Model Checking for Hybrid Systems Bruce H. Krogh Carnegie Mellon University

Carnegie Mellon: The Rare Glitch Project2Bruce H. Krogh Hybrid Dynamic Systems Dynamic systems with both continuous & discrete state variables Lyapunov functions, eigenvalue analysis, etc. Boolean algebra, formal logics, recursion, etc. Analytical Tools MATLAB, Matrix X, VisSim, etc., Statemate, Design CPN, Slam II, SMV, etc. Software Tools Continuous-State Systems differential equations, transfer functions, etc. Discrete-State Systems automata, Petri nets, statecharts, etc. Models

Carnegie Mellon: The Rare Glitch Project3Bruce H. Krogh Three Main Thrusts of Our Project Verifying system integrity  Synchronization constraints  Resource constraints  Real-time constraints Modeling the environment  Hybrid dynamics  Stochastic models Usability  Extracting models  Explaining tool feedback system environment

Carnegie Mellon: The Rare Glitch Project4Bruce H. Krogh Embedded systems with significant hybrid dynamics Source: ESP, Dec, 1998

Carnegie Mellon: The Rare Glitch Project5Bruce H. Krogh Opportunity to Apply Formal Verification Techniques test on engine/ vehicle feature specification code production executable spec. code generation simulation hardware in the loop executable spec. Computer-Aided Control System Design model checking Objective: Verify feature behavior for the entire range of operating conditions.

Carnegie Mellon: The Rare Glitch Project6Bruce H. Krogh Example: Variable CAM Timing look-up table 2-mode PID/ saturation controller operating state cam angle actuator command

Carnegie Mellon: The Rare Glitch Project7Bruce H. Krogh Example: Variable CAM Timing Controller Verification Problem: Determine whether the controller will switch only once from saturation to PID mode.

Carnegie Mellon: The Rare Glitch Project8Bruce H. Krogh Continuous-Time Model

Carnegie Mellon: The Rare Glitch Project9Bruce H. Krogh Switching Rule Discrete-time rule Switch on magnitude of the error and the sign of this filter Continuous-time rule Switch on magnitude of the error and the sign of this filter state of the filter error

Carnegie Mellon: The Rare Glitch Project10Bruce H. Krogh Finite-State Analysis Assign discrete states to each switch boundary and the initial condition set Determine reachability from each discrete state to the other discrete states Analyze the resulting finite state system

Carnegie Mellon: The Rare Glitch Project11Bruce H. Krogh Reachability Analysis

Carnegie Mellon: The Rare Glitch Project12Bruce H. Krogh Finite-State Model Switching back to the saturation controller is certain from some initial states (i.e., specification is not satisfied)

Carnegie Mellon: The Rare Glitch Project13Bruce H. Krogh Applying Model Checking to Hybrid Systems: interpret a hybrid system as a transition system (with an infinite state space) find an equivalent finite-state transition systems (bisimulation) perform verification using the bisimulation Can this approach be generalized to higher-order systems?

Carnegie Mellon: The Rare Glitch Project14Bruce H. Krogh Polyhedral-Invariant Hybrid Automaton (PIHA) Conversion Simulink/Stateflow Front End (graphical editing, simulation) Threshold-event-driven Hybrid Systems (TEDHS) Flow Pipe Approximations Quotient Transition System ACTL Verification Partition Refinement Initial Partition

Carnegie Mellon: The Rare Glitch Project15Bruce H. Krogh Polyhedral-Invariant Hybrid Automaton (PIHA) Conversion Simulink/Stateflow Front End (graphical editing, simulation) Threshold-event-driven Hybrid Systems (TEDHS) Flow Pipe Approximations Quotient Transition System ACTL Verification Partition Refinement Initial Partition T T/P SWITCHED CONTINUOUS DYNAMICS dx/dt = f u (x) POLYHEDRAL REGIONS STATEFLOW FSMs

Carnegie Mellon: The Rare Glitch Project16Bruce H. Krogh CheckMate Block Diagram Switched Continuous Dynamics Switching Hyperplanes Discrete-State Dynamics

Carnegie Mellon: The Rare Glitch Project17Bruce H. Krogh Polyhedral-Invariant Hybrid Automaton (PIHA) Conversion Simulink/Stateflow Front End (graphical editing, simulation) Threshold-event-driven Hybrid Systems (TEDHS) Flow Pipe Approximations Quotient Transition System ACTL Verification Partition Refinement Initial Partition T T/P mode select integrator m(t) xdot(t) flow constraints x(t) jump mapping initial condition e(t) threshold-driven discrete dynamics x(t) e(t) m(t) cont. state discrete state discrete event F1 F2 F3 1S1S X0X0 JeJe e(t)

Carnegie Mellon: The Rare Glitch Project18Bruce H. Krogh Polyhedral-Invariant Hybrid Automaton (PIHA) Conversion Simulink/Stateflow Front End (graphical editing, simulation) Threshold-event-driven Hybrid Systems (TEDHS) Flow Pipe Approximations Quotient Transition System ACTL Verification Partition Refinement Initial Partition Elements of CheckMate

Carnegie Mellon: The Rare Glitch Project19Bruce H. Krogh Polyhedral-Invariant Hybrid Automaton (PIHA) Conversion Simulink/Stateflow Front End (graphical editing, simulation) Threshold-event-driven Hybrid Systems (TEDHS) Flow Pipe Approximations Quotient Transition System ACTL Verification Partition Refinement Initial Partition u u’u’ x  INV u’ dx/dt = F u’ (x) x  INV u dx/dt = F u (x) x  Xox  Xo e i : g i (x)  0 x u’  J i (x u )

Carnegie Mellon: The Rare Glitch Project20Bruce H. Krogh Polyhedral-Invariant Hybrid Automaton (PIHA) Conversion Simulink/Stateflow Front End (graphical editing, simulation) Threshold-event-driven Hybrid Systems (TEDHS) Flow Pipe Approximations Quotient Transition System ACTL Verification Partition Refinement Initial Partition Elements of CheckMate

Carnegie Mellon: The Rare Glitch Project21Bruce H. Krogh Polyhedral-Invariant Hybrid Automaton (PIHA) Conversion Simulink/Stateflow Front End (graphical editing, simulation) Threshold-event-driven Hybrid Systems (TEDHS) Flow Pipe Approximations Quotient Transition System ACTL Verification Partition Refinement Initial Partition

Carnegie Mellon: The Rare Glitch Project22Bruce H. Krogh Polyhedral-Invariant Hybrid Automaton (PIHA) Conversion Simulink/Stateflow Front End (graphical editing, simulation) Threshold-event-driven Hybrid Systems (TEDHS) Flow Pipe Approximations Quotient Transition System ACTL Verification Partition Refinement Initial Partition T T/P

Carnegie Mellon: The Rare Glitch Project23Bruce H. Krogh Computing Transitions  ('1,p',q')('1,p',q') '1'1 '2'2 ('2,p',q')('2,p',q') (,p,q)(,p,q) pp'p' qq'q'

Carnegie Mellon: The Rare Glitch Project24Bruce H. Krogh Approximating reachable sets E.K. Kornoushenko. Finite-automaton approximation to the behavior of continuous plants, Automation and Remote Control, 1975 J. Reisch and S. O’Young, A DES approach to control of hybrid dynamical systems, Hybrid Systems III, LNCS 1066, Springer, 1996 A. Puri, V. Borkar and P. Varaiya,  -Approximation of differential inclusions, Hybrid Systems III, LNCS 1066, Springer, 1996 M.R. Greenstreet, Verifying safety properties of differential equations, CAV’96 M.R. Greenstreet and I. Mitchell, Integrating projections, HSCC98 T. Dang and O. Maler, Reachability analysis via face lifting, HSCC98 A. Chutinan and B. H. Krogh, Verification of polyhedral-invariant hybrid systems using polygonal flow pipe approximations, HSCC99

Carnegie Mellon: The Rare Glitch Project25Bruce H. Krogh Polyhedral flow pipe approximation A. Chutinan and B. H. Krogh, Computing polyhedral approximations to dynamic flow pipes, IEEE CDC, 1998 X0X0 t1t1 t2t2 t3t3 t4t4 t5t5 t6t6 t7t7 t8t8 t9t9 divide R [0,T] (X 0 ) into [t k,t k+1 ] segments enclose each segment with a convex polytope R M [0,T] (X 0 ) = union of polytopes

Carnegie Mellon: The Rare Glitch Project26Bruce H. Krogh Flow Pipe Segment Approximation Vertices(X 0 ) at t k Vertices(X 0 ) at t k+1 Step 1. a. Simulate trajectories from each vertex of X 0. Step 2. Solve optimization for d i flow pipe segment approximated by { x | c i T x  d i,  i } b. Take the convex hull and identify outward normal vectors.

Carnegie Mellon: The Rare Glitch Project27Bruce H. Krogh Flow Pipe Approximation for a Linear System Vertices for X 0 Uniform time step  t k = 0.1

Carnegie Mellon: The Rare Glitch Project28Bruce H. Krogh Flow Pipe Approximation Applies to nonlinear dynamics Applies in arbitrary dimensions Approximation error doesn't grow with time Estimation error (Hausdorff distance) can be made arbitrarily small with  t <  and size of X 0 <  Integrated into CheckMate

Carnegie Mellon: The Rare Glitch Project29Bruce H. Krogh Polyhedral-Invariant Hybrid Automaton (PIHA) Conversion Simulink/Stateflow Front End (graphical editing, simulation) Threshold-event-driven Hybrid Systems (TEDHS) Flow Pipe Approximations Quotient Transition System ACTL Verification Partition Refinement Initial Partition

Carnegie Mellon: The Rare Glitch Project30Bruce H. Krogh Polyhedral-Invariant Hybrid Automaton (PIHA) Conversion Simulink/Stateflow Front End (graphical editing, simulation) Threshold-event-driven Hybrid Systems (TEDHS) Flow Pipe Approximations Quotient Transition System ACTL Verification Partition Refinement Initial Partition

Carnegie Mellon: The Rare Glitch Project31Bruce H. Krogh Application Case Studies F 16 auto-land system (Lockheed-DARPA) Batch process shut down controller (ESPRIT VHS Project) Automotive powertrain  Engine shut-off mode (PARADES)  Idle speed control (CADENCE)  Transmission shift controller (Ford-DARPA)

Carnegie Mellon: The Rare Glitch Project32Bruce H. Krogh CheckMate - Current Work Sampled-data systems  clocked + unclocked events Resets (jumps in the continuous state) Efficient hybrid automata generation

Carnegie Mellon: The Rare Glitch Project33Bruce H. Krogh The Rare Glitch Project Hybrid system abstractions composable with independent embedded software models Generation of requirements from hybrid system models (timing and resource constraints) Improved technology  order-reduction  focused refinement  automatic model abstraction  usability