RouthSearch: Inferring PID Parameter Specification for Flight Control Program by Coordinate Search

Fuente: arXiv

Saved in:

Bibliographic Details
Main Authors:	Wang, Siao, Dong, Zhen, Li, Hui, Shen, Liwei, Peng, Xin, She, Dongdong
Format:	Preprint
Published:	2025
Subjects:	Software Engineering
Online Access:	Acceder al recurso
Tags:	Add Tag No Tags, Be the first to tag this record!

_version_	1866913820092399616
author	Wang, Siao Dong, Zhen Li, Hui Shen, Liwei Peng, Xin She, Dongdong
author_facet	Wang, Siao Dong, Zhen Li, Hui Shen, Liwei Peng, Xin She, Dongdong
contents	Flight control programs use PID control modules with user-configurable Proportional (P), Integral (I), and Derivative (D) parameters to manage UAV flying behaviors. Users can adjust these PID parameters during flight. However, flight control programs lack sufficient safety checks on user-provided PID parameters, leading to a severe UAV vulnerability - the input validation bug. This occurs when a user misconfigures PID parameters, causing dangerous states like deviation from the expected path, loss of control, or crash. Prior works use random testing like fuzzing, but these are not effective in the three-dimensional search space of PID parameters. The expensive dynamic execution of UAV tests further hinders random testing performance. We address PID parameter misconfiguration by combining the Routh-Hurwitz stability criterion with coordinate search, introducing RouthSearch. Instead of ad-hoc identification, RouthSearch principledly determines valid ranges for three-dimensional PID parameters. We first leverage the Routh-Hurwitz Criterion to identify a theoretical PID parameter boundary, then refine it using efficient coordinate search. The determined valid range can filter misconfigured PID parameters from users during flight and help discover logical bugs in flight control programs. We evaluated RouthSearch across eight flight modes in PX4 and Ardupilot. Results show RouthSearch determines valid ranges with 92.0% accuracy compared to ground truth. RouthSearch discovers 3,853 PID misconfigurations within 48 hours, while the STOA work PGFuzz discovers only 449 sets, significantly outperforming prior works by 8.58 times. Our method also helped detect three bugs in ArduPilot and PX4.
format	Preprint
id	arxiv_https___arxiv_org_abs_2505_02357
institution	arXiv
publishDate	2025
record_format	arxiv
spellingShingle	RouthSearch: Inferring PID Parameter Specification for Flight Control Program by Coordinate Search Wang, Siao Dong, Zhen Li, Hui Shen, Liwei Peng, Xin She, Dongdong Software Engineering Flight control programs use PID control modules with user-configurable Proportional (P), Integral (I), and Derivative (D) parameters to manage UAV flying behaviors. Users can adjust these PID parameters during flight. However, flight control programs lack sufficient safety checks on user-provided PID parameters, leading to a severe UAV vulnerability - the input validation bug. This occurs when a user misconfigures PID parameters, causing dangerous states like deviation from the expected path, loss of control, or crash. Prior works use random testing like fuzzing, but these are not effective in the three-dimensional search space of PID parameters. The expensive dynamic execution of UAV tests further hinders random testing performance. We address PID parameter misconfiguration by combining the Routh-Hurwitz stability criterion with coordinate search, introducing RouthSearch. Instead of ad-hoc identification, RouthSearch principledly determines valid ranges for three-dimensional PID parameters. We first leverage the Routh-Hurwitz Criterion to identify a theoretical PID parameter boundary, then refine it using efficient coordinate search. The determined valid range can filter misconfigured PID parameters from users during flight and help discover logical bugs in flight control programs. We evaluated RouthSearch across eight flight modes in PX4 and Ardupilot. Results show RouthSearch determines valid ranges with 92.0% accuracy compared to ground truth. RouthSearch discovers 3,853 PID misconfigurations within 48 hours, while the STOA work PGFuzz discovers only 449 sets, significantly outperforming prior works by 8.58 times. Our method also helped detect three bugs in ArduPilot and PX4.
title	RouthSearch: Inferring PID Parameter Specification for Flight Control Program by Coordinate Search
topic	Software Engineering
url	https://arxiv.org/abs/2505.02357