Modeling and Reachability Analysis of Hybrid Systems

1. Modeling and Reachability Analysis of Hybrid Systems Rajeev Alur Systems Design Research Lab University of Pennsylvania www.cis.upenn.edu/~alur/ MFPS, March 2002

2. Programming Interacting Autonomous Robots Low level Analysis of vision data Control laws for legs Wireless cards • Current programming • How to implement Go-to-ball • Real-time scheduling High level Modes: Attack, Defend How to switch? Strategies Communication to collaborate

3. Trends in Model-Based Design • Emerging notations: UML-RT,Stateflow • Visual, Hierarchical, Object oriented • Simulation, code generation • Formal models and Model checking tools • Programming languages (Esterel, FRP…) • Control engineer’s tools (Matlab…) • Design/Simulation environments • SHIFT, Ptolemy-II, Modelica ….

4. Guiding Themes for CHARON • Integrated modeling of control program and physical environment (hybrid) • Programming language technology in Control tools • Continuous modeling in Programming environments • Foundations for hybrid systems in presence of concurrency, hierarchy, exceptions … • Compositionality, refinement, …. • Models need to be analyzable • Model checking • Exploit modeling constructs for efficiency

5. Faculty Rajeev Alur (CIS) Vijay Kumar (MEAM) Insup Lee (CIS) George Pappas (EE) CHARON Team PhD Students Joel Esposito Yerang Hur Franjo Ivancic P K Mishra Usa Sammapun Research Associates Thao Dang Salvatore La Torre Oleg Sokolsky Collaborators Rafael Fierro (U Oklahoma) Radu Grosu (SUNY StonyBrook) Funding: DARPA Mobies, NSF ITR

6. Talk Outline • Motivation • CHARON Summary • Model Checking • Conclusions

7. State machines + Dynamical systems x>68 off on dx=-k’x x>60 dx=kx x<70 x<63 Hybrid Modeling

8. CHARON Language Features • Individual components described as agents • Composition, instantiation, and hiding • Individual behaviors described as modes • Encapsulation, instantiation, and Scoping • Support for concurrency • Shared variables as well as message passing • Support for discrete and continuous behavior • Differential as well as algebraic constraints • Discrete transitions can call Java routines

9. Example: Vehicle Model Agent Vehicle Agent InterVehicleCommunication_IN Agent InterVehicleCommunication_OUT Agent CarSensor Agent RegulationLayer Agent VehiclePlant

10. Agent VehiclePlant Agent VehiclePlant Agent DynamicController Agent DynamicSensor Agent Communication_IN Agent Communication_OUT mode Brake Controller mode Torque Controller xDot_lls xDDot_lls xDot u_isl p_man_lls p_wheel_lls w_wheel_lls xDDot throttle_lls gearRatio_lls we_lls Agent VehicleDynamics Agent PowerTrain Agent Brake Agent SI_Engine Agent GearShift steering p_mcc Agent Rigid Body throttle_des Agent Torque Converter Agent WheelSet Agent Moments

11. Agent RegulationLayer Agent RegulationLayer mode VehicleFollower mode VehicleLeader mode Collision_W_ON mode No_Warning mode Collision_W_Off mode Cruise mode Accelerate mode Cruise_Cntrl mode Join_ACC mode ACC mode Join_CACC mode CACC mode Decelerate mode Braking mode FCW mode CFCW mode Warning

12. CHARON Toolkit

13. What is Compositionality ? Which properties are preserved? Can we restrict reasoning to modified parts of design? Mode should have a precise interface spec that would permit composition of behaviors Charon supports formal trace-based semantics and compositional proof calculus for refinement

14. Talk Outline • Motivation • CHARON Summary • Model Checking • Overview • Linear Hybrid Automata • Polyhedral Approximations for Linear Systems • Predicate Abstraction • Conclusions

15. Quest for Better Debugging • Bugs are expensive! • Pentium floating point bug, Arian-V disaster • Testing is expensive! • More time than design and implementation • Safety critical applications • Certification mandated

16. Model Checker model yes temporal property error-trace Advantages Automated formal verification, Effective debugging tool Moderate industrial success In-house groups: Intel, Microsoft, Lucent, Motorola… Commercial model checkers: FormalCheck by Cadence Obstacles Scalability is still a problem (about 100 state vars) Effective use requires great expertise

17. Cache consistency: Gigamax Real design of a distributed multiprocessor Global bus UIC UIC UIC Cluster bus P M P M Read-shared/read-owned/write-invalid/write-shared/… Deadlock found using SMV Similar successes: IEEE Futurebus+ standard, network RFCs

18. Symbolic Model Checking Model variables: X = {x1, x2, … xn} Given initial set I, is target set T reachable? Data type: region to represent state-sets R:=I(X) Repeat If R intersects T report “yes” Else if R contains Post(R) report “no” Else R := R union Post(R) Post(R)= Set of states that can be reached from R in one “step” (discrete switch or continuous flow)

19. Symbolic Representations • Necessary operations on Regions • Union, Intersection, Negation • Projection, Renaming • Equality/containment test, Emptiness test • Different choices for different classes • BDDs for discrete boolean systems in hardware verification • Difference Bound Matrices (DBMs) for verification of timed automata

20. Model Checking for Hybrid Systems • Same algorithm works in principle • What’s a suitable representation of regions? • Region: subset of Rk • Main problem: handling continuous dynamics • Precise solutions available for restricted continuous dynamics • Timed automata • Linear hybrid automata • Even for linear systems, over-approximations of reachable set needed

21. Reach(X) X Reachability Analysis for Dynamical Systems • Goal: Given an initial region, compute whether a bad state can be reached • Key step is to compute Reach(X) for a given set X under dx/dt = f(x)

22. Linear Hybrid Automata • Invariants and guards: linear (Ax <= b) • Actions: linear transforms (x:= Ax) • Dynamics: time-invarint, state-independent specified by a convex polytope constraining rates E.g. 2 < x <= 3, x = y • Tools: HyTech • Symbolic representation: Polyhedra • Methodology: abstract dynamics by differential inclusions bounding rates

23. Example LHAGate for a railroad controller h = 90 Open h = 90 dh = 0 lower lowering h >= 0 -10<dh < 9 lower h = 90 h = 0 raise closed h = 0 dh = 0 raising h <= 90 8< dh <10 raise

24. Reachability Computation Basic element: (location l, polyhedron p) Set of visited states: a list of (l,p) pairs Key steps: • Compute “discrete” successors of (l,p) • Compute “continuous” successor of (l,p) • Check if p intersects with “bad” region • Check if newly found p is covered by already visited polyhedra p1,…, pk (expensive!)

25. Computing Discrete Successors g(x)-> x := a(x) Discrete successor of (l,p) • Intersect p with g (result r is a polyhedron) • Apply linear transformation a to r (result r’ is a polyhedron) • Successor is (l’,r’) l l’

26. y x Computing Time Successor y (1,4) (1,4) Reach(p) (3,2) p (3,2) x Rate Polytope • Thm: If initial set p, invariant I, and rate constraint r, are polyhedra, then set of reachable states is a polyhedron (and computable) • Basically, apply extremal rates to vertices of p

27. Summary: Linear Hybrid Automata • HyTech implements this strategy • Core computation: manipulation of polyhedra • Bottlenecks • proliferation of polyhedra (unions) • computing with higher dimensional polyhedra • Many case studies (active structure control, Philips audio control protocol, steam boiler…)

28. Beyond LHA • Exact computation with polyhedra is limiting. • If dynamics is dX=AX, and P is a polyhedron, Reach(P) is not a polyehdron • Solutions: • Approximate Reach(P) with an enclosing convex polyhedron: Checkmate (Krogh) • Approximate Reach(P) with an enclosing (non-convex) orthogonal polyhedron: d/dt (Dang/Maler) • Level sets method (Greenstreet, Tomlin) • Use ellipsoids for representation of sets (Kurzhanski)

29. t6 t5 t7 t4 t3 t8 t2 t9 t1 • divide R[0,T](X0) into [tk,tk+1] segments • enclose each segment with a convex polytope Polyhedral Flow Pipe Approximations X0 • RM[0,T](X0) = union of polytopes

30. Wrapping Hyperplanes Around a Set c2 Step 1: Choose normal vectors, c1,...,cm c1 S c3 c4

31. Wrapping Hyperplanes Around a Set Step 2: Compute optimal d in Cx  d, CT = [c1... cm]: c2 c1 di = max ciTx xS S c3 c4

32. Wrapping a Flow Pipe Segment Given normal vectors ci, we wrap R[tk,tk+1](X0) in a polytope by solving for each i di = max ciTx(t,x0) xo,t s.t. x0X0 t [tk,tk+1] Optimization problem is solved by embedding simulation into objective function computation

33. Improvements for Linear Systems • x = Ax x(t, x0) = eAtx0 • No longer need to embed simulation into optimization • Flow pipe segment computation depends only on time step t • A segment can be obtained by applying eAt to another segment of the same t

34. Example 1: Van der Pol Equation Van der Pol Equation Initial Set Uniform time step Dtk = 0.5

35. Example 2: Linear System Vertices for X0 Uniform time step Dtk = 0.1

36. Predicate Abstraction bx: x>0; by : y>0 Program Abstraction int x, y; if x>0 { ………… y:=x+1 ……….} else { ………… y:=x+1 ……….} bool bx, by; if bx { ………… by:=true ……….} else { ………… by:={true,false} ……….} Successful applications: Lucent: Pathstar switch NASA: Space shuttle control

37. x t Concrete Space: L x Rn Abstract Space: L x {0,1} k Predicate Abstraction • Input is a hybrid automaton and a set of k boolean predicates, e.g. x+y > 5-z. • The partitioning of the concrete state space is specified by the user-defined k predicates.

38. Overview of the Approach Hybrid system Boolean predicates additional predicates Search in abstract space Safety property No! Counter-example Property holds Analyze counter-example Real counter- example found

39. Why use this approach? • Reach(X) needs to be computed only for abstract states X and not intermediate regions of unpredictable shapes/complexity • No need to compute Reach (X). Goal is to find one new abstract state reachable from X, partial results are of great use • Simulate vertices • Consider time-slices at discrete times • Our focus is on search strategies to make progress in the abstract state-space • Initial implementation in C++ with promising results

40. What do we analyze? • Input hybrid automaton • Guards/updates/invariants are linear expressions • Dynamics: dx = A x + B u • u : uncertain input within a bounded range • Initial condition and bad region (both linear) • User provides set of linear predicates for abstraction • Builds on routines for manipulating polyhedra from d/dt

41. Search Algorithm • Starting with initial abstract states, depth-first search to discover bad state • On-the-fly search: abstract states analyzed for outgoing transitions only on demand • Given an abstract state s, first examine outgoing edges and check if they lead to new abstract states • When discrete transitions do not yield new states, compute continuous successors • For abstract state s, compute polyhedral slices at times r, 2r, 3r • Compute bounding polyhedra for reach sets from kr to (k+1)r • For every intermediate result, check intersection with new abstract states

42. Vehicle Controller PLATOON (i) DISTANCE VELOCITY CONTROLLER PLATOON (i-1) vel vel acc • The agent platoon-(i-1) generates a trace for its velocity using its acceleration which is treated as uncertain input to the system: • The agent controller of platoon-(i) tries to maintain the distance to the previous platoon-(i-1) to some safety distance which depends on its own acceleration and velocity. dist

43. Charon Modeling and Simulation • Variables: • distance • velLeader • velFollower • acceleration • (uncertain input)

44. Verification Results • The Predicate Abstraction tool found that the MoBIES Automotive OEP Vehicle-To-Vehicle longitudinal controller satisfies collision-free behavior, if the following initial region is assumed: • 20 ≤ distance ≤ 1000 • 15 ≤ velLead ≤ 18 • 20 ≤ velFollow ≤ 25 • The tool used 17 predicates, and found 16 reachable abstract states. • The computation took approximately 4 minutes on a Pentium II with negligible memory resource needs.

45. Talk Outline • Motivation • CHARON Summary • Model Checking • Conclusions

46. Refining the Verifier • How to efficiently check whether the abstract counter example is a real one? • Automatic discovery of new predicates • Finding a separating hyperplane for two sets of polyhedra • Greedy heuristic picks a subset of faces • Improved search strategy to guide the search • Techniques for eliminating abstract states early from consideration while computing continuous successors

47. Ongoing Activities • Research • Distributed simulation • Qualitative abstractions of hybrid systems • Model-based test generation • Accurate event detection for simulation • Exploiting hierarchy for efficient simulation • Applications/Case-studies • Multiple autonomous robots • MoBIES challenge problems • Animation • Biomolecular networks…

48. Wrap-Up • Modeling and Analysis in symbiosis • Common themes in many modeling proposals • Hierarchy • Concurrency and Communication • Component interfaces • Formal semantics and compositionality • Integration: Discrete + Continuous + Stochastic • Automating formal verification is hard, but there is a steady progress • Biological systems: emerging application for modeling with similarities to embedded software