Uppaal Coshy: Automated Safety Shield Synthesis

• Uppaal Coshy is a tool that automatically synthesizes safety shields for Euclidean Markov decision processes using partition-based abstraction and simulation-driven approximation.
• It employs the Caap algorithm to compactly represent per-cell safety strategies as decision trees via greedy expansion and heuristic splitting.
• The tool integrates with Uppaal models to verify safety through statistical model checking and has demonstrated effectiveness on benchmarks like the bouncing ball and water tank.

Uppaal Coshy is a tool for automatic synthesis of a safety strategy, or shield, for Markov decision processes over continuous state spaces and complex hybrid dynamics. Its general methodology is to partition the state space and then solve a two-player safety game, while approximating hard-to-obtain solutions using simulations. The implementation is fully automatic and supports the expressive formalism of Uppaal models, which encompass stochastic hybrid automata. A central feature is an algorithm called Caap, which computes a compact representation of a shield in the form of a decision tree and yields significant reductions (Brorholt et al., 22 Aug 2025).

1. Problem setting and synthesis objective

The setting is a possibly stochastic hybrid system modeled as a Euclidean Markov decision process (EMDP) whose state space $S \subseteq \mathbb{R}^k$ is conceptually infinite (Brorholt et al., 22 Aug 2025). Given a safety invariant $\varphi \subseteq S$, the goal is to automatically synthesize a nondeterministic shield $\sigma$ that maps each state $s$ to a set of safe control actions, so that under $\sigma$ all executions remain in $\varphi$.

The paper defines the target artifact as a nondeterministic “shield” or safety strategy rather than a single prescribed controller. This distinction is technically important: the shield restricts actions to those that are safe, but it does not necessarily determine one unique action in each state. Applications include enforcing safety at run-time while leaving freedom for optimization or learning within the shielded system. This suggests a separation between a safety envelope and whatever optimization or learning mechanism operates inside that envelope.

A common misunderstanding would be to treat the synthesis problem as a purely finite-state task. The paper instead starts from continuous state spaces and complex hybrid dynamics, and only then introduces a finite abstraction through partitioning. Another misconception would be to assume that exact hybrid reachability is computed throughout; the paper explicitly states that exact computation is undecidable or infeasible for general nonlinear or stochastic hybrid dynamics.

2. Formal model: EMDPs, partitions, and the safety game

An EMDP is defined as a tuple $\mathcal{M} = (S, A, T)$, where $S \subseteq \mathbb{R}^k$ is closed and bounded, $A$ is a finite set of actions, and $T \colon S \times A \to (S \to \mathbb{R}_{\ge 0})$ maps $\varphi \subseteq S$0 to a probability density $\varphi \subseteq S$1 on $\varphi \subseteq S$2 (Brorholt et al., 22 Aug 2025). A run is an infinite sequence

$\varphi \subseteq S$3

with $\varphi \subseteq S$4. A nondeterministic strategy is $\varphi \subseteq S$5; a run is safe if $\varphi \subseteq S$6 and $\varphi \subseteq S$7.

The abstraction step partitions $\varphi \subseteq S$8 into finitely many rectangular cells $\varphi \subseteq S$9. This induces a labeled transition system by

$\sigma$0

The zero-step safe cells are

$\sigma$1

The greatest-fixed-point characterization of the safe region is

$\sigma$2

The corresponding most-permissive shield on cells is

$\sigma$3

By mapping each continuous state $\sigma$4 to its cell $\sigma$5, the construction yields a shield for the original EMDP; the paper attributes this statement to Theorem 2.1. Once $\sigma$6 is computed, the safety game is solved via fixed point (2) in time polynomial in $\sigma$7 and $\sigma$8. The abstraction therefore relocates the main difficulty from game solving to the construction of a sufficiently informative finite transition relation.

3. Partition-based abstraction and simulation-driven approximation

The partition is a regular rectangular grid over $\sigma$9, parameterized by a granularity vector $s$0 and an offset $s$1. Each cell is

$s$2

Finer $s$3 yields more cells and, in principle, a more precise abstraction, but at higher computational cost (Brorholt et al., 22 Aug 2025).

The principal algorithmic obstacle is that exact computation of the transition relation in (1) is undecidable or infeasible for general nonlinear or stochastic hybrid dynamics. Uppaal Coshy addresses this by systematic sampling and simulation. Within each cell $s$4, it systematically samples $s$5 points on an $s$6-grid, where $s$7 is a user parameter. For each sample $s$8 and action $s$9, it applies $\sigma$0 and invokes the Uppaal simulator to run until the next controller decision point; this yields a successor sample $\sigma$1, and hence a successor cell $\sigma$2. Each sample–action pair is repeated $\sigma$3 times, where $\sigma$4 is another user parameter, to cover stochastic outcomes.

The union of discovered transitions underapproximates the ideal transition relation. Cells whose samples never violate $\sigma$5 are taken as initial safe cells. Empirically, increasing $\sigma$6 and $\sigma$7 improves precision; final safety can be checked by Uppaal’s statistical model checking. The paper’s general philosophy is therefore not to solve hybrid reachability exactly, but to approximate it through simulator-driven evidence. A plausible implication is that synthesis quality depends materially on the informativeness of the sampling regime and on the model’s stochastic structure.

4. Caap and compact shield representation

A direct shield stores $\sigma$8 for each cell, and the paper notes that this can involve millions of cells (Brorholt et al., 22 Aug 2025). Since many adjacent cells allow the same action set, Uppaal Coshy introduces Caap to compute a coarser, axis-aligned partition and thereby obtain a compact representation.

The compact representation is defined through a decision tree whose internal predicates have the form $\sigma$9, with sorted cut-points $\varphi$0 per dimension $\varphi$1. A region is represented by index bounds $\varphi$2, corresponding to a hyperrectangle in $\varphi$3.

A candidate expansion $\varphi$4 of a region is legal only if three rules hold:

1. Uniformity: all cells in $\varphi$5 share the same $\varphi$6.
2. Non-overlap: $\varphi$7 does not intersect already fixed regions.
3. Non-splitting: for any original region $\varphi$8, $\varphi$9 is either empty or a single rectangle.

The greedy expansion procedure initializes $\mathcal{M} = (S, A, T)$0 and iteratively tries to increase $\mathcal{M} = (S, A, T)$1 in each dimension $\mathcal{M} = (S, A, T)$2. If Rule 1 or 2 fails, the algorithm reverts and marks $\mathcal{M} = (S, A, T)$3 exhausted. If Rule 3 fails, it attempts a one-dimensional “repair” by more aggressive expansion; if impossible, it reverts and exhausts $\mathcal{M} = (S, A, T)$4. When all dimensions are exhausted, it records the maximal region and repeats until the whole space is covered.

The resulting regions are then converted back into a much smaller decision tree through a heuristic splitting procedure that balances number of cut regions and region counts while ensuring functional equivalence. Repeated Caap$\mathcal{M} = (S, A, T)$5tree cycles often yield further minor reductions. The compactness result is thus not merely a storage optimization; it is a structural post-processing step that preserves the shield while changing its representation.

5. Tool workflow and implementation in Uppaal

The workflow begins by modeling the hybrid system in Uppaal using piecewise ODEs, discrete modes, and synchronizations (Brorholt et al., 22 Aug 2025). Shield synthesis is then initiated by a query of the form:

$S \subseteq \mathbb{R}^k$4

Uppaal Coshy then automatically performs three synthesis stages: it builds the grid $\mathcal{M} = (S, A, T)$6, samples and simulates to approximate transitions, and solves the finite safety game to compute $\mathcal{M} = (S, A, T)$7. The raw shield can optionally be saved per cell to JSON. Caap can then be run on the saved shield JSON to obtain a compact decision tree, which can be loaded back in Uppaal. The compact shield can be used in reinforcement-learning or strategy-improvement queries via Uppaal Stratego.

Several implementation details are emphasized. Unbounded state spaces are handled by a special “out-of-bounds” cell; the user can choose to treat it as always safe, always unsafe, or decide automatically by sampling. Dimensions irrelevant to safety, including clocks, cost variables, and always-fixed discrete locations, may be omitted; their values are fixed to the initial state during sampling. The simulator is used both for nondeterministic hybrid flows and stochastic draws, which frees the implementation from re-implementing arbitrary C calls or complex distributions. All steps are fully automated from the Uppaal GUI, with no manual model changes needed except optional state-space transformations.

This implementation profile suggests that the tool is designed to exploit the simulator as a unifying interface for both dynamics and randomness, rather than to encode bespoke symbolic procedures for each model class.

6. Experimental findings, limitations, and extensions

The evaluation uses four benchmarks: the bouncing ball, boost converter, random walk, and water tank (Brorholt et al., 22 Aug 2025). The reported synthesis and Caap metrics are as follows.

Benchmark	Configuration and synthesis	Caap result
Bouncing Ball	$\mathcal{M} = (S, A, T)$8; synthesis 218 s; raw cells 1 430 000	53 s; 2 972 regions
Boost Converter	$\mathcal{M} = (S, A, T)$9; synthesis 1 430 s; raw cells 136 800	21 s; 571 regions
Random Walk	$S \subseteq \mathbb{R}^k$0; synthesis 82 s; raw cells 40 000	1.5 s; 60 regions
Water Tank	$S \subseteq \mathbb{R}^k$1; synthesis 0.1 s; raw cells 168	0.1 s; 24 regions

All synthesized shields were confirmed via 10 000 SMC runs at 99% confidence to violate safety in fewer than 0.03% of trials, and in practice zero. The paper also states that state-space transformations, for example using mechanical energy for the ball, can reduce raw grid size by orders of magnitude.

The limitations are explicit. Reachability is underapproximated, so corner cases may be missed unless $S \subseteq \mathbb{R}^k$2 and $S \subseteq \mathbb{R}^k$3 are large; statistical checking is recommended post-synthesis. Randomness in Uppaal is not systematically sampled, and future work may detect and sample over discrete distributions. Caap is currently a separate post-processing step, and tighter integration into Uppaal would simplify usability. Improved visualizations, including why a state is unsafe, and debug support could aid modelers. Proposed extensions include cost-aware shields through multi-objective synthesis and on-the-fly shield refinement during learning.

Taken together, these results position Uppaal Coshy as a partition-based, simulation-driven framework for automatic safety synthesis in stochastic and hybrid models, with Caap serving as the mechanism that converts large per-cell shields into compact deployable decision trees.