Taylor Model Flowpipe Construction for Non-linear Hybrid Systems

Abstract

Abstract-We propose an approach for verifying non-linear hybrid systems using higher-order Taylor models that are a combination of bounded degree polynomials over the initial conditions and time, bloated by an interval. Taylor models are an effective means for computing rigorous bounds on the complex time trajectories of non-linear differential equations. As a result, Taylor models have been successfully used to verify properties of non-linear continuous systems. However, the handling of discrete (controller) transitions remains a challenging problem.In this paper, we provide techniques for handling the effect of discrete transitions on Taylor model flowpipe construction. We explore various solutions based on two ideas: domain contraction and range over-approximation. Instead of explicitly computing the intersection of a Taylor model with a guard set, domain contraction makes the domain of a Taylor model smaller by cutting away parts for which the intersection is empty. It is complemented by range over-approximation that translates Taylor models into commonly used representations such as template polyhedra or zonotopes, on which intersections with guard sets have been previously studied. We provide an implementation of the techniques described in the paper and evaluate the various design choices over a set of challenging benchmarks.

A trajectory splicing approach to concretizing counterexamples for hybrid systems

“…Fig. 2 an over-approximation of the set of reachable states computed by the tool Flow* [12]. This over-approximation has a non-empty intersection with X f , allowing us to conclude a potential violation.…”

“…The objective function represents the total cost of the segmented trajectory S. Constraint (6) states that the dwell times are non-negative and bounded by τ min and τ max . Constraint (7) enforces that the initial point of the trajectory is in the initial set, (8) states that x i , y i are within the mode invariants of the respective mode, (9) enforces that y i is the continuous state obtained starting from x i in time τ i , (10) states that all intermediate states of the trajectory segments lie inside the mode invariant of i , (11) describes that the safety property is violated by the end point, the constraint (12) states that y i satisfies the guard of transition δ i and finally (5) defines the cost COST(π i , π i+1 ) as the gaps between the segments. Fig.…”

“…The two models used in our evaluation differ in their treatment of glucose absorption dynamics. Model-A uses linear hybrid glucose gut absorption dynamics, and is taken from our previous work [12]. This is a 6 mode hybrid automaton.…”

“…Unfortunately, checking if a dynamical system (discrete, con- tinuous or hybrid) satisfies a safety property is undecidable for all but the simplest of cases. A number of verification tools for hybrid automata conservatively estimate the set of reachable behaviors (reach set estimation) for establishing safety properties of hybrid systems [4], [5], [12], [24], [30], [34], [36]. If the unsafe region is reachable, these techniques report a plausible abstract error trajectory.…”

“…Likewise, the use of trajectory segments separated by different discrete modes allows us to naturally handle the discontinuities that arise through discrete transitions. Secondly, our approach also separates the search for an abstract violation that can be carried out using tools like SpaceEx [24] or Flow* [12] from the problem of concretizing these violations.…”