c2e2: a tool for verifying stateflow models
TRANSCRIPT
C2E2: A Verification Tool For Stateflow Models
Parasara Sridhar Duggirala, Sayan Mitra, Mahesh Viswanathan, Matthew Potok
Pacemaker โ Cardiac Cell System
2
+
Pacemaker โ Cardiac Cell System
3
๐0
๐2๐3โฆ
stimulatingpulse
Pacemaker๐1
HA = Finite State Machine + Differential Equation
time
๐ข(๐ก) ๐ฅ1(๐ก)
time
Stimulus from pacemaker Behavior of a cardiac cell
Safety Verification
Inputs: 1. Model of the system ๐ด,2. Initial States ฮ, and 3. Unsafe States ๐
Output: If the system is safe or unsafeโ๐ฅ โ ฮ, ๐ ๐ฅ, ๐ก โ ๐
4
๐ฅ1(๐ก)
time
Unsafe Set
Stateflow Model of Pacemaker โ Cardiac Cell systemFeatures: Invariants, Guards, and Resets
SolutionReachable Set Computation
Features of the Model
Contributions
Simulation based verification algorithm for Fully Hybrid Systems
Theoretical guarantees โ Soundness and Relative Completeness
Tool Featuresโข Stateflow Models, hyxml intermediate formatโข Graphical User Interfaceโข Visualizing the reachable set
5
Overview
Motivation and Problem Statement
Challenges in Verification
Building Blocks and Algorithm
Soundness and Relative Completeness Guarantees
Tool Features
Annotations
Future Work
6
Safety Verification
Inputs: 1. Model of the system ๐ด,2. Initial States ฮ, and 3. Unsafe States ๐
Output: If the system is safe or unsafeโ๐ฅ โ ฮ, ๐ ๐ฅ, ๐ก โ ๐
7
๐ข(๐ก)
time
Unsafe Set
Stateflow Model of Pacemaker โ Cardiac Cell systemFeatures: Invariants, Guards, and Resets
SolutionReachable Set Computation
Challenges In Reachable Set Computation
Nonlinear ODEs โ do not even have a closed form solution
Switching conditions โ predicates on variables (nondeterminism)
8
Our Technique: Use simulations for computing Reachable Set
๐ข(๐ก)
time
Unsafe Set
Stateflow Model of Pacemaker โ Cardiac Cell systemFeatures: Invariants, Guards, and Resets
9
Given start and unsafe
Compute finite cover of initial set
Simulate from the center ๐ฅ0 of each cover
Bloat simulation so that bloated tube contains all trajectories from the cover
Union = over-approximation of reach set
ฮ
๐ฅ0
๐
A Simple (Often The Only) Strategy
แถ๐ฅ = ๐(๐ฅ)
๐ต๐(๐(๐ฅ0, ๐ก))
10
Given start and unsafe
Compute finite cover of initial set
Simulate from the center ๐ฅ0 of each cover
Bloat simulation so that bloated tube contains all trajectories from the cover
Union = over-approximation of reach set
Check intersection/containment with ๐
Refine
ฮ
๐ฅ0
๐
A Simple (Often The Only) Strategy
แถ๐ฅ = ๐(๐ฅ)
๐ต๐(๐(๐ฅ0, ๐ก))
11
Given start and unsafe
Compute finite cover of initial set
Simulate from the center ๐ฅ0 of each cover
Bloat simulation so that bloated tube contains all trajectories from the cover
Union = over-approximation of reach set
Check intersection/containment with ๐
Refine
ฮ
๐ฅ0
๐
A Simple (Often The Only) Strategy
แถ๐ฅ = ๐(๐ฅ)
๐ต๐(๐(๐ฅ0, ๐ก))
12
Given start and unsafe
Compute finite cover of initial set
Simulate from the center ๐ฅ0 of each cover
Bloat simulation so that bloated tube contains all trajectories from the cover
Union = over-approximation of reach set
Check intersection/containment with ๐
Refine
1. How do we get the simulations?
2. How much to bloat?
3. How to handle mode switches?
ฮ
๐ฅ0
๐
A Simple (Often The Only) Strategy
แถ๐ฅ = ๐(๐ฅ)
๐ต๐(๐(๐ฅ0, ๐ก))
Building Blocks : Simulations
Simulation from ๐ฅ0 given as ๐(๐ฅ0, ๐ก) โ no closed form!
13
๐๐๐๐๐๐๐๐๐๐(๐๐, ๐, ๐, ๐ป) gives a sequence S0, โฆ , ๐๐:1. at any time ๐ก โ [๐โ, ๐ + 1 โ], ๐ ๐ฅ0, ๐ก โ ๐๐2. ๐๐๐ ๐๐ โค ๐
๐๐๐๐บ๐๐(๐๐, ๐ป, ๐) generates such simulations (CAPD)
Building Blocks : Discrepancy Function
Discrepancy Function: capturing the continuity of ODE solutionsexecutions that start close, stay close
โจ๐พ, ๐พโฉ is called an exponential discrepancy function of the system if for any two states ๐ฅ1 and ๐ฅ2 โ ๐, for any t |๐(๐ฅ1, ๐ก) โ ๐(๐ฅ2, ๐ก)| โค ๐พ ๐ฅ1 โ ๐ฅ2 ๐
๐พ๐ก
14
|๐ฅ1 โ ๐ฅ2|
๐ฅ1
๐ฅ2๐ ๐ฅ2, ๐ก
๐ ๐ฅ1, ๐ก
โค ๐พ ๐ฅ1 โ ๐ฅ2 ๐๐พ๐ก1
= ๐พ ๐ฅ1 โ ๐ฅ2 ๐๐พ๐ก1
Discrepancy functions are given as model annotations, i.e. โจ๐พ, ๐พโฉ is given by the user
Simulations + Discrepancy Functions = ReachTubes
๐ = ๐๐๐๐๐๐๐๐๐ ๐บ, ๐, ๐ป of แถ๐ฅ = ๐ ๐ฅ is a sequence ๐ 0, โฆ , ๐ ๐ such that ๐๐๐(๐ ๐) โค ๐ and from any ๐ฅ0 โ ๐, for each time ๐ก โ [๐โ, (๐ + 1)โ], ๐ ๐ฅ0, ๐ก โ ๐ ๐ .
How to compute a ReachTube from validated simulation and annotation?
๐0, โฆ , ๐๐ , ๐1 โ ๐๐๐๐บ๐๐(๐ฅ0, ๐, ๐)
15
Simulations + Discrepancy Functions = ReachTubes
๐ = ๐๐๐๐๐๐๐๐๐ ๐บ, ๐, ๐ป of แถ๐ฅ = ๐ ๐ฅ is a sequence ๐ 0, โฆ , ๐ ๐ such that ๐๐๐(๐ ๐) โค ๐ and from any ๐ฅ0 โ ๐, for each time ๐ก โ [๐โ, (๐ + 1)โ], ๐ ๐ฅ0, ๐ก โ ๐ ๐ .
How to compute a ReachTube from validated simulation and annotation?
๐0, โฆ , ๐๐ , ๐1 โ ๐๐๐๐บ๐๐(๐ฅ0, ๐, ๐)
For each ๐ โ ๐๐2 โ max
๐กโ๐๐๐พ๐๐พ๐ก๐ฟ;
๐ ๐ โ ๐ต๐2 ๐๐
๐ 0, โฆ , ๐ ๐ is a reachtube(๐ฉ๐น ๐๐ , ๐๐ + ๐๐, ๐ป)
16
How do we get the simulations? How much to bloat?โข How to handle mode switches?
Invariants
Guards
Handling Invariants
Tagging: track a region based on a predicate ๐
๐๐๐๐น๐๐๐๐๐ ๐น,๐ท = แ๐๐ข๐ ๐ก ๐ โ ๐๐๐๐ฆ ๐ โฉ ๐ โ โ , เดค๐ โฉ ๐ โ โ ๐๐๐ก ๐ โฉ ๐ = โ
๐ = ๐๐๐๐๐๐๐๐๐๐ท๐๐๐๐๐(๐, ๐ฐ๐๐๐๐๐๐๐๐) is
โจ๐ 0, ๐ก๐๐0, โฆ , ๐ ๐, ๐ก๐๐๐โฉ , such that either
๐ก๐๐๐ = ๐๐ข๐ ๐ก if all the ๐ ๐โฒ๐ before it are must
๐ก๐๐๐ = ๐๐๐ฆ if all the ๐ ๐โฒ๐ before it are tagged may or must and at least one of
them is not must
17
Goal: Reachtube that respects the invariant of the mode
Handling Guards & Resets
๐๐๐๐๐น๐๐๐๐๐๐(๐) returns a set of tagged regions N.
๐ โฒ, ๐ก๐๐โฒ โ ๐ iff โ ๐ โ ๐ด, โจ๐ ๐ , ๐ก๐๐๐โฉ โ ๐ such that ๐ โฒ = ๐ ๐๐ ๐๐ก๐ ๐ ๐ and:๐ ๐ โ ๐บ๐ข๐๐๐๐ , ๐ก๐๐๐ = ๐ก๐๐โฒ = ๐๐ข๐ ๐ก๐ ๐ โฉ ๐บ๐ข๐๐๐๐ โ โ , ๐ ๐ โ ๐บ๐ข๐๐๐๐ , ๐ก๐๐๐ = ๐๐ข๐ ๐ก, ๐ก๐๐โฒ = ๐๐๐ฆ๐ ๐ โฉ ๐บ๐ข๐๐๐๐ โ โ , ๐ก๐๐๐ = ๐ก๐๐โฒ = ๐๐๐ฆ
Tagging is essentially bookkeeping
1. ๐๐๐ฃ๐๐๐๐๐๐ก๐๐๐๐๐๐ฅ discards the invalid trajectories (violating invariant)
2. ๐๐๐ฅ๐ก๐ ๐๐๐๐๐๐ tags the regions based on the feasibility of discrete transition
Utility of tagging
1. Reachable set is contained in union of may and must regions โ inferring safety
2. There exists at least one reachable state in every must region โ inferring violation of safety
18
Goal: Compute set of states in Reachtube that change mode based on Guard
Algorithm for Hybrid Systems
Input: Initial Set ฮ, Unsafe set ๐, Time ๐, Number of Switches ๐
๐๐๐๐ก๐๐ก๐๐๐ โ ๐ก๐๐๐๐๐๐ถ๐๐ฃ๐๐(ฮ)
โ โจ๐, ๐ก๐๐โฉ โ ๐๐๐๐ก๐๐ก๐๐๐
๐ โ ๐๐๐๐โ๐๐ข๐๐(๐, ๐)
end;
19
๐ฅ0
Algorithm for Hybrid Systems
Input: Initial Set ฮ, Unsafe set ๐, Time ๐, Number of Switches ๐
๐๐๐๐ก๐๐ก๐๐๐ โ ๐ก๐๐๐๐๐๐ถ๐๐ฃ๐๐(ฮ)
โ โจ๐, ๐ก๐๐โฉ โ ๐๐๐๐ก๐๐ก๐๐๐
๐ โ ๐๐๐๐โ๐๐ข๐๐(๐, ๐)
๐ โ ๐๐๐ฃ๐๐๐๐๐๐ก๐๐๐๐๐๐ฅ(๐)
end;
20
invariant
Algorithm for Hybrid Systems
Input: Initial Set ฮ, Unsafe set ๐, Time ๐, Number of Switches ๐
๐๐๐๐ก๐๐ก๐๐๐ โ ๐ก๐๐๐๐๐๐ถ๐๐ฃ๐๐(ฮ)
โ โจ๐, ๐ก๐๐โฉ โ ๐๐๐๐ก๐๐ก๐๐๐
๐ โ ๐๐๐๐โ๐๐ข๐๐(๐, ๐)
๐ โ ๐๐๐ฃ๐๐๐๐๐๐ก๐๐๐๐๐๐ฅ(๐)
if (๐ is safe) then continue;
if (๐ is unsafe and ๐ก๐๐ is ๐๐ข๐ ๐ก) return unsafe;
else refine tagged cover;
end;
return safe;21
invariant
Algorithm for Hybrid Systems
Input: Initial Set ฮ, Unsafe set ๐, Time ๐, Number of Switches ๐
๐๐๐๐ก๐๐ก๐๐๐ โ ๐ก๐๐๐๐๐๐ถ๐๐ฃ๐๐(ฮ)
โ โจ๐, ๐ก๐๐โฉ โ ๐๐๐๐ก๐๐ก๐๐๐
๐ โ ๐๐๐๐โ๐๐ข๐๐(๐, ๐)
๐ โ ๐๐๐ฃ๐๐๐๐๐๐ก๐๐๐๐๐๐ฅ(๐)
if (๐ is safe) then continue;
if (๐ is unsafe and ๐ก๐๐ is ๐๐ข๐ ๐ก) return unsafe;
else refine tagged cover;
end;
return safe;22
guard
Algorithm for Hybrid Systems
Input: Initial Set ฮ, Unsafe set ๐, Time ๐, Number of Switches ๐
๐๐๐๐ก๐๐ก๐๐๐ โ ๐ก๐๐๐๐๐๐ถ๐๐ฃ๐๐(ฮ)
โ โจ๐, ๐ก๐๐โฉ โ ๐๐๐๐ก๐๐ก๐๐๐
๐ โ ๐๐๐๐โ๐๐ข๐๐(๐, ๐)
๐ โ ๐๐๐ฃ๐๐๐๐๐๐ก๐๐๐๐๐๐ฅ(๐)
๐๐๐ฅ๐ก โ ๐๐๐ฅ๐ก๐ ๐๐๐๐๐๐ (๐)
if (๐ is safe) then check ๐๐๐ฅ๐ก;
if (๐ is unsafe and ๐ก๐๐ is ๐๐ข๐ ๐ก) return unsafe;
else refine tagged cover;
end;
return safe;23
guard
Algorithm for Hybrid Systems
Input: Initial Set ฮ, Unsafe set ๐, Time ๐, Number of Switches ๐
๐๐๐๐ก๐๐ก๐๐๐ โ ๐ก๐๐๐๐๐๐ถ๐๐ฃ๐๐(ฮ)
โ โจ๐, ๐ก๐๐โฉ โ ๐๐๐๐ก๐๐ก๐๐๐
๐๐ข๐๐ข๐๐ ๐๐๐๐๐๐ โ {โจ๐, ๐ก๐๐โฉ}
โ ๐, ๐ก๐๐ โ ๐๐ข๐๐ข๐๐ ๐๐๐๐๐๐ until ๐ steps and ๐ time
๐ โ ๐๐๐๐โ๐๐ข๐๐(๐, ๐)
๐ โ ๐๐๐ฃ๐๐๐๐๐๐ก๐๐๐๐๐๐ฅ(๐)
๐๐๐ฅ๐ก โ ๐๐๐ฅ๐ก๐ ๐๐๐๐๐๐ (๐)
if (๐ is safe) enque ๐๐๐ฅ๐ก to ๐๐ข๐๐ข๐๐ ๐๐๐๐๐๐ ;
if (๐ is unsafe and ๐ก๐๐ is ๐๐ข๐ ๐ก) return unsafe;
else refine tagged cover;
end;
end;
return safe;24
guard
Soundness & Relative Completeness
[Soundness]: If the algorithm returns safe(or unsafe), then the system is indeed safe(or unsafe).
Proof sketch:
1. Union of May and Must regions contains the reachable set
2. Algorithm returns safe only when all the May and Must regions are safe
3. Algorithm returns unsafe only when a Must region is contained in the unsafe set
25
Soundness & Relative Completeness
[Relative Completeness]: If the system is robustly safe or robustly unsafe, then the algorithm will terminate with correct answer.
DefinitionRobustly safe: If there is ๐ separation between reachable set and ๐
Robustly unsafe: If ๐ shrinkage of invariants, guards, and initial set ฮ, is unsafewith respect to ๐ shrinkage of ๐
Proof sketch:
1. Refining the cover enough will ensure that overapproximation is less than ๐, so if the system is robustly safe, the algorithm returns safe
2. If the ๐ shrinkage of invariants, guards, ฮ, and ๐ is unsafe, then โ ๐ ๐ tagged ๐๐ข๐ ๐ก in the reachable that is unsafe
26
Overview
Motivation and Problem Statement
Challenges in Verification
Building Blocks and Algorithm
Soundness and Relative Completeness Guarantees
Tool Features
Annotations
Future Work
27
C2E2 :Compare-Execute-Check-Engine
Features:โข Stateflow modelsโข Graphical User Interfaceโข Plotting
28
Architecture of C2E2
๐ก โฅ 5; ๐ก = 0
C2E2: Features, Architecture, & Usability
Stateflow models: No formal semantics from MATHWORKS, Hybrid automata semantics by Tiwari [โ02], Manamcheri et.al.[โ10]
Urgent semantics:
Bloating the guard set: for providing robust counterexamples
๐ก โฅ 5 โ ๐ก โฅ 5 โ ๐, ๐ก โค 5 + ๐
29
C2E2: Features, Architecture, & Usability
30
โข GUI for viewing model, propertiesโข Saving model in hyxml formatโข Interface for plotting reachable set
More in the Tool Demo Market
Comparison with Existing Approaches on Academic Benchmarks [DMVโ13]
31
Benchmark Variables Sims. C2E2(time)
Flow*(time)
Ariadne(time)
Moore-G. Jet Engine 2 36 1.56 10.54 56.57
BrussellatorSystem 2 115 5.26 16.77 72.75
VanDerPolOscillator 2 17 0.75 8.93 98.36
Coupled VanDerPol 4 62 1.43 90.96 270.61
Sinusoidal Tracking 6 84 3.68 48.63 763.32
Linear Adaptive 3 16 0.47 NA NA
Nonlinear Adaptive 2 32 1.23 NA NA
Nonlinear Disturbance 3 48 1.52 NA NA
C2E2 Flow*
Discrepancy Functions โ Model Annotations
Sufficient conditions for finding discrepancy functions (borrowed from Control Theory)โข Lipschitz continuity: แถ๐ฅ = ๐(๐ฅ) has Lipschitz constant ๐ฟ, then ๐ฅ1(๐ก) โ ๐ฅ2(๐ก) โค |๐ฅ1 โ ๐ฅ2|๐
๐ฟ๐ก
โข Contraction Metric: If ๐ฝ๐๐+๐ ๐ฝ + ๐๐๐ โผ 0, then โ๐, ๐ฟ > 0, ๐ฅ1 ๐ก โ ๐ฅ2 ๐ก 2 โค ๐ ๐ฅ1 โ ๐ฅ22๐โ๐ฟ๐ก
โข Incremental Lyapunov Function: With function ๐, then ๐ฅ1 ๐ก โ ๐ฅ2(๐ก) โค ๐ ๐ฅ1 โ ๐ฅ2 ; ๐ = ๐น(๐)
Finding such discrepancy function automaticallyโข Nonlinear optimization for Lipschitz continuityโข For แถ๐ฃ = ๐ด๐ฃ that are exponentially stable, compute Lyapunov functionโข Solving LMIs using Sum-Of-Squares tools to compute contraction metricโข Manual proof methods using coordinate transformation and eigen values of Jacobian 32
Exponential discrepancy functionโจ๐พ = 3.8, ๐พ = โ0.2โฉ
Summary & Future Work
Simulation based verification algorithm for Fully Hybrid Systems
Soundness and Relative completeness guarantees
Tool features:โข Stateflow modelsโข GUI and usability enhancementsโข Plotting for visualizing reachable set
Future Work
Automatically finding discrepancy functions
Theoretical Result: Minimum number of simulations to verify a given system
33Thank You, Questions?