The Reachability Problem for
Neural-Network Control Systems

Cyber-physical systems consist of digital (cyber) and physical components. A common instance of this paradigm is a control system, consisting of a physical plant and a controller whose purpose is to steer the plant to a desired behavior [7]. Control theory studies the automatic synthesis of such controllers, which, for nonlinear systems, is a difficult task. Machine learning has long been successfully applied to tackle this task, where the learned controller was first represented by a (shallow) feedforward neural network [19] and more recently by a deep neural network (DNN) [15]. We call a control system with a DNN controller a neural-network control system (NNCS). Due to their black-box nature, DNNs have raised concerns about their correctness and safety, in particular in terms of the worst-case behavior [28]. However, as they are deployed in safety-critical applications, proving machine-learned NNCS correct is of utmost importance, and considerable resources have been invested into their verification [16, 17].

In this paper, we are concerned with the fundamental problem of safety for NNCS: given a set of initial states and a set of bad states of the plant, does the controller prevent the plant to reach a bad state when started in an initial state? Note that the failure of safety is captured by a reachability property: does there exist an initial state from which a bad state is reachable? Thus, in the following, we study the reachability problem for NNCS.

Recall that an NNCS is a combination of a DNN (the controller) and a plant. It is known that the reachability problem is already undecidable for sufficiently complex plants, even without any controller [13]. So the question becomes: is there a simple but expressive class of plants for which the reachability problem is tractable? Inspired by similar results for recurrent neural networks [27, 10], we show in Section 3 that the answer is negative: the reachability problem is undecidable even for trivial plants. Intuitively, a DNN can simulate one computational step of a two-counter machine. Thus, a recurrent neural network can simulate a two-counter machine. As a DNN controlling a plant is essentially recurrent (as it bases its control decisions on the current state of the plant), undecidability follows.

On the positive side, we show in Section 4 that the reachability problem is at least semi-decidable for plants whose behavior can be captured by automata over infinite words: Sälzer et al. showed that the behavior of DNNs can be captured by such automata [23]. Hence, relying on standard automata-theoretic constructions, the composition of a DNN and an automata-definable plant can also be captured by automata. The class of automata-definable plants includes, for instance, plants that are described by multi-mode linear maps. Such maps are able to express, for example, the dynamics of adaptive cruise controls [14].

We start by formally introducing the type of DNN under study.

Next, we define control systems as depicted in Fig. 1. The system consists of a plant and a controller (here: a DNN) and acts in iterations: first, the controller computes a control input $\vec{u}$ for the plant based on the current state $\vec{x}$ of the plant. Next, from its inputs $\vec{x}$ and $\vec{u}$, the plant computes a new state. Then the process repeats. For the plant, we restrict ourselves to discrete time, i.e., we are only interested in its output and not its intermediate states. For now, we also abstract from the concrete type of plant and just view it as a general function.

We introduce a shorthand to express one iteration of the control loop in Fig. 1, i.e., the composition of the DNN followed by the plant, to compute $\vec{x}_{k}$ from $\vec{x}_{k-1}$:

We will focus on sets of states represented by linear constraints. Given $a\in\mathbb{Q}^{n}$, $b\in\mathbb{Q}$, the set $H_{a,b}=\{\vec{x}\in\mathbb{R}^{n}\mid\langle a,\vec{x}\rangle\leq b\}$ is a linear constraint, where “$\langle\cdot,\cdot\rangle$” denotes the scalar product. A polyhedron is a finite intersection of linear constraints. Let $\mathcal{P}(n)$ denote the set of all polyhedra in $n$ dimensions.

We are now ready to define the reachability problem for NNCS.

In this section, we prove that the NNCS reachability problem is undecidable. The proof is by a reduction from the halting problem for two-counter machines.

Formally, a two-counter machine $\mathcal{M}$ is a sequence

where the first element of a pair $(\ell:\texttt{I}_{\ell})$ is the line number and $\texttt{I}_{\ell}$ for $0\leq\ell<k-1$ is an instruction of the form

• •

  $\texttt{INC}(i)$ with $i\in\{0,1\}$,

• •

  $\texttt{DEC}(i)$ with $i\in\{0,1\}$, or

• •

  $\texttt{JZ}(i,\ell^{\prime})$ with $i\in\{0,1\}$ and $\ell^{\prime}\in\{0,\ldots,k-1\}$.

A configuration of $\mathcal{M}$ is of the form $(\ell,c_{0},c_{1})$ with $\ell\in\{0,\ldots,k-1\}$ (the current value of the program counter) and $c_{0},c_{1}\in\mathbb{N}$ (the current contents of the two counters). The initial configuration is $(0,0,0)$ and the unique successor configuration of a configuration $(\ell,c_{0},c_{1})$ is defined as follows:

• •

  If $\texttt{I}_{\ell}=\texttt{INC}(i)$, then the successor configuration is $(\ell+1,c_{0}^{\prime},c_{1}^{\prime})$ with $c_{i}^{\prime}=c_{i}+1$ and $c_{1-i}^{\prime}=c_{1-i}$.

• •

  If $\texttt{I}_{\ell}=\texttt{DEC}(i)$, then the successor configuration is $(\ell+1,c_{0}^{\prime},c_{1}^{\prime})$ with $c_{i}^{\prime}=\max\{c_{i}-1,0\}$ and $c_{1-i}^{\prime}=c_{1-i}$.

• •

  If $\texttt{I}_{\ell}=\texttt{JZ}(i,\ell^{\prime})$ and $c_{i}=0$, then the successor configuration is $(\ell^{\prime},c_{0},c_{1})$.

• •

  If $\texttt{I}_{\ell}=\texttt{JZ}(i,\ell^{\prime})$ and $c_{i}>0$, then the successor configuration is $(\ell+1,c_{0},c_{1})$.

• •

  If $\texttt{I}_{\ell}=\texttt{STOP}$, then $(\ell,c_{0},c_{1})$ has no successor configuration.

The unique run of $\mathcal{M}$ (starting in the initial configuration) is defined as the maximal sequence $\gamma_{0}\gamma_{1}\gamma_{2}\cdots$ of configurations $\gamma_{j}\in\mathbb{N}^{3}$ where $\gamma_{0}$ is the initial configuration and $\gamma_{j+1}$ is the successor configuration of $\gamma_{j}$, if $\gamma_{j}$ has a successor configuration. This run is either finite (line $k-1$ is reached) or infinite (line $k-1$ is never reached). In the former case, we say that $\mathcal{M}$ terminates. The halting problem for two-counter machines asks, given a two-counter machine $\mathcal{M}$, whether $\mathcal{M}$ terminates when started in the initial configuration.

In the following, we show that the halting problem for two-counter machines can be reduced to the reachability problem for NNCS by simulating the semantics of a two-counter machine by a NNCS.

We note that the DNNs simulating two-counter machines are rather simple.

One may wonder whether the six hidden layers are necessary. In general, one cannot hope to obtain a small neural network when removing layers [4]. However, since we can iterate the NNCS, and the plant model is not interfering, we can reduce one iteration of a DNN $N$ with six hidden layers (constructed in the proof above) to seven iterations of a DNN $N^{\prime}$ with one hidden layer.¹¹1Typically, neural networks with only one hidden layer are not called deep. Fig. 5 shows a sketch of the construction idea. Essentially, we take the hidden layers of $N$ and stack them as one wide hidden layer in $N^{\prime}$. (For instance, layer $\ell_{1}$ has width $k+1$.) We refer to each of these hidden layers as a track. For each track, we need to add input and output dimensions corresponding to the number of neurons in the respective previous and next hidden layers. The output of track $j$ is fed to track $j+1$ (and the output of the last track is fed to the first track).

When presented with an input vector $\vec{x}_{0}$ of appropriate size, the first track performs the computation of the first hidden layer and feeds its output to the second track, and so on. After seven iterations, the output of the last track will equal the output of the seven-layer DNN $N$ after the first iteration. This output is then used as the input of the first track again and the process continues.

Finally, we need to make sure that the other tracks do not accidentally produce an output that leads to a target state between multiples of seven iterations. In order to only consider outputs in every seventh iteration, we use the additional gadget shown in Fig. 5(b). This gadget has seven inputs and outputs and is to be stacked below the other DNN. When the initial input is $(1,0,0,0,0,0,0)$, the $1$ is propagated to the second index, and so on, until it arrives back at the first index after seven iterations.

The target set $\varphi$ now simply needs to get extended to arbitrary values in the auxiliary dimensions, except for the seven-last entry ($m_{i}^{1}$), which has to equal one. Formally: $\varphi^{\prime}=(\varphi\land m_{i}^{1}\leq 1\land-m_{i}^{1}\leq-1)$.

In summary, by scaling the number of inputs and outputs with $\mathcal{M}$, we obtain a DNN with one (wide) hidden layer.

In this section, we show that the NNCS reachability problem is semi-decidable for a particular class of plants. Indeed, from a single initial state $\vec{x}_{0}$, we can enumerate all states $C_{P,N}(\vec{x}_{0})^{k}$ reachable in $k$ iterations and for each of them decide membership in the target polyhedron $\varphi$. However, since we allow for an initial set $X_{0}$, this algorithm is not effective.

The image of a polyhedron under a ReLU DNN is a (finite) union of polyhedra [21]. If we choose a class of plants with the same property, we obtain an effective algorithm again. In what follows, we show a more general result by using an automaton encoding of DNNs from [23]. This will allow us to more abstractly consider a class of plants that is definable in the same automaton formalism.

We slightly deviate from the original approach by Sälzer et al. [23] in that we use a more expressive automaton model, as we are (unlike them) not bothered with efficiency considerations (since our problem is undecidable).

In the following, we recall an effective encoding of real numbers in NBA from [23]. Let $\Sigma=\{+,-,0,1,.\}$. A word $w=sa_{n}\dots a_{0}.b_{0}b_{1}\dots$ with $n\geq 0$, $s\in\{+,-\}$, $a_{i},b_{i}\in\{0,1\}$ encodes the real value

where $\operatorname{sign}(s)=0$ if $s=+$ and $\operatorname{sign}(s)=1$ if $s=-$. As usual, the word encoding is not unique, but the decoding is [23, Page 5].

Now, we switch to a word encoding of multiple numbers by using a product alphabet. A symbol over this product alphabet $\Sigma^{k}$ is a $k$-vector of symbols. A word over $\Sigma^{k}$ is well-formed if it is of the form

where $s_{i}\in\{+,-\}$, $a_{i,j},b_{i,h}\in\{0,1\}$ for $i=1,\dots,k$, $j=0,\dots,n$, and $h=0,1,\dots$. In other words, the signs and the point are aligned, which can be achieved by filling up with leading zeros. The language $\mathit{WF}_{k}$ of well-formed words is $\omega$-regular [23]. The selection of a single component $i\in\{1,\dots,k\}$ is obtained in the obvious way:

If an NBA over $\Sigma^{k}$ accepts only well-formed words, then we can understand its language as a relation over $\mathbb{R}^{k}$. Furthermore, linear constraints are also $\omega$-regular [23]. Thus, as NBA are closed under intersection and union, (finite unions of) polyhedra are also $\omega$-regular. Finally, we can also use NBAs to encode functions $f\colon\mathbb{R}^{m}\rightarrow\mathbb{R}^{n}$ via their graphs, which are relations over $\mathbb{R}^{m+n}$.

Sälzer et al. showed that every function computable by a DNN can be represented by an NBA.²²2They actually proved the result for the more restrictive class of eventually-always weak NBA. But for us it is more prudent to consider the more general class of NBA.

For our application, we need to slightly modify the automaton $\mathcal{A}_{N}$ from Proposition 2 so that it also copies its input for further use. This modification can be implemented by replacing each transition label $(a_{1},\ldots,a_{n},a_{1}^{\prime},\dots,a_{m}^{\prime})$ by $(a_{1},\ldots,a_{n},a_{1},\ldots,a_{n},a_{1}^{\prime},\dots,a_{m}^{\prime})$.

Thus, the semantics of DNNs can be captured by NBAs. This is in general not true for plants. Hence, in the following, we restrict ourselves to plants that can also be captured by NBAs.

Now, both the DNN and the plant are given by NBA. Hence, we can apply standard automata-theoretic constructions to capture a bounded number of applications of the control loop by repeatedly composing the NBA for the DNN and the NBA for the plant. To this end, we introduce the (parametric) composition operator $\circ_{k}$ constructing from two NBAs $\mathcal{A}_{1}$ and $\mathcal{A}_{2}$, which accept the graphs of two functions $f_{1}\colon\mathbb{R}^{k_{1}}\to\mathbb{R}^{k}$ and $f_{2}\colon\mathbb{R}^{k}\to\mathbb{R}^{k_{2}}$, an NBA $\mathcal{A}_{1}\circ_{k}\mathcal{A}_{2}$ accepting the graph of $\vec{x}\mapsto f_{2}(f_{1}(\vec{x}))$.

Now we are ready to prove our main result of this section: NNCS reachability restricted to $\omega$-regular plants is semi-decidable. Note that this is tight, as the problem is undecidable as shown in Theorem 3.1: the plant just returning its control input as output is $\omega$-regular.

Let us remark that the construction in Theorem 4.1 does not require the initial set $X_{0}$ and the target set $\varphi$ to be polyhedral. It is sufficient that they are $\omega$-regular to effectively decide (non)emptiness of the intersection. The class of $\omega$-regular languages is strictly more expressive than polyhedral sets.³³3For example, the set of natural numbers is $\omega$-regular (in the encoding used here), but it is not a polyhedron. Thus, our result is more general than the statement of Theorem 4.1.

In this paper, we studied the reachability problem for dynamical systems controlled by deep neural networks. We showed that, for the common ReLU activations, the problem is undecidable even when the plant is trivial and the network is restricted to integral weights and a singleton initial set; furthermore, we can either fix the input and output dimensions to $3$ and the number of hidden layers to $6$, or use a single hidden layer. We then turned to the question when the problem can be semi-decided; here we extended a recent encoding of neural networks in Büchi automata and showed that $\omega$-regular plants as well as input and target sets are sufficient for a semi-decision procedure; as an example, we demonstrated that a model akin to linear hybrid automata is $\omega$-regular.

We thank the participants of AISoLA 2023 for suggesting to study the NNCS reachability problem with one hidden layer.

This research was partly supported by the Independent Research Fund Denmark under reference number 10.46540/3120-00041B, DIREC - Digital Research Centre Denmark under reference number 9142-0001B, and the Villum Investigator Grant S4OS under reference number 37819.