Formally Proving Invariant Systemic Properties of Control Programs Using Ghost Code and Integral Quadratic Constraints

This paper focuses on formally verifying invariant properties of control programs both at the model and code levels. The physical process is described by an uncertain discrete-time state-space system, where the dependence of the state-space matrix-valued functions defining the system on the uncertainties can be rational. The proposed approaches make use of pointwise integral quadratic constraints (IQCs) to characterize the uncertainties affecting the behavior of the system. Various uncertainties can be characterized by pointwise IQCs, including static linear time-varying perturbations and sector-bounded nonlinearities. Using the IQC framework, a sound overapproximation of the uncertain system, which is expressible at the code level, is constructed. Tools such as Frama-C, ACSL, WP, and an Alt-Ergo plugin are employed to ensure the validity of the state and output invariant properties across both real and float models. The first proposed approach can be used to formally verify (local) invariant properties of the control code. This capability is demonstrated in a couple of examples involving gain-scheduled path-following controllers designed for an uncrewed aircraft system and an autonomous underwater vehicle. The second approach enables the verification of closed-loop invariant properties, i.e., invariant properties of the controlled system as a whole, in both real and float models, while preserving the integrity of the executable controller code. This is achieved by using ghost code attached to the control code for all elements related to the plant model with uncertainties, as the ghost code does not interfere with the executable code. The effectiveness of this approach is demonstrated in two examples on the control of a four-thruster hovercraft and the control of a two-mass rotational system.