Experiments in Verification of Linear Model Predictive Control: Automatic Generation and Formal Verification of an Interior Point Method Algorithm

Abstract

Classical control of cyber-physical systems used to rely on basic linear controllers. These controllers provided a safe and robust behavior but lack the ability to perform more complex controls such as aggressive maneuvering or performing fuel-efficient controls. Another approach called optimal control is capable of computing such difficult trajectories but lacks the ability to adapt to dynamic changes in the environment. In both cases, the control was designed offline, relying on more or less complex algorithms to find the appropriate parameters. More recent kinds of approaches such as Linear Model-Predictive Control (MPC) rely on the online use of convex optimization to compute the best control at each sample time. In these settings optimization algorithms are specialized for the specific control problem and embed on the device. This paper proposes to revisit the code generation of an interior point method (IPM) algorithm, an efficient family of convex optimization, focusing on the proof of its implementation at code level. Our approach relies on the code specialization phase to produce additional annotations formalizing the intented specification of the algorithm. Deductive methods are then used to prove automatically the validity of these assertions. Since the algorithm is complex, additional lemmas are also produced, allowing the complete proof to be checked by SMT solvers only.This work is the first to address the effective formal proof of an IPM algorithm. The approach could also be generalized more systematically to code generation frameworks, producing proof certificate along the code, for numerical intensive software. Model Predictive Control and Verification ChallengesWhen one wants to control the behavior of a physical device, one could rely on the use of a feedback controller, executed on a computer, to perform the necessary adjustements to the device to maintain its state or reach a given target. Classical means of this control theory amount to express the device behavior as a linear ordinary differencial equation (ODE) and define the feedback controller as a linear system; eg. a PID controller. The design phase searches for proper gains, ie. parametrization, of the controller to achieve the desired behavior.While this approach has been used for years with great success, eg. in aircraft control, some more challenging behaviors or complex devices need more sophisticated controllers. Assuming that the device behavior is known, one can predict its future states. A first approach, Optimal Control with indirect-method, search for optimal solutions solving a complex mathematical problem, the Pontryagin Maximal Principle. This is typical used to compute rocket or satellite trajectories. However this approach, while theoretically optimal, requires complex computation * This work was partially supported by ANR FEANICSES project.

A constraint-separation principle in model predictive control

“…A decomposed controller is more straightforward to certify because an unconstrained problem is simpler than the same problem with constraints; it is therefore easier to certify the stabilizing component of the decomposed MPC problem. This makes it easier to ensure stability and attractiveness during online operation, limiting the need for a complex certification process, such as that of [3], to the constraint-enforcement component.…”