C2E2: A Verification Tool For Stateflow Models Parasara Sridhar - - PowerPoint PPT Presentation

β–Ά
c2e2 a verification tool for
SMART_READER_LITE
LIVE PREVIEW

C2E2: A Verification Tool For Stateflow Models Parasara Sridhar - - PowerPoint PPT Presentation

Dec 11, 2023 234 likes β€’576 views

C2E2: A Verification Tool For Stateflow Models Parasara Sridhar Duggirala , Sayan Mitra, Mahesh Viswanathan, Matthew Potok Pacemaker Cardiac Cell System + 2 Pacemaker Cardiac Cell System stimulating pulse 0 1 Pacemaker

slide-1
SLIDE 1

C2E2: A Verification Tool For Stateflow Models

Parasara Sridhar Duggirala, Sayan Mitra, Mahesh Viswanathan, Matthew Potok

slide-2
SLIDE 2

Pacemaker – Cardiac Cell System

2

+

slide-3
SLIDE 3

Pacemaker – Cardiac Cell System

3

π‘Ÿ0 π‘Ÿ2 π‘Ÿ3

…

stimulating pulse

Pacemaker

π‘Ÿ1

HA = Finite State Machine + Differential Equation

time

𝑣(𝑒) 𝑦1(𝑒)

time Stimulus from pacemaker Behavior of a cardiac cell

slide-4
SLIDE 4

Safety Verification

  • Inputs:

1. Model of the system 𝐡, 2. Initial States Θ, and 3. Unsafe States 𝑉

  • Output: If the system is safe or unsafe

βˆ€π‘¦ ∈ Θ, 𝜊 𝑦, 𝑒 βˆ‰ 𝑉

4

𝑦1(𝑒)

time Unsafe Set Stateflow Model of Pacemaker – Cardiac Cell system Features: Invariants, Guards, and Resets

Solution Reachable Set Computation

Features of the Model

slide-5
SLIDE 5

Contributions

  • Simulation based verification algorithm for Fully Hybrid Systems
  • Theoretical guarantees – Soundness and Relative Completeness
  • Tool Features
  • Stateflow Models, hyxml intermediate format
  • Graphical User Interface
  • Visualizing the reachable set

5

slide-6
SLIDE 6

Overview

οƒΌMotivation and Problem Statement

  • Challenges in Verification
  • Building Blocks and Algorithm
  • Soundness and Relative Completeness Guarantees
  • Tool Features
  • Annotations
  • Future Work

6

slide-7
SLIDE 7

Safety Verification

  • Inputs:

1. Model of the system 𝐡, 2. Initial States Θ, and 3. Unsafe States 𝑉

  • Output: If the system is safe or unsafe

βˆ€π‘¦ ∈ Θ, 𝜊 𝑦, 𝑒 βˆ‰ 𝑉

7

𝑣(𝑒)

time Unsafe Set Stateflow Model of Pacemaker – Cardiac Cell system Features: Invariants, Guards, and Resets

Solution Reachable Set Computation

slide-8
SLIDE 8

Challenges In Reachable Set Computation

  • Nonlinear ODEs – do not even have a closed form solution
  • Switching conditions – predicates on variables (nondeterminism)

8

Our Technique: Use simulations for computing Reachable Set

𝑣(𝑒)

time Unsafe Set Stateflow Model of Pacemaker – Cardiac Cell system Features: Invariants, Guards, and Resets

slide-9
SLIDE 9

9

  • Given start and unsafe
  • Compute finite cover of initial set
  • Simulate from the center 𝑦0 of each cover
  • Bloat simulation so that bloated tube contains

all trajectories from the cover

  • Union = over-approximation of reach set

Θ

𝑦0

𝑉

A Simple (Often The Only) Strategy

ሢ 𝑦 = 𝑔(𝑦) πΆπœ—(𝜊(𝑦0, 𝑒))

slide-10
SLIDE 10

10

  • Given start and unsafe
  • Compute finite cover of initial set
  • Simulate from the center 𝑦0 of each cover
  • Bloat simulation so that bloated tube contains

all trajectories from the cover

  • Union = over-approximation of reach set
  • Check intersection/containment with 𝑉
  • Refine

Θ

𝑦0

𝑉

A Simple (Often The Only) Strategy

ሢ 𝑦 = 𝑔(𝑦) πΆπœ—(𝜊(𝑦0, 𝑒))

slide-11
SLIDE 11

11

  • Given start and unsafe
  • Compute finite cover of initial set
  • Simulate from the center 𝑦0 of each cover
  • Bloat simulation so that bloated tube contains

all trajectories from the cover

  • Union = over-approximation of reach set
  • Check intersection/containment with 𝑉
  • Refine

Θ

𝑦0

𝑉

A Simple (Often The Only) Strategy

ሢ 𝑦 = 𝑔(𝑦) πΆπœ—(𝜊(𝑦0, 𝑒))

slide-12
SLIDE 12

12

  • Given start and unsafe
  • Compute finite cover of initial set
  • Simulate from the center 𝑦0 of each cover
  • Bloat simulation so that bloated tube contains

all trajectories from the cover

  • Union = over-approximation of reach set
  • Check intersection/containment with 𝑉
  • Refine
  • 1. How do we get the simulations?
  • 2. How much to bloat?
  • 3. How to handle mode switches?

Θ

𝑦0

𝑉

A Simple (Often The Only) Strategy

ሢ 𝑦 = 𝑔(𝑦) πΆπœ—(𝜊(𝑦0, 𝑒))

slide-13
SLIDE 13

Building Blocks : Simulations

Simulation from 𝑦0 given as 𝜊(𝑦0, 𝑒) – no closed form!

13

π’•π’‹π’π’—π’Žπ’ƒπ’–π’‹π’‘π’(π’šπŸ, π’Š, 𝝑, 𝑼) gives a sequence S0, … , 𝑇𝑙: 1. at any time 𝑒 ∈ [π‘—β„Ž, 𝑗 + 1 β„Ž], 𝜊 𝑦0, 𝑒 ∈ 𝑇𝑗 2. 𝑒𝑗𝑏 𝑇𝑗 ≀ πœ—

π’˜π’ƒπ’Žπ‘»π’‹π’(π’šπŸ, 𝑼, π’ˆ) generates such simulations (CAPD)

slide-14
SLIDE 14

Building Blocks : Discrepancy Function

Discrepancy Function: capturing the continuity of ODE solutions executions that start close, stay close

〈𝐿, 𝛿βŒͺ is called an exponential discrepancy function of the system if for any two states 𝑦1 and 𝑦2 ∈ π‘Œ, for any t |𝜊(𝑦1, 𝑒) βˆ’ 𝜊(𝑦2, 𝑒)| ≀ 𝐿 𝑦1 βˆ’ 𝑦2 𝑓𝛿𝑒

14

|𝑦1 βˆ’ 𝑦2| 𝑦1 𝑦2 𝜊 𝑦2, 𝑒 𝜊 𝑦1, 𝑒 ≀ 𝐿 𝑦1 βˆ’ 𝑦2 𝑓𝛿𝑒1 = 𝐿 𝑦1 βˆ’ 𝑦2 𝑓𝛿𝑒1

Discrepancy functions are given as model annotations, i.e. 〈𝐿, 𝛿βŒͺ is given by the user

slide-15
SLIDE 15

Simulations + Discrepancy Functions = ReachTubes

𝝎 = π’”π’‡π’ƒπ’…π’Šπ’–π’—π’„π’‡ 𝑻, 𝝑, 𝑼 of ሢ 𝑦 = 𝑔 𝑦 is a sequence 𝑆0, … , 𝑆𝑙 such that 𝑒𝑗𝑏(𝑆𝑗) ≀ πœ— and from any 𝑦0 ∈ 𝑇, for each time 𝑒 ∈ [π‘—β„Ž, (𝑗 + 1)β„Ž], 𝜊 𝑦0, 𝑒 ∈ 𝑆𝑗.

How to compute a ReachTube from validated simulation and annotation? 𝑇0, … , 𝑇𝑙, πœ—1 ← π’˜π’ƒπ’Žπ‘»π’‹π’(𝑦0, π‘ˆ, 𝑔)

15

slide-16
SLIDE 16

Simulations + Discrepancy Functions = ReachTubes

𝝎 = π’”π’‡π’ƒπ’…π’Šπ’–π’—π’„π’‡ 𝑻, 𝝑, 𝑼 of ሢ 𝑦 = 𝑔 𝑦 is a sequence 𝑆0, … , 𝑆𝑙 such that 𝑒𝑗𝑏(𝑆𝑗) ≀ πœ— and from any 𝑦0 ∈ 𝑇, for each time 𝑒 ∈ [π‘—β„Ž, (𝑗 + 1)β„Ž], 𝜊 𝑦0, 𝑒 ∈ 𝑆𝑗.

How to compute a ReachTube from validated simulation and annotation? 𝑇0, … , 𝑇𝑙, πœ—1 ← π’˜π’ƒπ’Žπ‘»π’‹π’(𝑦0, π‘ˆ, 𝑔) For each 𝑗 ∈ 𝑙 πœ—2 ← max

π‘’βˆˆπ‘ˆπ‘— πΏπ‘“π›Ώπ‘’πœ€;

𝑆𝑗 ← πΆπœ—2 𝑇𝑗 𝑆0, … , 𝑆𝑙 is a reachtube(π‘ͺ𝜺 π’šπŸ , π‘πŸ + π‘πŸ‘, 𝑼)

16

οƒΌ How do we get the simulations? οƒΌ How much to bloat?

  • How to handle mode switches?

Invariants Guards

slide-17
SLIDE 17

Handling Invariants

Tagging: track a region based on a predicate 𝑄

𝒖𝒃𝒉𝑺𝒇𝒉𝒋𝒑𝒐 𝑺, 𝑸 = ቐ 𝑛𝑣𝑑𝑒 𝑆 βŠ† 𝑄 𝑛𝑏𝑧 𝑆 ∩ 𝑄 β‰  βˆ…, ΰ΄€ 𝑆 ∩ 𝑄 β‰  βˆ… π‘œπ‘π‘’ 𝑆 ∩ 𝑄 = βˆ… 𝝔 = π’‹π’π’˜π’ƒπ’”π’‹π’ƒπ’π’–π‘Έπ’”π’‡π’ˆπ’‹π’š(𝝎, π‘±π’π’˜π’ƒπ’”π’‹π’ƒπ’π’–) is βŒ©π‘†0, 𝑒𝑏𝑕0, … , 𝑆𝑛, 𝑒𝑏𝑕𝑛βŒͺ , such that either 𝑒𝑏𝑕𝑗 = 𝑛𝑣𝑑𝑒 if all the 𝑆

π‘˜ ′𝑑 before it are must

𝑒𝑏𝑕𝑗 = 𝑛𝑏𝑧 if all the 𝑆

π‘˜ ′𝑑 before it are tagged may or must and at least one of

them is not must

17

Goal: Reachtube that respects the invariant of the mode

slide-18
SLIDE 18

Handling Guards & Resets

π’π’‡π’šπ’–π‘Ίπ’‡π’‰π’‹π’‘π’π’•(𝝔) returns a set of tagged regions N. 𝑆′, 𝑒𝑏𝑕′ ∈ 𝑂 iff βˆƒ 𝑏 ∈ 𝐡, βŒ©π‘†π‘—, 𝑒𝑏𝑕𝑗βŒͺ ∈ 𝜚 such that 𝑆′ = 𝑆𝑓𝑑𝑓𝑒𝑏 𝑆𝑗 and: 𝑆𝑗 βŠ† 𝐻𝑣𝑏𝑠𝑒𝑏 , 𝑒𝑏𝑕𝑗 = 𝑒𝑏𝑕′ = 𝑛𝑣𝑑𝑒 𝑆𝑗 ∩ 𝐻𝑣𝑏𝑠𝑒𝑏 β‰  βˆ…, 𝑆𝑗 βˆ‰ 𝐻𝑣𝑏𝑠𝑒𝑏 , 𝑒𝑏𝑕𝑗 = 𝑛𝑣𝑑𝑒, 𝑒𝑏𝑕′ = 𝑛𝑏𝑧 𝑆𝑗 ∩ 𝐻𝑣𝑏𝑠𝑒𝑏 β‰  βˆ…, 𝑒𝑏𝑕𝑗 = 𝑒𝑏𝑕′ = 𝑛𝑏𝑧 Tagging is essentially bookkeeping

  • 1. π‘—π‘œπ‘€π‘π‘ π‘—π‘π‘œπ‘’π‘„π‘ π‘“π‘”π‘—π‘¦ discards the invalid trajectories (violating invariant)
  • 2. π‘œπ‘“π‘¦π‘’π‘†π‘“π‘•π‘—π‘π‘œπ‘‘ tags the regions based on the feasibility of discrete transition

Utility of tagging

  • 1. Reachable set is contained in union of may and must regions – inferring safety
  • 2. There exists at least one reachable state in every must region – inferring violation of

safety

18

Goal: Compute set of states in Reachtube that change mode based on Guard

slide-19
SLIDE 19

Algorithm for Hybrid Systems

Input: Initial Set Θ, Unsafe set 𝑉, Time π‘ˆ, Number of Switches 𝑂 π‘žπ‘π‘ π‘’π‘—π‘’π‘—π‘π‘œ ← 𝑒𝑏𝑕𝑕𝑓𝑒𝐷𝑝𝑀𝑓𝑠(Θ) βˆ€ βŒ©π‘‡, 𝑒𝑏𝑕βŒͺ ∈ π‘žπ‘π‘ π‘’π‘—π‘’π‘—π‘π‘œ πœ” ← π‘ π‘“π‘π‘‘β„Žπ‘ˆπ‘£π‘π‘“(𝑇, π‘ˆ) end;

19

𝑦0

slide-20
SLIDE 20

Algorithm for Hybrid Systems

Input: Initial Set Θ, Unsafe set 𝑉, Time π‘ˆ, Number of Switches 𝑂 π‘žπ‘π‘ π‘’π‘—π‘’π‘—π‘π‘œ ← 𝑒𝑏𝑕𝑕𝑓𝑒𝐷𝑝𝑀𝑓𝑠(Θ) βˆ€ βŒ©π‘‡, 𝑒𝑏𝑕βŒͺ ∈ π‘žπ‘π‘ π‘’π‘—π‘’π‘—π‘π‘œ πœ” ← π‘ π‘“π‘π‘‘β„Žπ‘ˆπ‘£π‘π‘“(𝑇, π‘ˆ) 𝜚 ← π‘—π‘œπ‘€π‘π‘ π‘—π‘π‘œπ‘’π‘„π‘ π‘“π‘”π‘—π‘¦(πœ”) end;

20

invariant

slide-21
SLIDE 21

Algorithm for Hybrid Systems

Input: Initial Set Θ, Unsafe set 𝑉, Time π‘ˆ, Number of Switches 𝑂 π‘žπ‘π‘ π‘’π‘—π‘’π‘—π‘π‘œ ← 𝑒𝑏𝑕𝑕𝑓𝑒𝐷𝑝𝑀𝑓𝑠(Θ) βˆ€ βŒ©π‘‡, 𝑒𝑏𝑕βŒͺ ∈ π‘žπ‘π‘ π‘’π‘—π‘’π‘—π‘π‘œ πœ” ← π‘ π‘“π‘π‘‘β„Žπ‘ˆπ‘£π‘π‘“(𝑇, π‘ˆ) 𝜚 ← π‘—π‘œπ‘€π‘π‘ π‘—π‘π‘œπ‘’π‘„π‘ π‘“π‘”π‘—π‘¦(πœ”) if (𝜚 is safe) then continue; if (𝜚 is unsafe and 𝑒𝑏𝑕 is 𝑛𝑣𝑑𝑒) return unsafe; else refine tagged cover; end; return safe;

21

invariant

slide-22
SLIDE 22

Algorithm for Hybrid Systems

Input: Initial Set Θ, Unsafe set 𝑉, Time π‘ˆ, Number of Switches 𝑂 π‘žπ‘π‘ π‘’π‘—π‘’π‘—π‘π‘œ ← 𝑒𝑏𝑕𝑕𝑓𝑒𝐷𝑝𝑀𝑓𝑠(Θ) βˆ€ βŒ©π‘‡, 𝑒𝑏𝑕βŒͺ ∈ π‘žπ‘π‘ π‘’π‘—π‘’π‘—π‘π‘œ πœ” ← π‘ π‘“π‘π‘‘β„Žπ‘ˆπ‘£π‘π‘“(𝑇, π‘ˆ) 𝜚 ← π‘—π‘œπ‘€π‘π‘ π‘—π‘π‘œπ‘’π‘„π‘ π‘“π‘”π‘—π‘¦(πœ”) if (𝜚 is safe) then continue; if (𝜚 is unsafe and 𝑒𝑏𝑕 is 𝑛𝑣𝑑𝑒) return unsafe; else refine tagged cover; end; return safe;

22

guard

slide-23
SLIDE 23

Algorithm for Hybrid Systems

Input: Initial Set Θ, Unsafe set 𝑉, Time π‘ˆ, Number of Switches 𝑂 π‘žπ‘π‘ π‘’π‘—π‘’π‘—π‘π‘œ ← 𝑒𝑏𝑕𝑕𝑓𝑒𝐷𝑝𝑀𝑓𝑠(Θ) βˆ€ βŒ©π‘‡, 𝑒𝑏𝑕βŒͺ ∈ π‘žπ‘π‘ π‘’π‘—π‘’π‘—π‘π‘œ πœ” ← π‘ π‘“π‘π‘‘β„Žπ‘ˆπ‘£π‘π‘“(𝑇, π‘ˆ) 𝜚 ← π‘—π‘œπ‘€π‘π‘ π‘—π‘π‘œπ‘’π‘„π‘ π‘“π‘”π‘—π‘¦(πœ”) 𝑂𝑓𝑦𝑒 ← π‘œπ‘“π‘¦π‘’π‘†π‘“π‘•π‘—π‘π‘œπ‘‘(𝜚) if (𝜚 is safe) then check 𝑂𝑓𝑦𝑒; if (𝜚 is unsafe and 𝑒𝑏𝑕 is 𝑛𝑣𝑑𝑒) return unsafe; else refine tagged cover; end; return safe;

23

guard

slide-24
SLIDE 24

Algorithm for Hybrid Systems

Input: Initial Set Θ, Unsafe set 𝑉, Time π‘ˆ, Number of Switches 𝑂 π‘žπ‘π‘ π‘’π‘—π‘’π‘—π‘π‘œ ← 𝑒𝑏𝑕𝑕𝑓𝑒𝐷𝑝𝑀𝑓𝑠(Θ) βˆ€ βŒ©π‘‡, 𝑒𝑏𝑕βŒͺ ∈ π‘žπ‘π‘ π‘’π‘—π‘’π‘—π‘π‘œ π‘Ÿπ‘£π‘“π‘£π‘“π‘†π‘“π‘•π‘—π‘π‘œπ‘‘ ← {βŒ©π‘‡, 𝑒𝑏𝑕βŒͺ} βˆ€ 𝑇, 𝑒𝑏𝑕 ∈ π‘Ÿπ‘£π‘“π‘£π‘“π‘†π‘“π‘•π‘—π‘π‘œπ‘‘ until 𝑂 steps and π‘ˆ time πœ” ← π‘ π‘“π‘π‘‘β„Žπ‘ˆπ‘£π‘π‘“(𝑇, π‘ˆ) 𝜚 ← π‘—π‘œπ‘€π‘π‘ π‘—π‘π‘œπ‘’π‘„π‘ π‘“π‘”π‘—π‘¦(πœ”) 𝑂𝑓𝑦𝑒 ← π‘œπ‘“π‘¦π‘’π‘†π‘“π‘•π‘—π‘π‘œπ‘‘(𝜚) if (𝜚 is safe) enque 𝑂𝑓𝑦𝑒 to π‘Ÿπ‘£π‘“π‘£π‘“π‘†π‘“π‘•π‘—π‘π‘œπ‘‘; if (𝜚 is unsafe and 𝑒𝑏𝑕 is 𝑛𝑣𝑑𝑒) return unsafe; else refine tagged cover; end; end; return safe;

24

guard

slide-25
SLIDE 25

Soundness & Relative Completeness

[Soundness]: If the algorithm returns safe(or unsafe), then the system is indeed safe(or unsafe). Proof sketch:

  • 1. Union of May and Must regions contains the reachable set
  • 2. Algorithm returns safe only when all the May and Must regions

are safe

  • 3. Algorithm returns unsafe only when a Must region is contained

in the unsafe set

25

slide-26
SLIDE 26

Soundness & Relative Completeness

[Relative Completeness]: If the system is robustly safe or robustly unsafe, then the algorithm will terminate with correct answer. Definition

Robustly safe: If there is πœ— separation between reachable set and 𝑉 Robustly unsafe: If πœ— shrinkage of invariants, guards, and initial set Θ, is unsafe with respect to πœ— shrinkage of 𝑉 Proof sketch: 1. Refining the cover enough will ensure that overapproximation is less than πœ—, so if the system is robustly safe, the algorithm returns safe 2. If the πœ— shrinkage of invariants, guards, Θ, and 𝑉 is unsafe, then βˆƒ 𝑆𝑗 tagged 𝑛𝑣𝑑𝑒 in the reachable that is unsafe

26

slide-27
SLIDE 27

Overview

οƒΌMotivation and Problem Statement οƒΌChallenges in Verification οƒΌBuilding Blocks and Algorithm οƒΌSoundness and Relative Completeness Guarantees

  • Tool Features
  • Annotations
  • Future Work

27

slide-28
SLIDE 28

C2 C2E2 E2 : Compare-Execute-Check-Engine

Features:

  • Stateflow models
  • Graphical User Interface
  • Plotting

28

Architecture of C2E2

slide-29
SLIDE 29

𝑒 β‰₯ 5; 𝑒 = 0

C2E2: Features, Architecture, & Usability

Stateflow models: No formal semantics from MATHWORKS, Hybrid automata semantics by Tiwari [β€˜02], Manamcheri et.al.[β€˜10] Urgent semantics: Bloating the guard set: for providing robust counterexamples 𝑒 β‰₯ 5 β‡’ 𝑒 β‰₯ 5 βˆ’ πœ—, 𝑒 ≀ 5 + πœ—

29

slide-30
SLIDE 30

C2E2: Features, Architecture, & Usability

30

  • GUI for viewing model, properties
  • Saving model in hyxml format
  • Interface for plotting reachable set

More in the Tool Demo Market

slide-31
SLIDE 31

Comparison with Existing Approaches on Academic Benchmarks [DMV’13]

31 Benchmark Variables Sims. C2E2 (time) Flow* (time) Ariadne (time) Moore-G. Jet Engine 2 36 1.56 10.54 56.57 Brussellator System 2 115 5.26 16.77 72.75 VanDerPol Oscillator 2 17 0.75 8.93 98.36 Coupled VanDerPol 4 62 1.43 90.96 270.61 Sinusoidal Tracking 6 84 3.68 48.63 763.32 Linear Adaptive 3 16 0.47 NA NA Nonlinear Adaptive 2 32 1.23 NA NA Nonlinear Disturbance 3 48 1.52 NA NA

C2E2 Flow*

slide-32
SLIDE 32

Discrepancy Functions – Model Annotations

  • Sufficient conditions for finding discrepancy functions (borrowed from Control Theory)
  • Lipschitz continuity: ሢ

𝑦 = 𝑔(𝑦) has Lipschitz constant 𝑀, then 𝑦1(𝑒) βˆ’ 𝑦2(𝑒) ≀ |𝑦1 βˆ’ 𝑦2|𝑓𝑀𝑒

  • Contraction Metric: If πΎπ‘ˆπ‘ + 𝑁 𝐾 + 𝑐𝑁𝑁 β‰Ό 0, then βˆƒπ‘™, πœ€ > 0, 𝑦1 𝑒 βˆ’ 𝑦2 𝑒

2 ≀ 𝑙 𝑦1 βˆ’ 𝑦2 2π‘“βˆ’πœ€π‘’

  • Incremental Lyapunov Function: With function π‘Š, then 𝑦1 𝑒 βˆ’ 𝑦2(𝑒)

≀ 𝑙 𝑦1 βˆ’ 𝑦2 ; 𝑙 = 𝐺(π‘Š)

  • Finding such discrepancy function automatically
  • Nonlinear optimization for Lipschitz continuity
  • For ሢ

𝑀 = 𝐡𝑀 that are exponentially stable, compute Lyapunov function

  • Solving LMIs using Sum-Of-Squares tools to compute contraction metric
  • Manual proof methods using coordinate transformation and eigen values of Jacobian

32

Exponential discrepancy function 〈𝐿 = 3.8, 𝛿 = βˆ’0.2βŒͺ

slide-33
SLIDE 33

Summary & Future Work

  • Simulation based verification algorithm for Fully Hybrid Systems
  • Soundness and Relative completeness guarantees
  • Tool features:
  • Stateflow models
  • GUI and usability enhancements
  • Plotting for visualizing reachable set

Future Work

  • Automatically finding discrepancy functions
  • Theoretical Result: Minimum number of simulations to verify a

given system

33

Thank You, Questions?