# HYBRID systems involve a combination of discrete and continuous

Save this PDF as:

Size: px
Start display at page:

## Transcription

6 0 < x min < x max and x min, x max R +. When the heater is off, the temperature of the room decreases and when the heater is turned on, the temperature increases according to the following dynamics: off : ẋ = Kx on : ẋ = K(x h) Here, the parameter K R + is the room constant and the parameter h > x min +x max is a real-valued constant that depends on the power of the heater. The discrete logic to switch between these two modes is given by the following two guarded transitions: state = off x x min state = on x x max state = on state = off Let us say that the initial condition is given by x x min x x max and the heater is off. This hybrid model of the thermostat can be represented in Simulink and Stateflow as shown in the figures below. The complete system contains a Stateflow chart that keeps track of the mode of the system and Simulink blocks that describe the continuous dynamics. See Figure 3. In K Enable xdot Fig. 5 s x o Out2 SIMULINK MODEL OF THE HEATER OFF MODE In xdot x o K s 00 Constant Enable Fig. 6 x Out2 SIMULINK MODEL OF THE HEATER ON MODE x In Out2 NOT In Out2 mode Chart Fig. 3 SIMULINK MODEL OF THE THERMOSTAT EXAMPLE The Stateflow chart contains two states corresponding to whether the heater is on or off and transitions between these two modes and is shown in Figure 4. offmode entry:mode=0 [x >= xmax] Fig. 4 x x [x <= xmin] onmode entry:mode= STATEFLOW COMPONENT IN THE THERMOSTAT MODEL The Stateflow chart outputs the mode based on which the Simulink component chooses a particular dynamics. The two triggered Simulink subsystem blocks describe the dynamics of the temperature in each of the two modes and are shown in Figures 5 and 6. Note that we have used some hypothetical values for the constants h, K, x min, and x max in the Simulink model. See Example 6 in Section V-E for symbolic analysis of the more general example with symbolic parameter values. V. ANALYSIS FOR HYBRID SYSTEMS We describe new techniques for formal verification of hybrid models. We showed that hybrid system models in Simulink/Stateflow can be translated into transition systems. These transition systems are represented in SAL and techniques for their analysis are implemented as tools over SAL. This makes the tools more generally applicable and independent of the Simulink/Stateflow modeling language. A. An Overview of SAL Symbolic Analysis Laboratory (SAL) is a framework for combining different tools to perform symbolic analysis of discrete systems. At the core of SAL is a language for specifying transition systems in a compositional way. This language serves as the target for translators that extract the transition system description from various domain-specific modeling languages. The intermediate language also serves as a description from which different analysis tools can be driven. Existing analysis tools are interfaced with SAL by translating the intermediate language to the input format for the tools and translating the output of these tools back to the SAL intermediate language. A transition system module in SAL consists of a state type, an initialization condition on this state type, and a binary transition relation on the state type. The state type is defined by 6

7 four pairwise disjoint sets of input, output, global, and local variables. The initialization and transition relation are specified using guarded assignments over a strongly typed expression language. A guarded assignment consists of a guard and a list of assignments. A guard is a boolean expression in the current local, global, and output variables and current and next input variables. An assignment is an equality between a left-handside next variable (i.e., value of the variable in the next discrete time step) and a right-hand-side expression in current and next variables. New modules can also be defined using synchronous and asynchronous composition of existing modules using a renaming facility to avoid name clashes. The semantics of a SAL module M is given in terms of a Kripke structure (Q, E, L), where Q is the set of states (a state is a valuation of the input, output, local, and global variables), E Q Q is a binary relation on the state space Q induced by the guarded transitions, and L is a labeling function that maps each edge in E to the name of the guarded transition that induces that edge. Properties of a SAL module can be stated in any temporal logic, and the interpretation is the usual one [33]. B. Simulink/Stateflow Models and Hybrid Systems in SAL Following the discussion in Sections II and III-A, we can transform certain Simulink/Stateflow models into SAL. To see this, note that each pushdown automata is translated directly into a SAL basemodule. Furthermore, the differential equations arising from the Simulink component are converted into difference equations as shown in Section III-A. Note that we have a choice of using the discretization based on either the fixed step simulation semantics or the variable step simulation semantics. Using the same ideas, we can also represent suitable discretized models of hybrid dynamical systems in SAL. We show the benefit of doing this via some illustrations in later sections. Example 3: We can describe the leader control continuous dynamical system outlined in Example in SAL by using the variable step simulation semantics for the differential equations as follows: AHS : CONTEXT = BEGIN leader : MODULE = BEGIN INPUT a : REAL, δ : REAL LOCAL gap, v, v0 : REAL INITIALIZATION gap 2 AND v v0 TRANSITION [ 0 < δ δ v = v + δ * a; v0 = v0 + δ * (a + v - v0); gap = gap + δ * (v - v0) ] END; END Note that SAL allows us to state the initial condition symbolically. It also explicitly specifies the acceleration a of the leading car to be an input variable so that analysis tools can suitably deal with it. See Example 4. In the above description, δ is constrained to be between 0 and. In different instances, the upper bound (which is in this case) may need to be different. In case of a fixed time step semantics, δ is replaced by a constant. C. Symbolic Simulation The Matlab Simulink tool provides extensive simulation facility. Simulation refers to traversing one trajectory of the system behavior from the possible infinite. To run a simulation, the designer must (a) specify initial conditions by giving values of all state variables, (b) choose a particular input function (in case the system has inputs coming from the environment), (c) give some default values to all parameters used in the modeling of the system, and optionally (d) choose a solver and/or a sample time for certain blocks. The simulation tool then computes the system behavior under these specific choices. Even after doing several simulations with different choices for (a) (d) above, the designer cannot be sure that the system works correctly in all possible scenarios. For instance, in the leader control system of Example, simulation would show the behavior of the system under a particular profile of the acceleration of the car in front. But, safety requires that there be no crash under every possible acceleration maneuver of the leading car. Similarly, running simulation on the thermostat model of Example 2 will show that the thermostat works as desired for the particular values of parameters h, K, x min, and x max that were chosen for the simulation. Symbolic simulation refers to performing simulation on sets of states represented symbolically. Thus, symbolic simulation differs from regular simulation in two respects. First, it simultaneously traverses a bunch of trajectories instead of a single trajectory through the state space. Second, a set of states is represented symbolically rather than explicitly. This allows representation of a potentially infinite number of states and simulation of a potentially infinite number of trajectories in one symbolic simulation. We use the language of first-order logic to symbolically represent sets of states. We recall that a state is a valuation of all the state and output variables. A set of states can be specified using a first-order formula over the state and output variables. A crucial step in performing symbolic simulation is the computation of the set of all states that are reachable from the current set of states (represented as a first-order formula). If φ(x, y) is a first-order formula that represents the current set of states, and ψ(x, y, u, u ) i (x i = e i (x, y, u, u )) is a guarded transition with guard ψ(x, y, u) and assignments x i = e i(x, y, u, u ), 7 then the set of states reached after taking this transition is given by ( x, ȳ, ū, ū ) : [φ( x, ȳ, ū, ū ) ψ( x, ȳ) i (x i = e i ( x, ȳ, ū, ū )) j (x j = x j )]. Note that the x j s in the above formula are all the state and output variables that are left unchanged by the guarded transition. 7 The x i s are state and output variables and the e i s are expressions that can contain variables x, y, u, and u. The expression e i evaluates to a value of the same type as x i. 7

9 the formula φ and (ii) if the result of symbolic propagation starting from the formula φ (logically) implies the formula φ. Both of these tests can be done using a quantifier elimination procedure. In fact, Examples 4 and 5 can also be seen as checking that the formula given as the initial condition is an inductive invariant. Simple invariants on the values of variables can also be specified using types. Richer type system allows specification of more complex relations between the values of different variables. Invariant checking can be used to perform typechecking on such rich type systems. The designer can easily annotate his Simulink/Stateflow model by such type information using additional Simulink blocks. To illustrate that the symbolic propagation method can in fact generate invariants, we consider the thermostat example. Example 6: The thermostat hybrid system discussed in Example 2 can be expressed using guarded transitions. Let us assume that the variables x, x min, x max, and h are state (local) variables declared to be reals. The variable δ is declared to be a real input variable and is constrained to be between 0 and /K. state = off x x min state = on state = on x x max state = off state = on x < x max δ > 0 K δ x = x + δ( K)(x h) state = off x > x min δ > 0 K δ x = x + δ( Kx) The parameters x min, x max, and h could be any real numbers that satisfy the condition 0 < x min < x max < h (this is part of the specification of the problem). We do not explicitly mention this conjunct in the expressions below, but it is implicitly assumed in the computation. Starting with an initial state in which we assume nothing on the value of x and state variables, symbolic simulation gives the following: φ 0 : true φ : ( ( state) : ( ( state) : state = off x x min state = on) state = on x x max state = off ) ( ( x, δ) : state = on x < x max 0 < δ /K x = x Kδ( x h)) ( ( x, δ) : state = off x > x min 0 < δ /K x = x Kδ x) φ : (state = on x x min ) (state = off x x max ) (state = on x < h) (state = off x > 0 ) φ : (state = on x < h) (state = off x > 0 ) We do not show the rest of the computation here, but it can be checked that we get the same formula after the second symbolic simulation step as well. Thus, the set of states represented by φ is an invariant of the system. Note that we can get a stronger invariant if we make a stronger assumption on the parameter δ. As δ is constrained to be in a smaller neighborhood of 0 +, the upper and lower bound on x in the invariant gets closer to x max and x min, so that in the limit, the invariant is (state = on x x max ) (state = off x x min ). We emphasize here that in this computation, no assumption was made on (i) the values for the parameters h, x min, and x max, or (ii) the initial state of the system. F. Abstraction of the Continuous Component An abstraction of a system is any system that exhibits all the behaviors (trajectories) of the original system, possibly more. Abstract systems are usually smaller and are obtained by suitable generalization or pruning of information from the original system. Abstraction is essential for analyzing systems containing a large number of state variables. Since fairly efficient model checking tools are available for searching through a large, but finite, (discrete) state space, one of the challenges in building analysis tools for hybrid systems is to come up with suitable abstractions for the continuous components that are refined enough to suffice for proving the properties of interest. In the most simple form, one could use the most coarse abstraction of the continuous component of a hybrid model. The most coarse and trivial abstraction of any system is the system that accepts all behaviors. This corresponds to having no information about the continuous subsystem. This means that we execute the discrete transitions in a completely nondeterministic environment. The resulting discrete transition system can be model checked, but such an analysis is unlikely to give any useful information about the model. More refined abstractions can be constructed using invariants that are established using the techniques of Section V-E. In general, construction of an abstraction for a transition system involves (i) defining the abstract states: In case of predicate abstraction, certain predicates over the original local, input, and output variables are mapped onto boolean variables (losing information in the process); and (ii) mapping the transitions to abstract transitions: In case of predicate abstraction, this amounts to mapping the guard and assignments of the original system into abstract guards and transitions over the new boolean variables. This requires certain theorem proving capabilities. Invariants are useful in both of the above steps. The atomic formulas that appear in an invariant can be used as predicates that are mapped to new boolean variables. Furthermore, the invariants also help to discharge some of the proof obligations that arise in step (ii) of the above process. Example 7: Controllers for hybrid systems are often designed under a multiobjective setting [2, 36]. Most often, the requirements are that of safety (i.e., all the system trajectories satisfy certain constraints) and efficiency (i.e., optimizing certain other parameters). We showed in Example 6 that the switching law between the two modes of operation of the thermostat control is safe. Now if there is an additional controller hierarchically above the simple mode switching one, which, for example, controls the power of the heater (value of the parameter h) to optimize power consumption, we could verify that by using a suitable abstraction of the original system model. The abstraction 9

10 could be a simple one based on the inductive invariant property we established for the base system in Example 6. The combination of building abstractions using information from the invariants generated by symbolic propagation and model checking the resulting system is a powerful tool chain for scaling the techniques proposed in this paper to larger and more complex embedded control systems. VI. CONCLUSION Much work has been done in the design and analysis of hybrid systems [4,7,4,,7]. This paper is an attempt to develop tools and techniques for performing formal analysis on models that are developed in Simulink and Stateflow. This MathWorks software is one of the leading tool suites available to engineers for designing hybrid and embedded control systems. But the techniques developed in this paper are not specific to this particular input formalism. We have implemented our analysis tools over SAL, which is an intermediate format for representing transition systems, quite independent of any modeling language. We have presented a wide range of formal technologies for hybrid control systems starting from completely automated and invisible techniques like static analysis of simple program properties and symbolic simulation, through extended typechecking, to abstraction and invariant generation. These analysis tools can be embedded into design languages like Stateflow/Simulink to provide greater assurance and quick error detection. Stateflow design language is based on the concept of hierarchical automata from Statecharts [5], but the semantics of Stateflow diagrams is different from the semantics of Statecharts in several ways. There have been efforts at providing semantics to Statecharts [6]. Hierarchical automata were used for this purpose in [30], and a set of several different semantics for Statecharts was given in [37]. Quantifier elimination tools have been used in the hybrid system world in a variety of contexts. Formulas and expressions over the first-order theory of real closed fields arise naturally when linear and non-linear control systems are described. Many problems in control theory can be reduced to finding solutions of systems of polynomial equations, disequations, and inequalities [22]. Quantifier elimination is also used in obtaining decidability results for reachability in safety-critical embedded systems and hybrid systems [26]. Many applications, especially in mechanical engineering and in numerical analysis, lead to formulas with trignometric functions involved [32]. In fact, CAD-based quantifier elimination procedures have been used to solve problems regarding stationarity, stability, and reachability of control system designs [23]. Requiem [3] is a tool for performing exact reachability state set computation for linear systems specified using nilpotent matrices. It uses the quantifier elimination procedure implemented inside Mathematica. The computation of the reach set for parametric inhomogenous linear differential systems is done using implicitization and quantifier elimination in [6]. A finite decomposition of the real space R n into open sets and points such that each partition element preserves a firstorder formula over reals is crucial not only for getting a decision procedure for the first-order theory, but also for obtaining finite abstractions of certain hybrid systems [5]. In fact, a modeltheoretic structure over the reals in which every (first-order) definable subset of R n is a finite union of points and open intervals is called a o-minimal structure. It is shown in [5] that hybrid systems that are definable over some o-minimal structure admit finite abstractions. The class of o-minimal structures over the reals includes structures with richer signatures as well. The transition system we associate with a hybrid system in this paper is different from the usual one. In particular, the transition system that corresponds to the continuous flow in hybrid systems, as defined in in Section III-A, is an approximation and is different from the standard definition, as in [5]. REFERENCES [] R. Alur, C. Courcoubetis, N. Halbwachs, T. A. Henzinger, P.-H. Ho, X. Nicollin, A. Olivero, J. Sifakis, and S. Yovine. The algorithmic analysis of hybrid systems. Theoretical Computer Science, 3(3):3 34, 995. [2] R. Alur and D. Dill. A theory of timed automata. Theoretical Computer Science, 26:3 235, 994. [3] R. Alur, K. Etessami, and M. Yannakakis. Analysis of recursive state machines. In G. Berry, H. Comon, and A. Finkel, editors, Computer Aided Verification, 3th International Conference, CAV 200, Paris, France, July -22, 200, Proceedings, volume 202 of Lecture Notes in Computer Science. Springer, [4] R. Alur, T. Henzinger, and E. D. Sontag (eds.). Hybrid Systems III. Springer-Verlag, Berlin, 996. volume 066 of Lecture Notes in Computer Science. 0 [5] Rajeev Alur, Tom Henzinger, Gerardo Lafferriere, and George J. Pappas. Discrete abstractions of hybrid systems. Proceedings of the IEEE, (2):97 94, July [6] H. Anai and V. Weispfenning. Reach set computations using real quantifier elimination. In M. D. Di Benedetto and A. Sangiovanni-Vincentelli, editors, Hybrid Systems: Computation and Control HSCC 200, volume 2034 of LNCS, pages Springer- Verlag, [7] P. Antsaklis, W. Kohn, A. Nerode, and S. Sastry (eds.). Hybrid Systems II. Springer-Verlag, Berlin, 995. volume 999 of Lecture Notes in Computer Science. 0 [] P. Antsaklis, W. Kohn, A. Nerode, and S. Sastry (eds.). Hybrid Systems IV. Springer-Verlag, Berlin, 997. volume 273 of Lecture Notes in Computer Science. 0 [9] Gérard Berry, Hubert Comon, and Alain Finkel, editors. 0

11 Computer Aided Verification, 3th International Conference, CAV 200, Paris, France, July -22, 200, Proceedings, volume 202 of Lecture Notes in Computer Science. Springer, 200. [0] A. Bouajjani, J. Esparza, and O. Maler. Reachability analysis of pushdown automata: Application to model-checking. In A. W. Mazurkiewicz and J. Winkowski, editors, CON- CUR 97: th International Conference on Concurrency Theory, volume 243 of LNCS, pages Springer- Verlag, [] B. Buchberger, G. E. Collins, M. J. Encarnacion, H. Hong, J. R. Johnson, W. Krandick, R. Loos, A. M. Mandache, A. Neubacher, and H. Vielhaber. SACLIB. user s guide. In RISC-Linz Report Series, Tech Report No Kurt Gödel Institute, saclib/. [2] Alongkrit Chutinam and Bruce H. Krogh. Verification of polyhedral-invariant hybrid automata using polygonal flow pipe approximations. In Frits W. Vaandrager and Jan H. van Schuppen, editors, Hybrid Systems: Computation and Control, volume 569 of LNCS, pages Springer-Verlag, 999. [3] G. E. Collins. Quantifier elimination for the elementary theory of real closed fields by cylindrical algebraic decomposition. In Proc. Second GI Conf. Automata Theory and Formal Languages, pages 34 3, 975. Vol. 33 of Lecture Notes in Comp. Sci., Springer, Berlin. [4] R. L. Grossman, A. Nerode, A. P. Ravn, and H. Rischel (eds.). Hybrid Systems. Springer-Verlag, Berlin, 993. volume 736 of Lecture Notes in Computer Science. 0 [5] D. Harel. Statecharts: A visual formalism for complex systems. Sci. Comput. Program., :23 274, [6] D. Harel and A. Naamad. The statemate semantics of statecharts. ACM Transactions on Software Engineering and Methodology, 5(4): , October [7] T. Henzinger and S. Sastry (eds.). Hybrid Systems: Computation and Control. Springer-Verlag, Berlin, 99. volume 36 of Lecture Notes in Computer Science. 0 [] T. A. Henzinger, P. W. Kopke, A. Puri, and P. Varaiya. What s decidable about hybrid automata? Journal of Computer and System Sciences, 57:94 24, 99. [9] H. Hong. An improvement of the projection operator in cylindrical algebraic decomposition. In Proc. ISAAC 90, pages , 990. [20] H. Hong. Quantifier elimination in elementary algebra and geometry by partial cylindrical algebraic decomposition version 3. In The world wide web, cais/systeme/- saclib, saclib/. [2] Mats Jirstrand. Cylindrical algebraic decomposition - an introduction. Technical Report LiTH-ISY-R-07, Dept of EE. Linköping University, S-5 3 Linköping, Sweden, Dec 995. Available by anonumous ftp at ftp.control.ee.liu.se. [22] Mats Jirstrand. Algebraic methods for modeling and design in control. Licentiate thesis LIU-TEK-LIC-996:05 Linkping Studies in Science and Technology. Thesis No 540, Department of Electrical Engineering, Li, [23] Mats Jirstrand. Nonlinear control system design by quantifier elimination. Journal of Symbolic Computation, 24(2):37 52, Aug [24] Warren A. Hunt Jr. and Steven D. Johnson, editors. Formal Methods in Computer-Aided Design, Third International Conference, FMCAD 2000, Austin, Texas, USA, November -3, 2000, Proceedings, volume 954 of Lecture Notes in Computer Science. Springer, [25] G. Lafferriere, G. J. Pappas, and S. Sastry. O-minimal hybrid systems. Mathematics of Control, Signals, and Systems, 3(): 2, [26] Gerardo Lafferriere, George J. Pappas, and Sergio Yovine. Symbolic reachability computations for families of linear vector fields. J. Symbolic Computation, 200. To appear. 0 [27] D. Lazard. An improved projection for cylindrical algebraic decomposition. Technical Report, Informatique, Universite Paris IV, F Paris Cedex 05, France, 990. [2] John Lygeros, Claire Tomlin, and Shankar Sastry. Controllers for reachability specifications for hybrid systems.

12 Automatica, Special Issue on Hybrid Systems, 35(3), March [29] S. McCallum. An improved projection operator for cylindrical algebraic decomposition of three dimensional space. J. Symbolic Computation, 5:4 6, 9. [30] E. Mikk, Y. Lakhnech, and M. Siegel. Hierarchical automata as model for statecharts. In Asian Computing Science Conference (ASIAN 97), volume 345 of LNCS. Springer-Verlag, [3] P. Mishra and G. J. Pappas. Reachability using quantifier elimination. In University of Pennsylvania hybrid systems group webpage, [32] Petru Pau and Josef Schicho. Quantifier elimination for trignometric polynomials by cylindrical algebraic trignometric decomposition. Research Institute for Symbolic Computation, Johannes Kepler University, A-4040 Linz, Austria, [33] A. Pnueli. The temporal logic of programs. In Proceedings of the th annual symposium on foundations of computer science, pages IEEE computer society press, [34] A. Puri and P. Varaiya. Driving safely in smart cars. In Proceedings of the 995 American Control Conference, [35] A. Tiwari, H. Rueß, H. Saïdi, and N. Shankar. A technique for invariant generation. In Tiziana Margaria and Wang Yi, editors, TACAS Tools and Algorithms for the Construction and Analysis of Systems, volume 203 of LNCS, pages 3 27, Genova, Italy, April 200. Springer-Verlag. [36] Claire Tomlin, John Lygeros, and Shankar Sastry. Synthesizing controllers for nonlinear hybrid systems. In S. Sastry and T. Henzinger, editors, Hybrid Systems: Computation and Control, volume 36 of LNCS, pages Springer-Verlag, [37] M. von der Beek. A comparison of stateflow variants. In L. de Roever and J. Vytopil, editors, Formal techniques in real-time and fault tolerant systems, volume 63 of LNCS, pages 2 4. Springer-Verlag,

### Simulink for System and Algorithm Modeling Introduction to System Modeling

2015 The MathWorks, Inc. Simulink for System and Algorithm Modeling Introduction to System Modeling Outline 2-2 Model-Based Design Types of modeling System modeling with Simulink Modeling steps Model-Based

### Using the Theory of Reals in. Analyzing Continuous and Hybrid Systems

Using the Theory of Reals in Analyzing Continuous and Hybrid Systems Ashish Tiwari Computer Science Laboratory (CSL) SRI International (SRI) Menlo Park, CA 94025 Email: ashish.tiwari@sri.com Ashish Tiwari

### o-minimality and Uniformity in n 1 Graphs

o-minimality and Uniformity in n 1 Graphs Reid Dale July 10, 2013 Contents 1 Introduction 2 2 Languages and Structures 2 3 Definability and Tame Geometry 4 4 Applications to n 1 Graphs 6 5 Further Directions

### Introducing Formal Methods. Software Engineering and Formal Methods

Introducing Formal Methods Formal Methods for Software Specification and Analysis: An Overview 1 Software Engineering and Formal Methods Every Software engineering methodology is based on a recommended

### From Hybrid Data-Flow Languages to Hybrid Automata: A Complete Translation

From Hybrid Data-Flow Languages to Hybrid Automata: A Complete Translation Peter Schrammel peter.schrammel@inria.fr (joint work with Bertrand Jeannet) INRIA Grenoble Rhône-Alpes INRIA large-scale initiative

### Formal Verification Coverage: Computing the Coverage Gap between Temporal Specifications

Formal Verification Coverage: Computing the Coverage Gap between Temporal Specifications Sayantan Das Prasenjit Basu Ansuman Banerjee Pallab Dasgupta P.P. Chakrabarti Department of Computer Science & Engineering

### Model Checking: An Introduction

Announcements Model Checking: An Introduction Meeting 2 Office hours M 1:30pm-2:30pm W 5:30pm-6:30pm (after class) and by appointment ECOT 621 Moodle problems? Fundamentals of Programming Languages CSCI

### Coverability for Parallel Programs

2015 http://excel.fit.vutbr.cz Coverability for Parallel Programs Lenka Turoňová* Abstract We improve existing method for the automatic verification of systems with parallel running processes. The technique

### StateFlow Hands On Tutorial

StateFlow Hands On Tutorial HS/PDEEC 2010 03 04 José Pinto zepinto@fe.up.pt Session Outline Simulink and Stateflow Numerical Simulation of ODEs Initial Value Problem (Hands on) ODEs with resets (Hands

### A Static Analyzer for Large Safety-Critical Software. Considered Programs and Semantics. Automatic Program Verification by Abstract Interpretation

PLDI 03 A Static Analyzer for Large Safety-Critical Software B. Blanchet, P. Cousot, R. Cousot, J. Feret L. Mauborgne, A. Miné, D. Monniaux,. Rival CNRS École normale supérieure École polytechnique Paris

### Testing LTL Formula Translation into Büchi Automata

Testing LTL Formula Translation into Büchi Automata Heikki Tauriainen and Keijo Heljanko Helsinki University of Technology, Laboratory for Theoretical Computer Science, P. O. Box 5400, FIN-02015 HUT, Finland

### Simulation-Based Security with Inexhaustible Interactive Turing Machines

Simulation-Based Security with Inexhaustible Interactive Turing Machines Ralf Küsters Institut für Informatik Christian-Albrechts-Universität zu Kiel 24098 Kiel, Germany kuesters@ti.informatik.uni-kiel.de

### InvGen: An Efficient Invariant Generator

InvGen: An Efficient Invariant Generator Ashutosh Gupta and Andrey Rybalchenko Max Planck Institute for Software Systems (MPI-SWS) Abstract. In this paper we present InvGen, an automatic linear arithmetic

### Reliability Guarantees in Automata Based Scheduling for Embedded Control Software

1 Reliability Guarantees in Automata Based Scheduling for Embedded Control Software Santhosh Prabhu, Aritra Hazra, Pallab Dasgupta Department of CSE, IIT Kharagpur West Bengal, India - 721302. Email: {santhosh.prabhu,

### Specification and Analysis of Contracts Lecture 1 Introduction

Specification and Analysis of Contracts Lecture 1 Introduction Gerardo Schneider gerardo@ifi.uio.no http://folk.uio.no/gerardo/ Department of Informatics, University of Oslo SEFM School, Oct. 27 - Nov.

### Software Verification: Infinite-State Model Checking and Static Program

Software Verification: Infinite-State Model Checking and Static Program Analysis Dagstuhl Seminar 06081 February 19 24, 2006 Parosh Abdulla 1, Ahmed Bouajjani 2, and Markus Müller-Olm 3 1 Uppsala Universitet,

### Feasibility of a Software Process Modeling Library based on MATLAB / Simulink

Feasibility of a Software Process Modeling Library based on MATLAB / Simulink T. Birkhoelzer University of Applied Sciences Konstanz, Braunegger Str. 55, 7846 Konstanz, Germany, birkhoelzer@fh-kontanz.de

### Discrete Mathematics, Chapter 5: Induction and Recursion

Discrete Mathematics, Chapter 5: Induction and Recursion Richard Mayr University of Edinburgh, UK Richard Mayr (University of Edinburgh, UK) Discrete Mathematics. Chapter 5 1 / 20 Outline 1 Well-founded

Computing and Informatics, Vol. 20, 2001,????, V 2006-Nov-6 UPDATES OF LOGIC PROGRAMS Ján Šefránek Department of Applied Informatics, Faculty of Mathematics, Physics and Informatics, Comenius University,

### Formal Engineering for Industrial Software Development

Shaoying Liu Formal Engineering for Industrial Software Development Using the SOFL Method With 90 Figures and 30 Tables Springer Contents Introduction 1 1.1 Software Life Cycle... 2 1.2 The Problem 4 1.3

### Formal Languages and Automata Theory - Regular Expressions and Finite Automata -

Formal Languages and Automata Theory - Regular Expressions and Finite Automata - Samarjit Chakraborty Computer Engineering and Networks Laboratory Swiss Federal Institute of Technology (ETH) Zürich March

### CHAPTER 7 GENERAL PROOF SYSTEMS

CHAPTER 7 GENERAL PROOF SYSTEMS 1 Introduction Proof systems are built to prove statements. They can be thought as an inference machine with special statements, called provable statements, or sometimes

### Verification of hybrid dynamical systems

Verification of hybrid dynamical systems Jüri Vain Tallinn Technical University/Institute of Cybernetics vain@ioc.ee Outline What are Hybrid Systems? Hybrid automata Verification of hybrid systems Verification

### Formal Verification of Software

Formal Verification of Software Sabine Broda Department of Computer Science/FCUP 12 de Novembro de 2014 Sabine Broda (DCC-FCUP) Formal Verification of Software 12 de Novembro de 2014 1 / 26 Formal Verification

### Fabio Patrizi DIS Sapienza - University of Rome

Fabio Patrizi DIS Sapienza - University of Rome Overview Introduction to Services The Composition Problem Two frameworks for composition: Non data-aware services Data-aware services Conclusion & Research

### Generating models of a matched formula with a polynomial delay

Generating models of a matched formula with a polynomial delay Petr Savicky Institute of Computer Science, Academy of Sciences of Czech Republic, Pod Vodárenskou Věží 2, 182 07 Praha 8, Czech Republic

### µz An Efficient Engine for Fixed points with Constraints

µz An Efficient Engine for Fixed points with Constraints Kryštof Hoder, Nikolaj Bjørner, and Leonardo de Moura Manchester University and Microsoft Research Abstract. The µz tool is a scalable, efficient

### Approximation Algorithms

Approximation Algorithms or: How I Learned to Stop Worrying and Deal with NP-Completeness Ong Jit Sheng, Jonathan (A0073924B) March, 2012 Overview Key Results (I) General techniques: Greedy algorithms

### Monitoring Metric First-order Temporal Properties

Monitoring Metric First-order Temporal Properties DAVID BASIN, FELIX KLAEDTKE, SAMUEL MÜLLER, and EUGEN ZĂLINESCU, ETH Zurich Runtime monitoring is a general approach to verifying system properties at

### Software Verification/Validation Methods and Tools... or Practical Formal Methods

Software Verification/Validation Methods and Tools... or Practical Formal Methods John Rushby Computer Science Laboratory SRI International Menlo Park, CA John Rushby, SR I Practical Formal Methods: 1

### Software Modeling and Verification

Software Modeling and Verification Alessandro Aldini DiSBeF - Sezione STI University of Urbino Carlo Bo Italy 3-4 February 2015 Algorithmic verification Correctness problem Is the software/hardware system

### [Refer Slide Time: 05:10]

Principles of Programming Languages Prof: S. Arun Kumar Department of Computer Science and Engineering Indian Institute of Technology Delhi Lecture no 7 Lecture Title: Syntactic Classes Welcome to lecture

### Chapter 4 Software Lifecycle and Performance Analysis

Chapter 4 Software Lifecycle and Performance Analysis This chapter is aimed at illustrating performance modeling and analysis issues within the software lifecycle. After having introduced software and

### Scheduling Real-time Tasks: Algorithms and Complexity

Scheduling Real-time Tasks: Algorithms and Complexity Sanjoy Baruah The University of North Carolina at Chapel Hill Email: baruah@cs.unc.edu Joël Goossens Université Libre de Bruxelles Email: joel.goossens@ulb.ac.be

### Two General Methods to Reduce Delay and Change of Enumeration Algorithms

ISSN 1346-5597 NII Technical Report Two General Methods to Reduce Delay and Change of Enumeration Algorithms Takeaki Uno NII-2003-004E Apr.2003 Two General Methods to Reduce Delay and Change of Enumeration

### Formal Verification Methods 3: Model Checking

Formal Verification Methods 3: Model Checking John Harrison Intel Corporation Marktoberdorf 2003 Fri 1st August 2003 (11:25 12:10) This presentation was not given in Marktoberdorf since it mostly duplicates

### The Graphical Method: An Example

The Graphical Method: An Example Consider the following linear program: Maximize 4x 1 +3x 2 Subject to: 2x 1 +3x 2 6 (1) 3x 1 +2x 2 3 (2) 2x 2 5 (3) 2x 1 +x 2 4 (4) x 1, x 2 0, where, for ease of reference,

### A simple existence criterion for normal spanning trees in infinite graphs

1 A simple existence criterion for normal spanning trees in infinite graphs Reinhard Diestel Halin proved in 1978 that there exists a normal spanning tree in every connected graph G that satisfies the

### 4. Factor polynomials over complex numbers, describe geometrically, and apply to real-world situations. 5. Determine and apply relationships among syn

I The Real and Complex Number Systems 1. Identify subsets of complex numbers, and compare their structural characteristics. 2. Compare and contrast the properties of real numbers with the properties of

### 24. The Branch and Bound Method

24. The Branch and Bound Method It has serious practical consequences if it is known that a combinatorial problem is NP-complete. Then one can conclude according to the present state of science that no

### Offline sorting buffers on Line

Offline sorting buffers on Line Rohit Khandekar 1 and Vinayaka Pandit 2 1 University of Waterloo, ON, Canada. email: rkhandekar@gmail.com 2 IBM India Research Lab, New Delhi. email: pvinayak@in.ibm.com

### A Tool for Generating Partition Schedules of Multiprocessor Systems

A Tool for Generating Partition Schedules of Multiprocessor Systems Hans-Joachim Goltz and Norbert Pieth Fraunhofer FIRST, Berlin, Germany {hans-joachim.goltz,nobert.pieth}@first.fraunhofer.de Abstract.

### A first step towards modeling semistructured data in hybrid multimodal logic

A first step towards modeling semistructured data in hybrid multimodal logic Nicole Bidoit * Serenella Cerrito ** Virginie Thion * * LRI UMR CNRS 8623, Université Paris 11, Centre d Orsay. ** LaMI UMR

### Theory of Computation Prof. Kamala Krithivasan Department of Computer Science and Engineering Indian Institute of Technology, Madras

Theory of Computation Prof. Kamala Krithivasan Department of Computer Science and Engineering Indian Institute of Technology, Madras Lecture No. # 31 Recursive Sets, Recursively Innumerable Sets, Encoding

### 1 Definition of a Turing machine

Introduction to Algorithms Notes on Turing Machines CS 4820, Spring 2012 April 2-16, 2012 1 Definition of a Turing machine Turing machines are an abstract model of computation. They provide a precise,

### Scalable Automated Symbolic Analysis of Administrative Role-Based Access Control Policies by SMT solving

Scalable Automated Symbolic Analysis of Administrative Role-Based Access Control Policies by SMT solving Alessandro Armando 1,2 and Silvio Ranise 2, 1 DIST, Università degli Studi di Genova, Italia 2 Security

### Notes on Complexity Theory Last updated: August, 2011. Lecture 1

Notes on Complexity Theory Last updated: August, 2011 Jonathan Katz Lecture 1 1 Turing Machines I assume that most students have encountered Turing machines before. (Students who have not may want to look

### Rigorous Software Development CSCI-GA 3033-009

Rigorous Software Development CSCI-GA 3033-009 Instructor: Thomas Wies Spring 2013 Lecture 11 Semantics of Programming Languages Denotational Semantics Meaning of a program is defined as the mathematical

### An example of a computable

An example of a computable absolutely normal number Verónica Becher Santiago Figueira Abstract The first example of an absolutely normal number was given by Sierpinski in 96, twenty years before the concept

### Introduction to Flocking {Stochastic Matrices}

Supelec EECI Graduate School in Control Introduction to Flocking {Stochastic Matrices} A. S. Morse Yale University Gif sur - Yvette May 21, 2012 CRAIG REYNOLDS - 1987 BOIDS The Lion King CRAIG REYNOLDS

### Regular Expressions and Automata using Haskell

Regular Expressions and Automata using Haskell Simon Thompson Computing Laboratory University of Kent at Canterbury January 2000 Contents 1 Introduction 2 2 Regular Expressions 2 3 Matching regular expressions

### Continuous first-order model theory for metric structures Lecture 2 (of 3)

Continuous first-order model theory for metric structures Lecture 2 (of 3) C. Ward Henson University of Illinois Visiting Scholar at UC Berkeley October 21, 2013 Hausdorff Institute for Mathematics, Bonn

### Cost Model: Work, Span and Parallelism. 1 The RAM model for sequential computation:

CSE341T 08/31/2015 Lecture 3 Cost Model: Work, Span and Parallelism In this lecture, we will look at how one analyze a parallel program written using Cilk Plus. When we analyze the cost of an algorithm

### each college c i C has a capacity q i - the maximum number of students it will admit

n colleges in a set C, m applicants in a set A, where m is much larger than n. each college c i C has a capacity q i - the maximum number of students it will admit each college c i has a strict order i

### Using Separation of Concerns for Embedded Systems Design. α=90

Using Separation of Concerns for Embedded Systems Design α=90 Ethan Jackson and Janos Sztipanovits EmSoft 05, Jersey City, New Jersey September 19, 2005 Part I Outline Introduction: Discuss major design

### Theory of Computation

Theory of Computation For Computer Science & Information Technology By www.thegateacademy.com Syllabus Syllabus for Theory of Computation Regular Expressions and Finite Automata, Context-Free Grammar s

### 2. Methods of Proof Types of Proofs. Suppose we wish to prove an implication p q. Here are some strategies we have available to try.

2. METHODS OF PROOF 69 2. Methods of Proof 2.1. Types of Proofs. Suppose we wish to prove an implication p q. Here are some strategies we have available to try. Trivial Proof: If we know q is true then

### Lecture 2: Universality

CS 710: Complexity Theory 1/21/2010 Lecture 2: Universality Instructor: Dieter van Melkebeek Scribe: Tyson Williams In this lecture, we introduce the notion of a universal machine, develop efficient universal

### The Halting Problem is Undecidable

185 Corollary G = { M, w w L(M) } is not Turing-recognizable. Proof. = ERR, where ERR is the easy to decide language: ERR = { x { 0, 1 }* x does not have a prefix that is a valid code for a Turing machine

### OPRE 6201 : 2. Simplex Method

OPRE 6201 : 2. Simplex Method 1 The Graphical Method: An Example Consider the following linear program: Max 4x 1 +3x 2 Subject to: 2x 1 +3x 2 6 (1) 3x 1 +2x 2 3 (2) 2x 2 5 (3) 2x 1 +x 2 4 (4) x 1, x 2

### Order 2 Tree-Automatic Graphs

Order 2 Tree-Automatic Graphs (work in progress) Antoine Meyer (UPEM) Joint work with Arnaud Carayol (CNRS, UPEM) Automatic Presentations of Graphs and Numbers IMSc, 11/10/2016 Antoine Meyer Order 2 Tree-Automatic

### Chair of Software Engineering. Software Verification. Assertion Inference. Carlo A. Furia

Chair of Software Engineering Software Verification Assertion Inference Carlo A. Furia Proving Programs Automatically The Program Verification problem: Given: a program P and a specification S = [Pre,

### Algorithmic Software Verification

Algorithmic Software Verification (LTL Model Checking) Azadeh Farzan What is Verification Anyway? Proving (in a formal way) that program satisfies a specification written in a logical language. Formal

### Opus: University of Bath Online Publication Store http://opus.bath.ac.uk/

England, M. (2014) Formulating problems for real algebraic geometry. In: UNSPECIFIED. Link to official URL (if available): Opus: University of Bath Online Publication Store http://opus.bath.ac.uk/ This

### Fixed-Point Logics and Computation

1 Fixed-Point Logics and Computation Symposium on the Unusual Effectiveness of Logic in Computer Science University of Cambridge 2 Mathematical Logic Mathematical logic seeks to formalise the process of

### Reducing Clocks in Timed Automata while Preserving Bisimulation

Reducing Clocks in Timed Automata while Preserving Bisimulation Shibashis Guha Chinmay Narayan S. Arun-Kumar Indian Institute of Technology Delhi {shibashis, chinmay, sak}@cse.iitd.ac.in arxiv:1404.6613v2

### CMSC 858T: Randomized Algorithms Spring 2003 Handout 8: The Local Lemma

CMSC 858T: Randomized Algorithms Spring 2003 Handout 8: The Local Lemma Please Note: The references at the end are given for extra reading if you are interested in exploring these ideas further. You are

### Safety Verification of the Small Aircraft Transportation System Concept of Operations

Safety Verification of the Small Aircraft Transportation System Concept of Operations Victor Carreño 1 NASA Langley Research Center, Hampton, Virginia, 23681 César Muñoz 2 National Institute of Aerospace,

### The Trip Scheduling Problem

The Trip Scheduling Problem Claudia Archetti Department of Quantitative Methods, University of Brescia Contrada Santa Chiara 50, 25122 Brescia, Italy Martin Savelsbergh School of Industrial and Systems

### Development of dynamically evolving and self-adaptive software. 1. Background

Development of dynamically evolving and self-adaptive software 1. Background LASER 2013 Isola d Elba, September 2013 Carlo Ghezzi Politecnico di Milano Deep-SE Group @ DEIB 1 Requirements Functional requirements

### ECON20310 LECTURE SYNOPSIS REAL BUSINESS CYCLE

ECON20310 LECTURE SYNOPSIS REAL BUSINESS CYCLE YUAN TIAN This synopsis is designed merely for keep a record of the materials covered in lectures. Please refer to your own lecture notes for all proofs.

### Discrete Optimization

Discrete Optimization [Chen, Batson, Dang: Applied integer Programming] Chapter 3 and 4.1-4.3 by Johan Högdahl and Victoria Svedberg Seminar 2, 2015-03-31 Todays presentation Chapter 3 Transforms using

### A Propositional Dynamic Logic for CCS Programs

A Propositional Dynamic Logic for CCS Programs Mario R. F. Benevides and L. Menasché Schechter {mario,luis}@cos.ufrj.br Abstract This work presents a Propositional Dynamic Logic in which the programs are

### Compliance and Requirement Traceability for SysML v.1.0a

1. Introduction: Compliance and Traceability for SysML v.1.0a This document provides a formal statement of compliance and associated requirement traceability for the SysML v. 1.0 alpha specification, which

### 2.3 Convex Constrained Optimization Problems

42 CHAPTER 2. FUNDAMENTAL CONCEPTS IN CONVEX OPTIMIZATION Theorem 15 Let f : R n R and h : R R. Consider g(x) = h(f(x)) for all x R n. The function g is convex if either of the following two conditions

### Formal Verification by Model Checking

Formal Verification by Model Checking Natasha Sharygina Carnegie Mellon University Guest Lectures at the Analysis of Software Artifacts Class, Spring 2005 1 Outline Lecture 1: Overview of Model Checking

### Mathematics for Computer Science/Software Engineering. Notes for the course MSM1F3 Dr. R. A. Wilson

Mathematics for Computer Science/Software Engineering Notes for the course MSM1F3 Dr. R. A. Wilson October 1996 Chapter 1 Logic Lecture no. 1. We introduce the concept of a proposition, which is a statement

### Bounded Cost Algorithms for Multivalued Consensus Using Binary Consensus Instances

Bounded Cost Algorithms for Multivalued Consensus Using Binary Consensus Instances Jialin Zhang Tsinghua University zhanggl02@mails.tsinghua.edu.cn Wei Chen Microsoft Research Asia weic@microsoft.com Abstract

### Automated Model-Based Testing of Embedded Real-Time Systems

Automated Model-Based Testing of Embedded Real-Time Systems Jan Peleska jp@tzi.de University of Bremen Bieleschweig Workshop 7 2006-05-05 Outline Technologie-Zentrum Informatik Objectives Basic concepts

### Properties of Stabilizing Computations

Theory and Applications of Mathematics & Computer Science 5 (1) (2015) 71 93 Properties of Stabilizing Computations Mark Burgin a a University of California, Los Angeles 405 Hilgard Ave. Los Angeles, CA

### Domain Theory: An Introduction

Domain Theory: An Introduction Robert Cartwright Rebecca Parsons Rice University This monograph is an unauthorized revision of Lectures On A Mathematical Theory of Computation by Dana Scott [3]. Scott

### Class notes Program Analysis course given by Prof. Mooly Sagiv Computer Science Department, Tel Aviv University second lecture 8/3/2007

Constant Propagation Class notes Program Analysis course given by Prof. Mooly Sagiv Computer Science Department, Tel Aviv University second lecture 8/3/2007 Osnat Minz and Mati Shomrat Introduction This

### Static Program Transformations for Efficient Software Model Checking

Static Program Transformations for Efficient Software Model Checking Shobha Vasudevan Jacob Abraham The University of Texas at Austin Dependable Systems Large and complex systems Software faults are major

### The Classes P and NP

The Classes P and NP We now shift gears slightly and restrict our attention to the examination of two families of problems which are very important to computer scientists. These families constitute the

### vertex, 369 disjoint pairwise, 395 disjoint sets, 236 disjunction, 33, 36 distributive laws

Index absolute value, 135 141 additive identity, 254 additive inverse, 254 aleph, 466 algebra of sets, 245, 278 antisymmetric relation, 387 arcsine function, 349 arithmetic sequence, 208 arrow diagram,

### CSE 135: Introduction to Theory of Computation Decidability and Recognizability

CSE 135: Introduction to Theory of Computation Decidability and Recognizability Sungjin Im University of California, Merced 04-28, 30-2014 High-Level Descriptions of Computation Instead of giving a Turing

### Computationally Complete Spiking Neural P Systems Without Delay: Two Types of Neurons Are Enough

Computationally Complete Spiking Neural P Systems Without Delay: Two Types of Neurons Are Enough Rudolf Freund 1 and Marian Kogler 1,2 1 Faculty of Informatics, Vienna University of Technology Favoritenstr.

### Modeling, Verification and Testing using Timed and Hybrid. Automata. Stavros Tripakis and Thao Dang

Modeling, Verification and Testing using Timed and Hybrid Automata Stavros Tripakis and Thao Dang September 12, 2008 ii Contents 1 Modeling, Verification and Testing using Timed and Hybrid Automata 1 1.1

### 1 Error in Euler s Method

1 Error in Euler s Method Experience with Euler s 1 method raises some interesting questions about numerical approximations for the solutions of differential equations. 1. What determines the amount of

### Stochastic Inventory Control

Chapter 3 Stochastic Inventory Control 1 In this chapter, we consider in much greater details certain dynamic inventory control problems of the type already encountered in section 1.3. In addition to the

### Reading 13 : Finite State Automata and Regular Expressions

CS/Math 24: Introduction to Discrete Mathematics Fall 25 Reading 3 : Finite State Automata and Regular Expressions Instructors: Beck Hasti, Gautam Prakriya In this reading we study a mathematical model

### Compact Representations and Approximations for Compuation in Games

Compact Representations and Approximations for Compuation in Games Kevin Swersky April 23, 2008 Abstract Compact representations have recently been developed as a way of both encoding the strategic interactions

### HYBRID SYSTEMS CONTROLLER DESIGN METHODOLOGY

FISITA2010-SC-O-14 HYBRID SYSTEMS CONTROLLER DESIGN METHODOLOGY 1 Pluska Michal*, 1 Sinclair David 1 LERO@DCU i, Dublin City University, School of Computing, Dublin 9, Ireland michal.pluska2@mail.dcu.ie

### Threshold Logic. 2.1 Networks of functions

2 Threshold Logic 2. Networks of functions We deal in this chapter with the simplest kind of computing units used to build artificial neural networks. These computing elements are a generalization of the

### Virtual Time and Timeout in Client-Server Networks

Virtual Time and Timeout in Client-Server Networks Jayadev Misra July 13, 2011 Contents 1 Introduction 2 1.1 Background.............................. 2 1.1.1 Causal Model of Virtual Time...............

### PETRI NET BASED SUPERVISORY CONTROL OF FLEXIBLE BATCH PLANTS. G. Mušič and D. Matko

PETRI NET BASED SUPERVISORY CONTROL OF FLEXIBLE BATCH PLANTS G. Mušič and D. Matko Faculty of Electrical Engineering, University of Ljubljana, Slovenia. E-mail: gasper.music@fe.uni-lj.si Abstract: The

### Degrees of Truth: the formal logic of classical and quantum probabilities as well as fuzzy sets.

Degrees of Truth: the formal logic of classical and quantum probabilities as well as fuzzy sets. Logic is the study of reasoning. A language of propositions is fundamental to this study as well as true

Mathematics 0N1 Solutions 1 1. Write the following sets in list form. 1(i) The set of letters in the word banana. {a, b, n}. 1(ii) {x : x 2 + 3x 10 = 0}. 3(iv) C A. True 3(v) B = {e, e, f, c}. True 3(vi)