RouthSearch: Inferring PID Parameter Specification for Flight Control Program by Coordinate Search

TL;DR

RouthSearch combines the Routh-Hurwitz stability criterion with coordinate search to accurately identify valid PID parameter ranges in UAV flight control, improving safety and bug detection over prior random testing methods.

Contribution

It introduces a novel method that integrates theoretical stability analysis with efficient search to determine valid PID ranges, enhancing safety checks in UAV flight control software.

Findings

Achieves 92.0% accuracy in valid PID range detection

Discoveries of 3,853 misconfigurations in 48 hours

Detected three bugs in PX4 and ArduPilot

Abstract

Flight control programs use PID control modules with user-configurable Proportional (P), Integral (I), and Derivative (D) parameters to manage UAV flying behaviors. Users can adjust these PID parameters during flight. However, flight control programs lack sufficient safety checks on user-provided PID parameters, leading to a severe UAV vulnerability - the input validation bug. This occurs when a user misconfigures PID parameters, causing dangerous states like deviation from the expected path, loss of control, or crash. Prior works use random testing like fuzzing, but these are not effective in the three-dimensional search space of PID parameters. The expensive dynamic execution of UAV tests further hinders random testing performance. We address PID parameter misconfiguration by combining the Routh-Hurwitz stability criterion with coordinate search, introducing RouthSearch. Instead of ad-hoc identification, RouthSearch principledly determines valid ranges for three-dimensional PID parameters. We first leverage the Routh-Hurwitz Criterion to identify a theoretical PID parameter boundary, then refine it using efficient coordinate search. The determined valid range can filter misconfigured PID parameters from users during flight and help discover logical bugs in flight control programs. We evaluated RouthSearch across eight flight modes in PX4 and Ardupilot. Results show RouthSearch determines valid ranges with 92.0% accuracy compared to ground truth. RouthSearch discovers 3,853 PID misconfigurations within 48 hours, while the STOA work PGFuzz discovers only 449 sets, significantly outperforming prior works by 8.58 times. Our method also helped detect three bugs in ArduPilot and PX4.