Over-approximation of weakly-hard constraints for control systems verification (Extended)
Pith reviewed 2026-05-19 20:10 UTC · model grok-4.3
The pith
A compressed language acceptor over-approximates weakly-hard deadline-miss constraints while simulating the original finite-state machine, enabling safety verification for control systems where exact models are too large.
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
Core claim
The central claim is that an explicitly constructed compressed language acceptor recognizes an over-approximation of any weakly-hard constraint language, that this acceptor simulates the minimal finite-state machine for the exact constraint, and that the smaller machine can therefore be substituted into existing verification pipelines to obtain sound safety guarantees for plants subject to deadline misses.
What carries the argument
The compressed language acceptor, a finite-state machine that over-approximates the regular language of a weakly-hard constraint while preserving simulation of the original minimal automaton.
If this is right
- Safety verification becomes feasible for plants whose exact weakly-hard automata exceed the capacity of current model checkers.
- Sound (conservative) certificates replace the previous all-or-nothing situation in which no answer could be obtained.
- Language-cardinality results quantify how much extra behavior the over-approximation admits.
- The same acceptor can be reused across multiple controller designs that share the same weakly-hard specification.
Where Pith is reading between the lines
- Designers could iterate between controller synthesis and the compressed acceptor to tighten the over-approximation on demand.
- The technique may extend to other regular constraints that appear in scheduling or fault-tolerance analysis.
- If the cardinality gap remains small, the acceptor could also support probabilistic or statistical verification methods that sample from the over-approximated language.
Load-bearing premise
The over-approximation must stay tight enough that the safety properties it certifies are non-vacuous for the concrete control systems under study.
What would settle it
A control system for which the compressed acceptor certifies closed-loop safety yet an exhaustive simulation under the exact AnyMiss(2,300) constraint reveals a deadline-miss sequence that drives the plant into an unsafe state.
Figures
read the original abstract
A hard real-time system cannot miss any deadline. A weakly-hard real-time system, on the contrary, is designed to tolerate a specific number of deadline misses. For instance, the AnyMiss(2, 300) weakly-hard constraint stipulates that in every window of 300 consecutive jobs, at most 2 deadlines are missed. The weakly-hard model is the state-of-the-art for industrial dependability-by-design of control systems that tolerate deterministic failures. Weakly-hard constraints correspond to regular languages. The size of the minimal finite state machine that recognizes whether a string satisfies the constraint (about 45k states for AnyMiss(2, 300)) is a notorious impediment for the verification of control system properties. This paper discusses an over-approximation of the language that allows us to provide sound safety guarantees for control systems under deadline misses that would be out of reach using the minimal finite state machine. We present a compressed language acceptor and prove that it simulates the original finite state machine. We study language cardinality properties, and report on empirical results that show how the new acceptor can be embedded in the control design workflow, leading to verifying safety for systems for which the state-of-the-art tools do not provide answers.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper introduces an over-approximation technique for weakly-hard real-time constraints (e.g., AnyMiss(2,300)) in control-system verification. It replaces the minimal FSM (approximately 45k states) with a smaller compressed language acceptor, proves that the acceptor simulates the original machine (ensuring language inclusion and thus sound safety guarantees), studies cardinality properties of the accepted languages, and reports empirical results showing successful embedding into control-design workflows where state-of-the-art tools fail to return answers.
Significance. If the over-approximation remains sufficiently tight, the work would meaningfully expand the set of control systems for which safety under deadline misses can be formally verified. The simulation proof supplies soundness, and the reported empirical embedding demonstrates practical reach beyond current tools. The significance is tempered by the need for explicit evidence that the enlarged language does not render safety properties vacuous in closed-loop settings.
major comments (2)
- [Section 5 (empirical evaluation) and Section 4 (cardinality properties)] The central claim that the compressed acceptor yields useful (non-vacuous) safety guarantees rests on the tightness of the over-approximation. The manuscript studies language cardinality but does not report quantitative bounds on the ratio of accepted strings or the additional miss patterns admitted relative to the original FSM; without such metrics it is impossible to assess whether the safety results obtained in the empirical section remain informative rather than trivially true.
- [Section 3 (compressed acceptor and simulation proof)] The simulation proof (presumably Theorem 1 or equivalent in the section presenting the compressed acceptor) establishes language inclusion, but the argument does not address whether the compression preserves the periodic-window structure of AnyMiss(k,n) constraints tightly enough for the subsequent control-verification step; a concrete counter-example sequence or tightness lemma would strengthen the load-bearing claim.
minor comments (2)
- [Section 3] Notation for the compressed acceptor states and transition relation should be introduced with an explicit small example (e.g., AnyMiss(1,5)) before the general construction to improve readability.
- [Section 2] The abstract states that the minimal FSM for AnyMiss(2,300) has 'about 45k states'; the exact number and the construction method used to obtain it should be cited or reproduced in the preliminaries.
Simulated Author's Rebuttal
We thank the referee for the constructive comments, which help clarify the presentation of the over-approximation's properties and its utility in control-system verification. We respond to each major comment below and indicate the revisions we will make.
read point-by-point responses
-
Referee: [Section 5 (empirical evaluation) and Section 4 (cardinality properties)] The central claim that the compressed acceptor yields useful (non-vacuous) safety guarantees rests on the tightness of the over-approximation. The manuscript studies language cardinality but does not report quantitative bounds on the ratio of accepted strings or the additional miss patterns admitted relative to the original FSM; without such metrics it is impossible to assess whether the safety results obtained in the empirical section remain informative rather than trivially true.
Authors: We agree that explicit quantitative measures of tightness would allow readers to better judge whether the obtained safety results are informative. The manuscript already examines cardinality properties of the languages accepted by the original FSM and the compressed acceptor. In the revision we will augment Section 4 with concrete ratios (number of accepted strings of bounded length for representative AnyMiss(k,n) instances) and will list a small set of additional miss patterns admitted only by the compressed acceptor. These metrics will be cross-referenced with the control-design examples in Section 5 to show that the safety properties verified remain non-vacuous. revision: yes
-
Referee: [Section 3 (compressed acceptor and simulation proof)] The simulation proof (presumably Theorem 1 or equivalent in the section presenting the compressed acceptor) establishes language inclusion, but the argument does not address whether the compression preserves the periodic-window structure of AnyMiss(k,n) constraints tightly enough for the subsequent control-verification step; a concrete counter-example sequence or tightness lemma would strengthen the load-bearing claim.
Authors: The simulation relation is proved to guarantee language inclusion, which directly supplies the soundness argument required for safety verification: any property shown to hold under the larger language also holds under the original AnyMiss language. The compression merges states whose future acceptance behavior is identical with respect to the window constraints; this preserves the essential periodic structure while reducing the state space. To address the request for illustration, the revised Section 3 will include an explicit counter-example sequence accepted by the compressed acceptor but rejected by the minimal FSM, together with a short discussion of how the deviation in missed deadlines remains bounded within each window. A dedicated tightness lemma is not required for soundness but will be added if space permits. revision: partial
Circularity Check
No circularity; independent construction and proof of simulation
full rationale
The derivation constructs an explicit compressed acceptor, proves simulation of the original FSM via language inclusion (a standard automata-theoretic argument), studies cardinality properties as a separate analysis, and validates embedding through empirical results on control systems. These steps do not reduce to self-definition, fitted inputs renamed as predictions, or load-bearing self-citations. The over-approximation is sound by construction for safety guarantees, with tightness evaluated externally rather than forced internally. The paper is self-contained against the stated benchmarks.
Axiom & Free-Parameter Ledger
Reference graph
Works this paper leans on
-
[1]
Verifying weakly-hard real-time properties of traffic streams in switched networks
Leonie Ahrendts, Sophie Quinton, Thomas Boroske, and Rolf Ernst. Verifying weakly-hard real-time properties of traffic streams in switched networks. In30th Euromicro Conference on Real-Time Systems, volume 106 ofLIPIcs, pages 15:1– 15:22. Schloss Dagstuhl - Leibniz-Zentrum für Informatik, 2018
work page 2018
-
[2]
Benny Akesson, Mitra Nasri, Geoffrey Nelissen, Sebastian Altmeyer, and Robert I. Davis. An empirical survey-based study into industry practice in real-time systems. InIEEE Real-Time Systems Symposium, pages 3–11, 2020
work page 2020
-
[3]
ISA - The Instru- mentation, Systems and Automation Society, 2006
Karl Johan Åström and Tore Hägglund.Advanced PID Control. ISA - The Instru- mentation, Systems and Automation Society, 2006
work page 2006
-
[4]
K.J. Åström and B. Wittenmark.Computer-Controlled Systems: Theory and De- sign, Third Edition. Dover Books on Electrical Engineering. Dover Publications, 2011
work page 2011
- [5]
-
[6]
J. Richard Büchi. On a decision method in restricted second order arithmetic. In Ernest Nagel, Patrick Suppes, and Alfred Tarski, editors,Logic, Methodology and Philosophy of Science: Proceedings of the 1960 International Congress, pages 1–11. Stanford University Press, 1962. 20 Rieke de Maeyer, Holger Hermanns , Martina Maggio
work page 1960
-
[7]
A simple tree-based algorithm for decid- ing the stability of discrete-time switched linear systems
Fabio Dercole and Fabio Della Rossa. A simple tree-based algorithm for decid- ing the stability of discrete-time switched linear systems. InIEEE 56th Annual Conference on Decision and Control (CDC), pages 5298–5303, 2017
work page 2017
-
[8]
Melanie Gallant, Christoph Mark, Paolo Pazzaglia, Johannes von Keler, Laura Beermann, Kevin Schmidt, and Martina Maggio. Structure-exploiting distribu- tionally robust control of non-homogeneous markov jump linear systems.IEEE Control Systems Letters, 8:3069–3074, 2024
work page 2024
-
[9]
Melanie Gallant, Christoph Mark, Paolo Pazzaglia, Johannes von Keler, Laura Beermann, Kevin Schmidt, and Martina Maggio. Soft-constrained stochastic mpc of markov jump linear systems: Application to real-time control with deadline overruns.IEEE Control Systems Letters, 9:1532–1537, 2025
work page 2025
-
[10]
Computing the joint spectral radius.Linear Algebra and its Applications, 234:43–60, 1996
Gustaf Gripenberg. Computing the joint spectral radius.Linear Algebra and its Applications, 234:43–60, 1996
work page 1996
-
[11]
Bounding deadline misses in weakly-hard real-time systems with task dependencies
Zain Alabedin Haj Hammadeh, Rolf Ernst, Sophie Quinton, Rafik Henia, and Lau- rent Rioux. Bounding deadline misses in weakly-hard real-time systems with task dependencies. InDesign, Automation & Test in Europe Conference & Exhibition, DATE, pages 584–589. IEEE, 2017
work page 2017
-
[12]
Zain Alabedin Haj Hammadeh, Sophie Quinton, and Rolf Ernst. Weakly-hard real- time guarantees for earliest deadline first scheduling of independent tasks.ACM Transactions on Embedded Computing Systems, 18(6):121:1–121:25, 2020
work page 2020
-
[13]
Michael Hertneck, Steffen Linsenmayer, and Frank Allgöwer. Efficient stability analysis approaches for nonlinear weakly-hard real-time control systems.Auto- matica, 133:109868, 2021
work page 2021
-
[14]
Quantitative safety-driven co-synthesis of cyber- physical system implementations
Clara Hobbs, Shengjie Xu, Bineet Ghosh, Enrico Fraccaroli, Parasara Sridhar Dug- girala, and Samarjit Chakraborty. Quantitative safety-driven co-synthesis of cyber- physical system implementations. InACM/IEEE 15th International Conference on Cyber-Physical Systems (ICCPS), pages 99–110, 2024
work page 2024
-
[15]
Formal verification of weakly-hard systems
Chao Huang, Wenchao Li, and Qi Zhu. Formal verification of weakly-hard systems. InProceedings of the 22nd ACM International Conference on Hybrid Systems: Computation and Control, HSCC ’19, page 197–207, New York, NY, USA, 2019. Association for Computing Machinery
work page 2019
-
[16]
Springer Science & Business Media, 2009
Raphaël Jungers.The joint spectral radius: theory and applications, volume 385. Springer Science & Business Media, 2009
work page 2009
-
[17]
Kirsch and Ana Sokolova.The Logical Execution Time Paradigm, pages 103–120
Christoph M. Kirsch and Ana Sokolova.The Logical Execution Time Paradigm, pages 103–120. Advances in Real-Time Systems. Springer Berlin Heidelberg, 2011
work page 2011
-
[18]
Automata theory and model checking
Orna Kupferman. Automata theory and model checking. In Edmund M. Clarke, Thomas A. Henzinger, Helmut Veith, and Roderick Bloem, editors,Handbook of Model Checking, pages 107–151. Springer, 2018
work page 2018
-
[19]
Larsen, Christian Schilling, and Jirí Srba
Kim G. Larsen, Christian Schilling, and Jirí Srba. Simulation relations and applica- tions in formal methods. In Jean-François Raskin, Krishnendu Chatterjee, Laurent Doyen, and Rupak Majumdar, editors,Principles of Systems Design - Essays Dedi- cated to Thomas A. Henzinger on the Occasion of His 60th Birthday, volume 13660 ofLecture Notes in Computer Scie...
work page 2022
-
[20]
Stabilization of networked control sys- tems with weakly hard real-time dropout description
Steffen Linsenmayer and Frank Allgöwer. Stabilization of networked control sys- tems with weakly hard real-time dropout description. InIEEE Annual Conference on Decision and Control, pages 4765–4770. IEEE, 2017
work page 2017
-
[21]
Control- system stability under consecutive deadline misses constraints
MartinaMaggio,ArneHamann,EckartMayer-John,andDirkZiegenbein. Control- system stability under consecutive deadline misses constraints. InEuromicro Con- ference on Real-Time Systems, volume 165 ofLIPIcs, pages 21:1–21:24. Schloss Dagstuhl–Leibniz-Zentrum für Informatik, 2020. Over-approximation of weakly-hard constraints 21
work page 2020
-
[22]
Meyer.Matrix Analysis and Applied Linear Algebra
Carl D. Meyer.Matrix Analysis and Applied Linear Algebra. Society for Industrial and Applied Mathematics, Philadelphia, PA, USA, 2000
work page 2000
-
[23]
Concurrency and automata on infinite sequences.Theory of Com- putation Report, 104(35), 1981
David Park. Concurrency and automata on infinite sequences.Theory of Com- putation Report, 104(35), 1981. Department of Computer Science, University of Warwick
work page 1981
-
[24]
Be- yond the weakly hard model: Measuring the performance cost of deadline misses
Paolo Pazzaglia, Luigi Pannocchi, Alessandro Biondi, and Marco Di Natale. Be- yond the weakly hard model: Measuring the performance cost of deadline misses. In30th Euromicro Conference on Real-Time Systems, volume 106 ofLeibniz Inter- national Proceedings in Informatics, pages 10:1–10:22, Dagstuhl, Germany, 2018. Schloss Dagstuhl – Leibniz-Zentrum für Informatik
work page 2018
-
[25]
Springer Spektrum, Berlin, Heidelberg, Germany, 2013
Wolf Barth Peter Knabner.Lineare Algebra - Grundlagen und Anwendungen. Springer Spektrum, Berlin, Heidelberg, Germany, 2013
work page 2013
-
[26]
Matthew Philippe, Ray Essick, Geir E. Dullerud, and Raphaël M. Jungers. Stabil- ity of discrete-time switching systems with constrained switching sequences.Au- tomatica, 72:242–250, 2016
work page 2016
-
[27]
A note on the joint spectral radius.Indag
Gian-Carlo Rota and Gilbert Strang. A note on the joint spectral radius.Indag. Math, 22(4):379–381, 1960
work page 1960
-
[28]
Marc Seidel, Simon Lang, and Frank Allgöwer. Onℓ2-performance of weakly-hard real-time control systems.European Journal of Control, 80:101056, 2024. 2024 European Control Conference Special Issue
work page 2024
-
[29]
Seneta.Non-negative Matrices and Markov Chains, Second Edition
E. Seneta.Non-negative Matrices and Markov Chains, Second Edition. Springer New York, New York, NY, USA, 2006
work page 2006
-
[30]
Moshe Y. Vardi. Automata-theoretic techniques for temporal reasoning. In Patrick Blackburn, J. F. A. K. van Benthem, and Frank Wolter, editors,Handbook of Modal Logic, volume 3 ofStudies in logic and practical reasoning, pages 971–989. North- Holland, 2007
work page 2007
-
[31]
Stabilityandperformanceanaly- sis of control systems subject to bursts of deadline misses
NilsVreman,AntonCervin,andMartinaMaggio. Stabilityandperformanceanaly- sis of control systems subject to bursts of deadline misses. InEuromicro Conference on Real-Time Systems, volume 196 ofLIPIcs, pages 15:1–15:23. Schloss Dagstuhl - Leibniz-Zentrum für Informatik, 2021
work page 2021
-
[32]
InIEEE 28th Real-Time and Embedded Technology and Applications Symposium, pages 228–240, 2022
Nils Vreman, Richard Pates, and Martina Maggio.WeaklyHard.jl: Scalable analy- sis of weakly-hard constraints. InIEEE 28th Real-Time and Embedded Technology and Applications Symposium, pages 228–240, 2022
work page 2022
-
[33]
Weaklyhard.jl: Scalable analysis of weakly-hard constraints
Nils Vreman, Richard Pates, and Martina Maggio. Weaklyhard.jl: Scalable analysis of weakly-hard constraints. InIEEE Real-Time and Embedded Technology and Applications Symposium, pages 228–240. IEEE, 2022
work page 2022
-
[34]
Nils Vreman, Paolo Pazzaglia, Victor Magron, Jie Wang, and Martina Maggio. Stability of linear systems under extended weakly-hard constraints.IEEE Control Systems Letters, 6:2900–2905, 2022
work page 2022
-
[35]
Shengjie Xu, Bineet Ghosh, Clara Hobbs, P. S. Thiagarajan, and Samarjit Chakraborty. Safety-aware flexible schedule synthesis for cyber-physical systems using weakly-hard constraints. InProceedings of the 28th Asia and South Pa- cific Design Automation Conference, ASPDAC, pages 46–51, New York, NY, USA,
-
[36]
Association for Computing Machinery. A The structure ofT m,k,c Proof of Theorem 3.4 Proof.First, we show that the function is well-defined. This means that∀vk:1 = v∈V, n(v k:1, m, k)∈U. Given the constraintAnyMiss(m, k)and its minimal 22 Rieke de Maeyer, Holger Hermanns , Martina Maggio automaton (including⋆where states are merged), for eachv k:1 there ex...
-
[37]
Therefore, in both cases, we haveu′ ∈U
For the other elements, u′ i ≥u ′ j fori < japplies following the same argument as above,u ′ i =u i−1 and u∈U. Therefore, in both cases, we haveu′ ∈U. Over-approximation of weakly-hard constraints 23 Proof of Theorem 3.7 Proof.We show that there exists a bijective functionf:V→Usuch that (i)f(v init) =u init (ii)∀v, v ′ ∈Vandσ∈Σ: (v, σ, v ′)∈Eif and only i...
discussion (0)
Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.