Notions of transition invariants and closure certificates have seen recent use in the formal verification of controlled dynamical systems against \omega-regular properties. Unfortunately, existing approaches face limitations in two directions. First, they require a closed-form mathematical expression representing the model of the system. Such an expression may be difficult to find, too complex to be of any use, or unavailable due to security or privacy constraints. Second, finding such invariants typically rely on optimization techniques such as sum-of-squares (SOS) or satisfiability modulo theory (SMT) solvers. This restricts the classes of systems that need to be formally verified. To address these drawbacks, we introduce a notion of neural closure certificates. We present a data-driven algorithm that trains a neural network to represent a closure certificate. Our approach is formally correct under some mild assumptions, i.e., one is able to formally show that the unknown system satisfies the \omega-regular property of interest if a neural closure certificate can be computed. Finally, we demonstrate the efficacy of our approach with relevant case studies.

A barrier certificate, defined over the states of a dynamical system, is a real-valued function whose zero level set characterizes an inductively verifiable state invariant separating reachable states from unsafe ones. When combined with powerful decision procedures—such as sum-of-squares programming (SOS) or satisfiability-modulo-theory solvers (SMT)—barrier certificates enable an automated deductive verification approach to safety. The barrier certificate approach has been extended to refute LTL and ω -regular specifications by separating consecutive transitions of corresponding ω -automata in the hope of denying all accepting runs. Unsurprisingly, such tactics are bound to be conservative as refutation of recurrence properties requires reasoning about the well-foundedness of the transitive closure of the transition relation. This paper introduces the notion of closure certificates as a natural extension of barrier certificates from state invariants to transition invariants. We augment these definitions with SOS and SMT based characterization for automating the search of closure certificates and demonstrate their effectiveness over some case studies.

As cyber-physical systems (CPS) become increasingly autonomous, there is a growing need for resource-efficient design techniques that can guarantee safety and timeliness during system reconfiguration or mode changes. In this paper, we present Decntr, a co-design technique for jointly optimizing safety, schedulability and robustness for multi-mode CPS on multi-core platforms. By designing switching controllers that can switch be-tween different implementations and between different sampling periods, Decntr gives the resource allocation significantly more flexibility to adapt scheduling decisions to load changes, such as additional tasks in a new mode or increased demands during a mode change. For example, it can pick the best implementation for a task depending on the current resource availability; it can adapt the period within a safe range to effectively utilize CPU and shared resources, which helps increase performance and robustness; and it can relax some job deadlines to avoid transient overloads during mode transitions for better schedulability. Our evaluation on an automotive case study and resource-intensive benchmarks shows that Decntr is highly effective in maximizing schedulability and robustness while ensuring safety, and that it significantly outperforms the state of the art in multi-core resource allocation for multi-mode systems.

Nowadays, AI-based techniques, such as deep neural networks (DNNs), are widely deployed in autonomous systems for complex mission requirements (e.g., motion planning in robotics). However, DNNs-based controllers are typically very complex, and it is very hard to formally verify their correctness, potentially causing severe risks for safety-critical autonomous systems. In this paper, we propose a construction scheme for a so-called Safe-visor architecture to sandbox DNNs-based controllers. Particularly, we consider the construction under a stochastic game framework to provide a system-level safety guarantee which is robust to noises and disturbances. A supervisor is built to check the control inputs provided by a DNNs-based controller and decide whether to accept them. Meanwhile, a safety advisor is running in parallel to provide fallback control inputs in case the DNN-based controller is rejected. We demonstrate the proposed approaches on a quadrotor employing an unverified DNNs-based controller.

Barrier certificates are inductive invariants that provide guarantees on the safety and reachability behaviors of continuous dynamical systems. For stochastic dynamical systems, barrier certificates take the form of inductive “expectation” invariants. In this context, a barrier certificate is a non-negative real-valued function over the state space of the system satisfying a strong supermartingale condition: it decreases in expectation as the system evolves The existence of barrier certificates, then, provides lower bounds on the probability of satisfaction of safety or reachability specifications over unbounded-time horizons. Unfortunately, establishing supermartingale conditions on barrier certificates can often be restrictive. In practice, we strive to overcome this challenge by utilizing a weaker condition called c-martingale that permits a bounded increment in expectation at every time step; unfortunately this only guarantees the property of interest for a bounded time horizon.

No abstract available.

We introduce OmegaThreads, a tool for automatic synthesis of correct-by-construction controllers for control systems from ω-regular specifications. It accepts general nonlinear control systems from which discrete abstractions (a.k.a. symbolic models) are constructed. Specifications are provided directly as deterministic parity Automata (DPA) or as linear temporal logic (LTL) formulae. OmegaThreads constructs two-player parity games and searches for a winning strategies playing as a controller against the symbolic models. If found, OmegaThreads extracts the winning strategies as a Mealy machines.

Increasing levels of autonomy in safety-critical systems such as autonomous vehicles, airplanes, and medical robots, pose questions about their safety, thus compelling the scientific community to provide novel techniques for the design of foolproof safety-critical control software (SCCS). One promising approach for designing formally-correct SCCS is to use unambiguous formal descriptions for design requirements and, at the same time, automate the development and implementation processes. In this poster, we introduce OmegaThreads [3], a tool for automated synthesis of formally-correct controllers for control systems from ω-regular specifications.

This work studies formal verification of continuous-time continuous-space systems with unknown dynamics against safety specifications. The proposed framework is based on a data-driven construction of barrier certificates using which the safety of unknown systems is verified via a finite set of data collected from trajectories of systems with a priori guaranteed confidence. In the proposed scheme, we first cast the original safety problem as a robust convex program (RCP). Since the unknown model appears in one of the constraints of the proposed RCP, we provide the scenario convex program (SCP) corresponding to the original RCP by collecting finite numbers of data from systems' evolutions. We then establish a probabilistic closeness between the optimal value of SCP and that of RCP. Accordingly, we formally quantify the safety guarantee of unknown systems based on the number of data and the required level of safety confidence.

In this work, we propose a data-driven technique for a formal estimation of infinitesimal generators of continuous-time stochastic systems with unknown dynamics. In the proposed framework, we first approximate the infinitesimal generator of the solution process via a set of data collected from solution processes of unknown systems. We then put some proper assumptions on dynamics of systems and quantify the closeness between the infinitesimal generator and its approximation while providing a priori guaranteed confidence bound. We show that both the time discretization and the number of data play significant roles in providing a reasonable closeness precision.

Reachability analysis is a critical tool for the formal verification of dynamical systems and the synthesis of controllers for them. Due to their computational complexity, many reachability analysis methods are restricted to systems with relatively small dimensions. One significant reason for such limitation is that those approaches, and their implementations, are not designed to leverage parallelism. They use algorithms that are designed to run serially within one compute unit and they can not utilize widely-available high-performance computing (HPC) platforms such as many-core CPUs, GPUs and Cloud-computing services. This paper presents PIRK , a tool to efficiently compute reachable sets for general nonlinear systems of extremely high dimensions. PIRK can utilize HPC platforms for computing reachable sets for general high-dimensional non-linear systems. PIRK has been tested on several systems, with state dimensions up to 4 billion. The scalability of PIRK ’s parallel implementations is found to be highly favorable.

In this paper, we propose a software tool, called AMYTISS , implemented in C++/OpenCL, for designing correct-by-construction controllers for large-scale discrete-time stochastic systems. This tool is employed to (i) build finite Markov decision processes (MDPs) as finite abstractions of given original systems, and (ii) synthesize controllers for the constructed finite MDPs satisfying bounded-time high-level properties including safety, reachability and reach-avoid specifications. In AMYTISS , scalable parallel algorithms are designed such that they support the parallel execution within CPUs, GPUs and hardware accelerators (HWAs). Unlike all existing tools for stochastic systems, AMYTISS can utilize high-performance computing (HPC) platforms and cloud-computing services to mitigate the effects of the state-explosion problem, which is always present in analyzing large-scale stochastic systems. We benchmark AMYTISS against the most recent tools in the literature using several physical case studies including robot examples, room temperature and road traffic networks. We also apply our algorithms to a 3-dimensional autonomous vehicle and 7-dimensional nonlinear model of a BMW 320i car by synthesizing an autonomous parking controller.

Decision tree learning is a popular classification technique most commonly used in machine learning applications. Recent work has shown that decision trees can be used to represent provably-correct controllers concisely. Compared to representations using lookup tables or binary decision diagrams, decision trees are smaller and more explainable. We present dtControl, an easily extensible tool for representing memoryless controllers as decision trees. We give a comprehensive evaluation of various decision tree learning algorithms applied to 10 case studies arising out of correct-by-construction controller synthesis. These algorithms include two new techniques, one for using arbitrary linear binary classifiers in the decision tree learning, and one novel approach for determinizing controllers during the decision tree construction. In particular the latter turns out to be extremely efficient, yielding decision trees with a single-digit number of decision nodes on 5 of the case studies.

Decision tree learning is a popular classification technique most commonly used in machine learning applications. Recent work has shown that decision trees can be used to represent provably-correct controllers concisely. Compared to representations using lookup tables or binary decision diagrams, decision tree representations are smaller and more explainable. We present dtControl, an easily extensible tool offering a wide variety of algorithms for representing memoryless controllers as decision trees. We highlight that the trees produced by dtControl are often very concise with a single-digit number of decision nodes. This demo is based on our tool paper [1].

In this paper, we provide a compositional framework for synthesizing hybrid controllers for interconnected discrete-time control systems enforcing specifications expressed by co-Büchi automata. In particular, we first decompose the given specification to simpler reachability tasks based on automata representing the complements of original co-Büchi automata. Then, we provide a systematic approach to solve those simpler reachability tasks by computing cor-responding control barrier functions. We show that such control barrier functions can be constructed compositionally by assuming some small-gain type conditions and composing so-called local control barrier functions computed for subsystems. We provide two systematic techniques to search for local control barrier functions for subsystems based on the sum-of-squares optimization program and counter-example guided inductive synthesis approach. Finally, we illustrate the effectiveness of our results through two large-scale case studies.

Large-scale stochastic systems have recently received significant attentions due to their broad applications in various safety-critical systems such as traffic networks and self-driving cars. In this poster, we describe the software tool AMYTISS, implemented in C++/OpenCL, for designing correct-by-construction controllers for large-scale discrete-time stochastic systems. This tool is employed to (i) build finite Markov decision processes (MDPs) as finite abstractions of given original systems, and (ii) synthesize controllers for the constructed finite MDPs satisfying bounded-time safety, reachability, and reach-avoid specifications. In AMYTISS, scalable parallel algorithms are designed such that they support the parallel execution within CPUs, GPUs and hardware accelerators (HWAs). Unlike all existing tools for stochastic systems, AMYTISS can utilize high-performance computing (HPC) platforms and cloud-computing services to mitigate the effects of the state-explosion problem, which is always present in analyzing large-scale stochastic systems. We benchmark AMYTISS against the most recent tools in the literature using several physical case studies including robot examples, room temperature and road traffic networks. We also apply our algorithms to a 3-dimensional autonomous vehicle and a 7-dimensional nonlinear model of a BMW 320i car by synthesizing autonomous parking controllers.

The article addresses the issue of reliability of complex embedded control systems in the safety-critical environment. In this article, we propose a novel approach to design controller that (i) guarantees the safety of nonlinear physical systems, (ii) enables safe system restart during runtime, and (iii) allows the use of complex, unverified controllers (e.g., neural networks) that drive the physical systems toward complex specifications. We use abstraction-based controller synthesis approach to design a formally verified controller that provides application and system-level fault tolerance along with safety guarantee. Moreover, our approach is implementable using a commercial-off-the-shelf (COTS) processing unit. To demonstrate the efficacy of our solution and to verify the safety of the system under various types of faults injected in applications and in the underlying real-time operating system (RTOS), we implemented the proposed controller for the inverted pendulum and three degrees-of-freedom (3-DOF) helicopter.

The correctness of control software in many safety-critical applications such as autonomous vehicles is crucial. One technique to achieve correct control software is called "symbolic control", where complex systems are approximated by finite-state abstractions. Then, using those abstractions, provably-correct digital controllers are algorithmically synthesized for concrete systems, satisfying complex high-level requirements. Unfortunately, the complexity of synthesizing such controllers grows exponentially in the number of state variables. However, if distributed implementations are considered, high-performance computing platforms can be leveraged to mitigate the effects of the state-explosion problem.

In the first part of this paper, we solve the problem of verifying stability of an interconnection of embedded control systems under a timing contract which specifies the time instants at which some operations in each subsystem are performed such as sampling, actuation, or control input computation. In our approach, we reformulate each subsystem into an impulsive system and then derive a small gain condition on the stability of the interconnection using reachability analysis. In the second part of the paper, we consider the problem of synthesizing a set of timing contracts that guarantee the stability of the interconnected embedded control system by exploiting the monotonicity of stability with respect to timing contract parameters. Linear and nonlinear examples are provided allowing us to compare our results with existing techniques and to show the effectiveness of our approach.

The correctness of control software in many safety-critical applications such as autonomous vehicles is very crucial. One approach to achieve this goal is through “symbolic control”, where complex physical systems are approximated by finite-state abstractions. Then, using those abstractions, provably-correct digital controllers are algorithmically synthesized for concrete systems, satisfying some complex high-level requirements. Unfortunately, the complexity of constructing such abstractions and synthesizing their controllers grows exponentially in the number of state variables in the system. This limits its applicability to simple physical systems. This paper presents a unified approach that utilizes sparsity of the interconnection structure in dynamical systems for both construction of finite abstractions and synthesis of symbolic controllers. In addition, parallel algorithms are proposed to target high-performance computing (HPC) platforms and Cloud-computing services. The results show remarkable reductions in computation times. In particular, we demonstrate the effectiveness of the proposed approach on a 7-dimensional model of a BMW 320i car by designing a controller to keep the car in the travel lane unless it is blocked.

No abstract available.

This paper tackles the problem of constructing finite abstractions for formal controller synthesis with high dimensional systems. We develop a theory of abstraction for discrete time nonlinear systems that are equipped with variables acting as interfaces for other systems. Systems interact via an interconnection map which constrains the value of system interface variables. An abstraction of a high dimensional interconnected system is obtained by composing subsystem abstractions with an abstraction of the interconnection. System abstractions are modular in the sense that they can be rearranged, substituted, or reused in configurations that were unknown during the time of abstraction. Constructing the abstraction of the interconnection map can become computationally infeasible when there are many systems. We introduce intermediate variables which break the interconnection and the abstraction procedure apart into smaller problems. Examples showcase the abstraction of a 24-dimensional system through the composition of 24 individual systems, and the synthesis of a controller for a 6-dimensional system with a consensus objective.

This paper is concerned with a compositional approach for constructing finite Markov decision processes of interconnected discrete-time stochastic control systems. The proposed approach leverages the interconnection topology and a notion of so-called stochastic storage functions describing joint dissipativity-type properties of subsystems and their abstractions. In the first part of the paper, we derive dissipativity-type compositional conditions for quantifying the error between the interconnection of stochastic control subsystems and that of their abstractions. In the second part of the paper, we propose an approach to construct finite Markov decision processes together with their corresponding stochastic storage functions for classes of discrete-time control systems satisfying some incremental passivablity property. Under this property, one can construct finite Markov decision processes by a suitable discretization of the input and state sets. Moreover, we show that for linear stochastic control systems, the aforementioned property can be readily checked by some matrix inequality. We apply our proposed results to the temperature regulation in a circular building by constructing compositionally a finite Markov decision process of a network containing 200 rooms in which the compositionality condition does not require any constraint on the number or gains of the subsystems. We employ the constructed finite Markov decision process as a substitute to synthesize policies regulating the temperature in each room for a bounded time horizon. We also illustrate the effectiveness of our results on an example of fully connected network.

No abstract available.

We propose an algorithm to over-approximate the reachable set of nonlinear systems with bounded, time-varying parameters and uncertain initial conditions. The algorithm is based on the conservative representation of the nonlinear dynamics by a differential inclusion consisting of a linear term and the Minkowsky sum of two convex sets. The linear term and one of the two sets are obtained by a conservative first-order over-approximation of the nonlinear dynamics with respect to the system state. The second set accounts for the effect of the time-varying parameters. A distinctive feature of the novel algorithm is the possibility to over-approximate the reachable set to any desired accuracy by appropriately choosing the parameters in the computation. We provide an example that illustrates the effectiveness of our approach.

No abstract available.

We introduce a notion of invariance feedback entropy for discrete-time, nondeterministic control systems as a measure of necessary state information to enforce a given subset of the state space to be invariant. We provide conditions that guarantee finiteness and show that the well-known notion of invariance feedback entropy for deterministic systems is recovered in the deterministic case. We establish the data rate theorem which shows that the entropy equals the largest lower bound on the data rate of any coder-controller that achieves invariance. For finite systems, the invariance feedback entropy is characterized by the value function of an appropriately designed mean-payoff game. We use several examples throughout the paper to instantiate the various definitions and results.

We introduce SCOTS a software tool for the automatic controller synthesis for nonlinear control systems based on symbolic models, also known as discrete abstractions. The tool accepts a differential equation as the description of a nonlinear control system. It uses a Lipschitz type estimate on the right-hand-side of the differential equation together with a number of discretization parameters to compute a symbolic model that is related with the original control system via a feedback refinement relation. The tool supports the computation of minimal and maximal fixed points and thus natively provides algorithms to synthesize controllers with respect to invariance and reachability specifications. The atomic propositions, which are used to formulate the specifications, are allowed to be defined in terms of finite unions and intersections of polytopes as well as ellipsoids. While the main computations are done in C++, the tool contains a Matlab interface to simulate the closed loop system and to visualize the abstract state space together with the atomic propositions. We illustrate the performance of the tool with two examples from the literature. The tool and all conducted experiments are available at www.hcs.ei.tum.de.

In this paper we propose a compositional construction of approximate abstractions of interconnected control systems. Our notion of approximate abstraction is based on so-called simulation functions. The abstraction acts as substitute in the controller design process and is equipped with an interface that is used in lifting a controller, found for the abstraction, to a controller for the concrete system. The error between the abstraction and the concrete system is quantitatively bounded via the simulation function. In the first part of the paper, we provide conditions which facilitate the compositional construction of abstractions together with simulation functions and the associated interfaces of general interconnected control systems, given the abstractions and the simulation functions with the associated interfaces of the subsystems. In the second part of the paper, we characterize a general simulation function with the associated interface for the subclass of linear control systems. This characterization yields algorithmic procedures for the construction of approximate abstractions. Finally, we illustrate our findings with a simple example consisting of three linear subsystems.

In the past few years different techniques have been developed for constructively deriving symbolic abstractions of (stochastic) control systems. The obtained symbolic models allow us to leverage the apparatus of finite-state reactive synthesis towards the problem of designing hybrid controllers enforcing rich logic specifications over the concrete models. Unfortunately, most of the existing techniques severely suffer from the curse of dimensionality due to the need to discretize state and input sets. In this paper we provide a symbolic abstraction technique for incrementally stable stochastic control systems, which only requires discretizing input sets. We show that for every incrementally stable stochastic control system, and for every given positive precision ε, the discretization of exclusively the input set allows constructing a symbolic model which is ε-approximate bisimilar (in moments) to the original stochastic control system. The details of the proposed technique are elucidated by synthesizing a control policy for a 6-dimensional linear stochastic control system satisfying some logic specifications, which would not be tractable using existing approaches based on state-space discretization.

In this paper, for the first time, we propose a battery- and aging-aware optimization framework for embedded control systems design in electric vehicles (EVs). Performance and reliability of an EV are influenced by feedback control loops implemented into in-vehicle electrical/electronic (E/E) architecture. In this context, we consider the following design aspects of an EV: (i) battery usage, (ii) processor aging of the in-vehicle embedded platform. In this work, we propose a design optimization framework for embedded controllers with gradient-based and stochastic methods taking into account quality of control (QoC), battery usage and processor aging. First, we obtain a Pareto front between QoC and battery usage utilizing the optimization framework. Well-distributed non-dominated solutions are achieved by solving a constrained bi-objective optimization problem. In general, QoC of a control loop highly depends on the sampling period. When the processor ages, on-chip monitors could be used to measure the delay of the critical path, based on which, the processor operating frequency is reduced to ensure correct functioning. As a result, the sampling period gets longer opening up the possibility of QoC deterioration, which is highly undesirable for safety-critical applications in EVs. Utilizing the proposed framework, we take into account the effect of processor aging by re-optimizing the controller design with the prolonged sampling period resulting from processor aging. We illustrate the approach considering electric motor control in EVs. Our experimental results show that the effect of processor aging on QoC deterioration can be mitigated by controller re-optimization with a slight compromise on battery usage.

Software implementations of controllers for physical systems are at the core of many embedded systems. The design of controllers uses the theory of dynamical systems to construct a mathematical control law that ensures that the controlled system has certain properties, such as asymptotic convergence to an equilibrium point, and optimizes some performance criteria such as LQR-LQG. However, owing to quantization errors arising from the use of fixed-point arithmetic, the implementation of this control law can only guarantee practical stability: under the actions of the implementation, the trajectories of the controlled system converge to a bounded set around the equilibrium point, and the size of the bounded set is proportional to the error in the implementation. The problem of verifying whether a controller implementation achieves practical stability for a given bounded set has been studied before. In this paper, we change the emphasis from verification to automatic synthesis. We give a technique to synthesize embedded control software that is Pareto optimal w.r.t. both performance criteria and practical stability regions. Our technique uses static analysis to estimate quantization-related errors for specific controller implementations, and performs stochastic local search over the space of possible controllers using particle swarm optimization. The effectiveness of our technique is illustrated using several standard control system examples: in most examples, we find controllers with close-to-optimal LQR-LQG performance but with implementation errors, hence regions of practical stability, several times as small.

We consider the problem of designing a cyber-physical system where several control loops share the same architectural resources. Typically, the design of such systems proceeds in two steps. In the platform independent step, for each control loop in the system, the control designer calculates a control law and a sampling time that together ensure that the control loop has certain desired performance. Then, in the platform dependent step, these control tasks are scheduled on the platform, and a schedulability analysis determines if (and how) the control laws can be implemented and scheduled without missing the sampling deadlines.

In this paper, a new approach based on hybrid particle swarm-based-simulated annealing optimization (PSO-B-SA) for solving thermal unit commitment (UC) problems is proposed. The PSO-B-SA presented in this paper solves the two sub-problems simultaneously and independently; unit-scheduled problem that determines on/off status of units and the economic dispatch problem for production amount of generating units. Problem formulation of UC is defined as minimization of total objective function while satisfying all the associated constraints such as minimum up and down time, production limits and the required demand and spinning reserve. Simulation results show that the proposed approach can outperform the other solutions.