  Models of actual causality leverage domain knowledge to generate convincing
diagnoses of events that caused an outcome. It is promising to apply these
models to diagnose and repair run-time property violations in cyber-physical
systems (CPS) with learning-enabled components (LEC). However, given the high
diversity and complexity of LECs, it is challenging to encode domain knowledge
(e.g., the CPS dynamics) in a scalable actual causality model that could
generate useful repair suggestions. In this paper, we focus causal diagnosis on
the input/output behaviors of LECs. Specifically, we aim to identify which
subset of I/O behaviors of the LEC is an actual cause for a property violation.
An important by-product is a counterfactual version of the LEC that repairs the
run-time property by fixing the identified problematic behaviors. Based on this
insights, we design a two-step diagnostic pipeline: (1) construct and
Halpern-Pearl causality model that reflects the dependency of property outcome
on the component's I/O behaviors, and (2) perform a search for an actual cause
and corresponding repair on the model. We prove that our pipeline has the
following guarantee: if an actual cause is found, the system is guaranteed to
be repaired; otherwise, we have high probabilistic confidence that the LEC
under analysis did not cause the property violation. We demonstrate that our
approach successfully repairs learned controllers on a standard OpenAI Gym
benchmark.
