Loading in 2 Seconds...
Loading in 2 Seconds...
Practical reasoning about control Ursula Martin Queen Mary University of London/University of Cambridge www.cl.cam.ac.uk/~um200 With Ruth Hardy, Richard Boulton Thanks to Qinetiq. Outline of talk What is control and why do we want to reason about it? Control basics: the time domain
Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author.While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server.
Practical reasoning about controlUrsula MartinQueen Mary University of London/University of Cambridgewww.cl.cam.ac.uk/~um200With Ruth Hardy, Richard BoultonThanks to Qinetiq
Example: feedback control in TetR/EColi
Example: aeroservoelasticity
A Hoare logic for continuous SISO control
Proving properties of Nichols plots
steam engines, fighter aircraft, cars, smart devices, genomics, nanotech...
steam engines, fighter aircraft, cars, smart devices, genomics, nanotech...
steam engines, fighter aircraft, cars, smart devices, genomics, nanotech...
To control an object is to influence its behaviour to a desired outcome
steam engines, fighter aircraft, cars, smart devices, genomics, nanotech...
digital  discrete  difference equations
dynamical systems, Lie algebras ….math toybox!
steam engines, fighter aircraft, cars, smart devices, genomics, nanotech...
digital  discrete  difference equations
dynamical systems, Lie algebras ….math toybox!
linear models + numeric simulation
analysestability, response, reachability, identification…
 greater expressive power
 greater automation
 assured code generation
 greater expressive power
 greater automation
 assured code generation
if a > 0
then ..
else ..
{ I } M { G } “if the inputs of M satisfy I then the outputs satisfy { G } “
Step 1: symbolic reasoning about components (transfer functions)
Step 2: compositionality: a Hoare logic for intermediate assertions
{G}
{I}
{ I } M { G } “if the inputs of M satisfy I then the outputs satisfy { G } “
Step 1: symbolic reasoning about components
Step 2: compositionality: a Hoare logic for intermediate assertions
{G}
{I}
{ ??}
{ ??}
{ ??}
{ ??}
{ I } M { G } “if the inputs of M satisfy I then the outputs satisfy { G } “
Step 1: symbolic reasoning about components
Step 2: compositionality: a Hoare logic for intermediate assertions
{G}
{I}
{ ??}
{ ??}
{ ??}
{ ??}
{ A }
{ I } M { G } “if the inputs of M satisfy I then the outputs satisfy { G } “
Step 1: symbolic reasoning about components (transfer functions)
Step 2: compositionality: a Hoare logic for intermediate assertions
{G}
{I}
{ ??}
{ ??}
{ ??}
{ ??}
{ A }
{ I } M { G } “if the inputs of M satisfy I then the outputs satisfy { G } “
Step 1: symbolic reasoning about components
Step 2: compositionality: a Hoare logic for intermediate assertions
{G}
{I}
Hoare logic
Verif ication req’t
QED
Example: feedback control in TetR/EColi
Example: aeroservoelasticity
A Hoare logic for continuous SISO control
Proving properties of Nichols plots
U(s)
G(s)
x’
u
x’’
x
1/M
b/M
K/M
U(s)
A
F(s)
G(s)
F(s) = A U(s)/( M s2+ b s + ( A + k ) )
U(s)
A
F(s)
G(s)
F(s) = A U(s)/( M s2+ b s + ( A + k ) )
“typical “ inputs, eg ramp
increases overshoot and decreases
variability (steady state error) (s(U(s)F(s)))
Example: feedback control in TetR/EColi
Example: aeroservoelasticity
A Hoare logic for continuous SISO control
Proving properties of Nichols plots
Structural coupling in flexible aircraft introduces highfrequency resonances to digital flight control system. These vary with payload.
Add filter to attentuate  introduces low frequency phase lag  so add phase advance filter  this increases structural coupling…..
System is stable if it avoids (  p, 0)
critical region to obtain good handling +
aeroservoelasticity properties
numeric plotting + eyeballing
Garteur reference model
1100 plots
Example: feedback control in TetR/EColi
Example: aeroservoelasticity
A Hoare logic for continuous SISO control
Proving properties of Nichols plots
Explain why program right using values at intermediate stages  assertions..
Machine independent model of computation  models and semantics
STOP
Y
r’ = 1

s’ = 1
v’ =u
u’ = u + v
TEST r  n
s’ = s + 1
u’ = 1

TEST s  r
r’ = r + 1
+
Y
Explain why program right using values at intermediate stages  assertions..
Machine independent model of computation  models and semantics
Gave formal rules for tracking assertions through programs  Hoare logic
{A} prog {B} denotes “if A is true and we run prog then B is true”
{C and r=n}
{C}
STOP
Y
r’ = 1

s’ = 1
v’ =u
u’ = u + v
TEST r  n
s’ = s + 1
u’ = 1

TEST s  r
r’ = r + 1
+
Explain why program right using values at intermediate stages  assertions..
Machine independent model of computation
Gave formal rules for tracking assertions through programs  Hoare logic
{A} prog {B} denotes “if A is true and we run prog then B is true”
Theory
Software
Scalability
Compelling benefits
{u = n!}
STOP
{n > 0}
{??}
Y
r’ = 1

s’ = 1
v’ =u
u’ = u + v
TEST r  n
s’ = s + 1
u’ = 1
{??}
{??}

TEST s  r
r’ = r + 1
+
A very short history of computational logic
use of a computer to produce or check formal proofs within
a computer representation of a system of formal logic
Russell and Whitehead, Principia Mathematica, Vol II p79
PVS theorem prover: SRI International Menlo Park USA
HOL theorem prover : Cambridge UK
formal proof + fast decision procedures + computation+
highly automated + architecture for other techniques eg model checking
compliance conditions derived from annotated Sparc Ada implementation
specification got from translating Fortran into Simulink into ClawZ
reason in ProofPower  HOLlike system from Lemma 1
PVS/SALHOLIsabelle COQ
formal proof + automation/high level strategies + computation + libraries + fast decision procedures/model checking/QE ….
HOL: analysis, numerical analysis, floating point
Maple symbolic computation + numerics to experiment / solve / simulate / prototype / formulate proof obligations
restricted invocation of PVS for highly automated verification support strategies for continuity, convergence, existence of limits…
d’base of lemmas about elementary functions (cos, ln, exp…)
“Prove that arctan( sin( x )) 1 is positive and continuous in [0, p]”
PVS: analysis, trigonometry
Solve x2  2 x  4 = 0 Soln: x = 3.236, 1.236 + error bound
Integrate cos(x) between 0, /2 Soln: 1.0 + error bound
Solve x2  2 x  4 a = 0 Soln: x = 1+ √ (1 + 4 a), 1 √ (1 + 4 a)
Differentiate sin(cos(x)) Soln:sin(x) . cos ( cos (x))
Prove that x2  2 x  4 a = 0 has a real solution for a > 1/4
Prove that x = 3.236 is a “solution” of x2  2 x  4 = 0 with error …
Prove that arctan( sin( x )) 1 is always positive
Prove that this implementation of NewtonRaphson is….
Intel: verification of floating point division for IA64
NASA Langley: verification of free flight air traffic control
Example: feedback control in TetR/EColi
Example: aeroservoelasticity
A Hoare logic for continuous SISO control
Proving properties of Nichols plots
requirements of form: g(x) > f(x) in
interval [a,b] in Nichols plots
correspond to good handling +
aeroservoelasticity properties
If f(b) < g(b) and f'(b) > g'(b)
f monotone increasing (i.e. f ’ > 0) in [a,b]
f' monotone decreasing (i.e. f ’’< 0 ) in [a,b]
then g(x) > f(x) in interval [a,b]
x:= argument( k.(t2 + 2 I c t + d)1)
y:= ( 20 ln k.(t2 + 2 I c t + d)1 ) / ln(10)
Calculate dy/dx (Maple) and show positive in [Pi, Pi/2] (PVS)
dy/dx = 20*sin(x)*(c*(c^2*cos(x)^2+d^2*sin(x)^2)^(1/2) + cos(x)*c^2+cos(x)*d^2)/(c^2*cos(x)^2+d^2*sin(x)^2)^(1/2)/(c*cos(x)+(c^2*cos(x)^2+d^2*sin(x)^2)^(1/2))/ln(10)
G(s)
composition of blocks with sinusoidal input
multiplies the gain (modulus) G( i w) H( i w)  =  G( i w)  *  H( i w) 
adds the phase (argument) arg(G( i w) H( i w) ) = arg(G( i w)) + arg(H( i w) )
compositionality for frequency response!
G(s)
composition of blocks with sinusoidal input
multiplies the gain (modulus) G( i w) H( i w)  =  G( i w)  *  H( i w) 
adds the phase (argument) arg(G( i w) H( i w) ) = arg(G( i w)) + arg(H( i w) )
compositionality for frequency response!
{P} C < dr,d > {Q}
denotes that component C causes a gain of dr and a phase shift of d, and if property P holds at the input then property Q holds at the output
{ ??}
{ ??}
{ ??}
{ A }
{ ??}
Hoare logic in terms of phase and gain for siso frequency domain
Proved soundness in HOL up to soundness of underlying math
Verification condition generator in HOL for “simple” block diagrams
Discharge verification requirements in HOL/PVS
{G}
{I}
Theorem prover
VCG works out this
QED
Richard Boulton, Verilab
Ruth Hardy, University of St AndrewsWith thanks to Yoge Patel, John Hall, Rob Arthan, Rick Hyde, Colin O’Halloran for their time and ideas
QinetiQ for the funding
SRI and Royal Academy of Engineering for the sabbatical 19992000
category/domain object model
annotate code with assertions
interface specifications as high level operational semantics for trusted components
uses/requires/modifies/ensures/assumes
tools for verification condition generation
locate type system bugs
analysis of pre/side conditions eg continuity
smart documentation
method selection
document and reason about assumptions