Doctoral Thesis Defense: Detecting Semantic Bugs in Autopilots by Monitoring Relevant Variables via Machine Learning

Abstract

The autopilot is the cornerstone for current advances in ground and air vehicles. However, like any piece of software, autopilots still contain bugs. One way to categorize bugs places them into three categories: memory, concurrency and semantic bugs. A large portion of bugs in autopilots are semantic bugs, where the autopilot does not behave according to the expectations of the programmer. Semantic bugs are especially difficult to detect as these bugs do not crash the program. Instead the autopilot continues to execute but can lead to potentially disastrous consequences. In this thesis, we construct a bug detector to detect semantic bugs. A bug detector requires two components to function, a source of data and a method to extract meaning from the data. We hypothesize that semantic bugs can be detected by monitoring a set of relevant variables internal to the autopilot as the data source. In addition, we leverage machine learning models as the method to interpret the data. We formulate the problem of identifying relevant variables formally as an optimization problem, which is to locate a set of variables that minimizes overhead and satisfies our performance constraints.

We evaluate our hypothesis using Ardupilot and first show the existence of a set of variables which meet some of our performance criteria found using heuristics. Once we meet the feasibility requirements we tackle a relaxed version of our optimization problem. Furthermore, we hypothesize that program slicing can be used as a principled approach to identify relevant variables. Our experimental results show that variables identified by the program slice can enable our machine learning models to perform significantly better compared to variables comprising the system inputs and outputs. Additionally, we implement two methods to select a subset of variables within the program slice to reduce the overhead. Our results show that we can retain nearly the same bug detection performance as compared to the full slice but reduce the overhead of the bug detector by as much as 80%.