1 Verification and Synthesis of Hybrid Systems Thao Dang October 10, 2000

2 Plan 1- Algorithmic Verification of Hybrid Systems 2- Reachability Analysis of Continuous Systems 3- Safety Verification of Hybrid Systems 4- Safety Controller Synthesis for Hybrid Systems 5- Implementation

3 Plan 1- Algorithmic Verification of Hybrid Systems 2- Reachability Analysis of Continuous Systems 3- Safety Verification of Hybrid Systems 4- Safety Controller Synthesis for Hybrid Systems 5- Implementation

4 Hybrid systems Hybrid systems: systems which combine continuous-time dynamics and discrete-event dynamics Continuous processesDigital controllers, switches, gears.. (e.g., chemical reactions) Arisen virtually everywhere (due to the increasing use of computers)

5 Analysis of Hybrid Systems Formal verification: prove that the system satisfies a given property Controller synthesis: design controllers so that the controlled system satisfies a desired property We concentrate on invariance properties: all trajectories of the system stay in a subset of the state space Hybrid systems are difficult to analyze No existing general method

6 Illustrative Example: A Thermostat onoff Verification problem: prove that the temperature x  [a,b] Characterize all behaviors  Reachability Analysis

7 The Thermostat Example (cont’d) Two-phase behavior Non-deterministic behavior Set of initial states x t  max  min  00 0 How to characterize and represent “tubes” of trajectories of continuous dynamics in order to treat discrete transitions??

8 Algorithmic Analysis of Hybrid Systems Exact symbolic methods applicable for restricted classes of hybrid systems Our objective: verification method for general hybrid systems in any dimension

9 Algorithmic Verification of Hybrid Systems   approximate reachability techniques  represent reachable sets by orthogonal polyhedra What do we need?? a reachability technique which  is applicable for arbitrary continuous systems  can be extended to hybrid systems

10 Approximations by Orthogonal Polyhedra Non-convex orthogonal polyhedra (unions of hyperrectangles) Motivations  canonical representation, efficient manipulation in any dimension  easy extension to hybrid systems  termination can be guaranteed Over-approximation Under-approximation

11 Plan 1- Approach to Algorithmic Verification of Hybrid Systems 2- Reachability Analysis of Continuous Systems  Abstract Reachability Algorithm  Algorithm for Linear Continuous Systems  Algorithm for Non-Linear Continuous Systems 3- Safety Verification of Hybrid Systems 4- Safety Controller Synthesis for Hybrid Systems 5- Implementation

12 Plan 1- Approach to Algorithmic Verification of Hybrid Systems 2- Reachability Analysis of Continuous Systems  Abstract Reachability Algorithm  Algorithm for Linear Continuous Systems  Algorithm for Non-Linear Continuous Systems 3- Safety Verification of Hybrid Systems 4- Safety Controller Synthesis for Hybrid Systems 5- Implementation

13 Reachability Analysis of Continuous Systems Problem Find an orthogonal polyhedron over-approximating the reachable set from F x(0)  F, set of initial states

14 [0,r](F)[0,r](F) Successor Operator r(F)r(F) F Reachable set from F:  (F) =  [0,  ) (F)

15 Abstract Algorithm for Calculating  (F) P 0 := F ; repeat k = 0, 1, 2.. P k+1 := P k   [0,r] (P k ) ; until P k+1 = P k Use orthogonal polyhedra to represent P k approximate  [0,r] r : time step

16 Plan 1- Algorithmic Verification of Hybrid Systems 2- Reachability Analysis of Continuous Systems  Abstract Reachability Algorithm  Algorithm for Linear Continuous Systems  Algorithm for Non-Linear Continuous Systems 3- Safety Verification of Hybrid Systems 4- Safety Controller Synthesis for Hybrid Systems 5- Implementation

17 Reachability of Linear Continuous Systems F is a convex polyhedron: F = conv{v 1,..,v m }  r (F) = e Ar F F vivi  r (v i )=e Ar v i F is the set of initial states  r (F) = conv{  r (v 1 ),..,  r (v m )}

18 Over-Approximating the Reachable Set  [0,2r] (F)  P 2 = G 1  G 2 X2X2 P2P2  [0,r] (F)  G 1 P 1 =G 1  [r,2r] (F)  G 2 X1X1 X2X2 G2G2 X0=FX0=F r(v2)r(v2) X 1 =  r (X 0 ) v1v1 v2v2 r(v1)r(v1) X1X1 X1X1 X0X0 C 1 =conv{X 1,X 0 } C1C1 Cb 1  Extension to under-approximations

19 Example

20 Extension to Linear Systems with Uncertain Input  Computation of  r (F) [Varaiya 98] i (r) i F yi*(r)yi*(r) yiyi r(F)r(F)  Bloating amount u1u1 u2u2 (Maximum Principle)

21 Example [Kurzhanski and Valyi 97] Advantage: time-efficiency

22 Plan 1- Algorithmic Verification of Hybrid Systems 2- Reachability Analysis of Continuous Systems  Abstract Reachability Algorithm  Algorithm for Linear Continuous Systems  Algorithm for Non-Linear Continuous Systems 3- Safety Verification of Hybrid Systems 4- Safety Controller Synthesis for Hybrid Systems 5- Implementation

23 Principle of the Reachability Technique y F x  ‘Face lifting’ technique, inspired by [Greenstreet 96] x(0)  F, set of initial states  Continuity of trajectories  compute from the boundary of F  The initial set F is a convex polyhedron The boundary of F: union of its faces

24 N(e) H(e) Over-Approximating  [0,r] (F) Step 1: rough approximation N(F) F e f e : projection of f on the outward normal to face e : maximum of f e over the neighborhood N(e) of e H’(e) r e1e1 N(F) Step 2: more accurate approximation

25 Computation Procedure Decompose F into non-overlapping hyper-rectangles Apply the lifting operation to each hyper-rectangle (faces on the boundary of F) Make the union of the new hyper-rectangles F

26 Example: Airplane Safety [Lygeros et al. 98] P = [V min,V max ]  [  min,  max ]

27 Plan 1- Algorithmic Verification of Hybrid Systems 2- Reachability Analysis of Continuous Systems  Abstract Reachability Algorithm  Algorithm for Linear Continuous Systems  Algorithm for Non-Linear Continuous Systems 3- Safety Verification of Hybrid Systems 4- Safety Controller Synthesis for Hybrid Systems 5- Implementation

28 Hybrid Systems Hybrid automata continuous dynamics: linear with uncertain input, non-linear staying and switching conditions: convex polyhedra reset functions : affine of the form R qq’ (x) = D qq’ x + J qq’ q0q0 q1q1 switching condition reset function discrete state staying condition continuous dynamics

29 Reachability of Hybrid Automata The state (q, x) of the system can change in two ways: continuous evolution: q remains constant, and x changes continuously according to the diff. eq. at q discrete evolution (by making a transition): q changes, and x changes according to the reset function. Reachability analysis continuous-successors discrete-successors  approximations by orthogonal polyhedra

30 Over-approximating Continuous-Successors Use the reachability algorithms for continuous systems Take into account the staying conditions HqHq F  [0,r] (F)  P

31 F g  F  G qq’ Over-approximating Discrete-Successors R qq’ (b) H q’ F  qq’ (q, F) = (q’, R qq’ (F  G qq’ )  H q’ ) b G qq’ FgFg

32 q0q0 q1q1 q0q0 Example q0q0 q1q1

33 Plan 1- Algorithmic Verification of Hybrid Systems 2- Reachability Analysis of Continuous Systems  Abstract Reachability Algorithm  Algorithm for Linear Continuous Systems  Algorithm for Non-Linear Continuous Systems 3- Safety Verification of Hybrid Systems 4- Safety Controller Synthesis for Hybrid Systems 5- Implementation

34 Switching Controller Synthesis: Introduction q1q1 q2q2 q3q3 f1f1 f2f2 f3f3 qx Mode selection Plant Discrete Switching Controller q3q3 q1q1 q2q2

35 The Safety Synthesis Problem Given a hybrid automaton A and a set F  How to restrict the guards and the staying conditions of A so that all trajectories of the resulting automaton A * stay in F Solution: Compute the maximal invariant set (set of ‘winning’ states)

36 Operator  Given F={(q, F q ) | q  Q},  (F) consists of states from which all trajectories stay indefinitely in F without switching OR stay in F for some time and then make a transition to another discrete state and still in F G qq’  F q’ FqFq x1x1 x2x2 x3x3

37 Calculation of the Maximal Invariant Set P 0 := F ; repeat k = 1, 2,.. P k+1 := P k   (P k ) ; until P k+1 = P k P * = P k ; P * : maximal invariant set A * : H * =H  P *, G * =G  P *

38 Effective Approximate Synthesis Algorithm Use our reachability techniques for hybrid automata to approximate  (F) Under-approximations  Effective approximate synthesis algorithm for hybrid systems with linear continuous dynamics To approximate the maximal invariant set:

39 F0F0 F1F1 G 10 G 01 G 10  F 0 F1F1 F0F0 G 01  F 1 G 01 =[-0.2,-0.01]  [-0.2,-0.01] G 10 =[0.01,0.32]  [-0.01,0.1]

40 Plan 1- Approach to Algorithmic Verification of Hybrid Systems 2- Reachability Analysis of Continuous Systems  Abstract Reachability Algorithm  Algorithm for Linear Continuous Systems  Algorithm for Non-Linear Continuous Systems 3- Safety Verification of Hybrid Systems 4- Safety Controller Synthesis for Hybrid Systems 5- Implementation

41 The tool d/dt Three types of automatic analysis for hybrid systems with linear differential inclusions  Reachability Analysis: compute an over-approximation of the reachable set from a given initial set  Safety Verification: check whether the system reaches a set of bad states  Safety Controller Synthesis: synthesize a switching controller so that the controlled system always remains inside a given set

42 Implementation OpenGL LEDA Interface Verification Algorithms Controller Synthesis Algorithms Numerical Integration CVODE Geometric Algorithms Qhull, Polka, Cubes Orthogonal Approximations d/dt

43 The tool d/dt

44 Conclusions Generality of Systems  Complexity of continuous and discrete dynamics  High dimensional systems Variety of Problems  Safety Verification and Synthesis Applications  collision avoidance ( 4 continuous variables, 1 discrete state )  double pendulum ( 3 continuous variables, 7 discrete states )  freezing system ( 6 continuous variables, 9 discrete states )

45 Perspectives More efficient analysis techniques - Combining with analytic/qualitative methods - Adapting existing techniques for discrete/timed systems More classes of problems - more properties to verify, more synthesis criteria - controller synthesis for more general systems, e.g linear diff. games Tool - more interactive analysis, simulation features - experimentation: real-life problems

46 Related Work Reachability Analysis Polygonal Projections [Greenstreet and Mitchell 99] Ellipsoidal Techniques [Kurzhanski and Varaiya 00] Approximations via Parallelotopes [Kostoukova 99] Verification CheckMate [Chutinan and Krogh 99] HyperTech [Henzinger et al. 00] VeriShift [Botchkarev and Tripakis 00] Symbolic Method [Lafferriere, Pappas, and Yovine 99] Synthesis Synthesis for timed automata [Asarin, Maler, Pnueli, and Sifakis 98] Hamilton Jacobi Partial Diff. Eq. [Lygeros, Tomlin, and Sastry 98] Computer Algebra [Shakernia, Pappas, and Sastry 00]

47 Fin Merci