despite preserved safety.
  • Scheduling trade-offs: Boolean and Spatial ETC suffered systemic safety violations because they lacked temporal latency awareness and triggered fallback maneuvers too late.The passage attributes this outcome to the absence of temporal latency awareness.
  • Scheduling trade-offs: 121 µs evaluation overhead was incurred by LA-ETC because it numerically integrated trajectories online over the latency horizon.
  • Scheduling trade-offs: 60.5× lower evaluation overhead was achieved by CIPS while matching LA-ETC's safety outcome and minimum-gap bound across evaluated latency and sampling settings.CIPS latency efficiency remained near optimal at 98.4% to 100.0%.

VII. RELATED WORK AND INTERFACE COMPARISON

CIPS adds a temporal compilation layer that converts heterogeneous spatial safety certificates into runtime contracts. It complements latency-aware control, sampled-data CBFs, reachability tools, runtime assurance, and information-staleness approaches by decoupling runtime scheduling from online plant dynamics.

  • CIPS normalizes heterogeneous spatial certificates into consumable runtime contracts for managing discrete computation and non-zero latency.
  • Unlike latency-aware ETC and predictive safety filters, CIPS avoids continuous online plant evaluations and numerical integration by compiling certificates offline.
  • CIPS decouples temporal intervals from specific continuous controllers by compiling spatial certificates into platform-agnostic persistence contracts.
  • CIPS complements offline HJ toolboxes by compiling computed spatial domains into fast, microsecond-scale temporal functionals for runtime execution.
  • CIPS formalizes staleness as a consumable temporal asset and provides the latency-aware trigger Φ(x) ≤ Lreg + 2∆t for safe mode switches.

VIII. CONCLUSION AND FUTURE WORK

CIPS bridges continuous physical safety and discrete cyber execution by compiling spatial certificates into unit-rate temporal contracts offline. This decoupling supports provable global hybrid safety invariance under bounded latency and sampling while motivating extensions to broader certificate and uncertainty settings.

  • CIPS transforms continuously differentiable spatial certificates into consumable, unit-rate temporal contracts.The Certificate-to-Persistence compiler shifts plant-model computation from runtime evaluation to offline processing.
  • The resulting decoupling of certificate derivation from runtime scheduling eliminates online numerical integration.Runtime scheduling operates on compiled persistence information rather than repeatedly integrating plant dynamics.
  • CIPS achieves provable global hybrid safety invariance under bounded latency and sampling.The guarantee follows from separating physical certificate derivation from runtime scheduling.
  • Future work targets nonsmooth and neural-network-based bounds, probabilistic safety under uncertainty, and tighter temporal contracts through advanced reachability bounds.These directions address broader certificate classes, noisy or uncertain environments, and conservatism in spatial decay.
Loading 2608.25228v1…