Automatic Rectangular Refinement of Affine Hybrid Automata Tom Henzinger EPFL Laurent Doyen ULB Jean-François Raskin ULB FORMATS 2005 – Sep 27 th - Uppsala

Overview Automatic analysis of affine hybrid systems

Overview Example: Navigation Benchmark {

Overview Automatic analysis of affine hybrid systems Example: Two trajectories {

Overview Automatic analysis of affine hybrid systems Example: Navigation Benchmark { Affine dynamics

Overview Automatic analysis of affine hybrid systems Example: { Affine dynamics Discrete states B2 + A

Some classes of hybrid automata: –Timed automata ( ) –Rectangular automata ( ) –Linear automata ( )Reminder

Some classes of hybrid automata: –Timed automata ( ) –Rectangular automata ( ) –Linear automata ( )Reminder Limit for decidability of Language Emptiness

Reminder Some classes of hybrid automata: –Timed automata ( ) –Rectangular automata ( ) –Linear automata ( ) –Affine automata ( ) –Polynomial automata ( ) –etc. Limit for decidability of Language Emptiness

Reminder Some classes of hybrid automata: –Timed automata ( ) –Rectangular automata ( ) –Linear automata ( ) –Affine automata ( ) –Polynomial automata ( ) –etc. Limit for symbolic computation of Post with HyTech Limit for decidability of Language Emptiness

Methodology Affine automaton A and set of states Bad Check that Reach(A)  Bad = Ø

Methodology Affine dynamics is too complex ? Abstract it ! Affine automaton A and set of states Bad Check that Reach(A)  Bad = Ø

Methodology Affine dynamics is too complex ? Abstract it ! Abstraction is too coarse ? Refine it ! HOW ? Affine automaton A and set of states Bad Check that Reach(A)  Bad = Ø

Methodology Affine dynamics Rectangular dynamics 1. Abstraction: over-approximation

Let ThenMethodology Affine dynamics Rectangular dynamics 1. Abstraction: over-approximation {

Methodology Line l  2. Refinement: split locations by a line cut l 0 3

Methodology Line l  2. Refinement: split locations by a line cut l 0 3

Methodology Abstract Reach(A’)  Bad Ø ? = A’ A Yes Original Automaton Property verified

Methodology Abstract Reach(A’)  Bad Ø ? = A’ A Yes Original Automaton ( Undecidable ) Property verified

Methodology AbstractRefine Reach(A’)  Bad Ø ? = A’ A No Yes Original Automaton ( Undecidable ) Property verified using Reach(A’) using Pre*(Bad)

Refinement 2. Refinement: split locations by a line cut Which location(s) ? –Loc 1 = Locations reachable in the last step –Loc 2 = Reachable locations that can reach Bad –B etter: replace the state space by Loc 2

Refinement 2. Refinement: split locations by a line cut Which location(s) ? –Loc 1 = Locations reachable in the last step –Loc 2 = Reachable locations that can reach Bad –B etter: replace the state space by Loc 2 Which line cut ? –The best cut for some criterion characterizing the goodness of the resulting approximation.

Notations

Notations

Notations l P+P+ P-P- A B

Notations l P+P+ P-P- A B

? Goodness of a cut A good cut should minimize

? Goodness of a cut A good cut should minimize

? … Goodness of a cut A good cut should minimize

? … Goodness of a cut Our choice A good cut should minimize

Finding the optimal cut P

Extremal level sets of f(x,y) P

Extremal level sets of g(x,y) P

Example P Assume

Then any line separating { } and { } is better than any other line.Example P Assume

Example P

Example Any line separating { } and { } is better than any other line. P

Example Any line separating { } and { } is better than any other line. P

Example Thus, for every the best line separates and P

Example Thus, for every the best line separates and P

Example Thus, for every the best line separates and P

Example Thus, for every the best line separates and P

Example P When

Example P the best line cut must separate both from and from

Example P The best line cut must separate both from and from

Example Intersection P The process continues because it is still possible to separate both from and from When an intersection occurs…

Example P

Example P

Example P

Example P

Example Intersection P When a second intersection occurs…

Example Intersection P In this case, we have reached the "limit of separability"

Example An optimal cut P

How to compute the intersection ? P

P We have to find the minimal  such that: (u,v)

How to compute the intersection ? P We have to find the minimal  such that: This is a linear program ! (u,v)

The algorithm Applies in the plane (2D) –Several particular cases

The algorithm Applies in the plane (2D) –Several particular cases What for higher dimension ? –An option: discretize the problem using a grid –Apply a (more) discrete algorithm –The exact solution can be arbitrarily closely approximated

The algorithm Applies in the plane (2D) –Several particular cases What for higher dimension ? –An option: discretize the problem using a grid –Apply a (more) discrete algorithm –The exact solution can be arbitrarily closely approximated N.B.: it is possible to define a general algorithm in nD, but it requires to solve difficult geometrical problems (parametric convex hulls).

The algorithm Applies in the plane (2D) –Several particular cases What for higher dimension ? –An option: discretize the problem using a grid –Apply a (more) discrete algorithm –The exact solution can be arbitrarily closely approximated N.B.: it is possible to define a general algorithm in nD, but it requires to solve difficult geometrical problems (parametric convex hulls).

Navigation benchmark In each location, the dynamics has the form: We cut in the plane v 1 -v 2

Navigation benchmark In each location, the dynamics has the form: We cut in the plane v 1 -v 2

Results NAV 04 NAV 07 Initial states Bad statesGood states

Results: NAV 04 Forward Backward

Results: NAV 04 Forward

Results: NAV 07 Backward

Conclusion Approximations Rectangular Over-approximations

Conclusion Approximations Rectangular Over-approximations Refinements Automatic Optimal split for some criterion (at least in 2D)

Conclusion Approximations Rectangular Over-approximations Refinements Automatic Optimal split for some criterion (at least in 2D) Possible future work Under-approximations Optimal split for some other criterion Combine with other approaches (barrier certificates, ellipsoïds, …)

References [FI04] A. Fehnker and F. Ivancic. Benchmarks for hybrid systems verification. In HSCC 2004, LNCS 2993, pp [Fre05] G. Frehse. Phaver: Algorithmic verification of hybrid systems past hytech. In HSCC 2005, LNCS 3414, pp