RouthSearch: Inferring PID Parameter Specification for Flight Control Program by Coordinate Search

TL;DR

This work tackles the unsafe practice of dynamically adjusting PID parameters in UAV flight control without adequate safety checks. It introduces RouthSearch, which anchors boundary discovery in the theoretical Routh-Hurwitz stability criterion and refines it with an efficient coordinate search, guided by a misbehavior validator using Metric Temporal Logic on flight logs. Across eight flight modes on PX4 and ArduPilot, RouthSearch achieves 92.0% boundary accuracy and detects around 3,853 misconfigurations in 48 hours, vastly outperforming PGFuzz (≈449). The approach also uncovers three real bugs in open-source flight controllers, demonstrating practical impact for improving UAV safety and reliability; the tool is released to the community for further adoption and study.

Abstract

Flight control programs use PID control modules with user-configurable Proportional (P), Integral (I), and Derivative (D) parameters to manage UAV flying behaviors. Users can adjust these PID parameters during flight. However, flight control programs lack sufficient safety checks on user-provided PID parameters, leading to a severe UAV vulnerability - the input validation bug. This occurs when a user misconfigures PID parameters, causing dangerous states like deviation from the expected path, loss of control, or crash. Prior works use random testing like fuzzing, but these are not effective in the three-dimensional search space of PID parameters. The expensive dynamic execution of UAV tests further hinders random testing performance. We address PID parameter misconfiguration by combining the Routh-Hurwitz stability criterion with coordinate search, introducing RouthSearch. Instead of ad-hoc identification, RouthSearch principledly determines valid ranges for three-dimensional PID parameters. We first leverage the Routh-Hurwitz Criterion to identify a theoretical PID parameter boundary, then refine it using efficient coordinate search. The determined valid range can filter misconfigured PID parameters from users during flight and help discover logical bugs in flight control programs. We evaluated RouthSearch across eight flight modes in PX4 and Ardupilot. Results show RouthSearch determines valid ranges with 92.0% accuracy compared to ground truth. RouthSearch discovers 3,853 PID misconfigurations within 48 hours, while the STOA work PGFuzz discovers only 449 sets, significantly outperforming prior works by 8.58 times. Our method also helped detect three bugs in ArduPilot and PX4.

Figures (7)

• Figure 1: Comparison of UAV trajectories before and after setting invalid PID configurations. After the invalid PID parameter is set, the UAV trajectory becomes waving and unstable as shown in \ref{['fig:traj_after_invalid_pid']}.
• Figure 2: RouthSearch Overview: RouthSearch includes Boundary Identification module and Misbehavior Validation module. The Boundary Identification module takes in PID parameters along with their ranges from the document and then explores the parameter space to find boundaries between valid and invalid configurations. The Boundary Identification module queries the Misbehavior Validation module to validate PID parameter configurations during the search process. Finally, it outputs valid PID parameter ranges.
• Figure 3: Different PID parameter boundaries of UAVs. The light blue and pink represent valid and invalid PID configurations, respectively. We highlight the boundary line in red.
• Figure 4: False negative reported by the misbehavior validator under PX4 Orbit mode. The pink marks false positive misconfigurations caused by the detector's sensitivity to deviation.
• Figure 5: UAV under ArduPilot Brake mode fails to stop at the destination marked in red and gets stuck in circles endlessly due to a logic bug in the flight control program.