Exploiting System Structure in Formal Synthesis

Transcription

1 CDC 2015 Pre-Conference Workshop Exploiting System Structure in Formal Synthesis Murat Arcak with Sam Coogan and Eric Kim Electrical Engineering and Computer Sciences, UC Berkeley

2 This Talk: Formal synthesis, motivated by traffic control q 1 q 2 q 3 q 4 q 5 q 6 Finite state abstraction x + = F (x) finite abstraction formal methods Outline: 1. Finite abstraction for formal methods Exploiting a mixed monotonicity property for scalability. Application to a macroscopic traffic flow model. 2. Compositional synthesis for large networks Decoupled synthesis for subnetworks with supply and demand contracts.

3 1. Finite Abstraction for Formal Methods q 1 q 2 q 3 q 4 q 5 q 6 Finite state abstraction Capture the underlying dynamics with a finite set of symbols and transitions between them. Methods exist for classes of systems (Tabuada, Girard, Pappas, Reissig, Abate, Belta, and others ) Example: polyhedral computations for piecewise affine systems (Belta et al.)

4 Monotonicity and Mixed Monotonicity The discrete-time system: is monotone if x + = F (x) x 2X x 1 apple x 2 =) F (x 1 ) apple F (x 2 ) with respect to a partial order (standard order in this talk). Monotonicity offers strong dynamical properties [Hirsch, Smith, Angeli, Sontag] but is restrictive in practice. Necessary and sufficient condition for i j 0 8x 2X 8i, j

5 x + = F (x) x 2X is mixed monotone if there exists a decomposition function such that Monotonicity and Mixed Monotonicity f : X X!X f(x, x) =F (x) x 1 apple x 2 ) f(x 1,y) apple f(x 2,y) y 1 apple y 2 ) f(x, y 2 ) apple f(x, y 1 ). A sufficient condition for mixed monotonicity: 9 ij 2 { 1, 1} s.t. i (x) 0 8i, j y j Decomposition function: F i (,x j, ) if ij = 1

6 Mixed Monotonicity Allows Scalable Finite Abstraction Two function evaluations tightly bound the one-step reach set: Monotone: Mixed Monotone: This allows a scalable abstraction algorithm: [Coogan, Arcak, 2015] q 1 q 4 q 5 q 2 q 3 q 6

7 Traffic Flow: a Macroscopic Model For each link `: Vehicles per time period Demand, F out i (x i ) Supply, F in i (x i ) x +` = x` + f in ` (x) f` out (x) =:F`(x) x jam i x i Outgoing links: f in k (x, m) = X`2in Incoming links: f` out (x, m) =s`(m)min {0, 1} `kf out ` (x, m) out ` (x`), min k2out turn ratio 1 `k in k (x k )

8 Traffic Flow is Mixed Monotone i j 0 ij = 1 if i and j share tail node +1 otherwise Apply abstraction algorithm and add signaling states to transition model q 1 q 4 q 5 q 2 q 3 q 6 Finite state abstraction finite abstraction Note: Standard monotonicity breaks down at splits formal methods ` =3 f out 1 = 1 12 in 2 (x 2 ) ` =1 ` =2 congested f in 3 = 13 f out 1 = 13 ) 32 = 1 12 in 2 (x 2 )

9 Example: Signal Control for a Corridor Naïve offset optimal policy Temporal Logic Specifications: Each signal actuates cross street traffic infinitely often Eventually, links 1, 2, 3, and 4 have fewer than 30 vehicles each The signal at junction 4 must actuate cross street traffic for at least two sequential time-steps Correct-by-design policy

10 2. Compositional Synthesis for Large Networks [Kim, Arcak, Seshia, 2015] Contracts between neighboring subnetworks to limit demand and guarantee adequate supply Neighbors promises allow decoupled subnetwork models with set valued maps Augment temporal logic specifications with own promises and synthesize controller for each subnetwork new i = original i ^ supply i ^ demand i i =1, 2,... promises to neighbors

11 Neighbors Promises Allow Decoupled Models Subnetwork 2 promises a minimum supply of 2 on link 5 and to limit its demand on link 4 by vehicles per period. contract contract 4 Decoupled subnet 1 model: 2 (x) =min 2 min f out f in 4 (x) = 74 min 2 74 min out 2 (x 2 ), out 2 (x 2 ), out 7 (x 7 ), 25, 2 [ 1 78 in 4 (x 4 ),, 2 [0, in 5 (x 5 ) contract 2, in 8 (x 8 ), contract 4 ] 1 best 2 ] 74 in 4 (x 4 )

12 Restrictions on the Specification 1. Separability: network = subnet 1 ^ ^ subnet N Then the th subproblem is: i subnet i ^ supply i ^ demand i II. Easier to satisfy subnet i when i s neighbors promise more This allows a systematic search for contract parameters. Example: The class of specifications subnet i = ^ ^ {^j=1,,l j } ^ {^j=1,,m apple j } has this property if the dynamics x 2 are monotone and the propositions,, j,apple j are true on lower sets: x apple x and x 2 S ) x 2 S S x x 1

13 Proof idea in a picture: If subnet 2 promises more supply on link 5, then link 2 occupancy drops. Likewise less occupancy on link 4 if x 4 more supply initial set one step reach set less demand less demand is promised. x 2 Why monotonicity matters: If subnet 1 promises more supply on link 4, this liberates more flow out of link 7 and causes higher occupancy on link 8 (contrary to fig. above).

14 Acknowledgment: NSF-CPS grant CNS and coworkers: Sam Coogan Calin Belta Roberto Horowitz Eric Kim Sanjit Seshia Alex Kurzhanskiy

15 Related Publications Coogan and Arcak Efficient finite abstraction of mixed monotone systems HSCC 2015 Coogan, Gol, Arcak and Belta Traffic network control from temporal logic specifications IEEE Trans. Control of Network Systems, 2015 Coogan and Arcak Freeway traffic control from linear temporal logic specifications ICCPS 2014 Kim, Arcak and Seshia Compositional controller synthesis for vehicular traffic networks to be presented at this conference