Hybrid Systems Analysis of Periodic Control Systems using Continuization

Transcription

1 Hybrid Systems Analysis of Periodic Control Systems using Continuization Stanley Bak Air Force Research Lab Information Directorate June 2015 DISTRIBUTION A. Approved for public release; Distribution unlimited. (Approval AFRL PA # 88ABW , 26 May 2015)

2 Outline Background: RTA and Hybrid Automata Periodically controlled Cyber-Physical Systems Continuization for Analysis 2

3 Run-Time Assurance Run-Time Assurance (RTA) methods protect an untrusted controller with a verified backup The key for safe RTA mechanisms is guarantees the switch to the backup happens while it can still recover RTA Architecture 3

4 RTA Design Extensive Simulation Solving Linear Matrix Inequalities Hybrid Systems Reachability *More details in Sandboxing Controllers for Cyber-Physical Systems, Bak et al., ICCPS

5 Hybrid Automaton Model for of continuous/discrete computation Simulation Reachability 5

6 X (temperature) Flowpipe Construction Flowpipe construction explores the reachable states symbolically θ highest θ high θ low θ lowest Post C Post C Post C Post C Intersection Intersection Intersection Computation Steps 6

7 Continuous Post Track sets of states at different instants in time Continuous Post Operation 7

8 Intersection Overapproximate tracked states when performing intersection operations Leads to some error Overapproximation for Intersection 8

9 Outline Background: RTA and Hybrid Automata Periodically controlled Cyber-Physical Systems Continuization for Analysis 9

10 Periodic Control System Apply a digital controller to a physical system Depending on the implementation, different hybrid automaton representation Strictly Periodic Real-time Scheduled* 10

11 Periodic Control System Reachability Reachability tools experience error on each discrete transition Periodic control systems have lots of discrete transitions Controller may run tens or hundreds of times per second 11

12 Example Simple system: point moving along a line x = vel vel = accel (accel is a PD-controller) Controlled at 20 Hz (T=0.05) Reachability from x=[0,0.1] SpaceEx: Scalable Verification of Hybrid Systems, Frehse et al., CAV 2011 Flow*: An Analyzer for Non-Linear Hybrid Systems, Chen et al., CAV

13 Outline Background: RTA and Hybrid Automata Periodically controlled Cyber-Physical Systems Continuization for Analysis 13

14 Continuization Approximate a quickly-switching discrete system by a continuous system with bounded noise (nondeterminism) Previously used to analyze properties about hardware circuits (phase-locked loops) Key challenge: how much nondeterminism? Formal Verification of Phase-Locked Loops using Reachability Analysis and Continuization, Althoff et al., CACM

15 Continuization of a Sine Wave controller_update(t) = sin(t) t in [0, π] Controller period, T =

16 Process for Sine Wave Example 1. Derivative of sin(t) is cos(t) 2. Bound on cos(t) from 0 to π is K=[-1, 1] 3. Maximum deviation is [-T, 0] * K = [-0.2, 0] * [-1, 1] = [-0.2, 0.2] 16

17 Local Analysis Domains - Example Bound in each domain is [-T, 0] * K i Domains overlap by T = 0.2 (why?) 17

18 Observations Accuracy can be improved either through local analysis domains, or by considering smaller periods (multiply by [-T, 0]) Contrast with reachability of direct models Intuitively, sampling at a higher frequency more closely matches the continuous system Trade-off of analysis domains versus number of discrete transitions (time-triggered support) The continuized system also accounts for variations from real-time scheduling 18

19 Point-Line Example (accuracy can be improved either through local analysis domains, or by considering smaller periods) 19

20 Domain Checks Process is : (1) symbolic derivative (2) compute bounds K in domain (3) multiply [-T, 0] * K Step (2) can be tricky, since if the domain is wrong, the bounds will be wrong. 20

21 Domain Check - Line-Point Example Derivative is vel + 30*x 30, what ranges of x and vel should be considered? Chicken and egg problem X range is [0.05, 1.18] X range is [0, 1.45] 21

22 Domain Check - Line-Point Example (2) Solution: (1) iteratively try bigger values and (2) add check to reachability analysis to ensure domains are respected Both x and velocity domains were too small, and this was detected by the tool. 22

23 Hyst Implementation Continuization was implemented in the Hyst model transformation tool. Input is: Hybrid Automaton Model Description File Controller period T Periodically-Controlled Variable Name Symbolic Derivative (for now) Times for Analysis Domains Bloating Terms for Analysis Domains Time Variable Name (optional) Hyst: A Source Transformation and Translation Tool for Hybrid Automaton Models, Bak et al., HSCC

24 Yaw-Damper for a 747 Aircraft Case study from Matlab control systems toolbox LTI dynamics, MIMO system 2 inputs (rudder, aileron); 2 outputs (yaw rate, bank angle); 5 internal states (sideslip angle, yaw rate, roll rate, bank angle, and washout filter variable) Control goal: prevent oscillations while maintaining spiral mode in aileron-to-bank angle impulse response Yaw Damper Design for a 747 Jet Aircraft 24

25 Yaw-Damper Direct Reachability The spiral mode is the apparent offset in the steady-state in the aileton-to-bank angle impulse response We analyze a real-time scheduled periodic version of this model running at T=0.005 (200Hz) 25

26 Yaw-Damper with Continuization 26

27 Future Directions Local analysis domains based on system state, not just time Automation of iterative approach for domain splitting and choice of bloat terms Different way to analyze controllers than classical control theory; what about design? Application on Toyota Powertrain Benchmark Powertrain control verification benchmark, Jin et al., HSCC

28 Questions?

29 Backup Slides

30 RTA and Hybrid Systems Run-time assurance frameworks must provably constrain the system to a set of allowable states where an unverified, possibly adaptive and nondeterministic controller may actuate the system. Determining this set of states can be done using approaches including extensive simulation, LMI-based computation, or through hybrid systems reachability computation. This talk presents fundamental methods to improve scalability of hybrid systems reachability computations for periodic control systems which interact with a physical system model. In particular, the technique of continuization, that is, abstracting a fast-switching hybrid system by a nondeterministic continuous one, is shown to greatly improve the scalability of hybrid systems reachability tools. The key to this approach is introduce enough nondeterminism to capture all the behaviors of the periodic system, but not too much that the reachable set diverges. This talk discusses methods to ensure such properties.

31 Challenges for Formal System Design and Analysis using Hybrid Automata Tools Chair: Stanley Bak Air Force Research Lab Information Directorate June 2015 DISTRIBUTION A. Approved for public release; Distribution unlimited. (Approval AFRL PA # 88ABW , 26 May 2015)

32 Link with Run-Time Assurance Run-Time Assurance (RTA) methods protect an untrusted controller with a verified backup

33 RTA Design Extensive Simulation Solving Linear Matrix Inequalities Hybrid Systems Reachability

34 X (temperature) Flowpipe Construction Flowpipe construction explores the reachable states symbolically θ highest θ high θ low θ lowest Post C Post C Post C Post C Intersection Intersection Intersection Computation Steps

35 Analysis Methods Simulation Falsification (guided random search) Flow-pipe construction Invariant-based approaches barrier certificates SMT solving Simulation-based reachability

36 Warm Up Who has used reachability or other hybrid systems analysis tools? What was your experience? What stopped you from going further? Was anything lacking in these tools? -or- Why are you interested in Hybrid Systems analysis? Which domains do you see applications? Can you think of any properties you d want to prove that need both a physical and a cyber model?

37 Discussion Questions Are there remaining challenges with low-dimensional problems? Clearly, large models require tools that scale to a large number of variables. Are there also interesting problems for models with 1-4 variables? What are these challenges? Which features are fundamental to problems faced by reachability, such that they should have first-class support inside the tool? For example, time-triggered dynamics, pure discrete variables, urgent transitions, differential inclusions, more complex (discrete) data structures, networked automata support, others? What are the strengths and weaknesses of tools based on SMT solving (dreach, HySat) versus flow-pipe construction methods (SpaceEx, Flow*, HyCreate)? Is there a fair way to compare different reachability tools and methods? What would such a comparison look like? Is the hard part of reachability computation the continuous successors, or the discrete successors? What are the challenges in each? If you have used some of the tools, what was your process of parameter tuning? Could this process be automated, and what would automation require to be programmatically available? Have you used falsification tools (tools which try to find counter-example traces)? What are the most-pressing challenges with these methods?