SIMULATION TO PROOFS IN C2E2 Parasara Sridhar Duggirala 1 A simple - - PowerPoint PPT Presentation

β–Ά
simulation to proofs in c2e2
SMART_READER_LITE
LIVE PREVIEW

SIMULATION TO PROOFS IN C2E2 Parasara Sridhar Duggirala 1 A simple - - PowerPoint PPT Presentation

Dec 11, 2022 210 likes β€’442 views

SIMULATION TO PROOFS IN C2E2 Parasara Sridhar Duggirala 1 A simple (often the only) strategy Given start and target S Compute finite cover of initial set Simulate from the center 0 of each cover Bloat

slide-1
SLIDE 1

SIMULATION TO PROOFS IN C2E2

Parasara Sridhar Duggirala

1

slide-2
SLIDE 2

2

  • Given start and target
  • Compute finite cover of initial set
  • Simulate from the center 𝑦0 of each cover
  • Bloat simulation so that bloated tube

contains all trajectories from the cover

  • Union = over-approximation of reach set
  • Check intersection/containment with π‘ˆ
  • Refine
  • How much to bloat?
  • How to handle mode switches?

S

𝑦0

π‘ˆ

A simple (often the only) strategy

[Girard et al 2006], [Donze et al 2008],... (obviously incomplete)

slide-3
SLIDE 3
  • Definition. 𝛾: ℝ2π‘œ Γ— ℝβ‰₯0 β†’ ℝβ‰₯0 defines a discrepancy of the

system if for any two states 𝑦1 and 𝑦2 ∈ π‘Œ, For any t,

  • 1. |𝜊 𝑦1, 𝑒 βˆ’ 𝜊 𝑦2, 𝑒 | ≀ 𝛾 𝑦1, 𝑦2, 𝑒 and
  • 2. 𝛾 β†’ 0 as 𝑦1 β†’ 𝑦2

βˆ’πœŠ 𝑦1, 𝑒 βˆ’π‘Š 𝜊 𝑦1, 𝑒 , 𝜊 𝑦2, 𝑒 βˆ’π›Ύ 𝑦1, 𝑦2, 𝑒

3

Discrepancy (Spirit of Loop Invariants) .

𝑦 ≔ 0 invariant 𝑦 ≀ 10 until 𝑦 β‰₯ 10 do 𝑦 ≔ 𝑦 + 1

  • d
slide-4
SLIDE 4

4

If L is a Lipschitz constant for f(x,t) then |𝜊 𝑦1, 𝑒 βˆ’ 𝜊 𝑦2, 𝑒 | ≀ 𝑓𝑀𝑒 𝑦1 βˆ’ 𝑦2 . If 𝑦 = 𝐡𝑦 Lyapunov function π‘¦π‘ˆπ‘π‘¦ that proves exponenial stability, then |𝜊 𝑦1, 𝑒 βˆ’ 𝜊 𝑦2, 𝑒 | ≀ 𝐿𝑓𝛿𝑒 𝑦1 βˆ’ 𝑦2 where 𝐿 = πΊπ‘£π‘œπ‘‘(𝑁) Similar observation by [Deng et al 2013] What about Nonlinear Systems?

Computing Discrepancy .

slide-5
SLIDE 5

5

If M is a contraction metric, that is, a positive definite matrix such that βˆƒπ‘π‘ > 0: πΎπ‘ˆπ‘ + 𝑁 𝐾 + 𝑐𝑁𝑁 β‰Ό 0, where J is the Jacobian for f, then βˆƒπ‘™, πœ€ > 0 such that 𝜊 𝑦, 𝑒 βˆ’ 𝜊 𝑦′, 𝑒

2 ≀

𝑙 𝑦 βˆ’ 𝑦′ 2π‘“βˆ’πœ€π‘’[Lohmiller & Slotine β€˜98]. New algorithm: computes local discrepancy by estimating maximum eigenvalue of the Jacobian matrix over a neighborhood [Fan & Mitra 2014]. Inferring Contraction Metric from simulations [Balkan et al 2014] What next?

Computing Discrepancy .

slide-6
SLIDE 6

Simulations+Annotation οƒ  Reachtubes

π’•π’‹π’π’—π’Žπ’ƒπ’–π’‹π’‘π’(π’šπŸ , π’Š, 𝝑, 𝑼) of gives a sequence S0, … , 𝑇𝑙: 𝑒𝑗𝑏 𝑇𝑗 ≀ πœ— & at any time 𝑒 ∈ [π‘—β„Ž, 𝑗 + 1 β„Ž], solution 𝜊 𝑦0, 𝑒 ∈ 𝑇𝑗. π’”π’‡π’ƒπ’…π’Šπ’–π’—π’„π’‡ 𝑻, 𝝑, 𝑼 of 𝑦 = 𝑔 𝑦 is a sequence 𝑆0, … , 𝑆𝑙 such that 𝑒𝑗𝑏(𝑆𝑗) ≀ πœ— and from any 𝑦0 ∈ 𝑇, for each time 𝑒 ∈ [π‘—β„Ž, (𝑗 + 1)β„Ž], 𝜊 𝑦0, 𝑒 ∈ 𝑆𝑗. 𝑇0, … , 𝑇𝑙, πœ—1 ← π‘€π‘π‘šπ‘‡π‘—π‘›(𝑦0, π‘ˆ, 𝑔) For each 𝑗 ∈ [𝑙] πœ—2 ← sup

π‘’βˆˆπ‘ˆπ‘—,𝑦,π‘¦β€²βˆˆπΆπœ€(𝑦0)

𝛾 𝑦1, 𝑦2, 𝑒 𝑆𝑗 ← πΆπœ—2 𝑇𝑗

6

slide-7
SLIDE 7

How to get completeness for hybrid systems?

Track & propagate 𝑛𝑏𝑧 and 𝑛𝑣𝑑𝑒 fragments of reachtube 𝒖𝒃𝒉𝑺𝒇𝒉𝒋𝒑𝒐 𝑺, 𝑸 = 𝑛𝑣𝑑𝑒 𝑆 βŠ† 𝑄 𝑛𝑏𝑧 𝑆 ∩ 𝑄 β‰  βˆ… π‘œπ‘π‘’ 𝑆 ∩ 𝑄 = βˆ… π’‹π’π’˜π’ƒπ’”π’‹π’ƒπ’π’–π‘Έπ’”π’‡π’ˆπ’‹π’š(𝝎, 𝑻) = βŒ©π‘†0, 𝑒𝑏𝑕0, … , 𝑆𝑛, 𝑒𝑏𝑕𝑛βŒͺ , such that either 𝑒𝑏𝑕𝑗 = 𝑛𝑣𝑑𝑒 if all the 𝑆

π‘˜ ′𝑑 before it are must

𝑒𝑏𝑕𝑗 = 𝑛𝑏𝑧 if all the 𝑆

π‘˜ ′𝑑 before it are at least may

and at least one of them is not must

7

slide-8
SLIDE 8

Hybrid Reachtubes: Guards & Resets

π’π’‡π’šπ’–π‘Ίπ’‡π’‰π’‹π’‘π’π’•(𝝌) returns a set of tagged regions N. 𝑆′, 𝑒𝑏𝑕′ ∈ 𝑂 iff βˆƒ 𝑏, 𝑆𝑗 such that 𝑆′ = 𝑆𝑓𝑑𝑓𝑒𝑏 𝑆𝑗 and: 𝑆𝑗 βŠ† 𝐻𝑣𝑏𝑠𝑒𝑏 , 𝑒𝑏𝑕𝑗 = 𝑒𝑏𝑕′ = 𝑛𝑣𝑑𝑒 𝑆𝑗 ∩ 𝐻𝑣𝑏𝑠𝑒𝑏 β‰  βˆ…, 𝑆𝑗 βˆ‰ 𝐻𝑣𝑏𝑠𝑒𝑏 , 𝑒𝑏𝑕𝑗 = 𝑛𝑣𝑑𝑒, 𝑒𝑏𝑕′ = 𝑛𝑏𝑧 𝑆𝑗 ∩ 𝐻𝑣𝑏𝑠𝑒𝑏 β‰  βˆ…, 𝑒𝑏𝑕𝑗 = 𝑒𝑏𝑕′ = 𝑛𝑏𝑧

8

slide-9
SLIDE 9
  • Theorem. (Soundness). If Algorithm returns safe or unsafe, then 𝐡 is safe or

unsafe. Definition Given HA 𝐡 = βŒ©π‘Š, 𝑀𝑝𝑑, 𝐡, 𝐸, π‘ˆ βŒͺ, an 𝝑-perturbation of A is a new HA 𝐡′ that is identical except, Ξ˜β€² = πΆπœ—(Θ), βˆ€ β„“ ∈ 𝑀𝑝𝑑, π½π‘œπ‘€β€² = πΆπœ—(π½π‘œπ‘€) (b) a ∈ A, 𝐻𝑣𝑏𝑠𝑒𝑏 = πΆπœ—(𝐻𝑣𝑏𝑠𝑒𝑏). A is robustly safe iff βˆƒπœ— > 0, such that A’ is safe for π‘‰πœ— upto time bound T, and transition bound N. Robustly unsafe iff βˆƒ πœ— < 0 such that 𝐡′ is safe for π‘‰πœ—.

  • Theorem. (Relative Completeness) Algorithm always terminates whenever

the A is either robustly safe or robustly unsafe.

Sound & Relatively Complete.

9

slide-10
SLIDE 10

10

C2E2

slide-11
SLIDE 11

TWO APPLICATIONS

Part II

11

Duggirala ∘ Wang ∘ Mitra ∘ Munoz ∘ Viswanathan (FM 2014) Huang ∘ Fan ∘ Meracre ∘ Mitra ∘ Kiwatkowska (CAV 2014)

slide-12
SLIDE 12

SAPA-ALAS Parallel Landing Protocol

Ownship and Intruder approaching parallel runways with small separation ALAS (at ownship) protocol is supposed to raise an alarm if within T time units the Intruder can violate safe separation based on 3 different projections Verify Alert≼𝑐Unsafe for different runway and aircraft scenarios Scenario 1. With xsep [.11,.12] Nm ysep [.1,.21] Nm, 𝜚 = 30𝑝 πœšπ‘›π‘π‘¦ = 45o vyo= 136 Nmph, vyi = 155 Nmph

12

𝑇𝐢

π‘§π‘‘π‘“π‘ž π‘¦π‘‘π‘“π‘ž

𝑇𝐼 𝑇𝐺

Duggirala, Wang, Mitra, Munoz, Viswanathan FM 2014

slide-13
SLIDE 13

𝑇𝐢

π‘§π‘‘π‘“π‘ž π‘¦π‘‘π‘“π‘ž

𝑇𝐼 𝑇𝐺

π΅π‘šπ‘“π‘ π‘’π‘— = 𝑦 βˆƒ 𝑒 ∈ 0, π‘ˆ , π‘žπ‘ π‘π‘˜π‘— 𝑦, 𝑒 ∈ π‘‰π‘œπ‘‘π‘π‘”π‘“}, where π‘žπ‘ π‘π‘˜π‘— defined as solution of ODE 𝑦 = 𝑕𝑗(𝑦, 𝑒) Use simulations and annotations of 𝑕𝑗 to compute 𝑛𝑣𝑑𝑒 intervals when 𝑦 ∈ π΅π‘šπ‘“π‘ π‘’π‘— π΅π‘šπ‘“π‘ π‘’ ≺𝑐 𝑄2 is satisfied by Reachtube πœ” if βˆ€ 𝐽2 ∈ 𝑁𝑣𝑑𝑒 𝑄2 βˆͺ 𝑁𝑏𝑧 𝑄2 there exists 𝐽1 ∈ 𝑁𝑣𝑑𝑒 π΅π‘šπ‘“π‘ π‘’ such that 𝐽1 < 𝐽2 βˆ’ 𝑐 π΅π‘šπ‘“π‘ π‘’ ≺𝑐 𝑄2 is violated by Reachtube πœ” if βˆƒ 𝐽2 ∈ 𝑁𝑣𝑑𝑒 𝑄2 for all 𝐽1 ∈ 𝑁𝑣𝑑𝑒 π΅π‘šπ‘“π‘ π‘’ βˆͺ 𝑁𝑏𝑧 π΅π‘šπ‘“π‘ π‘’ such that 𝐽1 > 𝐽2 βˆ’ 𝑐

13

Duggirala, Wang, Mitra, Munoz, Viswanathan FM 2013

SAPA-ALAS Parallel Landing Protocol

slide-14
SLIDE 14

Real-time Alerting Protocol .

Scenario Alert β‰Ό4 Unsafe Running time (mins:sec) Alert β‰Ό? Unsafe

6 False 3:27 2.16 7 True 1:13 – 8 True 2:21 – 6.1 False 7:18 1.54 7.1 True 2:34 – 8.1 True 4:55 – 9 False 2:18 1.8 10 False 3:04 2.4 9.1 False 4:30 1.8 10.1 False 6:11 2.4

Sound & robustly completeness C2E2 verifies interesting scenarios in reasonable time; shows that false alarms are possible; found scenarios where alarm may be missed

14

slide-15
SLIDE 15

Exploiting Modularity

15

𝑦1 = 𝑔

𝑏(𝑦1, 𝑦2, 𝑦3)

𝑦2 = 𝑔

𝑐(𝑦2, 𝑦1, 𝑦3)

𝑦3 = 𝑔

𝑑(𝑦3, 𝑦1, 𝑦2)

Γ— 𝑀𝑂

π‘Ÿπ‘ π‘Ÿπ‘ π‘Ÿπ‘‘

?

Module 1 Module 2 Module 3 Module 1 Module 2 Module 3 Module 4 Module 5

slide-16
SLIDE 16

Input-to-State (IS) Discrepancy

  • Definition. IS discrepancy is defined by 𝛾 and 𝛿 such that for

any initial states 𝑦, 𝑦′ and any inputs 𝑣, 𝑣′,

|𝜊(𝑦, 𝑣, 𝑒) βˆ’ 𝜊 𝑦′, 𝑣′, 𝑒 | ≀ 𝛾(𝑦, 𝑦′, 𝑒) +

𝑒

𝛿 |𝑣 𝑑 βˆ’ 𝑣′ 𝑑 | 𝑒𝑑 𝛾 β†’ 0 as 𝑦 β†’ 𝑦′, and 𝛿 β†’ 0 as 𝑣 β†’ 𝑣′

16

𝑦 = 𝑔(𝑦, 𝑣)

𝑣

time 𝑦

𝜊(𝑦, 𝑣, 𝑒)

𝑦′

𝜊(𝑦′, 𝑣′, 𝑒)

𝑒 time

𝑣(𝑒) 𝑣′(𝑒)

slide-17
SLIDE 17

Reduced System 𝑁(πœ€1, πœ€2, π‘Š

1, π‘Š 2).

𝑦 = 𝑔

𝑁 𝑦

𝑦 = βŒ©π‘›1, 𝑛2, π‘‘π‘šπ‘™βŒͺ 𝑛1 𝑛2 π‘‘π‘šπ‘™ = 𝑔

𝑁 𝑦 =

𝛾1 πœ€1, π‘‘π‘šπ‘™ + 𝛿1 𝑛2 𝛾2 πœ€2, π‘‘π‘šπ‘™ + 𝛿2 𝑛1 1

17

slide-18
SLIDE 18

Bloating with Reduced Model

18

The bloated tube contains all trajectories start from the πœ€-ball of 𝑦. The over-approximation can be computed arbitrarily precise.

time

𝜊(𝑒) 𝑦

𝑛2 = 𝛾2 πœ€, 𝑒 +𝛿2(𝑛1, 𝑛3) 𝑛1 = 𝛾1 πœ€, 𝑒 +𝛿1(𝑛2, 𝑛3) 𝑛3 = 𝛾3 πœ€, 𝑒 +𝛿3(𝑛1, 𝑛2)

time

𝑛(𝑒) πœ€

𝑛(𝑒)

𝑦1 = 𝑔

1(𝑦1, 𝑣1)

𝑦2 = 𝑔

2(𝑦2, 𝑣2)

𝑦3 = 𝑔

3(𝑦3, 𝑣3)

slide-19
SLIDE 19

Reduced 𝑁 gives effective Discrepancy of 𝐡.

  • Theorem. For any πœ€ = βŒ©πœ€1, πœ€2βŒͺ, π‘Š = βŒ©π‘Š

1, π‘Š 2βŒͺ and π‘ˆ

π‘†π‘“π‘π‘‘β„Žπ΅ πΆπœ€ 𝑦 , π‘ˆ βŠ† π‘’β‰€π‘ˆ 𝐢𝜈 𝑒

π‘Š

(𝜊 𝑦, 𝑒 )

  • Theorem. For any Ο΅ > 0 there exists Ξ΄ = 〈δ1, Ξ΄2βŒͺ such that

π‘’β‰€π‘ˆ 𝐢𝜈 𝑒

π‘Š

(𝜊 𝑦, 𝑒 ) βŠ† πΆπœ—(π‘†π‘“π‘π‘‘β„Žπ΅(πΆπœ€ 𝑦 , π‘ˆ)

Here 𝜈 𝑒 is the solution of 𝑁(πœ€1, πœ€2, π‘Š

1, π‘Š 2).

19

Huang & Mitra, HSCC 2013

slide-20
SLIDE 20

Pacemaker + Cardiac Network .

Action potential remains in specific range No alternation of action potentials

20

Nodes Thresh Sims Run time (s) Property 3 2 16 104.8 TRUE 3 1.65 16 103.8 TRUE 5 2 3 208 TRUE 5 1.65 5 281.6 TRUE 5 1.5 NA 63.4 FALSE 8 2 3 240.1 TRUE 8 1.65 73 2376.5 TRUE

slide-21
SLIDE 21

Summary and Outlook

  • Tractable reachability of nonlinear hybrid

models

– scales reasonably with time horizon and precision – exponential dependence on initial set (plenty of room to exploit parallelism)

  • Promising for synthesis of switching surfaces
slide-22
SLIDE 22

Challenges

– Theory to support nondeterministic models using decomposition into deterministic part and state-dependent uncertainty:

  • Use cases: advanced controller, adversary, failures

– Compositional inference of annotations of large models from known annotations of smaller blocks

  • Use case: direct support of Simulink models directly

– Abstraction refinement-based algorithm for synthesis

– Connect synthesis engine with a specific complex hardware platform, for example, a quadcopter or a bipedal robotic system

22