Automated Software Synthesis for Cyber-Physical Systems

Automated Software Synthesis for Cyber-Physical Systems Indranil Saha UC Berkeley and UPenn Indranil Saha Automated Software Synthesis for CPS 1/53

Cyber Physical Systems Indranil Saha Automated Software Synthesis for CPS 2/53

Cyber Physical Systems The systems are mostly life-critical or mission-critical Indranil Saha Automated Software Synthesis for CPS 2/53

Embedded Control Software: The Weak Link u Plant x' = f(x, u) x Actuator Sensor Controller u = k(x) Control System Plant Controller Indranil Saha Automated Software Synthesis for CPS 3/53

Embedded Control Software: The Weak Link u Plant x' = f(x, u) x Actuator Sensor Controller u = k(x) Control System 1962 Mariner I Space Probe Malfunction Plant Controller Indranil Saha Automated Software Synthesis for CPS 3/53

Embedded Control Software: The Weak Link u Plant x' = f(x, u) x Actuator Sensor Controller u = k(x) Control System 1962 Mariner I Space Probe Malfunction Plant 1991 The Patriot Missile Failure Controller Indranil Saha Automated Software Synthesis for CPS 3/53

Embedded Control Software: The Weak Link u Plant x' = f(x, u) x Actuator Sensor Controller u = k(x) Control System 1962 Mariner I Space Probe Malfunction Plant 1991 The Patriot Missile Failure Controller 1995 Ariane 5 Flight 501 Explosion Indranil Saha Automated Software Synthesis for CPS 3/53

Embedded Control Software: The Weak Link u Plant x' = f(x, u) x Actuator Sensor Controller u = k(x) Control System 1962 Mariner I Space Probe Malfunction Plant 1991 The Patriot Missile Failure Controller 1995 Ariane 5 Flight 501 Explosion 2014 Toyota Prius Recall Indranil Saha Automated Software Synthesis for CPS 3/53

Embedded Control Software: The Weak Link u Plant x' = f(x, u) x Today in aerospace industry, control software design, implementation, and testing account for over 60% of the total development cost of an aircraft Sensor (Source: Lockheed Martin Aeronautics Company) Actuator Controller u = k(x) Control System 1962 Mariner I Space Probe Malfunction Plant 1991 The Patriot Missile Failure Controller 1995 Ariane 5 Flight 501 Explosion 2014 Toyota Prius Recall... Indranil Saha Automated Software Synthesis for CPS 3/53

Future Cyber-Physical Systems Aerospace Automatic air-traffic controller Automotive Self driving car Delivery Delivery by UAVs HealthCare Surgical robots Agriculture Automatic harvestation Entertainment Robot soccer Indranil Saha Automated Software Synthesis for CPS 4/53

Future Cyber-Physical Systems Aerospace Automatic air-traffic controller Automotive Self driving car Delivery Delivery by UAVs HealthCare Surgical robots Agriculture Automatic harvestation Entertainment Robot soccer More Automation.. More reliance on Software.. Indranil Saha Automated Software Synthesis for CPS 4/53

Future Cyber-Physical Systems Aerospace Automatic air-traffic controller Automotive Self driving car Delivery Delivery by UAVs HealthCare Surgical robots Agriculture Automatic harvestation Entertainment Robot soccer More Automation.. More reliance on Software.. Need of the hour: More Automation in Software Development Indranil Saha Automated Software Synthesis for CPS 4/53

Research Goal Research Goal To devise tools and technologies to build high-assurance software for cyber-physical systems (CPSs) Focus Automated Software Synthesis Indranil Saha Automated Software Synthesis for CPS 5/53

Example: Multi-Robot Motion Planning y I2 I1 I3 I4 x F2 F1 F3 F4 Goal: I1 F1, I2 F2, I3 F3, I4 F4 Requirements: Maintain a rectangular formation Maintain a precedence relationship Maintain a minimum distance Indranil Saha Automated Software Synthesis for CPS 6/53

Planning, Control and Computing Hierarchy Artificial Intelligence Formal Methods Control Theory Scheduling Theory Software Engineering High-Level Planning Control Algorithm Design Real-Time Software Implementation Compositional motion planning for dynamic robots Synthesis of Embedded Control Software Indranil Saha Automated Software Synthesis for CPS 7/53

Planning, Control and Computing Hierarchy Artificial Intelligence Formal Methods Control Theory Scheduling Theory Software Engineering High-Level Planning Control Algorithm Design Real-Time Software Implementation Compositional motion planning for dynamic robots Synthesis of Embedded Control Software Research Focus Automated Synthesis with the aid of Formal Methods + Control Theory + Scheduling Theory + Software Engineering Indranil Saha Automated Software Synthesis for CPS 7/53

Outline Background on Synthesis Compositional Motion Planning Control Software Synthesis Ongoing and Future Work Indranil Saha Automated Software Synthesis for CPS 8/53

Program Synthesis Specification System Information Synthesis Tool (SMT Solver) Program Indranil Saha Automated Software Synthesis for CPS 10/53

Program Synthesis Specification System Information Synthesis Tool (SMT Solver) Program Synthesized program is correct-by-construction Indranil Saha Automated Software Synthesis for CPS 10/53

Program Synthesis - Specification Specification System Information Synthesis Tool (SMT Solver) Program Indranil Saha Automated Software Synthesis for CPS 11/53

Temporal logics as a task language Specification Language R1 π1 R2 π2 R3 π3 R4 π4 Should be expressive to capture temporal relationships among the events 3/2/15 Example: Visit area R 2, then area R 3, then area R 4, and finally, return and remain in region R 1 while avoiding areas R 2 and R 3 Linear Temporal Logic Indranil Saha Automated Software Synthesis for CPS 12/53

Linear Temporal Logic (LTL) LTL Grammar: φ ::= π φ φ φ φ φ φ φ U φ Temporal logics as a task π - atomic proposition G Example: π 1 - The robot is in Room 1 (next) φ φ (always) φ φ φ φ φ π1 π3 π2 π4 Visit area π2 then area π3 then a remain in region π1 while avoiding C S R R (eventually) φ φ 3/2/15 (until) φ 1 U φ 2 φ 1 φ 1 φ 2 Indranil Saha Automated Software Synthesis for CPS 13/53

Examples Temporal of logics LTL Specifications as a task language Go to goal (reachability) 1 Reachability π1 π3 π2 π4 ϕ = π 2 Coverage 2 Coverage ϕ = π 2 π 3 π 4 Sequencing 3 Sequencing (π 2 π 3 ) 4 Reachability with with avoidance avoidance ( π 2 π 3 ) U π 4 5 Recurrent Recurrent Sequencing sequencing (π 2 π 3 ) Visit area π2 then area π3 then area π4 and, finally, return and Visit remain area Rin 2, region then area π1 while R 3, then avoiding areaareas R 4, and π2 and finally, π3 return and remain in region R 1 while avoiding areas R 2 and R 3 ϕ = (π 2 (π 3 (π 4 ( π 2 π 3 ) U π 1 ))) 3/2/15 Indranil Saha Automated Software Synthesis for CPS 14/53

Program Synthesis - SMT Solver Specification System Information Synthesis Tool (SMT Solver) Program Indranil Saha Automated Software Synthesis for CPS 15/53

SMT Solver SAT solver: Checks satisfiability of Boolean formulas Example: b 1 b2 (b2 b1) SMT Solver: SAT solver empowered with Theory solvers Example Theories: LRA (Linear Real Arithmetic), EUF (Equality with Uninterpreted Functions),... Example: x0 = 0 y0 = 0 f (2, 1) = true ((x1 = x0 + 2) (y1 = y0 + 1)) ((x1 = x0 + 1) (y1 = y0 + 2)) ((x2 = x1 + 2) (y2 = y1 + 1)) ((x2 = x1 + 1) (y2 = y1 + 2)) f (x1, y1) true x2 4 y2 3 Formula is satisfiable generates a model Formula is unsatisfiable generates an unsatisfiable core An SMT solver can be used as an optimization engine - Iteratively search for better solution using binary search Indranil Saha Automated Software Synthesis for CPS 16/53

Architecture of a Program Synthesis Tool System Information Specification Constraint Generator Constraints SMT Solver Unsat Core Model Specification Refinement Tool Program Generator Program Indranil Saha Automated Software Synthesis for CPS 17/53

Motion Plan Synthesis High-Level Planning Control Algorithm Design Real-Time Software Implementation Compositional motion planning for dynamic robots Synthesis of Embedded Control Software Indranil Saha Automated Software Synthesis for CPS 19/53

Motion Plan Synthesis High-Level Planning Control Algorithm Design Real-Time Software Implementation Compositional motion planning for dynamic robots Synthesis of Embedded Control Software Specification (LTL formula) System Information (Dynamics) Synthesis Tool Program (Motion Plan) Indranil Saha Automated Software Synthesis for CPS 19/53

Existing Solutions for LTL Motion Planning General Idea: Generate a finite abstraction for the robot dynamics Generate a finite model for the LTL specification Apply a game theoretic algorithm to generate a high level plan Generate low level control signals to realize the high level plan Work by Kress-Gazit, Fainekos, Pappas, Karaman, Frazzoli, Kavraki, Verdi, Topcu, Murray, Belta, Rus and others.. Limitations: Discretization of continuous dynamics is expensive Existence of low-level controllers is not guaranteed Indranil Saha Automated Software Synthesis for CPS 20/53

NSF ExCAPE Project Indranil Saha Automated Software Synthesis for CPS 21/53

ExCAPE Research Organization Indranil Saha Automated Software Synthesis for CPS 22/53

Motion Primitives Short, kinematically feasible motions forming the basis of movements of the robot Components: u - a precomputed control input τ - the duration for which the control signal is applied I I F F q i - initial velocity configuration q f - final velocity configuration (a) (a) X rf - relative final position W - the set of relative blocks through which the robot may pass cost - an estimated energy consumption for executing the control law Note: Motion Primitives are position oblivious I I (c) (c) F F Indranil Saha Automated Software Synthesis for CPS 23/53

Motion Planning Problem An input problem instance P = R, I, PRIM, Workspace, ξ, L R - The set of robots I - Initial state of the group of robots PRIM = [PRIM 1, PRIM 2,..., PRIM R ] Workspace - Workspace dimension, position of obstacles ξ - Specification given in Linear Temporal Logic L - Number of hops in the trajectory Definition (Motion Planning Problem) Given an input problem P, synthesize a trajectory of length L Indranil Saha Automated Software Synthesis for CPS 24/53

Trajectory Synthesis via SMT Solving [IROS 2014] Complan (COmpositional Motion PLANner) http://www.seas.upenn.edu/ isaha/complan.shtml Φ(0) Prim 1 Φ(1) Prim 2 Φ(2)... Φ(L 1) Prim L Φ(L) Constraints: (Φ(0) I) Transition Specification Boolean combination of constraints from Linear Arithmetic and Equality with Uninterpreted Functions theories Complan solves for the L motion primitives using an SMT solver Indranil Saha Automated Software Synthesis for CPS 25/53

Example: Satisfy Invariants before Reaching Goal Goal: (I1 and I2) B (I3 and I4) A y I2 I1 I3 I4 A B Invariants: Maintain a rectangular or linear formation x Maintain a minimum distance Indranil Saha Automated Software Synthesis for CPS 26/53

Example: Satisfy Invariants before Reaching Goal Goal: (I1 and I2) B (I3 and I4) A y I2 I1 I3 I4 A B Invariants: Maintain a rectangular or linear formation x Maintain a minimum distance No motion plan that satisfies the formation constraint exists Unsatisfiable Core helps us refining the specification Indranil Saha Automated Software Synthesis for CPS 26/53

Example: Satisfy Invariants before Reaching Goal Goal: (I1 and I2) B (I3 and I4) A y I2 I1 I3 I4 A B Invariants: Maintain a minimum distance x The distance between two quadrotors is always greater than one unit Indranil Saha Automated Software Synthesis for CPS 27/53

Finding Optimal Trajectory Find the least number of motion primitives that can generate a valid trajectory Among all trajectories that use the least number of motion primitives, find the one that incurs the least cost Indranil Saha Automated Software Synthesis for CPS 28/53

Example: Satisfy Invariants before Reaching Goal Goal: (I1 and I2) B (I3 and I4) A y I2 I1 I3 I4 A B Invariants: Maintain a minimum distance x The distance between two quadrotors is always greater than one unit Indranil Saha Automated Software Synthesis for CPS 29/53

Example: Persistent Surveillance y I1 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0 U1 U1U1 G4 G3 G1 0 1 2 3 4 5 6 7 8 9 10 x G2 U2 U2 U2 11 12 13 14 15 16 17 18 Each quadrotor has to repeatedly gather data from some data gathering location and upload the gathered data at a data upload location. ξ 1 := A( ( (rxgather ( rxupload)))) Indranil Saha Automated Software Synthesis for CPS 30/53

Terraswarm Indranil Saha Automated Software Synthesis for CPS 31/53

Terraswarm Themes Indranil Saha Automated Software Synthesis for CPS 32/53

Motion Plan Synthesis for a Swarm of Robots Specification: obstacles U reach Indranil Saha Automated Software Synthesis for CPS 33/53

Motion Plan Synthesis for a Swarm of Robots Specification: obstacles U reach Main Idea: Synthesize optimal trajectory for each robot independently Indranil Saha Automated Software Synthesis for CPS 33/53

Motion Plan Synthesis for a Swarm of Robots Specification: obstacles U reach Main Idea: Synthesize optimal trajectory for each robot independently R1 R2 R1' R2' R1 R2 R2' R1' Indranil Saha Automated Software Synthesis for CPS 33/53

Motion Plan Synthesis for a Swarm of Robots Specification: obstacles U reach Main Idea: Synthesize optimal trajectory for each robot independently R1 Find a feasible ordering for the robots R2 R1' R2' R1 R2 R2' R1' Indranil Saha Automated Software Synthesis for CPS 33/53

Motion Plan Synthesis for a Swarm of Robots Specification: obstacles U reach Main Idea: Synthesize optimal trajectory for each robot independently R1 Find a feasible ordering for the robots Synthesize final trajectories according to the assigned priorities Treat the robots with higher priorities as dynamic obstacles Introduce minimum delay to execute the optional trajectory to avoid collision R2 R1 R2 R1' R2' R2' R1' Indranil Saha Automated Software Synthesis for CPS 33/53

Motion Plan Synthesis for a Swarm of Robots Specification: obstacles U reach Implan (Incremental Motion PLANner) Main Idea: Synthesize optimal trajectory for each robot independently R1 Find a feasible ordering for the robots Synthesize final trajectories according to the assigned priorities Treat the robots with higher priorities as dynamic obstacles Introduce minimum delay to execute the optional trajectory to avoid collision R2 R1 R2 R1' R2' R2' R1' Indranil Saha Automated Software Synthesis for CPS 33/53

Motion Plan Synthesis for a Swarm of Robots 15 i1 i2 14 13 12 11 i3 10 9 8 y 7 6 5 i4 4 3 2 1 0 f1 f5 i5 f4 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 x f2 i6 f3 f6 Ordering: 1: R 3 2: R 6 3: R 2 4: R 4 5: R 1 6: R 5 Indranil Saha Automated Software Synthesis for CPS 34/53

Motion Plan Synthesis for a Swarm of Robots 15 i1 i2 14 13 12 11 i3 10 9 8 y 7 6 5 i4 4 3 2 1 0 f1 f5 i5 f4 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 x Challenge: What if an ordering does not exist? f2 i6 f3 f6 Ordering: 1: R 3 2: R 6 3: R 2 4: R 4 5: R 1 6: R 5 Indranil Saha Automated Software Synthesis for CPS 34/53

Motion Plan Synthesis for a Swarm of Robots 15 i1 i2 14 13 12 11 i3 10 9 8 y 7 6 5 i4 4 3 2 1 0 f1 f5 i5 f4 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 x R1 R2 R1' R2' Challenge: What if an ordering does not exist? f2 i6 f3 f6 Ordering: 1: R 3 2: R 6 3: R 2 4: R 4 5: R 1 6: R 5 R1 R2 R2' R1' Indranil Saha Automated Software Synthesis for CPS 34/53

Example: Motion Planning in a Compact Workspace 25 quadrotors moving in a closed place Specification: obstacles U reach Figure: caption Indranil Saha Automated Software Synthesis for CPS 35/53

Control Software Synthesis High-Level Planning Control Algorithm Design Real-Time Software Implementation Compositional motion planning for dynamic robots Synthesis of Embedded Control Software Indranil Saha Automated Software Synthesis for CPS 37/53

Control Software Synthesis High-Level Planning Control Algorithm Design Real-Time Software Implementation Compositional motion planning for dynamic robots Synthesis of Embedded Control Software Specification (Stability) System Information (Model of the Plant) Synthesis Tool Program (Controller Software) Platform Information (Number of Bits) Indranil Saha Automated Software Synthesis for CPS 37/53

Specification for Ideal Controller: Exponential Stability The plant converges to a desired behavior under the actions of the controller I R I' I R' R ρ Indranil Saha Automated Software Synthesis for CPS 38/53

Specification for Ideal Controller: Exponential Stability The plant converges to a desired behavior under the actions of the controller I R I' I R' R ρ Example: In the steady state, the quadrotor will be at 4m away from the x-axis and 6m away from the y-axis Indranil Saha Automated Software Synthesis for CPS 38/53

Specification for Implemented Controller: Practical Stability R R R' R' R I ρ R I I I' I ρ I' I Mathematical Model Software Implementation The state of the plant eventually reaches a bounded region and remains there under the action of the controller Specification is given in terms of Region of Practical Stability Indranil Saha Automated Software Synthesis for CPS 39/53

Specification for Implemented Controller: Practical Stability R R R' R' R I ρ R I I I' I ρ I' I Mathematical Model Software Implementation The state of the plant eventually reaches a bounded region and remains there under the action of the controller Specification is given in terms of Region of Practical Stability Example: In the steady state, the quadrotor will be between 3.9-4.1m away from the x-axis and 5.8-6.2m away from the y-axis Indranil Saha Automated Software Synthesis for CPS 39/53

Verification Question [EMSOFT2010 (Best Paper Award)] Given: Dynamics of the plant A stabilizing controller The number of bits of the target processor Specification on practical stability Verify: If the software implementation of the controller satisfies the specification on practical stability Reduces to computing the upper bound on the region of practical stability Indranil Saha Automated Software Synthesis for CPS 40/53

Bound on the Region of Practical Stability R R R' R' R I ρ R I I I' I ρ I' I Mathematical Model Software Implementation Indranil Saha Automated Software Synthesis for CPS 41/53

Bound on the Region of Practical Stability R R R' R' R I ρ R I I I' I ρ I' I Mathematical Model Software Implementation Theorem[EMSOFT2010] If γ is the L2-Gain of a control system, b is a bound on the implementation error, then ρ γ b Indranil Saha Automated Software Synthesis for CPS 41/53

Bound on the Region of Practical Stability R R R' R' R I ρ R I I I' I ρ I' I Mathematical Model Software Implementation Theorem[EMSOFT2010] If γ is the L2-Gain of a control system, b is a bound on the implementation error, then ρ γ b Separation of concerns: Compute L2-gain from the mathematical model (standard problem in control theory) Compute the bound on implementation error (analysis of the implementation) Indranil Saha Automated Software Synthesis for CPS 41/53

Example of Controller Program Control Law (Vehicle Steering) : u = 0.81 (In1 In2) 1.017 In3 Real-valued program Real In1, In2, In3; Real Subtract, Gain, Gain2, Out1; static void output(void) { Subtract = In1 - In2; Gain = 0.81 * Subtract; Gain2 = 1.017 * In3; Out1 = Gain - Gain2; } Fixed-point implementation (16-bit): short int In1, In2, In3; short int Subtract, Gain, Gain2, Out1; static void output(void) { Subtract = (short int)(in1 - In2); Gain = (short int)(26542 * Subtract 15); Gain2 = (short int)(16663 * In3 14); Out1 = (short int)(((gain 1) - Gain2) 1); } Indranil Saha Automated Software Synthesis for CPS 42/53

Example of Controller Program Control Law (Vehicle Steering) : u = 0.81 (In1 In2) 1.017 In3 Real-valued program Real In1, In2, In3; Real Subtract, Gain, Gain2, Out1; static void output(void) { Subtract = In1 - In2; Gain = 0.81 * Subtract; Gain2 = 1.017 * In3; Out1 = Gain - Gain2; } Fixed-point implementation (16-bit): short int In1, In2, In3; short int Subtract, Gain, Gain2, Out1; static void output(void) { Subtract = (short int)(in1 - In2); Gain = (short int)(26542 * Subtract 15); Gain2 = (short int)(16663 * In3 14); Out1 = (short int)(((gain 1) - Gain2) 1); } What is the bound on the error? Can be formulated as an SMT solving problem over Boolean combination of linear arithmetic constraints Indranil Saha Automated Software Synthesis for CPS 42/53

Controller Stability Analyzer: Costan An automatic tool to compute the bound on the region of practical stability Model of Plant Control Theory Model Of Controller Fixed-point Code generator Implementation Of Controller Supports both linear and nonlinear controllers, for nonlinear controllers both polynomial implementation and lookup table based implementation L2 Gain Computation Bound on Stability Region Computation Strongest Post-condition Computation Error-bound Computation Computed Bound Indranil Saha Automated Software Synthesis for CPS 43/53

Synthesis Question [EMSOFT 2012 (Best Paper Nomination)] Is it possible to synthesize a controller that minimizes the region of practical stability? Indranil Saha Automated Software Synthesis for CPS 44/53

Synthesis Question [EMSOFT 2012 (Best Paper Nomination)] Is it possible to synthesize a controller that minimizes the region of practical stability? Traditionally, controllers are synthesized minimizing LQR cost function LQR cost = state cost + control cost state cost = sum of the deviations of the states from their desired values control cost = energy expended by the control action Indranil Saha Automated Software Synthesis for CPS 44/53

Example Model of a Vehicle Steering: [ ξ1 ξ 2 ] = y = [ 0 g h 1 0 [ av0 bh v 2 0 bh ] [ ξ1 ] [ ξ 1 ξ 2 [ 1 + ] 0 + ν ξ 2 ] ] (υ + ω) LQR Controller: K 1 = [5.1538, 12.9724] LQR cost function is 264.1908 Another Controller: K 2 = [3.0253, 12.6089] LQR cost function is 284.1578 Indranil Saha Automated Software Synthesis for CPS 45/53

Example (Cont.) y 1 0.5 0 K 2 and L 2 K 1 and L 1 0.5 0 5 10 15 y 0.015 0.01 0.005 K 2 and L 2 K 1 and L 1 0 5 10 15 time There is a trade-off between LQR cost and the region of practical stability Indranil Saha Automated Software Synthesis for CPS 46/53

Problem Statement Design a controller optimizing the following objectives: The LQR cost The bound on the region of practical stability Indranil Saha Automated Software Synthesis for CPS 47/53

Controller Synthesis Tool: Ocsyn Co-optimizes LQR cost and the bound on region of practical stability Employs stochastic optimization needs to compute the value of the objective functions for many different controllers Employs a convex optimization tool to compute LQR cost Uses Costan to compute the region of practical stability Synthesizes controller with significant improvement on the bound on region of practical stability without significant degradation on the LQR cost Example: vehicle steering A factor of 10 improvement in the region of practical stability with only 10% degradation in LQR cost Indranil Saha Automated Software Synthesis for CPS 48/53

Ongoing Research Complan: New class of properties Timing specification New System Model Mixed Logical Dynamical System Time varying motion primitives Implan: Linear Temporal Logic Motion Planning for large number of robots Indranil Saha Automated Software Synthesis for CPS 50/53

Reactive, Robust and Distributed Motion Planning Goal: Devise tools and techniques for synthesizing motion planner that is Reactive Self-Driven Car, Robocup Robust Path planning for a drone in the presence of gust of wind Distributed Challenges: Path planning for an aircraft in a congested airspace How to make existing solvers more amenable to solve planning problems? How to build domain specific solvers? (e.g., a solver that has control theoretic intelligence) Indranil Saha Automated Software Synthesis for CPS 51/53

Big Data Analytics and Security for CPS Application of Big Data analytics in cyber-physical systems Automatic air-traffic controller Real-time decision making by unmanned vehicles Security for cyber-physical systems Devise defense against attacks on unmanned aerial vehicles Indranil Saha Automated Software Synthesis for CPS 52/53

Thank You!! http://www.seas.upenn.edu/ isaha Indranil Saha Automated Software Synthesis for CPS 53/53