Meeko Oishi

Computational techniques for the verification of hybrid systems

Hybrid system theory lies at the intersection of the fields of engineering control theory and computer science verification. It is defined as the modeling, analysis, and control of systems that involve the interaction of both discrete state systems, represented by finite automata, and continuous state dynamics, represented by differential equations. The embedded autopilot of a modern commercial jet is a prime example of a hybrid system: the autopilot modes correspond to the application of different control laws, and the logic of mode switching is determined by the continuous state dynamics of the aircraft, as well as through interaction with the pilot. To understand the behavior of hybrid systems, to simulate, and to control these systems, theoretical advances, analyses, and numerical tools are needed. In this paper, we first present a general model for a hybrid system along with an overview of methods for verifying continuous and hybrid systems. We describe a particular verification technique for hybrid systems, based on two-person zero-sum game theory for automata and continuous dynamical systems. We then outline a numerical implementation of this technique using level set methods, and we demonstrate its use in the design and analysis of aircraft collision avoidance protocols and in verification of autopilot logic.

Aircraft Autolander Safety Analysis Through Optimal Control-Based Reach Set Computation

and safety analysis of autoland systems. It is shown to be applicable to specific phases of landing: descent, flare, and touchdown. The method is based on optimal control and level set methods; it simultaneously computes a maximal controlled invariant set and a set-valued control law guaranteed to keep the aircraft within a safe set of states under autopilot mode switching. The method is applied to the sequenced flap and slat deflections of a simplified model of a DC9-30. The paper concludes with a demonstration of the method on higher dimensional aircraft models.

Lagrangian methods for approximating the viability kernel in high-dimensional systems

Abstract While a number of Lagrangian algorithms to approximate reachability in dozens or even hundreds of dimensions for systems with linear dynamics have recently appeared in the literature, no similarly scalable algorithms for approximating viable sets have been developed. In this paper we describe a connection between reachability and viability that enables us to compute the viability kernel using reach sets. This connection applies to any type of system, such as those with nonlinear dynamics and/or non-convex state constraints; however, here we take advantage of it to construct three viability kernel approximation algorithms for linear systems with convex input and state constraint sets. We compare the performance of the three algorithms and demonstrate that the two based on highly scalable Lagrangian reachability–those using ellipsoidal and support vector set representations–are able to compute the viability kernel for linear systems of larger state dimension than was previously feasible using traditional Eulerian methods. Our results are illustrated on a 6-dimensional pharmacokinetic model and a 20-dimensional model of heat conduction on a lattice.

Invariance-Preserving Abstractions of Hybrid Systems: Application to User Interface Design

Hybrid systems combine discrete state dynamics which model mode switching, with continuous state dynamics which model physical processes. Hybrid systems can be controlled by affecting both their discrete mode logic and continuous dynamics: in many systems, such as commercial aircraft, these can be controlled both automatically and using manual control. A human interacting with a hybrid system is often presented, through information displays, with a simplified representation of the underlying system. This user interface should not overwhelm the human with unnecessary information, and thus usually contains only a subset of information about the true system model, yet, if properly designed, represents an abstraction of the true system which the human is able to use to safely interact with the system. In safety-critical systems, correct and succinct interfaces are paramount: interfaces must provide adequate information and must not confuse the user. We present an invariance-preserving abstraction which generates a discrete event system that can be used to analyze, verify, or design user-interfaces for hybrid human-automation systems. This abstraction is based on hybrid system reachability analysis, in which, through the use of a recently developed computational tool, we find controlled invariant regions satisfying a priori safety constraints for each mode, and the controller that must be applied on the boundaries of the computed sets to render the sets invariant. By assigning a discrete state to each computed invariant set, we create a discrete event system representation which reflects the safety properties of the hybrid system. This abstraction, along with the formulation of an interface model as a discrete event system, allows the use of discrete techniques for interface analysis, including existing interface verification and design methods. We apply the abstraction method to two examples: a car traveling through a yellow light at an intersection, and an aircraft autopilot in a landing/go-around maneuver.

Hybrid verification of an interface for an automatic landing

Modern commercial aircraft have extensive automation which helps the pilot by performing computations, obtaining data, and completing procedural tasks. The pilot display must contain enough information so that the pilot can correctly predict the aircrafts behavior, while not overloading the pilot with unnecessary information. Human-automation interaction is currently evaluated through extensive simulation. In this paper, using both hybrid and discrete-event system techniques, we show how one could mathematically verify that an interface contains enough information for the pilot to safely and unambiguously complete a desired maneuver. We first develop a nonlinear, hybrid model for the longitudinal dynamics of a large civil jet aircraft in an autoland/go-around maneuver. We find the largest controlled subset of the aircrafts flight envelope for which we can guarantee both safe landing and safe go-around. We abstract a discrete procedural model using this result, and verify a discrete formulation of the pilot display against it. An interface which fails this verification could result in nondeterministic or unpredictable behavior from the pilots point of view.

Computing the viability kernel using maximal reachable sets

We present a connection between the viability kernel and maximal reachable sets. Current numerical schemes that compute the viability kernel suffer from a complexity that is exponential in the dimension of the state space. In contrast, extremely efficient and scalable techniques are available that compute maximal reachable sets. We show that under certain conditions these techniques can be used to conservatively approximate the viability kernel for possibly high-dimensional systems. We demonstrate the results on two practical examples, one of which is a seven-dimensional problem of safety in anesthesia.

Computing Viable Sets and Reachable Sets to Design Feedback Linearizing Control Laws Under Saturation

We consider feedback linearizable systems subject to bounded control input and nonlinear state constraints. In a single computation, we synthesize 1) parameterized nonlinear controllers based on feedback linearization, and 2) the set of states over which this controller is valid. This is accomplished through a reachability calculation, in which the state is extended to incorporate input parameters. While we use a Hamilton-Jacobi formulation, a viability approach is also feasible. The result provides a mathematical guarantee that for all states within the computed set, there exists a control law that simultaneously satisfy two separate goals: envelope protection (no violation of state constraints), and stabilization despite saturation. We apply this technique to two real-world systems: the longitudinal dynamics of a civil jet aircraft, and a two-aircraft, planar collision avoidance scenario. The result, in both cases, is a feasible range of input parameters for the nonlinear control law, and a corresponding controlled invariant set

Immediate observability of discrete event systems with application to user-interface design

A human interacting with a hybrid system is often presented, through information displays, with a simplified representation of the underlying system. This interface should not overwhelm the human with unnecessary information, and thus usually contains only a subset of information about the true system model, yet, if properly designed, represents an abstraction of the true system which the human is able to use to safely interact with the system [M. Heymann and A. Degani, 2002]. For cases in which the human interacts with all or part of the system from a remote location, and communication has a high cost, the need for a simple abstraction, which reduces the amount of information that must be transmitted, is of the utmost importance. The user should be able to immediately determine the actual state of the system, based on the information displayed through the interface. In this paper, we derive conditions for immediate observability in which the current state of the system can be unambiguously reconstructed from the output associated with the current state and the last or next event. Then, we show how to construct a discrete event system output function, which makes a system immediately observable, and apply this to a reduced state machine, which represents an interface.

Addressing Multiobjective Control: Safety and Performance through Constrained Optimization

We address systems which have multiple objectives: broadly speaking, these objectives can be thought of as safety and performance goals. Guaranteeing safety is our first priority, satisfying performance criteria our second. In this paper, we compute the systems safe operating space and represent it in closed form, and then, within this space, we compute solutions which optimize a given performance criterion. We describe the methodology and illustrate it with two examples of systems in which safety is paramount: a two-aircraft collision avoidance scenario and the flight management system of a VSTOL aircraft. In these examples, performance criteria are met using mixed-integer nonlinear programming (MINLP) and nonlinear programming (NLP), respectively. Optimized trajectories for both systems demonstrate the effectiveness of this methodology on systems whose safety is critical.

Parkinson's disease rigidity: relation to brain connectivity and motor performance

Objective: (1) To determine the brain connectivity pattern associated with clinical rigidity scores in Parkinson’s disease (PD) and (2) to determine the relation between clinically assessed rigidity and quantitative metrics of motor performance. Background: Rigidity, the resistance to passive movement, is exacerbated in PD by asking the subject to move the contralateral limb, implying that rigidity involves a distributed brain network. Rigidity mainly affects subjects when they attempt to move; yet the relation between clinical rigidity scores and quantitative aspects of motor performance are unknown. Methods: Ten clinically diagnosed PD patients (off-medication) and 10 controls were recruited to perform an fMRI squeeze-bulb tracking task that included both visually guided and internally guided features. The direct functional connectivity between anatomically defined regions of interest was assessed with Dynamic Bayesian Networks (DBNs). Tracking performance was assessed by fitting Linear Dynamical System (LDS) models to the motor performance, and was compared to the clinical rigidity scores. A cross-validated Least Absolute Shrinkage and Selection Operator (LASSO) regression method was used to determine the brain connectivity network that best predicted clinical rigidity scores. Results: The damping ratio of the LDS models significantly correlated with clinical rigidity scores (p = 0.014). An fMRI connectivity network in subcortical and primary and premotor cortical regions accurately predicted clinical rigidity scores (p < 10−5). Conclusion: A widely distributed cortical/subcortical network is associated with rigidity observed in PD patients, which reinforces the importance of altered functional connectivity in the pathophysiology of PD. PD subjects with higher rigidity scores tend to have less overshoot in their tracking performance, and damping ratio may represent a robust, quantitative marker of the motoric effects of increasing rigidity.