Deciding Reachability for 3-DimensionalMulti-Linear Systems This work was supported in part by the “Concept for the Future” of Karlsruhe Institute of Technology within the framework of the German Excellence Initiative.

# Deciding Reachability for 3-Dimensional Multi-Linear Systems 1

## Abstract

This paper deals with the problem of point-to-point reachability in multi-linear systems. These systems consist of a partition of the Euclidean space into a finite number of regions and a constant derivative assigned to each region in the partition, which governs the dynamical behavior of the system within it. The reachability problem for multi-linear systems has been proven to be decidable for the two-dimensional case and undecidable for the dimension three and higher. Multi-linear systems however exhibit certain properties that make them very suitable for topological analysis. We prove that reachability can be decided exactly in the 3-dimensional case when systems satisfy certain conditions. We show with experiments that our approach can be orders of magnitude more efficient than simulation.

## 1 Introduction

During the last decades a lot of devices have been developed that consist of computers interacting with a physical environment. Computers perform discrete operations, while a physical environment has continuous dynamics. Such systems are called hybrid systems. Many of the applications of hybrid systems, such as intelligent highway systems, air traffic management systems and others are safety critical and require the guarantee of a safe operation.

Formally verifying safety properties of hybrid systems consists of building a set of reachable states and checking if this set intersects with a set of unsafe states. Therefore one of the most fundamental problems in the analysis of hybrid systems is the reachability problem.

The reachability problem is known as being difficult. It has been shown to be decidable for special kinds of hybrid automata [2, 8, 10, 11, 12] including timed automata [2], some classes of rectangular hybrid automata [8] and o-minimal hybrid automata [10].

Since only certain kinds of hybrid systems allow for the exact computation of the reachable set, approaches for safety verification include the approximation of reachability analysis and abstraction techniques. But these techniques are easy to fail when applied to large systems since the complexity rises up very quickly with an increase in system size.

One of the drawbacks of approximation and propagation techniques is that too little attention is paid to the geometric properties of the systems under analysis [4]. There are two main approaches in this direction: 1) methods that use topological properties of the plane [13], and 2) techniques based on the existence of integrals and the ability to compute them [6].

In this paper we consider multi-linear systems (ML) also often called piecewise constant derivative systems (PCDs) in the literature. They are a special kind of hybrid system, where the number of dimensions refers to the number of continuous variables. Such systems satisfy the following restrictions: A discrete state is defined by a set of linear constraints and discrete transitions do not change continuous variables. ML systems have been proven to be decidable for the two-dimensional case [13], whereas the results presented in [3] state that such systems are undecidable for the dimension three and higher.

The decidability results for the -dimensional case rely on the existence of a periodic trajectory after a finite number of steps. This property does not hold for higher dimensions. Nevertheless, -dimensional systems also feature some sort of regularity. And, as in the -dimensional case, -dimensional multi-linear systems exhibit certain properties that make them very suitable for topological analysis.

Contribution. We consider a subclass of multi-linear systems, that we call multi-linear -systems. These systems satisfy the following property: If there is a cyclic trajectory, then the the points of each cycle iteration intersecting the same boundary element of a polyhedron lie on a straight line. A straightforward consequence of this assumption is that the distances between the corresponding boundary points of different rounds are proportional (-property). We introduce the notion of a hypercycle, a generalization of a cycle. The infinity criterion for -dimensional case, refer to [13], has an analog in dimensions. We show that the -property holds also for hypercycles, and the reachability can be decided exactly if the derived infinity criterion for dimensions holds for a hypercycle.

We have implemented our approach and compared it with simulation. As soon as our algorithm detects a cycle (or a hypercycle) for which the given infinity criterion holds, the algorithm requires constant number of steps. While the number steps for simulation grows exponentially with the distance between points. Algorithms for computing reachable states are often based on floating point computations that involve rounding errors and the correctness of such algorithms can be violated. Since our algorithm takes significantly less steps, it leads to more exact computations.

A complete version of the paper containing all proofs and the details of the benchmarks is available at [15].

## 2 Multi-Linear Systems

Multi-linear systems consist of a partition of the Euclidean space into a finite number of regions and a constant derivative assigned to each region in the partition. In this section we define these systems in a way similar to [13].

We consider an -dimensional Euclidean space with a metric d and points in it denoted by and . In the following, we specify the position of any point in -dimensional space by three Cartesian coordinates. A linear half space is a set of all point in satisfying , where , is a rational vector and is a rational number. A polyhedron is a subset of obtained by intersecting a finite number of linear half spaces. Since we have a finite number of linear half spaces that divide the complete -dimensional Euclidean space, there are polyhedra that are not bounded from all sides.

###### Definition 2.1 (Polyhedral partition)

Given a finite set of linear half spaces , we say that is a polyhedral partition of by if: , and for distinct .

When it is convenient we will use instead of to denote a polyhedral partition. Given a polyhedral partition , we define the set of its boundary points as

 Bd(P(S))={y∈Rn | ∃(Ax+B⋈0)∈S:Ay+B=0}.

For each polyhedron , we define the set of the boundary points as

 Bd(P)=Bd(P(S))∩P.

Note that, depending on the partition, the set of boundary points of some polyhedra can be empty.

###### Definition 2.2 (Boundary element)

Given a polyhedral partition and a polyhedron , we say that e is a boundary element of if the following holds.

1. , and

2. There is such that if then .

An -dimensional multi-linear system consists of a partitioning of the space into a finite set of polyhedral regions and a constant derivative assigned to each region . We define such systems and a trajectory similar to [13].

###### Definition 2.3 (Multi-linear system)

We define a multi-linear system on as a pair , where is a polyhedral partition of and is a function that assigns a vector to each .

In the following we concentrate on -dimensional multi-linear systems. A simple -dimensional multi-linear system is depicted in Figure 1. The trajectories of such systems are sequences of line segments, where the break points belong to the boundaries of polyhedra. Multi-linear systems are deterministic in a sense that for each initial point there is exactly one corresponding trajectory.

We assume that the assigned derivative vectors of two neighboring polyhedra may not be directed towards the same boundary, since this would lead to Zeno behavior when a system performs infinitely many transitions in a finite period of time.

In the rest of the paper we use the following notations. By we denote the empty sequence. We use to denote the concatenation of sequences and , is a shortcut for the sequence . Given a sequence , we denote by a (possibly infinite) sequence if is repeated at least two times. By we mean that for some sequences and at most one of and is not the empty sequence.

In the following definitions for simplicity and without loss of generality we can assume that a trajectory always starts at a boundary element.

###### Definition 2.4 (Trajectory )

Let be a ML, and be a point.

1. A trajectory starting at is a sequence where for there is such that and for there is no such that . We denote by the set of all trajectories of .

2. A sub-trajectory of , written as , is a finite (possibly empty) sequence . We denote by the set of all sub-trajectories of .

###### Definition 2.5 (Signature of a trajectory)

Let be a ML, and be a point. We assume a trajectory . We say that a sequence of boundary elements is a signature of if for . We denote by the set of signatures of all trajectories of and by the set of signatures of all sub-trajectories of .

###### Definition 2.6 (Simple trajectory)

Let be a ML. We say that is a simple trajectory if for each such that and . We denote by the set of all simple trajectries and by the set of signatures of all simple trajectories of .

For each multi-linear system, the number of polyhedra in the corresponding polyhedral partition is finite. Hence, we conclude that the number of signatures corresponding to the simple trajectories is also finite.

###### Lemma 2.7

For each ML , is a finite set.

The notion of a cycle plays an important role in the next section. Due to the finiteness of the number of polyhedra in the polyhedral partition of each multi-linear system, each trajectory either reaches a region it never leaves or its subtrajectories form cycles of boundary elements.

###### Definition 2.8 (Cycle)

Let be a ML. We say that , a (sub)trajectory of , is a cycle if for . We denote by the set of all cycles of .

Multi-linear systems for the dimension two have a nice property that makes the analysis simpler: Each trajectory has an ultimately periodic structure, i.e. after finite number of steps it forms a cycle in terms of visited boundary elements. This property does not hold for higher dimensions. Therefore, we introduce a notion of a hypercycle. This is a generalization of a cycle in the following sense: a hypercycle contains (several) cycles adjoined by simple trajectories. In each iteration of the hypercycle the number of passes through each cycle may vary but the sequence of visited boundary elements is preserved.

###### Definition 2.9 (Hypercycle)

Let be a multi-linear system. We say that a trajectory is a hypecycle if for , and and at least one of the following holds.

• There is such that ,

• .

We denote by the set of all hypercycles of .

In fact, the notion of a hypercycle can be generalized further by considering cycles of hypercycles. But in this paper we restrict the class of systems under consideration to the systems such that each trajectory is either a cycle or a hypercycle after finite number of steps.

## 3 Deciding Reachability for a Special Class of Multi-Linear Systems

In this section we analyze topological properties of a subclass of multi-linear systems. This subclass is defined by a generalization of properties of -dimensional ML systems.

Namely, we assume that if there is a cyclic trajectory, then the points of each cycle iteration intersecting the same boundary element of a polyhedron lie on a straight line, called the -property. A straightforward consequence of this assumption is that the distances between the corresponding boundary points of different rounds are proportional.

If there is a cyclic trajectory, then the points of each cycle iteration intersecting the same boundary element of a polyhedron not necessarily lie on a straight line. In general case, even the angle between the corresponding line segments is not preserved. Nevertheless, we tend to think that for sufficiently many systems, especially for systems having some symmetry in their description, the trajectories obey the -property.

### 3.1 The Reachability Problem

In the following to be able to perform exact computations, we assume that all coefficients in a system are rationals.

Since a solution of a differential equation is unique for a given initial point in combination with rationality of coefficients, we obtain the following property. Given a multi-linear system and a rational initial point , it is possible to compute the point reachable from after time interval exactly.

###### Definition 3.1 (Reachability problem)

Given a multi-linear system and two points and , the problem of point-to-point reachability is stated as follows: Given two points , is there a trajectory such that .

### 3.2 Reachability for Multi-Linear λ-Systems

Now we define formally a subclass of multi-linear systems we consider.

###### Definition 3.2 (λ-cycle and λ-line)

Let be a ML. Suppose for the following holds.

• where for , there are and such that .

• for , , .

Then we say that is a -cycle. We say that a line is a -line of with respect to if , , .

The notion of -cycle can be extended to a hypercycle. In the following, given two parallel lines and , we denote by the distance between and , i.e. the length of a line segment such that , and .

###### Definition 3.3 (λ-hypercycle)

Let be a ML. Suppose a trajectory is a hypercycle, i.e. for . Let for , , and , , and are -lines for of the corresponding consecutive rounds , , and of . We say that is a -hypercycle if

 db−1db=dbdb+1,

where , .

###### Definition 3.4 (λ-system)

Let be a ML. We say that is a -system if for each the following holds: 1) If is a cycle then is a -cycle. 2) If is a hypercycle then is a -hypercycle.

As the next step, we define computable properties that would allow us to check whether a system is a -system. Lemma 3.5 defines conditions sufficient for a cycle to be a -cycle: As soon as three points of consecutive cycle iterations lie on a straight line, the ratio of the distances between consecutive points of different rounds is preserved.

###### Lemma 3.5

Let be a ML. Suppose for and . Assume that , , are consecutive points of intersection of and e. If for some line L then is a -cycle.

As we see in Lemma 3.6, it is sufficient for the -property to hold for two distinct trajectories going through the same cycle of boundary elements. Then it holds for each cycling trajectory going through the same cycle. Note that it is sufficient to compute for each trajectory whether three points of the consecutive rounds are in one line.

###### Lemma 3.6

Let be a ML. Suppose for a trajectory , . Assume that and are -cycles. Then the following holds.

• is a -cycle.

• , where is a -line of with respect to e for each .

###### Lemma 3.7

Let be a ML. Suppose each is a -cycle. Then each is a -hypercycle.

###### Theorem 3.8

Let be a multi-linear system. Then it is decidable whether is a -system.

• By Lemma 2.7, the set is finite. By Lemmas 3.5, 3.6 and 3.7 it is sufficient to perform the following steps: 1) For each to choose two distinct and such that and . 2) To compute three consecutive points of intersection of and with . 3) To check whether these points are in one line.

We have shown that if each cycle is a -cycle then the given system is a -system. The algorithm to check whether a (hyper)cycle is infinite is presented in the next section and it is an extension of the -dimensional case from [13].

## 4 Algorithm for Point-to-Point Reachability

First we need to introduce some further notations. Let denote the border element such that for some partition and . An edge is given in the form of

 e={v+κ⋅→u|v,→u∈R3;l≤κ≤h:l,h∈R}.

Furthermore, given a cycle , let denote the point reached by the cycle in the th iteration on border element . Then for is the line through the trajectory points on (-line), called a trace in the following.

Algorithm 1 decides for a ML system and a starting point whether a point can be reached by a trajectory through . The algorithm is allowed to perform simulations of , note that can be much larger than as our experiments will show.

While the maximum number of evaluations is not reached, is simulated stepwise until either is reached or a cycle is detected. In our implementation we use the cycle detection algorithm due to Brent [5] which requires system evaluations.2

If a cycle is detected, several cases have to be distinguished:

1. is not part of the cycle.3 If is infinite according to Algorithm 2, will never be reached.

2. for some and hence is element of the cycle. In this case it needs to be checked whether such that . If so then should be in

 {x1b+t⋅−−−→x1bx2b}

for some . For all ,

 ta=a∑i=1λib=1−λib1−λb,

therefore

 ay=log(1−ty(1−λb))log(λb)

is in iff is reached by a cycle iteration. If is not reached by and the cycle is infinite, is never reached by from .

3. is not reached by and the cycle is finite. We calculate the point where is abandoned according to algorithm 3 and continue simulation and cycle detection there.

The infinity test (Algorithm 2) checks for every partition in cycle whether the trace line intersects with some . If a intersection point exists and then must abandon after some number of iterations and therefore can not be infinite. If no intersection occurs or and the convergence point

 x∞b=x1b+∞∑i=1λib⋅−−−→x1bx2b=x1b+11−λb⋅−−−→x1bx2b

lies before on the trace line, is never abandoned. If no partition within the cycle is ever abandoned then is infinite.

For a finite cycle , Algorithm 3 determines the exit point from . Recall that an edge can be represented as . For every the intersection point with the trace line is determined.

The intersection point with the smallest distance to is the exit point to . The number of cycle iterations fully contained in is given by

 nb=⌊log(1−t(1−λb))log(λb)⌋

with point

 xe,b=x1b+1−λnb1−λb⋅−−−→x1bx2b.

Special consideration is given to , refer to Algorithm 3. The overall exit point to cycle can therefore be determined by with .

## 5 Experiments

The experiments were performed on a server with two dual-core 2.8 GHz CPUs and 3 GB main memory under RedHat Linux. We implemented the algorithms in Java using the JAMA library for linear algebra operations [9]. The source code of our implementation is available at [14].

Two sample ML systems were used in our experiments and are depicted in Figure 5 alongside a sample trajectory for each. The details of the examples can be found in [15].

All partitions in are unbounded in the dimension. The plane is divided into four inner partitions and 8 outer ones. In the inner partitions the trajectory \enquoterotates around the center with increasing radius, whereas the radius decreases in the outer partitions. Not all choices of result in a -system. Note that in figure 6 the points of a trace through one border element (depicted in red) lie on one line for 2 projections ( and ), but violate the line criterion for the projection.

System consists of 5 two dimensional polygons and 4 unbounded three dimensional polyhedra. In the unbounded regions the system \enquoterotates around the axis in ever shrinking circles until it reaches . then traverses all two dimensional polygons until it reaches where it is ejected into to the unbounded space again. With each iteration more and more rotations are required in the unbounded space to reach and the trajectory through converges towards the axis. Therefore the system never reaches an infinite simple cycle as illustrated in figure 7.

In placing the initial point at any distance from the inner four partitions results in simulation steps until the inner portion is reached. Our algorithm reduces the complexity to in general, considering even to . Only three cycle iterations are required to calculate for each and determine the exit point of the cycle. Experimental data is shown in table 1 and figure a. We attribute the decrease in running time of our algorithm in the first two iterations to the Java just in time compiler, optimizing code dynamically as it is executed [7]. Thereafter the algorithm exhibits constant execution time as anticipated.

Modifying to so that the rotation radius decreases in the outer partitions as well as in the inner partitions,4 produces a convergence line for all partitions at . Simulation alone may never determine whether is reached, whereas our algorithm requires again three cycle iterations of length at most 12 to determine the reachability of .

ML system exhibits a similar behavior. With each pass through the two dimensional partitions the number of required rotations to reach the axis again increases to infinity. Therefore the reachability of on or close to the convergence line of the system is not feasibly determined by simulation alone. If is reached after hyper cycle iterations, at least simulation steps were required. Our algorithm reduces the complexity to . With improved hyper cycle handling the complexity ought to be further reduced to , since three passes of the simple cycle to reach the axis suffice to determine the convergence line of the hyper cycle. Again, experimental data is shown in table 1 and figure b. The data exhibits the same behavior as for regarding the Java just in time compilation. Due to its position reaches before and therefore requires fewer simulation steps than .

## 6 Conclusions

The complexity of safety critical systems has increased dramatically over last decades. The safety properties of such systems can often not be checked exactly either due to theoretical boundaries or due to too large computational efforts required. One of the drawbacks of recent techniques is that too little attention is paid to the geometric properties of the systems under analysis.

A hybrid system (a hybrid automaton) is a formalism that can be used for modeling safety critical systems. ML systems constitute a rather simple class of hybrid systems but yet they are on the boundary of decidable and undecidable systems.

ML systems have certain properties that make them very suitable for a topological analysis. We have shown that on the one hand there are systems with acyclic behavior, and on the other hand if some properties of -dimensional systems hold in three dimensions then it is possible to answer exactly whether a point is reachable from a point . We have presented a prototype implementation of our approach for solving the reachability problem for a subclass of multi-linear systems which we have called -systems. We compared our approach with simulation. The results suggest, that using geometrical properties of the systems can lead to orders of magnitude more efficient techniques than simulation. As soon as our algorithm detects a cycle (or a hypercycle) for which the infinity criterion holds, the algorithm requires constant number of steps. While the number steps for simulation grows exponentially with the distance between points. Also our algorithm can lead to more exact computations because of less rounding errors during the computation.

### Footnotes

1. thanks: This work was supported in part by the “Concept for the Future” of Karlsruhe Institute of Technology within the framework of the German Excellence Initiative.
2. denoting the first occurrence of the cycle, indicating the cycle length.
3. is the border element reached from by simulating , see algorithm 1 step 1.
4. Specifically setting to .

### References

1. R. Alur & D. L. Dill (1994): A Theory of Timed Automata. Theor. Comput. Sci. 126(2), pp. 183–235, doi:http://dx.doi.org/10.1016/0304-3975(94)90010-8.
2. E. Asarin, O. Maler & A. Pnueli (1995): Reachability Analysis of Dynamical Systems Having Piecewise-Constant Derivatives. Theor. Comput. Sci. 138(1), pp. 35–65, doi:http://dx.doi.org/10.1016/0304-3975(94)00228-B.
3. E. Asarin, G. Schneider & S. Yovine (2007): Algorithmic analysis of polygonal hybrid systems, part I: Reachability. Theor. Comput. Sci. 379(1-2), pp. 231–265, doi:http://dx.doi.org/10.1016/j.tcs.2007.03.055.
4. R. P. Brent (1980): An improved Monte Carlo factorization algorithm. BIT Numerical Mathematics 20, pp. 176–184, doi:http://dx.doi.org/10.1007/BF01933190. 10.1007/BF01933190.
5. M. Broucke (1999): A geometric approach to bisimulation and verification of hybrid systems. In: Hybrid Systems: Computation and Control, volume 1569 of Lecture Notes in Computer Science. Springer-Verlag, pp. 61–75, doi:http://dx.doi.org/10.1007/3-540-48983-5˙9.
6. T. Cramer, R. Friedman, T. Miller, D. Seberger, R. Wilson & M. Wolczko (1997): Compiling Java just in time. Micro, IEEE 17(3), pp. 36–43, doi:http://dx.doi.org/10.1109/40.591653.
7. T. A. Henzinger, P. W. Kopke, A. Puri & P. Varaiya (1995): What’s decidable about hybrid automata? In: STOC. pp. 373–382, doi:http://dx.doi.org/10.1145/225058.225162.
8. J. Hicklin, C. Moler, P. Webb, R.F. Boisvert, B. Miller, R. Pozo & K. Remington (2000): Jama: A Java matrix package. Website. Available at http://math.nist.gov/javanumerics/jama.
9. G. Lafferriere, G. J. Pappas & S. Sastry (2000): O-Minimal Hybrid Systems. Math. Control Signals Systems 13, pp. 1–21, doi:http://dx.doi.org/10.1007/PL00009858.
10. G. Lafferriere, G. J. Pappas & S. Yovine (1999): A New Class of Decidable Hybrid Systems. In: HSCC. pp. 137–151, doi:http://dx.doi.org/10.1007/3-540-48983-5˙15.
11. G. Lafferriere, G.J. Pappas & S. Yovine (1999): Reachability Computation For Linear Hybrid Systems. In: Proceedings of the 14th IFAC World Congress. E, pp. 7–12.
12. O. Maler & A. Pnueli (1993): Reachability Analysis of Planar Multi-linear Systems. In: CAV. pp. 194–209, doi:http://dx.doi.org/10.1007/3-540-56922-7˙17.
13. O. Tveretina & D. Funke (2011): 3-Dimensional Multi-Linear Systems. Website.
14. O. Tveretina & D. Funke (2011): Deciding Reachability for a Subclass of 3-Dimensional Multi-Linear Systems. Technical Report 2011-19, Karlsruhe Institute of Technology.
100915
0