Content uploaded by Houssam Abbas

Author content

All content in this area was uploaded by Houssam Abbas on Apr 02, 2017

Content may be subject to copyright.

Computing Descent Direction of MTL Robustness for Non-Linear Systems

Houssam Abbas and Georgios Fainekos

Abstract—The automatic analysis of transient properties of

nonlinear dynamical systems is achallenging problem. The

problem is even morechallenging when complex state-space

and timing requirements must be satisﬁed by the system. Such

complex requirements can be captured by Metric Temporal

Logic (MTL) speciﬁcations. The problem of ﬁnding system

behaviors that do not satisfy an MTL speciﬁcation is referred

to as MTL falsiﬁcation. This paper presents an approach for

improving stochastic MTL falsiﬁcation methods by performing

local search in the set of initial conditions. In particular,

MTL robustness quantiﬁes howcorrect or wrong is asystem

trajectory with respect to an MTL speciﬁcation. Positivevalues

indicate satisfaction of the property while negativevalues

indicate falsiﬁcation. Astochastic falsiﬁcation method attempts

to minimize the system’srobustness with respect to the MTL

property.Given some arbitrary initial state, this paper presents

amethod to compute adescent direction in the set of initial

conditions, such that the new system trajectory gets closer to the

unsafe set of behaviors. This technique can be iterated in order

to converge to alocal minimum of the robustness landscape.

The paper demonstrates the applicability of the method on

some challenging nonlinear systems from the literature.

I.INTROD UCTIO N

Anumber of applications can only be accurately modeled

using nonlinear dynamical models. Typical such applications

include analog circuits [1]–[3] and biological and medical

systems [4]–[7]. Acommon theme of all the aforementioned

applications is the need to verify transient or periodic proper-

ties of the system. Such properties might involvesequencing

of events, conditional reachability and invariants and real-

time constraints and can be formally captured using temporal

logics [4], [8].

Unfortunately,for complexnonlinear systems, these types

of properties are hard –if not impossible –to verify algorith-

mically.Therefore, recent research efforts havebeen invested

in property falsiﬁcation methods [9]–[12]. In falsiﬁcation,

the space of operating conditions and/or inputs is searched

in order to ﬁnd an initial condition and/or parameter that

will force the system to exhibit an unsafe behavior with

respect to the formal requirement. In turn, the unsafe system

trajectory can be used in order to manually or automatically

modify the system to achievethe desired system behavior

and performance [13], [14].

In [10], [15], the temporal logic falsiﬁcation problem

is converted into an optimization (minimization) problem

based on the notion of robustness of temporal logics [16].

Essentially,asystem trajectory with negativerobustness is

one that proves the existence of unsafe system behaviors.

This work was partially supported by the NSF awards CNS-1017074 and

CNS-1116136.

H. Abbas and G. Fainekos are with the Schools of Engineering at Arizona

State University,Tempe, AZ, E-mail: {hyabbas,fainekos}@asu.edu

Then, anumber of stochastic optimization methods can be

utilized in order to solvethe optimization problem and

ﬁnd asystem trajectory that minimizes the temporal logic

robustness metric.

However,in [10], [15], the system is treated as ablack-

box. In order,to improvethe rate of convergence of stochas-

tic search methods, it is desirable to havetechniques that

can compute local descent directions in the search space.

In particular,if atest is performed starting from an initial

condition xwith property robustness f(x),then adescent

vector dmust be computed so that starting from x+dthe

system has robustness f(x+d)<f(x).Such aprocess

has the potential to speed up the stochastic search method

by enabling gradient descent in the searchspace. In [17],

we demonstrated that in the case of linear hybrid systems

improvements in the convergence rate can be achieved.

Contributions: In this paper,we present amethod forthe

computation of descent vectors for reducing speciﬁcation

robustness for continuous nonlinear dynamical systems. In

particular,given an arbitrary MetricTemporal Logic (MTL)

speciﬁcation [18], we determine acritical point on the system

trajectory which if changed, then the MTL robustness will

be changed as well. Weutilize nonsmooth optimization

theory [19] in order to derivethe equations that compute

adescent vector in the set of initial conditions that will

result in reduced MTL robustness. Finally,we demonstrate

the applicability of our approach on some nonlinear models

from the literature. Weenvision that our results can be

extended to handle arbitrary temporal logic speciﬁcations

over trajectories of hybrid systems.

Related Work: Combined state-space and real-time tem-

poral logic properties havebeen studied in anumber of

different settings. MTL properties of nonlinear systems have

been studied in [12] through abstractions to Linear Pa-

rameter Varying (LPV) systems. The work in [11] studies

the applicability of statistical model checking methods on

stochastic hybrid systems. The temporal logic falsiﬁcation

problem can be viewed as adual problem to the optimal

control problem under temporal logic requirements. In [20],

the optimal control problem under Linear Temporal Logic

(LTL) speciﬁcations is studied for mixed-logical discrete-

time linear dynamical systems. However,there do not ex-

ist anyoptimal control problem formulations for nonlinear

systems under MTL speciﬁcations.

The work that appears in [4] and [21] is the closest to the

results that we present here. In particular,in [21], the authors

use sensitivity analysis in order to quantify neighborhoods

of trajectories with the same qualitativebehavior.Then, the

results of [21] are extended in [4] to estimating parameter

2013 American Control Conference (ACC)

Washington, DC, USA, June 17-19, 2013

978-1-4799-0178-4/$31.00 ©2013 AACC 4405

ranges and initial conditions for which the system satisﬁes

some real-time temporal logic speciﬁcation. Even though we

are also using sensitivity analysis in our problem solution,

our objectiveis very different from the work in [4]. Our

goal is to develop the local search tools needed in order

to improvethe performance of stochastic MTL falsiﬁcation

methods [10], [15]. Stochastic falsiﬁcation methods avoid

the state-explosion problems that occur when attempting to

cover ahigh-dimensional set of parameters.

II.PROBLE MFORMULATION

Weconsider adynamical system with state x∈X

˙x=F(t, x)(1)

for aC1ﬂowF:Rn→Rnwith initial conditions x0∈X0.

Assumption 2.1: For every x∈X0and ﬁnite time T>0,

there exists aunique solution s(·,x):[0,T]7→ Rnto the

differential equation (1). Also, the solution sx(·)is absolutely

continuous. Finally,the ﬂowFis locally bounded, that is,

for all compact sets [0,t]×C⊂[0,T]×X0,there exists

m>0such that F([0,T]×C)⊂mB,where Bis the unit

ball centered at 0.

Weformally capture speciﬁcations regarding the correct

system behavior using Metric Temporal Logic (MTL) [18].

MTL formulas are built over aset of propositions using

combinations of the traditional and temporal operators. In

this work, the set of atomic propositions AP label subsets of

the state space X.In other words, we deﬁne an observation

map O:AP →P(X)such that for each π∈AP the

corresponding set is O(π)⊆X.Here, P(S)denotes the

powerset of aset S.Traditional logic operators are the con-

junction (∧), disjunction (∨), negation (¬),implication (→)

and equivalence (↔). Some of the temporal operators are

eventually (✸I),always (✷I)and until (UI).The subscript

Iimposes timing constraints on the temporal operators.

The interval Imust be non-empty (I6=∅). For example,

MTL can capture the requirement that “all the trajectories

x(t)∈Rattain avalue in the set [10,+∞)”(✸p1with

O(p1)=[10,+∞))or that “whenever the value of xdrops

below10, then it should go above10 within 5sec and remain

above10 for at least 10 sec”(✷(¬p1→✸[0,5]✷[0,10]p1)).

Wecan quantify howrobustly asystem trajectory sx(t)=

s(t, x)satisﬁes aspeciﬁcation φin MTL [16]. Namely,we

deﬁne afunction fφ(x)that returns the radius of the largest

neighborhood we can ﬁt around sxsuch that anytrajectory in

that neighborhood satisﬁes the same MTL speciﬁcation φas

sx.Moreover,fφ(x)takes positivevalues if sxsatisﬁes φand

negativevaluesotherwise. The falsiﬁcation of speciﬁcation

φ,i.e. detecting asystem behavior that does not satisfy φ,can

thus be re-cast as the problem of ﬁnding initial states x∈X0

with negativefφ-values. This can be done using stochastic

search techniques [10], [15]. These can be improved by

computing local descent directions for fφ.

In this paper,our objectiveis to solvethe following sub-

problem: Let U⊂Xbe aset of ‘unsafe’ system states -in

the next section we see exactly what such aUlooks like.

There may be manysuch sets. Wedeﬁne the robustness of

atrajectory relativeto U:

Deﬁnition 2.1 (Robustness): Let x∈X0,T>0and sx(·)

be the unique solution of (1) starting from time 0,then the

robustness of the solution sxwith respect to Uis

f(x)=min

0≤t≤TdU(s(t;x)) (2)

where dU(x)=infu∈U kx−ukis the distance function of a

point xfrom U.

The function fis non-differentiable, and generally non-

convex. Then, our problem is:

Problem 1: Given x∈X0,T>0and the unsafe set U,

ﬁnd avector d(x)∈Rnsuch that

f(x+hd(x)) <f(x)for all 0<h<h

for some h>0.

Although Problem 1was deﬁned for asingle unsafe set,

Prop. 3.1 belowshows that robustness w.r.t. ageneral MTL

formula (with several sets) equals the robustness w.r.t. one

of the formula’satomic propositions (one of the sets).

Some proofs are omitted due to space constraints.

III.MTL ROBUSTNES S

In this section, we provide an informal reviewof the robust

semantics of MTL formulas. Formal details are available in

our previous work [16].

Deﬁnition 3.1 (MTL Syntax): Let AP be the set of atomic

propositions and Ibe anynon-empty interval of R≥0.The

set MTLof all well-formed MTL formulas is inductively

deﬁned as ϕ::= T|p|¬ϕ|ϕ∨ϕ|ϕUIϕ,where

p∈AP and Tis true.

The robust semantics maps an MTL formula ϕand a

trajectory sxto avalue drawn from R∪{±∞}.The seman-

tics for the atomic propositions evaluated for sx(t)consists

of the distance between sx(t)and the set O(p)labeling

atomic proposition p.Intuitively,this distance represents how

robustly the point sx(t)lies within (or isoutside) the set

O(p).If this distance is zero, then the smallest perturbation

of the point sx(t)can affect the outcome of sx(t)∈O(p).

The semantics for aformula are naturally deﬁned from the

semantics for the atomic propositions. Wedenote the robust

valuation of the formula ϕover the trajectory sxat time

tstarting at initial condition xby [[ϕ, O]](sx,t).It is easy

to show[16] that if the signal satisﬁes the property,then

its robustness is non-negative, and if the signal does not

satisfy the property,then its robustness is non-positive. In [8],

we presented algorithms for efﬁciently computing the MTL

robustness of adiscrete-time trajectory.The analysis can be

extended to continuous-time signals under some assumptions

on the system [16].

For computational reasons, we must impose additional

assumptions on the sets O(p):

Assumption 3.1: For each p∈AP ,we haveO(p)=

∩i{x∈Rn|ai·x≤bi}where ai∈Rnand bi∈R.

Under the assumption that (1) is well-behaved, there exist

at least one point in time tand an atomic proposition psuch

4406

that the MTL robustness is equal to the distance of sx(t)from

O(p).The proof of the following proposition is based on the

assumption that the trajectory is continuous and bounded for

all time in [0,T].

Proposition 3.1: Consider an MTL formula φand atra-

jectory sxof (1) starting from some x∈X0such that

[[φ, O]](sx,0) >0.If (1) satisﬁes Assumption 2.1, then there

exist tr∈[0,T]and p∈AP such that

[[φ, O]](sx,0) =Dist(sx(tr),O(p))

where the signed distance Dist(z,S)=dS(z)if z∈S,and

−dS(z)otherwise. Weremark that given atrajectory of (1),

then the sample of the trajectory that represents the critical

distance can be easily computed by modifying the algorithm

in [8].

In order to detect abad system behavior with respect to

an MTL speciﬁcation, our goal is to reduce such critical dis-

tances. Therefore, in the following, we focus on aparticular

set O(p)or one of its deﬁning half-spaces which we refer

to as the unsafe set U.

In general, φmay haveseveral predicates pand cor-

responding sets O(p).Tofalsify φwill require ﬁnding a

trajectory that visits these O(p)in some order and under

some timing constraints. In this paper,we derivethe descent

vector relativeto only one O(p)at atime. Different unsafe

sets O(p)are chosen by the stochastic falsiﬁcation algorithm,

which calls the local descent algorithm on the chosen unsafe

set.

IV.COMPUTIN G A DESCENTDIRECTION

In this section we compute adescent direction using

tools from nonsmooth analysis. Westart by solving the

unconstrained problem X0=Rnin sub-section IV-A. The

constrained problem is later addressed in sub-section IV-B.

A. Descent vector

In general, two trajectories starting arbitrarily close may

achievevery different robustness values, at very different

points in time. The following theorem shows that for some

systems that are themselves ‘Lipschitz’ (in the sense below),

the objectivefunction is Lipshitz:

Theorem 4.1 (Lipschitz objective): If for every x∈X0,

there exist b>0and Kx>0s.t. ks(t;x1)−s(t;x2)k≤

Kxkx1−x2kfor all x1,x2∈Bb(x)and all 0≤t≤T,then

the objectivefunction fis Lipschitz.

The condition of the theorem can be shown to hold if we

assume Fto be Lipschitz in xon [0,T]×X,and Xis open

connected. Moreover,the constant Kxis then independent

of x.

Nonsmooth analysis [19] provides us with the tools to

compute descent directions.

Theorem 4.2 (Thm. 5.2.5 in [19]): Let f:Rn→be

locally Lipschitz at x.The direction d∈Rnis adescent

direction at xif

fo(x;d)<0

where fois the generalized directional derivativeof fat x

fo(x;d)=lim sup

y→x,hց0

f(y+hd)−f(y)

h

Theorem 4.3 (2.1.3(i) in [19]): Let g:Rn→be a

convexfunction with aLipschitz constant Kat x.Then,

the directional derivativein each direction v∈Rnexists

and satisﬁes

g′(x;v)=inf

h>0

g(x+hv)−g(x)

h

In this section we will work from the deﬁnition of general-

ized derivativeto derive a descent dsuch that fo(x;d)<0.

By deﬁnition of robustness (2), we have

fo(x;d)=lim sup

y→x,hց0

f(y+hd)−f(y)

h

=lim sup

y→x,hց0min

0≤t≤TdU(s(t;y+hd))−

−min

0≤t≤TdU(s(t;y))/h

By deﬁnition of limit, there exists sequences (yi)→x∈

Rnand (hi)→0∈R+and i0∈Nsuch that, for i>i0,

fo(x;d)≤min

0≤t≤TdU(s(t;yi+hid))

−min

0≤t≤TdU(s(t;yi))hi+1

i

It is easily seen that for positivefunctions g(t)and k(t),

mintg(t)−mintk(t)≤ − mint[k(t)−g(t)].Identifying

g(t)=dU(t;yi+hid)and k(t)=dU(t;yi),we have

fo(x;d)≤

≤−min0≤t≤T[dU(s(t;yi)) −dU(s(t;yi+hid))]

hi

+1

i

=−min

0≤t≤T

[dU(s(t;yi)) −dU(s(t;yi+hid))]

hi

+1

i

As i→ ∞,1/i →0,hi→0,yi→xand s(t;yi+hid)→

s(t;yi)in norm by Assumption 2.1. So

fo(x;d)

≤lim

i→∞ −min

0≤t≤T

[dU(s(t;yi)) −dU(s(t;yi+hid))]

hi

=−min

0≤t≤Tlim

i→∞

[dU(s(t;yi)) −dU(s(t;yi+hid))]

hi

+1

i

=−min

0≤t≤Tlim

yi→x,hiց0−dU(s(t;yi+hid)) −dU(s(t;yi))]

hi

(Wecan showthat the interchange of limit and min above

is valid). Linearizing s(t;yi+hid)in the second argument,

and ignoring higher-order terms o(hi):

s(t;yi+hid)≈s(t;yi)+hi

∂s(t;yi)

∂yd(3)

Assumption 4.1: Weassume that the sensitivity matrix

A(t;y),∂s(t;y)

∂yexists, is invertible, and that it is spectral

norm-continuous in y.

4407

Weremark that A(t;y)is the sensitivity of the trajectory

with respect to the initial conditions and can be computed

as indicated in [22], [23]. Then,

fo(x;d)≤

≤ − min

0≤t≤T[−lim

yi→x,hiց0(dU(s(t;yi)+hiA(t;yi)d)−

−dU(s(t;yi)))/hi]

If the limit in brackets does not exist, i.e., it is +∞,then

fo(x;d)<0and we are done. Otherwise, it can be shown

that the limit in brackets equals d′

U(s(t;A(t;x)d):that is, the

directional derivativeof dUat s(t;x)∈Rn,in the direction

A(t;x)d.Thus,

fo(x;d)≤ − min[−d′

U(s(t;x); A(t;x)d)]

=max

0≤t≤Td′

U(s(t;x); A(t;x)d)

Recall that we want fo(x;d)<0,so we seek to upper-

bound the RHS, that is,

max

0≤t≤Td′

U(s(t;x); A(t;x)d)<0,

which is equivalent to

d′

U(s(t;x); A(t;x)d)<0∀t∈[0,T]

Fix tfor now.For ease of notation, we’ll just write sand

Afor s(t;x)and A(t;x),respectively.By Theorem 4.3,

d′

U(s;Ad)=inf

h>0

dU(s+h·Ad)−dU(s)

h

Thus, it is necessary that there exist an h>0s.t.

dU(s+h·Ad)−dU(s)<0

Let ns(x)(t)∈Rnbe the vector that gives the direction of

the shortest distance between s(t;x)and U.We’ll write n

for short, and call it an approachvector.Then

dU(s+hn)<dU(s)∀0<h≤dU(s)⇒(4)

inf

h>0

dU(s+hn)−dU(s)

h<dU(s+hn)−dU(s)

h<0

So set A(t;x)d(t)=ns(x)(t)⇒d(t)=A(t;x)−1ns(x)(t),

where we made explicit the dependence of the descent vector

on time (different points on the trajectory will havedifferent

descent vectors). Thus, d(t)=A(t;x)−1ns(x)(t)satisﬁes

d′

U(s(t;x); A(t;x)d(t)) <0at every t.In particular at

t∗,argmax0≤t≤Td′

U(s(t;x); A(t;x)d(t)),

we still have

d′

U(s(t∗;x); A(t∗;x)d(t∗)<0

Finally,

d=A(t∗;x)−1ns(x)(t∗)(5)

is adescent direction for fat x,subject to the foregoing

assumptions.

It remains to compute t∗.Wecan showthat t∗=

argmin0≤t≤TdU(s(t;x)),and the proof is omitted.

Weconclude this section by noting that Eq.(5) can be

generalized by choosing adifferent approach vector than

n,conditioned on satisfying (4). The particular choice will

depend on the geometry of the problem.

B. Constrained problem

WenowremoveAssumption (A3) and we consider the

constrained problem where X06=Rn.In other words, what

if x+d/∈X0?

If we use µd, µ<1,then

d′

U(s(tr;x); µ·ns(x)(tr)) =

=inf

h>0

dU(s(tr;x)+hµ ·ds(x)(t)) −dU(s(tr;x))

h<0

by Eq. (4). So we can shrink dto ﬁt x+din X0,and still

have a descent. This simple approach circumvents the need

to calculate or approximate the subdifferential of fsubject

to the constraints, which is anon-trivial task given the form

of f.

This brings up the issue of step-size: in principle, any

method for computing astep-size, that does not require dif-

ferentiability,can be used, once we have a descent direction

(and indeed we use backtracking in our experiments); see

e.g. [19], [24], [25]. In practice, amethod that does not

use aline-search is preferable, since line searches require

additional evaluations of the objectivefunction, and this

implies simulating the system. Such simulations might prove

too costly.Wewill simply highlight two requirements on

anystep-size that transpire from abovearguments: that it

be “small enough” for the o(h)terms in (3) to be safely

ignored, and that it be smaller than the robustness dU(s(t;x))

as per (4). Additional, generic, conditions can be reviewed

in standard texts, such as [19, Section II.2.1.2].

V.EXPERIMENTS

Example 1: Our ﬁrst example is 2-dimensional system

taken from [12] (Example 4), given by

˙x(t)=0.05x1(t)sin2(x2(t)) −2.5x2(t)

0.5x1(t)−x2(t)

Wepresent two representative experiments with this sys-

tem, both using atrajectory duration of 10 time units,

the speciﬁcation is ✷¬p1with O(p1)=[−0.11,−0.08] ×

[0,0.01] and x0=(0.5,−0.2)T.First, we consider h=1.

Fig.1 shows asequence of starting points, and correspond-

ing trajectories, generated by computing successivedescent

vectors according to Eq. (5). Descents of different directions

are generated, and successivetrajectories get closer to the

unsafe set ascan be seen in Fig.2. Ten descent vectors reduce

robustness from 0.016097 to 0.011181.

Starting with h=0.1,the iterations reach alocal mini-

mum after 4descents -the dcomputed by Eq.(5) no longer

decreases the objectivefunction value for anystep-size. A

small ball around the current x0was sampled to verify it is

indeed alocal minimum. △

Example 2: Our second example is taken from [15], given

by

˙x(t)=x1(t)−x2(t)+0.1t

x2(t)cos(2πx2(t)) −x1(t)sin(2πx1(t)) +0.1t

with initial condition x(0) =x0∈X0=[−1,1] ×[−1,1],

and speciﬁcation ✷¬p2with O(p2)=[−1.6,−1.4] ×

4408

−0.2 00.2 0.4 0.6 0.8

−0.3

−0.25

−0.2

−0.15

−0.1

−0.05

0

0.05

0.1

0.15

0.2

x1

x2

Fig. 1. Inital set (bottom right), unsafe set (red (black) box in top left)

and trajectories for Example 1.

−0.13 −0.125 −0.12 −0.115 −0.11 −0.105

0.008

0.01

0.012

0.014

0.016

0.018

0.02

x1

x2

Fig. 2. SuccessiveExample 1trajectories descending towards unsafe set.

[−0.9,−1.1].If the trajectory duration is6units, allowing

the trajectories to settle, and starting from (0,0)T,alocal

minimum is reached in only 2iterations. Inspection of the

descent direction lead us to try astart point x0=(0.5,0.5)T:

from here, robustness was reduced from 1.9 to 1.19 in

10 iterations, decreasing at every iteration. If the trajectory

duration is only 2units, thus remaining in the transient mode,

we can see more clearly the effect of choosing adescent

direction: Fig.3 shows the unsafe set relativeto the initial

set, and the trajectories chosen by descent.

To verify that this change in trajectory was not ‘accidental’

(e.g. as aresult of the step-size leading to an entirely different

local min), but rather was driven by agenuine descent,we

plot the contour curves of the objectivefunction (obtained by

sampling it on agrid of 500 points). Fig.4 shows aconsistent

descent towards levels of decreasing robustness. As further

veriﬁcation, we moved the unsafe set to [1.251.75]×[−1.1−

0.9].Fig.5 shows the resulting trajectories chosen by descent.

In order to demonstrate the potential of the proposed

approach to the MTL falsiﬁcation problem, we incorporated

the descent method with the Simulated Annealing (SA)

falsiﬁcation method of [15]. Wefalsiﬁed the speciﬁcation

φ3=✷(p3=⇒✷[0,1]¬p4)

where O(p3)and O(p4)are the dark boxes in Fig.6. Infor-

mally,the speciﬁcation requires that if the system trajectory

is in O(p3)at time t1,then O(p4)should be avoided for all

time in [t1,t1+1].For the speciﬁcation to be falsiﬁed dis-

tances to both sets O(p3)and O(p4)must become zero. Note

that in Fig. 6, our algorithm attempts to minimize both dis-

tances. Torigorously assess the efﬁciencyof SA+DESCENT

compared to pure SA, athorough statistical study will be

conducted in future research. △

−2 −1.5 −1 −0.5 00.5 11.5

−1.5

−1

−0.5

0

0.5

1

x1

x2

1

2

3

4

5

Fig. 3. Transient trajectories of Example 2. Note the qualitativechange in

the trajectories, from 1to 5, as aresult of descending towards the unsafe

set. Circles mark the initial points, and long black arrows are u∗−s(t;x).

0.15 0.2 0.25 0.3 0.35 0.4 0.45 0.5 0.55

0.3

0.35

0.4

0.45

0.5

0.55

0.6

0.65

0.7

0.75

0.8

x1

x2

2.4

2.2

1.6

2.0

1.8

1.4

1.2

Fig. 4. Contour plot of fin Example 2, with initial points chosen by

descent.

Example 3: Our third example is the quorum sensing

system of the luminescent marine bacterium Vibrio Fischeri

(VF) [5]. This is modeled as a9-dimensional non-linear

system. Asimpliﬁed hybrid model of amutant VF bacterium

has 2equilibrium points (one luminescent, the other non-

luminescent) [5]. Wechoose the unsafe set to be disjoint

from neighborhoods around these 2equilibria. Namely,we

consider the speciﬁcation ✷¬p2with O(p5)={x∈

R9|13625 ≤x3≤13626,36330 ≤x7≤36331,17968 ≤

x8≤17969}.Starting from x0=(1e5,1,...,1)T,and

4409

−1 −0.5 00.5 11.5 22.5

−1.5

−1

−0.5

0

0.5

1

x1

x2

Fig. 5. Example 2with adifferent unsafe set.

−4 −2 0 2 4 6 8 10

−2

−1

0

1

2

x1

x2

Fig. 6. Example 2with φ3.O(p3)is the left dark square, O(p4)is the

right dark square, X0is the white rectangle.

computing trajectories of duration 5units, 10 computations

of adescent vector with step size h=0.1reduce robustness

from 36327 to 14099,with robustness decreasing at each

iteration. △

VI.CON CLUSION S

Wehavepresented the derivation of the equations that can

be used for the computation of robustness descent vectors in

the set of initial conditions for nonlinear dynamical systems.

These results are necessary for enabling “gray box” MTL

falsiﬁcation methods for dynamical systems. In the future, we

will focus on extending our newapproach to hybridsystems

and non-autonomous systems.

REFERENCES

[1] S. Steinhorst and L. Hedrich, “Model checking of analog systems us-

ing an analog speciﬁcation language,”in Proceedings of the conference

on Design, automation and test in Europe,ser.DATE ’08. New York,

NY,USA: ACM, 2008, pp. 324–329.

[2] M. H. Zaki, S. Tahar,and G. Bois,“Formal veriﬁcation of analog and

mixed-signal designs: Asurvey,”Microelectronics Journal,vol. 39, p.

13951404, 2008.

[3] S. Little, D. Walter,K. Jones, and C. J. Myers, “Analog/mixed-signal

circuit veriﬁcation using models generatedfrom simulation traces,”

in Proceedings of the 5th International Symposium on Automated

Technology for Veriﬁcation and Analysis (ATVA),ser.LNCS, vol. 4762.

Springer,2007, pp. 114–128.

[4] A. Donze, E. Fanchon, L. M. Gattepaille, O. Maler,and P.Tracqui,

“Robustness analysis and behavior discrimination in enzymatic reac-

tion networks,”PLoS ONE,vol. 6, no. 9, p. e24246, 09 2011.

[5] C. Belta, J. Schug, T.Dang, V.Kumar,G. Pappas, and H. Rubin,

“Stability and rechability analysis of ahybrid model of luminescence

in the marine bacterium vibrio ﬁscheri,”in Proceedings of the 40th

IEEE Conference on Decision and Control,December 2001.

[6] A. A. Julius, ´

A. M. Hal´

asz, M. S. Sakar,H. Rubin, V.Kumar,and G. J.

Pappas, “Stochastic modeling and control of biological systems: The

lactose regulation system of escherichia coli,”IEEE Trans. Automat.

Contr.,vol. 53, pp. 51–65, 2008.

[7] S. Sankaranarayanan and G. Fainekos, “Simulating insulin infusion

pump risks by in-silico modeling of the insulin-glucose regulatory

system,”in International Conference on Computational Methods in

Systems Biology,2012, [ToAppear].

[8] G. Fainekos, S. Sankaranarayanan, K. Ueda, and H. Yazarel, “Veriﬁca-

tion of automotivecontrol applications using s-taliro,”in Proceedings

of the American Control Conference,2012.

[9] E. Plaku, L. E. Kavraki, and M. Y.Vardi, “Falsiﬁcation of ltl safety

properties in hybrid systems,”in Proc. of the Conf.on Tools and

Algorithms for the Construction and Analysisof Systems (TACAS),

ser.LNCS, vol. 5505, 2009, pp. 368 – 382.

[10] T.Nghiem, S. Sankaranarayanan, G. Fainekos, F.Ivancic, A. Gupta,

and G. Pappas, “Monte-carlo techniques for falsiﬁcation of temporal

properties of non-linear hybrid systems,”in Hybrid Systems: Compu-

tation and Control,2010.

[11] P.Zuliani, A. Platzer,and E. M. Clarke, “Bayesian statistical model

checking with application to simulink/stateﬂowveriﬁcation,”in Pro-

ceedings of the 13th ACM International Conference on Hybrid Sys-

tems: Computation and Control,2010, pp. 243–252.

[12] G. E. Fainekos and G. J. Pappas, “Mtl robust testing and veriﬁcation

for lpv systems,”in Proceedings of the American Control Conference,

2009, pp. 3748–3753.

[13] A. Rizk, G. Batt, F.Fages, and S. Soliman, “Continuous valuations of

temporal logic speciﬁcations with applications to parameter optimiza-

tion and robustness measures,”Theor.Comput. Sci.,vol. 412, no. 26,

pp. 2827–2839, 2011.

[14] A. Donze, G. Clermont, and C. J. Langmead, “Parameter synthesisin

nonlinear dynamical systems: Application to systems biology,”Journal

of Computational Biology,vol. 17, no. 3, pp. 325–336, 2010.

[15] H. Abbas, G. E. Fainekos, S. Sankaranarayanan, F.Ivancic, A. Gupta,

and G. J. Pappas, “Probabilistic temporal logic falsiﬁcation of cyber-

physical systems,”ACM Transactions on Embedded Computing Sys-

tems,vol. (Accepted), 2011.

[16] G. Fainekos and G. Pappas, “Robustness of temporal logic speciﬁca-

tions for continuous-time signals,”Theoretical Computer Science,vol.

410, no. 42, pp. 4262–4291, September 2009.

[17] H. Abbas and G. Fainekos, “Linear hybrid system falsiﬁcation through

local search,”in Automated Technology for Veriﬁcation and Analysis,

ser.LNCS, vol. 6996. Springer,2011, pp. 503–510.

[18] R. Koymans, “Specifying real-time properties with metric temporal

logic.”Real-Time Systems,vol. 2, no. 4, pp. 255–299, 1990.

[19] M. M. Makela and P.Neittaanmaki,Nonsmooth optimization.World

Scientiﬁc, 1992.

[20] S. Karaman, R. Sanfelice, and E. Frazzoli, “Optimal control of mixed

logical dynamical systems with linear temporal logic speciﬁcations,”

in IEEE Conf.on Decision and Control,2008.

[21] A. Donze and O. Maler,“Systematic simulation using sensitivity

analysis,”in Hybrid Systems: Computation and Control,ser.LNCS,

vol. 4416. Springer,2007, pp. 174–189.

[22] R. Serban and A. Hindmarsh, “Cvodes: the sensitivity-enabled ode

solver in sundials,”in Proceedings of IDETC/CIE,2005.

[23] I. Hiskens and M. Pai, “Trajectory sensitivity analysis of hybrid sys-

tems,”Circuits and Systems I: Fundamental Theory and Applications,

IEEE Transactions on,vol. 47, no. 2, pp. 204 –220, feb 2000.

[24] S. Boyd and L. Vandenberghe, ConvexOptimization.Cambridge

University Press, 2004.

[25] J. Gofﬁn, “On convergence rates of subgradient optimization methods,”

Mathematical Programming,no. 13, pp. 329–347, 1977.

4410