[Paper Review] Automatic Synthesis of Switching Controllers for Linear Hybrid Automata

Massimo Benerecetti, Marco Faella+1 more|arXiv (Cornell University)|Mar 23, 2011

Formal Methods in Verification12 references3 citations

TL;DR

This paper presents a sound and complete symbolic fixpoint procedure for automatically synthesizing switching controllers in Linear Hybrid Automata (LHAs) to satisfy safety objectives. By introducing a novel RWA^m operator based on polyhedral abstractions and proving termination, the method enables exact synthesis of controllers that avoid unsafe regions while ensuring reachability to safe states, with experimental validation on PHAVer+ showing linear scalability.

ABSTRACT

In this paper we study the problem of automatically generating switching controllers for the class of Linear Hybrid Automata, with respect to safety objectives. We identify and solve inaccuracies contained in previous characterizations of the problem, providing a sound and complete symbolic fixpoint procedure, based on polyhedral abstractions of the state space. We also prove the termination of each iteration of the procedure. Some promising experimental results are presented, based on an implementation of the fixpoint procedure on top of the tool PHAVer.

Motivation & Objective

• To address inaccuracies in prior characterizations of controller synthesis for Linear Hybrid Automata (LHAs) with respect to safety objectives.
• To develop a sound and complete symbolic fixpoint procedure for synthesizing switching controllers that ensure safety in the presence of controllable and uncontrollable transitions.
• To formally prove termination of each iteration in the fixpoint computation, ensuring correctness and convergence.
• To implement and evaluate the procedure using the PHAVer+ tool on benchmark models, demonstrating scalability and precision.
• To provide a foundation for approximate techniques by offering an exact reference implementation.

Proposed method

• The method employs a novel symbolic fixpoint procedure based on polyhedral abstractions of the continuous state space to represent and manipulate reachable sets.
• It introduces the RWA^m (Reach While Avoiding) operator as the core primitive, which computes the set of states from which a trajectory can reach a target set while avoiding an unsafe set.
• The procedure iteratively applies the controller preimage operator (CPre) to compute backward reachable sets, converging to a fixpoint that characterizes the controllable region.
• Termination is formally proven by showing that each iteration reduces the state space in a well-founded manner, leveraging the structure of convex polyhedra.
• The implementation is built on top of the PHAVer tool, extending it with controller synthesis capabilities using exact arithmetic and polyhedral operations.
• The approach handles non-deterministic differential inclusions (via convex polyhedra), modeling environmental disturbances, and supports both deterministic and non-deterministic continuous flows.

Experimental results

Research questions

• RQ1 Can a sound and complete symbolic fixpoint procedure be developed for controller synthesis in Linear Hybrid Automata with safety objectives?
• RQ2 How can inaccuracies in prior RWA-style operators—especially for non-convex unsafe sets—be formally corrected?
• RQ3 Does the proposed fixpoint procedure terminate for all instances of the synthesis problem in LHAs?
• RQ4 Can the method scale effectively to realistic models with increasing complexity, such as multiple obstacles or non-deterministic flows?
• RQ5 How does the performance of the exact synthesis procedure compare to prior tools, especially in terms of scalability and precision?

Key findings

• The proposed fixpoint procedure is formally proven to be sound and complete for synthesizing switching controllers in LHAs under safety objectives.
• The method correctly handles non-convex unsafe sets, which previous approaches failed to address, by using a refined RWA^m operator.
• Termination of each iteration is formally proven, ensuring that the algorithm converges to the correct controllable region.
• In experiments, the implementation on PHAVer+ showed approximately linear growth in computation time with increasing numbers of obstacles (e.g., pits), outperforming prior tools like HoneyTech in scalability.
• For the water tank control example, the fixpoint was computed in 11 seconds over 5 iterations, correctly capturing the 1-second delay constraint on valve operations.
• The tool correctly identified that in the all-valves-closed case, water levels must be within [0.5, 7] to remain safe after one second, due to evaporation and rain effects.