Content uploaded by Houssam Abbas
Author content
All content in this area was uploaded by Houssam Abbas on Apr 02, 2017
Content may be subject to copyright.
Computing Descent Direction of MTL Robustness for Non-Linear Systems
Houssam Abbas and Georgios Fainekos
Abstract—The automatic analysis of transient properties of
nonlinear dynamical systems is achallenging problem. The
problem is even morechallenging when complex state-space
and timing requirements must be satisfied by the system. Such
complex requirements can be captured by Metric Temporal
Logic (MTL) specifications. The problem of finding system
behaviors that do not satisfy an MTL specification is referred
to as MTL falsification. This paper presents an approach for
improving stochastic MTL falsification methods by performing
local search in the set of initial conditions. In particular,
MTL robustness quantifies howcorrect or wrong is asystem
trajectory with respect to an MTL specification. Positivevalues
indicate satisfaction of the property while negativevalues
indicate falsification. Astochastic falsification method attempts
to minimize the system’srobustness with respect to the MTL
property.Given some arbitrary initial state, this paper presents
amethod to compute adescent direction in the set of initial
conditions, such that the new system trajectory gets closer to the
unsafe set of behaviors. This technique can be iterated in order
to converge to alocal minimum of the robustness landscape.
The paper demonstrates the applicability of the method on
some challenging nonlinear systems from the literature.
I.INTROD UCTIO N
Anumber of applications can only be accurately modeled
using nonlinear dynamical models. Typical such applications
include analog circuits [1]–[3] and biological and medical
systems [4]–[7]. Acommon theme of all the aforementioned
applications is the need to verify transient or periodic proper-
ties of the system. Such properties might involvesequencing
of events, conditional reachability and invariants and real-
time constraints and can be formally captured using temporal
logics [4], [8].
Unfortunately,for complexnonlinear systems, these types
of properties are hard –if not impossible –to verify algorith-
mically.Therefore, recent research efforts havebeen invested
in property falsification methods [9]–[12]. In falsification,
the space of operating conditions and/or inputs is searched
in order to find an initial condition and/or parameter that
will force the system to exhibit an unsafe behavior with
respect to the formal requirement. In turn, the unsafe system
trajectory can be used in order to manually or automatically
modify the system to achievethe desired system behavior
and performance [13], [14].
In [10], [15], the temporal logic falsification problem
is converted into an optimization (minimization) problem
based on the notion of robustness of temporal logics [16].
Essentially,asystem trajectory with negativerobustness is
one that proves the existence of unsafe system behaviors.
This work was partially supported by the NSF awards CNS-1017074 and
CNS-1116136.
H. Abbas and G. Fainekos are with the Schools of Engineering at Arizona
State University,Tempe, AZ, E-mail: {hyabbas,fainekos}@asu.edu
Then, anumber of stochastic optimization methods can be
utilized in order to solvethe optimization problem and
find asystem trajectory that minimizes the temporal logic
robustness metric.
However,in [10], [15], the system is treated as ablack-
box. In order,to improvethe rate of convergence of stochas-
tic search methods, it is desirable to havetechniques that
can compute local descent directions in the search space.
In particular,if atest is performed starting from an initial
condition xwith property robustness f(x),then adescent
vector dmust be computed so that starting from x+dthe
system has robustness f(x+d)<f(x).Such aprocess
has the potential to speed up the stochastic search method
by enabling gradient descent in the searchspace. In [17],
we demonstrated that in the case of linear hybrid systems
improvements in the convergence rate can be achieved.
Contributions: In this paper,we present amethod forthe
computation of descent vectors for reducing specification
robustness for continuous nonlinear dynamical systems. In
particular,given an arbitrary MetricTemporal Logic (MTL)
specification [18], we determine acritical point on the system
trajectory which if changed, then the MTL robustness will
be changed as well. Weutilize nonsmooth optimization
theory [19] in order to derivethe equations that compute
adescent vector in the set of initial conditions that will
result in reduced MTL robustness. Finally,we demonstrate
the applicability of our approach on some nonlinear models
from the literature. Weenvision that our results can be
extended to handle arbitrary temporal logic specifications
over trajectories of hybrid systems.
Related Work: Combined state-space and real-time tem-
poral logic properties havebeen studied in anumber of
different settings. MTL properties of nonlinear systems have
been studied in [12] through abstractions to Linear Pa-
rameter Varying (LPV) systems. The work in [11] studies
the applicability of statistical model checking methods on
stochastic hybrid systems. The temporal logic falsification
problem can be viewed as adual problem to the optimal
control problem under temporal logic requirements. In [20],
the optimal control problem under Linear Temporal Logic
(LTL) specifications is studied for mixed-logical discrete-
time linear dynamical systems. However,there do not ex-
ist anyoptimal control problem formulations for nonlinear
systems under MTL specifications.
The work that appears in [4] and [21] is the closest to the
results that we present here. In particular,in [21], the authors
use sensitivity analysis in order to quantify neighborhoods
of trajectories with the same qualitativebehavior.Then, the
results of [21] are extended in [4] to estimating parameter
2013 American Control Conference (ACC)
Washington, DC, USA, June 17-19, 2013
978-1-4799-0178-4/$31.00 ©2013 AACC 4405
ranges and initial conditions for which the system satisfies
some real-time temporal logic specification. Even though we
are also using sensitivity analysis in our problem solution,
our objectiveis very different from the work in [4]. Our
goal is to develop the local search tools needed in order
to improvethe performance of stochastic MTL falsification
methods [10], [15]. Stochastic falsification methods avoid
the state-explosion problems that occur when attempting to
cover ahigh-dimensional set of parameters.
II.PROBLE MFORMULATION
Weconsider adynamical system with state x∈X
˙x=F(t, x)(1)
for aC1flowF:Rn→Rnwith initial conditions x0∈X0.
Assumption 2.1: For every x∈X0and finite time T>0,
there exists aunique solution s(·,x):[0,T]7→ Rnto the
differential equation (1). Also, the solution sx(·)is absolutely
continuous. Finally,the flowFis locally bounded, that is,
for all compact sets [0,t]×C⊂[0,T]×X0,there exists
m>0such that F([0,T]×C)⊂mB,where Bis the unit
ball centered at 0.
Weformally capture specifications regarding the correct
system behavior using Metric Temporal Logic (MTL) [18].
MTL formulas are built over aset of propositions using
combinations of the traditional and temporal operators. In
this work, the set of atomic propositions AP label subsets of
the state space X.In other words, we define an observation
map O:AP →P(X)such that for each π∈AP the
corresponding set is O(π)⊆X.Here, P(S)denotes the
powerset of aset S.Traditional logic operators are the con-
junction (∧), disjunction (∨), negation (¬),implication (→)
and equivalence (↔). Some of the temporal operators are
eventually (✸I),always (✷I)and until (UI).The subscript
Iimposes timing constraints on the temporal operators.
The interval Imust be non-empty (I6=∅). For example,
MTL can capture the requirement that “all the trajectories
x(t)∈Rattain avalue in the set [10,+∞)”(✸p1with
O(p1)=[10,+∞))or that “whenever the value of xdrops
below10, then it should go above10 within 5sec and remain
above10 for at least 10 sec”(✷(¬p1→✸[0,5]✷[0,10]p1)).
Wecan quantify howrobustly asystem trajectory sx(t)=
s(t, x)satisfies aspecification φin MTL [16]. Namely,we
define afunction fφ(x)that returns the radius of the largest
neighborhood we can fit around sxsuch that anytrajectory in
that neighborhood satisfies the same MTL specification φas
sx.Moreover,fφ(x)takes positivevalues if sxsatisfies φand
negativevaluesotherwise. The falsification of specification
φ,i.e. detecting asystem behavior that does not satisfy φ,can
thus be re-cast as the problem of finding initial states x∈X0
with negativefφ-values. This can be done using stochastic
search techniques [10], [15]. These can be improved by
computing local descent directions for fφ.
In this paper,our objectiveis to solvethe following sub-
problem: Let U⊂Xbe aset of ‘unsafe’ system states -in
the next section we see exactly what such aUlooks like.
There may be manysuch sets. Wedefine the robustness of
atrajectory relativeto U:
Definition 2.1 (Robustness): Let x∈X0,T>0and sx(·)
be the unique solution of (1) starting from time 0,then the
robustness of the solution sxwith respect to Uis
f(x)=min
0≤t≤TdU(s(t;x)) (2)
where dU(x)=infu∈U kx−ukis the distance function of a
point xfrom U.
The function fis non-differentiable, and generally non-
convex. Then, our problem is:
Problem 1: Given x∈X0,T>0and the unsafe set U,
find avector d(x)∈Rnsuch that
f(x+hd(x)) <f(x)for all 0<h<h
for some h>0.
Although Problem 1was defined for asingle unsafe set,
Prop. 3.1 belowshows that robustness w.r.t. ageneral MTL
formula (with several sets) equals the robustness w.r.t. one
of the formula’satomic propositions (one of the sets).
Some proofs are omitted due to space constraints.
III.MTL ROBUSTNES S
In this section, we provide an informal reviewof the robust
semantics of MTL formulas. Formal details are available in
our previous work [16].
Definition 3.1 (MTL Syntax): Let AP be the set of atomic
propositions and Ibe anynon-empty interval of R≥0.The
set MTLof all well-formed MTL formulas is inductively
defined as ϕ::= T|p|¬ϕ|ϕ∨ϕ|ϕUIϕ,where
p∈AP and Tis true.
The robust semantics maps an MTL formula ϕand a
trajectory sxto avalue drawn from R∪{±∞}.The seman-
tics for the atomic propositions evaluated for sx(t)consists
of the distance between sx(t)and the set O(p)labeling
atomic proposition p.Intuitively,this distance represents how
robustly the point sx(t)lies within (or isoutside) the set
O(p).If this distance is zero, then the smallest perturbation
of the point sx(t)can affect the outcome of sx(t)∈O(p).
The semantics for aformula are naturally defined from the
semantics for the atomic propositions. Wedenote the robust
valuation of the formula ϕover the trajectory sxat time
tstarting at initial condition xby [[ϕ, O]](sx,t).It is easy
to show[16] that if the signal satisfies the property,then
its robustness is non-negative, and if the signal does not
satisfy the property,then its robustness is non-positive. In [8],
we presented algorithms for efficiently computing the MTL
robustness of adiscrete-time trajectory.The analysis can be
extended to continuous-time signals under some assumptions
on the system [16].
For computational reasons, we must impose additional
assumptions on the sets O(p):
Assumption 3.1: For each p∈AP ,we haveO(p)=
∩i{x∈Rn|ai·x≤bi}where ai∈Rnand bi∈R.
Under the assumption that (1) is well-behaved, there exist
at least one point in time tand an atomic proposition psuch
4406
that the MTL robustness is equal to the distance of sx(t)from
O(p).The proof of the following proposition is based on the
assumption that the trajectory is continuous and bounded for
all time in [0,T].
Proposition 3.1: Consider an MTL formula φand atra-
jectory sxof (1) starting from some x∈X0such that
[[φ, O]](sx,0) >0.If (1) satisfies Assumption 2.1, then there
exist tr∈[0,T]and p∈AP such that
[[φ, O]](sx,0) =Dist(sx(tr),O(p))
where the signed distance Dist(z,S)=dS(z)if z∈S,and
−dS(z)otherwise. Weremark that given atrajectory of (1),
then the sample of the trajectory that represents the critical
distance can be easily computed by modifying the algorithm
in [8].
In order to detect abad system behavior with respect to
an MTL specification, our goal is to reduce such critical dis-
tances. Therefore, in the following, we focus on aparticular
set O(p)or one of its defining half-spaces which we refer
to as the unsafe set U.
In general, φmay haveseveral predicates pand cor-
responding sets O(p).Tofalsify φwill require finding a
trajectory that visits these O(p)in some order and under
some timing constraints. In this paper,we derivethe descent
vector relativeto only one O(p)at atime. Different unsafe
sets O(p)are chosen by the stochastic falsification algorithm,
which calls the local descent algorithm on the chosen unsafe
set.
IV.COMPUTIN G A DESCENTDIRECTION
In this section we compute adescent direction using
tools from nonsmooth analysis. Westart by solving the
unconstrained problem X0=Rnin sub-section IV-A. The
constrained problem is later addressed in sub-section IV-B.
A. Descent vector
In general, two trajectories starting arbitrarily close may
achievevery different robustness values, at very different
points in time. The following theorem shows that for some
systems that are themselves ‘Lipschitz’ (in the sense below),
the objectivefunction is Lipshitz:
Theorem 4.1 (Lipschitz objective): If for every x∈X0,
there exist b>0and Kx>0s.t. ks(t;x1)−s(t;x2)k≤
Kxkx1−x2kfor all x1,x2∈Bb(x)and all 0≤t≤T,then
the objectivefunction fis Lipschitz.
The condition of the theorem can be shown to hold if we
assume Fto be Lipschitz in xon [0,T]×X,and Xis open
connected. Moreover,the constant Kxis then independent
of x.
Nonsmooth analysis [19] provides us with the tools to
compute descent directions.
Theorem 4.2 (Thm. 5.2.5 in [19]): Let f:Rn→be
locally Lipschitz at x.The direction d∈Rnis adescent
direction at xif
fo(x;d)<0
where fois the generalized directional derivativeof fat x
fo(x;d)=lim sup
y→x,hց0
f(y+hd)−f(y)
h
Theorem 4.3 (2.1.3(i) in [19]): Let g:Rn→be a
convexfunction with aLipschitz constant Kat x.Then,
the directional derivativein each direction v∈Rnexists
and satisfies
g′(x;v)=inf
h>0
g(x+hv)−g(x)
h
In this section we will work from the definition of general-
ized derivativeto derive a descent dsuch that fo(x;d)<0.
By definition of robustness (2), we have
fo(x;d)=lim sup
y→x,hց0
f(y+hd)−f(y)
h
=lim sup
y→x,hց0min
0≤t≤TdU(s(t;y+hd))−
−min
0≤t≤TdU(s(t;y))/h
By definition of limit, there exists sequences (yi)→x∈
Rnand (hi)→0∈R+and i0∈Nsuch that, for i>i0,
fo(x;d)≤min
0≤t≤TdU(s(t;yi+hid))
−min
0≤t≤TdU(s(t;yi))hi+1
i
It is easily seen that for positivefunctions g(t)and k(t),
mintg(t)−mintk(t)≤ − mint[k(t)−g(t)].Identifying
g(t)=dU(t;yi+hid)and k(t)=dU(t;yi),we have
fo(x;d)≤
≤−min0≤t≤T[dU(s(t;yi)) −dU(s(t;yi+hid))]
hi
+1
i
=−min
0≤t≤T
[dU(s(t;yi)) −dU(s(t;yi+hid))]
hi
+1
i
As i→ ∞,1/i →0,hi→0,yi→xand s(t;yi+hid)→
s(t;yi)in norm by Assumption 2.1. So
fo(x;d)
≤lim
i→∞ −min
0≤t≤T
[dU(s(t;yi)) −dU(s(t;yi+hid))]
hi
=−min
0≤t≤Tlim
i→∞
[dU(s(t;yi)) −dU(s(t;yi+hid))]
hi
+1
i
=−min
0≤t≤Tlim
yi→x,hiց0−dU(s(t;yi+hid)) −dU(s(t;yi))]
hi
(Wecan showthat the interchange of limit and min above
is valid). Linearizing s(t;yi+hid)in the second argument,
and ignoring higher-order terms o(hi):
s(t;yi+hid)≈s(t;yi)+hi
∂s(t;yi)
∂yd(3)
Assumption 4.1: Weassume that the sensitivity matrix
A(t;y),∂s(t;y)
∂yexists, is invertible, and that it is spectral
norm-continuous in y.
4407
Weremark that A(t;y)is the sensitivity of the trajectory
with respect to the initial conditions and can be computed
as indicated in [22], [23]. Then,
fo(x;d)≤
≤ − min
0≤t≤T[−lim
yi→x,hiց0(dU(s(t;yi)+hiA(t;yi)d)−
−dU(s(t;yi)))/hi]
If the limit in brackets does not exist, i.e., it is +∞,then
fo(x;d)<0and we are done. Otherwise, it can be shown
that the limit in brackets equals d′
U(s(t;A(t;x)d):that is, the
directional derivativeof dUat s(t;x)∈Rn,in the direction
A(t;x)d.Thus,
fo(x;d)≤ − min[−d′
U(s(t;x); A(t;x)d)]
=max
0≤t≤Td′
U(s(t;x); A(t;x)d)
Recall that we want fo(x;d)<0,so we seek to upper-
bound the RHS, that is,
max
0≤t≤Td′
U(s(t;x); A(t;x)d)<0,
which is equivalent to
d′
U(s(t;x); A(t;x)d)<0∀t∈[0,T]
Fix tfor now.For ease of notation, we’ll just write sand
Afor s(t;x)and A(t;x),respectively.By Theorem 4.3,
d′
U(s;Ad)=inf
h>0
dU(s+h·Ad)−dU(s)
h
Thus, it is necessary that there exist an h>0s.t.
dU(s+h·Ad)−dU(s)<0
Let ns(x)(t)∈Rnbe the vector that gives the direction of
the shortest distance between s(t;x)and U.We’ll write n
for short, and call it an approachvector.Then
dU(s+hn)<dU(s)∀0<h≤dU(s)⇒(4)
inf
h>0
dU(s+hn)−dU(s)
h<dU(s+hn)−dU(s)
h<0
So set A(t;x)d(t)=ns(x)(t)⇒d(t)=A(t;x)−1ns(x)(t),
where we made explicit the dependence of the descent vector
on time (different points on the trajectory will havedifferent
descent vectors). Thus, d(t)=A(t;x)−1ns(x)(t)satisfies
d′
U(s(t;x); A(t;x)d(t)) <0at every t.In particular at
t∗,argmax0≤t≤Td′
U(s(t;x); A(t;x)d(t)),
we still have
d′
U(s(t∗;x); A(t∗;x)d(t∗)<0
Finally,
d=A(t∗;x)−1ns(x)(t∗)(5)
is adescent direction for fat x,subject to the foregoing
assumptions.
It remains to compute t∗.Wecan showthat t∗=
argmin0≤t≤TdU(s(t;x)),and the proof is omitted.
Weconclude this section by noting that Eq.(5) can be
generalized by choosing adifferent approach vector than
n,conditioned on satisfying (4). The particular choice will
depend on the geometry of the problem.
B. Constrained problem
WenowremoveAssumption (A3) and we consider the
constrained problem where X06=Rn.In other words, what
if x+d/∈X0?
If we use µd, µ<1,then
d′
U(s(tr;x); µ·ns(x)(tr)) =
=inf
h>0
dU(s(tr;x)+hµ ·ds(x)(t)) −dU(s(tr;x))
h<0
by Eq. (4). So we can shrink dto fit x+din X0,and still
have a descent. This simple approach circumvents the need
to calculate or approximate the subdifferential of fsubject
to the constraints, which is anon-trivial task given the form
of f.
This brings up the issue of step-size: in principle, any
method for computing astep-size, that does not require dif-
ferentiability,can be used, once we have a descent direction
(and indeed we use backtracking in our experiments); see
e.g. [19], [24], [25]. In practice, amethod that does not
use aline-search is preferable, since line searches require
additional evaluations of the objectivefunction, and this
implies simulating the system. Such simulations might prove
too costly.Wewill simply highlight two requirements on
anystep-size that transpire from abovearguments: that it
be “small enough” for the o(h)terms in (3) to be safely
ignored, and that it be smaller than the robustness dU(s(t;x))
as per (4). Additional, generic, conditions can be reviewed
in standard texts, such as [19, Section II.2.1.2].
V.EXPERIMENTS
Example 1: Our first example is 2-dimensional system
taken from [12] (Example 4), given by
˙x(t)=0.05x1(t)sin2(x2(t)) −2.5x2(t)
0.5x1(t)−x2(t)
Wepresent two representative experiments with this sys-
tem, both using atrajectory duration of 10 time units,
the specification is ✷¬p1with O(p1)=[−0.11,−0.08] ×
[0,0.01] and x0=(0.5,−0.2)T.First, we consider h=1.
Fig.1 shows asequence of starting points, and correspond-
ing trajectories, generated by computing successivedescent
vectors according to Eq. (5). Descents of different directions
are generated, and successivetrajectories get closer to the
unsafe set ascan be seen in Fig.2. Ten descent vectors reduce
robustness from 0.016097 to 0.011181.
Starting with h=0.1,the iterations reach alocal mini-
mum after 4descents -the dcomputed by Eq.(5) no longer
decreases the objectivefunction value for anystep-size. A
small ball around the current x0was sampled to verify it is
indeed alocal minimum. △
Example 2: Our second example is taken from [15], given
by
˙x(t)=x1(t)−x2(t)+0.1t
x2(t)cos(2πx2(t)) −x1(t)sin(2πx1(t)) +0.1t
with initial condition x(0) =x0∈X0=[−1,1] ×[−1,1],
and specification ✷¬p2with O(p2)=[−1.6,−1.4] ×
4408
−0.2 00.2 0.4 0.6 0.8
−0.3
−0.25
−0.2
−0.15
−0.1
−0.05
0
0.05
0.1
0.15
0.2
x1
x2
Fig. 1. Inital set (bottom right), unsafe set (red (black) box in top left)
and trajectories for Example 1.
−0.13 −0.125 −0.12 −0.115 −0.11 −0.105
0.008
0.01
0.012
0.014
0.016
0.018
0.02
x1
x2
Fig. 2. SuccessiveExample 1trajectories descending towards unsafe set.
[−0.9,−1.1].If the trajectory duration is6units, allowing
the trajectories to settle, and starting from (0,0)T,alocal
minimum is reached in only 2iterations. Inspection of the
descent direction lead us to try astart point x0=(0.5,0.5)T:
from here, robustness was reduced from 1.9 to 1.19 in
10 iterations, decreasing at every iteration. If the trajectory
duration is only 2units, thus remaining in the transient mode,
we can see more clearly the effect of choosing adescent
direction: Fig.3 shows the unsafe set relativeto the initial
set, and the trajectories chosen by descent.
To verify that this change in trajectory was not ‘accidental’
(e.g. as aresult of the step-size leading to an entirely different
local min), but rather was driven by agenuine descent,we
plot the contour curves of the objectivefunction (obtained by
sampling it on agrid of 500 points). Fig.4 shows aconsistent
descent towards levels of decreasing robustness. As further
verification, we moved the unsafe set to [1.251.75]×[−1.1−
0.9].Fig.5 shows the resulting trajectories chosen by descent.
In order to demonstrate the potential of the proposed
approach to the MTL falsification problem, we incorporated
the descent method with the Simulated Annealing (SA)
falsification method of [15]. Wefalsified the specification
φ3=✷(p3=⇒✷[0,1]¬p4)
where O(p3)and O(p4)are the dark boxes in Fig.6. Infor-
mally,the specification requires that if the system trajectory
is in O(p3)at time t1,then O(p4)should be avoided for all
time in [t1,t1+1].For the specification to be falsified dis-
tances to both sets O(p3)and O(p4)must become zero. Note
that in Fig. 6, our algorithm attempts to minimize both dis-
tances. Torigorously assess the efficiencyof SA+DESCENT
compared to pure SA, athorough statistical study will be
conducted in future research. △
−2 −1.5 −1 −0.5 00.5 11.5
−1.5
−1
−0.5
0
0.5
1
x1
x2
1
2
3
4
5
Fig. 3. Transient trajectories of Example 2. Note the qualitativechange in
the trajectories, from 1to 5, as aresult of descending towards the unsafe
set. Circles mark the initial points, and long black arrows are u∗−s(t;x).
0.15 0.2 0.25 0.3 0.35 0.4 0.45 0.5 0.55
0.3
0.35
0.4
0.45
0.5
0.55
0.6
0.65
0.7
0.75
0.8
x1
x2
2.4
2.2
1.6
2.0
1.8
1.4
1.2
Fig. 4. Contour plot of fin Example 2, with initial points chosen by
descent.
Example 3: Our third example is the quorum sensing
system of the luminescent marine bacterium Vibrio Fischeri
(VF) [5]. This is modeled as a9-dimensional non-linear
system. Asimplified hybrid model of amutant VF bacterium
has 2equilibrium points (one luminescent, the other non-
luminescent) [5]. Wechoose the unsafe set to be disjoint
from neighborhoods around these 2equilibria. Namely,we
consider the specification ✷¬p2with O(p5)={x∈
R9|13625 ≤x3≤13626,36330 ≤x7≤36331,17968 ≤
x8≤17969}.Starting from x0=(1e5,1,...,1)T,and
4409
−1 −0.5 00.5 11.5 22.5
−1.5
−1
−0.5
0
0.5
1
x1
x2
Fig. 5. Example 2with adifferent unsafe set.
−4 −2 0 2 4 6 8 10
−2
−1
0
1
2
x1
x2
Fig. 6. Example 2with φ3.O(p3)is the left dark square, O(p4)is the
right dark square, X0is the white rectangle.
computing trajectories of duration 5units, 10 computations
of adescent vector with step size h=0.1reduce robustness
from 36327 to 14099,with robustness decreasing at each
iteration. △
VI.CON CLUSION S
Wehavepresented the derivation of the equations that can
be used for the computation of robustness descent vectors in
the set of initial conditions for nonlinear dynamical systems.
These results are necessary for enabling “gray box” MTL
falsification methods for dynamical systems. In the future, we
will focus on extending our newapproach to hybridsystems
and non-autonomous systems.
REFERENCES
[1] S. Steinhorst and L. Hedrich, “Model checking of analog systems us-
ing an analog specification language,”in Proceedings of the conference
on Design, automation and test in Europe,ser.DATE ’08. New York,
NY,USA: ACM, 2008, pp. 324–329.
[2] M. H. Zaki, S. Tahar,and G. Bois,“Formal verification of analog and
mixed-signal designs: Asurvey,”Microelectronics Journal,vol. 39, p.
13951404, 2008.
[3] S. Little, D. Walter,K. Jones, and C. J. Myers, “Analog/mixed-signal
circuit verification using models generatedfrom simulation traces,”
in Proceedings of the 5th International Symposium on Automated
Technology for Verification and Analysis (ATVA),ser.LNCS, vol. 4762.
Springer,2007, pp. 114–128.
[4] A. Donze, E. Fanchon, L. M. Gattepaille, O. Maler,and P.Tracqui,
“Robustness analysis and behavior discrimination in enzymatic reac-
tion networks,”PLoS ONE,vol. 6, no. 9, p. e24246, 09 2011.
[5] C. Belta, J. Schug, T.Dang, V.Kumar,G. Pappas, and H. Rubin,
“Stability and rechability analysis of ahybrid model of luminescence
in the marine bacterium vibrio fischeri,”in Proceedings of the 40th
IEEE Conference on Decision and Control,December 2001.
[6] A. A. Julius, ´
A. M. Hal´
asz, M. S. Sakar,H. Rubin, V.Kumar,and G. J.
Pappas, “Stochastic modeling and control of biological systems: The
lactose regulation system of escherichia coli,”IEEE Trans. Automat.
Contr.,vol. 53, pp. 51–65, 2008.
[7] S. Sankaranarayanan and G. Fainekos, “Simulating insulin infusion
pump risks by in-silico modeling of the insulin-glucose regulatory
system,”in International Conference on Computational Methods in
Systems Biology,2012, [ToAppear].
[8] G. Fainekos, S. Sankaranarayanan, K. Ueda, and H. Yazarel, “Verifica-
tion of automotivecontrol applications using s-taliro,”in Proceedings
of the American Control Conference,2012.
[9] E. Plaku, L. E. Kavraki, and M. Y.Vardi, “Falsification of ltl safety
properties in hybrid systems,”in Proc. of the Conf.on Tools and
Algorithms for the Construction and Analysisof Systems (TACAS),
ser.LNCS, vol. 5505, 2009, pp. 368 – 382.
[10] T.Nghiem, S. Sankaranarayanan, G. Fainekos, F.Ivancic, A. Gupta,
and G. Pappas, “Monte-carlo techniques for falsification of temporal
properties of non-linear hybrid systems,”in Hybrid Systems: Compu-
tation and Control,2010.
[11] P.Zuliani, A. Platzer,and E. M. Clarke, “Bayesian statistical model
checking with application to simulink/stateflowverification,”in Pro-
ceedings of the 13th ACM International Conference on Hybrid Sys-
tems: Computation and Control,2010, pp. 243–252.
[12] G. E. Fainekos and G. J. Pappas, “Mtl robust testing and verification
for lpv systems,”in Proceedings of the American Control Conference,
2009, pp. 3748–3753.
[13] A. Rizk, G. Batt, F.Fages, and S. Soliman, “Continuous valuations of
temporal logic specifications with applications to parameter optimiza-
tion and robustness measures,”Theor.Comput. Sci.,vol. 412, no. 26,
pp. 2827–2839, 2011.
[14] A. Donze, G. Clermont, and C. J. Langmead, “Parameter synthesisin
nonlinear dynamical systems: Application to systems biology,”Journal
of Computational Biology,vol. 17, no. 3, pp. 325–336, 2010.
[15] H. Abbas, G. E. Fainekos, S. Sankaranarayanan, F.Ivancic, A. Gupta,
and G. J. Pappas, “Probabilistic temporal logic falsification of cyber-
physical systems,”ACM Transactions on Embedded Computing Sys-
tems,vol. (Accepted), 2011.
[16] G. Fainekos and G. Pappas, “Robustness of temporal logic specifica-
tions for continuous-time signals,”Theoretical Computer Science,vol.
410, no. 42, pp. 4262–4291, September 2009.
[17] H. Abbas and G. Fainekos, “Linear hybrid system falsification through
local search,”in Automated Technology for Verification and Analysis,
ser.LNCS, vol. 6996. Springer,2011, pp. 503–510.
[18] R. Koymans, “Specifying real-time properties with metric temporal
logic.”Real-Time Systems,vol. 2, no. 4, pp. 255–299, 1990.
[19] M. M. Makela and P.Neittaanmaki,Nonsmooth optimization.World
Scientific, 1992.
[20] S. Karaman, R. Sanfelice, and E. Frazzoli, “Optimal control of mixed
logical dynamical systems with linear temporal logic specifications,”
in IEEE Conf.on Decision and Control,2008.
[21] A. Donze and O. Maler,“Systematic simulation using sensitivity
analysis,”in Hybrid Systems: Computation and Control,ser.LNCS,
vol. 4416. Springer,2007, pp. 174–189.
[22] R. Serban and A. Hindmarsh, “Cvodes: the sensitivity-enabled ode
solver in sundials,”in Proceedings of IDETC/CIE,2005.
[23] I. Hiskens and M. Pai, “Trajectory sensitivity analysis of hybrid sys-
tems,”Circuits and Systems I: Fundamental Theory and Applications,
IEEE Transactions on,vol. 47, no. 2, pp. 204 –220, feb 2000.
[24] S. Boyd and L. Vandenberghe, ConvexOptimization.Cambridge
University Press, 2004.
[25] J. Goffin, “On convergence rates of subgradient optimization methods,”
Mathematical Programming,no. 13, pp. 329–347, 1977.
4410