Specification Violations Research Articles

Safety Shielding under Delayed Observation

Agents operating in physical environments need to be able to handle delays in the input and output signals since neither data transmission nor sensing or actuating the environment are instantaneous. Shields are correct-by-construction runtime enforcers that guarantee safe execution by correcting any action that may cause a violation of a formal safety specification. Besides providing safety guarantees, shields should interfere minimally with the agent. Therefore, shields should pick the safe corrective actions in such a way that future interferences are most likely minimized. Current shielding approaches do not consider possible delays in the input signals in their safety analyses. In this paper, we address this issue. We propose synthesis algorithms to compute delay-resilient shields that guarantee safety under worst-case assumptions on the delays of the input signals. We also introduce novel heuristics for deciding between multiple corrective actions, designed to minimize future shield interferences caused by delays. As a further contribution, we present the first integration of shields in a realistic driving simulator. We implemented our delayed shields in the driving simulator Carla. We shield potentially unsafe autonomous driving agents in different safety-critical scenarios and show the effect of delays on the safety analysis.

DDR4 Ball Grid Array Package Intermittent Fracture Effect on Signal Integrity

DDR4 die are commonly packaged in Ball Grid Array packages. The package solder balls develop fractures due to difference in the thermal co-efficient of expansion of the package and printed circuit board. The intermittent behavior of the fracture is due to the momentarily opening of the solder joint due to vibration or the warpage of the package and the printed circuit board. This intermittent behavior can result in no fault found phenomenon in memory systems. DDR4 response in the presence of an intermittent fracture depends on the location of defect. The defect can occur in clock, address or data channel. A test fixture is used to show the AC coupling nature of fracture in ball grid array package solder ball. The intermittent change in the height of fracture is analyzed using 3-D electromagnetic model of the solder ball using high frequency structure simulator (HFSS) software. HFSS model of the fractured solder ball is used along with DDR4 channel topology to compare the sensitivity of clock, address and data channel response to intermittent fracture. It is shown that the data channel is most sensitive to intermittent fracture. DDR4 data mask violation occurs for even a small fracture height of 0.1 μm. For clock channel, the eye degrades or becomes smaller as the fracture height increases from 0.1 μm to 3 μm. But even for 3 μm fracture height, clock eye diagram remains within DDR4 clock +/- 110 mV specification. For address channel the eye degrades or becomes smaller when the height of fracture increases from 0.1 μm to 3 μm. For fracture height of 3 μm, DDR4 address +/- 65 mV input specification violation occurs. Address channel is more sensitive to intermittent fracture as compared to clock channel. The analysis shows that there is always intermittent error in data channel due to intermittent fracture and there are more intermittent errors in address channel compared to clock channel.

Temporal logic guided safe model-based reinforcement learning: A hybrid systems approach

This paper studies the problem of synthesizing control policies for uncertain continuous-time nonlinear systems from linear temporal logic (LTL) specifications using model-based reinforcement learning (MBRL). Rather than taking an abstraction-based approach, we view the interaction between the LTL formula’s corresponding Büchi automaton and the nonlinear system as a hybrid automaton whose discrete dynamics match exactly those of the Büchi automaton. To find satisfying control policies, we pose a sequence of optimal control problems associated with states in the accepting run of the automaton and leverage control barrier functions (CBFs) to prevent specification violation. Since solving many optimal control problems for a nonlinear system is computationally intractable, we take a learning-based approach in which the value function of each problem is learned online in real-time. Specifically, we propose a novel off-policy MBRL algorithm that allows one to simultaneously learn the uncertain dynamics of the system and the value function of each optimal control problem online while adhering to CBF-based safety constraints. Unlike related approaches, the MBRL method presented herein decouples convergence, stability, and safety, allowing each aspect to be studied independently, leading to stronger safety guarantees than those developed in related works. Numerical results are presented to validate the efficacy of the proposed method.

Corporate Probability of Default: A Single-Index Hazard Model Approach

Corporate probability of default (PD) prediction is vitally important for risk management and asset pricing. In search of accurate PD prediction, we propose a flexible yet easy-to-interpret default-prediction single-index hazard model (DSI). By applying it to a comprehensive U.S. corporate bankruptcy database we constructed, we discover an interesting V-shaped relationship, indicating a violation of the common linear hazard specification. Most importantly, the single-index hazard model passes the Hosmer-Lemeshow goodness-of-fit calibration test while neither does a state-of-the-art linear hazard model in finance nor a parametric class of Box-Cox transformation survival models. In an economic value analysis, we find that this may translate to as much as three times of profit compared to the linear hazard model. In model estimation, we adopt a penalized-spline approximation for the unknown function and propose an efficient algorithm. With a diverging number of spline knots, we establish consistency and asymptotic theories for the penalized-spline likelihood estimators. Furthermore, we reexamine the distress risk anomaly, that is, higher financially distressed stocks deliver anomalously lower excess returns. Based on the PDs from the proposed single-index hazard model, we find that the distress risk anomaly has weakened or even disappeared during the extended period.

Adaptive testing for specification coverage and refinement in CPS models

Design of correct cyber–physical systems (CPS) is of uttermost importance for safety-critical applications. This crucial yet extremely challenging property is often addressed in practice by simulation-based methods. The simulation activity can be made more systematic and rigorous by using formal specifications to express requirements and guide the testing of the system.In this paper, we develop a procedure for generating tests from formal specifications given in Signal Temporal Logic (STL), a declarative language used to express CPS requirements. The proposed test generation method is adaptive with the aim at achieving specification coverage. We devise to this goal cooperative reachability games, which we enhance with numerical optimization to facilitate exercising various parts of specifications. The resulting approach is effective in finding specification violations, but also in increasing confidence (via coverage) that the specification is satisfied. In the latter case, we also propose a method for automatically refining the specification into its part that is actually implemented, thus gaining additional insight into the system-under-test.

CPFuzz: Combining Fuzzing and Falsification of Cyber-Physical Systems

Coverage-guided grey-box fuzzing for computer systems has been explored for decades. However, existing techniques do not adequately explore the space of continuous behaviors in Cyber-Physical Systems (CPSs), which may miss safety-critical bugs. Optimization-guided falsification is promising to find violations of safety specifications, but not suitable for identifying traditional program bugs. This article presents a fuzzing process for finding safety violations at the development phase, which is guided by two quantities: a branch coverage metric to explore discrete program behaviors and a Linear Temporal Logic (LTL) robust satisfaction metric to identify undesirable continuous plant behaviors. We implement CPFuzz to demonstrate the utility of the idea and estimate its effectiveness on seven control system benchmarks. The results show up to a better performance in average time to find violations on all benchmarks than S-TaLiRo and six benchmarks than S3CAMX. Finally, we exploit CPFuzz to synthesize the sensor spoofing attack on a DC motor with fixed-point overflow vulnerability as a case study.

On Generating A Variety of Unsafe Counterexamples for Linear Dynamical Systems

Counterexamples encountered in formal verification are typically used as evidence for violation of specification. They also play a crucial role in CEGAR based techniques, where the counterexample guides the refinements to be performed on the abstractions. While several scalable techniques for verification have been developed for safety verification of hybrid systems, less attention has been paid to extracting the various types of counterexamples for safety violations. Since these systems are infinite state systems, the number of counterexamples for safety violations are potentially infinite and hence searching for the right counterexample becomes a challenging task. In this paper, we present a technique for providing various types of counterexamples for a safety violation of the linear dynamical system. More specifically, we develop algorithms to extract the longest counterexample — the execution that stays in the unsafe set for most time, and deepest counterexample — the execution that ventures the most into the unsafe set in a specific direction provided by the user.

Effect of humidity changes on dimensional stability of 3D printed parts by selective laser sintering

Across many industries, additive manufacturing, also known as 3D printing, is being recognized more and more as an innovative manufacturing technology for the next generation. The automotive industry, especially, has paid huge attention to additive manufacturing, and actively applies it to their design, research, development and manufacturing processes. Selective laser sintering (SLS) in additive manufacturing is emerging and popular, and is often used to produce jigs and fixtures for cost benefits and efficiency in the manufacturing industry. However, the application of additive manufacturing is still limited due to the lack of dimensional stability of 3D printed parts associated with changes in temperature and humidity. This paper examines the effect of humidity changes on the dimensional stability of 3D printed parts made by the SLS process. The test results demonstrated changes in relative humidity may result in design specification violation in terms of dimensional requirement while in use.

Fractures in High-Strength Bolts due to Hydrogen Induced Stress Corrosion – Causes and Corrective Actions

Abstract Delayed brittle fractures of high-strength bolts of the strength class 10.9 are presented, taking the example of three damage cases. The respective damage mechanisms could be attributed to hydrogen induced stress corrosion which was caused, in turn, by hydrogen absorption during operation. The examples were chosen with a particular focus on the material condition‘s susceptibility which explains the cause for the occurrence of the damage mechanism. However, in only one of the three cases the susceptibility was evident and could be explained by violations of normative specifications and an unfavorable material choice. Whereas in the two other examples, only slight or no deviations from the standards and/or regulations could be found. The influencing parameters that caused the damage, those that further promoted the damage, as well as possible corrective actions are discussed taking into account the three exemplary damage cases.

Hybrid Intrusion Detection Framework for Ad hoc networks

In this paper, a cluster-based hybrid security framework called HSFA for ad hoc networks is proposed and evaluated. The proposed security framework combines both specification and anomaly detection techniques to efficiently detect and prevent wide range of routing attacks. In the proposed hierarchical architecture, cluster nodes run a host specification-based intrusion detection system to detect specification violations attacks such as fabrication, replay, etc. While the cluster heads run an anomaly-based intrusion detection system to detect wormhole and rushing attacks. The proposed specification-based detection approach relies on a set of specifications automatically generated, while anomaly-detection uses statistical techniques. The proposed security framework provides an adaptive response against attacks to prevent damage to the network. The security framework is evaluated by simulation in presence of malicious nodes that can launch different attacks. Simulation results show that the proposed hybrid security framework performs significantly better than other existing mechanisms.

Algebraic Functions to Counter Improper Model Specification and Assumption Violation Problem

A mathematical model becomes an econometric model only when we include the stochastic term. The model is generally based on certain assumptions regarding the behavior of stochastic variable. Violation of these assumptions leads to certain problems in the model estimation. This paper aims to develop methods to avoid the violation of stochastic assumptions with the help of algebraic functions due to the relationships between the values of independent and dependent variables.

Fault Detection of Discrete-Time Stochastic Systems Subject to Temporal Logic Correctness Requirements

This paper studies the fault detection of discrete-time stochastic systems with linear-time temporal logic (LTL) as correctness requirement—A fault is a violation of LTL specification. The temporal logic allows system correctness properties to be specified compactly and in a user-friendly manner (being close to natural-languages), and supports automatic translation into other formal models such as automata. We introduce the notion of input-output stochastic hybrid automaton (I/O-SHA) and show that the refinement of a continuous physical system (modeled as stochastic difference equations) against a certain class of LTL correctness requirement can be modeled as an I/O-SHA. The refinement preserves the behaviors of the physical system and also captures requirement-violation as a reachability property. Probability distribution over the discrete locations of hybrid system is estimated recursively by computing the distributions for continuous variables for each discrete location. This is then used to compute the likelihood of fault, a statistic that we employ for the purpose of fault detection. The performance of the detection scheme is measured in terms of false alarm (FA) and missed detection (MD) rates, and the condition for the existence of a detector to achieve any desired rates of FA and MD is captured in form of Stochastic-Diagnosability, a notion that we introduce in this paper for stochastic hybrid systems. The proposed method of fault detection is illustrated by a practical example.

This Time the Robot Settles for a Cost: A Quantitative Approach to Temporal Logic Planning with Partial Satisfaction

The specification of complex motion goals through temporal logics is increasingly favored in robotics to narrow the gap between task and motion planning. A major limiting factor of such logics, however, is their Boolean satisfaction condition. To relax this limitation, we introduce a method for quantifying the satisfaction of co-safe linear temporal logic specifications, and propose a planner that uses this method to synthesize robot trajectories with the optimal satisfaction value. The method assigns costs to violations of specifications from user-defined proposition costs. These violation costs define a distance to satisfaction and can be computed algorithmically using a weighted automaton. The planner utilizes this automaton and an abstraction of the robotic system to construct a product graph that captures all possible robot trajectories and their distances to satisfaction. Then, a plan with the minimum distance to satisfaction is generated by employing this graph as the high-level planner in a synergistic planning framework. The efficacy of the method is illustrated on a robot with unsatisfiable specifications in an office environment.

Automatic Error Cause Localization of Faulty PLC Programs

Abstract: When a model checker detects a violation of an all-quantified specification, it generates a counterexample trace that explains how to reach a violating state. In the context of PLCs, the counterexample contains the required stimuli for the program to cause erroneous behavior. Although these counterexamples are tremendously helpful to assess the violation, the actual cause of the erroneous behavior, i. e., the faulty line in the program, can be hidden anywhere in the counterexample trace. Finding the cause manually still takes great effort if the counterexample is long. In this paper, we present a technique to automatically find possible causes of such a violation of PLC programs running in cyclic scanning mode.

TACO: Efficient SAT-Based Bounded Verification Using Symmetry Breaking and Tight Bounds

SAT-based bounded verification of annotated code consists of translating the code together with the annotations to a propositional formula, and analyzing the formula for specification violations using a SAT-solver. If a violation is found, an execution trace exposing the failure is exhibited. Code involving linked data structures with intricate invariants is particularly hard to analyze using these techniques. In this paper, we present Translation of Annotated COde (TACO), a prototype tool which implements a novel, general, and fully automated technique for the SAT-based analysis of JML-annotated Java sequential programs dealing with complex linked data structures. We instrument code analysis with a symmetry-breaking predicate which, on one hand, reduces the size of the search space by ignoring certain classes of isomorphic models and, on the other hand, allows for the parallel, automated computation of tight bounds for Java fields. Experiments show that the translations to propositional formulas require significantly less propositional variables, leading to an improvement of the efficiency of the analysis of orders of magnitude, compared to the noninstrumented SAT--based analysis. We show that in some cases our tool can uncover bugs that cannot be detected by state-of-the-art tools based on SAT-solving, model checking, or SMT-solving.

Strong guidance on mitigating the effects of uncertainties in the brass casting blending problem: a hybrid optimization approach

The scrap charge optimization problem in the brass casting process is a critical management concern that aims to reduce the charge while preventing specification violations. Uncertainties in scrap material compositions often cause violations in product standards. In this study, we have discussed the aleatory and epistemic uncertainties and modelled them by using probability and possibility distributions, respectively. Mathematical models including probabilistic and possibilistic parameters are generally solved by transforming one type of parameter into the other. However, the transformation processes have some handicaps such as knowledge losses or virtual information production. In this paper, we have proposed a new solution approach that needs no transformation process and so eliminates these handicaps. The proposed approach combines both chance-constrained stochastic programming and possibilistic programming. The solution of the numerical example has shown that the blending problem including probabilistic and possibilistic uncertainties can be successfully handled and solved by the proposed approach.

Modeling and Verification of Agent based Adaptive Traffic Signal using Symbolic Model Verifier

This paper addresses the issue of modeling and verification of a Multi Agent System (MAS) scenario. We have considered an agent based adaptive traffic signal system. The system monitors the smooth flow of traffic at intersection of two road segment. After describing how the adaptive traffic signal system can efficiently be used and showing its advantages over traffic signals with predetermined periods, we have shown how we can transform this scenario into Finite State Machine (FSM). Once the system is transformed into a FSM, we have verified the specifications specified in Computational Tree Logic(CTL) using NuSMV as a model checking tool. Simulation results obtained from NuSMV showed us whether the system satisfied the specifications or not. It has also showed us the state where the system specification does not hold. Using which we traced back our system to find the source, leading to the specification violation. Finally, we again verified the modified system with NuSMV for its specifications.

Probabilistic, modular and scalable inference of typestate specifications

Static analysis tools aim to find bugs in software that correspond to violations of specifications. Unfortunately, for large and complex software, these specifications are usually either unavailable or sophisticated, and hard to write.

'Soft' usability problems with consumer electronics: the interaction between user characteristics and usability

The paper reports a study into consumers’ ‘soft’ usability problems they experience using electronic household products. These problems cannot be traced back to a specification violation failure, classified as no failure found (NFF). The aim of this study is to find a relationship between consumers’ soft usability problems and their personal characteristics, encompassing demographical and cognitive aspects. The complaints collected through an exploratory survey were classified into three categories of soft usability problems. The findings indicate that demographic, socioeconomic and cultural characteristics as well as personal traits show significant correlations with these problem categories. Based on the data preliminary user profiles were made. By providing a new definition of usability problems and by user profiling, this study is expected to help design teams to get a better understanding of their target group. The implications of these findings for the product development process are discussed.

Debugging formal specifications: a practical approach using model-based diagnosis and counterstrategies

Creating a formal specification for a design is an error-prone process. At the same time, debugging incorrect specifications is difficult and time consuming. In this work, we propose a debugging method for formal specifications that does not require an implementation. We handle conflicts between a formal specification and the informal design intent using a simulation-based refinement loop, where we reduce the problem of debugging overconstrained specifications to that of debugging unrealizability. We show how model-based diagnosis can be applied to locate an error in an unrealizable specification. The diagnosis algorithm computes properties and signals that can be modified in such a way that the specification becomes realizable, thus pointing out potential error locations. In order to fix the specification, the user must understand the problem. We use counterstrategies to explain conflicts in the specification. Since counterstrategies may be large, we propose several ways to simplify them. First, we compute the counterstrategy not for the original specification but only for an unrealizable core. Second, we use a heuristic to search for a countertrace, i.e., a single input trace which necessarily leads to a specification violation. Finally, we present the countertrace or the counterstrategy as an interactive game against the user, and as a graph summarizing possible plays of this game. We introduce a user-friendly implementation of our debugging method and present experimental results for GR(1) specifications.