Controller Verification and Design with Logical Analysis Support

Modern computer-controlled systems deployed for safety-critical applicationsare growing increasingly large and complex. Industry professionals submit theirdesigns to rigorous testing procedures to detect possible errors and re-design thesystem as necessary. Nonetheless, design errors can go undetected and appear in thefinal product. In safety-critical systems, these errors may cause severe financial andeven human losses. As a result, the modern engineering development process needsto address safety specifications as well as performance specifications.This dissertation proposes the use of control envelopes, which are abstractionson the input-output relation of a controller. Control envelopes can be used to verifysafety of proposed controllers. Since the control envelope does not depend onany specific controller implementation, it can be reused throughout the system developmentcycle. As a result, safety specifications can be checked with the controlenvelope by a static check on the input-output of the controller. Second, controlenvelopes constitute a reusable specification. Initial effort devoted to computing agood control pays for itself throughout the rest of the development process in termsof flexibility and reusability.We describe a tool called Perseus to automatically check when a controller satisfiesa control envelope. We illustrate our approach on control design case studies forautonomous driving scenarios intended to reduce accidents at traffic intersections.Our case studies make use of the theorem prover KeYmaera to verify plants controlledby control envelopes. KeYmaera uses a powerful representation languagecalled differential dynamic logic, which supports symbolic parameters and can handlenonlinear dynamics without resorting to approximation techniques that incur errors.However, KeYmaera (and theorem proving approaches in general) suffer froma lack of automation, and often require specialized knowledge to operate. We proposethe addition of a forward invariant cut proof rule to KeYmaera’s reasoningcalculus, which allows one to leverage designer insights into proofs of safety of aclosed-loop system. We describe the tool Manticore, which aids the search for forwardinvariants. We illustrate our approach on a case study of a benchmark fuelcontrol system.