A New Verification Algorithm for Planar Differential Inclusions

1. A New Verification Algorithm forPlanar Differential Inclusions Gordon Pace University of Malta December 2003

2. Scientific Models • Discrete systems • CSs’ favourite domain • What I should be talking about here … • Continuous systems • Engineers’ domain • Differential equations • Hybrid Systems

3. A Hybrid System • Typical example: A heated room with a a thermostat. • Room temperature T continuous variable, • State of heater (on or off) is a discrete variable, • Different (continuous/differential) equations regulate room temperature depending whether heater is on or off.

4. The Heated Room: Required Parameters • Dynamics in different (discrete) states; • When to switch from one state to another; • Whether any continuous variables are reset discontinuously when switching from one state to another.

5. The Heated Room:Typical questions • Reachability questions: Can the room temperature rise over 5% above the thermostat setting? • ‘Qualitative’ system behaviour: Given a loop (a sequence of discrete states) what continuous behaviour is possible within that loop?

6. Hybrid Automata On Off

7. Hybrid Automata Label Dynamics On Off Invariant Guard Reset

8. Verification of Hybrid Automata • Undecidable in general. • Even (good) testing is difficult! • Most complete approaches look at sub-problems eg limiting differential equations, limiting number of continuous variables.

9. Swimmer in a whirlpool

10. Swimmer in a whirlpool

11. Swimmer in a whirlpool

12. Swimmer in a whirlpool

13. Swimmer in a whirlpool

14. Swimmer in a whirlpool

15. Swimmer in a whirlpool

16. Swimmer in a whirlpool

17. Swimmer in a whirlpool

18. Swimmer in a whirlpool

19. Swimmer in a whirlpool

20. Polygonal Differential Inclusion Systems (SPDIs) • A partition of the plane into convex polygons • Constant differential inclusion for each region describing allowable dynamics

21. Swimmer SPDI

22. Swimmer SPDI Polygons: Discrete states Arrows: System dynamics (Transformed) coordinates: two continuous states

23. Swimmer SPDI Polygons: Discrete states Arrows: System dynamics Position on line: one continuous state

24. Swimmer SPDI

25. Swimmer SPDI

26. Some undecidable extensions • Three or more dimensions • Variant differential inclusions • SPDIs with arbitrary resets

27. Some observations (1) • Position on edges can be described as a single real number. • Starting from a position s on an edge and ending at t on another edge, the linear inclusion limits guarantees: t 2[1 s + 2, 1 s + 2] • Similarly if we went through a number of edges in between.

28. Result: • Given a loop of region edges, we can compute the reachable polygon without iterating. • We can compute the effect of following an abstract trace: e1…ei(ei+1…ej)*ej+1…ek(ek+1…el)* … en

29. Some observations (2) • For any self-crossing path through an SPDI, there exists a non-self-crossing one with the same start and end points. • A path which follows a loop (a number of times), leaves it and goes through the loop again, can be replaced by one which enters the loop only once.

30. Result: • Any path through an abstract trace which is ‘too long’ also belongs to a shorter abstract path: e1…ei(ei+1…ej)*ej+1…ek(ek+1…el)* … en • Only a finite number of paths need be explored to check reachability.

31. Summary • We can (non-iteratively) calculate the effect of following an abstract path. • A finite number of abstract paths cover all possible concrete paths from one edge to another. • These abstract paths can be calculated.

32. Summary • We can (non-iteratively) calculate the effect of following an abstract path. • A finite number of abstract paths cover all possible concrete paths from one edge to another. • These abstract paths can be calculated. We have an algorithm to decide SPDI reachability

33. Summary • We can (non-iteratively) calculate the effect of following an abstract path. • A finite number of abstract paths cover all possible concrete paths from one edge to another. • These abstract paths can be calculated. But it does not guarantee shortest counter-example unless exhaustive search is performed

34. Forward model checking R0 = Initial Rn+1 = Rn[next(Rn) Termination Condition: Rn = Rn+1

35. SPDI model checking R0 = Initial Rn+1 = Rn[next(Rn) [ loop(Rn) Termination Condition: Rn[ Inv= Rn+1 [ Inv

36. SPDI model checking This follows loops (non-iteratively) in one step R0 = Initial Rn+1 = Rn[next(Rn) [ loop(Rn) Termination Condition: Rn[ Inv= Rn+1 [ Inv

37. SPDI model checking R0 = Initial Rn+1 = Rn[next(Rn) [ loop(Rn) Termination Condition: Rn[ Inv= Rn+1 [ Inv This is the invariance kernel of the SPDI

38. Invariance kernel of a loop • The greatest set of points such that every trajectory starting in such points must remain in the set forever. • Can be calculated using a non-iterative algorithm. • The set Inv is the union of all invariance kernels.

39. Invariance kernel of a loop • The greatest set of points such that every trajectory starting in such points must remain in the set forever. • Can be calculated using a non-iterative algorithm. • The set Inv is the union of all invariance kernels. BFS algorithm which guarantees shortest abstract counter-example

40. Invariance kernel of a loop • The greatest set of points such that every trajectory starting in such points must remain in the set forever. • Can be calculated using a non-iterative algorithm. • The set Inv is the union of all invariance kernels. Allows us to apply standard model-checking verification optimisations to SPDI verification

41. Future work • Implementation of the new algorithm and standard optimisations • Case studies and safe approximation generators • How can this be applied to discrete systems with one continuous variable and differential inclusion transitions?

42. x 2[min{c1, 1 x + 2}, max{c1,1 s + 2}]