Robust Permissive Controller Synthesis

• Robust permissive controller synthesis is a framework that constructs controllers guaranteeing formal specifications under uncertainty while retaining multiple admissible control actions.
• Methodologies include MILP-based discrete formulations, SOS programs, and abstraction techniques, all balancing robustness with maximal permissiveness.
• Optimization and certification strategies expand certified control sets and mitigate conservatism, facilitating adaptive online control in dynamic environments.

Searching arXiv for recent and foundational papers on robust permissive controller synthesis and closely related methods. Robust permissive controller synthesis is the problem of constructing controllers that guarantee a formal specification under uncertainty while deliberately preserving multiple admissible control choices, rather than committing to a single deterministic strategy. Across the literature, the resulting controller is typically represented as a set-valued object—such as a multi-strategy in Markov decision processes and stochastic games, a set of allowed actions in interval Markov decision processes, or a certificate-induced set of safe modes in switched and continuous systems—and correctness is required to hold for all compliant refinements and, depending on the model, for all admissible disturbances, transition realizations, or uncertain preferences (Drager et al., 2015). This places the topic at the intersection of formal methods, robust control, abstraction-based synthesis, and safety certification, with formulations ranging from mixed-integer linear programming for uncertain discrete models to quantified nonlinear constraints, sum-of-squares programs, and semidefinite programming for continuous and hybrid systems.

1. Discrete-state formulations and the meaning of permissiveness

In probabilistic verification and synthesis, permissiveness is formalized by replacing a single strategy with a set-valued controller. In stochastic games, a multi-strategy is a map from controller states to non-empty sets of enabled actions, and a strategy is compliant if it only chooses allowed actions. Soundness requires that every compliant strategy satisfy the property against every environment strategy, so the synthesized object is robust to runtime action substitution within the allowed set (Drager et al., 2015). The same structural idea appears in MDPs with uncertain human preferences, where a deterministic, memoryless multi-strategy $\theta : S \to 2^A$ is required to satisfy lower and upper bounds on each objective for all compliant refinements, and permissiveness is optimized by minimizing the number of disallowed actions in reachable states (Chen et al., 2021).

For interval Markov decision processes, permissiveness is defined in the presence of epistemic uncertainty in the transition probabilities. An IMDP is given as $$\mathcal{M} = (S, s_{\iota}, A, \check{P}, \hat{P}, R)$$, where $\check{P}$ and $\hat{P}$ bound each transition probability and thus define a family of concrete MDPs. A permissive controller, or multi-strategy, is a mapping $\theta : S \to 2^A$ such that $\theta(s) \subseteq \alpha(s)$ and $\theta(s) \neq \emptyset$ for all $s$, and a deterministic strategy $\sigma$ is compliant when $\sigma(s) \in \theta(s)$ for all states. The paper defines the permissiveness measure

$$\mathcal{M} = (S, s_{\iota}, A, \check{P}, \hat{P}, R)$$0

and seeks multi-strategies that are both robust and maximally permissive (Huynh et al., 3 Oct 2025).

This discrete-state view clarifies the core distinction between ordinary robust synthesis and robust permissive synthesis. Ordinary synthesis returns one robust strategy. Robust permissive synthesis returns a family of robust strategies encoded by allowed-action sets. A plausible implication is that permissiveness functions as a formally certified interface between offline synthesis and online adaptation: the offline stage proves that all compliant refinements are correct, while the online stage may exploit context, learning, or secondary objectives without leaving the certified action envelope.

2. Robustness semantics across uncertainty models

Robustness is model-dependent, but the literature shares the same quantifier pattern: the synthesized controller must satisfy the specification for all admissible uncertainty realizations and, in permissive formulations, for all compliant strategies. In IMDPs, robust satisfaction of a property $$\mathcal{M} = (S, s_{\iota}, A, \check{P}, \hat{P}, R)$$1 by a multi-strategy $$\mathcal{M} = (S, s_{\iota}, A, \check{P}, \hat{P}, R)$$2 is defined by universal quantification over all transition functions $$\mathcal{M} = (S, s_{\iota}, A, \check{P}, \hat{P}, R)$$3, where each $$\mathcal{M} = (S, s_{\iota}, A, \check{P}, \hat{P}, R)$$4 lies in the interval-constrained probability simplex $$\mathcal{M} = (S, s_{\iota}, A, \check{P}, \hat{P}, R)$$5. The central synthesis problem is then: find $$\mathcal{M} = (S, s_{\iota}, A, \check{P}, \hat{P}, R)$$6 such that $$\mathcal{M} = (S, s_{\iota}, A, \check{P}, \hat{P}, R)$$7 and there exists no strictly more permissive $$\mathcal{M} = (S, s_{\iota}, A, \check{P}, \hat{P}, R)$$8 that also satisfies $$\mathcal{M} = (S, s_{\iota}, A, \check{P}, \hat{P}, R)$$9 robustly (Huynh et al., 3 Oct 2025).

A different robustness notion arises when uncertainty lies in preferences rather than dynamics. In multi-objective MDP synthesis with uncertain human preferences, an interval weight vector $\check{P}$0 defines a convex set of admissible weights. From the Pareto points induced by all $\check{P}$1, the method computes bounds $\check{P}$2 for each objective, and a multi-strategy is sound when every compliant strategy satisfies

$\check{P}$3

Robustness here is with respect to preference uncertainty, not transition uncertainty, but the permissive structure is the same: every refinement must remain within certified bounds (Chen et al., 2021).

In continuous systems, robustness is usually expressed against bounded disturbances or uncertain parameters. For switched systems synthesized via control certificates, quantified constraints take the form “for all states, there exists a mode, for all disturbances,” which already encodes a permissive set of safe or progress-making modes at each state (Ravanbakhsh et al., 2015). For uncertain polynomial systems with robust-adaptive control barrier functions, the robust invariant set is

$\check{P}$4

and safety is guaranteed for all unknown constant parameters $\check{P}$5 through a margin based on worst-case estimation error (Liu et al., 2023). For control-affine systems with bounded state-dependent uncertainty and hard control limits, robustness is defined through the set of controls $\check{P}$6 satisfying the derivative inequality for all $\check{P}$7 and $\check{P}$8, and persistent feasibility requires $\check{P}$9 throughout the intended safe region (Wei et al., 2022).

The abstraction-based literature introduces yet another robustness semantics: approximate correctness under model approximation. If a concrete transition system $\hat{P}$0 and an abstract system $\hat{P}$1 are $\hat{P}$2-approximately bisimilar, controllers synthesized on $\hat{P}$3 for contracted or expanded specifications can be concretized to $\hat{P}$4, yielding guarantees relative to maximal safety or time-optimal reachability controllers on the concrete system (Girard, 2010). This suggests that robust permissiveness can be interpreted not only as disturbance tolerance but also as tolerance to abstraction error.

3. Optimization formulations for robust permissive synthesis

The dominant optimization paradigm in uncertain discrete-state models is MILP. In IMDPs, robust permissive controller synthesis for reachability or reward specifications is encoded with binary variables $\hat{P}$5 indicating whether action $\hat{P}$6 is allowed in state $\hat{P}$7, continuous variables $\hat{P}$8 representing robust reachability probabilities or rewards, and the objective

$\hat{P}$9

which maximizes $\theta : S \to 2^A$0 (Huynh et al., 3 Oct 2025). Two exact encodings are given. The vertex-enumeration encoding exploits the fact that a linear objective over the uncertainty polytope $\theta : S \to 2^A$1 achieves its extremum at a vertex, while the dualization-based encoding uses linear programming duality to avoid explicit vertex enumeration. The latter introduces dual variables $\theta : S \to 2^A$2, $\theta : S \to 2^A$3, $\theta : S \to 2^A$4, and $\theta : S \to 2^A$5, and yields a number of constraints linear in the number of successor transitions rather than exponential in the number of vertices (Huynh et al., 3 Oct 2025).

MILP also appears in permissive synthesis without transition uncertainty. In stochastic games, deterministic multi-strategy synthesis is encoded with binary variables $\theta : S \to 2^A$6 for action permission and real variables $\theta : S \to 2^A$7 for worst-case expected reward, together with Bellman-like inequalities and ranking constraints ensuring that $\theta : S \to 2^A$8 is the least solution of the induced system. For dynamic penalties, additional variables $\theta : S \to 2^A$9 encode the worst-case expected penalty, and the objective minimizes $\theta(s) \subseteq \alpha(s)$0 (Drager et al., 2015). Randomized permissive synthesis is handled approximately by discretizing probabilities, transforming the game, and reducing to deterministic MILP on an expanded model (Drager et al., 2015).

In continuous and switched systems, the optimization problems become nonlinear or convex-algebraic. Control-certificate synthesis for switched systems is encoded as quantified nonlinear constraints, solved via a Counterexample Guided Inductive Synthesis loop with SMT-based synthesis and verification phases (Ravanbakhsh et al., 2015). For robust-adaptive safe control, verification of a candidate polynomial raCBF is reduced to feasibility of sum-of-squares programs, and synthesis is carried out by alternating convex subproblems over barrier coefficients and SOS multipliers (Liu et al., 2023). For bounded uncertainty with hard input limits, the robust safe control problem becomes a convex semi-infinite program,

$\theta(s) \subseteq \alpha(s)$1

where $\theta(s) \subseteq \alpha(s)$2 is defined by infinitely many affine inequalities indexed by the uncertainty set. A cutting-plane algorithm then solves the exact convex semi-infinite formulation for convex bounded uncertainty (Wei et al., 2022).

For LTI robust state-feedback synthesis with IQC uncertainty, the problem can be cast as a KYP-type semidefinite program with variables $\theta(s) \subseteq \alpha(s)$3 and constraints $\theta(s) \subseteq \alpha(s)$4, $\theta(s) \subseteq \alpha(s)$5, and a KYP-LMI. A structure-exploiting solver eliminates $\theta(s) \subseteq \alpha(s)$6 through an anti-stabilizing Riccati solution $\theta(s) \subseteq \alpha(s)$7, reducing the problem to a convex optimization in $\theta(s) \subseteq \alpha(s)$8 with barrier

$\theta(s) \subseteq \alpha(s)$9

and $\theta(s) \neq \emptyset$0 per-Newton-step complexity instead of $\theta(s) \neq \emptyset$1 for generic SDP solvers (Gramlich et al., 2023). This paper does not synthesize permissive controllers explicitly, but it provides computational infrastructure for exploring larger robustly feasible controller sets.

4. Certificates, abstractions, and set-valued safety mechanisms

A substantial part of the field uses certificates or set-valued winning sets as the substrate on which permissiveness is defined. In switched nonlinear systems, control Lyapunov functions and control barrier functions encode conditions of the form “for every state there exists a mode that satisfies the derivative condition for all disturbances,” and the induced controller is permissive because it characterizes a set of admissible modes rather than a single switching function (Ravanbakhsh et al., 2015). In robust-adaptive safe control, the raCBF-QP

$\theta(s) \neq \emptyset$2

subject to the raCBF inequality returns the control closest to the nominal input that remains safe, so the safe control set is implicitly the half-space defined by the barrier derivative constraint intersected with $\theta(s) \neq \emptyset$3 (Liu et al., 2023). The paper explicitly notes that the inequality defines the set of all safe controls, even though the implemented controller selects one particular element of that set (Liu et al., 2023).

A related approach for uncertain control-affine systems synthesizes a safety index $\theta(s) \neq \emptyset$4 such that the set $\theta(s) \neq \emptyset$5 is robustly forward invariant under bounded uncertainty and control limits. The resulting online controller is the solution of a robust safe QP over $\theta(s) \neq \emptyset$6, where $\theta(s) \neq \emptyset$7 is the set of all controls satisfying the robust derivative inequality. Because the robust constraint is expressed exactly as a convex semi-infinite condition or its tight SOCP specialization, the method is explicitly described as yielding the least conservative control among convex bounded-uncertainty formulations (Wei et al., 2022). This suggests a continuous-state analogue of maximal permissiveness: maximize the safe control set compatible with the uncertainty model and actuator bounds.

Abstraction-based methods define permissiveness through maximal winning controllers on finite symbolic models. For safety, a maximal controller on the abstraction can be concretized to the original approximately bisimilar system, and the paper proves a sandwich result

$\theta(s) \neq \emptyset$8

where $\theta(s) \neq \emptyset$9 is the maximal concrete safety controller for the original specification and the other terms correspond to concretizations for contracted or expanded specifications (Girard, 2010). For reachability, analogous inequalities bound the concretized value function between the optimal values for expanded and contracted specifications (Girard, 2010). In relational-interface formulations of abstraction-based control synthesis, the controlled predecessor is defined compositionally and the greatest fixed-point of the safety game yields the full winning relation; all actions that keep the state inside the winning set are implicitly admissible, so permissiveness is retained unless later determinization prunes it (Kim et al., 2019).

The set-valued safety-preserving controller for continuous-time LTI systems subject to bounded disturbance presents an especially explicit permissive design. A piecewise ellipsoidal inner approximation of the discriminating kernel is computed offline. Online, a hybrid automaton switches between a performance mode, in which any $s$0 is allowed, and a safety mode, in which the control is forced to the ellipsoidal safety-preserving law $s$1. The paper states that the precomputed piecewise ellipsoidal set is then used online to synthesize a permissive state-feedback safety-preserving controller, and the safety guarantee holds for any control generated by the hybrid automaton inside the allowed set (Kaynama et al., 2013).

5. High-level permissiveness, reactive synthesis, and shields

Robust permissiveness also appears in reactive synthesis over temporal specifications. In DCSYNTH, the synthesis process first computes a Maximally Permissive Non-deterministic Controller for the hard QDDC requirement and then determinizes it into a Locally Optimal Deterministic Controller using lexicographically prioritized soft requirements (1711.01823). Hard requirements must be invariantly satisfied, while soft requirements may be satisfied “as much as possible” in a best-effort manner (1711.01823). The resulting pattern is conceptually important: permissiveness is computed first, then quality objectives are used only to resolve degrees of freedom left by correctness.

The same separation appears in context-triggered temporal-logic control for disturbed linear systems. High-level context-triggered LTL synthesis is reduced to context-dependent reach-avoid-stay objectives, and strategy templates encode a set of winning logical moves rather than a single plan. The low-level robust controller combines MPC with a local invariant controller, and the MPC value function serves as a reachability certificate while avoidance is enforced by robust constraints (Kordabad et al., 1 Jul 2026). The paper states that the proposed framework yields significantly larger feasible sets than Lyapunov-based approaches and naturally accommodates dynamic environments and online task reconfiguration (Kordabad et al., 1 Jul 2026). A plausible implication is that permissiveness should be understood at both layers: high-level templates preserve multiple discrete plans, and low-level MPC preserves large continuous feasible sets.

Shield synthesis supplies a runtime-enforcement interpretation of permissive robustness. In DCSYNTH’s conservative burst-error shields, the hard requirement is the corrected safety formula $s$2, while soft requirements maximize equality $s$3 for each design output bit, thereby minimizing deviations from the design signal whenever possible (1711.01823). This is not permissive controller synthesis in the multi-strategy sense, but it is structurally analogous: retain all corrected outputs consistent with safety, then select those closest to the nominal design behavior.

The literature on robust software synthesis contributes a complementary notion of degradation-aware permissiveness. Metric automata equip states with a distance, and strategies are synthesized that guarantee graceful degradation under disturbances for $s$4-regular properties. Fixed-point algorithms compute optimally robust strategies in polynomial time, and the degree of degradation is parameterized by disturbance magnitude (Majumdar et al., 2011). Although the paper does not phrase the result as permissive synthesis, it suggests that permissiveness can be generalized beyond action multiplicity to quantitative tolerance of specification weakening under bounded disturbance.

6. Scalability, trade-offs, and open directions

A recurring tension in robust permissive controller synthesis is between exactness, permissiveness, and scalability. In IMDPs, the dualization-based MILP avoids the exponential blowup of vertex enumeration and scales to large models while remaining exact (Huynh et al., 3 Oct 2025). In stochastic games, deterministic permissive synthesis is NP-hard and randomized permissive synthesis lies in PSPACE, with a reduction from square-root-sum indicating substantial inherent complexity (Drager et al., 2015). In continuous systems, SOS-based methods currently scale only to moderate dimensions, with experiments up to 7D in robust-adaptive safe control (Liu et al., 2023), while ellipsoidal and KYP-based methods exploit structure to reach substantially higher dimensions [(Kaynama et al., 2013); (Gramlich et al., 2023)].

Another major trade-off is between worst-case robustness and conservatism. Interval and robust CBF baselines are often safe but restrictive. In the IMDP setting, robust multi-strategies are maximally permissive with respect to all admissible transitions, but only for deterministic, memoryless strategies and restricted property classes (Huynh et al., 3 Oct 2025). In robust-adaptive safe control, the barrier set is deliberately shrunk by a margin based on parameter-estimation error, yet the adaptive dependence on $s$5 yields “selective conservatism,” and the experiments report 100% safety and up to 55% performance improvement over a robust baseline (Liu et al., 2023). In control-limits-aware robust safe control, the convex semi-infinite formulation is explicitly described as the tightest formulation for convex bounded uncertainties and leads to the least conservative control (Wei et al., 2022). In context-triggered robust MPC, feasible sets are significantly larger than with Lyapunov-based approaches (Kordabad et al., 1 Jul 2026). These results collectively suggest that permissiveness is not a cosmetic add-on but a direct measure of how much conservatism a robust synthesis method introduces.

A further distinction concerns whether permissiveness is explicit or implicit. Discrete multi-strategy papers optimize it directly through $s$6 or penalty functions (Huynh et al., 3 Oct 2025, Drager et al., 2015, Chen et al., 2021). Many continuous-state papers instead maximize invariant-set size, feasible-set size, or safe-control-region size, which functions as an implicit permissiveness surrogate [(Liu et al., 2023); (Wei et al., 2022); (Kordabad et al., 1 Jul 2026); (Kaynama et al., 2013)]. This suggests a useful editorial shorthand: “action permissiveness” for explicit allowed-action maximization, and “geometric permissiveness” for enlargement of safe state or control sets. The literature supports the distinction, even when it does not name it explicitly.

Open directions follow directly from the surveyed formulations. The IMDP work focuses on deterministic, memoryless strategies and reachability or expected-reward specifications (Huynh et al., 3 Oct 2025). Preference-robust multi-objective synthesis treats uncertainty in weights but not in dynamics (Chen et al., 2021). raCBF synthesis is limited to polynomial systems with constant unknown parameters (Liu et al., 2023). Safety-index synthesis currently assumes bounded convex uncertainty and control-affine dynamics (Wei et al., 2022). Context-triggered robust MPC addresses discrete-time linear systems with additive bounded disturbances (Kordabad et al., 1 Jul 2026). A plausible implication is that a unified theory of robust permissive controller synthesis will likely require bridging explicit multi-strategy optimization in discrete models with certificate- and set-based permissiveness in continuous models, while preserving computational tractability under richer uncertainty descriptions and temporal specifications.