Abstract
Safety specifications in cyber-physical systems (CPS) capture the operational conditions that the system shall satisfy to operate safely within its intended environment. As environmental conditions evolve, operational rules that express acceptance criteria must be continuously refined to preserve alignment with observed system behavior. These rules, often expressed as logical or quantitative constraints on system behavior, are validated through simulation-based testing but may become inconsistent as new operational conditions or boundary behaviors emerge. We ask: Can grammar-constrained refinement loop using large language models (LLMs) automatically refine inconsistent operational rules while preserving syntactic correctness and semantic validity, and what safety concerns emerge from language-in-the-loop refinement? We introduce a framework that combines counterfactual reasoning with a grammar-constrained refinement loop to refine operational rules, aligning them with the observed system behavior. Applied to an autonomous driving control system, our grammar-constrained refinement loop, supported by counterfactual evidence, successfully resolved the inconsistencies in an operational rule inferred by a conventional baseline while remaining grammar compliant. An empirical LLM variant study further revealed model dependent refinement quality and safety lessons, which motivate parser-based grammar enforcement, stronger automated validation and broader evaluation in future work.
Research Question
Can grammar-constrained refinement loop using large language models (LLMs) automatically refine inconsistent operational rules while preserving syntactic correctness and semantic validity, and what safety concerns emerge from language-in-the-loop refinement?
Approach
Figure 1: Overview of the grammar-constrained refinement loop.
We introduce a grammar-constrained rule refinement framework that leverages counterfactual reasoning combined with grammar-constrained LLM to produce interpretable, syntactically and semantically valid refinements of operational rules.
1) Counterfactual Analysis: This step takes as input an inconsistent operational rule and a labeled simulation dataset containing test inputs and observed outcomes. It produces a counterfactual evidence file by generating counterfactual inputs for inputs that expose inconsistencies in the rule.
2) Rule Refinement Loop: This step runs an iterative loop that uses the evidence, the grammar, and previously consistent rules to have a grammar constrained LLM propose a minimally modified refinement of the inconsistent rule, such as tightening a threshold or adjusting logical structure. Each candidate refinement is checked for grammar and vocabulary compliance, consistency with historical rules using satisfiability checks, and semantic validity on the dataset, and the loop repeats until a refinement passes all checks. The step outputs the validated refined rule along with a brief change log and explanation of how it resolves the observed inconsistency.
Conclusion
Safety operational rules can lose alignment with observed system behavior as systems and operating contexts evolve. This paper introduced a rule refinement framework that uses counterfactual reasoning and a grammar-constrained LLM refinement loop to produce interpretable refinements that are syntactically correct and semantically valid. An initial study on an autonomous driving subsystem showed that our loop eliminates inconsistencies produced by the selected conventional method, with +0.14 decisiveness. An LLM variant study further exposed model dependent quality and safety trade offs including syntactic violations and over constraining operational rule refinements that risk overfitting to the test data. These findings highlight what can go wrong even under grammar guidance, motivating stronger grammar enforcement, more rigorous semantic validation, and broader evaluation in future work.