# Reachset Conformance and Automatic Model Adaptation for Hybrid Systems

^{1}

^{2}

^{*}

## Abstract

**:**

## 1. Introduction

**Natural choice:**We show that safety properties can be transfered from M to S exactly in the case when reachset conformance between M and S holds. Therefore, reachset conformance is the natural choice to transfer safety properties.

**Quantified reachset conformance check:**A robustness measure is introduced, which is based on the distance of a point to the boundary of a reachable set. In our setting, reachable sets are represented as zonotopes, and as a result, exclusion can be checked using linear programming techniques. This is computed for the measured data of the real system of some input and the output of the verification model for the same input, cf. Figure 2.

**Model adaptation:**We show how to automatically adapt the non-determinism of a model M, such that M becomes reachset-conformant to S. This is computed by identifying bounds on non-deterministic parameters. The bounds are optimized using Bayesian optimization to minimize the non-determinism while being conformant, Figure 1. In addition to building a reachset-conformant model, the method maximizes the verification capabilities of the model, cf. model 3 in Figure 2. Thus, our method helps to overcome the burden of building a formal verification model.

**Autonomous vehicle application:**We apply our methods to a real automated vehicle and construct a verification model of the vehicle. Measured driving data of the automated vehicle were recorded, and our model adaptation was applied to identify the non-determinism of the verification model such that the model is reachset-conformant to the automated vehicle. Our verification model is amenable to verification, showing that our approach is applicable to the highly relevant use case of autonomous vehicles. This is the first work showing reachset conformance for a real (autonomous) vehicle.

## 2. Related Work

#### 2.1. Verification

#### 2.2. Conformance

## 3. Preliminaries

- A finite set of locations $Q\subset \mathbb{N}$;
- A continuous state space $X\subseteq {\mathbb{R}}^{n}$;
- An initial set ${I}_{H}\subseteq Q\times X$;
- A continuous input space $U\subseteq {\mathbb{R}}^{m}$;
- A flow function ${F}_{H}:Q\times X\times U\to \mathcal{P}\left(X\right)$, where $\mathcal{P}\left(X\right)$ is the power set of X;
- An invariant set $inv\left(q\right)\subseteq X$ for each location q;
- A set of discrete transitions $\mathcal{T}\subseteq Q\times Q$;
- A guard set $guard\left((q,{q}^{\prime})\right)$ for each transition $(q,{q}^{\prime})\in \mathcal{T}$;
- A jump function $jum{p}_{(q,{q}^{\prime})}:X\to \mathcal{P}\left(X\right)$ for each transition $(q,{q}^{\prime})\in \mathcal{T}$;
- An output space $O\subseteq {\mathbb{R}}^{l}$;
- An output map $out:Q\times X\to O$.

**Definition**

**1**

## 4. Reachset Conformance

**Definition**

**2**

**Proposition**

**1.**

**Proof.**

**Theorem**

**1.**

**Proof.**

**Theorem**

**2.**

**Proof.**

## 5. Reachset Conformance Testing

- 1.
- Obtain measurements of the system S as an underapproximation $Reac{h}_{t}^{u}(,u(.),{I}_{S})\subseteq Reac{h}_{t}(,u(.),{I}_{S})$ of the reachable states of for a finite set T of points in time $t\in T$.
- 2.
- Compute an overapproximation $Reac{h}_{t}^{o}(,u(.),{I}_{M})\supseteq Reac{h}_{t}(,u(.),{I}_{M})$ of the reachable set of for all $t\in T$.
- 3.
- Check if $Reac{h}_{t}^{u}(,u(.),{I}_{S})\u2288Reac{h}_{t}^{o}(,u(.),{I}_{M})$ holds for any $t\in T$.

#### 5.1. Obtain Measurements of S

#### 5.2. Overapproximation of the Reachable Sets of M

**Definition**

**3**

#### 5.3. Exclusion Check

**Definition**

**4**

**Theorem**

**3.**

**Proof.**

## 6. Model Adaptation

**Example**

**1.**

- 1.
- Initialize vectors $P={p}_{1},\dots ,{p}_{n}$ with random values and calculate the vectors $V={v}_{1},\dots ,{v}_{n},C={c}_{1},\dots ,{c}_{n}$ via ${v}_{i}={m}_{ver}\left({p}_{i}\right),{c}_{i}={m}_{conf}\left({p}_{i}\right)$.
- 2.
- Generate $g{p}_{conf}$ and $g{p}_{ver}$ using $P,V,$ and C.
- 3.
- Find ${p}_{n+1}$ minimizing $g{p}_{conf}$ with $g{p}_{ver}>0$ using Bayesian optimization [38], add ${p}_{n+1}$ to P, and add ${v}_{n+1}={m}_{ver}\left({p}_{n+1}\right),{c}_{n+1}={m}_{conf}\left({p}_{n+1}\right)$ to V and C, respectively.

## 7. Application of Reachset Conformance to an Autonomous Vehicle

#### 7.1. Experimental Setup

- 1.
**Single lane-change maneuver:**One single lane-change from a right lane to the left lane, which is a typical maneuver for automated vehicles.- 2.
**Double lane-change maneuver:**After a single lane-change, the vehicle stays on the left lane for 4 s and switches back to the initial lane. This is a standard overtaking maneuver.- 3.
**Fast double lane-change maneuver:**This maneuver is similar to the double-lane change maneuver, but it immediately switches back to the right lane when on the left lane. Such a maneuver occurs when avoiding obstacles on the road and is more dynamic than the double-lane change.- 4.
**Slalom maneuver:**To challenge the model with measurements of a more dynamic maneuver, a slalom maneuver was additionally included.

#### 7.2. Verification Model

#### 7.3. Reachset Conformance Testing

## 8. Conclusions

## Author Contributions

## Funding

## Data Availability Statement

## Acknowledgments

## Conflicts of Interest

## References

- Guéguen, H.; Lefebvre, M.A.; Zaytoon, J.; Nasri, O. Safety verification and reachability analysis for hybrid systems. Annu. Rev. Control
**2009**, 33, 25–36. [Google Scholar] [CrossRef] - Frehse, G. An Introduction to Hybrid Automata, Numerical Simulation and Reachability Analysis. In Proceedings of the Formal Modeling and Verification of Cyber-Physical Systems; Drechsler, R., Kühne, U., Eds.; Springer: Berlin, Germany, 2015. [Google Scholar]
- Roehm, H.; Oehlerking, J.; Woehrle, M.; Althoff, M. Reachset Conformance Testing of Hybrid Automata. In Proceedings of the HSCC, Vienna, Austria, 12–14 April 2016; pp. 277–286. [Google Scholar]
- Dang, T. Model-Based Testing for Embedded Systems; Chapter Model-Based Testing of Hybrid Systems; CRC Press: Boca Raton, FL, USA, 2011; pp. 383–423. [Google Scholar]
- Schupp, S.; Ábrahám, E.; Chen, X.; Ben Makhlouf, I.; Frehse, G.; Sankaranarayanan, S.; Kowalewski, S. Current Challenges in the Verification of Hybrid Systems. In Proceedings of the Fifth Workshop on Design, Modeling and Evaluation of Cyber Physical Systems, Amsterdam, The Netherlands, 8 October 2015; pp. 8–24. [Google Scholar]
- Althoff, M. An Introduction to CORA 2015. In Proceedings of the Workshop on Applied Verification for Continuous and Hybrid Systems, Brussels, Belgium, 9 July 2015; pp. 120–151. [Google Scholar]
- Althoff, M.; Dolan, J.M. Reachability Computation of Low-Order Models for the Safety Verification of High-Order Road Vehicle Models. In Proceedings of the American Control Conference, Atlanta, GA, USA, 8–10 June 2012; pp. 3559–3566. [Google Scholar]
- Roehm, H.; Oehlerking, J.; Woehrle, M.; Althoff, M. Model Conformance for Cyber-Physical Systems: A Survey. ACM Trans. Cyber Phys. Syst.
**2019**, 3, 1–26. [Google Scholar] [CrossRef] - van Osch, M.P.W.J. Automated Model-Based Testing of Hybrid Systems. Ph.D. Thesis, Technische Universiteit Eindhoven, Eindhoven, The Netherlands, 2009. [Google Scholar]
- Tretmans, G.J. A Formal Approach to Conformance Testing. Ph.D Thesis, Universiteit Twente, Twente, The Netherlands, 1992. [Google Scholar]
- Abbas, H.; Mittelmann, H.; Fainekos, G. Formal Property Verification in a Conformance Testing Framework. In Proceedings of the 12th ACM/IEEE International Conference on Formal Methods and Models for Codesign, Lausanne, Switzerland, 19–21 October 2014; pp. 155–164. [Google Scholar]
- Abbas, H.; Hoxha, B.; Fainekos, G.; Deshmukh, J.V.; Kapinski, J.; Ueda, K. Conformance Testing as Falsification for Cyber-Physical Systems. arXiv
**2014**, arXiv:1401.5200. [Google Scholar] - Annapureddy, Y.S.R.; Fainekos, G.E. Ant Colonies for Temporal Logic Falsification of Hybrid Systems. In Proceedings of the 36th Annual Conference of IEEE Industrial Electronics, Glendale, AZ, USA, 7–10 November 2010; pp. 91–96. [Google Scholar]
- Quesel, J.D. Similarity, Logic, and Games: Bridging Modeling Layers of Hybrid Systems. Ph.D. Thesis, University of Oldenburg, Oldenburg, Germany, 2013. [Google Scholar]
- Deshmukh, J.V.; Majumdar, R.; Prabhu, V.S. Quantifying Conformance Using the Skorokhod Metric. In Proceedings of the CAV, San Francisco, CA, USA, 18–24 July 2015. [Google Scholar]
- Majumdar, R.; Prabhu, V.S. Computing Distances between Reach Flowpipes. In Proceedings of the 19th International Conference on Hybrid Systems: Computation and Control. Association for Computing Machinery, Vienna, Austria, 12–14 April 2016; pp. 267–276. [Google Scholar] [CrossRef]
- Frehse, G. Compositional Verification of Hybrid Systems using Simulation Relations. Ph.D. Thesis, Radboud Universiteit Nijmegen, Nijmegen, The Netherlands, 2005. [Google Scholar]
- Tabuada, P. Verification and Control of Hybrid Systems—A Symbolic Approach; Springer: Berlin, Germany, 2009. [Google Scholar]
- van der Schaft, A. Bisimulation of Dynamical Systems. In Proceedings of the Hybrid Systems: Computation and Control, Philadelphia, PA, USA, 25–27 March 2004; pp. 555–569. [Google Scholar]
- Bujorianu, M.L.; Lygeros, J.; Bujorianu, M.C. Bisimulation for general stochastic hybrid systems. In Proceedings of the HSCC, Zurich, Switzerland, 9–11 March 2005. [Google Scholar]
- Cuijpers, P.J.L. On Bicontinuous Bisimulation and the Preservation of Stability. In Proceedings of the Hybrid Systems: Computation and Control, Pisa, Italy, 3–5 April 2007; pp. 676–679. [Google Scholar]
- Prabhakar, P.; Dullerud, G.; Viswanathan, M. Stability Preserving Simulations and Bisimulations for Hybrid Systems. IEEE Trans. Autom. Control
**2015**, 60, 3210–3225. [Google Scholar] [CrossRef] - Girard, A.; Julius, A.A.; Pappas, G.J. Approximate simulation relations for hybrid systems. IFAC Proc. Vol.
**2006**, 39, 106–111. [Google Scholar] [CrossRef] - Girard, A.; Julius, A.A.; Pappas, G.J. Approximate simulation relations for hybrid systems. Discret. Event Dyn. Syst.
**2008**, 18, 163–179. [Google Scholar] [CrossRef] - Tabuada, P. Approximate simulation relations and finite abstractions of quantized control systems. In Proceedings of the HSCC, Pisa, Italy, 3–5 April 2007. [Google Scholar]
- Liu, S.B.; Althoff, M. Reachset Conformance of Forward Dynamic Models for the Formal Analysis of Robots. In Proceedings of the P IEEE/RSJ International Conference on Intelligent Robots and Systems, Madrid, Spain, 1–5 October 2018; pp. 370–376. [Google Scholar]
- Kochdumper, N.; Tarraf, A.; Rechmal, M.; Olbrich, M.; Hedrich, L.; Althoff, M. Establishing Reachset Conformance for the Formal Analysis of Analog Circuits. In Proceedings of the 25th Asia and South Pacific Design Automation Conference, Beijing, China, 13–16 January 2020; pp. 199–204. [Google Scholar]
- Bravo, J.M.; Alamo, T.; Camacho, E.F. Bounded Error Identification of Systems With Time-Varying Parameters. IEEE Trans. Autom. Control
**2006**, 51, 1144–1150. [Google Scholar] [CrossRef] - Wang, H.; Kolmanovsky, I.V.; Sun, J. Zonotope-based recursive estimation of the feasible solution set for linear static systems with additive and multiplicative uncertainties. Automatica
**2018**, 95, 236–245. [Google Scholar] [CrossRef] - Liu, B.; Kong, S.; Gao, S.; Zuliani, P.; Clarke, E.M. Parameter Synthesis for Cardiac Cell Hybrid Models Using d-Decisions. In International Conference on Computational Methods in Systems Biology; Springer: Cham, Switzerland, 2014. [Google Scholar]
- Alur, R.; Coucoubetis, C.; Halbwachs, N.; Henzinger, T.A.; Ho, P.H.; Nicolin, X.; Olivero, A.; Sifakis, J.; Yovine, S. The Algorithmic Analysis of Hybrid Systems. Theor. Comput. Sci.
**1995**, 138, 3–34. [Google Scholar] [CrossRef] - Bishop, C. Pattern Recognition and Machine Learning; Information Science and Statistics; Springer: Berlin, Germany, 2006. [Google Scholar]
- Roehm, H.; Oehlerking, J.; Heinz, T.; Althoff, M. STL Model Checking of Continuous and Hybrid Systems. In Proceedings of the ATVA, Chiba, Japan, 17–20 October 2016; Volume 9938, pp. 412–427. [Google Scholar]
- Althoff, M.; Stursberg, O.; Buss, M. Computing Reachable Sets of Hybrid Systems Using a Combination of Zonotopes and Polytopes. Nonlinear Anal. Hybrid Syst.
**2010**, 4, 233–249. [Google Scholar] [CrossRef] [Green Version] - Girard, A.; Le Guernic, C.; Maler, O. Efficient Computation of Reachable Sets of Linear Time-Invariant Systems with Inputs. In Hybrid Systems: Computation and Control; LNCS 3927; Springer: Berlin, Germany, 2006; pp. 257–271. [Google Scholar]
- Le, V.T.H.; Stoica, C.; Alamo, T.; Camacho, E.F.; Dumur, D. Zonotopic Guaranteed State Estimation for Uncertain Systems. Automatica
**2013**, 49, 3418–3424. [Google Scholar] [CrossRef] - Alamo, T.; Bravo, J.M.; Camacho, E.F. Guaranteed State Estimation by Zonotopes. In Proceedings of the 42nd IEEE International Conference on Decision and Control, 2003, Maui, HI, USA, 9–12 December 2003; pp. 5831–5836. [Google Scholar]
- Gardner, J.R.; Kusner, M.J.; Xu, Z.; Weinberger, K.Q.; Cunningham, J.P. Bayesian Optimization with Inequality Constraints. In Proceedings of the 31st I nternational Conference on International Conference on Machine Learning, Beijing, China, 21–26 June 2014; pp. II-937–II-945. [Google Scholar]
- Althoff, M.; Dolan, J.M. Set-Based Computation of Vehicle Behaviors for the Online Verification of Autonomous Vehicles. In Proceedings of the 14th IEEE Conference on Intelligent Transportation Systems, Washington, DC, USA, 5–7 October 2011; pp. 1162–1167. [Google Scholar]
- Althoff, M.; Dolan, J.M. Online Verification of Automated Road Vehicles Using Reachability Analysis. IEEE Trans. Robot.
**2014**, 30, 903–918. [Google Scholar] [CrossRef] [Green Version] - Heß, D.; Löper, C.; Hesse, T. Safe Cooperation of Automated Vehicles. In Proceedings of the AAET—Automatisiertes und vernetztes Fahren, Braunschweig, Germany, 8–9 February 2017. [Google Scholar]

**Figure 1.**The reachable states (gray area) of several verification models as well as the unsafe states (dotted area) are shown. For increasing determinism, the set of reachable states is becoming smaller. When the reachable set is too small to contain all possible states of the real system, it is no longer conformant. Also, when the reachable is too big, it intersects with the unsafe state, and thus, it cannot be used for successful verification. The optimal model has the most determinism while being conformant.

**Figure 3.**The planned trajectory (red) and the driving data (gray, shifted by multiples of 30 cm in ${p}_{y}$ for presentation purposes) for the maneuvers. (

**a**) Single lane-change maneuver. (

**b**) Double lane-change maneuver. (

**c**) Fast double lane-change maneuver. (

**d**) Slalom maneuver.

**Figure 4.**Conformance measure with respect to parameters as approximated by $g{p}_{conf}$. The red line is the boundary between conformant and non-conformant parameters. (

**a**) ${e}_{x}$ vs. ${e}_{y}$, ${e}_{\omega}$ constant. (

**b**) ${e}_{x}$ vs. ${e}_{\omega}$, ${e}_{y}$ constant. (

**c**) ${e}_{y}$ vs. ${e}_{\omega}$, ${e}_{x}$ constant.

**Figure 5.**Verification measure with respect to parameters as approximated by $g{p}_{ver}$. (

**a**) ${e}_{x}$ vs. ${e}_{y}$, ${e}_{\omega}$ constant. (

**b**) ${e}_{x}$ vs. ${e}_{\omega}$, ${e}_{y}$ constant. (

**c**) ${e}_{y}$ vs. ${e}_{\omega}$, ${e}_{x}$ constant.

**Figure 6.**Projection of the measurements (black lines) and the reachsets of the model (gray area) to the position for the single lane-change maneuver. (

**a**) Overview. (

**b**) Subfigure 1: Zoom on the initial set (white box). (

**c**) Subfigure 2: Zoom on the point in time, where the measured data comes closest to the reachset boundary.

Publisher’s Note: MDPI stays neutral with regard to jurisdictional claims in published maps and institutional affiliations. |

© 2022 by the authors. Licensee MDPI, Basel, Switzerland. This article is an open access article distributed under the terms and conditions of the Creative Commons Attribution (CC BY) license (https://creativecommons.org/licenses/by/4.0/).

## Share and Cite

**MDPI and ACS Style**

Roehm, H.; Rausch, A.; Althoff, M.
Reachset Conformance and Automatic Model Adaptation for Hybrid Systems. *Mathematics* **2022**, *10*, 3567.
https://doi.org/10.3390/math10193567

**AMA Style**

Roehm H, Rausch A, Althoff M.
Reachset Conformance and Automatic Model Adaptation for Hybrid Systems. *Mathematics*. 2022; 10(19):3567.
https://doi.org/10.3390/math10193567

**Chicago/Turabian Style**

Roehm, Hendrik, Alexander Rausch, and Matthias Althoff.
2022. "Reachset Conformance and Automatic Model Adaptation for Hybrid Systems" *Mathematics* 10, no. 19: 3567.
https://doi.org/10.3390/math10193567