Cyber-Physical Systems (CPS) are abundant in safety-critical domains such as healthcare, avionics, and autonomous vehicles. Formal verification of their operational safety is, therefore, of utmost importance. In this paper, we address the falsification problem, where the focus is on searching for an unsafe execution in the system instead of proving its absence. The contribution of this paper is a framework that (a) connects the falsification of CPS with the falsification of deep neural networks (DNNs) and (b) leverages the inherent interpretability of Decision Trees for faster falsification of CPS. This is achieved by: (1) building a surrogate model of the CPS under test, either as a DNN model or a Decision Tree, (2) application of various DNN falsification tools to falsify CPS, and (3) a novel falsification algorithm guided by the explanations of safety violations of the CPS model extracted from its Decision Tree surrogate. The proposed framework has the potential to exploit a repertoire ofadversarial attackalgorithms designed to falsify robustness properties of DNNs, as well as state-of-the-art falsification algorithms for DNNs. Although the presented methodology is applicable to systems that can be executed/simulated in general, we demonstrate its effectiveness, particularly in CPS. We show that our framework, implemented as a tool FLEXIFAL, can detect hard-to-find counterexamples in CPS that have linear and non-linear dynamics. Decision tree-guided falsification shows promising results in efficiently finding multiple counterexamples in the ARCH-COMP 2024 falsification benchmarks [23].

Bounded model checking (BMC) is well-known to be undecidable even for simple hybrid systems. Existing work targeted for a wide class of non-linear hybrid systems reduces the BMC problem to the satisfiability problem of an satisfiability modulo theory formula encoding the hybrid system dynamics. Consequently, the satisfiability of the formula is deduced with a δ-decision procedure. However, the encoded formula can be complex for large automaton and for deep exploration causing the decision procedure to be inefficient. Additionally, a generalized decision procedure can be inefficient for hybrid systems with simple dynamics. In this article, we propose a BMC algorithm built upon the foundation of the counter example guided abstraction refinement (CEGAR) technique and targeted for hybrid systems with piecewise affine dynamics, modeled as a hybrid automaton. In particular, our algorithm begins by searching an abstract counterexample in the discrete state-space of the automaton. We check whether a discovered abstract counterexample is spurious or real by a two-tier refinement of the state-space guided by the abstract counterexample. The primary refinement is through symbolic reachability analysis and the following refinement is via a search of a real counterexample by the trajectory splicing method, guided in turn by the outcome of reachability analysis. We show that our algorithm reaps the benefits of the CEGAR technique by directing the exploration in the regions of interest and pruning search space that is irrelevant to the property under consideration. In addition, an optimization by memoizing the computed symbolic states during reachability analysis has been proposed for efficiency. The proposed algorithm is implemented in the tool SAT-Reach, and we compare its performance with dReach , XSpeed , Flow* , SpaceEx, and a pattern database heuristic-guided search algorithm. Experiments demonstrate the efficacy of our algorithm.