Search arXiv⌕ Search
Home/Archive/arXiv

arXiv · 2503.11916

Formally Proving Invariant Systemic Properties of Control Programs Using Ghost Code and Integral Quadratic Constraints

Elias Khalife·Pierre-Loic Garoche·Mazen Farhood
View original source ↗Read source document ↗Export metadata ↓

Abstract

This paper focuses on formally verifying invariant properties of control programs both at the model and code levels. The physical process is described by an uncertain discrete-time state-space system, where the dependence of the state-space matrix-valued functions defining the system on the uncertainties can be rational. The proposed approaches make use of pointwise integral quadratic constraints (IQCs) to characterize the uncertainties affecting the behavior of the system. Various uncertainties can be characterized by pointwise IQCs, including static linear time-varying perturbations and sector-bounded nonlinearities. Using the IQC framework, a sound overapproximation of the uncertain system, which is expressible at the code level, is constructed. Tools such as Frama-C, ACSL, WP, and an Alt-Ergo plugin are employed to ensure the validity of the state and output invariant properties across both real and float models. The first proposed approach can be used to formally verify (local) invariant properties of the control code. This capability is demonstrated in a couple of examples involving gain-scheduled path-following controllers designed for an uncrewed aircraft system and an autonomous underwater vehicle. The second approach enables the verification of closed-loop invariant properties, i.e., invariant properties of the controlled system as a whole, in both real and float models, while preserving the integrity of the executable controller code. This is achieved by using ghost code attached to the control code for all elements related to the plant model with uncertainties, as the ghost code does not interfere with the executable code. The effectiveness of this approach is demonstrated in two examples on the control of a four-thruster hovercraft and the control of a two-mass rotational system.

Explore related subjects

eess.SYcs.SYmath.OC

Keep this discovery

Explore connections, maps & timelines

BibTeXRIS

Elias Khalife, Pierre-Loic Garoche, Mazen Farhood. 2025-03-14. Formally Proving Invariant Systemic Properties of Control Programs Using Ghost Code and Integral Quadratic Constraints. https://arxiv.org/abs/2503.11916

Cite the original work for its findings. Save a collection to share your selection of sources.

KEEP EXPLORING

Related papers

arXiv2026

Failure-Aware Iterative Learning of State-Control Invariant Sets

In this paper, we address the problem of computing maximal state-control invariant sets for deterministic linear systems using failing trajectories. We introduce the concept of state-control invariance, which extends control invariance from the state space to the joint state-control space. The maximal state-control invariant (MSCI) set simultaneously encodes the maximal control invariant set (MCI) and, for each state in the MCI, the set of control inputs that preserve invariance. We prove that the state projection of the MSCI is the MCI and the state-dependent sections of the MSCI are the admissible invariance-preserving inputs. Building on this framework, we develop a Failure-Aware Iterative Learning (FAIL) algorithm for deterministic linear time-invariant systems with polytopic constraints. The algorithm iteratively updates a constraint set in the state-control space by learning predecessor halfspaces from one-step failing state-input pairs, without knowing the dynamics. For each failure, FAIL learns the violated halfspaces of the predecessor of the constraint set by a regression on failing trajectories. We prove that the learned constraint set converges monotonically to the MSCI. Numerical experiments on a double integrator system validate the proposed approach.

eess.SY↗
arXiv2026

Consensus and Synchronization of Multi-agent Systems over Finite Fields - Graph Topologies

This paper presents cooperative protocols for multi-agent systems with agents having a finite state-space. Both scalar single-integrator consensus and general LTI system synchronization are considered. Systems having a finite state-space describe agents with minimal memory capacity processing only a finite alphabet. Such systems are remarkably resilient to communication noise. The crucial problem, however, is to construct the admissible communication topology, which is NP-hard. We address this by efficiently exploring the subsets of admissible graph matrices and propose two new algorithms to generate them. Simulations validate the proposed approach.

eess.SY↗
arXiv2026

Extracting Exact Lie Derivatives Without Backpropagation: A Dual Compiler for Neural Control Barrier Functions

A safety filter based on a neural control barrier function (CBF) deployed in an embedded control loop evaluates, at each control cycle, the trained network and its Lie derivatives along the system vector fields, under the memory and worst-case execution time (WCET) constraints that safety-oriented coding standards impose. Reverse-mode automatic differentiation, by which training frameworks obtain these derivatives, retains an activation cache whose size grows with the sum of the layer widths, and general-purpose differentiation runtimes allocate the computational graph from the heap at each call. This paper presents a compiler that evaluates a neural CBF and its exact Lie derivatives by forward-mode dual-number arithmetic. The compiler emits self-contained C++ code in which a single forward pass, without backpropagation, returns the barrier value and its exact Lie derivative along a given vector field; the drift and input Lie derivatives of the safety constraint are obtained from one such pass per vector field, and a second-order extension based on hyper-dual numbers returns the exact second-order Lie derivatives required by CBFs of relative degree two. The dual forward pass requires a workspace bounded by four times the widest layer, independent of network depth, and the emitted code contains no allocation call sites, so the absence of dynamic allocation is verifiable by inspection of the code. On an ESP32-S3 microcontroller, the compiled filter assembles the complete safety constraint in under one millisecond from statically allocated buffers of at most 768 bytes, and the maximum execution time over 1000 evaluations lies within 5% of the median in all three examples, whereas a heap-allocating reverse-mode baseline shows maxima 33% and 70% above its median in the two first-order examples. The compiler and the embedded experiments are released as open-source software.

eess.SY↗