We propose a methodology for the automatic verification of safety properties of controllers based on dynamical systems, such as those typically used in avionics. In particular, our focus is on proving stability properties of software implementing linear and some non-linear controllers. We develop an abstract interpretation framework that follows closely the Lyapunov methods used in proofs at the model level and describe the corresponding abstract domains, which for linear systems consist of ellipsoidal constraints. These ellipsoidal domains provide abstractions for the values of state variables and must be combined with other domains that model the remaining variables in a program. Thus, the problem of automatically assigning the right type of abstract domain to each variable arises. We provide an algorithm that solves this classification problem in many practical cases and suggest how it could be generalized to more complicated cases. We then find a fixpoint by solving a matrix equation, which in the linear case is just the discrete Lyapunov equation. Contrary to most cases in software analysis, this fixpoint cannot be reached by the usual iterative method of propagating constraints until saturation and so numerical methods become essential. Finally, we illustrate our methodology with several examples.
Beyond the theoretical level, several papers have focused on the analysis at the model level @cite_6 @cite_2 . Among them, the approach most similar to ours was proposed by @cite_15 , who used ellipsoidal calculus to compute overapproximations to the reachability set of controller models. They gave algorithms to estimate unions and intersections of ellipsoids and implemented a tool called VeriSHIFT to automate the reachability computation of models designed with it. Their algorithm has been later improved by @cite_1 .
@cite_15 @cite_1 @cite_6 @cite_2
2162196264 2155596590 2060095702 1530240157
A general verification algorithm is described. It is then shown how ellipsoidal methods developed by A. B. Kurzhanski and P. Varaiya can be adapted to the algorithm. New numerical algorithms that compute approximations of unions of ellipsoids and intersections of ellipsoids and polyhedra were developed. The presented techniques were implemented in the verification tool called VeriSHIFT and some practical results are discussed. A new approach is presented for computing approximations of the reached sets of linear hybrid automata. First, we present some new theoretical results on termination of a class of reachability algorithms, which includes Botchkarev's, based on ellipsoidal calculus. The main contribution of the paper is a revised reachability computation that avoids the approximations caused by the union operation in the discretized flow tube estimation. Therefore, the new algorithm may classify as unreachable states that are reachable according to the previous algorithm because of the looser over-approximations introduced by the union operation. We implemented the new reachability algorithm and tested it successfully on a real-life case modeling a hybrid model of a controlled car engine. Predicate abstraction has emerged to be a powerful technique for extracting finite-state models from infinite-state systems, and has been recently shown to enhance the effectiveness of the reachability computation techniques for hybrid systems. Given a hybrid system with linear dynamics and a set of linear predicates, the verifier performs an on-the-fly search of the finite discrete quotient whose states correspond to the truth assignments to the input predicates. To compute the transitions out of an abstract state, the tool needs to compute the set of discrete and continuous successors, and find out all the abstract states that this set intersects with. The complexity of this computation grows exponentially with the number of abstraction predicates. In this paper we present various optimizations that are aimed at speeding up the search in the abstract state-space, and demonstrate their benefits via case studies. We also discuss the completeness of the predicate abstraction technique for proving safety of hybrid systems.