Proofs from Simulations and Modular Annotations Zhenqi Huang and Sayan Mitra Department of Electrical and Computer Engineering University of Illinois at Urbana-Champaign
Proofs from Simulations and Modular Annotations
Zhenqi Huang and Sayan Mitra
Department of Electrical and Computer Engineering
University of Illinois at Urbana-Champaign
Background
โข Invariant verification for dynamical systems. โข Through computing the set of state the system can reach (reach set)
โข Exact Reach set computation is in general undecidable โ Over-approximation
โข Static analysis and symbolic approaches โข E.g. SpaceEx, PHAVer, CheckMate, d/dt
โข Dynamic+Static analysis using numerical simulations โข E.g. S-TaLiRo, Breach, C2E2
2 HSCC 2014, Berlin
Simulation-based Reachability
โข ๐ฅ = ๐ ๐ฅ , ฮ โ ๐ ๐
โข Denote ๐(๐, ๐ก) as a trajectory from ๐ โ ฮ
โข Simulation-based Verification โข Finite cover of ฮ ( ).
โข Simulate from the center of each cover.
โข Bloat the simulation with some factor, such that the bloated tube contains all trajectories starting from the cover.
โข Union of all such tubes gives an over-approximation of reach set
โข In [1], we expect the bloating factor to be given by the user as an annotation to the model
3 HSCC 2014, Berlin [1] Duggirala, Mitra, Viswannathan. EMSOFT2013
Annotation: Discrepancy Function
Definition. Functions V: ๐ ร ๐ โ โโฅ0 and ๐ฝ: โโฅ0 ร ๐ โ โโฅ0 define a
discrepancy of the system if for any two states ๐1 and ๐2 โ ฮ, For any ๐ก,
V ๐ ๐, ๐ก , ๐ ๐โฒ, ๐ก โค ๐ฝ |๐ โ ๐โฒ|, ๐ก
where, ๐ฝ โ 0 as ๐ โ ๐โฒ
โข Stability not required
โข Discrepancy can be found automatically for
linear systems
โข For nonlinear systems, several template-based
heuristics were proposed
๐(๐(๐, ๐ก), ๐(๐โฒ, ๐ก))
๐โฒ
๐(๐โฒ, ๐ก) ๐
๐(๐, ๐ก)
4
HSCC 2014, Berlin
Key challenge: Finding Discrepancy
Functions for Large Models
HSCC 2014, Berlin 5
Models of Cardiac Cell Networks โข Find quadratic contraction metric [2]:
โข ๐ฝ(๐ฃ,๐ค) = 0.5 โ 3๐ฃ2 โ11 โ1
โข Search for ๐ฝ โ โ and the coefficients of
๐ ๐ฃ,๐ค = ๐๐๐ ๐ฃ
๐๐ค๐ ๐๐๐ ๐ฃ๐๐ค๐
๐๐๐ ๐ฃ๐๐ค๐ ๐๐๐ ๐ฃ
๐๐ค๐,
s.t. 0 โค ๐ + ๐ โค 2, ๐ โป 0, and ๐ฝ๐๐ + ๐ ๐ฝ + ๐ โบ โ๐ฝ๐
Cardiac Cell
๐ฃ = 0.5 ๐ฃ โ ๐ฃ3 โ ๐ค + ๐ข๐ค = ๐ฃ โ ๐ค + 0.7
โข FitzHughโNagumo (FHN) model [1] โข Invariant property
โข Threshold of voltage โข Periodicity of behavior
6 HSCC 2014, Berlin
๐ ๐ฝ
Pacemaker
[1] FitzHugh. Biophysical J. 1961 [2] Aylward,Parrilo, Slotine. Automatica. 2008
๐๐ (๐ ๐, ๐ก , ๐ ๐โฒ, ๐ก ) โค ๐โ๐ฝ๐ก๐๐ (๐, ๐โฒ)
๐ข
Scalability of Finding Annotation
Pace Maker
Pace Maker Cardiac
Cell
Cardiac Cell
Cardiac Cell
Cardiac Cell
Cardiac Cell
7 HSCC 2014, Berlin
?
๐ฟ = ๐ฟ1 ร |๐ฟ2|
[1] Grosu, et al. CAV2011 [1]
Input-to-State (IS) Discrepancy
8
Definition. Functions ๐: ๐1 ร ๐1 โ โโฅ0, ๐ฝ: โโฅ0 ร โโฅ0 โ โโฅ0and ๐พ:โโฅ0 โ โโฅ0 define a IS discrepancy of the system:
๐1 ๐1 ๐1, ๐ข1, ๐ก , ๐ ๐1โฒ, ๐ข1โฒ, ๐ก โค ๐ฝ1 |๐1 โ ๐1โฒ|, ๐ก + ๐พ1 |๐ข1 ๐ โ ๐ข1โฒ ๐ | ๐๐
๐
0
and ๐พ1 โ โ 0 as ๐ข1 โ ๐ข1โฒ (๐1, ๐2) and (๐1
โฒ , ๐2โฒ) are a pair of trajectories of the overall ring:
๐1 ๐1 ๐ก , ๐1โฒ ๐ก โค ๐ฝ1 ๐1 โ ๐1
โฒ , ๐ก + 0๐ก๐พ1(|๐2(๐ ) โ ๐2
โฒ (๐ )|)๐๐
๐2 ๐2 ๐ก , ๐2โฒ ๐ก โค ๐ฝ2 ๐2 โ ๐2โฒ , ๐ก + 0
๐ก๐พ2(|๐1(๐ ) โ ๐1
โฒ(๐ )|)๐๐
๐ด1 ๐ฅ 1 = ๐1(๐ฅ1, ๐ข1)
๐ด2 ๐ฅ 2 = ๐2(๐ฅ2, ๐ข2)
๐ข2 = ๐1 ๐ข1 = ๐2
๐ข1 ๐1 ๐ด1 ๐ฅ 1 = ๐1(๐ฅ1, ๐ข1)
HSCC 2014, Berlin
More on IS Discrepancy
โข IS Discrepancy:
๐ ๐ ๐, ๐ข, ๐ก , ๐ ๐โฒ, ๐ขโฒ, ๐ก โค ๐ฝ ๐ โ ๐โฒ , ๐ก + ๐พ( ๐ข ๐ โ ๐ขโฒ ๐ )๐๐ ๐ก
0
โข Incremental integral input-to-state stability [1], except no stability property is required.
โข Most methods of finding discrepancy of ๐ฅ = ๐(๐ฅ) can be modified to find IS discrepancy systems with linear input ๐ฅ = ๐ ๐ฅ + ๐ต๐ข.
9 HSCC 2014, Berlin [1] Angeli D. TAC. 2009
IS Discrepancy โน Reachability
โข We will build a reduced model ๐(๐ฟ) with a unique trajectory ๐(๐ก) using the IS Discrepancy.
โข Theorem: ๐ ๐๐๐โ(๐ต๐ฟ๐ ๐ , ๐) โ ๐ต๐ ๐ก
๐ (๐(๐, ๐ก))๐กโ[0,๐]
โข Theorem: for small enough ๐ฟ and precise enough simulation, the over-approximation can be computed arbitrarily precise.
๐
๐(๐, ๐ก) ๐(๐ก)
๐ฟ
10 HSCC 2014, Berlin
Construction of the Reduced Model
โข Reduced model ๐ ๐ฟ
โข ๐ฅ = ๐๐(๐ฅ) with ๐ฅ = โจ๐1, ๐2, ๐๐๐โฉ
โข
๐1๐2
๐๐๐
=
๐ฝ1 ๐ฟ,๐๐๐ +๐พ1 (๐2)
๐ฝ2 ๐ฟ,๐๐๐ +๐พ2 (๐1)
1
โข ๐๐ 0 = ๐ฝ๐ ๐ฟ, 0 , ๐๐๐ 0 = 0
โข ๐(๐ฟ) has a unique trajectory ๐(๐ก).
๐1, ๐ข2
๐2, ๐ข1
11 HSCC 2014, Berlin
Reduced Model โน Bloating Factor
โข Lemma: |๐1 โ ๐1โฒ | โค ๐ฟ, and |๐2 โ ๐2
โฒ | โค ๐ฟ โน ๐1 ๐1 ๐ก , ๐1
โฒ ๐ก โค ๐1(๐ก), and ๐2 ๐2 ๐ก , ๐2โฒ ๐ก โค ๐2(๐ก).
12
The IS Discrepancy functions:
๐1 ๐1 ๐ก , ๐1โฒ ๐ก โค ๐ฝ1 ๐1 โ ๐1
โฒ , ๐ก + 0๐ก๐พ1(|๐2(๐ ) โ ๐2
โฒ (๐ )|)๐๐
๐2 ๐2 ๐ก , ๐2โฒ ๐ก โค ๐ฝ2 ๐2 โ ๐2โฒ , ๐ก + 0
๐ก๐พ2(|๐1(๐ ) โ ๐1
โฒ(๐ )|)๐๐
The ODE of the reduced model ๐(๐ฟ) :
๐1
๐2
๐๐๐
=๐ฝ1 ๐ฟ, ๐๐๐ + ๐พ1 (๐2)
๐ฝ2 ๐ฟ, ๐๐๐ + ๐พ2 (๐1)1
๐
๐(๐, ๐ก) ๐(๐ก)
๐ฟ
โข Thus, bloating ๐(๐, ๐ก) by ๐(๐ก) gives an over-approximation of reach set from a ball.
HSCC 2014, Berlin
Simulation & Modular Annotation โน Proof
13
Simulation Engine
Reach set over-
approximation
Reduced Model
Pace Maker
Trajectory
Bloating factor
IS Discrepancy
HSCC 2014, Berlin
Sat Inv?
Proof
Counter Example
Refinement
Soundness and Relative Complete
โข Robustness Assumption: โข Invariant is closed.
โข If an initial set ฮ satisfies the invariant, โ๐ > 0, such that all trajectories are at least ๐ distance from the boundary of the invariant.
โข Theorem: the Algorithm is sound and relatively complete
โข We verify systems with upto 30 dimensions in minutes.
14 HSCC 2014, Berlin
System # Variables # Module # Init. cover Run Time
Lin. Sync 24 6 128 135.1
Nonli. WT 30 6 128 140.0
Nonli. Robot 6 2 216 166.8
Conclusion
โข A scalable technique to verify nonlinear dynamical systems using modular annotations
โข Modular annotations are used to construct a reduced model of the overall system whose trajectory gives the discrepancy of trajectories
โข Sound and relatively complete โข Ongoing: extension to hybrid, cardiac cell network with 5 cells each has 4
continuous var. and 29 locations โข Thank you for your attention!
15 HSCC 2014, Berlin