Verification Techniques and Tools for Reliable Cyber-Physical Systems

Taylor T. Johnson Coordinated Science Laboratory Department of Electrical and Computer Engineering

Verification Challenge

No: bug

Yes: proof

Elevators
Date: Notice: Device: September 20, 2012 #12-750 ThyssenKrupp Access LEV II, Volant, Rise Units: ~670 Problem: elevators door can unlock and open at a landing with no elevator car present, exposing the elevator shaft and posing a fall hazard to consumers Remedy: software update

[Consumer Product Safety Commission (CPSC), Alert #12-750, http://www.cpsc.gov] Image: [http://www.tkaccess.com/home-elevators/volant/homeElevators_volant.aspx]

Fire Alarms and Controls

Date: February 15, 2012 Notice: #12-721 Device: Bosch FPA-1000-UL Units: ~330 Problem: control panel can fail to sound an alarm if a fire occurs Remedy: software update

[Consumer Product Safety Commission (CPSC), Alert #12-721, http://www.cpsc.gov]

Fire Alarms and Controls

Date: Notice: Device: February 8, 2011 #11-721 Tyco Safety Products / SimplexGrinnell Simplex 4100U-NXP Units: ~540 Problem: can fail to send a signal to alert monitoring centers in the event of a fire Remedy: software update

[Consumer Product Safety Commission (CPSC), Alert #11-721, http://www.cpsc.gov]

Fire Alarms and Controls

Date: Notice: Device: October 5, 2010 #11-702 Honeywell Fire-Lite Alarms MS-9600LS Units: ~530 Problem: can fail to sound an alarm in the event of a fire Remedy: software update

[Consumer Product Safety Commission (CPSC), Alert #11-702, http://www.cpsc.gov]

(Non-Autonomous) Cars
Date: May 31, 2005 Notice: #PE05029 Device: Toyota Prius (2004-2005) Units: ~75,000 Problem: reports allege that the gasoline engine shut down suddenly without warning Remedy: electronic control module (ECM) software update

[National Highway Traffic Safety Administration (NHTSA), Investigation #PE05029, www.safercar.gov] Image: [http://www.netcarshow.com/toyota/2004-prius/1024x768/wallpaper_13.htm]

(Non-Autonomous) Cars
Date: Notice: Device: August 4, 2011 #11V395 Honda Accord (20052010), CR-V (2007-2010), Element (2005-2008) Units: ~1.5 million US (~2.5 million globally) Problem: may cause an engine stall and/or cause the vehicle to move when the gear selector is in park Remedy: update to automatic transmission control module (TCM) software
[NHTSA, Recall Notice #11V395, http://www.safercar.gov/] Image: [http://www.netcarshow.com/honda/2010-accord_crosstour/800x600/wallpaper_02.htm]

Cyber-Physical Defects

Physical Specification

Cyber Specification

[Defect Notice, Aug. 3, 2011, Part 573, http://www-odi.nhtsa.dot.gov/acms/cs/jaxrs/download/doc/ACM17689918/RCDNN-11V395-2852.pdf] 9

My Research

Robotics

Aerospace

*RTSS12, JNSA11, *FM12, ICCPS12, ICDCS10, SSS10+ FORTE12*] Formal Hybrid & Verification: Nonlinear Distributed Dynamical Embedded Systems Systems
*RTSS12, FORTE12*, ICDCS10+ *FM12, CDC11, PECI13, PECI12, PECI11*+

Power and Energy

*PECI13, PECI12, PECI11*+ *Best Paper Award
10

Outline
Parameterized Verification of Distributed Cyber-Physical Systems (CPS)
The Passel Verification Tool Finding Inductive Invariants Proving Inductive Invariants
No: bug Yes: proof

Reachability Analysis for Models with Uncertain Parameters

Research Directions
11

Parameterized Verification

Yes: proof

12

Motivational Example

Video: [ZHAW School of Engineering, 2008, http://radar.zhaw.ch/]

13

Small Aircraft Transportation System (SATS)

NASA/FAA NextGen Programs SATS Minimal central infrastructure

Airport Management Module (AMM)

Distributed air traffic

control

[Abbott et al., NASA Tech Report NASA/TP-2006-214512, 2006]

14

Small Aircraft Transportation System Basics

Overhead Geometry and Protocol
initiate landing protocol start approach miss

land

15

Discrete States

1.0E+28 1.0E+21 1.0E+14 1.0E+07 1.0E+00 1 3 5 7 9 11 13 15

16

1 3

17

Outline
Parameterized Verification of Distributed Cyber-Physical Systems (CPS)
The Passel Verification Tool Finding Inductive Invariants Proving Inductive Invariants
No: bug Yes: proof

Reachability Analysis for Models with Uncertain Parameters

Research Directions
18

Invariants and Inductive Invariants

State Space

19

Inductive Invariance Checks

[T. Johnson, S. Mitra, IFIP FORTE 2012]

20

Small Model Theorem Intuition & Interpretation

Technical Statement: Theorem actually about size of satisfying assignments for syntactically restricted first-order logic formulas encoding inductive invariance conditions 1.0E+28

Discrete States

1.0E+21
1.0E+14 1.0E+07 1.0E+00 1 3 5 7 9 11 13 15

[T. Johnson, S. Mitra, IFIP FORTE 2012]

21

Outline
Parameterized Verification of Distributed Cyber-Physical Systems (CPS)
The Passel Verification Tool Finding Inductive Invariants Proving Inductive Invariants
No: bug Yes: proof

Reachability Analysis for Models with Uncertain Parameters

Research Directions
22

Synthesizing Inductive Invariants

[T. Johnson, S. Mitra, SPIN 2013 (Under Review)]

23

Project-and-Generalize Example

project-and-generalize

[T. Johnson, S. Mitra, SPIN 2013 (Under Review)]

24

Outline
Parameterized Verification of Distributed Cyber-Physical Systems (CPS)
The Passel Verification Tool Finding Inductive Invariants Proving Inductive Invariants No: bug Yes: proof

Reachability Analysis for Models with Uncertain Parameters

Research Directions
25

The Passel Verification Tool

passel (noun): a large group of things of indeterminate number

Yes: proof

Project and generalize

No: counterexample

Passel backend: Microsoft Researchs Z3 satisfiability modulo theories (SMT) solver

26

Experiments
SATS Properties Time (s) 0.586 0.757 6 6 2 2 1 1

0.467

Fischer Mutual Exclusion Properties

Time (s)

0.396
0.435 0.414

6
6 6

2
2 2

1
1 1

[T. Johnson, S. Mitra, IFIP FORTE 2012]

27

Synthesized Inductive Invariants

[T. Johnson, S. Mitra, SPIN 2013 (Under Review)]

28

Outline
Parameterized Verification of Distributed Cyber-Physical Systems (CPS)
The Passel Verification Tool Finding Inductive Invariants Proving Inductive Invariants
No: bug Yes: proof

Reachability Analysis for Models with Uncertain Parameters

Research Directions
29

Reachability Analysis for Models with Uncertain Parameters

No: bug

Yes: proof

S VS

L + iL C + Vc R Vo L

L VS
[T. Johnson, Z. Hong, A. Kapoor, IEEE PECI 2012] [S. Hossain, S. Dhople, T. Johnson, IEEE PECI 2013]

iL

+ + R Vc Vo -

+ iL C + Vc R Vo 30

Buck-Converter Example
Parameter variation Transform interval linear system to linear hybrid system with setvalued inputs Verify using reachability

Component Symbol Range Resistor Capacitor Inductor

[T. Johnson, Z. Hong, A. Kapoor, IEEE PECI 2012] [S. Hossain, S. Dhople, T. Johnson, IEEE PECI 2013] 31

Outline
Parameterized Verification of Distributed Cyber-Physical Systems (CPS)
The Passel Verification Tool Finding Inductive Invariants Proving Inductive Invariants
No: bug Yes: proof

Reachability Analysis for Models with Uncertain Parameters

Research Directions
32

Webberville Solar Farm

Image: [http://stateimpact.npr.org/texas/2012/01/09/largest-solar-farm-in-texas-opens/]
33

Parameterized Smart Grid Applications: Power Converters for Renewables

Vdc
. . Vo .

Vdc

34

Parameterized Smart Grid Applications: Demand Response

Image: [http://www.lbl.gov/Science-Articles/Archive/sabl/2008/Feb/ADR.html] 35

Parameterized Cloud Computing Applications: Green Server Farm Load Balancing

[Images: http://www.rackspace.com/cloud/hybrid/ http://www.rackspace.com/cloud/load-balancing/technology/]

36

Verification for Distributed CPS Traces

[P. S. Duggirala, T. Johnson, A. Zimmerman, S. Mitra, IEEE RTSS 2012]

37

Acknowledgements
Research Funding Support NSF, AFOSR, Boeing, Rockwell Collins, John Deere, Schlumberger Dissertation Committee Prof. Sayan Mitra Prof. Tarek F. Abdelzaher Prof. Daniel Liberzon Prof. William H. Sanders Prof. Mahesh Viswanathan
Collaborators and Labmates Illinois ECE: Shamina Hossain, Zhihao (Ted) Hong, Akash Kapoor, Adam Zimmerman, Debjit Pal, Adel Ahmadyan Illinois CS: Stanley Bak, Parasara Sridhar Duggirala Zhenqi Huang (Illinois ME), Prof. Sairaj Dhople (Minnesota ECE), Dr. Albert Hoefel (Schlumberger), Prof. Cedric Langbort (Illinois AE), Karthik Manamcheri (National Instruments), Dr. Richard Scott Erwin (AFRL), Rachel Dudley (Iowa State ME)

38

Thank You

Robotics

Aerospace

*RTSS12, JNSA11, *FM12, ICCPS12, ICDCS10, SSS10+ FORTE12*] Formal Hybrid & Verification: Nonlinear Distributed Dynamical Embedded Systems Systems

Power and Energy

*PECI13, PECI12, PECI11*+ *Best Paper Award
39

extra slides

40