1. Automatic Rectangular Refinement of Affine Hybrid Automata Tom Henzinger EPFL Laurent Doyen ULB Jean-François Raskin ULB FORMATS 2005 – Sep 27 th - Uppsala

2. Overview Automatic analysis of affine hybrid systems

3. Overview Example: Navigation Benchmark {

4. Overview Automatic analysis of affine hybrid systems Example: Two trajectories {

5. Overview Automatic analysis of affine hybrid systems Example: Navigation Benchmark { Affine dynamics

6. Overview Automatic analysis of affine hybrid systems Example: { Affine dynamics Discrete states B2 + A 2 2 4 4 4 3

7. Some classes of hybrid automata: –Timed automata ( ) –Rectangular automata ( ) –Linear automata ( )Reminder

8. Some classes of hybrid automata: –Timed automata ( ) –Rectangular automata ( ) –Linear automata ( )Reminder Limit for decidability of Language Emptiness

9. Reminder Some classes of hybrid automata: –Timed automata ( ) –Rectangular automata ( ) –Linear automata ( ) –Affine automata ( ) –Polynomial automata ( ) –etc. Limit for decidability of Language Emptiness

10. Reminder Some classes of hybrid automata: –Timed automata ( ) –Rectangular automata ( ) –Linear automata ( ) –Affine automata ( ) –Polynomial automata ( ) –etc. Limit for symbolic computation of Post with HyTech Limit for decidability of Language Emptiness

11. Methodology Affine automaton A and set of states Bad Check that Reach(A)  Bad = Ø

12. Methodology Affine dynamics is too complex ? Abstract it ! Affine automaton A and set of states Bad Check that Reach(A)  Bad = Ø

13. Methodology Affine dynamics is too complex ? Abstract it ! Abstraction is too coarse ? Refine it ! HOW ? Affine automaton A and set of states Bad Check that Reach(A)  Bad = Ø

14. Methodology Affine dynamics Rectangular dynamics 1. Abstraction: over-approximation

15. Let ThenMethodology Affine dynamics Rectangular dynamics 1. Abstraction: over-approximation {

16. Methodology Line l  2. Refinement: split locations by a line cut l 0 3

17. Methodology Line l  2. Refinement: split locations by a line cut l 0 3

18. Methodology Abstract Reach(A’)  Bad Ø ? = A’ A Yes Original Automaton Property verified

19. Methodology Abstract Reach(A’)  Bad Ø ? = A’ A Yes Original Automaton ( Undecidable ) Property verified

20. Methodology AbstractRefine Reach(A’)  Bad Ø ? = A’ A No Yes Original Automaton ( Undecidable ) Property verified using Reach(A’) using Pre*(Bad)

21. Refinement 2. Refinement: split locations by a line cut Which location(s) ? –Loc 1 = Locations reachable in the last step –Loc 2 = Reachable locations that can reach Bad –B etter: replace the state space by Loc 2

22. Refinement 2. Refinement: split locations by a line cut Which location(s) ? –Loc 1 = Locations reachable in the last step –Loc 2 = Reachable locations that can reach Bad –B etter: replace the state space by Loc 2 Which line cut ? –The best cut for some criterion characterizing the goodness of the resulting approximation.

23. Notations

24. Notations

25. Notations l P+P+ P-P- A B

26. Notations l P+P+ P-P- A B

27. ? Goodness of a cut A good cut should minimize

28. ? Goodness of a cut A good cut should minimize

29. ? … Goodness of a cut A good cut should minimize

30. ? … Goodness of a cut Our choice A good cut should minimize

31. Finding the optimal cut P

32. Extremal level sets of f(x,y) P

33. Extremal level sets of g(x,y) P

34. Example P Assume

35. Then any line separating { } and { } is better than any other line.Example P Assume

36. Example P

37. Example Any line separating { } and { } is better than any other line. P

38. Example Any line separating { } and { } is better than any other line. P

39. Example Thus, for every the best line separates and P

40. Example Thus, for every the best line separates and P

41. Example Thus, for every the best line separates and P

42. Example Thus, for every the best line separates and P

43. Example P When

44. Example P the best line cut must separate both from and from

45. Example P The best line cut must separate both from and from

46. Example Intersection P The process continues because it is still possible to separate both from and from When an intersection occurs…

47. Example P

48. Example P

49. Example P

50. Example P

51. Example Intersection P When a second intersection occurs…

52. Example Intersection P In this case, we have reached the "limit of separability"

53. Example An optimal cut P

54. How to compute the intersection ? P

55. P We have to find the minimal  such that: (u,v)

56. How to compute the intersection ? P We have to find the minimal  such that: This is a linear program ! (u,v)

57. The algorithm Applies in the plane (2D) –Several particular cases

58. The algorithm Applies in the plane (2D) –Several particular cases What for higher dimension ? –An option: discretize the problem using a grid –Apply a (more) discrete algorithm –The exact solution can be arbitrarily closely approximated

59. The algorithm Applies in the plane (2D) –Several particular cases What for higher dimension ? –An option: discretize the problem using a grid –Apply a (more) discrete algorithm –The exact solution can be arbitrarily closely approximated N.B.: it is possible to define a general algorithm in nD, but it requires to solve difficult geometrical problems (parametric convex hulls).

60. The algorithm Applies in the plane (2D) –Several particular cases What for higher dimension ? –An option: discretize the problem using a grid –Apply a (more) discrete algorithm –The exact solution can be arbitrarily closely approximated N.B.: it is possible to define a general algorithm in nD, but it requires to solve difficult geometrical problems (parametric convex hulls).

61. Navigation benchmark In each location, the dynamics has the form: We cut in the plane v 1 -v 2

62. Navigation benchmark In each location, the dynamics has the form: We cut in the plane v 1 -v 2

63. Results NAV 04 NAV 07 Initial states Bad statesGood states

64. Results: NAV 04 Forward Backward

65. Results: NAV 04 Forward

66. Results: NAV 07 Backward

67. Conclusion Approximations Rectangular Over-approximations

68. Conclusion Approximations Rectangular Over-approximations Refinements Automatic Optimal split for some criterion (at least in 2D)

69. Conclusion Approximations Rectangular Over-approximations Refinements Automatic Optimal split for some criterion (at least in 2D) Possible future work Under-approximations Optimal split for some other criterion Combine with other approaches (barrier certificates, ellipsoïds, …)

70. References [FI04] A. Fehnker and F. Ivancic. Benchmarks for hybrid systems verification. In HSCC 2004, LNCS 2993, pp 326-341. [Fre05] G. Frehse. Phaver: Algorithmic verification of hybrid systems past hytech. In HSCC 2005, LNCS 3414, pp 258-273.