Verification of Hybrid Systems Using Linear Hybrid Automata Bruce - PowerPoint PPT Presentation

Verification of Hybrid Systems Using Linear Hybrid Automata Bruce H. Krogh Department of Electrical and Computer Engineering Carnegie Mellon University Carnegie Mellon University Pittsburgh, Pennsylvania – USA krogh@ece.cmu.edu g @ 1

Standard Model: Hybrid Automata * Standard Model: Hybrid Automata locations or modes guard (discrete states) edge j x  INV j e i j : g ij ( x )  0 dx/dt  F j ( x ) i x j  J ij ( x ) x  INV i x  INV i dx/dt  F i ( x ) jump transformation x  X o invariant: hybrid automaton may remain in i as long as x  INV i initial condition di i continuous dynamics i d i * Thomas A. Henzinger. The theory of hybrid automata. In Verification of Digital and Hybrid Systems (M.K. Inan, R.P. Kurshan, eds.), NATO ASI Series F: Computer and Systems Sciences, Vol. 170, Springer, 2000, pp. 265-292. 2

Linear Hybrid Automata Linear Hybrid Automata All All constraints are linear or affine. t i t li ffi j x  INV j e i j : g ij ( x )  0 dx/dt  F j i x j  J ij ( x ) x  INV i x  INV i dx/dt  F i x  X o constant polyhedra constant polyhedra 3

Overview Overview • LHA Reachability • Approximating Richer Dynamics • PHAVer • Iterative Relaxation Abstractions • Iterative Relaxation Abstractions 4

9 Reachability with LHA [Halbwachs, Henzinger, 93-97] Reachability with LHA [Halbwachs, Henzinger, 93 97] 1. find bounds on derivative d i i 2. time elapse by invariant projection 3. compute successors of transitions successors initial states derivatives in invariant projection cone cone 5

Overview Overview • LHA Reachability • Approximating Richer Dynamics * • PHAVer • Iterative Relaxation Abstractions • Iterative Relaxation Abstractions * Thomas A. Henzinger, Pei-Hsin Ho, and Howard Wong-Toi. Algorithmic analysis of nonlinear hybrid systems. IEEE Transactions on Automatic Control 43:540-554, 1998. 6

Linear Phase-Portrait Approximation Linear Phase-Portrait Approximation Goal: Approximate a hybrid automaton H with an LHA, A. xdot d t e.g., single location, scalar x maxP dx/dt  F k (x) approximating valid trajectory for H “polydedron” P k x o valid trajectory for A minP minP x location invariant location invariant maxX minX 7

Linear Phase-Portrait Approximation: Time-Domain Implications range of slopes range of slopes x(t) slope maxP allowed by F k (x(t 1 )) maxX x(t 1 ) slope minP x o minX t 1 t e in H t e in A 8

Improving Linear Phase-Portrait Approximations: Mode Splitting xdot d t maxP 2 F k (x) maxP 1 P k2 valid trajectory for H P k1 P minP 2 x o minP 1 minP 1 x m m k1 m m k2 maxX 2 minX 1 X’ 9

Linear Phase-Portrait Approximation: Improved Time-Domain Approximation x(t) maxX X’ X x o minX t e in H t t e in A 10

Linear Phase-Portrait Approximation: Higher Dimensions P k In general find P k by In general find P k by k n 2 F k (X k ) solving the following xdot 2 optimization problem in a set of face- normal directions: n 1 T xdot max n i n 3 3 x, xdot d t n 4 s.t. xdot  F k (x) x  X k k xdot 1 Problem: How to choose the n i . i 11

Linear Phase-Portrait Approximations Linear Phase Portrait Approximations • guaranteed conservative approximations • refinement introduces more discrete states • for bounded hybrid automata, arbitrarily close approximation can be attained using mode splitting approximation can be attained using mode splitting • sufficient to use rectangular phase-portrait T = [0…1…0]) approximations (n i 12

Overview Overview • LHA Reachability • Approximating Richer Dynamics • PHAVer • Iterative Relaxation Abstractions • Iterative Relaxation Abstractions 13

Th The following slides are f ll i lid excerpts from the following presentation: PHAVer: Reachability Analysis for Linear Hybrid Systems and Beyond Goran Frehse Verimag – UJF/CNRS/INPG, Grenoble PHAVer available at http://www verimag imag fr/~frehse/phaver web/index html http://www-verimag.imag.fr/~frehse/phaver_web/index.html 14

Yet Another Verification Tool? • Existing not powerful enough – in practice only 3 - 4 dimensions • Non-conservative floating-point not reachable tools give wrong results g g according to HDV according to HDV – exception: HSOLVER • Why not use HyTech? thanks to Zhi Han, CMU – numerical problems, no easy fix – numerical problems no easy fix Floating Point: Floating-Point: (exact arithm. & 32 bit  overflow) CheckMate (CMU ‘98) HYSDEL (ETH Zurich ‘99) – complexity explosion d/dt (Verimag ‘00) – limited class of automata (LHA) – limited class of automata (LHA) Predicate Abstraction (UPenn ‘02) HDV (UPenn ‘04) HSOLVER (MPI ’05) Exact Arithmetic: HyTech (Berkeley ‘95) 15

Polyhedral Hybrid Automaton Verifyer Polyhedral Hybrid Automaton Verifyer • Reachability Analysis Hybrid Automata     Model Model M M x A Ax b b – exact arithmetic M, A, b as intervals – guaranteed overapproximation – complexity management On-the-fly over- approximation • limiting bits & constraints • State-of-the-Art Libraries: Linear Hybrid Automata Analysis – Parma Polyhedra Library y y Engine E i – Gnu MultiPrecision (GMP) • Compositional Reasoning Overapprox. with – computing simulation relations computing simulation relations limited complexity limited complexity Reachable States Output as Polyhedra y 16

17 Over-Approximation of Affine Dynamics affine dynamics y invariant LHA dynamics pp to LHA: From •

Over-Approximation of Affine Dynamics pp y • From to LHA: • Solutions: a) project invariant  flow to b) each constraint separately (rectangular, octagonal, etc.)  projection constraint-based -based 18

12 Limiting the Number of Bits g 1. truncate bits of 2. push plane to 3. snap to next coefficients coefficients outside (solve LP) outside (solve LP) integer integer 7 bit y y y 1 1 1 109 x 121 y 100 600 600 6 x 6 y 6 6 x 6 y 6 6 x 6 y 6 x 6 y 6 x 6 y 6 x 6 y ? ? 109 109 3 bit 3 bit 0 0 1 1 x x 0 0 1 1 x x 0 0 1 1 x x Max. # of Bits • Good: 10000 –large problems infeasible without large problems infeasible without unlimited li it d Max. Bits –with limit of constraints  termination 1000 limited • Bad: –unbounded error unbounded error 100 0 25 50 75 100 125 Iteration 19

Limiting the Number of Constraints g F • Reduce from m to z constraints 45° 15° E A 135° • • Significance Measure f ( m d ) Significance Measure f ( m,d ) – Volume: exp 45° B – Slack: LP D m 2 d – max. angle: g 30° 30 90 90° C C T a j  - min i  j a i • Heuristics to choose constraints 150° 2 F 45° A – deconstruction: 4 drop (m-z) least significant 45° – reconstruction: 5 D 3 B add z most significant • • Experiments: angle & reconstr Experiments: angle & reconstr. 30 30° 1 1 C C – 1000  50 in 4 dim: < 2 sec. From 6 to 5 constraints (1000x faster than slack) 20

Reachability of Tunnel Diode Oscillator Reachability of Tunnel Diode Oscillator I L [mA] • Efficiency through – Adaptation of partitions to dynamics – Overapproximation: • complex polyhedra  conservative, simplified polyhedra • Good performance G d f – Reachability with high V C [V] accuracy in 72s, 127MB • Tunnel Diode Oscillator well behaved… Partition depending vector field on dynamics y 21

Reachability of Voltage Controlled Oscillator Reachability of Voltage Controlled Oscillator • 3-dim. system with nonlinearity • Goal: Show invariance of Show invariance of cycle • No success after 20min, 1GB RAM 20 i 1GB RAM  64x accuracy needed  20h, 64GB? 64GB?  We need advanced methods 22

Forward/Backward-Refinement - Concept Forward/Backward-Refinement - Concept • Task: Final states – Show that bad states are not reachable from initial states • Observation: Reachable – Small partitions in states regions not leading to bad states • Solution: – Alternate Alternate forward/backward Partitions Initial states reachability – Smaller partitions at each p step 23

Forward/Backward-Refinement - Example Forward/Backward-Refinement - Example Step 3 Step 1 Step 2 a) Restrict final a) Restrict final a) Forward ) F d a) Restrict final ) R t i t fi l states and reachability with states and invariants to R 2 coarse partition invariants to b) Backward b) Backward R 1 R R 1 R reachability b) Backward with finer reachability partition R 3 3 with finer with finer partition R 2 final states not reachable 24

Forward/Backward-Refinement of VCO Forward/Backward-Refinement of VCO V D2 15 initial states • F/B-Refinement steps – states outside initial 1 last iteration states vanishes = final (forbidden) – not reachable  overapprox. harmless any cycle passes through V D1 initial states i iti l t t • Success C D – after 11.5h, 1.7GB RAM • Parallelizable: B A – 5.7h, 1.2GB RAM , each on two CPUs hybrid automaton 25