A controller-side check can stop commands based on stale state

When an industrial command waits for confirmation or transport, how can a system know it still fits the plant’s current state at the moment it is released? The paper studies this execution gap, where a pause or other change can make a once-valid command stale before it reaches the controller.

AIS carries an action’s validity conditions, while XAIR checks them at release and can let the state-owning controller make the final version check.

The authors address a specific timing problem: a command can be valid when proposed but stale when released, because the plant changes while it waits.

They introduce AIS to carry validity conditions with each action, and XAIR to check them before release, including a version-conditional command for the controller that owns the relevant state.

In tests, a store check left a short interval before release, while controller-scan checks prevented stale effects in the tested pause trials. A version check also rejected commands after a pause was undone, which a condition-only check missed.

The evidence supports locating the last check with the state owner and selecting a version scope that limits irrelevant revocations.

These are prototype results from software controllers, not a physical field trial, and they do not establish physical safety. The controller-side result applies to state owned by that controller; state owned elsewhere remains subject to replica checks and their limits.