1. Application of Formal Verification Methods to the analysis of Bearings-only Ballistic Missile Interception Algorithms Eli Bendersky Michael Butvinnik Supervisor: Dr. Mark Moulin

2. Project goals Verify and improve the performance of antimissile interception by using a Formal Verification technique for checking: Interception dynamics consistency Extended Kalman Filter estimation consistency

3. Interception model

4. The polar system equations are given by: True Proportional Navigation guidance law System equations - bearing angle - range - missile acceleration - target acceleration - navigation gain

5. EKF Linearized system equationsMeasurement equation Modified covariance - positive semidefinite pseudo-noise covariance - process noise covariance - white noise

6. Interception scenario and system parameters 0.0051LOS angle rate -0.96LOS angle -1787range rate 80000range 500target velocity 1500missile velocity 3.85navigation constant 8e-8measurement noise variance 0.5process sampling rate 1.0EKF update rate

7. Formal verification Prove that a system obeys its specification Contrast to simulation: Formal verificationSimulation all legal input sequences(large) set of particular cases correctness expressed as correctness usually expressed per set of general propertiesrun (expected results) Methods: theorem proving, model checking

8. Model checking View system as a finite state machine Traverse the state machine to determine the truth or falsity of a specification always (request -> next acknowledge) Provide a counter-example if the specification failed

9. Safety and Liveness properties Safety property: “Something bad never happens.” Useful to check that a tracking error is always lower than some upper bound always (…) Liveness property: “Something good eventually happens.” Useful to verify that a system eventually converges always_in_future_time (…)

10. Bounded Model Checking Bounds the model to a limited amount of cycles Uses a Boolean Satisfiability solver to find counter examples to specifications When used with SAT – very efficient, faster than traditional Model Checking algorithms, can process larger models Can be only used for falsification – finding bugs

11. Boolean Satisfiability (SAT) Well studied NP-Complete problem Given a boolean conjunctive normal form (CNF) formula, looks for assignments to variables so that the formula evaluates to true CNF: Given a property p and running for k cycles, is there a reachable state within k cycles that satisfies  p ?... s0s0 s1s1 s2s2 s k-1 sksk pp p pp p

12. Rulebase formal verification tool Verifies a design, typically control logic, against a set of properties, producing documented fail/pass answer Deals with industrial size designs Used throughout IBM, by external licensees, and in academia IBM Outstanding Research Innovation Award

13. Rulebase (continued) design (HDL) environ. (EDL) spec (sugar) RuleBase pass/fail

14. Rulebase with SAT Design, environment and specifications reduced to a CNF boolean formula Formula passed to a SAT solver The SAT solver runs for a specified amount of cycles Reports a counter example if the specification failed

15. Modeling the system for Rulebase The system was coded in Verilog (a common hardware description language) Floating point operations implemented using fixed point arithmetic (with precision of 0.0001) Specifications coded in the Sugar language (Industry standard)

16. Property 1 - Range always (range=80000 -> next [k] (range < 70000))

17. Property 2 - Acceleration Can be formulated in two ways always ( < 20) exists_at_least_once ( > 20) Rulebase found a counterexample showing a target acceleration that causes the missile acceleration to be after the first 4 seconds of the interception process

18. Properties 3 and 4 – range bias Property 3 always [k] (range_bias < 4000) Property 4 always (for_all ( ) -> within range_bias > 4000)

19. Properties 3 and 4 – results

20. Conclusions A novel powerful technique is introduced to analyze the interception process behavior The system properties are naturally described in a formal specification language The Rulebase verification engine steadily verifies these properties Formal verification is capable of finding heuristic control parameters, and proved to be suitable for checking the bound and corner cases