Runtime Hybrid Model Validation Under Sensor and Actuator Uncertainty
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cyber-physical systems (CPS) face challenges in ensuring safety due to discrepancies between models and real-world implementations, particularly with partial observability and actuator disturbances, which render formal verification results unreliable at runtime.
Innovation Solution
The development of ModelPlex, a method that synthesizes provably correct runtime monitors using theorem proving to validate compliance with hybrid system models, initiating fail-safe actions when deviations occur, and providing offline safety proofs to ensure future safety.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If runtime monitoring checks the critical safety property directly, then safety violations are detected, but the monitoring becomes futile when violations occur too late to prevent harm due to continuous dynamics
Solution Approach 1:
The runtime monitor checks preconditions and invariants that must hold before and during system operation to prevent unsafe states, rather than merely detecting post-violation conditions. By validating assumptions about sensor readings, actuator behavior, and system state transitions in advance, the monitor can trigger warnings or fail-safe actions before critical safety violations occur.
Solution Approach 2:
The patent introduces an intermediate layer of abstractions between the physical system and safety properties: verified hybrid system models serve as intermediaries that capture essential safety-critical behavior. The runtime monitor validates whether actual system behavior conforms to these intermediate models, providing a computationally tractable way to ensure safety without directly analyzing complex continuous dynamics in real-time.
2Reliability
If the verified model is used directly for runtime validation, then safety guarantees transfer to the real system under ideal conditions, but the verification fails when sensor uncertainty and actuator disturbance cause deviations from the model
Solution Approach 1:
The patent modifies the verification approach to account for uncertainty by introducing parameter variations. Instead of verifying against a single deterministic model, the system verifies hybrid system models that incorporate ranges of possible sensor readings and actuator behaviors. The runtime monitor then checks whether actual behavior falls within these verified ranges, allowing safety guarantees to hold despite expected deviations.
Solution Approach 2:
The patent applies different levels of verification strictness to different parts of the system. Critical safety-critical components are verified with high precision, while less critical components allow greater deviation margins. The runtime monitor focuses its attention on validating the most important model assumptions and invariants, rather than requiring perfect conformance across all system aspects.
Data Source
AI summary
Disclosed herein are techniques to make the synthesized monitoring conditions of partially-observable hybrid systems robust to partial observability of sensor uncertainty and partial controllability due to actuator disturbance. The approach herein shows that the monitoring conditions result in provable safety guarantees with fallback controllers that react to monitor violation at runtime.