What's to Come is Still Unsure

Transcription

1 What's to Come is Still Unsure Synthesizing Controllers Resilient to Delayed Interaction Mingshuai Chen, Martin Fränzle, Yangjia Li 3,, Peter N Mosaad, Naijun Zhan chenms@iosaccn lcsiosaccn/~chenms/ State Key Lab of Computer Science, Institute of Software, Chinese Academy of Sciences, China Dpt of Computing Science, Carl v Ossietzky Universität Oldenburg, Germany 3 University of Tartu, Estonia Los Angeles, October 08 William Shakespeare, Twelfth Night/What You Will, Act, Scene 3 Mingshuai Chen Institute of Software, CAS Synthesizing Controllers Resilient to Delay Los Angeles, ATVA 08 / 5

2 Staying Safe When Observation & Actuation Suffer from Serious Delays You could move slowly (Well, can you?) You could trust autonomy Or you have to anticipate and issue actions early ESA Mingshuai Chen Institute of Software, CAS Synthesizing Controllers Resilient to Delay Los Angeles, ATVA 08 / 5

3 A Pearl of Wisdom izquotes Mingshuai Chen Institute of Software, CAS Synthesizing Controllers Resilient to Delay Los Angeles, ATVA 08 3 / 5

4 A Pearl of Wisdom Only relevant to ordinary people's life? Or to scientists, in particular comp sci and control folks, too? izquotes Mingshuai Chen Institute of Software, CAS Synthesizing Controllers Resilient to Delay Los Angeles, ATVA 08 3 / 5

5 A Pearl of Wisdom Only relevant to ordinary people's life? Or to scientists, in particular comp sci and control folks, too? izquotes Remember that Canning briefly controlled Great Britain! Mingshuai Chen Institute of Software, CAS Synthesizing Controllers Resilient to Delay Los Angeles, ATVA 08 3 / 5

6 Outline Safety Games under Delay 3 Synthesizing Controllers Resilient to Delayed Interaction 4 5 Mingshuai Chen Institute of Software, CAS Synthesizing Controllers Resilient to Delay Los Angeles, ATVA 08 4 / 5

7 Outline Safety Games under Delay Delayed observation and actuation Reducibility to standard safety games 3 Synthesizing Controllers Resilient to Delayed Interaction Incremental handling of order-preserving delays Out-of-order delivery 4 Performance 5 Summary Mingshuai Chen Institute of Software, CAS Synthesizing Controllers Resilient to Delay Los Angeles, ATVA 08 5 / 5

8 Hybrid Systems disturbances ("noise") Plant environmental influence observable state control Analog switch Continuous controllers Plant Control selection setpoints active control law D/A setpoints Discrete supervisor A/D part of observable state task selection Mingshuai Chen Institute of Software, CAS Synthesizing Controllers Resilient to Delay Los Angeles, ATVA 08 6 / 5

9 Hybrid Systems disturbances ("noise") Plant environmental influence observable state control selection Analog switch setpoints active control law Continuous controllers D/A setpoints Discrete supervisor A/D part of observable state task selection Plant Control Loads of continuous computations interleaved with discrete decisions Mingshuai Chen Institute of Software, CAS Synthesizing Controllers Resilient to Delay Los Angeles, ATVA 08 6 / 5

10 Hybrid Systems disturbances ("noise") Plant environmental influence observable state Crucial question : control Analog switch selection setpoints active control law Continuous controllers D/A setpoints Discrete supervisor How do the controller and the plant interact? Traditional answer : A/D part of observable state task selection Plant Control Loads of continuous computations interleaved with discrete decisions Coupling assumed to be (or at least modeled as) delay-free Mode dynamics is covered by the conjunction of the individual ODEs Switching btw modes is an immediate reaction to environmental conditions Mingshuai Chen Institute of Software, CAS Synthesizing Controllers Resilient to Delay Los Angeles, ATVA 08 6 / 5

11 Instantaneous Coupling 4 a i o i o i3 o3 timer h brake a_brake a s x o v 00 len s x o 3 v xh xr 4 xr_l 400 s 3 a_free v_init xr_init Following the tradition, above (rather typical) Simulink model assumes delay-free coupling between all components, instantaneous feed-through within all functional blocks ETCS-3 Central questions : Is this realistic? If not, does it have observable effect on control performance? 3 May that effect be detrimental or even harmful? Mingshuai Chen Institute of Software, CAS Synthesizing Controllers Resilient to Delay Los Angeles, ATVA 08 7 / 5

12 Q : Is Instantaneous Coupling Realistic? Mingshuai Chen Institute of Software, CAS Synthesizing Controllers Resilient to Delay Los Angeles, ATVA 08 8 / 5

13 Q : Is Instantaneous Coupling Realistic? We are no better : As soon as computer scientists enter the scene, serious delays are ahead Mingshuai Chen Institute of Software, CAS Synthesizing Controllers Resilient to Delay Los Angeles, ATVA 08 8 / 5

14 Q : Is Instantaneous Coupling Realistic? Digital control needs A/D and D/A conversion, which induces latency in signal forwarding Digital signal processing, especially in complex sensors like CV, needs processing time, adding signal delays Networked control introduces communication latency into the feedback control loop Harvesting, fusing, and forwarding data through sensor networks enlarge the latter by orders of magnitude Mingshuai Chen Institute of Software, CAS Synthesizing Controllers Resilient to Delay Los Angeles, ATVA 08 9 / 5

15 Q : Is Instantaneous Coupling Realistic? -- No Digital control needs A/D and D/A conversion, which induces latency in signal forwarding Digital signal processing, especially in complex sensors like CV, needs processing time, adding signal delays Networked control introduces communication latency into the feedback control loop Harvesting, fusing, and forwarding data through sensor networks enlarge the latter by orders of magnitude Mingshuai Chen Institute of Software, CAS Synthesizing Controllers Resilient to Delay Los Angeles, ATVA 08 9 / 5

16 Qa : Resultant Forms of Delay Delayed reaction : Reaction to a stimulus is not immediate Easy to model in timed automata, hybrid automata, : a / x:=0 x<4 x > 3 / b Thus amenable to the pertinent analysis tools Not of interest today Mingshuai Chen Institute of Software, CAS Synthesizing Controllers Resilient to Delay Los Angeles, ATVA 08 0 / 5

17 Qa : Resultant Forms of Delay Delayed reaction : Reaction to a stimulus is not immediate Easy to model in timed automata, hybrid automata, : a / x:=0 x<4 x > 3 / b Thus amenable to the pertinent analysis tools Not of interest today Network delay : Information of different age coexists and is queuing in the network when piped towards target End-to-end latency may exceed sampling intervals etc by orders of magnitude Not (continuous-time pipelined delay) or not efficiently (discrete-time pipelined delay) expressible in our std models Our theme today : discrete-time pipelined delay [M Chen, M Fränzle et al ATVA'8], [M Zimmermann LICS'8, GandALF'7], [F Klein & M Zimmermann ICALP'5, CSL'5] Mingshuai Chen Institute of Software, CAS Synthesizing Controllers Resilient to Delay Los Angeles, ATVA 08 0 / 5

18 Q : Do Delays Have Observable Effect? y x Figure : A robot escape game in a 4 4 room, with Σ r = {RU, UR, LU, UL, RD, DR, LD, DL, ϵ}, Σ k = {R, L, U, D} Mingshuai Chen Institute of Software, CAS Synthesizing Controllers Resilient to Delay Los Angeles, ATVA 08 / 5

19 Q : Do Delays Have Observable Effect? y x Figure : A robot escape game in a 4 4 room, with Σ r = {RU, UR, LU, UL, RD, DR, LD, DL, ϵ}, Σ k = {R, L, U, D} Mingshuai Chen Institute of Software, CAS Synthesizing Controllers Resilient to Delay Los Angeles, ATVA 08 / 5

20 Q : Do Delays Have Observable Effect? y x Figure : A robot escape game in a 4 4 room, with Σ r = {RU, UR, LU, UL, RD, DR, LD, DL, ϵ}, Σ k = {R, L, U, D} Mingshuai Chen Institute of Software, CAS Synthesizing Controllers Resilient to Delay Los Angeles, ATVA 08 / 5

21 Q : Do Delays Have Observable Effect? y 3 No delay : x Figure : A robot escape game in a 4 4 room, with Σ r = {RU, UR, LU, UL, RD, DR, LD, DL, ϵ}, Σ k = {R, L, U, D} Mingshuai Chen Institute of Software, CAS Synthesizing Controllers Resilient to Delay Los Angeles, ATVA 08 / 5

22 Q : Do Delays Have Observable Effect? y 3 No delay : Robot always wins by circling around the obstacle at (,) x Figure : A robot escape game in a 4 4 room, with Σ r = {RU, UR, LU, UL, RD, DR, LD, DL, ϵ}, Σ k = {R, L, U, D} Mingshuai Chen Institute of Software, CAS Synthesizing Controllers Resilient to Delay Los Angeles, ATVA 08 / 5

23 Q : Do Delays Have Observable Effect? y 3 No delay : Robot always wins by circling around the obstacle at (,) step delay : x Figure : A robot escape game in a 4 4 room, with Σ r = {RU, UR, LU, UL, RD, DR, LD, DL, ϵ}, Σ k = {R, L, U, D} Mingshuai Chen Institute of Software, CAS Synthesizing Controllers Resilient to Delay Los Angeles, ATVA 08 / 5

24 Q : Do Delays Have Observable Effect? y 3 No delay : Robot always wins by circling around the obstacle at (,) step delay : Robot wins by -step pre-decision x Figure : A robot escape game in a 4 4 room, with Σ r = {RU, UR, LU, UL, RD, DR, LD, DL, ϵ}, Σ k = {R, L, U, D} Mingshuai Chen Institute of Software, CAS Synthesizing Controllers Resilient to Delay Los Angeles, ATVA 08 / 5

25 Q : Do Delays Have Observable Effect? y 3 No delay : Robot always wins by circling around the obstacle at (,) step delay : Robot wins by -step pre-decision steps delay : x Figure : A robot escape game in a 4 4 room, with Σ r = {RU, UR, LU, UL, RD, DR, LD, DL, ϵ}, Σ k = {R, L, U, D} Mingshuai Chen Institute of Software, CAS Synthesizing Controllers Resilient to Delay Los Angeles, ATVA 08 / 5

26 Q : Do Delays Have Observable Effect? y 3 No delay : Robot always wins by circling around the obstacle at (,) step delay : Robot wins by -step pre-decision x steps delay : Robot still wins, yet extra memory is needed Figure : A robot escape game in a 4 4 room, with Σ r = {RU, UR, LU, UL, RD, DR, LD, DL, ϵ}, Σ k = {R, L, U, D} Mingshuai Chen Institute of Software, CAS Synthesizing Controllers Resilient to Delay Los Angeles, ATVA 08 / 5

27 Q : Do Delays Have Observable Effect? y 3 No delay : Robot always wins by circling around the obstacle at (,) step delay : Robot wins by -step pre-decision 0 0 Figure : A robot escape game in a 4 4 room, with Σ r = {RU, UR, LU, UL, RD, DR, LD, DL, ϵ}, Σ k = {R, L, U, D} 3 x steps delay : Robot still wins, yet extra memory is needed 3 steps delay : Mingshuai Chen Institute of Software, CAS Synthesizing Controllers Resilient to Delay Los Angeles, ATVA 08 / 5

28 Q : Do Delays Have Observable Effect? y 3 No delay : Robot always wins by circling around the obstacle at (,) step delay : Robot wins by -step pre-decision 0 0 Figure : A robot escape game in a 4 4 room, with Σ r = {RU, UR, LU, UL, RD, DR, LD, DL, ϵ}, Σ k = {R, L, U, D} 3 x steps delay : Robot still wins, yet extra memory is needed 3 steps delay : Robot is unwinnable (uncontrollable) anymore Mingshuai Chen Institute of Software, CAS Synthesizing Controllers Resilient to Delay Los Angeles, ATVA 08 / 5

29 Q : Do Delays Have Observable Effect? -- Yes, they have y 3 No delay : Robot always wins by circling around the obstacle at (,) step delay : Robot wins by -step pre-decision 0 0 Figure : A robot escape game in a 4 4 room, with Σ r = {RU, UR, LU, UL, RD, DR, LD, DL, ϵ}, Σ k = {R, L, U, D} 3 x steps delay : Robot still wins, yet extra memory is needed 3 steps delay : Robot is unwinnable (uncontrollable) anymore Mingshuai Chen Institute of Software, CAS Synthesizing Controllers Resilient to Delay Los Angeles, ATVA 08 / 5

30 Q3 : May the Effects be Harmful? -- Yes, delays may well annihilate control performance y 3 No delay : Robot always wins by circling around the obstacle at (,) step delay : Robot wins by -step pre-decision 0 0 Figure : A robot escape game in a 4 4 room, with Σ r = {RU, UR, LU, UL, RD, DR, LD, DL, ϵ}, Σ k = {R, L, U, D} 3 x steps delay : Robot still wins, yet extra memory is needed 3 steps delay : Robot is unwinnable (uncontrollable) anymore Mingshuai Chen Institute of Software, CAS Synthesizing Controllers Resilient to Delay Los Angeles, ATVA 08 / 5

31 Outline Safety Games under Delay Delayed observation and actuation Reducibility to standard safety games 3 Synthesizing Controllers Resilient to Delayed Interaction Incremental handling of order-preserving delays Out-of-order delivery 4 Performance 5 Summary Mingshuai Chen Institute of Software, CAS Synthesizing Controllers Resilient to Delay Los Angeles, ATVA 08 3 / 5

32 Delayed Observation & Actuation A Trivial Safety Game A Trivial Safety Game u a 3 e a b u a a 5 a u b a u a e e 3 v v Goal: Avoid a 5 by appropriate Goal : Avoid actions a 5 by of appropriate player e actions of player e b u a 4 PKU MAVeLoS Workshop, Beijing, Oct 8, 07 Martin Fränzle: Indecision and Delay 3 / 39 Mingshuai Chen Institute of Software, CAS Synthesizing Controllers Resilient to Delay Los Angeles, ATVA 08 4 / 5

33 Delayed Observation & Actuation A Trivial Safety Game A Trivial Safety Game u a 3 e a b u a a 5 a u b a u a e e 3 b v v Goal: Avoid a 5 by appropriate Goal : Avoid actions a 5 by of appropriate player e actions of player e Strategy : May always play "a" except in e 3 : e, e a e 3 b u a 4 PKU MAVeLoS Workshop, Beijing, Oct 8, 07 Martin Fränzle: Indecision and Delay 3 / 39 Mingshuai Chen Institute of Software, CAS Synthesizing Controllers Resilient to Delay Los Angeles, ATVA 08 4 / 5

34 Delayed Observation & Actuation Playing Safety Game Subject to Discrete Delay Playing Subject to Discrete Delay Ego player Shift registers Game state Adversary Observation : It doesn't make an observable difference for the joint dynamics Observation: whetheritdelay doesn t occurs make in perception, an observable actuation, difference or both for the joint dynamics whether delay occurs in perception, actuation, or both Mingshuai Chen Institute of Software, CAS Synthesizing Controllers Resilient to Delay Los Angeles, ATVA 08 5 / 5

35 Delayed Observation & Actuation Playing Safety Game Subject to Discrete Delay Playing Subject to Discrete Delay Ego player Shift registers Game state Adversary Observation : It doesn't make an observable difference for the joint dynamics Observation: whetheritdelay doesn t occurs make in perception, an observable actuation, difference or both for the joint dynamics Consequence whether : There delayisoccurs an obvious in perception, reduction to actuation, a safety game or both of perfect information In fact, two different ones : To mimic opacity of the shift registers, delay has to be moved to actuation/sensing for ego/adversary, resp The two thus play different games! Mingshuai Chen Institute of Software, CAS Synthesizing Controllers Resilient to Delay Los Angeles, ATVA 08 5 / 5

36 Reduction Reduction to Delay-Free Games from Ego-Player Perspective The Reduction from Ego-Player Perspective Σ / Ego inp Adv inp Ego input Shift register Σ Game graph Σ Safe / unsafe PKU MAVeLoS Workshop, Beijing, Oct 8, 07 Martin Fränzle: Indecision and Delay 5 / 39 Mingshuai Chen Institute of Software, CAS Synthesizing Controllers Resilient to Delay Los Angeles, ATVA 08 6 / 5

37 Reduction Reduction to Delay-Free Games from Ego-Player Perspective The Reduction from Ego-Player Perspective Σ / Ego inp Adv inp Ego input Shift register Σ Game graph Σ Safe / unsafe Safety games w delay can be solved algorithmically Game graph incurs blow-up by factor Alphabet(ego) delay Mingshuai Chen PKU Institute MAVeLoS of Software, Workshop, CAS Beijing, Synthesizing Oct 8, 07 Controllers Martin Resilient Fränzle: to DelayIndecision and Delay Los Angeles, 5 / ATVA / 5

38 Reduction The Simple Safety Game but with Delay A Trivial Safety Game u a 3 No delay : e, e a e 3 b e a b u a a 5 a u b a u a e e 3 v v Goal: step Avoid delay a: 5 Strategy by appropriate? actions a, of a 4 player a e a, a 3 b b u a 4 PKU MAVeLoS Workshop, Beijing, Oct 8, 07 Martin Fränzle: Indecision and Delay 3 / 39 Mingshuai Chen Institute of Software, CAS Synthesizing Controllers Resilient to Delay Los Angeles, ATVA 08 7 / 5

39 Reduction The Simple Safety Game but with Delay A Trivial Safety Game u a 3 No delay : e, e a e 3 b e a b u a a 5 a u u b a u a e e 3 b a 4 v v Goal: step Avoid delay a: 5 Strategy by appropriate? actions a, of a 4 player a e a, a 3 b steps delay : Strategy? a e b e b e 3 a if steps back an "a" was issued, if steps back a "b" was issued Need memory! PKU MAVeLoS Workshop, Beijing, Oct 8, 07 Martin Fränzle: Indecision and Delay 3 / 39 Mingshuai Chen Institute of Software, CAS Synthesizing Controllers Resilient to Delay Los Angeles, ATVA 08 7 / 5

40 Outline Safety Games under Delay Delayed observation and actuation Reducibility to standard safety games 3 Synthesizing Controllers Resilient to Delayed Interaction Incremental handling of order-preserving delays Out-of-order delivery 4 Performance 5 Summary Mingshuai Chen Institute of Software, CAS Synthesizing Controllers Resilient to Delay Los Angeles, ATVA 08 8 / 5

41 Order-Preserving Delays in a Nutshell Observation : A winning strategy for delay k > k can always be utilized for a safe win under delay k Consequence : That a position is winning for delay k is a necessary condition for it being winning under delay k > k Mingshuai Chen Institute of Software, CAS Synthesizing Controllers Resilient to Delay Los Angeles, ATVA 08 9 / 5

42 Order-Preserving Delays in a Nutshell Observation : A winning strategy for delay k > k can always be utilized for a safe win under delay k Consequence : That a position is winning for delay k is a necessary condition for it being winning under delay k > k Idea : Incrementally filter out loss states & incrementally synthesize winning strategy for the remaining : Synthesize winning strategy for underlying delay-free safety game For each winning state, lift strategy from delay k to k + 3 Remove states where this does not succeed 4 Repeat from until either delay-resilience suffices (winning) or initial state turns lossy (losing) M Chen, M Fränzle, Y Li, PN Mosaad, N Zhan : What's to come is still unsure : Synthesizing controllers resilient to delayed interaction To appear in Proc of ATVA 08 Mingshuai Chen Institute of Software, CAS Synthesizing Controllers Resilient to Delay Los Angeles, ATVA 08 9 / 5

43 Order-Preserving Delays of Delay-Tolerant Strategies Generate a maximally permissive strategy for delay k = 0 Mingshuai Chen Institute of Software, CAS Synthesizing Controllers Resilient to Delay Los Angeles, ATVA 08 0 / 5

44 Order-Preserving Delays of Delay-Tolerant Strategies Generate a maximally permissive strategy for delay k = 0 Advance to delay k + : If k odd : For each (ego-)winning adversarial state define strategy as a 5 u v e e 4 after playing σ, σ (k )/, play {a, c, e} u a5 v after playing σ, σ (k )/, play {b, c, e, f} 3 3 and eliminate any dead ends by bwd traversal e after playing σ, σ (k )/, play {a, c, e} {b, c, e, f} = {c, e} e 4 Mingshuai Chen Institute of Software, CAS Synthesizing Controllers Resilient to Delay Los Angeles, ATVA 08 0 / 5

45 Order-Preserving Delays of Delay-Tolerant Strategies Generate a maximally permissive strategy for delay k = 0 Advance to delay k + : If k odd : For each (ego-)winning adversarial state define strategy as a 5 u v e e 4 after playing σ, σ (k )/, play {a, c, e} u a5 v after playing σ, σ (k )/, play {b, c, e, f} 3 3 and eliminate any dead ends by bwd traversal If k even : For each winning ego state define strategy as e after playing σ, σ (k )/, play {a, c, e} {b, c, e, f} = {c, e} e 4 e 5 a b c a 3 a 4 a 5 play σ, σ k/, play σ, σ k/, e 5 a c a 3 play a, σ,, σ k/ or play c, σ,, σ k/ a 5 Mingshuai Chen Institute of Software, CAS Synthesizing Controllers Resilient to Delay Los Angeles, ATVA 08 0 / 5

46 Order-Preserving Delays of Delay-Tolerant Strategies Generate a maximally permissive strategy for delay k = 0 Advance to delay k + : If k odd : For each (ego-)winning adversarial state define strategy as a 5 u v e e 4 after playing σ, σ (k )/, play {a, c, e} u a5 v after playing σ, σ (k )/, play {b, c, e, f} 3 3 and eliminate any dead ends by bwd traversal If k even : For each winning ego state define strategy as e after playing σ, σ (k )/, play {a, c, e} {b, c, e, f} = {c, e} e 4 e 5 a b c a 3 a 4 a 5 play σ, σ k/, play σ, σ k/, e 5 a c a 3 play a, σ,, σ k/ or play c, σ,, σ k/ a 5 3 Repeat from until either delay-resilience suffices or initial state turns lossy Mingshuai Chen Institute of Software, CAS Synthesizing Controllers Resilient to Delay Los Angeles, ATVA 08 0 / 5

47 Non-Order-Preserving Delays How About Non-Order-Preserving Delays? Observations may arrive out-of-order : Maximum delay 5 Out of order! Sample # t Mingshuai Chen Institute of Software, CAS Synthesizing Controllers Resilient to Delay Los Angeles, ATVA 08 / 5

48 Non-Order-Preserving Delays How About Non-Order-Preserving Delays? Observations may arrive out-of-order : Maximum delay 5 Sample # Out of order! t But this may only reduce effective delay, improving controllability : Maximum delay 5 Factual delay 3 Sample # t ! Effective delay More recent state information available earlier 65 Mingshuai Chen Institute of Software, CAS Synthesizing Controllers Resilient to Delay Los Angeles, ATVA 08 / 5

49 Non-Order-Preserving Delays How About Non-Order-Preserving Delays? Observations may arrive out-of-order : Maximum delay 5 Sample # Out of order! t But this may only reduce effective delay, improving controllability : Maximum delay 5 Factual delay 3 Sample # t ! Effective delay More recent state information available earlier 65 Wrt qualitative controllability, the worst-case of out-of-order delivery is equivalent to order-preserving delay k Stochastically expected controllability even better than for strict delay k Mingshuai Chen Institute of Software, CAS Synthesizing Controllers Resilient to Delay Los Angeles, ATVA 08 / 5

50 Outline Safety Games under Delay Delayed observation and actuation Reducibility to standard safety games 3 Synthesizing Controllers Resilient to Delayed Interaction Incremental handling of order-preserving delays Out-of-order delivery 4 Performance 5 Summary Mingshuai Chen Institute of Software, CAS Synthesizing Controllers Resilient to Delay Los Angeles, ATVA 08 / 5

51 Performance Incremental vs Reduction-Based 4 M Chen et al Benchmark Reduction + Explicit-State Synthesis Incremental Explicit-State Synthesis name S U δmax δ = 0 δ = δ = δ = 3 δ = 4 δmax δ = 0 δ = δ = δ = 3 δ = 4 % Exmptrv Exmptrv 4 4 = = Escp = = Escp = = Escp ?? = Escp ?? = Escp ?? = Escp ?? = Escp ???? = Benchmark Reduction + Yosys + SafetySynth (symbolic) (explicit-state implementation) name δmax δ = 0 δ = δ = δ = 3 δ = 4 δ = 5 δ = 6 δ = 0 δ = δ = δ = 3 δ = 4 δ = 5 δ = 6 % Stub4 4 = Stub4 5 = Stub5 5 = Stub5 6 = Stub6 6 = Stub7 7 = δmax: the maximum delay under which Gδ is controllable δmax = δ : Gδ is verified controllable under delays 0 δ δ while uncontrollable under any delay δ > δ δmax Table δ : : Gδ is Benchmark verified controllable resultsunder in relation delays 0to reduction-based δ δ within hour approaches CPU time(time bound, inyet seconds) unknown under δ > δ due to the limitation of computing capability : already for smaller δ the controller has no winning strategy?: algorithm fails to answer the control/synthesis problem within hour of CPU time %: percentage of savings in state space compared to the reduction-based methods, as obtained on δmax + Table : Benchmark results in relation to reduction-based approaches (time in seconds) Mingshuai Chen Institute of Software, CAS Synthesizing Controllers Resilient to Delay Los Angeles, ATVA 08 3 / 5

52 Performance Incremental vs Reduction-Based 4 M Chen et al Benchmark Reduction + Explicit-State Synthesis Incremental Explicit-State Synthesis name S U δmax δ = 0 δ = δ = δ = 3 δ = 4 δmax δ = 0 δ = δ = δ = 3 δ = 4 % Exmptrv Exmptrv 4 4 = = Escp = = Escp = = Escp ?? = Escp ?? = Escp ?? = Escp ?? = Escp ???? = Benchmark Reduction + Yosys + SafetySynth (symbolic) (explicit-state implementation) name δmax δ = 0 δ = δ = δ = 3 δ = 4 δ = 5 δ = 6 δ = 0 δ = δ = δ = 3 δ = 4 δ = 5 δ = 6 % Stub4 4 = Stub4 5 = Stub5 5 = Stub5 6 = Stub6 6 = Stub7 7 = δmax: the maximum delay under which Gδ is controllable δmax = δ : Gδ is verified controllable under delays 0 δ δ while uncontrollable under any delay δ > δ δmax Table δ : : Gδ is Benchmark verified controllable resultsunder in relation delays 0to reduction-based δ δ within hour approaches CPU time(time bound, inyet seconds) unknown under δ > δ due to the limitation of computing capability : already for smaller δ the controller has no winning strategy?: algorithm fails to answer the control/synthesis problem within hour of CPU time %: percentage of savings in state space compared to the reduction-based methods, as obtained on δmax + Table : Benchmark results in relation to reduction-based approaches (time in seconds) Mingshuai Chen Institute of Software, CAS Synthesizing Controllers Resilient to Delay Los Angeles, ATVA 08 3 / 5

53 Outline Safety Games under Delay Delayed observation and actuation Reducibility to standard safety games 3 Synthesizing Controllers Resilient to Delayed Interaction Incremental handling of order-preserving delays Out-of-order delivery 4 Performance 5 Summary Mingshuai Chen Institute of Software, CAS Synthesizing Controllers Resilient to Delay Los Angeles, ATVA 08 4 / 5

54 Summary Problem : We face increasingly wide-spread use of networked distributed sensing and control, substantial delays thus impacting controllability and control performance, naïve reduction to delay-free settings, yet with an exponential blow-up Status : We present insufficiency of memoryless control strategies for discrete safety games under delay, incremental algorithm for efficient delay-tolerant control synthesis, the practically relevant case of non-order-preserving delays Future Work : We plan to integrate stochastic models of message delays into safety synthesis processes, let synthesis constructively leverage the advantages of (partial) control on out-of-order delivery, extend to hybrid setting combining delayed continuous and delayed discrete reactive behavior Mingshuai Chen Institute of Software, CAS Synthesizing Controllers Resilient to Delay Los Angeles, ATVA 08 5 / 5