PLANT CONV 1 CONV 2. Digital Control Automaton

Transcription

1 A Logical Approach to Specication of Hybrid Systems M. V. Korovina 1 and O. V. Kudinov 2 1 Insitute of Informatics Systems, Lavrent'ev pr., 6, Novosibirsk, Russia, rita@ssc.nsu.ru 2 Institute of Mathematics, University pr., 4, Novosibirsk, Russia, kud@math.nsc.ru Abstract. The main subject of our investigation is behaviour of the continuous components of hybrid systems. By a hybrid system we mean a network of digital and analog devices interacting at discrete times. A rst-order logical formalisation of hybrid systems is proposed in which the trajectories of the continuous components are presented by majorantcomputable functionals. 1 Introduction In the recent time, attention to the problems of exact mathematical formalisation of complex systems such as hybrid systems is constantly raised. By a hybrid system we mean a network of digital and analog devices interacting at discrete times. An important characteristic of hybrid systems is that they incorporate both continuous components, usually called plants, as well as digital components, i.e. digital computers, sensors and atuators controlled by programs. These programs are designed to select, control, and supervise the behaviours of the continuous components. Modelling, design, and investigation of behaviours of hybrid systems have recently become active areas of research in computer science (for example see [7, 10, 11, 15, 16, 19]). We use the models of hybrid systems proposed by Nerode, Kohn in [19]. A hybrid system is a system which consists of a continuous plant that is disturbed by external world and controlled by a program implemented on a sequential automaton (see Figure 1). The control program reads sensor data, a sensor function of state of the plant sampled at discrete times, computes the next control law, and imposes it on the plant. The plant will continue using this control law until the next such intervention. Thus, a hybrid system is a network that consists of a continuous device, which is a plant, and a control automaton that interact with external world at discrete times. A representation of external world is an input data of the plant. The control automaton has input data (the set of sensor measurements) and the output data (the set of control laws). The control automaton is modelled by three units.

2 PLANT CONV 1 CONV 2 Digital Control Automaton Fig. 1. The rst unit is a converter which converts each measurement into input symbols of the internal control automaton. The internal control automaton, in practice, is a nite state automaton with nite input and output alphabets. The second unit is the internal control automaton, which has a symbolic representation of a measurement as input and produces a symbolic representation of the next control law to be imposed on the plant as output. The third unit is a converter which converts these output symbols representing control laws into the actual control laws imposed on the plant. The plant interacts with the external world and the control automata at times t i, where the time sequence ft i g satises a realizability requirements. The main subject of our investigation is behaviour of the continuous components. In [19], the set of all possible trajectories of the plant was called as a performance specication. We propose a rst-order logical formalisation of hybrid systems in which the trajectories of the continuous components (the performance specication) are presented by majorant-computable functionals. The following properties are the main characteristic properties of our approach. 1. An information about the external world is represented by a majorantcomputable real-valued function. In nontrivial cases for proper behaviour our system should analyse some complicated external information at every moment when such information can be processed. In general case, we can't represent this information by several real numbers because the laws of behaviours of the external world may be unknown in advance. Note that an external information should be measured so, in some sense, it is computable. According this reasons we present an external information by a majorant-computable real-valued function. 2. The plant is given by a real-valued functional. At the moment of interaction,

3 using the law computed by the discrete device, the plant transforms external function to a real value which is the output for the plant. So the theory of majorant-computable functionals is adequate mathematical tool for a formalisation of the mentioned phenomena. Although the dierential operator is not used as a basic one, this formalisation is compatible with representation of the plant by an ordinary dierential equation (see [13, 20]). Really, if there exists some method for approximate computing of the solution to the dierential equation that is based on dierence operators like the Galerkin method, then such solution can be described by a computable functional (see [13, 20]). 3. The trajectories of plants are described by computable functionals. So the trajectories are exactly characterized in logical terms (via -formulas). Thus, the proposition is proved which connects the trajectory of a plant with validity of two -formulas in the basic model. 2 Basic Notions To construct a formalization of hybrid systems we introduce a basic model and recall the notions of majorant-computability of real-valued functions and functionals. 2.1 Basic Model To specify complicated systems such as hybrid systems we extend the real numbers IR by adding the list superstructure L(IR), the set of nite sequences (words), A, of elements of A, where A is a nite alphabet, together with the predicates P ai for each elements a i of A, and appropriate operations for working with elements of L(IR) and A. We consider the many-sorted model M =< HW(IR); A > with the following sorts: 1. HW(IR) = hir; L(IR); cons; 2 l ; []i, where IR =< IR; 0; 1; +; ; > is the standard model of the reals, denoted also by IR; the set L(IR) is constructed by induction: (a) L 0 (IR) = []; (b) L i+1 =the set of nite ordered sequences (lists) of elements of IR[L i (IR); (c) L(IR) = S i2! L i(ir). (d) HW(IR) = f0; 1; +; ; g [ fcons; 2; []g, where cons,2; [] (empty list) are dened in standard way ( see [8]). At rst this structure was proposed by Backus in [1], now, it is rather well studied in [2, 5, 8]. This structure enables us to dene the natural numbers, to code, and to store information via formulas. 2. A =< A ; A > is the set of nite sequences (words) of elements of A, where A = fa 1 ; : : : ; a n g is a nite alphabet. The elements of the language A = fp a1 ; : : : ; P an ; =; 2; conc; ()g are dened in standard way (see [23]).

4 3. M = HW(IR) [ A [ fg, where are dened in the following way: (a) : A HW(IR)! HW(IR), (b) (a i1 ; : : : ; a ik ) [x 1 ; : : : ; x n ] = [y 1 ; : : : ; y m ], where m = min(i k ; n) and y j = xj if a ij = a 1 ; 0 otherwise. The variables of M subject to the following conventions: a; b; c; d; : : : range over IR, l 1 ; l 2 ; : : : range over L(IR), x; y; z; : : : range over IR [ L(IR), a 1 ; : : : a n range over A, ; ; ; w; : : : range over A. This notation gives us easy way to assert that something holds of real numbers, of lists, or of words. The notions of a term and an atomic formula in the languages HW(IR) and A are given in a standard manner. The set of atomic formulas in M is the union of the sets of atomic formulas in HW(IR), A, and the set of formulas of the type w l i = l j. The set of 0 -formulas in M is the closure of the set of atomic formulas in M under ^; _; :; 9x 2 l; 8x 2 l; 9a 2 w and 8a 2 w. The set of -formulas in M is the closure of the set of 0 -formulas under ^; _; 9x 2 l; 8x 2 l; 9a 2 w; 8a 2 w, and 9. We dene -formulas as negations of -formulas. We use denability as one of the basic conceptions. Montague [17] proposed to consider computability from the point of view of denability. Later, many authors among them Ershov [5], Moschovakis [18] paid attention to properties of this approach applied to various basic models. Denition A set B HW(IR) (A ) n is -denable if there exists a - formula (x) such that x 2 B $ M j= (x): 2. A function f is -denable if its graph is -denable In a similar way, we dene the notions of -denable functions and sets. The class of -denable functions (sets) is the intersection of the class -denable functions (sets) and the class of -denable functions (sets). Properties of -, -, - denable sets and functions were investigated in [5, 8, 12]. Note only that -denable sets are analogies of recursive sets on the natural numbers. 2.2 Majorant-Computable Functions and Functionals We will use majorant-computable functions and functionals to formalize information about external world and plants. Let us recall the notion of computability for real-valued functions and functional proposed and investigated in [12, 13]. We use the class of -denable Sets as a basic class. A real-valued function is said to be majorant- computable if we can construct a special kind of nonterminating process computing approximations closer and closer to the result. Denition 2. A function f : IR n! IR is called majorant-computable if there exist an eective sequence of -formulas f s (x; y)g s2! and an eective sequence of -formulas fg s (x; y)g s2! such that the following conditions hold.

5 1. For all s 2!, x 2 IR n, the formulas s and G s dene the same nonempty interval < s ; s >. 2. For all x 2 IR n, the sequence f< s ; s >g s2! decreases monotonically, i.e., < s+1 ; s+1 >< s ; s > for s 2!; 3. For all x 2 dom(f), f(x) = y $ T s2! < s; s >= fyg holds. As we can see, the process which carries out the computation is represented by two eective procedures. These procedures produce -formulas and -formulas which dene approximations closer and closer to the result. For formalization of information about external world we will use the following set. F = ff jf is a majorant{computable total real-valued functiong: An important property of a total real-valued function, which will be used below, is that the function is majorant-computable if and only if its epigraph and ordinate set are -denable (i.e. eective sets). Denition 3. Let g 1 be Godel numbering of a set A 1, g 2 be Godel numbering of a set A 2. A procedure h : A 1! A 2 is said to be eective procedure if there exists recursive function such that the following diagram is commutative N! N g 1 # g 2 # A 1 h! A2 : Let be the set of -formulas and be the set of -formulas. If (x; y) is a formula, we identify with the set f(x; y) j (x; y)g and (x; ) with the set fy j (x; y)g. Denition 4. A set R IR n+1 F is said to be -denable by an eective procedure ' :! if for each majorant{computable function f and for {formulas A(x; y), B(x; y) with the following conditions: f(x) = y $ A(x; ) < y < B(x; ) and fz j A(x; z)g [ fz j B(x; z)g = IR n fyg the following proposition holds M j= R(x; y; f) $ M j= '(A; B)(x; y): Denition 5. A set R IR n+1 F is said to be -denable by an eective procedure :! if for each majorant{computable function f and for all {formulas A(x; y), B(x; y) with the following conditions: f(x) = y $ A(x; ) < y < B(x; ) and fz j A(x; z)g [ fz j B(x; z)g = IR n fyg the following proposition holds M j= R(x; y; f) $ M j= (A; B)(x; y):

6 Denition 6. A functional F : IR n F! IR is called majorant{computable if there exists eective sequence of sets fr s g s2!, where each element R s is - denable by an eective procedure ' s and -denable by an eective procedure s, such that the following properties hold: 1. For all s 2!, the set R s (x; ; f) is a nonempty interval; 2. For all x 2 IR n and f 2 F, the sequence fr s (x; ; f)g s2! decreases monotonically; 3. For all (x; f) 2 dom(f ), F (x; f) = y $ \ s2! R s (x; ; f) = fyg holds: As we can see, the process which carries out the computation is represented by two eective procedures. These procedures produce -formulas and -formulas which dene approximations closer and closer to the result. We will use the following property of majorant-computable functionals. Theorem 7. A functional F : IR n F! IR is majorant{computable if and only if there exist two eective procedures h i :!, i = 1; 2, with the following properties: for a majorant{computable function f and for {formulas A(x; y), B(x; y) with the following conditions: f(x) = y $ A(x; ) < y < B(x; ) and fz j A(x; z)g [ fz j B(x; z)g = IR n fyg the following proposition holds F (x; f) = y $ h 1 (A; B)(x; ) < y < h 2 (A; B)(x; ) and fz j h 1 (A; B)(x; z)g [ fz j h 2 (A; B)(x; z)g = IR n fyg We use majorant-computability as one of the basic conceptions by the following reasons. 1. The notion of computability involves only effective processes. The computation of a real-valued function and functionals is an innite process that produces approximations closer and closer to the result. 2. Its denition contains minimal number of limitations (doesn't contain a derivative operator as a basic). 3. The class of computable real-valued functions and funtionals have clear and exact classications in logical and topological terms. 4. This class also contains the classes of computable real-valued functions proposed in earlier works by Blum, Shub, Smail [3]; Pour-El, Richards [20]; Stoltenberg-Hansen, Tucker [22]; Edalat, Sunderhauf [4] as subclasses. 5. The majorant-computable functions include a class of real-valued total functions that admit meromorphic continuation onto C. This class, in particular, contains functions that are solutions of well-known dierential equations.

7 3 Specications of Hybrid Systems Let us consider hybrid systems of the type considered in Introduction. A specication of the hybrid system SHS = ht S; F; Conv1; A; Conv2; Ii consists of: ST = ft i g i2!. It is an eective sequence of real numbers. The real numbers t i are the times of communication of the external world and the hybrid system, and the plant and the control automata. The time sequence ft i g i2! satises the realizability requirements: 1. For every i, t i 0; 2. t 0 < t 1 < : : : < t i : : :; 3. The dierences t i?1? t i have positive lower bounds. F : HW(IR) F! IR. It is a majorant-computable functional. The behaviour of the plant is modelled by this functional. Conv1 : IN 2! A. It is an eective procedure. At the time of communication this procedure converts the number of time interval, measurements presented by two -formulas into nite words which are input words of the internal control automata. A : A! A. It is a -denable function with parameters. The internal control automata, in practice, is a nite state automata with nite input and nite output alphabets. So, it is naturally modelled by -denable function (see [5, 8, 12]) which has a symbolic representation of measurements as input and produces a symbolic representation of the next control law as output. Conv2 : A! HW(IR). It is a -denable function. This function converts nite words representing control laws into control laws imposed on the plant. I A [ HW(IR). It is a nite set of initial conditions. Theorem 8. Suppose a hybrid system is specied as above. Then the trajectory of the hybrid system is dened by a majorant-computable functional. Proof. Let SHS = ht S; F; Conv1; A; Conv2; Ii be a specication of the hybrid system. According to Figure 1 we consider behaviour of the hybrid system in terms of our specication on [t i ; t i+1 ]. Let F(t i ; z; f) = y i, where z i represents the recent control law, and y i is the state of the plant at the time t i. At the moment t i Converter 1 gets measurements of recent states of the plant as input. By properties of majorant-computable functionals, these measurements can be presented by two -formulas which code methods of computations of measurements. These representations are compatible with real measurements. Indeed, using dierent approaches to process some external signals from the plant, Converter 1 may transform it to dierent results. This note is taken into account in our formalization of Converter 1. Thus, Conv1 is a -denable function and its arguments are the methods of computations of measurements. The meaning of the function Conv1 is an input word w 1 of the digital automaton which is presented by A.

8 By w 1 the function A computes new control law w 2 and Conv2 transforms it to z. The plant transforms new information about external world presented by f to recent states of the plant according to the control law z, i.e., y = F(t; z; f) for t 2 [t i ; t i+1 ]. The theorem states that there exists a majorant-computable functional F such that y(t) = F (t; f). To construct the functional F (t; f) which denes the trajectory it is enough to produce, by steps, two procedures 1 ; 2 which satisfy the conditions of Theorem 7. By Denition, F(t; z; f) is majorant-computable functional. So there exist two eective procedures h 1 ; h 2 which satisfy the conditions of Theorem 7. Denote the initial time by t 0 and the initial position of the plan by y 0. Let f is a majorant-computable function, and O is its ordinate set, E is its epigraph. Denote + 0 * ) (y > y 0 ) ;? 0 * ) (y < y 0 ) : For t 2 [t 0 ; t 1 ] put: 1 (O; E)(t; y) $ 9w 1 9w 2 9a[Conv1(1; + 0 ;? 0 ) = w 1 ^ A(w 1 ) = w 2 ^ Conv2(w 2 ; a) ^ h 1 (O; E)(t; a; y)]; 2 (O; E)(t; y) $ 9w 1 9w 2 9a[Conv1(1; + 0 ;? 0 ) = w 1 ^ A(w 1 ) = w 2 ^ Conv2(w 2 ; a) ^ h 2 (O; E)(t; a; y)]: In the same way we can construct the procedure 1 ; 2 for each interval [t i ; t i+1 ]. The following functional is required. F (t; f) = y $ 1 (O; E)(t; ) < y < 2 (O; E)(t; ) and fz j 1 (A; B)(t; z)g [ fz j 2 (A; B)(t; z)g = IR n fyg By constructions, the functional F dene the trajectory of the hybrid system with SHS specication. Following example illustrates our approach to the specication of Hybrid Systems. Some object is moving from the starting point to the destination point above a certain surface. Distance between object and the surface can't be less s than some given h and has to be as close to h as possible. This object represents hybrid system (such problems exist in real life: aeroplanes and other ying machines). In our approach we can describe object's trajectory by a majorantcomputable functional when surface curve is continuous and has continuous derivatives almost everywhere. In two-dimensional case (see Figure 2) trajectory will be the envelope of the family of circles of radius h and with centre located on curve which denes the surface. It will be a computable functional if at any given moment our hybrid system input is presented by computable function. Note, that in general case when object can only retrieve information about limited part of surface

9 Y h X Fig. 2. dierential equations can't be used to formalise the behaviour of the continuous part. This paper has presented the description of trajectories in terms of computable functionals which can be constructed by the specications SHS of hybrid systems. The preliminary results suggest possible directions for future applications to study real hybrid systems. References 1. J. Backus, Can Programming be Liberated from the von Neumann Style, A Functional Style and its Algebra of Programs,, Comm. of the ACM, V. 21, N 8, 1978, pages 613{ J. Barwise, Admissible sets and structures, Berlin, Springer{Verlag, L. Blum and M. Shub and S. Smale, On a theory of computation and complexity over the reals:np-completeness, recursive functions and universal machines, Bull. Amer. Math. Soc., (N.S.), v. 21, no. 1, 1989, pages 1{ A. Edalat, P. Sunderhauf, A domain-theoretic approach to computability on the real line, Theoretical Computer Science. To appear. 5. Yu. L. Ershov, Denability and computability, Plenum, New York, H. Freedman and K. Ko, Computational complexity of real functions, Theoret. Comput. Sci., v. 20, 1982, pages 323{ A Logical for specication of Continuous System, LNCS N 1386, 1998, pages 143{ S.S. Goncharov, D.I. Sviridenko, -programming, Vychislitel'nye Sistemy, Novosibirsk, v. 107, 1985, pages 3{29.

10 9. A. Grzegorczyk, On the denitions of computable real continuous functions, Fund. Math., N 44, 1957, pages 61{ T.A. Henzinger, Z. Manna, A. Pnueli, Towards rening Temporal Specications into Hybrid Systems, LNCS N 736, 1993, pages 36{ T.A. Henzinger, V. Rusu, Reachability Verication for Hybrid Automata, LNCS N 1386, 1998, pages 190{ M. Korovina, Generalized computability of real functions, Siberian Advance of Mathematics, v. 2, N 4, 1992, pages 1{ M. Korovina, O. Kudinov, A New Approach to Computability over the Reals, SibAM, v. 8, N 3, 1998, pages 59{ M. Korovina, O. Kudinov, Characteristic Properties of Majorant-Computability over the Reals, Proc. of CSL'98, LNCS, to appear. 15. C. Livadas, N.A. Lynch, Formal verication of Safety-Critical hybrid systems, LNCS N 1386, 1998, pages 253{ Z. Manna, A. Pnueli, Verifying Hybrid Systems, LNCS N 736, 1993, pages 4{ R. Montague, Recursion theory as a branch of model theory, Proc. of the third international congr. on Logic, Methodology and the Philos. of Sc., 1967, Amsterdam, 1968, pages 63{ Y. N. Moschovakis, Abstract rst order computability, Trans. Amer. Math. Soc., v. 138, 1969, pages 427{ A. Nerode, W. Kohn Models for Hybrid Systems: Automata, Topologies, Controllability, Observability, LNCS N 736, 1993, pages 317{ M. B. Pour-El, J. I. Richards, Computability in Analysis and Physics, Springer- Verlag, D. Scott, Outline of a mathematical theory of computation, In 4th Annual Princeton Conference on Information Sciences and Systems, 1970, pages 169{ V. Stoltenberg-Hansen and J. V. Tucker, Eective algebras, Handbook of Logic in computer Science, v. 4, Clarendon Press, 1995, pages 375{ B.A. Trakhtenbrot, Yu.Barzdin, Finite automata: Behaviour and Syntheses, North-Holland, This article was processed using the LATEX macro package with LLNCS style