Safe Neighborhood Computation for Hybrid System Verification

Hybrid systems exhibit both discrete and continuous dynamics. The system state can flow continuously, and can also jump by triggering an event (transition). As an important application in the research of hybrid systems, safety verification is concerned with whether a specified set of unsafe states can be reached by the system from the initial set. One direct approach is to compute or over-approximate the set of all reachable states [8, 11, 13, 16], and then check the intersection with the unsafe set. The verification problem has also been investigated by using the abstraction approach, i.e., to construct a system model with a smaller or even finite state space, whose language is equivalent to or includes that of the original system [15]. Performing analysis of the abstraction is relatively easy, and allows us to verify properties of the original system. Various effective methods for system abstraction have been proposed [2, 6, 10]. Reachable set computation, system abstraction, and some other approaches such as barrier certificate construction [14] are capable of formally proving the system safety; but formal verification often comes at the price of conservatism and limited scalability. As complementary verification methods, randomized approaches have been proposed to strategically explore the state space with tools such as Rapidly-Exploring Random Trees (RRTs) and Probabilistic RoadMaps (PRMs) [3, 4]. By simulating trajectories from the initial set, one can falsify the system safety, or evaluate probabilistic safety. The randomized approaches are easy to implement because they are simulation-based; but usually a large number of trajectories need to be simulated, and no formal verification can be achieved. It is possible to bridge the simulation-based approach and formal verification [7, 12]: with finitely many simulations run for the sampled initial states, one can verify the safety of not only the samples but also infinitely many candidates in the initial set with mathematically proved guarantee. As in [12], a tube surrounding each simulated trajectory is computed, which over-approximates the reachable set for a neighborhood of initial states around the simulated one. If the simulated trajectory is safe, any trajectory initiated from the neighborhood must be safe, and moreover, must trigger the same event sequence as the simulated trajectory does. Such neighborhood is called a robust neighborhood, which has both uniform safety and transition properties. If the initial set can be fully covered by the robust neighborhoods of