SAG-SUP: Supervisory Patterns in Automation

• SAG-SUP is a supervisory layer that defines explicit control, safety, and coordination rules separate from nominal system operations.
• The approach leverages formal models, partial observation, MILP relaxations, and one-shot optimization to ensure system safety and performance.
• It finds diverse applications across autonomous driving, discrete-event systems, industrial readouts, and human-AI orchestration with measurable improvements.

Supervisor (SAG-SUP) is a designation used in several research literatures for supervisory layers that observe a nominal process, apply explicit safety, coordination, security, or orchestration criteria, and then authorize, modify, replace, or contextualize the nominal action. In the cited work, the term covers an online verification module for autonomous-vehicle trajectories, a localized implementation of partial-observation supervisors for large-scale discrete-event systems, a safety-supervisor channel for high levels of automated driving, a safety protection and extension governor, a road-intersection collision-avoidance supervisor, time-inserting and obfuscated supervisors for secure discrete-event systems, a digital-twin supervisor for a semi-autogenous grinding mill, haptically augmented human supervision, a multimodal AI orchestration supervisor, a readout-control firmware core for LHCb, and the supervisory layer of the CTAO Science Alert Generation pipeline (Stahl et al., 2020, Zhang et al., 2017, Törngren et al., 2019, Li et al., 2023, Ahn et al., 2016, Gruska, 22 May 2025, Tai et al., 2022, Quintanilla et al., 6 Mar 2025, Gilbert et al., 2024, Bishwas, 12 Mar 2026, Alessio et al., 2018, Collaboration et al., 19 Sep 2025, Markovski, 2012).

1. Terminological range and recurring role

The literature suggests that “SAG-SUP” is not a single canonical formalism, but a recurring supervisory pattern instantiated in different domains. In each case, the supervisor is distinct from the nominal plant, controller, planner, or pipeline, and its authority derives from explicit rules, synthesized control logic, fallback mechanisms, or orchestration policies (Stahl et al., 2020, Zhang et al., 2017, Li et al., 2023, Alessio et al., 2018, Bishwas, 12 Mar 2026).

Domain	SAG-SUP designation	Core role
Automated driving	online verification module; safety supervisor channel	verify trajectories, monitor hazards, trigger takeover
Discrete-event systems	Supervisor Action-Graph Supervisor; monolithic supervisor	enforce controllability, observability, coordination
Constraint-governed control	Safety Protection and Extension Governor; intersection supervisor	keep state safe indefinitely or delay violation
Security	time-inserting supervisor; obfuscated supervisor	enforce opacity; resist covert actuator attackers
Industrial and scientific infrastructure	readout supervisor; SAG Supervisor; digital twin supervisor	synchronize hardware, filter data, retrain models
Human and AI orchestration	Supervisor Augmented by Haptics-SUP; multimodal Supervisor	improve supervisory perception; route tools adaptively

Despite the diversity of implementations, the recurring structural idea is a separation between nominal functionality and a supervisory layer with simpler, more explicit, or more controllable decision logic. In automated driving this layer may sit “serially between the Motion Planner and the low-level Controller”; in discrete-event control it may be synthesized from formal languages and then localized; in orchestration systems it may build a directed acyclic graph of tool calls; and in readout or alert pipelines it may manage timing, status, and filtering conditions (Stahl et al., 2020, Zhang et al., 2017, Bishwas, 12 Mar 2026, Collaboration et al., 19 Sep 2025).

2. Formal models of supervision

A major line of SAG-SUP work is rooted in supervisory control of discrete-event systems under partial observation. In that setting, the plant is modeled as a finite-state generator

$G=(Q,\Sigma,\delta,q_0,Q_m),$

with event set $\Sigma$ partitioned into controllable and uncontrollable events, and into observable and unobservable events. Partial observation is expressed by the natural projection

$P_o:\Sigma^*\to\Sigma_o^*,$

and a feasible supervisor is a map $SUP:L(G)\to\Gamma$ satisfying

$$\forall s,s'\in L(G),\ P_o(s)=P_o(s')\Rightarrow SUP(s)=SUP(s').$$

Existence of a feasible nonblocking supervisor enforcing a specification $K$ is characterized by controllability together with observability or relative observability with respect to an ambient language $C$ (Zhang et al., 2017).

A related process-algebraic formulation introduces explicit distinction between observation and supervision channels. In the framework of Markovski et al., plant behavior and supervisor behavior are described in a process theory with data, and control requirements are expressed as Boolean implications of the form $a\Rightarrow \phi$, $\phi\Rightarrow a$, or as state-exclusion invariants $\phi$. Synthesis computes the supremal controllable sublanguage of the requirement-constrained behavior, and code generation can translate the resulting supervisor into PLC-style guarded commands or embedded software (Markovski, 2012).

Security-oriented formulations extend the supervisory role beyond enable/disable control. In the timed-process-algebra setting of the time-inserting supervisor, the supervisor is a function

$\Sigma$0

so it may both disable controllable actions and insert additional $\Sigma$1-actions. The supervised process is required to generate only traces in the $\Sigma$2-safe set $\Sigma$3, and the main existence theorem states that such a supervisor exists if and only if $\Sigma$4 is controllable with respect to $\Sigma$5 (Gruska, 22 May 2025).

Another formal extension addresses covert actuator attackers. There, resilience is defined relative to covert, damage-reachable attackers, while preserving the original closed-loop behavior through control equivalence:

$\Sigma$6

The construction produces an automaton $\Sigma$7 that exactly encodes all resilient, control-equivalent supervisors, and the synthesis algorithm is proved sound and complete (Tai et al., 2022).

3. Safety supervision in automated driving and motion control

In autonomous-vehicle trajectory supervision, the Supervisor of (Stahl et al., 2020) is inserted serially between the Motion Planner and the low-level Controller, in the stack Perception $\Sigma$8 Planner $\Sigma$9 Supervisor $P_o:\Sigma^*\to\Sigma_o^*,$0 Controller $P_o:\Sigma^*\to\Sigma_o^*,$1 Actuators. Its input interface receives perceived objects and ego-state, together with candidate driving and emergency trajectories. The supervisor then applies a static-obstacle monitor, a dynamic-obstacle monitor based on RSS worst-case collision checks, a friction limit monitor, a kinematic/dynamic limit monitor, a localization consistency monitor, a rule-compliance monitor, and a classification and fallback logic that aggregates all monitor outputs into a single “safe”/“unsafe” verdict. If unsafe, execution reverts to the last safe emergency trajectory (Stahl et al., 2020).

The corresponding safety properties are written as invariants over all trajectory points. Representative examples are

$P_o:\Sigma^*\to\Sigma_o^*,$2

$P_o:\Sigma^*\to\Sigma_o^*,$3

and

$P_o:\Sigma^*\to\Sigma_o^*,$4

The verification algorithm evaluates these checks pointwise and returns UNSAFE on the first failure. In scenario-based testing, 32 critical scenarios were used, and all 32 scenarios were classified correctly, with no false negatives and no false positives outside the permitted envelope. In full-scale autonomous race runs, the supervisor executed online in real time and the no-fire test passed (Stahl et al., 2020).

The safety-supervisor architecture of Törngren et al. places this runtime role into a broader fault-tolerant ADI. The ADI consists of a nominal channel and a supervisor channel, both structured by the MAPE-K pattern: Measure/Monitor, Analyze, Plan, Execute, and Knowledge. Hazardous events are attributed to four root causes: random hardware faults, systematic faults, performance limitations of the ADI, and adverse operational situations. The supervisor uses internal safety constraints (ISCs) and external safety constraints (ESCs), with takeover defined by

$P_o:\Sigma^*\to\Sigma_o^*,$5

where $P_o:\Sigma^*\to\Sigma_o^*,$6. The design principles include “No single-point failure in ADI,” “If supervisor fails → go to minimal-risk condition,” and “Supervisor deterministic & transparent (first principles)” (Törngren et al., 2019).

At road intersections, the supervisory algorithm of (Ahn et al., 2016) separates safety verification from control design. Safety verification is translated into a job-shop scheduling problem whose objective is to minimize the maximum lateness; zero optimal cost is equivalent to a collision-free crossing schedule. Because the exact formulation is a MINLP under nonlinear second-order dynamics, two MILP relaxations are introduced to provide lower and upper bounds. The supervisor overrides the drivers if the upper-bound MILP yields a positive optimal cost. Theoretical results establish exactness of the MINLP formulation, lower- and upper-bound correctness, quantified approximation bounds via shrunk and inflated bad sets, and non-blocking operation. In a realistic scenario with 20 vehicles and 48 conflict areas, the maximum solve time per step was $P_o:\Sigma^*\to\Sigma_o^*,$7 on a $P_o:\Sigma^*\to\Sigma_o^*,$8 Core i7 with CPLEX, below $P_o:\Sigma^*\to\Sigma_o^*,$9 (Ahn et al., 2016).

The Safety Protection and Extension Governor generalizes the supervisory function to systems of the form

$SUP:L(G)\to\Gamma$0

If a control exists that renders the system robustly invariant in an infinite-horizon safe set $SUP:L(G)\to\Gamma$1, the supervisor computes exactly such a control while minimally deviating from the nominal command. If no infinite-horizon safe control exists, it instead maximizes the remaining guaranteed horizon $SUP:L(G)\to\Gamma$2. The key contribution is a unified one-shot optimization with only continuous variables; for linear systems with convex constraints, the problem reduces to a strictly convex quadratic program. In the adaptive cruise control example, the one-shot QP solve was approximately $SUP:L(G)\to\Gamma$3 per time step, whereas repeatedly checking feasibility across horizons took approximately $SUP:L(G)\to\Gamma$4 (Li et al., 2023).

4. Distributed, partially observed, and secure supervisory control

Large-scale partial-observation DES motivate a distributed SAG-SUP architecture. In (Zhang et al., 2017), monolithic synthesis is avoided by a heterarchical procedure: decentralized supervisors $SUP:L(G)\to\Gamma$5 are computed for decomposed specifications and module-plants, coordinators $SUP:L(G)\to\Gamma$6 are added for blocking subsystems, and each supervisor/coordinator is then localized into event-based local controllers $SUP:L(G)\to\Gamma$7 and $SUP:L(G)\to\Gamma$8 that observe only $SUP:L(G)\to\Gamma$9 plus the controlled event. The global implementation is

$$\forall s,s'\in L(G),\ P_o(s)=P_o(s')\Rightarrow SUP(s)=SUP(s').$$0

and the collection $$\forall s,s'\in L(G),\ P_o(s)=P_o(s')\Rightarrow SUP(s)=SUP(s').$$1 is the SAG-SUP implementation (Zhang et al., 2017).

The AGV workcell case study makes the scalability claim concrete. The plant comprises five AGVs $$\forall s,s'\in L(G),\ P_o(s)=P_o(s')\Rightarrow SUP(s)=SUP(s').$$2 with nine decomposable specifications and unobservable re-entry events $$\forall s,s'\in L(G),\ P_o(s)=P_o(s')\Rightarrow SUP(s)=SUP(s').$$3. Nine decentralized supervisors are first synthesized, with state sizes ranging from 9 to 26. Blocking in a subsystem leads to installation of coordinator $$\forall s,s'\in L(G),\ P_o(s)=P_o(s')\Rightarrow SUP(s)=SUP(s').$$4 with 36 states; further abstraction and conflict analysis produce coordinator $$\forall s,s'\in L(G),\ P_o(s)=P_o(s')\Rightarrow SUP(s)=SUP(s').$$5 with 123 states. Localization generates 22 local controllers/coordinators, each observing only observable events and enforcing the same global behavior. The largest monolithic supervisor would exceed $$\forall s,s'\in L(G),\ P_o(s)=P_o(s')\Rightarrow SUP(s)=SUP(s').$$6 states, whereas each local controller has at most 6 states; decentralized synthesis took less than 1 second in TCT, and localization less than 0.1 seconds per supervisor (Zhang et al., 2017).

Data-driven supervisory coordination provides another route to implementation. In the process-theoretic account of (Markovski, 2012), plants emit observations via uncontrollable channels and await enabling signals on controllable channels; the supervisor sends control messages without side effects on its own data. Control requirements are compactly expressed by data predicates, and synthesis can be exported to tools such as Supremica. The resulting guarded supervisors can then be compiled into software, PLC code, or firmware. The printer-maintenance case study demonstrates how current power mode, maintenance scheduling, maintenance operations, page counters, and target power mode can be coordinated by a single monolithic supervisor (Markovski, 2012).

Security-focused SAG-SUP variants change the objective from safety or coordination to opacity and resilience. The time-inserting supervisor can preserve opacity by inserting delays to mask timing side channels, rather than merely disabling actions. The obfuscation framework computes all supervisors that are resilient against covert actuator attackers while preserving closed behavior. A plausible implication is that, within discrete-event settings, the supervisory layer is treated not only as a safety filter but also as a mechanism for preserving confidentiality and attack resilience under partial observation (Gruska, 22 May 2025, Tai et al., 2022).

5. Real-time infrastructures and industrial deployments

In detector readout systems, SAG-SUP appears as hard real-time firmware. The LHCb Readout Supervisor controls the upgraded detector and readout system, distributing the clock and timing information and synchronizing all elements from the front-end ASICs to event building. The firmware core runs on an Altera Arria 10 PCIe card and includes a ClockDistributionUnit, TimingGenerator, CommandFormatter, SynchronizationEngine, TriggerFSM and ThrottleHandler, TAEWindowHandler, MEP Handler, Configuration and RegisterBank, and OutputPipelineManager. It maintains a 12-bit Bunch ID counter incrementing every 25 ns, supports a TAE window of up to $$\forall s,s'\in L(G),\ P_o(s)=P_o(s')\Rightarrow SUP(s)=SUP(s').$$7 consecutive BXIDs, and fixes deterministic output latency via

$$\forall s,s'\in L(G),\ P_o(s)=P_o(s')\Rightarrow SUP(s)=SUP(s').$$8

With $$\forall s,s'\in L(G),\ P_o(s)=P_o(s')\Rightarrow SUP(s)=SUP(s').$$9 and $K$0, the example latency budget is $K$1. The upgraded readout system targets 40 MHz operation and an aggregate raw data rate of approximately 40 Tb/s (Alessio et al., 2018).

In the CTAO Science Alert Generation pipeline, SAG-SUP oversees dynamic operations of SAG and its integration with ACADA components. It subscribes to real-time telescope status, environmental conditions, and data-quality veto intervals through the ACADA Monitoring system, writes them into the sag-sup-db database, and uses them to filter out data from slewing phases or degraded conditions. Good Time Intervals are computed first from telescope status and then refined by environmental and DQ-veto criteria:

$K$2

The end-to-end latency budget is reported as approximately $K$3, below the 20 s requirement, and even at $K$4 trigger rate the per-event overhead remains at most about $K$5. If MON Kafka becomes unavailable for more than 2 seconds, the system falls back to standard GTIs only; alarms are surfaced to the HMI within 1 second of detection (Collaboration et al., 19 Sep 2025).

A process-industry instantiation is the digital twin with automatic disturbance detection for an expert-controlled SAG mill. The supervisor integrates three components of the closed-loop operation: fuzzy logic for expert control, a state-space model for regulatory control, and a recurrent NARX model to simulate the mill process. The disturbance detector monitors prediction-error sequences in sliding windows of length $K$6 samples, applying two-sided hypothesis tests on mean, variance, PDF shape, and autocorrelation. Retraining is triggered only when the rejection counter exceeds the threshold $K$7, reported as 103 for pressure and 181 for power. The model was trained with 68 hours of industrial data, validated with an additional 8 hours, and predicts mill behavior over a 2.5-minute horizon at 30-second intervals with errors smaller than 5% (Quintanilla et al., 6 Mar 2025).

6. Human and AI-centered supervision

One strand of SAG-SUP research studies the supervisor as a human observer of automation rather than as an autonomous controller. In embodied supervision, the core hypothesis is that supervisors should receive a copy of the operator’s command signal $K$8. For the controlled plant

$K$9

and operator model

$C$0

the supervisor’s estimate of the reference changes from $C$1 to

$C$2

Simulation produced $C$3 and $C$4, approximately a 30% reduction. In the experiment, $C$5 participants compared three conditions: uOff, uVisual, and uHaptic. Target Selection Accuracy showed a one-way repeated-measures ANOVA result of $C$6, $C$7, generalized $C$8, and the post-hoc Bonferroni comparison found uHaptic versus uVisual significant at $C$9. Mean TSA values were $a\Rightarrow \phi$0 for uOff, $a\Rightarrow \phi$1 for uVisual, and $a\Rightarrow \phi$2 for uHaptic (Gilbert et al., 2024).

In autonomous multimodal query processing, the Supervisor is a central orchestration service rather than a safety monitor. The framework of (Bishwas, 12 Mar 2026) organizes the supervisor into four modules: query decomposition, tool selection, orchestration engine, and result synthesis. Modality detection combines heuristic attachment checks with SLM-assisted flagging, producing one of eight execution flags. For text-only queries the framework invokes RouteLLM; for non-text paths it dispatches to domain-optimized pipelines such as YOLO plus SLM for object detection, Tesseract plus SLM for OCR, and Whisper plus SLM for transcription. The orchestration engine builds a LangGraph StateGraph in which independent branches execute in parallel and failures trigger localized repair (Bishwas, 12 Mar 2026).

The formal objective is to minimize expected time-to-accurate-answer under an accuracy constraint:

$a\Rightarrow \phi$3

Evaluation on 2,847 queries across 15 task categories reports a 72% reduction in time-to-accurate-answer, an 85% reduction in conversational rework, and a 67% reduction in cost per query relative to a matched hierarchical baseline, while maintaining accuracy parity. Median TTA decreased from 4.20 s to 1.18 s, rework rate from 23% to 3.4%, and cost from \$a\Rightarrow \phi$40.05; throughput increased from 45 q/s to 54 q/s (Bishwas, 12 Mar 2026).

7. Limitations, open issues, and recurring misconceptions

A recurrent source of confusion is terminological. The literature surveyed here suggests that “SAG-SUP” names a supervisory role rather than a uniquely defined architecture. Some instances are runtime safety filters, some are synthesized DES supervisors, some are secure or obfuscated controllers, some are database-backed monitoring components, and some are human- or AI-facing orchestration layers (Stahl et al., 2020, Zhang et al., 2017, Collaboration et al., 19 Sep 2025, Bishwas, 12 Mar 2026).

Technical limitations are domain-specific. The autonomous-vehicle online verifier currently relies on longitudinal RSS only for dynamic collision checking; lateral interactions and full reachable-set computations remain to be integrated. Its friction limit is assumed known and conservatively underestimated by perception, rule compliance is limited to simple limits such as speed, and the scenario set is not exhaustive. Planned next steps include a more detailed tire model, V2X data, probabilistic safety margins, formal “rulebooks,” and structured scenario generation (Stahl et al., 2020). In the dual-channel automated-driving architecture, open research directions include completeness and coverage of $a\Rightarrow \phi$5, runtime risk estimation under ML-based perception uncertainty, structured diversity to avoid common-cause failures, dynamic hand-back, cybersecurity integration, and deriving safety goals and requirements per ISO 26262 (Törngren et al., 2019).

Approximation and decidability issues also remain central. The road-intersection supervisor uses lower- and upper-bound MILPs around an exact MINLP, with guarantees expressed through shrunk and inflated bad sets rather than direct exactness of the MILP relaxations (Ahn et al., 2016). The unified safety protection and extension governor reduces to a convex quadratic program for linear systems with convex constraints, which indicates a structural dependence on that problem class (Li et al., 2023). In secure supervisory control, supervisor existence and opacity checking are undecidable in full timed process algebra, but become effectively constructible when the process is finite-state, observations are static, and the predicate and its complement are regular (Gruska, 22 May 2025).

Taken together, these works suggest a stable encyclopedic characterization of SAG-SUP: a supervisory layer that is intentionally separated from nominal behavior, equipped with explicit constraints or synthesized logic, and entrusted with preserving a formally specified envelope of acceptable operation. What changes across domains is not the supervisory motif itself, but the object being supervised—trajectories, event languages, control commands, data streams, human perception, or tool executions—and the mechanism by which supervision is enforced: disabling, takeover, fallback, optimization, synchronization, filtering, delay insertion, localization, or adaptive orchestration (Törngren et al., 2019, Li et al., 2023, Alessio et al., 2018, Gilbert et al., 2024).