Model-Driven Hybrid and Embedded Software for Automotive Applications

Transcription

1 1 Model-Drive Hybrid d Embedded Softwre for Automotive Applictios Aouck R. Girrd, Adm S. Howell d J. Krl Hedrick Abstrct Complex lrge-scle embedded systems rise i my pplictios, i prticulr i the ig of utomotive systems, cotrollers d etworkig protocols. I this pper, we ttempt to preset review of sliet results i modelig of complex lrge scle embedded systems, icludig hybrid systems, d review existig results for compositio, lysis, model checkig, d verifictio of sfety properties. We the preset librry of vehicle models iged for cruise cotrol (d CACC) tht ttempt to cross the chsm betwee theory d prctice by cpturig rel-world chlleges fced by idustry d mkig the librry ccessible i public domi form. Idex Terms Automotive Cotrol, Embedded Softwre, Hybrid Systems, Cotrol Architecture, Model-Drive Softwre R I. INTRODUCTION el-time, embedded systems hve become prevlet i our everydy life. A embedded system is specil-purpose computer system built ito lrger device [6]. Sice my embedded systems re produced i the rge of tes of thousds to millios of uits, reducig cost is mjor cocer. Embedded systems ofte use (reltively) slow processor clock speed d smll memory size to cut costs. Progrms o embedded system ofte must ru with reltime costrits; tht is, lte swer is cosidered wrog swer. Ofte there is o disk drive, opertig system, keybord or scree. Cell phoes, PDA, televisios, wshig mchies, microwve oves d clcultors re ll exmples tht coti embedded processors. Demds plced o the fuctiolity, complexity d criticl ture of embedded systems re ever icresig. Moder-dy utomobiles ow coti my differet processors tht perform fuctios such s egie cotrol, ABS, vehicle stbility d trctio cotrol, d electroic cotrol of power widows, mirrors, d driver-set settigs. Aircrft cotrol systems c be severl orders of mgitude more complicted, due i prt to greter eed for system recofigurtio from missio to missio d fult tolerce requiremets tht iclude hvig triple redudt copies of criticl sesig d ctutio systems. This work ws supported by DARPA/ITO i the MoBIES project (Model- Bsed Itegrtio of Embedded Systems) uder Grt F C A. Girrd d A. Howell re visitig post-doctorl reserchers t the Uiversity of Clifori t Berkeley, Berkeley, CA, 9470 USA (e-mil: ouck@eecs.berkeley.edu, howell@pth.berkeley.edu). J. K. Hedrick is Professor of Mechicl Egieerig t the Uiversity of Clifori t Berkeley, Berkeley, CA, 9470 USA (e-mil: khedrick@me.berkeley.edu ). As expecttios icrese for more complicted embedded systems, the eed for orgized rel-time, embedded softwre developmet processes becomes more proouced. However, curret idustry stdrds fll short of producig high degree of cofidece, reusble code tht fulfills this eed. A lrge pitfll of the curret stte of the rt is tht most bugs re cught i the fil phses of the process, t system itegrtio d testig time. Correctig problems t this stge ofte ivolves modifyig the system requiremets, specifictio or ig, d such chges re costly s they imply sigifict rework of the system. We begi by reviewig curret pproches for the modelig, compositio, lysis d model/property checkig of complex systems. The use of well-uderstood mthemticl modelig frmeworks llows forml verifictio of the system. Cocepts re preseted usig the simplest formlism possible to develop ituitios, d for extesios the reder is ivited to cosult the refereces. We the proceed to preset model-bsed process tht plces strog emphsis o performig s much testig d verifictio i tight-loops s possible. Thus we hope to ctch bugs erly o i the developmet process d miimize costs ssocited with fixig the problems. We choose to frme our models d cotrollers i the cotext of hybrid utomt which llows forml verifictio of the cotroller usig third prty tools. Furthermore, timig properties of the softwre c be verified with dditiol iformtio bout the experimetl pltform. This gives us high degree of cofidece i the performce of the geerted code. We lso preset librry of models tht hve icresig complexity d were developed i the cotext of itelliget cruise cotrol pplictios. These models rge from lier double-itegrtor vehicle model to eleve cotiuous stte composed hybrid model tht ws used for simultios d implemettio of ACC/CACC system o experimetl vehicles. II. MODELING AND ANALYSIS OF COMPLEX LARGE-SCALE SYSTEMS A comprehesive review of ll vilble methods for the modelig d lysis of complex systems is beyod the scope of this pper. My techiques re vilble d c be brodly clssified i rge of icresig complexity of system fetures to be modeled, strtig from stte mchies, d goig o to lbeled stte mchies, I/O utomt, compositio, timed systems, hybrid systems d dymic etworks of hybrid utomt. For comprehesive review, the iterested reder is referred to [3].

2 I very geerl wy, we cosider systems tht c be cribed s begiig i strtig stte d progress from stte to stte i discrete jumps ccordig to set of specified rules. I geerl, systems re odetermiistic, tht is, the ext stte might ot lwys be determied by the previous stte. There might be explicit choice poits, for exmple i lgorithm; or there just might be differet orders i which thigs c be doe. The bsic mthemticl model to cribe complex systems is clled stte mchie. A stte mchie [] is formed of set of sttes Q, set of llowble strtig sttes Q 0, d set of llowed trsitios betwee sttes δ. A executio of stte mchie is (possibly ifiite) sequece of sttes such tht the iitil stte q 0 is i the set of llowble strtig sttes, d for ech stte q i i the sequece, the trsitio from q i to q i+1 is i δ. Oe useful property to uderstd the behvior of system is to study which sttes c be reched i its executios. A stte is sid to be rechble if it s the fil stte i some fiitelegth executio. The Mthworks Stteflow toolbox [8] is tool to visully model d simulte complex systems bsed o fiite stte mchie theory. Provig versus testig or simultio Provig properties (such s correctess or sfety properties) of system is quite differet from simple testig or simultio. Sice most complex systems operte i the rel world, they re fced with very lrge (whe ot ifiite) umber of iputs; exhustive testig is rrely possible, d prtil testig does ot gurtee proper behvior of the system for those iputs tht were ot tested. Proofs of complex system properties re plyig growig role i ssurig qulity, for criticl or med systems [5]. Proofs for stte mchies There re umber of thigs tht c be prove bout systems tht re modeled s stte mchies [1], such s: Ivrit properties (some predicte of the stte vribles is true i ll rechble sttes) Evetulity properties (evetully = b) Time boud properties (fter T steps, some predicte or property is true) These properties re so importt tht people hve developed lguges for expressig them d computer progrms to check for them. Ivrit properties c be used to cribe properties tht re lwys true, o mtter how the system behves. This c be useful to prove bsic correctess properties for systems. Ivrit proofs ofte use mthemticl iductio. Ivrit d evetulity properties c be used to chrcterize sfety (for exmple, the distce betwee two vehicles is ever egtive, or stedy-stte is reched i cotroller). Sfety properties re sometimes cribed s those which re fiitely refutble; tht is, if behvior does ot stisfy the property, the oe c tell who took the step tht violted it. Other properties tht oe my wish to prove re true re tht the executios termite, or tht they fiish i some fixed mout of time. These properties re dubbed termitio properties. Bsic defiitios of sfety vs. liveess c be foud i [4]. Severl model checkig tools c be used to prove liveess, ivrit d evetulity properties [11-1]. Compositio of systems modeled s stte mchies Some systems re too big or complicted to model s sigle stte mchie: oe eeds to brek the criptio ito pieces, usig either bstrctio (givig high-level criptio of systems, the seprtely, implemetig the high-level criptio usig low-level elemets), or compositio (buildig ll the compoets seprtely out of idividul specifictios, the puttig them ll together) [13]. To decompose systems, we ugmet the stte mchie models cosidered previously with lbels cribig iputs, outputs, d iterl prts of system. Iterl vribles cot be used by other compoets, d exterlly visible behvior is determied by the reltioship betwee iputs d outputs. A slightly more geerl costruct th lbeled stte mchies is I/O utomt, which re odetermiistic, ifiite stte mchies whose iputs d outputs ctios re lbeled [1]. A compoet is sid to implemet other if their exterlly observble behvior is the sme, so tht oe compoet c be substituted for other i lrger system. I dditio, compositio refers to the otio tht two compoets c operte i prllel d iterct. Whe two compoets iterct, ll tht ech sees bout the other is its exterlly visible behvior. Compositio llows oe to uderstd the behvior of lrge system oce oe uderstds the behvior of ech of the idividul compoets. A geerl priciple for prllel compositio ppers i [14]. The Pi-clculus, which is lgebr tht ccommodtes my kids of combitio opertors, is cribed i [15]. Timed Systems I the cotext of rel-time, embedded systems, oe eeds to icorporte otio of time i the modelig. Severl modelig formlisms hve bee proposed, icludig timed I/O utomt [1], rective systems [16] (which c idetify tht oe evets occurs before other, but ot by how much), time trsitio systems [17] (i which time stmp is ffixed to ech stte i computtio), d clocked trsitio systems [18] (timers icrese uiformly whe time progresses, d c be reset rbitrrily o trsitios). Model checkig tools re vilble for timed systems [18]. Hybrid Systems A hybrid system llows the iclusio of cotiuous compoets i timed system. Such cotiuous compoets my cuse cotiuous chges i the vlues of some stte vribles ccordig to some physicl or cotrol lw. Formlly, hybrid utomto cosists of cotrol loctios with edges betwee them. The cotrol loctios re the vertices i grph. A loctio is lbeled with differetil iclusio, d every edge is lbeled with gurd, jump d reset coditio. A hybrid utomto is H = (L, D, E) where: L is set of cotrol loctios D: L Iclusios where D(l) is the differetil iclusio t loctio l.

3 3 E L x Gurds x Jumps x L re the edges edge e = (l,g,j,m) E is d edge from loctio l to loctio m with gurd g d jump reltio j. The stte of hybrid utomto is pir (l,x) where l is the cotrol loctio d x R is the cotiuous stte. Modelig frmeworks d verifictio tools for hybrid utomt re vilble from [19-7]. Dymic Networks of Hybrid Automt (DNHA) iclude the dymic cretio of hybrid utomt, which the get composed with previously existig hybrid utomt. III. REAL-WORLD CHALLENGES: MODEL-DRIVEN DEVELOPMENT PROCESS Our model-drive process, s show i figure 1, plces strog emphsis o performig s much testig d verifictio i tight-loops s possible. Thus we hope to ctch bugs erly o i the developmet process d miimize cost ssocited with fixig the problems. We choose to frme our models d cotrollers i the cotext of hybrid utomt. This is the most useful modelig formlism for us, s we re modelig physicl processes tht re govered by differetil equtios, such s positio d speed of the vehicles, i dditio to modelig time. Simultio d rel-time code geertio re coducted usig the TEJA softwre suite [9]. Sfety properties re verified o simple models (icludig the distce betwee the two vehicles is ever strictly less th zero ) [10], d timig properties of the code re lyzed usig schedulbility lysis [9]. Plt Librry Util HSIF mtures Simultio CA Hybrid System Verifictio Third prty tools CC C++ code QNX Low-level C code Device drivers P/S dtbse QNX Mchie QNX Mchie Schedulbility Alysis Third prty tools Cr, Petiums Figure 1. Itelliget cruise cotrol softwre developmet process. This developmet process ws coceived i joit effort betwee the Uiversity of Clifori t Berkeley, Ford Scietific Reserch Lbortories d Geerl Motors. The pproch is pplied to Adptive Cruise Cotrol (ACC) d Coopertive ACC systems. IV. THE VV LIBRARIES We preset set of four levels of models for vehicle-tovehicle (VV) cotrol (tht is, for vehicle followig pplictios d logitudil cotrol of vehicles, such s cruise cotrol, ACC d CACC). The gol of this set of models is to preset rge of models dequte for model cofigurtio, compositio, checkig d lysis usig vriety of tools, with relevce to VV problems. I the first three levels of modelig, we hve two types of utomt, oe for the vehicle model, d oe for the vehicle cotroller. We crete two istces of ech, to hve two full vehicles (model + cotroller) i our scerio. Ech vehicle is ssumed to hve idel forwrd lookig sesor (FLS) tht c detect vehicle withi specified mximum rge d mesure both the rge d rge rte of the detected vehicle. A idel commuictios chel with y surroudig vehicle is lso ssumed to llow kowledge of every vehicle s ccelertio. Lier models Vehicle Model The model of the vehicle dymics is give by the followig secod order cotiuous dymic system, x& = v 1 v& = ( u v) where x d v re positio d velocity of the vehicle, u is the cotrol iput give by the cotroller, d is the time costt of the vehicle s velocity dymics. Vehicle Cotroller The cotroller is cribed by hybrid utomto with two sttes: velocity followig d distce-followig. The iitil stte of the cotroller is the velocity followig stte, where the cotroller trcks fixed ired velocity usig the discrete time cotrol lw, u[ = v[ + ( v v[ ) where u[ d v[ re the cotrol iput d velocity mesuremet t the curret time step, d re the kow time costt of the model d the ired dymics, d v is the ired velocity. Note tht the cotroller rus t fixed smple time, d the cotrol is essetilly pssed through zero-order hold to geerte the cotiuous time cotrol iput used i the vehicle model. The cotroller will remi withi this stte util other vehicle is detected by the FLS, fter which the cotroller will trsitio to the distce followig stte. DFCotrolCycle/- BecomeFollower/- VFCotrolCycle/- VelocityFollowig DistceFollowig BecomeFreeAget/- Figure : Simple CC/CACC cotroller. I the distce followig stte, the cotrol iput is computed usig the discrete time cotrol lw, u[ = v[ + ( [ + ζω δ[ + ω. ( δ[ δ ))

4 4 where is the edig vehicles ccelertio kow vi commuictios, & δ [ d δ re the rge rte d rge mesured by the FLS, ζ d ω re cotroller prmeters tht determie the closed loop dymics, d δ is the ired iter-vehicle spcig. Similr to bove, the cotroller will remi i this stte util there is o vehicle detected by the FLS, fter which the cotroller will trsitio bck to the velocity followig stte. Figure 3: Rge betwee vehicles 1 d, with =0.5s, v =0 d 1 m/s, ζ =1, ω =0.71, δ mx =1s, δ =40m, =10m, T =0.0s, d s ( x, v 0 0 ) beig (0,19) d (60, ). Nolier models Vehicle model A model of vehicle powertri dymics ws derived for this exmple d is give by the followig secod order cotiuous dymic system, x& = hr * ωe v& = hr * & ωe where: ω& ( * e = kuu Ch R ωe hr * Froll ) J eff x d v re positio d velocity of the vehicle, u is the cotrol iput give by the cotroller, C is the vehicle drg coefficiet, F is the tire rollig resistce, R * is the roll opertig ger rtio, h is the wheel rdius, ω e is the egie speed, d ku is the cotrol coefficiet. The totl momet of ierti is give by the followig equtio, J I + R * I + h R * M eff = e ω I e d I ω re the momet of iertis for the egie where d wheel respectively, d M is the vehicle mss. The cotroller is cribed by hybrid utomto with two sttes: velocity followig d distce followig. The iitil stte of the cotroller is the velocity followig stte, where the cotroller trcks fixed ired velocity usig the discrete time cotrol lw, 1 J eff sy u [ = ( ChR * v[ + + hr * Froll ) ku hr * where v v[ sy = u[ d v[ re the cotrol iput d velocity mesuremet t the curret time step, d is the kow time costt of the model d the ired dymics, d v is the ired velocity. Note tht the cotroller rus t fixed smple time, d the cotrol is essetilly pssed through zero-order hold to geerte the cotiuous time cotrol iput used i the vehicle model. The cotroller will remi withi this stte util other vehicle is detected by the FLS, fter which the cotroller will trsitio to the distce followig stte. I the distce followig stte, the cotrol iput is computed usig the discrete time cotrol lw, 1 J ( [ ] [ ] ( [ ] )) eff k + ζω δ k + ω δ k δ u [ = ( ChR * v[ + + hr * F k hr * u where is the edig vehicles ccelertio kow vi commuictios, & δ [ d δ re the rge rte d rge mesured by the FLS, ζ d ω re cotroller prmeters tht determie the closed loop dymics, d δ is the ired iter-vehicle spcig. Similr to bove, the cotroller will remi i this stte util there is o vehicle detected by the FLS, fter which the cotroller will trsitio bck to the velocity followig stte. Nolier models with look-up-tbles A look-up tble ws dded to the vehicle models to ccommodte for vrible gerig bsed o speed. Complex model The vehicle model used for cotroller developmet is complex model, which iclu vehicle stte dymics, throttle d brke system dymics, two-stte model for the sprk-igitio egie s preseted i [8], icludig exterl dt mps which require iterpoltio, d models of the torque coverter, trsmissio d wheel slip, s show i figure 4.. roll ) Vehicle Cotroller

5 P P ω m 00 m e ω Throttle 1 C.T. Stte represetig throttle dymics. Vehicle Stte Dymics C.T. Sttes: Positio, Velocity. Iclu vehicle mss, ir drg, rollig resistce, etc. Brkes 1 C.T. Stte represetig time respose lg Experimetl Results The geerted softwre for CC, ACC d CACC ws ru o experimetl test vehicles operted by Clifori PATH. The experimetl vehicles re 1996 d 1997 model-yer Buick LeSbres. Sprk Igitio Egie Uses -stte C.T. olier model: ω, m& 3 Exterl Dt Mps re used which require both 1 d -d iterpoltio. Torque Coverter No C.T. sttes. Hybrid sttes: Coupled & Ucoupled Trsmissio Discrete trsitios re tke durig ger chges bsed o vehicle speed. Abrupt ger chges cuse brupt ger rtio chges, so filter is dded which iclu 1 C.T. stte. Wheel Slip Model Models the tire slip dymics. Requires 4 C.T. Sttes oe per wheel. Figure 4. Complex vehicle model. The vehicle stte dymics hve two cotiuous sttes, vehicle positio d velocity, d cosider vehicle mss, ir drg d rollig resistce. The throttle d brke dymics re both first-order, with oe cotiuous stte for ech represetig ctutor dymics for the throttle d time respose lg for the brkes. The model cotis 11 cotiuous sttes, 3 exterl dt look-up fuctios requirig iterpoltio, d severl very olier fuctios, icludig egie dymics, the torque coverter model d tire frictio effects. Complete detils of the model re vilble i [7]. The cotroller ig process stems from system requiremets. We cosider oly the logitudil cotrol of psseger vehicles (o utomtic steerig). Vehicles my be heterogeeous, tht is of differet types, mkes d models. I our experimets, we limit ourselves to the utiliztio of two utomted crs. This exclu cut-i scerios for the experimets (they were cosidered i simultio). The ired behvior for the utomted vehicle is to perform cruise cotrol if the rod is cler, otherwise follow the vehicle i frot t predetermied time gp, usig commuictios if vilble. The cotroller ws split hierrchiclly betwee upper level cotroller tht hs severl mo, mely cruise cotrol (CC), dptive cruise cotrol (ACC) d coordited dptive cruise cotrol (CACC). I ACC mode we use oly iformtio from the host vehicle s forwrd-lookig sesors, d i CACC mode we supplemet this iformtio with dt from the wireless commuictio system. Low-Level Cotrol throttle ired ccelertio ccel. to torque switchig lw brke DB1 DB High-Level Cotrol stte of cr cc off cc ccc Figure 6. Experimetl test vehicles. They re equipped with throttle, brke d steerig ctutig systems, s well s with umerous sesors, icludig ccelerometers, wheel speed sesors, egie speed d mifold pressure sesors, d mgetometers tht re used s prt of the lterl cotrol. I dditio, both EVT-300 Doppler rdr d Mitsubishi lidr were mouted to the frot bumper of the vehicles. There re two cotrol computers locted i the truk. Both ru the QNX 4.5 rel-time opertig system d commuicte over seril port coectios. The computers ru host of tsks ecessry for utomted cotrol of the vehicles, icludig redig sesor dt d writig to ctutors, cotrol computtios such s those cribed bove for the ACC/CACC system d low-level cotrollers, d tsks pertiig to driver disply iformtio. There re bout 30 differet tsks ruig o the most hevily loded of the cotrol computers, d timig is firly criticl s hum test drivers re i the crs durig rus d their sfety is prmout. I cosequece, we temed up with other MoBIES tem t Cregie Mello Uiversity to perform schedulbility lysis of ll tsks, usig Rte Mootoic Schedulig lgorithms [9]. Executio times for the differet tsks were mesured o the cotrol computer, d choice of priorities to set the tsks t i QNX ws foud tht gurtees tht timig properties re ot violted. Results for CACC ru o the Berkeley test trck re preseted below. The speed limit o the Berkeley trck is 5mph, so the scerio preseted is suitble for Stop-d-Go coditios. throttle, brke, stte of cr ired ccelertio Figure 5. Decompositio of the vehicle cotrol system i mo.

6 6 Figure 7. Results of CACC cruise cotrol ru, o test trck. Gree lie idictes velocity of led cr, red velocity of follower cr, blue lies idicte reltive velocity s obtied from the commuictios d rdr filterig. The vehicle speeds mtch well, especilly whe the discotiuous ture of the speed profile is tke ito cosidertio. A costt rge policy ws used for this prticulr low-speed test d the rge betwee the vehicles ws mitied t 15 meters throughout the test. The VV librries re vilble from: V. CONCLUSIONS This pper presets review of modelig, lysis d verifictio of complex systems d cribes the use of model-bsed pproch to the developmet of rel-time, embedded, hybrid cotrol softwre for ACC pplictios. The models d cotrollers tht hve bee developed re publicdomi d hve bee used by severl ledig uiversities d reserch groups; hopefully, those models or their future geertios will cotiue to help bridge the chsm betwee model-bsed embedded systems theory d prctice. REFERENCES [1] N. Lych, Distributed Algorithms, Morg-Kufm Publishers, Ic. S Mteo, CA, [] D. Hrel, Sttechrts: A Visul Formlism for Complex Systems, Sciece of Computer Progrmmig, 8:31-74, [3] N. Lych, Clss Notes, MIT, Computer Sciece Deprtmet clss #6.879, 001. [4] B. Alper d F.B. Scheider, Recogizig Sfety d Liveess, Distributed Computig, (3):117-16, [5] B. Powel-Douglss, Doig Hrd Time: Developig Rel-Time Systems with UML, Objects, Frmeworks d Ptters, Addiso-Wesley Publishig Compy, [6] from Wikipedi, the free Ecyclopedi [7] M. Drew d J.K. Hedrick, A Discussio of Vehicle Modelig for Cotrol, Vehicle Dymics Lbortory Techicl Report, Mechicl Egieerig Deprtmet, UC Berkeley. [8] D. Cho d J.K. Hedrick, Automotive Egie Modelig for Cotrol, ASME Jourl of Dymic Systems, Mesuremet d Cotrol, December 1989, Vol. 111, pp [9] [10] Frjo Ivcic, Report o Verifictio of the MoBIES Vehicle-Vehicle Automotive OEP Problem, Techicl Report # MS-CIS-0-0, Uiversity of Pesylvi, Phildelphi, PA, Mrch 00. [11] N. Shkr, S. Owre d J. Rushby, The PVS Proof-Checker: A Referece Mul, Techicl Report, Computer Sciece Lb, SRI Itertiol, Melo Prk, CA [1] S.J. Grld d J.V. Guttg, LP, The Lrch Prover, [13] E.M. Clrke, O. Grumberg d D.E. Log, Model Checkig d Abstrctio, ACM Trsctios o Progrmmig Lguges d Systems, 16 (5):151-, September [14] M. Abdi d L. Lmport, Composig Specifictios, ACM Trsctios o Progrmmig Lguges d Systems, 15 (1):73-13, Jury [15] R. Miler, Commuictig d Mobile Systems: The Pi-Clculus, Cmbridge Uiversity Press, [16] Z. M d A. Pueli, Temporl Verifictio of Rective Systems: Sfety, Spriger-Verlg, New York, [17] S. Yovie, Model Checkig Timed Automt, Lectures o Embedded Systems, LNCS Volume 1494, October [18] Y. Keste, Z. M d A. Pueli, Verifictio of Clocked d Hybrid Systems, Lectures o Embedded Systems, LNCS Volume 1494, October [19] R. Alur d C. Coucourbetis, N. Hlbwchs, T.A. Heziger, P.H. Ho, X. Nicolli, A. Olivero, J. Sifkis, d S. Yovie, The Algorithmic Alysis of Hybrid Systems, Theoreticl Computer Sciece, 138 (1):3-34, [0] N. Lych, R. Segl d F. Vdrger, Hybrid I/O Automt Revisited, Fourth Itertiol Workshop o Hybrid Systems, Computtio d Cotrol (HSCC), LNCS Volume 034, Spriger- Verlg, 001. [1] Rjeev Alur, Rdu Grosu, Yerg Hur, Vijy Kumr, d Isup Lee, Modulr Specifictios of Hybrid Systems i CHARON, Hybrid Systems: Computtio d Cotrol, LNCS Volume 1790, pp. 6-19, 000. [] A. Chuti d B. H. Krogh, Computtiol Techiques for Hybrid System Verifictio, IEEE Trsctios o Automtic Cotrol, 48 (1):64-75, 003. [3] Ashish Tiwri, "Approximte Rechbility for Lier Systems", Proceedigs of Hybrid Systems: Computtio d Cotrol (HSCC), LNCS Volume 63, Spriger-Verlg, 003. [4] A.B. Kurzhski, P. Vriy, Ellipsoidl Techiques for Rechbility Alysis, Proceedigs of Hybrid Systems: Computtio d Cotrol (HSCC), LNCS Volume 1790, Spriger-Verlg, 000. [5] T.A.Heziger, P.H. Ho d H. Wog-Toi, Hy-Tech: A Model Checker for Hybrid Systems, Softwre Tools for Techology Trsfer, 1:110-1, [6] M. Bricky, Studies i Hybrid Systems: Modelig, Alysis d Cotrol, Ph. D. Thesis, EECS, MIT, Cmbridge, MA, [7] Joh Lygeros, Clire Tomli d Shkr Sstry, Cotrollers for Rechbility Specifictios for Hybrid Systems", Automtic, Specil Issue o Hybrid Systems, Mrch 1999, pp [8] flow.shtml [9] ACKNOWLEDGMENTS The uthors would like to thk Aupm Pthk who implemeted the simplified VV librries i TEJA s prt of his work o the MoBIES project i the summer of 00, d Stephe Spry for his ssistce i cotroller developmet d dt collectio for figure 7. Figure 6 is courtesy of Gerld Stoe d PATH publictios.