Inconsistencies in Models of Adaptive Service Robots

•

1 recomendación•197 vistas

Consider an adaptive robot that completes movement tasks in an uncertain environment with limited resources. A promising way to design such robots is model-based engineering -- using multiple explicit models (e.g., of the architecture, power, and motion) to make choices based on the current state estimates and future state predictions. Ideally, these multiple models should be integrated; that is, they should cooperate seamlessly to support the adaptation goals. However, inconsistencies between models threaten their proper integration and, consequently, the intended adaptive behavior. We will describe several examples of inconsistencies that arise between the models of power, motion, configuration, and physical environment for a mobile service robot. The talk will discuss the causes and impacts of these inconsistencies, as well as the preliminary ways to detect and correct them.

Tecnología

Inconsistencies in Models of
Adaptive Service Robots
Ivan Ruchkin *
PhD Student in Software Engineering
Institute for Software Research
Carnegie Mellon University
* with images from Jonathan Aldrich,
Javier Cámara, and Bradley Schmerl
Software Research Seminar (SSSG)
April 10, 2017

2
Service robot missions
● Autonomy in the face of uncertainty
● Timeliness, power, safety

4
Centralized online adaptation
Does it work?

5
How to check if it works
Run the system

6
How to check if it works
Run the system
Run the simulation

7
How to check if it works
Run the system
Run the simulation
Analyze the models

8
How to check if it works
Run the system
Run the simulation
Analyze the models
Analyze the code

9
How to check if it works
Run the system
Run the simulation
Analyze the models
Analyze the code

10
Plan for today
● Inconsistency 1: power
● Inconsistency 2: turns
● What is common?
● Tentative approach: detection

11
Inconsistency 1: power in
simulation vs hardware

12
Inconsistency 1: power in
simulation vs hardware

13
Inconsistency 1: power in
simulation vs hardware
Model source:
hardware
experiments

14
Inconsistency 1: power in
simulation vs hardware
Model source:
hardware
experiments
Simulation:
fixed increments
Simulation

15
Inconsistency 1: power in
simulation vs hardware
Model source:
hardware
experiments
Simulation:
fixed increments
Simulation

18
Inconsistency 1: summary
● Hardware power predictions do not match the simulation
– Initially optimistic, later pessimistic
● Obscured by mixing power dynamics
– Mode switching
– CPU and sensors
● Definition:
– What deviations are acceptable, over what time?
● Assurance:
– Simulation, corner case tests

19
Inconsistency 2: turning in
instruction graphs vs planning

20
Inconsistency 2: turning in
instruction graphs vs planning
A
B
C D

21
Inconsistency 2: turning in
instruction graphs vs planning
A
B
C D
Instruction
graph
A B C D

22
Inconsistency 2: turning in
instruction graphs vs planning
A
B
C D
APlanning
+ cost(C)
B D
Instruction
graph
A B C D

23
Inconsistency 2: turning in
instruction graphs vs planning
A
B
C D
APlanning
+ cost(C)
B D
Instruction
graph
A B C D
State estimation = ?

26
● Planning and execution represent turning differently
● State estimation is uncertain during a turn
– If optimistic, can run out of power
– If pessimistic, can waste time on charging
● Definition:
– Bound of utility loss from state estimation uncertainty
● Assurance:
– Quantitative model checking
Inconsistency 2: summary

27
What is common?
A B D
A B C D
Power in simulation/hardware Turns in planning/execution

31
What is common?
A B D
A B C D
Power in simulation/hardware Turns in planning/execution
● Several models with differing assumptions
● Definition: bounded mismatch
● Checking requires multiple semantics

33
Detecting Inconsistencies
1. Relate models
● Manual

36
Detecting Inconsistencies
1. Relate models
● Manual
2. Specify consistency properties
● Manual

37
Specifying consistency
“Predicted and simulated power always stay within a fixed error bound”
□ ∀p, t · p = PowPred(t) →
□ ( time = t → | PowSim – p | < ε)

38
Detecting Inconsistencies
1. Relate models
● Manual
2. Specify consistency properties
● Manual
3. Find potential inconsistencies
● Automated

41
Detecting Inconsistencies
1. Relate models
● Manual
2. Specify consistency properties
● Manual
3. Find potential inconsistencies
● Automated
4. Check if the consistency properties hold
● Automated

43
Summary
Four-step approach:
Relate – Specify – Find – Check

Más contenido relacionado

Similar a Inconsistencies in Models of Adaptive Service Robots

Rigorous engineering of safety-critical Cyber-Physical Systems (CPS) requires integration of heterogeneous modeling methods from different disciplines. It is often necessary to view this integration from the perspective of analyses -- algorithms that read and change models. Although analytic integration supports formal contract-based verfication of model evolution, it suffers from the limitation of analytic dependency loops. Dependency loops between analyses cannot be resolved based on the existing contract-based verification. This paper makes a step towards using rich architectural description to resolve circular analytic dependencies. We characterize the dependency loop problem and discuss three algorithmic approaches to resolving such loops: analysis iteration, constraint solving, and genetic search. These approaches take advantage of information in multi-view architectures to resolve analytic dependency loops.

Analytic Dependency Loops in Architectural Models of Cyber-Physical Systems

Ivan Ruchkin

A slide deck from my PhD thesis defense. The video of the defense talk can be seen here: https://scs.hosted.panopto.com/Panopto/Pages/Viewer.aspx?id=aebd3567-e42b-4281-94a7-a98f011d1268 Abstract: "Cyber-physical systems (CPS) incorporate digital (cyber) and mechanical (physical) elements that interact in complex ways. Many safety-critical CPS, such as autonomous vehicles and drones, are becoming increasingly widespread and hence demand rigorous quality assurance. To this end, CPS engineering relies on modeling methods, which use models to represent the system and design-time analyses to interpret/change the models. Coming from diverse scientific and engineering fields, these modeling methods are difficult to combine, or integrate, due to implicit relations and dependencies between them. CPS failures can lead to substantial damage or loss of life, and are often due to two key integration challenges: (i) inconsistencies between models — contradictions in models that do not add up to a cohesive design, and (ii) incorrect interactions of analyses — out-of-order executions in mismatched contexts, leading to erroneous analysis outputs. This thesis presents a novel approach to detect and prevent integration issues between CPS modeling methods during the design phase. To detect inconsistencies between models, the approach allows engineers to specify integration properties — quantified logical statements that relate various elements of multiple models — in the Integration Property Language (IPL). IPL statements describe verifiable conditions that are equivalent to an absence of inconsistencies. To interface with the models, IPL relies on integration abstractions — simplified representations of models for integration purposes. Two abstractions are proposed in this thesis: views (annotated component-and-connector models, inspired by software architecture) and behavioral properties (expressions in model-specific languages, such as the linear temporal logic). Combining these abstractions enables engineers to mix model structure and behavior in IPL statements. To ensure correct interactions of analyses, I introduce analysis contracts — a lightweight specification that captures inputs, outputs, assumptions, and guarantees for each analysis, in terms of the integration abstractions. Given these contracts, an analysis execution platform performs analyses in the order of their dependencies, and only in contexts that guarantee correct outputs. My approach to integration was validated on four case studies of CPS modeling methods in different systems: energy-aware planning in a mobile robot, collision avoidance in a mobile robot, thread/battery scheduling in a quadrotor, and reliable/secure sensing in an autonomous vehicle. The validation has shown that the approach supports expressive integration properties, which can be soundly checked within practical constraints, all while being customizable to diverse models, analyses, and domains."

Thesis Defense: Integration of Modeling Methods for Cyber-Physical Systems

Ivan Ruchkin

Our talk from the 22nd International Symposium on Formal Methods. Full paper: http://www.cs.cmu.edu/~iruchkin/docs/ruchkin18-ipl.pdf Abstract: "Design and verification of modern systems requires diverse models, which often come from a variety of disciplines, and it is challenging to manage their heterogeneity -- especially in the case of cyber-physical systems. To check consistency between models, recent approaches map these models to flexible static abstractions, such as architectural views. This model integration approach, however, comes at a cost of reduced expressiveness because complex behaviors of the models are abstracted away. As a result, it may be impossible to automatically verify important behavioral properties across multiple models, leaving systems vulnerable to subtle bugs. This paper introduces the Integration Property Language (IPL) that improves integration expressiveness using modular verification of properties that depend on detailed behavioral semantics while retaining the ability for static system-wide reasoning. We prove that the verification algorithm is sound and analyze its termination conditions. Furthermore, we perform a case study on a mobile robot to demonstrate IPL is practically useful and evaluate its performance. "

IPL: An Integration Property Language for Multi-Model Cyber-Physical Systems

Ivan Ruchkin

Software lifecycle lodhi (1)

Nitesh Nayal

Ch03-Software Engineering Model

Bala Ganesh

Modelling and analysing contextual failures for dependability requirements

Engineering and Social Informatics (ESOTICS)

Final Exam Questions Fall03

Radu_Negulescu

[Video recording available at https://www.youtube.com/playlist?list=PLewjn-vrZ7d3x0M4Uu_57oaJPRXkiS221] Artificial Intelligence is increasingly playing an integral role in determining our day-to-day experiences. Moreover, with proliferation of AI based solutions in areas such as hiring, lending, criminal justice, healthcare, and education, the resulting personal and professional implications of AI are far-reaching. The dominant role played by AI models in these domains has led to a growing concern regarding potential bias in these models, and a demand for model transparency and interpretability. In addition, model explainability is a prerequisite for building trust and adoption of AI systems in high stakes domains requiring reliability and safety such as healthcare and automated transportation, and critical industrial applications with significant economic implications such as predictive maintenance, exploration of natural resources, and climate change modeling. As a consequence, AI researchers and practitioners have focused their attention on explainable AI to help them better trust and understand models at scale. The challenges for the research community include (i) defining model explainability, (ii) formulating explainability tasks for understanding model behavior and developing solutions for these tasks, and finally (iii) designing measures for evaluating the performance of models in explainability tasks. In this tutorial, we present an overview of model interpretability and explainability in AI, key regulations / laws, and techniques / tools for providing explainability as part of AI/ML systems. Then, we focus on the application of explainability techniques in industry, wherein we present practical challenges / guidelines for effectively using explainability techniques and lessons learned from deploying explainable models for several web-scale machine learning and data mining applications. We present case studies across different companies, spanning application domains such as search & recommendation systems, hiring, sales, and lending. Finally, based on our experiences in industry, we identify open problems and research directions for the data mining / machine learning community.

Explainable AI in Industry (KDD 2019 Tutorial)

Krishnaram Kenthapadi

Modern cyber-physical systems interact closely with continuous physical processes like kinematic movement. Software component frameworks do not provide an explicit way to represent or reason about these processes. Meanwhile, hybrid program models have been successful in proving critical properties of discrete-continuous systems. These programs deal with diverse aspects of a cyber-physical system such as controller decisions, component communication protocols, and mechanical dynamics, requiring several programs to address the variation. However, currently these aspects are often intertwined in mostly monolithic hybrid programs, which are difficult to understand, change, and organize. These issues can be addressed by component-based engineering, making hybrid modeling more practical. This paper lays the foundation for using architectural models to provide component-based benefits to developing hybrid programs. We build formal architectural abstractions of hybrid programs and formulas, enabling analysis of hybrid programs at the component level, reusing parts of hybrid programs, and automatic transformation from views into hybrid programs and formulas. Our approach is evaluated in the context of a robotic collision avoidance case study.

Architectural Abstractions for Hybrid Programs

Ivan Ruchkin

Energy modeling during design can be valuable, but calibrated modeling post-construction tells the truth. Learn the tools available for calibrated modeling, and how they use energy bills, digital control systems data, and metering data to assess the actual functionality of a building. Calibrated modeling completes a valuable feedback loop that can help direct future building decisions and, in some cases, uncover additional savings opportunities in existing structures.

Calibrated Modeling - How Well Does My Building Perform? by Eveline Killian

Cx Associates

Final Exam Solutions Fall02

Radu_Negulescu

Keeping Master Green at Scale

Sundaram Ananthanarayanan

Survey on Software Defect Prediction

Sung Kim

Autonomous Systems: How to Address the Dilemma between Autonomy and Safety

Lionel Briand

Alleman coonce-agile-2017 may2

Glen Alleman

IJRET : International Journal of Research in Engineering and Technology is an international peer reviewed, online journal published by eSAT Publishing House for the enhancement of research in various disciplines of Engineering and Technology. The aim and scope of the journal is to provide an academic medium and an important reference for the advancement and dissemination of research results that support high-level learning, teaching and research in the fields of Engineering and Technology. We bring together Scientists, Academician, Field Engineers, Scholars and Students of related fields of Engineering and Technology.

Software testing effort estimation with cobb douglas function a practical app...

eSAT Publishing House

Abstract Effort estimation is one of the critical challenges in Software Testing Life Cycle (STLC). It is the basis for the project’s effort estimation, planning, scheduling and budget planning. This paper illustrates model with an objective to depict the accuracy and bias variation of an organization’s estimates of software testing effort through Cobb-Douglas function (CDF). Data variables selected for building the model were believed to be vital and have significant impact on the accuracy of estimates. Data gathered for the completed projects in the organization for about 13 releases. Statistically, all variables in this model were statistically significant at p<0.05><0.01 levels. The Cobb-Douglas function was selected and used for the software testing effort estimation. The results achieved with CDF were compared with the estimates provided by the area expert. The model’s estimation figures are more accurate than the expert judgment. CDF has one of the appropriate techniques for estimating effort for software testing. CDF model accuracy is 93.42%.

Software testing effort estimation with cobb douglas function- a practical ap...

eSAT Journals

ITSE-lecture no. 4.ppt

SamKazmi2

Survey on Software Defect Prediction

lifove

Survey on Software Defect Prediction (PhD Qualifying Examination Presentation)

lifove

Similar a Inconsistencies in Models of Adaptive Service Robots (20)

Analytic Dependency Loops in Architectural Models of Cyber-Physical Systems

Thesis Defense: Integration of Modeling Methods for Cyber-Physical Systems

IPL: An Integration Property Language for Multi-Model Cyber-Physical Systems

Software lifecycle lodhi (1)

Ch03-Software Engineering Model

Modelling and analysing contextual failures for dependability requirements

Final Exam Questions Fall03

Explainable AI in Industry (KDD 2019 Tutorial)

Architectural Abstractions for Hybrid Programs

Calibrated Modeling - How Well Does My Building Perform? by Eveline Killian

Final Exam Solutions Fall02

Keeping Master Green at Scale

Survey on Software Defect Prediction

Autonomous Systems: How to Address the Dilemma between Autonomy and Safety

Alleman coonce-agile-2017 may2

Software testing effort estimation with cobb douglas function a practical app...

Software testing effort estimation with cobb douglas function- a practical ap...

ITSE-lecture no. 4.ppt

Survey on Software Defect Prediction

Survey on Software Defect Prediction (PhD Qualifying Examination Presentation)

Más de Ivan Ruchkin

Poster for the paper presented at the NASA Formal Methods Symposium (NFM) by Matthew Cleaveland on May 16, 2023. Abstract: Generating accurate runtime safety estimates for autonomous systems is vital to ensuring their continued proliferation. However, exhaustive reasoning about future behaviors is generally too complex to do at runtime. To provide scalable and formal safety estimates, we propose a method for leveraging design-time model checking results at runtime. Specifically, we model the system as a probabilistic automaton (PA) and compute bounded-time reachability probabilities over the states of the PA at design time. At runtime, we combine distributions of state estimates with the model checking results to produce a bounded time safety estimate. We argue that our approach produces well-calibrated safety probabilities, assuming the estimated state distributions are well-calibrated. We evaluate our approach on simulated water tanks.

Poster: Conservative Safety Monitors of Stochastic Dynamical Systems

Ivan Ruchkin

This poster was presented at the University of Florida AI Days 2023. It is based on this paper: https://arxiv.org/abs/2308.12252 Title: How Safe Am I Given What I See? Calibrated Prediction of Safety Chances for Image-Controlled Autonomy Abstract: End-to-end learning has emerged as a major paradigm for developing autonomous systems. Unfortunately, with its performance and convenience comes an even greater challenge of safety assurance. A key factor of this challenge is the absence of the notion of a low-dimensional and interpretable dynamical state, around which traditional assurance methods revolve. Focusing on the online safety prediction problem, this paper proposes a configurable family of learning pipelines based on generative world models, which do not require low-dimensional states. To implement these pipelines, we overcome the challenges of learning safety-informed latent representations and missing safety labels under prediction-induced distribution shift. These pipelines come with statistical calibration guarantees on their safety chance predictions based on conformal prediction. We perform an extensive evaluation of the proposed learning pipelines on two case studies of image-controlled systems: a racing car and a cartpole.

Poster: How Safe Am I Given What I See? Calibrated Prediction of Safety Chanc...

Ivan Ruchkin

Presented at the Sixth International Workshop on Design Automation for Cyber-Physical Systems (DACPS), co-located with the Design Automation Conference (DAC) 2023. Abstract: Autonomous cyber-physical systems (CPS) are increasingly deployed in complex and safety-critical environments. To help CPS interact with such environments, learning-enabled components, such as neural networks, often implement perception and control functions. Unfortunately, the complexity of the environments and learning components is a major challenge to ensuring the safety of CPS. An emerging assurance paradigm prescribes verifying as much of the CPS as possible at design time - and then monitoring the probability of safety at run time in case of unexpected situations. How can we guarantee that the monitor produces a probability that is well-calibrated to the true chance of safety? This talk will overview our recent answers in two settings. The first combines Bayesian filtering with probabilistic model checking of Markov decision processes. The second is based on confidence monitoring of assumptions behind closed-loop neural-network verification.

Verify-then-Monitor: Calibration Guarantees for Safety Confidence

Ivan Ruchkin

Presented by Pengyuan (Eric) Lu at the International Conference on Assured Autonomy 2023. Abstract: Models of actual causality leverage domain knowledge to generate convincing diagnoses of events that caused an outcome. It is promising to apply these models to diagnose and repair run-time property violations in cyber-physical systems (CPS) with learning-enabled components (LEC). However, given the high diversity and complexity of LECs, it is challenging to encode domain knowledge (e.g., the CPS dynamics) in a scalable actual causality model that could generate useful repair suggestions. In this paper, we focus causal diagnosis on the input/output behaviors of LECs. Specifically, we aim to identify which subset of I/O behaviors of the LEC is an actual cause for a property violation. An important by-product is a counterfactual version of the LEC that repairs the run-time property by fixing the identified problematic behaviors. Based on this insights, we design a two-step diagnostic pipeline: (1) construct and Halpern-Pearl causality model that reflects the dependency of property outcome on the component's I/O behaviors, and (2) perform a search for an actual cause and corresponding repair on the model. We prove that our pipeline has the following guarantee: if an actual cause is found, the system is guaranteed to be repaired; otherwise, we have high probabilistic confidence that the LEC under analysis did not cause the property violation. We demonstrate that our approach successfully repairs learned controllers on a standard OpenAI Gym benchmark.

Causal Repair of Learning-Enabled Cyber-physical Systems

Ivan Ruchkin

Presented at the NASA Formal Methods Symposium (NFM) by Matthew Cleaveland on May 16, 2023. Abstract: Generating accurate runtime safety estimates for autonomous systems is vital to ensuring their continued proliferation. However, exhaustive reasoning about future behaviors is generally too complex to do at runtime. To provide scalable and formal safety estimates, we propose a method for leveraging design-time model checking results at runtime. Specifically, we model the system as a probabilistic automaton (PA) and compute bounded-time reachability probabilities over the states of the PA at design time. At runtime, we combine distributions of state estimates with the model checking results to produce a bounded time safety estimate. We argue that our approach produces well-calibrated safety probabilities, assuming the estimated state distributions are well-calibrated. We evaluate our approach on simulated water tanks.

Conservative Safety Monitors of Stochastic Dynamical Systems

Ivan Ruchkin

Presented at 13th ACM/IEEE Intl. Conf. on Cyber-Physical Systems, part of CPS-IoT Week, on May 4, 2022. Presentation video: https://youtu.be/nnhcUhih-vQ Abstract: Closed-loop verification of cyber-physical systems with neural network controllers offers strong safety guarantees under certain assumptions. It is, however, difficult to determine whether these guarantees apply at run time because verification assumptions may be violated. To predict safety violations in a verified system, we propose a three-step confidence composition (CoCo) framework for monitoring verification assumptions. First, we represent the sufficient condition for verified safety with a propositional logical formula over assumptions. Second, we build calibrated confidence monitors that evaluate the probability that each assumption holds. Third, we obtain the confidence in the verification guarantees by composing the assumption monitors using a composition function suitable for the logical formula. Our CoCo framework provides theoretical bounds on the calibration and conservatism of compositional monitors. Two case studies show that compositional monitors are calibrated better than their constituents and successfully predict safety violations.

Confidence Composition for Monitors of Verification Assumptions

Ivan Ruchkin

Presented at the following seminar series in Spring 2022: - University of Arizona, SIE Department - San Diego State University, CS Department - University of Kansas, EECS Department - Tulane University, CS Department - Auburn University, CSSE Department - University of Hawaii, ICS Department - Virginia Tech, ISE Department - Santa Clara University, CS Department - University of Kentucky, CS Department - Indiana University - Purdue University Indianapolis, CIS Department - Michigan State University, CSE Department - University of Florida, ECE Department - Florida Atlantic University, EECS Department Abstract: From autonomous vehicles to smart grids, cyber-physical systems (CPS) play an increasingly important role in today's society. Often, CPS operate autonomously in highly critical settings, and thus it is imperative to engineer these systems to be safe and trustworthy. However, it is particularly difficult to do so due to CPS heterogeneity -- the high diversity of components and models used in these systems. This heterogeneity substantially contributes to fragmented, incoherent assurance as well as to inconsistencies between different models of the system. This talk will present two complementary techniques for overcoming CPS heterogeneity: confidence composition and model integration. The former technique combines heterogeneous confidence monitors to produce calibrated estimates of the run-time probability of safety in CPS with machine learning components. The latter technique discovers inconsistencies between heterogeneous CPS models using a logic-based specification language and a verification algorithm. The application of these techniques will be demonstrated on an unmanned underwater vehicle and a power-aware service robot. These techniques serve as stepping stones towards the vision of engineering autonomous systems that are aware of their own limitations.

Overcoming Heterogeneity in Autonomous Cyber-Physical Systems

Ivan Ruchkin

Presented by Sydney Pugh at the IEEE/ACM international conference on Connected Health: Applications, Systems and Engineering Technologies (CHASE) 2021. Abstract: False alarms generated by physiological monitors can overwhelm clinical caretakers with a variety of alarms. The resulting alarm fatigue can be mitigated with alarm suppression. Before being deployed, such suppression mechanisms need to be evaluated through a costly observational study, which would determine and label the truly suppressible alarms. This paper proposes a lightweight method for evaluating alarm suppression without access to the true alarm labels. The method is based on the data programming paradigm, which combines noisy and cheap-to-obtain labeling heuristics into probabilistic labels. Based on these labels, the method estimates the sensitivity/specificity of a suppression mechanism and describes the likely outcomes of an observational study in the form of confidence bounds. We evaluate the proposed method in a case study of low SpO2 alarms using a dataset collected at Children's Hospital of Philadelphia and show that our method provides tight and accurate bounds that significantly outperform the naive comparative method.

High-Confidence Data Programming for Evaluating Suppression of Physiological ...

Ivan Ruchkin

Presented at the Winter Simulation Conference 2021. Abstract: Stochastic simulations of complex systems often rely on sampling dependent discrete random variables. Currently, their users are limited in expressing their intention about how these variables are distributed and related to each other over time. This limitation leads the users to program complex and error-prone sampling algorithms. This paper introduces a way to specify, declaratively and precisely, a temporal distribution over discrete variables. Our tool PROSPECT infers and samples this distribution by solving a system of polynomial equations. The evaluation on three simulation scenarios shows that the declarative specifications are easier to write, 3x more succinct than imperative sampling programs, and are processed correctly by PROSPECT.

Data Generation with PROSPECT: a Probability Specification Tool

Ivan Ruchkin

Presented at Formal Methods in Outer Space Essays Dedicated to Klaus Havelund on the Occasion of His 65th Birthday. Link to the paper: https://link.springer.com/chapter/10.1007/978-3-030-87348-6_8 Abstract: Design-time approaches to safety assurance for autonomous systems are limited because they must rely on assumptions about the behaviors of learned components in previously unseen environments. These assumptions may be violated at run time, thus invalidating the guarantees produced at design time. To overcome this limitation, we propose to complement design-time assurance with run-time monitoring that calculates the confidence that those assumptions are satisfied and, therefore, design-time guarantees continue to hold. As the first step in our vision, we elicit the logical relationship between assumption violations and safety violations. Then, we develop a probabilistic confidence monitor for each design-time assumption. Finally, we compose these assumption monitors based on their logical relation to safety violations, producing a system-wide assurance monitor. Our vision is illustrated with a case study of an autonomous underwater vehicle that performs pipeline inspection.

Confidence Monitoring and Composition for Dynamic Assurance of Learning-Enabl...

Ivan Ruchkin

Confidence Composition (CoCo) for Dynamic Assurance of Learning-Enabled Auton...

Ivan Ruchkin

Confidence Monitoring and Composition for Dynamic Assurance of Learning-Enabl...

Ivan Ruchkin

A position talk given at the Smart Designing of Smart Systems workshop: https://sdpsnet.org/sdps-2020/ws8.html Engineers necessarily make assumptions during design and implementation of complex systems. These assumptions often set the expectations of one component towards the environment and other components. Assumptions are typically seen as implicit weak points of the system: should they be violated at run time, the system is likely to fall short of its required performance and safety. Although some recent work makes the assumptions explicit, they are still seen as liabilities. This talk will take a complementary perspective and explore how engineering assumptions enable intelligent behaviour in systems and design processes -- and how their violations can be managed at design time and run time.

On the Role of Assumptions in Engineering Smart Systems

Ivan Ruchkin

Authors: Ivan Ruchkin, Oleg Sokolsky, James Weimer, Tushar Hedaoo, and Insup Lee Abstract: Run-time monitoring is a vital part of safety-critical systems. However, early-stage assurance of monitoring quality is currently limited: it relies either on complex models that might be inaccurate in unknown ways, or on data that would only be available once the system has been built. To address this issue, we propose a compositional framework for modeling and analysis of noisy monitoring systems. Our novel 3-value detector model uses probability spaces to represent atomic (non-composite) detectors, and it composes them into a temporal logic-based monitor. The error rates of these monitors are estimated by our analysis engine, which combines symbolic probability algebra, independence inference, and estimation from labeled detection data. Our evaluation on an autonomous underwater vehicle found that our framework produces accurate estimates of error rates while using only detector traces, without any monitor traces. Furthermore, when data is scarce, our approach shows higher accuracy than non-compositional data-driven estimates from monitor traces. Thus, this work enables accurate evaluation of logical monitors in early design stages before deploying them. Original paper: http://dx.doi.org/10.1109/TCAD.2020.3... Supplementary materials: https://www.researchgate.net/publication/342993188_Supplementary_Materials_for_Compositional_Probabilistic_Analysis_of_Temporal_Properties_over_Stochastic_Detectors Video presentation: https://www.youtube.com/watch?v=q-9aHAQwd9Q Source code and data: https://github.com/bisc/prob-comp-asst

Compositional Probabilistic Analysis of Temporal Properties over Stochastic D...

Ivan Ruchkin

Overview of Epidemic Models for COVID-19

Ivan Ruchkin

A presentation from SEAMS 2017 on formalization of hybrid planning. Lead author: https://www.cs.cmu.edu/~ashutosp/ Full paper: http://www.cs.cmu.edu/~iruchkin/docs/pandey17-towards.pdf Abstract: "Decision-making approaches in self-adaptation face a fundamental trade-off between quality and timeliness of adaptation plans. Due to this trade-off, designers often have to make an offline compromise between finding adaptation plans quickly and finding closer-to-optimal plans that demand longer computation times. Recent work has proposed that hybrid planning can resolve this trade-off dynamically, achieving higher utility than either fast or slow approaches individually. The promise of hybrid planning is to combine multiple decision-making approaches at run time to produce adaptation plans of the high quality within given time constraints. However, the diversity of decision-making approaches makes the problem of hybrid planning complex and multi-faceted. This paper advances the theory of hybrid planning by formalizing the central concepts and four sub-problems of hybrid planning. This formalization can serve as a foundation for creating and evaluating hybrid planners in the future."

Towards a Formal Framework for Hybrid Planning in Self-Adaptation

Ivan Ruchkin

The initial version of slides is due to Selva Samuel. Abstract: "Cyber-physical systems (CPSs) mix software, hardware, and physical aspects with equal importance. Typically, the use of models of such systems during run time has concentrated only on managing and controlling the cyber (software) aspects. However, to fully realize the goals of a CPS, physical models too have to be treated as first-class models. This approach gives rise to three main challenges: (a) identifying and integrating physical and software models with different characteristics and semantics; (b) obtaining instances of physical models at a suitable level of abstraction for adaptation; and (c) using and adapting physical models to control CPSs. In this position paper, we elaborate on these three challenges and describe our vision of making physical models first-class entities in adaptation. We illustrate this vision in the context of power adaptation for a service robotic system."

Challenges in Physical Modeling for Adaptation of Cyber-Physical Systems

Ivan Ruchkin

Hardware Power Modeling for Turtlebot

Ivan Ruchkin

A talk given at ACVI 2016. Abstract: Recent research in embedded and cyber-physical systems has developed theories and tools for integration of heterogeneous components and models. These efforts, although important, are insufficient for high-quality and error-free systems integration since inconsistencies between system elements may stem from factors not directly represented in models (e.g., analysis tools and expert disagreements). Therefore, we need to broaden our perspective on integration, and devise approaches in three novel directions of integration: modeling methods, data sets, and humans. This paper summarizes the latest advances, and discusses those directions and associated challenges in integration for cyber-physical systems.

Integration Beyond Components and Models: Research Challenges and Directions

Ivan Ruchkin

Presented at the 1st ACM Workshop on Cyber-Physical Systems Security and Privacy (CPS-SPC). Abstract: Designing secure cyber-physical systems (CPS) is a particularly difficult task since security vulnerabilities stem not only from traditional cybersecurity concerns, but also physical ones. Many of the standard methods for CPS design make strong and unverified assumptions about the trustworthiness of physical devices, such as sensors. When these assumptions are violated, subtle inter-domain vulnerabilities are introduced into the system model. In this paper we use formal specification of analysis contracts to expose security assumptions and guarantees of analyses from reliability, control, and sensor security domains. We show that this specification allows us to determine where these assumptions are violated, opening the door to malicious attacks. We demonstrate how this approach can help discover and prevent vulnerabilities using a self-driving car example.

Eliminating Inter-Domain Vulnerabilities in Cyber-Physical Systems: An Analys...

Ivan Ruchkin

Más de Ivan Ruchkin (20)