Falsification of Cyber-Physical Systems with Constrained Signal Spaces

Abstract

Falsification has garnered much interest recently as a way to validate complex CPS designs with respect to a specification expressed via temporal logics. Using their quantitative semantics, the falsification problem can be formulated as robustness minimization problem. To make this infinite-dimensional problem tractable, a common approach is to restrict to classes of signals that can be defined using a finite number of parameters, such as piecewise-constant or piecewise-linear signals with fixed time intervals). A major drawback of this approach is that when the input signals must satisfy non-trivial temporal constraints, encoding these constraints into bounded domains for parameters can be difficult. In this work, to better capture temporal constraints on the input signal space, we use timed automata (TA) and make use of a transformation that allows sampling TA traces by sampling points in the unit box. We exploit this transformation to efficiently encode constrained CPS signals in the robustness minimization problem. This transformation also allows us to define an effective coverage measure of the constrained signal space so as to provide quantitative guarantees when no falsifying behaviour is found. In addition, this coverage is used to improve the black-box optimisation performance by detecting situations where the search is stuck near a local optimum. The approach is demonstrated on a ∆Σ modulator and a model of car automatic transmission subject to constraints describing usual driving patterns.

Sampling of shape expressions with ShapEx

“…More recent work on falsification of hybrid and cyber-physical systems extends inputs to sets of signals described by piecewise functions encoded using a finite number of bounded parameters. The literature on CPS falsification and testing has become vast, we include here only some most recent papers [13,15,41,4,5] and more references can be found therein as well as in the papers and websites related to the major state-of-the-art tools S-TaLiRo [38] and Breach [11]. Compared to this approach, our work can deal with more general signals described by complex constraints involving both time and value domains.…”

“…with slope in (1,2) and duration in (0.5, 2), and (E) with slope in (5,900) and duration in (0.01, 2). We finally also allow the concatenation of segments (D) and (E) to be replaced by a single segment (F), a linearly increasing segment with slope in (1,5) and duration in (2,10).…”

“…with slope in (1,2) and duration in (0.5, 2), and (E) with slope in (5,900) and duration in (0.01, 2). We finally also allow the concatenation of segments (D) and (E) to be replaced by a single segment (F), a linearly increasing segment with slope in (1,5) and duration in (2,10). We observe that the above specification uses parametric shapes, where the parameters are possibly constrained, and describes perfect shapes without accounting for noise.…”

Temporal Logic Falsification of Cyber-Physical Systems using Input Pulse Generators

“…These methods are suited for the type of problems mentioned above requiring targeting a small region of the input signal space, but they might fail to converge toward counterexamples living in some high-frequency regions, simply because this will require adding too many control points. In [1], the authors introduce an input generator using the words accepted by a time automaton (TA) and show in particular that it can address the generation of complex periodic behaviors. This is much more general than the simple pulse generator that we consider in this paper and requires more effort in modeling the TA for input generation.…”

“…three different ranges: [-0.35, 0.35], [-0.40, 0.40], [-0.45, 0.45]; with three initial conditions x init 1 , x init 2 , x init 3 in the range [-0.1, 0.1]; • Switched System (SS): Two inputs defined in the range [-1, 1]; Three different values are consideredfor parameter thresh: 0.7, 0.8, 0.9;• Neural Network (NN): One input (reference) chosen in[1,3];• Fuel Control (AFC): Two inputs, throttle in [0, 61.2], and engine speed in [900, 1000];• Steam Condenser (SC): One input with possible values in[3.99, 4.01].…”