Proofs from simulations and modular annotations

Abstract

We present a modular technique for simulation-based bounded verification for nonlinear dynamical systems. We introduce the notion of input-to-state discrepancy of each subsystem Ai in a larger nonlinear dynamical system A which bounds the distance between two (possibly diverging) trajectories of Ai in terms of their initial states and inputs. Using the IS discrepancy functions, we construct a low dimensional deterministic dynamical system M (δ). For any two trajectories of A starting δ distance apart, we show that one of them bloated by a factor determined by the trajectory of M contains the other. Further, by choosing appropriately small δ's the overapproximations computed by the above method can be made arbitrarily precise. Using the above results we develop a sound and relatively complete algorithm for bounded safety verification of nonlinear ODEs. Our preliminary experiments with a prototype implementation of the algorithm show that the approach can be effective for verification of nonlinear models.

Cyber-physical specification mismatch identification with dynamic analysis

“…For discrete or discretized systems, translations to formal models like extended input/output automata have been developed [19]. Some recent simulation-based verification, testing, and falsification approaches in hybrid systems and CPS like those in S-TaLiRo, Breach, and C2E2 can be viewed as forms of dynamic analysis (potentially with additional annotations and proof steps) [26,28,29,[39][40][41]. Additionally, there are alternative methods for finding specifications for SLSF models [29,39].…”

Invariant Verification of Nonlinear Hybrid Automata Networks of Cardiac Cells

“…First of all, we will use the definition of Input-to-State (IS) discrepancy function [27], which enables us to use annotations for individual modules in a dynamical system to then check invariants of the composed system. The IS discrepancy function for a location of A (or for a dynamical system) bounds the distance between two trajectories in location from different initial states, as a function of time and the inputs they receive.…”

“…The result is generalized to dynamical systems with N modules connected in general network topologies [27], where the IS approximation is (N + 1)-dimensional.…”

“…The resulting algorithm enjoys scalability and relative completeness: if the system satisfies the invariant robustly, then the algorithm is guaranteed to terminate. The burden of finding discrepancy functions for large models is partly alleviated in [27] for nonlinear differential equations. That paper proposes input-to-state (IS) discrepancy functions for each module A i of a larger system A = A 1 .…”

Simulation-Based Verification of Cardiac Pacemakers With Guaranteed Coverage

“…Further, it is important that the over-approximation can be made more precise so that false positives can be eliminated. To turn this idea into an algorithm, we introduced the notion of discrepancy which (a) upper bounds the distance between two neighboring behaviors and (b) the bound converges to zero as the parameter choices for the two behaviors get closer and closer [6], [8]. It has been shown that, for an expressive class of models, indeed one can find discrepancy functions that meet these criteria [7].…”