A Reachability Method for Verifying Dynamical Systems with Deep Neural Network Controllers

TL;DR

This paper introduces a reachability-based verification method for neural network controllers in dynamical systems, ensuring safety over multiple steps by over-approximating reachable states using verification tools.

Contribution

It combines reachability analysis with neural network verification to provide formal safety guarantees for neural network controllers in dynamical systems.

Findings

Successfully verified neural network controllers for mountain car and aircraft collision avoidance.

Provided formal guarantees that the system states remain within safe bounds.

Demonstrated the method's effectiveness in complex, real-world scenarios.

Abstract

Deep neural networks can be trained to be efficient and effective controllers for dynamical systems; however, the mechanics of deep neural networks are complex and difficult to guarantee. This work presents a general approach for providing guarantees for deep neural network controllers over multiple time steps using a combination of reachability methods and open source neural network verification tools. By bounding the system dynamics and neural network outputs, the set of reachable states can be over-approximated to provide a guarantee that the system will never reach states outside the set. The method is demonstrated on the mountain car problem as well as an aircraft collision avoidance problem. Results show that this approach can provide neural network guarantees given a bounded dynamic model.

Tables

Table 1. TABLE I: Mountain car neural network approximation results

Method	Num. Actions	Runtime (s)	Complete
Sampling	344126	172.9	No
ReluVal	344127	72.99	Yes
Reluplex	344130	57360	Yes

Equations

$$R_S=\{g(s,a):s\in S,a\in {\mathcal{A}}_S\}$$

$${\mathcal{R}}_{t+1}^{s_i}=\{S:S\in {\mathcal{S}}_N,S\cap R_{S_i}\ne \varnothing \}$$

$${\mathcal{R}}_{t+1}=\bigcup _{S_i\in {\mathcal{R}}_t}{\mathcal{R}}_{t+1}^{S_i}$$

$$\left[\begin{array}{c}p\\ v\end{array}\right]\leftarrow \left[\begin{array}{c}p+v\\ v+0.0015(u+{\delta }_u)-0.0025\cos (3p)\end{array}\right]$$

$$Q_{t+1}(s,a)=r(s,a)+\underset{a^{\prime }}{\max }\sum _{s^{\prime }}T(s,a,s^{\prime })Q_t(s^{\prime },a^{\prime })$$

$$\cos (3p)\in \left[c{p}_{\text{min}},c{p}_{\text{max}}\right]$$

$$c{p}_{\text{min}}$$

$$c{p}_{\text{max}}$$

$$p^{\prime }$$

$$v^{\prime }$$

$$v^{\prime }-p^{\prime }$$

$$\left[\begin{array}{c}h\\ {\dot{h}}_0\\ \tau \\ s_{\text{adv}}\end{array}\right]\leftarrow \left[\begin{array}{c}h-{\dot{h}}_0\Delta t-0.5{\ddot{h}}_0\Delta t^2\\ {\dot{h}}_0+{\ddot{h}}_0\Delta t\\ \tau -\Delta t\\ s_{\text{adv}}^{\prime }\end{array}\right]$$

Full text

I Introduction

Neural networks are global function approximators that can efficiently and accurately represent any target domain. In recent years, neural networks have become widely used for decision making and control in dynamical systems such as pendulums [1], video games [2], autonomous vehicles [3], and aircraft collision avoidance systems [4]. Neural network controllers can be generated in many ways, including supervised learning to compress existing controllers [5], Neural Fitted Q Iteration [1], and deep Q-learning [2].

In some domains, neural network controllers can make decisions better than human experts, but guarantees about their performance are difficult to prove, inhibiting their use in safety-critical systems. Whereas traditional model checking techniques may be sufficient to verify logic-based controllers [6], new verification techniques are required to ensure that complex and non-linear neural network controllers will always generate safe trajectories.

Recent advancements in neural network verification tools have yielded many options for proving bounds on neural network outputs [7]. Given some region of the input space, these verification tools define what values could be given by the neural network and provide either a guarantee of a correct output or a counterexample. Some tools work layer by layer through the network to compute a reachable set of each layer, ending with the reachable output of the network given the input region [8, 9]. Other tools formulate neural network verification as a mixed-integer linear programming and use optimization methods to find counterexamples [10, 11]. Tools such as Reluplex [12] and Sherlock [13] convert neural networks into linear programs and systematically search for a satisfying counterexample. While these tools ensure that input regions satisfy some network output property for a single evaluation, ensuring safety for multiple network evaluations over time remains difficult due to system dynamics and uncertainties.

Recent work involved developing methods for the verification of neural network controllers for agents acting in an environment. These methods use a reachability approach that computes the set of states the system can reach given an initial set of states and a controller. [14] formulate neural agents and their dynamics as a large mixed-integer linear program, which can be solved to verify the agent’s safety. This method requires linearly-definable dynamics, but non-linear dynamics can be approximated by a neural network with arbitrary precision. [15] formulate sigmoid-activated neural networks with one hidden layer as a hybrid system to compute reachability sets over time. [16] train neural networks to output the next state in a nonlinear system instead of a control input. They compute an over-approximation of the reachable set at each time step to bound the trajectories of state variables.

In addition, [17] bound the neural network output over small hyper-rectangular input sets and use reachability tools for linear systems to compute reachable sets for a trajectory.

This work builds upon prior work and uses a general reachability algorithm for an agent controlled by a neural network. Whereas many previous approaches combine the neural network controller output with a dynamics model, we separate the two components and analyzes each individually. Our method is applicable to any network architecture or activation function, and any existing neural network verification tool can be used. Furthermore, by analyzing the dynamics separately, our method can consider complex actions that are not well represented by linear models. While [17] demonstrate their approach on continuous-time linear control systems, our experiments use discrete control actions. Additionally, our work considers the degree of uncertainty that can be present in the system dynamics before safety can no longer be guaranteed, allowing us to make claims about how a real system with errors will be able to maintain safety. A mountain car example is provided to illustrate the approach on a classic problem. In addition, an aircraft collision avoidance problem inspired by the next-generation system ACAS X [18] demonstrates how the approach can handle complex and real-world systems. Our experimental results provide performance and safety guarantees from any initial starting point in the full input space.

II Approach

This section describes the reachability method used to provide guarantees about neural network controlled systems. First, the neural network is over-approximated in order to bound the outputs given in different regions of the state space. Then a general reachability method is formulated that uses the network bounds to over-approximate the system’s set of reachable states, which provides a guarantee that states outside the set cannot be achieved. If unsafe states lie entirely outside the reachable set, then the system is safe.

II-A Neural Network Over-approximation

Neural network controllers give control actions $a=f(s)$ for states $s\in\mathcal{S}$, where $\mathcal{S}$ is the controller state space. Because the neural network function can be highly nonlinear, predicting the neural network output can be difficult. However, many tools have been developed recently to verify neural networks, which can bound the behavior of neural networks. For a small set of states $S\subset S$, tools such as Reluplex [12], Sherlock [13], Reluval [19], and Verisig [15] can be used to guarantee that $f(s)\in\mathcal{A}_{S}\;\forall\;s\in S$, where $\mathcal{A}_{S}$ is a bound on the neural network output in set $S$. For neural networks with discrete outputs, $\mathcal{A}_{S}$ represents the set of all discrete actions that could be chosen by the neural network for some point in $S$. For neural networks with $n$ continuous control outputs, $\mathcal{A}_{S}$ represents some $n$-dimensional polytope. If $\mathcal{S}$ is divided into $N$ small subsets, or cells, then $\mathcal{A}=\{\mathcal{A}_{S_{1}},\mathcal{A}_{S_{2}},\dots,\mathcal{A}_{S_{N}}\}$ bounds the neural network output. By assuming that the neural network can give any action $a\in\mathcal{A}_{S}$ from any point $s\in S$, the neural network controller is over-approximated.

II-B Reachability Method

Let $\mathcal{S}_{N}=\{S_{1},S_{2},\dots,S_{N}\}$ be the set of all $N$ cells that divide $\mathcal{S}$, and define $\mathcal{R}_{t}\subseteq\mathcal{S}_{N}$ to be the set of cells reachable at time $t$. The initial reachable set $\mathcal{R}_{0}$ is problem specific and can include all or some specific subset of $\mathcal{S}_{N}$. The reachability method iteratively computes $\mathcal{R}_{t+1}$ given $\mathcal{R}_{t}$ and $\mathcal{A}$. To compute $\mathcal{R}_{t+1}$, first compute the region of state space $R_{S}\subseteq\mathcal{S}$ that can be reached at the next time step from $S$ with control inputs from $\mathcal{A}_{S}$. With system dynamics $g(s,a)$ for state $s$ and control input $a$, $R_{S}$ can be defined as

[TABLE]

In general, there may be uncertainty surrounding $g(s,a)$. Factors such as modeling errors, disturbances, or human error may cause the dynamics of real systems to differ from ideal equations. This work considers these errors to obtain safety guarantees considering some level of error in $g(s,a)$. One way to incorporate these errors is to expand $R_{S}$ to include all states that could be reached with error in the dynamics.

Next, the set of cells that could be reached from cell $S_{i}\in\mathcal{R}_{t}$ is calculated as

[TABLE]

Equation 2 over-approximates $R_{S}$ by including all cells that have some intersection with $R_{S}$. Lastly, the set of cells reachable at the next time step from any cell in $\mathcal{R}_{t}$ is

[TABLE]

Algorithm 1 outlines the steps for this method.

Because the neural network and system dynamics are over-approximated, this method will over-approximate the reachable set at each time step. As a result, all states outside the reachable set at time $t$ are impossible to reach from the initial set of states. If the reachable set is contained within a goal set or excludes a failure set, then this method verifies that the neural network controller will be safe at time $t$.

II-C Implementation Considerations

Although the proposed method can verify neural network controllers, its implementation may raise a few concerns. First, neural network verification tools can be slow, so checking each discrete cell may seem slow especially as the number of cells grows. However, many neural network verification tools run faster as input bounds become tighter, so checking many small regions may not be slower than checking fewer large regions. Furthermore, computing $R_{S}$ becomes more complicated with higher-dimensional state spaces. In two dimensions with linear dynamics and rectangular cells, computing $R_{S}$ is straightforward, but more complicated dynamic models for higher-dimensional spaces can prove challenging. Fortunately many tools exist to perform reachability over-approximations for complex problems, such as SpaceEx, which uses lazy set computation with Zonotopes for efficient computation with hundreds of state variables [20]. Another tool, JuliaReach, uses the high performance Julia language to compute reachable sets assuming convex sets and currently supports linear dynamics [21]. These tools provide efficient methods for reachable set estimation that can be used to enable this approach for complex neural network systems.

Additionally, if a cell $S\in\mathcal{R}_{t}$ is also in $\mathcal{R}_{t+1}$ given control inputs $\mathcal{A}_{S}$, then $S$ will remain in all future reachable sets, which could be problematic if $S$ is in an undesirable area of the state space. This problem can be caused by over-approximation errors, which can be improved by shrinking the cells. However, making cells smaller can quickly lead to an explosion in the number of cells to consider, especially at higher dimensions. It is important to reduce cell size in critical areas of the state space without generating so many cells that reachability computation becomes too slow.

III Mountain Car Example

To demonstrate the approach, we consider the classic mountain car problem depicted in Figure 1, where a one-dimensional car must climb to the top of a hill [23]. However, the car’s acceleration cannot overcome gravity, so the car must rock between two hills to gain enough momentum to reach the top of the hill. The system has two state variables, position $p$ and velocity $v$, and one control input, $u$. We consider the same dynamic model as used by [15] but with uniformly distributed random disturbance $\delta_{u}\sim\mathcal{U}(-w,w)$ added to the control input, where $w$ is the maximum disturbance. The state variables are updated as

[TABLE]

This formulation uses discrete actions, $u\in\{-1,0,1\}$, instead of continuous values. The range of positions and velocities is $p\in[-1.2,0.6]$ and $v\in[-0.07,0.07]$ respectively, and the goal of the car is to reach $p=0.6$ as quickly as possible.

III-A Neural Network Controller

This section presents a method for generating neural network controllers, though there are many other methods that could be used with this reachability approach. To generate a neural network controller, the problem was first solved as a discrete Markov decision process using POMDPs.jl [24]. In a Markov decision process, an agent in state $s\in\mathcal{S}$ takes action $a\in\mathcal{A}$, receives reward $r(s,a)$, and transitions to a new state $s^{\prime}$ with probability $T(s,a,s^{\prime})$, where $T$ is the transition function [25]. Discrete value iteration was used to compute policy $\pi$ that maximizes the accumulation of reward overtime. In discrete value iteration, $Q$-values are associated with each state-action pair, with initial $Q_{0}(s,a)=0$. The $Q$-values are updated according to the finite-horizon Bellman equation as

[TABLE]

After the $Q$-values converge, the policy is computed as $\pi(s)=\arg\max_{a}Q(s,a)$. For the mountain car problem, $s=(p,v)$, $\mathcal{S}$ is the Cartesian product of 100 uniformly distributed positions and velocities, $a=u$, $r(s,a)=-\mathds{1}(p<0.6)$, and $T(s^{\prime},a,s)$ has $1/3$ probability for each of the next states calculated with $\delta_{u}$ as -0.5, 0.0, and 0.5, which encourages the computed policy to be robust to noisy accelerations. Multilinear interpolation is used to compute the $Q(s^{\prime},a^{\prime})$ when $s^{\prime}$ does not fall on one of the points in the grid.

After computing the $Q$-values for the optimal policy, a neural network is trained through supervised learning to approximate the $Q$-values. The neural network has an input variable for each state dimension and an output variable associated with each action. An asymmetric loss function that penalizes under-valuing the optimal action or over-valuing the suboptimal actions was used, which encourages the network to approximate both the $Q$-values and policy well [4]. For the mountain car problem, the neural network uses ReLU activations and has five hidden layers of 30 units each. The neural network was trained for 1000 epochs using Adamax optimization [26], and the trained network predicts actions with 97.80% accuracy and an average absolute error of 5.69. The the policy of the trained network is shown in Figure 2, which shows that the neural network does not recommend $u=0$ actions often if at all.

III-B *

State Space Discretization *

The discretization of the input space into cells has a significant impact on the performance of this algorithm. First, a larger number smaller cells requires checking more queries to with neural network verification tools, which may increase computation time to approximate the neural network controller. In addition, using larger numbers of cells will increase the amount of computation required to compute reachable sets. However, larger cells lead to more over-approximation errors, which can prevent the algorithm from proving the desired closed-loop property. For the mountain car problem, we wish to show that all initial starting conditions will reach the goal. If over-approximation errors result in a cell being in its reachable set at the next time step, then we cannot prove that the controller will move the car away from the cell and towards the goal. Therefore, if a cell is within its reachable set, the cell should be divided until it is no longer a member of its reachable set.

Selecting a good state space discretization is important for many reachability algorithms. One method for discretization uses a tree representation and refines leaf nodes as needed [27]. Similarly, we iteratively refined the grid when cells were computed to be in their own reachable set. Figure 3 shows a heat map of the final discretization used for the mountain car problem, where the value at each pixel corresponds to the number of grid cells within a small region around the pixel. The discretization is uniform in most locations, but a few key areas are more heavily discretized. First, regions with low magnitude velocity are more heavily discretized because the position does not change much when velocity is small. In addition, the region around $p=-0.45$ is refined because this location is the bottom of the hill where the $\cos(3p)$ gravity term is small. Lastly, the region around $p=0.4$ is refined. In this region, selecting the action to move right has just enough power to overcome the gravity term, resulting in a slow climb up the hill. However, if this region is not finely discretized, then over-approximation errors would show the car getting stuck on the side of the hill if the right action is chosen. The final state space discretization contains 341523 hyper-rectangular cells.

III-C Neural Network Approximation

Three methods were used to approximate the neural network policy as described in Section II-A: 100 random samples, Reluplex [12], and ReluVal [19].

Reluplex is an SMT solver that extends the simplex method to handle ReLU activations and check if a set of input variables in the input region can satisfy an output constraint [12].

ReluVal uses symbolic interval analysis and iteratively tightens the bound until the output property is verified or a counterexample is found [19].

To use Reluplex and ReluVal, the property we want to hold must be negated and checked for a counterexample. For a discrete action neural network, the action associated with the highest network output value is used. Therefore, to check if an action is given, the output constraint is that the value of the target action must be less than the value of all other actions. If a counterexample is found, then there exists a point in the input set where the target action is given. Otherwise, if the solvers return UNSAT, then we are guaranteed the target action is not given within the input region. For every input region to be checked, we target each possible action to see if that action could be given by the neural network.

Table I reports the results where the number of actions is the sum of the number of actions found in all cells, and the run time reported uses a single CPU, though all methods are easily parallelized to decrease runtime. The sampling method misses an action in one of the cells, and Reluplex finds three spurious actions that occur very close to the cell but outside the cell boundaries. Decreasing the boundary error tolerance removes these spurious actions. ReluVal identifies all actions given within each cell and performs faster than both Reluplex and sampling approaches.

III-D Reachability Results

First, we need to compute bounds on the reachable set of next states $R_{S}$ from a given set of initial states $S$. For a given hyper-rectangular initial set, the input variables are bounded by $p\in[p_{\text{min}},p_{\text{max}}]$ and $v\in[v_{\text{min}},v_{\text{max}}]$, and the disturbance term is bounded by $\delta_{u}\in[-w,w]$. Although the dynamics include a nonlinear $\cos(3p)$ term, we can bound the function as

[TABLE]

where

[TABLE]

As a result, we can compute minimum and maximum bounds for the state variables at the next time step $(p^{\prime},v^{\prime})$ as

[TABLE]

Lastly, by subtracting $p^{\prime}$ from $v^{\prime}$, we get $v^{\prime}-p^{\prime}=-p-0.0025\cos(3p)+0.0015(u+\delta_{u})$. We can bound this term as

[TABLE]

Using these six inequalities, we can compute a convex polygon that contains all possible variables at the next time step from some initial set. Figure 5 shows an example with $w=0.5$ and $u=1.0$. In addition, 500 random points are initially sampled from the input region and updated with the mountain car dynamics. All 500 points are bounded by the convex polygon $R_{S}$. Then, $\mathcal{R}^{S}$ is derived as the set of cells in the state space that overlap with $R_{S}$.

Initially, the car could be in any state, so $\mathcal{R}_{0}=\mathcal{S}_{N}$. For each cell in $\mathcal{R}_{0}$, the set of cells that could be reached at the next time step is computed as illustrated in Figure 5, and $\mathcal{R}_{1}$ is computed as the union of reachable cells for any of the cells’ possible actions. Figure 4 shows the evolution of over-approximated reachable set over time using the neural network controller. Over time the reachable set diminishes to include only states where $p=0.6$, which proves that the car will always reach the goal when using the neural network controller regardless of initial condition. The runtime required to evolve reachable sets is on the order of a couple seconds, much faster than the time required to over-approximate the neural network controller.

Reachable sets were also computed with different levels of dynamic disturbance to study how errors in the dynamics effect verification. The reachability method was compared to two Monte Carlo simulations that use worst-case and random disturbances. The worst-case disturbance is $\delta_{u}=-\text{sign}(u)w$ so that the disturbance always opposes the car’s acceleration, while random disturbances are sampled from $\mathcal{U}(-w,w)$ at each time step. For both Monte Carlo methods, 10000 simulations from random starting locations were evaluated, and the maximum number of time steps to reach the goal state was recorded. Figure 6 summarizes the results and shows that the reachability method guarantees that the car will reach the goal up to disturbance level $w=0.25$; however, worst-case Monte Carlo simulations show that the car will reach the goal for $w\leq 0.5$. Over-approximation errors contribute to the size of the gap between the two approaches, and decreasing the cell sizes to reduce over-approximation error could decrease this gap. Random Monte Carlo simulations show no difference for different levels of disturbances. Since the disturbance distribution has zero mean, the disturbance has no effect in expectation. Verifying safety in critical systems means ensuring failures do not occur even with low probability, which requires firm bounds on dynamic uncertainties to prevent large disturbances from having non-zero probability.

IV Aircraft Collision Avoidance System Example

The second example considers commercial aircraft, which are required to operate with a collision avoidance system that gives vertical climbrate advisories to pilots to prevent near midair collisions (NMACs). An NMAC occurs when the aircraft are separated by less than $100\text{\,}\mathrm{ft}\text{/}$ vertically and $500\text{\,}\mathrm{ft}\text{/}$ horizontally. An aircraft collision avoidance system called ACAS X uses $Q$-values to represent much of the decision making logic [18]. It uses a large table of state-action $Q$-values to make decisions, but [4] explored compressing the table using a neural network. This section presents a notional example based loosely on an early prototype of ACAS X [18].

IV-A System Description

The example collision avoidance system, referred to as VerticalCAS, considers two aircraft: an ownship aircraft equipped with VerticalCAS, and an intruder aircraft. In this formulation, the intruder is assumed to maintain level flight, but future work can relax this assumption. The system uses four variables to describe the encounter with the intruder aircraft:

$h$ ($\mathrm{ft}\text{/}$): Intruder altitude relative to ownship $[-3000,3000]$ 2. 2.

$\dot{h}_{0}$ ($\mathrm{ft}\text{/}\mathrm{min}$): Ownship vertical climbrate $[-2500,2500]$ 3. 3.

$\tau$ ($\mathrm{s}\text{/}$): Time to loss of horizontal separation $[0,40]$ 4. 4.

$s_{\text{adv}}$: Previous advisory from VerticalCAS

The first two state variables describe the encounter geometry vertically. The $\tau$ variable condenses the horizontal geometry into a single variable by providing a countdown until the intruder will no longer be separated horizontally, at which point the ownship must be vertically separated to avoid an NMAC. These geometric variables are depicted in Figure 7.

The $s_{\text{adv}}$ variable is categorical and can be any one of the nine possible advisories given by the system, and conditioning the next advisory on the current advisory allows the system to maintain consistency when alerting pilots. The nine possible advisories are

COC: Clear of Conflict 2. 2.

DNC: Do Not Climb 3. 3.

DND: Do Not Descent 4. 4.

DES1500: Descend at least $1500\text{\,}\mathrm{ft}\text{/}\mathrm{min}$ 5. 5.

CL1500: Climb at least $1500\text{\,}\mathrm{ft}\text{/}\mathrm{min}$ 6. 6.

SDES1500: Strengthen Descent to at least $1500\text{\,}\mathrm{ft}\text{/}\mathrm{min}$ 7. 7.

SCL1500: Strengthen Climb to at least $1500\text{\,}\mathrm{ft}\text{/}\mathrm{min}$ 8. 8.

SDES2500: Strengthen Descent to at least $2500\text{\,}\mathrm{ft}\text{/}\mathrm{min}$ 9. 9.

SCL2500: Strengthen Climb to at least $2500\text{\,}\mathrm{ft}\text{/}\mathrm{min}$

Each advisory instructs the pilot to accelerate until complying with the specified climb or descent rate, except for COC, which allows the pilot freedom to choose any acceleration $\ddot{h}_{0}\in[-g/8,g/8]$, where $g$ is the sea-level gravitational acceleration constant, $32.2\text{\,}\mathrm{ft}\text{/}{\mathrm{s}}^{2}$. For advisories DNC, DND, DES1500, and CL1500, the pilot is assumed to accelerate in the range $|a|\in[g/4,g/3]$ with the sign of $\ddot{h}_{0}$ determined by the specific advisory. If the pilot is already compliant with the given advisory, then the pilot is assumed to continue at the current climbrate. For advisories SDES1500, SCL1500, SDES2500, and SCL2500, the pilot as assumed to accelerate at $\pm g/3$ until compliance. For example, a pilot receiving the CL1500 advisory while descending at $-500\text{\,}\mathrm{ft}\text{/}\mathrm{min}$ is assumed to begin accelerating upwards with some acceleration between $g/4$ and $g/3$ and then maintaining a constant climbrate upon reaching the $1500\text{\,}\mathrm{ft}\text{/}\mathrm{min}$ climbrate.

New advisories $s^{\prime}_{\text{adv}}$ are given once each second ($\Delta t=1$), and the state variables are updated as

[TABLE]

The reward structure contains penalties for NMACs at $\tau=$0\text{,}\mathrm{s}\text{/}$$, giving non-COC advisories, and reversing/strengthening an advisory. Advisories that transition from a previous weak advisory like COC or DNC to a strong advisory like SCL1500 or SDES2500 are also penalized. The reward structure contains many terms, and Kochenderfer describes in greater detail the reward function used here [18]. This problem was optimized using discrete value iteration and compressed with a neural network in the same was as described in  Section III-A. Since $s_{\text{adv}}$ is discrete, nine separate networks were trained, one for each $s_{\text{adv}}$. Each network has three inputs for the three geometric state variables, five ReLU-activated hidden layers of 20 units each, and nine outputs representing the score of each of the nine advisories. VerticalCAS recommends the highest scoring action to the pilot. An example policy plot is shown in Figure 9, which shows that the system tends to strengthen the previous advisory in order to avoid collisions. However, if the intruder is well below the aircraft, then descending could result in an NMAC, so the system reverses the advisory and strengthens to SCL1500.

IV-B Reachability Results

To define $\mathcal{S}_{N}$, we first note that $s_{\text{adv}}$ is discrete with nine values, and $\tau$ acts independently and can be discretized to $\{0,1,\dots,40\}$. The remaining variables, $h$ and $\dot{h}_{0}$, are continuous and need to be discretized to define cells. Because we are interested in the NMAC region where $|h|\leq$100\text{,}\mathrm{ft}\text{/}$$, low magnitude $h$ values were more finely discretized to limit over-approximation errors in that region of the state space. The final discretization used 231 points for $h$ and 44 for $\dot{h}_{0}$, resulting in 3.65 million discrete cells. Reluplex was used to approximate the neural networks, generating 32.8 million queries in order to check for each of the nine advisories in all discrete cells. Reluplex took 175 CPU-hours to complete, an order of magnitude longer than for the mountain car example.

After approximating the neural networks, the reachable sets can be computed. The reachable region $R_{S}$ was over-approximated by computing the minimum and maximum $h$ and $\dot{h}_{0}$ values achievable from cell $s$ given the acceleration constraints. The initial reachable set is all cells at $\tau=$40\text{,}\mathrm{s}\text{/} with $s_{adv}=\text{COC}$. Each new reachable set counts down $\tau$ until eventually $\tau=$0\text{\,}\mathrm{s}\text{/} and the aircraft must be separated by $100\text{\,}\mathrm{ft}\text{/}$ vertically to avoid an NMAC. As seen in Figure 8, the neural network controller causes the ownship to climb or descend in order to avoid the unsafe NMAC set. This method guarantees that no collision will occur when using the neural network collision avoidance system, given that assumptions made to constrain the acceleration hold. If the acceleration limits are relaxed such that the pilot can accelerate up to $g/2$, for example, then the reachable set will overlap with the NMAC region, and safety cannot be guaranteed.

IV-C Pilot Delay

Assuming that a human pilot will react immediately to collision avoidance advisories from the neural network system is unreasonable. In reality, there will be some amount of pilot delay when following the advisories. For maximum pilot delay $\epsilon$, the pilot could choose to follow any of the advisories of the previous $\epsilon$ seconds. Pilot delay can be incorporated into the reachable set formulation by tracking the $\epsilon$ most recent advisories that result in reaching each cell. A union of cells reachable using all possible delayed advisories is used to compute $\mathcal{R}_{t+1}$ instead of using the current advisory.

For a pilot delay of three seconds, safety is no longer guaranteed, as seen in the left plot of Figure 10. For example, consider an ownship slightly below the intruder. VerticalCAS would alert the ownship to descend to avoid an NMAC, but with pilot delay, the ownship could climb for $\epsilon$ seconds instead. At this point, the ownship could be above the intruder aircraft in a region where VerticalCAS would reverse the advisory to make the ownship continue climbing and gain further separation. However, with pilot delay, the pilot could begin following the stale descend advisories and descend instead. The cycle repeats indefinitely, resulting in an NMAC.

One solution to fix such issues uses online costs to penalize undesirable behavior [18]. For example, an online cost could be applied to prevent the system from reversing the direction of given advisories more than once. A count of reversals can be tracked along with the previous advisories given to reach each cell. As shown in Figure 10, preventing double reversals is sufficient to prevent an NMAC. This reachability method allows complex systems involving neural network controllers alongside other variables and penalties to be analyzed to ensure safety.

V Conclusions

Guaranteeing the performance of neural network controllers in the presence of uncertainty is paramount to incorporating such controllers in safety critical systems. We presented a general method that uses existing neural network verification tools to constrain the neural network output before computing over-approximated reachable sets of system states. If the over-approximated set does not contain any unsafe states, then the system is guaranteed to be safe. A mountain car example demonstrated the approach and provided guarantees on time to reach the goal for different levels of disturbances. A collision avoidance example demonstrated how complex systems involving human delay and online costs could be modeled and shown to be safe. The proposed method is flexible and applicable to any neural network controller of a dynamical system. Future work will explore higher dimensional problems along with open source reachable set libraries in order to decrease computation time.

Acknowledgments

This material is based upon work supported by the National Science Foundation Graduate Research Fellowship under Grant No. DGE$-$1656518. Any opinion, findings, and conclusions or recommendations expressed in this material are those of the authors and do not necessarily reflect the views of the National Science Foundation.