08: Events & Responses 15-424: Foundations of Cyber-Physical - - PowerPoint PPT Presentation

▶
08 events responses
SMART_READER_LITE
LIVE PREVIEW

08: Events & Responses 15-424: Foundations of Cyber-Physical - - PowerPoint PPT Presentation

Nov 24, 2022 264 likes •829 views

08: Events & Responses 15-424: Foundations of Cyber-Physical Systems Andr e Platzer aplatzer@cs.cmu.edu Computer Science Department Carnegie Mellon University, Pittsburgh, PA 0.5 0.4 0.3 0.2 1.0 0.1 0.8 0.6 0.4 0.2 Andr e

slide-1
SLIDE 1

08: Events & Responses

15-424: Foundations of Cyber-Physical Systems Andr´ e Platzer

aplatzer@cs.cmu.edu Computer Science Department Carnegie Mellon University, Pittsburgh, PA

0.2 0.4 0.6 0.8 1.0

0.1 0.2 0.3 0.4 0.5

Andr´ e Platzer (CMU) FCPS / 08: Events & Responses 1 / 20

slide-2
SLIDE 2

Outline

1

Learning Objectives

2

The Need for Control Quantum the Ping Pong Ball Cartesian Demon Determinizing Ping Pong Balls

3

Event-triggered Control Evolution Domains Detect Events Non-negotiability of Physics Splitting and Connecting Evolution Domains Firing of Events Physics vs. Control

4

Proof Loop Invariants

5

Summary

Andr´ e Platzer (CMU) FCPS / 08: Events & Responses 2 / 20

slide-3
SLIDE 3

Outline

1

Learning Objectives

2

The Need for Control Quantum the Ping Pong Ball Cartesian Demon Determinizing Ping Pong Balls

3

Event-triggered Control Evolution Domains Detect Events Non-negotiability of Physics Splitting and Connecting Evolution Domains Firing of Events Physics vs. Control

4

Proof Loop Invariants

5

Summary

Andr´ e Platzer (CMU) FCPS / 08: Events & Responses 2 / 20

slide-4
SLIDE 4

Learning Objectives

Events & Responses

CT M&C CPS using loop invariants design event-triggered control modeling CPS event-triggered control continuous sensing feedback mechanisms control vs. physics Cartesian Demons semantics of event-triggered control

  • perational effects

model-predictive control

Andr´ e Platzer (CMU) FCPS / 08: Events & Responses 3 / 20

slide-5
SLIDE 5

Outline

1

Learning Objectives

2

The Need for Control Quantum the Ping Pong Ball Cartesian Demon Determinizing Ping Pong Balls

3

Event-triggered Control Evolution Domains Detect Events Non-negotiability of Physics Splitting and Connecting Evolution Domains Firing of Events Physics vs. Control

4

Proof Loop Invariants

5

Summary

Andr´ e Platzer (CMU) FCPS / 08: Events & Responses 3 / 20

slide-6
SLIDE 6

Quantum the Safely Bored Bouncing Ball

Proposition (Quantum can bounce around safely)

0 ≤ x ∧ x = H ∧ v = 0 ∧ g > 0 ∧ 1 ≥ c ≥ 0 → [

  • x′ = v, v′ = −g & x ≥ 0; (?x=0; v := −cv ∪ ?x=0)

∗](0 ≤ x ∧ x ≤ H) Proof @invariant(2gx = 2gH − v2 ∧ x ≥ 0)

Andr´ e Platzer (CMU) FCPS / 08: Events & Responses 4 / 20

slide-7
SLIDE 7

Quantum the Safely Bored Bouncing Ball

Proposition (Quantum can bounce around safely)

0 ≤ x ∧ x = H ∧ v = 0 ∧ g > 0 ∧ 1 = c → [

  • x′ = v, v′ = −g & x ≥ 0; (?x=0; v := −cv ∪ ?x=0)

∗](0 ≤ x ∧ x ≤ H) Proof @invariant(2gx = 2gH − v2 ∧ x ≥ 0) Can be improved. . .

Andr´ e Platzer (CMU) FCPS / 08: Events & Responses 4 / 20

slide-8
SLIDE 8

Quantum the Safely Bored Bouncing Ball

Proposition (Quantum can bounce around safely)

0 ≤ x ∧ x = H ∧ v = 0 ∧ g > 0 ∧ 1 ≥ c ≥ 0 → [

  • x′ = v, v′ = −g & x ≥ 0; (?x=0; v := −cv ∪ ?x=0)

∗](0 ≤ x ∧ x ≤ H) Proof @invariant(2gx = 2gH − v2 ∧ x ≥ 0) Can be improved. . .

Andr´ e Platzer (CMU) FCPS / 08: Events & Responses 4 / 20

slide-9
SLIDE 9

Quantum the Daring Ping Pong Ball

Conjecture (Quantum can play ping pong safely)

0 ≤ x ∧ x ≤ 5 ∧ v ≤ 0 ∧ g > 0 ∧ 1 ≥ c ≥ 0 ∧ f ≥ 0 →

  • x′ = v, v′ = −g & x ≥ 0;

(?x=0; v := −cv ∪ ?x=0) ∗ (0≤x≤5)

Andr´ e Platzer (CMU) FCPS / 08: Events & Responses 5 / 20

slide-10
SLIDE 10

Quantum the Daring Ping Pong Ball

Conjecture (Quantum can play ping pong safely)

0 ≤ x ∧ x ≤ 5 ∧ v ≤ 0 ∧ g > 0 ∧ 1 ≥ c ≥ 0 ∧ f ≥ 0 →

  • x′ = v, v′ = −g & x ≥ 0;

(?x=0; v := −cv ∪ ?4≤x≤5; v := −fv ∪ ?x=0) ∗ (0≤x≤5) Proof? Ask Ren´ e Descartes

Andr´ e Platzer (CMU) FCPS / 08: Events & Responses 5 / 20

slide-11
SLIDE 11

Cartesian Doubt: Ren´ e Descartes’s Cartesian Demon 1641

Outwit the Cartesian Demon

Skeptical about the truth of all beliefs until justification has been found.

Andr´ e Platzer (CMU) FCPS / 08: Events & Responses 6 / 20

slide-12
SLIDE 12

Quantum the Daring Ping Pong Ball

Conjecture (Quantum can play ping pong safely)

0 ≤ x ∧ x ≤ 5 ∧ v ≤ 0 ∧ g > 0 ∧ 1 ≥ c ≥ 0 ∧ f ≥ 0 →

  • x′ = v, v′ = −g & x ≥ 0;

(?x=0; v := −cv ∪ ?4≤x≤5; v := −fv ∪ ?x=0) ∗ (0≤x≤5) Proof? Ask Ren´ e Descartes

Andr´ e Platzer (CMU) FCPS / 08: Events & Responses 7 / 20

slide-13
SLIDE 13

Quantum the Daring Ping Pong Ball

Conjecture (Quantum can play ping pong safely)

0 ≤ x ∧ x ≤ 5 ∧ v ≤ 0 ∧ g > 0 ∧ 1 ≥ c ≥ 0 ∧ f ≥ 0 →

  • x′ = v, v′ = −g & x ≥ 0;

(?x=0; v := −cv ∪ ?4≤x≤5; v := −fv ∪ ?x=0) ∗ (0≤x≤5) Proof? Ask Ren´ e Descartes who says no! Could run instead of control

Andr´ e Platzer (CMU) FCPS / 08: Events & Responses 7 / 20

slide-14
SLIDE 14

Quantum the Daring Ping Pong Ball

Conjecture (Quantum can play ping pong safely)

0 ≤ x ∧ x ≤ 5 ∧ v ≤ 0 ∧ g > 0 ∧ 1 ≥ c ≥ 0 ∧ f ≥ 0 →

  • x′ = v, v′ = −g & x ≥ 0;

(?x=0; v := −cv ∪ ?4≤x≤5; v := −fv ∪ ?x=0∧x<4∨x>5) ∗ (0≤x≤5) Proof? Ask Ren´ e Descartes who says no! No bounce at event

Andr´ e Platzer (CMU) FCPS / 08: Events & Responses 7 / 20

slide-15
SLIDE 15

Quantum the Daring Ping Pong Ball

Conjecture (Quantum can play ping pong safely)

0 ≤ x ∧ x ≤ 5 ∧ v ≤ 0 ∧ g > 0 ∧ 1 ≥ c ≥ 0 ∧ f ≥ 0 →

  • x′ = v, v′ = −g & x ≥ 0;

(?x=0; v := −cv ∪ ?4≤x≤5; v := −fv ∪ ?x=0∧x<4∨x>5) ∗ (0≤x≤5) Proof? Ask Ren´ e Descartes who says no! Could miss this event

Andr´ e Platzer (CMU) FCPS / 08: Events & Responses 7 / 20

slide-16
SLIDE 16

Quantum the Deterministically Daring Ping Pong Ball

Conjecture (Quantum can play ping pong safely)

0 ≤ x ∧ x ≤ 5 ∧ v ≤ 0 ∧ g > 0 ∧ 1 ≥ c ≥ 0 ∧ f ≥ 0 →

  • {x′ = v, v′ = −g & x ≥ 0};

if(x=0) v := −cv else if(4≤x≤5) v := −fv ∗ (0≤x≤5) Proof? Ask Ren´ e Descartes

Andr´ e Platzer (CMU) FCPS / 08: Events & Responses 8 / 20

slide-17
SLIDE 17

Quantum the Deterministically Daring Ping Pong Ball

Conjecture (Quantum can play ping pong safely)

0 ≤ x ∧ x ≤ 5 ∧ v ≤ 0 ∧ g > 0 ∧ 1 ≥ c ≥ 0 ∧ f ≥ 0 →

  • {x′ = v, v′ = −g & x ≥ 0};

if(x=0) v := −cv else if(4≤x≤5) v := −fv ∗ (0≤x≤5) Proof? Ask Ren´ e Descartes who says no!

Andr´ e Platzer (CMU) FCPS / 08: Events & Responses 8 / 20

slide-18
SLIDE 18

Quantum the Deterministically Daring Ping Pong Ball

Conjecture (Quantum can play ping pong safely)

0 ≤ x ∧ x ≤ 5 ∧ v ≤ 0 ∧ g > 0 ∧ 1 ≥ c ≥ 0 ∧ f ≥ 0 →

  • {x′ = v, v′ = −g & x ≥ 0};

if(x=0) v := −cv else if(4≤x≤5) v := −fv ∗ (0≤x≤5) Proof? Ask Ren´ e Descartes who says no! Could also miss if-then event

Andr´ e Platzer (CMU) FCPS / 08: Events & Responses 8 / 20

slide-19
SLIDE 19

Outline

1

Learning Objectives

2

The Need for Control Quantum the Ping Pong Ball Cartesian Demon Determinizing Ping Pong Balls

3

Event-triggered Control Evolution Domains Detect Events Non-negotiability of Physics Splitting and Connecting Evolution Domains Firing of Events Physics vs. Control

4

Proof Loop Invariants

5

Summary

Andr´ e Platzer (CMU) FCPS / 08: Events & Responses 8 / 20

slide-20
SLIDE 20

Evolution Domains Detect Events

Evolution domains detect events x′ = f (x) & Q Evolution domain Q of a differential equation is responsible for detecting

  • events. Q can stop physics whenever an event happens on which the

control wants to take action.

t x Q w u r x′ = f(x) & Q

Andr´ e Platzer (CMU) FCPS / 08: Events & Responses 9 / 20

slide-21
SLIDE 21

Quantum the Deterministically Daring Ping Pong Ball

Conjecture (Quantum can play ping pong safely)

0 ≤ x ∧ x ≤ 5 ∧ v ≤ 0 ∧ g > 0 ∧ 1 ≥ c ≥ 0 ∧ f ≥ 0 →

  • {x′ = v, v′ = −g & x ≥ 0};

if(x=0) v := −cv else if(4≤x≤5) v := −fv ∗ (0≤x≤5) Proof? Ask Ren´ e Descartes who says no! Could also miss if-then event

Andr´ e Platzer (CMU) FCPS / 08: Events & Responses 10 / 20

slide-22
SLIDE 22

Quantum the Deterministically Daring Ping Pong Ball

Conjecture (Quantum can play ping pong safely)

0 ≤ x ∧ x ≤ 5 ∧ v ≤ 0 ∧ g > 0 ∧ 1 ≥ c ≥ 0 ∧ f ≥ 0 →

  • {x′ = v, v′ = −g & x ≥ 0 ∧ 4≤x≤5};

if(x=0) v := −cv else if(4≤x≤5) v := −fv ∗ (0≤x≤5) Proof? Ask Ren´ e Descartes who says no! Domain as event trap?

Andr´ e Platzer (CMU) FCPS / 08: Events & Responses 10 / 20

slide-23
SLIDE 23

Quantum the Deterministically Daring Ping Pong Ball

Conjecture (Quantum can play ping pong safely)

0 ≤ x ∧ x ≤ 5 ∧ v ≤ 0 ∧ g > 0 ∧ 1 ≥ c ≥ 0 ∧ f ≥ 0 →

  • {x′ = v, v′ = −g & x ≥ 0 ∧ 4≤x≤5};

if(x=0) v := −cv else if(4≤x≤5) v := −fv ∗ (0≤x≤5) Proof? Ask Ren´ e Descartes who says no! Broken physics: Always event

Andr´ e Platzer (CMU) FCPS / 08: Events & Responses 10 / 20

slide-24
SLIDE 24

Quantum the Deterministically Daring Ping Pong Ball

Conjecture (Quantum can play ping pong safely)

0 ≤ x ∧ x ≤ 5 ∧ v ≤ 0 ∧ g > 0 ∧ 1 ≥ c ≥ 0 ∧ f ≥ 0 →

  • {x′ = v, v′ = −g & x ≥ 0 ∧ 4≤x≤5};

if(x=0) v := −cv else if(4≤x≤5) v := −fv ∗ (0≤x≤5) Proof? Ask Ren´ e Descartes who says no! Broken physics: Always event = Zero-crossing ≥ Zero-event

Andr´ e Platzer (CMU) FCPS / 08: Events & Responses 10 / 20

slide-25
SLIDE 25

Quantum the Deterministically Daring Ping Pong Ball

Conjecture (Quantum can play ping pong safely)

0 ≤ x ∧ x ≤ 5 ∧ v ≤ 0 ∧ g > 0 ∧ 1 ≥ c ≥ 0 ∧ f ≥ 0 →

  • {x′ = v, v′ = −g & x ≥ 0 ∧ x≤5};

if(x=0) v := −cv else if(4≤x≤5) v := −fv ∗ (0≤x≤5) Proof? Ask Ren´ e Descartes who says yes! Limiting constraint

Andr´ e Platzer (CMU) FCPS / 08: Events & Responses 10 / 20

slide-26
SLIDE 26

Quantum the Deterministically Daring Ping Pong Ball

Conjecture (Quantum can play ping pong safely)

0 ≤ x ∧ x ≤ 5 ∧ v ≤ 0 ∧ g > 0 ∧ 1 ≥ c ≥ 0 ∧ f ≥ 0 →

  • {x′ = v, v′ = −g & x ≥ 0 ∧ x≤5};

if(x=0) v := −cv else if(4≤x≤5) v := −fv ∗ (0≤x≤5) Proof? Ask Ren´ e Descartes who says yes! May miss 4 but not 5

Andr´ e Platzer (CMU) FCPS / 08: Events & Responses 10 / 20

slide-27
SLIDE 27

Quantum the Deterministically Daring Ping Pong Ball

Conjecture (Quantum can play ping pong safely)

0 ≤ x ∧ x ≤ 5 ∧ v ≤ 0 ∧ g > 0 ∧ 1 ≥ c ≥ 0 ∧ f ≥ 0 →

  • {x′ = v, v′ = −g & x ≥ 0 ∧ x≤5};

if(x=0) v := −cv else if(4≤x≤5) v := −fv ∗ (0≤x≤5) Proof? Ask Ren´ e Descartes who says yes! May miss 4 but not 5

Andr´ e Platzer (CMU) FCPS / 08: Events & Responses 10 / 20

slide-28
SLIDE 28

Quantum the Deterministically Daring Ping Pong Ball

Conjecture (Quantum can play ping pong safely)

0 ≤ x ∧ x ≤ 5 ∧ v ≤ 0 ∧ g > 0 ∧ 1 ≥ c ≥ 0 ∧ f ≥ 0 →

  • {x′ = v, v′ = −g & x ≥ 0 ∧ x≤5};

if(x=0) v := −cv else if(4≤x≤5) v := −fv ∗ (0≤x≤5) Proof? Ask Ren´ e Descartes who says yes! But meant to say no! Domain by construction

Andr´ e Platzer (CMU) FCPS / 08: Events & Responses 10 / 20

slide-29
SLIDE 29

Quantum the Deterministically Daring Ping Pong Ball

Conjecture (Quantum can play ping pong safely)

0 ≤ x ∧ x ≤ 5 ∧ v ≤ 0 ∧ g > 0 ∧ 1 ≥ c ≥ 0 ∧ f ≥ 0 →

  • {x′ = v, v′ = −g & x ≥ 0 ∧ x≤5};

if(x=0) v := −cv else if(4≤x≤5) v := −fv ∗ (0≤x≤5) Proof? Ask Ren´ e Descartes who says yes! But meant to say no! Non-negotiable physics

Andr´ e Platzer (CMU) FCPS / 08: Events & Responses 10 / 20

slide-30
SLIDE 30

On the Nuisance of Nuances of Physics

Non-negotiability of Physics

1 Making systems safe by construction is a great idea.

For control!

2 Not by changing the laws of physics around. 3 Physics is unpleasantly non-negotiable. 4 If models are safe because we forgot to include all behavior of physical

reality, then correctness statements only hold in that other universe. Despite control We don’t get to boss physics around

We don’t make this world any safer by writing CPS programs for another universe.

Andr´ e Platzer (CMU) FCPS / 08: Events & Responses 11 / 20

slide-31
SLIDE 31

Quantum the Deterministically Daring Ping Pong Ball

Conjecture (Quantum can play ping pong safely)

0 ≤ x ∧ x ≤ 5 ∧ v ≤ 0 ∧ g > 0 ∧ 1 ≥ c ≥ 0 ∧ f ≥ 0 →

  • {x′ = v, v′ = −g & x ≥ 0 ∧ x≤5};

if(x=0) v := −cv else if(4≤x≤5) v := −fv ∗ (0≤x≤5) Proof? Ask Ren´ e Descartes who says yes! But meant to say no! Can’t stop the world for an event

Andr´ e Platzer (CMU) FCPS / 08: Events & Responses 12 / 20

slide-32
SLIDE 32

Quantum the Deterministically Daring Ping Pong Ball

Conjecture (Quantum can play ping pong safely)

0 ≤ x ∧ x ≤ 5 ∧ v ≤ 0 ∧ g > 0 ∧ 1 ≥ c ≥ 0 ∧ f ≥ 0 →

  • {x′ = v, v′ = −g & x ≥ 0 ∧ x≤5 ∪ x′ = v, v′ = −g & x>5};

if(x=0) v := −cv else if(4≤x≤5) v := −fv ∗ (0≤x≤5) Proof? Ask Ren´ e Descartes Can split the world for an event

Andr´ e Platzer (CMU) FCPS / 08: Events & Responses 12 / 20

slide-33
SLIDE 33

Quantum the Deterministically Daring Ping Pong Ball

Conjecture (Quantum can play ping pong safely)

0 ≤ x ∧ x ≤ 5 ∧ v ≤ 0 ∧ g > 0 ∧ 1 ≥ c ≥ 0 ∧ f ≥ 0 →

  • {x′ = v, v′ = −g & x ≥ 0 ∧ x≤5 ∪ x′ = v, v′ = −g & x>5};

if(x=0) v := −cv else if(4≤x≤5) v := −fv ∗ (0≤x≤5) Proof? Ask Ren´ e Descartes Disjoint domains Shattered the world

Andr´ e Platzer (CMU) FCPS / 08: Events & Responses 12 / 20

slide-34
SLIDE 34

Quantum the Deterministically Daring Ping Pong Ball

Conjecture (Quantum can play ping pong safely)

0 ≤ x ∧ x ≤ 5 ∧ v ≤ 0 ∧ g > 0 ∧ 1 ≥ c ≥ 0 ∧ f ≥ 0 →

  • {x′ = v, v′ = −g & x ≥ 0 ∧ x≤5 ∪ x′ = v, v′ = −g & x≥5};

if(x=0) v := −cv else if(4≤x≤5) v := −fv ∗ (0≤x≤5) Proof? Ask Ren´ e Descartes Glue domains Reunite the world

Andr´ e Platzer (CMU) FCPS / 08: Events & Responses 13 / 20

slide-35
SLIDE 35

Connected Evolution Domains

Connected evolution domains

1 Evolution domain constraints need care. 2 Determine regions within which the system can evolve. 3 Disconnected/disjoint disallows continuous transitions. 1 Splitting the state space into different regions to detect events is fine. 2 Destroying the world is not. 3 Not even by poking infinitesimal holes into the time-space continuum. Andr´ e Platzer (CMU) FCPS / 08: Events & Responses 14 / 20

slide-36
SLIDE 36

Quantum the Deterministically Daring Ping Pong Ball

Conjecture (Quantum can play ping pong safely)

0 ≤ x ∧ x ≤ 5 ∧ v ≤ 0 ∧ g > 0 ∧ 1 ≥ c ≥ 0 ∧ f ≥ 0 →

  • {x′ = v, v′ = −g & x ≥ 0 ∧ x≤5 ∪ x′ = v, v′ = −g & x≥5};

if(x=0) v := −cv else if(4≤x≤5) v := −fv ∗ (0≤x≤5) Proof? Ask Ren´ e Descartes

Andr´ e Platzer (CMU) FCPS / 08: Events & Responses 15 / 20

slide-37
SLIDE 37

Quantum the Deterministically Daring Ping Pong Ball

Conjecture (Quantum can play ping pong safely)

0 ≤ x ∧ x ≤ 5 ∧ v ≤ 0 ∧ g > 0 ∧ 1 ≥ c ≥ 0 ∧ f ≥ 0 →

  • {x′ = v, v′ = −g & x ≥ 0 ∧ x≤5 ∪ x′ = v, v′ = −g & x≥5};

if(x=0) v := −cv else if(4≤x≤5) v := −fv ∗ (0≤x≤5) Proof? Ask Ren´ e Descartes Multi-fire

Andr´ e Platzer (CMU) FCPS / 08: Events & Responses 15 / 20

slide-38
SLIDE 38

Quantum the Deterministically Daring Ping Pong Ball

Conjecture (Quantum can play ping pong safely)

0 ≤ x ∧ x ≤ 5 ∧ v ≤ 0 ∧ g > 0 ∧ 1 ≥ c ≥ 0 ∧ f ≥ 0 →

  • {x′ = v, v′ = −g & x ≥ 0 ∧ x≤5 ∪ x′ = v, v′ = −g & x≥5};

if(x=0) v := −cv else if(4≤x≤5) v := −fv ∗ (0≤x≤5) Proof? Ask Ren´ e Descartes Multi-fire

Andr´ e Platzer (CMU) FCPS / 08: Events & Responses 15 / 20

slide-39
SLIDE 39

Quantum the Deterministically Daring Ping Pong Ball

Conjecture (Quantum can play ping pong safely)

0 ≤ x ∧ x ≤ 5 ∧ v ≤ 0 ∧ g > 0 ∧ 1 ≥ c ≥ 0 ∧ f ≥ 0 →

  • {x′ = v, v′ = −g & x ≥ 0 ∧ x≤5 ∪ x′ = v, v′ = −g & x≥5};

if(x=0) v := −cv else if(4≤x≤5) v := −fv ∗ (0≤x≤5) Proof? Ask Ren´ e Descartes who definitely says no! Multi-fire

Andr´ e Platzer (CMU) FCPS / 08: Events & Responses 15 / 20

slide-40
SLIDE 40

Quantum the Deterministically Daring Ping Pong Ball

Conjecture (Quantum can play ping pong safely)

0 ≤ x ∧ x ≤ 5 ∧ v ≤ 0 ∧ g > 0 ∧ 1 ≥ c ≥ 0 ∧ f ≥ 0 →

  • {x′ = v, v′ = −g & x ≥ 0 ∧ x≤5 ∪ x′ = v, v′ = −g & x≥5};

if(x=0) v := −cv else if(4≤x≤5∧v≥0) v := −fv ∗ (0≤x≤5) Proof? Ask Ren´ e Descartes Only upsense event

Andr´ e Platzer (CMU) FCPS / 08: Events & Responses 15 / 20

slide-41
SLIDE 41

Multi-firing Events

Multi-firing of events

1 If the same event is detected multiple times: 2 Are multiple responses acceptable? 3 Or is a single response crucial? Andr´ e Platzer (CMU) FCPS / 08: Events & Responses 16 / 20

slide-42
SLIDE 42

Physics vs. Control: Classification

Conjecture (Quantum can play ping pong safely)

0 ≤ x ∧ x ≤ 5 ∧ v ≤ 0 ∧ g > 0 ∧ 1 ≥ c ≥ 0 ∧ f ≥ 0 →

  • ((x′ = v, v′ = −g & x ≥ 0 ∧ x≤5) ∪ (x′ = v, v′ = −g & x≥5));

if(x=0) v := −cv else if(4≤x≤5∧v≥0) v := −fv ∗ (0≤x≤5) control: robust, all cases physics: precise

Andr´ e Platzer (CMU) FCPS / 08: Events & Responses 17 / 20

slide-43
SLIDE 43

Physics vs. Control: Classification

Conjecture (Quantum can play ping pong safely)

0 ≤ x ∧ x ≤ 5 ∧ v ≤ 0 ∧ g > 0 ∧ 1 ≥ c ≥ 0 ∧ f ≥ 0 →

  • ((x′ = v, v′ = −g & x ≥ 0 ∧ x≤5) ∪ (x′ = v, v′ = −g & x≥5));

if(x=0) v := −cv else if(4≤x≤5∧v≥0) v := −fv ∗ (0≤x≤5) control: robust, all cases physics: precise

Andr´ e Platzer (CMU) FCPS / 08: Events & Responses 17 / 20

slide-44
SLIDE 44

Outline

1

Learning Objectives

2

The Need for Control Quantum the Ping Pong Ball Cartesian Demon Determinizing Ping Pong Balls

3

Event-triggered Control Evolution Domains Detect Events Non-negotiability of Physics Splitting and Connecting Evolution Domains Firing of Events Physics vs. Control

4

Proof Loop Invariants

5

Summary

Andr´ e Platzer (CMU) FCPS / 08: Events & Responses 17 / 20

slide-45
SLIDE 45

Quantum’s Ping Pong Proof Invariants

Proposition (Quantum can play ping pong safely)

0 ≤ x ∧ x ≤ 5 ∧ v ≤ 0 ∧ g > 0 ∧ 1 ≥ c ≥ 0 ∧ f ≥ 0 →

  • ((x′ = v, v′ = −g & x ≥ 0 ∧ x≤5) ∪ (x′ = v, v′ = −g & x≥5));

if(x=0) v := −cv else if(4≤x≤5∧v≥0) v := −fv ∗ (0≤x≤5)

Andr´ e Platzer (CMU) FCPS / 08: Events & Responses 18 / 20

slide-46
SLIDE 46

Quantum’s Ping Pong Proof Invariants

Proposition (Quantum can play ping pong safely)

0 ≤ x ∧ x ≤ 5 ∧ v ≤ 0 ∧ g > 0 ∧ 1 ≥ c ≥ 0 ∧ f ≥ 0 →

  • ((x′ = v, v′ = −g & x ≥ 0 ∧ x≤5) ∪ (x′ = v, v′ = −g & x≥5));

if(x=0) v := −cv else if(4≤x≤5∧v≥0) v := −fv ∗ (0≤x≤5) Loop invariant j(x, v):

1 0≤x≤5

not inductive

Andr´ e Platzer (CMU) FCPS / 08: Events & Responses 18 / 20

slide-47
SLIDE 47

Quantum’s Ping Pong Proof Invariants

Proposition (Quantum can play ping pong safely)

0 ≤ x ∧ x ≤ 5 ∧ v ≤ 0 ∧ g > 0 ∧ 1 ≥ c ≥ 0 ∧ f ≥ 0 →

  • ((x′ = v, v′ = −g & x ≥ 0 ∧ x≤5) ∪ (x′ = v, v′ = −g & x≥5));

if(x=0) v := −cv else if(4≤x≤5∧v≥0) v := −fv ∗ (0≤x≤5) Loop invariant j(x, v):

1 0≤x≤5

not inductive

2 0≤x≤5∧v≤0 Andr´ e Platzer (CMU) FCPS / 08: Events & Responses 18 / 20

slide-48
SLIDE 48

Quantum’s Ping Pong Proof Invariants

Proposition (Quantum can play ping pong safely)

0 ≤ x ∧ x ≤ 5 ∧ v ≤ 0 ∧ g > 0 ∧ 1 ≥ c ≥ 0 ∧ f ≥ 0 →

  • ((x′ = v, v′ = −g & x ≥ 0 ∧ x≤5) ∪ (x′ = v, v′ = −g & x≥5));

if(x=0) v := −cv else if(4≤x≤5∧v≥0) v := −fv ∗ (0≤x≤5) Loop invariant j(x, v):

1 0≤x≤5

not inductive

2 0≤x≤5∧v≤0 not inductive Andr´ e Platzer (CMU) FCPS / 08: Events & Responses 18 / 20

slide-49
SLIDE 49

Quantum’s Ping Pong Proof Invariants

Proposition (Quantum can play ping pong safely)

0 ≤ x ∧ x ≤ 5 ∧ v ≤ 0 ∧ g > 0 ∧ 1 ≥ c ≥ 0 ∧ f ≥ 0 →

  • ((x′ = v, v′ = −g & x ≥ 0 ∧ x≤5) ∪ (x′ = v, v′ = −g & x≥5));

if(x=0) v := −cv else if(4≤x≤5∧v≥0) v := −fv ∗ (0≤x≤5) Loop invariant j(x, v):

1 0≤x≤5

not inductive

2 0≤x≤5∧v≤0 not inductive 3 0≤x≤5∧(x=5→v≤0) Andr´ e Platzer (CMU) FCPS / 08: Events & Responses 18 / 20

slide-50
SLIDE 50

Quantum’s Ping Pong Proof Invariants

Proposition (Quantum can play ping pong safely)

0 ≤ x ∧ x ≤ 5 ∧ v ≤ 0 ∧ g > 0 ∧ 1 ≥ c ≥ 0 ∧ f ≥ 0 →

  • ((x′ = v, v′ = −g & x ≥ 0 ∧ x≤5) ∪ (x′ = v, v′ = −g & x≥5));

if(x=0) v := −cv else if(4≤x≤5∧v≥0) v := −fv ∗ (0≤x≤5) Proof @invariant(0≤x≤5 ∧ (x = 5 → v≤0)) Loop invariant j(x, v):

1 0≤x≤5

not inductive

2 0≤x≤5∧v≤0 not inductive 3 0≤x≤5∧(x=5→v≤0) yes! Andr´ e Platzer (CMU) FCPS / 08: Events & Responses 18 / 20

slide-51
SLIDE 51

Quantum’s Ping Pong Proof Invariants

Proposition (Quantum can play ping pong safely)

0 ≤ x ∧ x ≤ 5 ∧ v ≤ 0 ∧ g > 0 ∧ 1 ≥ c ≥ 0 ∧ f ≥ 0 →

  • ((x′ = v, v′ = −g & x ≥ 0 ∧ x≤5) ∪ (x′ = v, v′ = −g & x≥5));

if(x=0) v := −cv else if(4≤x≤5∧v≥0) v := −fv ∗ (0≤x≤5) Proof @invariant(0≤x≤5 ∧ (x = 5 → v≤0))

Andr´ e Platzer (CMU) FCPS / 08: Events & Responses 18 / 20

slide-52
SLIDE 52

Outline

1

Learning Objectives

2

The Need for Control Quantum the Ping Pong Ball Cartesian Demon Determinizing Ping Pong Balls

3

Event-triggered Control Evolution Domains Detect Events Non-negotiability of Physics Splitting and Connecting Evolution Domains Firing of Events Physics vs. Control

4

Proof Loop Invariants

5

Summary

Andr´ e Platzer (CMU) FCPS / 08: Events & Responses 18 / 20

slide-53
SLIDE 53

Summary: Event-triggered Control

1 Common conceptually simple paradigm for designing controllers 2 Assumes all events are surely detected 3 Implementation: Requires continuous sensing

Tell me if you found a good implementation platform . . .

4 Robust events, not just if(x = 9.8696) . . . 5 Events have subtle models, but make design and verification easier!

Non-negotiability of Physics Connected domains Multi-firing

6 Verify event-triggered model as first step, then refine toward realistic

implementation based on safe event-triggered design

7 Physics = Control Andr´ e Platzer (CMU) FCPS / 08: Events & Responses 19 / 20

slide-54
SLIDE 54

On the Nuisance of Nuances of Physics

Non-negotiability of Physics

1 Making systems safe by construction is a great idea.

For control!

2 Not by changing the laws of physics around. 3 Physics is unpleasantly non-negotiable. 4 If models are safe because we forgot to include all behavior of physical

reality, then correctness statements only hold in that other universe. Despite control We don’t get to boss physics around

We don’t make this world any safer by writing CPS programs for another universe.

Andr´ e Platzer (CMU) FCPS / 08: Events & Responses 20 / 20

slide-55
SLIDE 55

Andr´ e Platzer. Foundations of cyber-physical systems. Lecture Notes 15-424/624, Carnegie Mellon University, 2016. URL: http://www.cs.cmu.edu/~aplatzer/course/fcps16.html. Andr´ e Platzer. Logical Analysis of Hybrid Systems: Proving Theorems for Complex Dynamics. Springer, Heidelberg, 2010. doi:10.1007/978-3-642-14509-4.

Andr´ e Platzer (CMU) FCPS / 08: Events & Responses 20 / 20