Vector Barrier Certificates and Comparison Systems

Transcription

1 Vector Barrier Certificates and Comparison Systems Andrew Sogokon 1 Khalil Ghorbal 2 Yong Kiam Tan 1 André Platzer Carnegie Mellon University, Pittsburgh, USA 2 - Inria, Rennes, France 16 July 2018, FM 2018, Oxford, UK 1/26

2 Preliminaries: Systems of ODEs An autonomous n-dimensional system of ODEs has the general form: x 1 = f 1(x 1,..., x n),. x n = f n(x 1,..., x n), where x i denotes the time derivative dx i dt and fi are continuous functions. 2/26

3 Preliminaries: Systems of ODEs An autonomous n-dimensional system of ODEs has the general form: x 1 = f 1(x 1,..., x n),. x n = f n(x 1,..., x n), where x i denotes the time derivative dx i dt and fi are continuous functions. We write x = f(x). The vector field f : R n R n gives the direction of motion at each point in space. 2/26

4 Preliminaries: Systems of ODEs An autonomous n-dimensional system of ODEs has the general form: x 1 = f 1(x 1,..., x n),. x n = f n(x 1,..., x n), where x i denotes the time derivative dx i dt and fi are continuous functions. We write x = f(x). The vector field f : R n R n gives the direction of motion at each point in space. A solution x(x 0, t) : R n R R n exactly describes the motion of a particle x 0 under the influence of the vector field. 2/26

5 Example: Van der Pol oscillator The Van der Pol system oscillator evolves according to the following ODEs: x 1 = x 2, x 2 = (1 x 2 1)x 2 x 1 3/26

6 Example: Van der Pol oscillator The Van der Pol system oscillator evolves according to the following ODEs: x 1 = x 2, x 2 = (1 x 2 1)x 2 x 1 x 0 3/26

7 Example: Van der Pol oscillator The Van der Pol system oscillator evolves according to the following ODEs: x 1 = x 2, x 2 = (1 x 2 1)x 2 x 1 x 0 x(x 0, t) 3/26

8 Barrier certificates Lyapunov-like safety verification method, due to Prajna & Jadbabaie (2004). MAIN IDEA: Find a differentiable function B : R n R such that B(x) > 0 holds for every x Unsafe, For all x 0 Init, B(x(x 0, t)) 0 holds for all future t. 4/26

9 Barrier certificates Lyapunov-like safety verification method, due to Prajna & Jadbabaie (2004). MAIN IDEA: Find a differentiable function B : R n R such that B(x) > 0 holds for every x Unsafe, For all x 0 Init, B(x(x 0, t)) 0 holds for all future t. x2 Init Unsafe x 1 4/26

10 Barrier certificates Lyapunov-like safety verification method, due to Prajna & Jadbabaie (2004). MAIN IDEA: Find a differentiable function B : R n R such that B(x) > 0 holds for every x Unsafe, For all x 0 Init, B(x(x 0, t)) 0 holds for all future t. B > 0 x2 B 0 Init Unsafe B > 0 x 1 4/26

11 Barrier certificates (more formally) Lemma (Safety with semantic barrier certificates) Given : a system of n first-order ODEs x = f(x), 5/26

12 Barrier certificates (more formally) Lemma (Safety with semantic barrier certificates) Given : a system of n first-order ODEs x = f(x), possibly an evolution constraint Q R n, 5/26

13 Barrier certificates (more formally) Lemma (Safety with semantic barrier certificates) Given : a system of n first-order ODEs x = f(x), possibly an evolution constraint Q R n, a set of initial states Init R n, 5/26

14 Barrier certificates (more formally) Lemma (Safety with semantic barrier certificates) Given : a system of n first-order ODEs x = f(x), possibly an evolution constraint Q R n, a set of initial states Init R n, and a set of unsafe states Unsafe R n, 5/26

15 Barrier certificates (more formally) Lemma (Safety with semantic barrier certificates) Given : a system of n first-order ODEs x = f(x), possibly an evolution constraint Q R n, a set of initial states Init R n, and a set of unsafe states Unsafe R n, if a differentiable (barrier) function B : R n R satisfies the following conditions, then the system is safe: 1 x Unsafe. B(x) > 0, ( ) 2 x 0 Init. t 0. ( τ [0, t]. x(x 0, τ) Q) B(x(x 0, t)) 0. 5/26

16 Kinds of barrier certificates Recall the (semantic) conditions: 1 x Unsafe. B(x) > 0, ( ) 2 x 0 Init. t 0. ( τ [0, t]. x(x 0, τ) Q) B(x(x 0, t)) 0. 6/26

17 Kinds of barrier certificates Recall the (semantic) conditions: 1 x Unsafe. B(x) > 0, ( ) 2 x 0 Init. t 0. ( τ [0, t]. x(x 0, τ) Q) B(x(x 0, t)) 0. Several direct sufficient conditions have been proposed to ensure the last requirement. Observe that the solutions x(x 0, t) are not explicit. Convex (Prajna & Jadbabaie, 2004) Exponential-type (Kong et al., 2013) General (Dai et al., 2017) Q B 0. Q B λb. Q B ω(b), t 0. b(t) 0, b is the solution to b = ω(b). 6/26

18 Kinds of barrier certificates Recall the (semantic) conditions: 1 x Unsafe. B(x) > 0, ( ) 2 x 0 Init. t 0. ( τ [0, t]. x(x 0, τ) Q) B(x(x 0, t)) 0. Several direct sufficient conditions have been proposed to ensure the last requirement. Observe that the solutions x(x 0, t) are not explicit. Convex (Prajna & Jadbabaie, 2004) Exponential-type (Kong et al., 2013) General (Dai et al., 2017) Q B 0. Q B λb. Q B ω(b), t 0. b(t) 0, b is the solution to b = ω(b). All these conditions are instantiations of the comparison principle. 6/26

19 Comparison principle Used by R. Conti (1956), F. Brauer, C. Corduneanu (1960s), many others. Not a new idea in applied mathematics; used in stability theory. 7/26

20 Comparison principle Used by R. Conti (1956), F. Brauer, C. Corduneanu (1960s), many others. Not a new idea in applied mathematics; used in stability theory. MAIN IDEA: Given x = f(x), if a positive definite differentiable function V : R n R satisfies the differential inequality V ω(v ), where ω : R R is an appropriate scalar function, one may infer the stability of x = f(x) from the stability of the one-dimensional system v = ω(v). 7/26

21 Comparison principle Used by R. Conti (1956), F. Brauer, C. Corduneanu (1960s), many others. Not a new idea in applied mathematics; used in stability theory. MAIN IDEA: Given x = f(x), if a positive definite differentiable function V : R n R satisfies the differential inequality V ω(v ), where ω : R R is an appropriate scalar function, one may infer the stability of x = f(x) from the stability of the one-dimensional system v = ω(v). One obtains an abstraction of the system by another one-dimensional system. 7/26

22 Comparison theorem (scalar majorization) The comparison principle hinges on an appropriate comparison theorem. Theorem (Scalar comparison theorem) Let V (t) and v(t) be real valued functions differentiable on [0, T ]. If V ω(v ) and v = ω(v) holds on [0, T ] for some locally Lipschitz continuous function ω and if V (0) = v(0), then for all t [0, T ] one has V (t) v(t). Informally, Solutions to the ODE v = ω(v) act as upper bounds (i.e. majorize) solutions to V ω(v ). 8/26

23 Comparison principle 1. Introduce a fresh variable v (really a function of time v(t)), 9/26

24 Comparison principle 1. Introduce a fresh variable v (really a function of time v(t)), 2. Replace the scalar differential inequality V ω(v ) by an equality. 9/26

25 Comparison principle 1. Introduce a fresh variable v (really a function of time v(t)), 2. Replace the scalar differential inequality V ω(v ) by an equality. V ω(v ) v = ω(v) 9/26

26 Comparison principle 1. Introduce a fresh variable v (really a function of time v(t)), 2. Replace the scalar differential inequality V ω(v ) by an equality. V ω(v ) v = ω(v) Obtain one-dimensional abstraction; 1-d systems are easy to study. ω(v) v 9/26

27 Kinds of barrier certificates Recall the (semantic) conditions: 1 x Unsafe. B(x) > 0, ( ) 2 x 0 Init. t 0. ( τ [0, t]. x(x 0, τ) Q) B(x(x 0, t)) 0. Several direct sufficient conditions have been proposed to ensure the last requirement. Observe that the solutions x(x 0, t) are not explicit. Convex (Prajna & Jadbabaie, 2004) Exponential-type (Kong et al., 2013) General (Dai et al., 2017) Q B 0. Q B λb. Q B ω(b), t 0. b(t) 0, b is the solution to b = ω(b). All these conditions are instantiations of the comparison principle. 10/26

28 Convex barrier certificates (Prajna & Jadbabaie, 2004) ω(b) Differential inequality B 0 0 B 0 b Comparison system b = 0 11/26

29 Exponential-type barrier certificates (Kong et al., 2013) ω(b) λb Differential inequality B λb B 0 b Comparison system b = λb 12/26

30 General barrier certificates (Dai, et al., 2017) ω(b) ω(b) Differential inequality B ω(b) r 1 r 2 B r 1 r 2 b Comparison system b = ω(b) 13/26

31 Scalar barrier certificates as comparison systems ω(b) ω(b) λb ω(b) ω(b) 0 B B r 1 r 2 B 0 b 0 b r 1 r 2 b (a) Constant (zero) Convex (b) Linear Exponential (c) Non-linear General 14/26

32 Scalar barrier certificates as comparison systems ω(b) ω(b) λb ω(b) ω(b) 0 B B r 1 r 2 B 0 b 0 b r 1 r 2 b (a) Constant (zero) Convex (b) Linear Exponential (c) Non-linear General Can we leverage the comparison principle to go beyond the scalar case? 14/26

33 Vector comparison systems R.E. Bellman introduced vector Lyapunov functions in /26

34 Vector comparison systems R.E. Bellman introduced vector Lyapunov functions in MAIN IDEA: Given x = f(x), if a positive definite differentiable function V : R n R m satisfies the differential inequality V ω(v ), where ω : R m R m is an appropriate vector function, one may infer the stability of x = f(x) from the stability of the m-dimensional system v = ω(v). 15/26

35 Vector comparison systems R.E. Bellman introduced vector Lyapunov functions in MAIN IDEA: Given x = f(x), if a positive definite differentiable function V : R n R m satisfies the differential inequality V ω(v ), where ω : R m R m is an appropriate vector function, one may infer the stability of x = f(x) from the stability of the m-dimensional system v = ω(v). One obtains an abstraction of the system by another m-dimensional system. 15/26

36 Vector comparison systems R.E. Bellman introduced vector Lyapunov functions in MAIN IDEA: Given x = f(x), if a positive definite differentiable function V : R n R m satisfies the differential inequality V ω(v ), where ω : R m R m is an appropriate vector function, one may infer the stability of x = f(x) from the stability of the m-dimensional system v = ω(v). One obtains an abstraction of the system by another m-dimensional system.!!! CAVEAT: The vector function ω needs to be quasi-monotone increasing. 15/26

37 Quasi-monotone increasing functions Definition A function ω : R m R m is said to be quasi-monotone increasing if ω i (x) ω i (y) for all i = 1,..., m and all x, y such that x i = y i, and x k y k for all k i. 16/26

38 Quasi-monotone increasing functions Definition A function ω : R m R m is said to be quasi-monotone increasing if ω i (x) ω i (y) for all i = 1,..., m and all x, y such that x i = y i, and x k y k for all k i. Every scalar function is (trivially) quasi-monotone increasing. 16/26

39 Quasi-monotone increasing functions Definition A function ω : R m R m is said to be quasi-monotone increasing if ω i (x) ω i (y) for all i = 1,..., m and all x, y such that x i = y i, and x k y k for all k i. Every scalar function is (trivially) quasi-monotone increasing. A linear function ω(x) = Ax is quasi-monotone increasing if and only if A is essentially non-negative, i.e. all off-diagonal entries of A are non-negative. 16/26

40 Quasi-monotone increasing functions Definition A function ω : R m R m is said to be quasi-monotone increasing if ω i (x) ω i (y) for all i = 1,..., m and all x, y such that x i = y i, and x k y k for all k i. Every scalar function is (trivially) quasi-monotone increasing. A linear function ω(x) = Ax is quasi-monotone increasing if and only if A is essentially non-negative, i.e. all off-diagonal entries of A are non-negative. Matrices with this property are also known as Metzler matrices. 16/26

41 Vector comparison principle 1. Introduce a fresh vector of variables v (vector function of time v(t)), 17/26

42 Vector comparison principle 1. Introduce a fresh vector of variables v (vector function of time v(t)), 2. Replace the vector differential inequality V ω(v ) by an equality. 17/26

43 Vector comparison principle 1. Introduce a fresh vector of variables v (vector function of time v(t)), 2. Replace the vector differential inequality V ω(v ) by an equality. V ω(v ) v = ω(v) 17/26

44 v Vector comparison principle 1. Introduce a fresh vector of variables v (vector function of time v(t)), 2. Replace the vector differential inequality V ω(v ) by an equality. V ω(v ) v = ω(v) Obtain an m-dimensional abstraction. More general than the scalar principle. v 17/26

45 Vector comparison principle Theorem (Linear vector comparison theorem) For a given system of ODEs x = f(x) and a Metzler matrix, A R m m, if V = (V 1, V 2,..., V m ) satisfies the system of differential inequalities V AV, then for all t 0 the inequality V (t) v(t) holds component-wise, where v(t) is the solution to the comparison system v = Av, and v(0) = V (0). 18/26

46 Vector comparison principle Theorem (Linear vector comparison theorem) For a given system of ODEs x = f(x) and a Metzler matrix, A R m m, if V = (V 1, V 2,..., V m ) satisfies the system of differential inequalities V AV, then for all t 0 the inequality V (t) v(t) holds component-wise, where v(t) is the solution to the comparison system v = Av, and v(0) = V (0). Metzler matrices have another important property: Lemma If A R m m is a Metzler matrix, then for any v 0 0, the solution v(t) to the linear system v = Av is such that v(t) 0 for all t 0. 18/26

47 Vector barrier certificates Theorem Given an m-vector of functions B = (B 1, B 2,..., B m ) and some essentially non-negative m m matrix A, if the following conditions hold, then the system is safe: VBC 1. x R n. (Init m i=1 B i 0), VBC 2. x R n. (Unsafe m i=1 B i > 0), VBC 3. x R n. (Q B AB). 19/26

48 Vector barrier certificates Theorem Given an m-vector of functions B = (B 1, B 2,..., B m ) and some essentially non-negative m m matrix A, if the following conditions hold, then the system is safe: VBC 1. x R n. (Init m i=1 B i 0), VBC 2. x R n. (Unsafe m i=1 B i > 0), VBC 3. x R n. (Q B AB). Generation? 19/26

49 Vector barrier certificates Theorem Given an m-vector of functions B = (B 1, B 2,..., B m ) and some essentially non-negative m m matrix A, if the following conditions hold, then the system is safe: VBC 1. x R n. (Init m i=1 B i 0), VBC 2. x R n. (Unsafe m i=1 B i > 0), VBC 3. x R n. (Q B AB). Generation? Unfortunately VBC 2 leads to non-convexity. Convexity enables the use of efficient semidefinite solvers. 19/26

50 Vector barrier certificate (convex) Theorem Given an m-vector of functions B = (B 1, B 2,..., B m ) and some essentially non-negative m m matrix A, if for some i {1,..., m} the following conditions hold, then the system is safe: VBC 1. x R n. (Init m i=1 B i 0), VBC 2. x R n. (Unsafe B i > 0), VBC 3. x R n. (Q B AB). The above conditions define a convex set. 20/26

51 Generating vector barrier certificates using SDP Solve a sum-of-squares optimization problem for size m vector barrier certificates B 1, B 2,..., B m, with i {1,..., m}: B i Σ a j=1σ Ii,j I j 0 for all i = 1, 2,..., m (VBC 1) B i Σ b j=1σ Uj U j ɛ 0 (VBC 2) Σ m j=1a ijb j B i Σ c j=1σ Qi,j Q j 0 for all i = 1, 2,..., m (VBC 3) Possible using e.g. SOSTOOLS toolbox in Matlab, together with a semidefinite solve (e.g. SeDuMi). 21/26

52 Vector barrier certificates (deductive power) Theorem Polynomial convex or exponential-type barrier certificates (trivially) satisfy the conditions VBC 1-3 (or VBC 1-3). The converse is false. 22/26

53 Vector barrier certificates (deductive power) Theorem Polynomial convex or exponential-type barrier certificates (trivially) satisfy the conditions VBC 1-3 (or VBC 1-3). The converse is false. There are vector barrier certificates for some safety properties where scalar barrier certificates do not exist. 22/26

54 Vector barrier certificates (deductive power) Theorem Polynomial convex or exponential-type barrier certificates (trivially) satisfy the conditions VBC 1-3 (or VBC 1-3). The converse is false. There are vector barrier certificates for some safety properties where scalar barrier certificates do not exist. Vector barrier certificates can also exist with lower polynomial degrees than is possible with scalar barrier certificates! 22/26

55 Vector barrier certificates (example) x 1 = x 2, x 2 = x 1, ( ) ( )( ) B Vector barrier certificate (B 1, B 2) = (x 1, x 2) satisfies B 1 B B 2 and has polynomial degree 1. No scalar barrier certificate of degree 1 exists x x1 23/26

56 Summary The comparison principle is a powerful and fundamental abstraction mechanism for ODEs. 24/26

57 Summary The comparison principle is a powerful and fundamental abstraction mechanism for ODEs. Existing (scalar) notions of barrier certificates follow easily from this principle. 24/26

58 Summary The comparison principle is a powerful and fundamental abstraction mechanism for ODEs. Existing (scalar) notions of barrier certificates follow easily from this principle. A generalization of existing notions of barrier certificates is achieved, following Bellman s use of the vector comparison principle. 24/26

59 Summary The comparison principle is a powerful and fundamental abstraction mechanism for ODEs. Existing (scalar) notions of barrier certificates follow easily from this principle. A generalization of existing notions of barrier certificates is achieved, following Bellman s use of the vector comparison principle. Also possible to use time-dependent Metzler matrices, i.e. A(t). Work on this ongoing. 24/26

60 Limitations Choosing an appropriate Metzler matrix A for the comparison system is generally non-trivial. 25/26

61 Limitations Choosing an appropriate Metzler matrix A for the comparison system is generally non-trivial. Numerical inaccuracies in the results (to be expected with existing solvers). 25/26

62 Limitations Choosing an appropriate Metzler matrix A for the comparison system is generally non-trivial. Numerical inaccuracies in the results (to be expected with existing solvers). Trade-off: dimension of the comparison system vs degree of the barrier functions. 25/26

63 End Questions? Acknowledgments This work was supported by the National Science Foundation under NSF CPS Award CNS and by the AFOSR under grant number FA ; the third author was supported by the National Science Scholarship from A*STAR, Singapore. 26/26