From Hybrid Data-Flow Languages to Hybrid Automata: A Complete Translation

Transcription

1 From Hybrid Data-Flow Languages to Hybrid Automata: A Complete Translation Peter Schrammel peter.schrammel@inria.fr (joint work with Bertrand Jeannet) INRIA Grenoble Rhône-Alpes INRIA large-scale initiative Synchronics Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 1 / 29

2 Introduction Motivation Motivation: Verification of safety properties Synchronous program + physical environment = hybrid system synchronous program physical environment Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 2 / 29

3 Introduction Motivation Motivation: Verification of safety properties Synchronous program + physical environment = hybrid system synchronous program physical environment Invariance properties checked by reachability analysis init safe unsafe Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 2 / 29

7 Introduction Motivation Hybrid Systems Specification Simulation Languages Simulink, Modelica, Zelus (Benveniste, Bourke, Caillaud, Pouzet 2011) Purpose: Features: modelling, implementation and simulation Modularity, hierarchy, data-flow or equational syntax Discrete transitions triggered by the activation of zero-crossings: z(x(t)) up(z) 0 t Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 3 / 29

8 Introduction Motivation Hybrid Systems Specification Simulation Languages Simulink, Modelica, Zelus (Benveniste, Bourke, Caillaud, Pouzet 2011) Purpose: Features: modelling, implementation and simulation Modularity, hierarchy, data-flow or equational syntax Discrete transitions triggered by the activation of zero-crossings integration step discrete step initialization numerical solver zero-crossing detected discrete program no more discrete steps Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 3 / 29

9 Introduction Motivation Hybrid Systems Specification Simulation Languages Simulink, Modelica, Zelus (Benveniste, Bourke, Caillaud, Pouzet 2011) Purpose: Features: Modelling, implementation and simulation Modularity, hierarchy, data-flow or equational syntax Discrete transitions triggered by the activation of zero-crossings Hybrid Automata (Alur et al 1993) Purpose: Features: Verification Non-deterministic semantics Transitions governed by staying conditions and guards 0 x 20 1 ẋ 2 x 10 Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 3 / 29

10 Introduction Motivation Conceptual Mismatch simulation languages hybrid automata syntax equation-based automata-based discrete transition activation system zero-crossings deterministic, open with inputs staying conditions and guards non-deterministic, closed Zelus and Stateflow also allow automata-based specifications. Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 4 / 29

11 Introduction Motivation Goals Formalize translation from hybrid data-flow formalism to hybrid automata Special topic: Translation of zero-crossings Application: Verification of reactive systems in their environment large discrete state space translation to logico-numerical hybrid automata Source language more expressive than destination language: translation is a sound over-approximation (inclusion of sets of execution traces) Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 5 / 29

12 Introduction Related Work Outline 1 Introduction Motivation Related Work 2 Hybrid Data-Flow Model 3 Logico-Numerical Hybrid Automata 4 Semantics of Zero-Crossings 5 Translation Translation of Continuous Zero-Crossings Translation of Discrete Zero-Crossings Complete Translation 6 Conclusion Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 6 / 29

13 Introduction Related Work Outline 1 Introduction Motivation Related Work 2 Hybrid Data-Flow Model 3 Logico-Numerical Hybrid Automata 4 Semantics of Zero-Crossings 5 Translation Translation of Continuous Zero-Crossings Translation of Discrete Zero-Crossings Complete Translation 6 Conclusion Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 7 / 29

14 Introduction Related Work Related Work Translations from Simulink to hybrid automata Agrawal, Simon and Karsai 2004 for verification Alur, Kanade, Ramesh and Shashidhar 2008: for improvement of simulation coverage Manamcheri, Mitra, Bak and Caccamo 2011: tool HyLink for verification and controller synthesis Restrictions: Stateflow diagrams for discrete behavior No zero-crossings No soundness property Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 8 / 29

15 Introduction Related Work Related Work Verification of hybrid systems with large discrete state space Briand and Jeannet 2010: Analysis of a language Lustre + differential equations Kind of logico-numerical hybrid automata Do not use standard semantics of hybrid automata Other work Tripakis, Sofronis, Caspi and Curic 2005: Discrete-time Simulink to Lustre Najafi and Nikoukhah 2007: Embedding of hybrid automata in Scicos Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 9 / 29

16 Hybrid Data-Flow Model Outline 1 Introduction Motivation Related Work 2 Hybrid Data-Flow Model 3 Logico-Numerical Hybrid Automata 4 Semantics of Zero-Crossings 5 Translation Translation of Continuous Zero-Crossings Translation of Discrete Zero-Crossings Complete Translation 6 Conclusion Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 10 / 29

17 Hybrid Data-Flow Model Zelus Lucid Synchrone + differential equations Synchronous program with zero-crossings as base clock Exact, mathematical semantics Independent of integration method and numerical issues Common basis for simulation, code-generation and verification Example: Thermostat system let node main xi eps = x where assert 0<=xi && xi<=30 && -0.1<=eps && eps<=0.1; and der x = if on then xi-x+22 else xi-x init xi and on = (xi<=19) -> true every up(18-x+eps) false every up(x-20) x Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 11 / 29 t

18 Hybrid Data-Flow Model Hybrid Data-Flow Model I(s) A(s,i) { e(s,i) if ϕ(b) else ẋ 1 = { s 1 = Φ(s,i) if ϕ Z (s,i) else... Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 12 / 29

19 Hybrid Data-Flow Model Hybrid Data-Flow Model initial states I(s) A(s,i) { e(s,i) if ϕ(b) else ẋ 1 = { s 1 = Φ(s,i) if ϕ Z (s,i) else... Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 12 / 29

20 Hybrid Data-Flow Model Hybrid Data-Flow Model initial states I(s) A(s,i) b x «discrete vars continuous vars { e(s,i) if ϕ(b) else ẋ 1 = { s 1 = Φ(s,i) if ϕ Z (s,i) else... Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 12 / 29

21 Hybrid Data-Flow Model Hybrid Data-Flow Model initial states assertion I(s) A(s,i) b x «discrete vars continuous vars { e(s,i) if ϕ(b) else ẋ 1 = { s 1 = Φ(s,i) if ϕ Z (s,i) else... Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 12 / 29

22 Hybrid Data-Flow Model Hybrid Data-Flow Model initial states assertion input vars I(s) A(s,i) b x «discrete vars continuous vars { e(s,i) if ϕ(b) else ẋ 1 = { s 1 = Φ(s,i) if ϕ Z (s,i) else... Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 12 / 29

23 Hybrid Data-Flow Model Hybrid Data-Flow Model initial states assertion input vars I(s) A(s,i) b x «discrete vars continuous vars { e(s,i) if ϕ(b) else ẋ 1 = { s 1 = Φ(s,i) if ϕ Z (s,i) else... differential equations Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 12 / 29

24 Hybrid Data-Flow Model Hybrid Data-Flow Model initial states assertion input vars I(s) A(s,i) b x «discrete vars continuous vars { e(s,i) if ϕ(b) else ẋ 1 = { s 1 = Φ(s,i) if ϕ Z (s,i) else... differential equations discrete transitions Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 12 / 29

25 Hybrid Data-Flow Model Hybrid Data-Flow Model initial states assertion input vars I(s) A(s,i) b x «discrete vars continuous vars { e(s,i) if ϕ(b) else ẋ 1 = { s 1 = Φ(s,i) if ϕ Z (s,i) else... zero-crossings differential equations discrete transitions Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 12 / 29

26 Hybrid Data-Flow Model Hybrid Data-Flow Model initial states assertion input vars I(s) A(s,i) b x «discrete vars continuous vars { e(s,i) if ϕ(b) else ẋ 1 = { s 1 = Φ(s,i) if ϕ Z (s,i) else... zero-crossings differential equations discrete transitions Example: Thermostat system I(on, x) = 0 x 30 (x 19 on x > 19 on) A((on, x), (ξ, ǫ)) = 0 ξ ǫ 0.1 { ξ x + 22 if on else ẋ = ξ x if on { ff if up(x 20) else on = tt if up(18 x + ǫ) Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 12 / 29

27 Hybrid Data-Flow Model Hybrid Data-Flow Model initial states assertion input vars I(s) A(s,i) b x «discrete vars continuous vars { e(s,i) if ϕ(b) else ẋ 1 = { s 1 = Φ(s,i) if ϕ Z (s,i) else... zero-crossings differential equations discrete transitions Discrete transitions only by zero-crossings Change of dynamics only on discrete transitions Discrete transitions are urgent Simultaneous zero-crossings: priority by order in the program source Zero-crossing can also be triggered by discrete transitions Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 12 / 29

28 Hybrid Data-Flow Model Semantics Operational semantics inspired by the behavior of a simulator Uses non-standard analysis x =x+e(s,i) A up(z j ) s =Φ(s,i) A I(s ) continuous evolution zero-crossing discrete transitions no more zero-crossing Execution trace: (s 0,i 0 ) (s 1,i 1 ) (s 2,i 2 )... Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 13 / 29

29 Logico-Numerical Hybrid Automata Outline 1 Introduction Motivation Related Work 2 Hybrid Data-Flow Model 3 Logico-Numerical Hybrid Automata 4 Semantics of Zero-Crossings 5 Translation Translation of Continuous Zero-Crossings Translation of Discrete Zero-Crossings Complete Translation 6 Conclusion Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 14 / 29

30 Logico-Numerical Hybrid Automata Logico-Numerical Hybrid Automata Example: Thermostat system x 18.1 on = tt { on 17.9 x 30 x ẋ 30 x on 0 x x ẋ 52 x x =20 on = ff Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 15 / 29

31 Logico-Numerical Hybrid Automata Logico-Numerical Hybrid Automata Example: Thermostat system x 18.1 on = tt { on 17.9 x 30 x ẋ 30 x on 0 x x ẋ 52 x flow relation x =20 on = ff Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 15 / 29

32 Logico-Numerical Hybrid Automata Logico-Numerical Hybrid Automata Example: Thermostat system staying condition flow relation x 18.1 on = tt { on 17.9 x 30 x ẋ 30 x x =20 on = ff on 0 x x ẋ 52 x Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 15 / 29

33 Logico-Numerical Hybrid Automata Logico-Numerical Hybrid Automata Example: Thermostat system jump relation staying condition flow relation x 18.1 on = tt { on 17.9 x 30 x ẋ 30 x x =20 on = ff on 0 x x ẋ 52 x Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 15 / 29

34 Logico-Numerical Hybrid Automata Logico-Numerical Hybrid Automata Example: Thermostat system jump relation staying condition { on 17.9 x 30 x ẋ 30 x guard { }} { x 18.1 on = tt on 0 x x ẋ 52 x flow relation x =20 on = ff Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 15 / 29

35 Semantics of Zero-Crossings Outline 1 Introduction Motivation Related Work 2 Hybrid Data-Flow Model 3 Logico-Numerical Hybrid Automata 4 Semantics of Zero-Crossings 5 Translation Translation of Continuous Zero-Crossings Translation of Discrete Zero-Crossings Complete Translation 6 Conclusion Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 16 / 29

36 Semantics of Zero-Crossings Continuous vs. Discrete Zero-Crossings Continuous zero-crossing: triggered by continuous evolution sk 1 c s k s k+1... z(x(t)) 0 up(z) t Discrete zero-crossing: triggered by discrete transition occur in zero-crossing cascades: sk 2 c s k 1 d s k... z(x(t)) 0 up(z) t A zero-crossing may be both, e.g. up(x n) Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 17 / 29

37 Semantics of Zero-Crossings Semantics of Zero-Crossings up(z(s,i)) interpreted over: (s k 1,i k 1 ) (s k,i k ) up(z(s, i)) At-zero semantics: z(s k 1,i k 1 ) 0 z(s k,i k ) 0 Contact semantics: z(s k 1,i k 1 ) < 0 z(s k,i k ) 0 Crossing semantics: z(s k 1,i k 1 ) 0 z(s k,i k ) > 0 Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 18 / 29

38 Semantics of Zero-Crossings Semantics of Zero-Crossings up(z(s,i)) interpreted over: (s k 1,i k 1 ) (s k,i k ) up(z(s, i)) At-zero semantics: z(s k 1,i k 1 ) 0 z(s k,i k ) 0 Contact semantics: z(s k 1,i k 1 ) < 0 z(s k,i k ) 0 Crossing semantics: z(s k 1,i k 1 ) 0 z(s k,i k ) > 0 Simulink: contact crossing Modelica: choice left to the programmer Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 18 / 29

39 Translation Outline 1 Introduction Motivation Related Work 2 Hybrid Data-Flow Model 3 Logico-Numerical Hybrid Automata 4 Semantics of Zero-Crossings 5 Translation Translation of Continuous Zero-Crossings Translation of Discrete Zero-Crossings Complete Translation 6 Conclusion Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 19 / 29

40 Translation Translation of Continuous Zero-Crossings Single Zero-crossing without Inputs History must be memorized s = Φ(s) if up(z(s)) encoded by locations φ 1 φ 2 Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 20 / 29

41 Translation Translation of Continuous Zero-Crossings Single Zero-crossing without Inputs History must be memorized s = Φ(s) if up(z(s)) encoded by locations φ 1 φ 2 At-zero semantics z(s k 1 ) 0 } {{ } staying condition before zero-crossing z(s k ) 0 } {{ } guard Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 20 / 29

42 Translation Translation of Continuous Zero-Crossings Single Zero-crossing without Inputs History must be memorized s = Φ(s) if up(z(s)) encoded by locations φ 1 φ 2 At-zero semantics z(s k 1 ) 0 } {{ } staying condition before zero-crossing z(s k ) 0 } {{ } guard φ 1 z 0 tt φ 1 z 0 z =0 s =Φ(s) φ 2 above below Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 20 / 29

43 Translation Translation of Continuous Zero-Crossings Single Zero-crossing without Inputs History must be memorized s = Φ(s) if up(z(s)) encoded by locations φ 1 φ 2 At-zero semantics z(s k 1 ) 0 } {{ } staying condition before zero-crossing z(s k ) 0 } {{ } guard φ 1 z 0 tt φ 1 z 0 z =0 s =Φ(s) φ 2 z above below z t t Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 20 / 29

44 Translation Translation of Continuous Zero-Crossings Single Zero-crossing without Inputs History must be memorized s = Φ(s) if up(z(s)) encoded by locations φ 1 φ 2 Contact semantics z(s k 1 ) < 0 } {{ } guard for entering ready location z(s k ) 0 } {{ } guard φ 1 z 0 tt φ 1 z < 0 z 0 φ 1 z 0 z = 0 s = Φ(s) φ 2 above below ready Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 21 / 29

45 Translation Translation of Continuous Zero-Crossings Single Zero-crossing without Inputs History must be memorized s = Φ(s) if up(z(s)) encoded by locations φ 1 φ 2 Contact semantics z(s k 1 ) < 0 } {{ } guard for entering ready location z(s k ) 0 } {{ } guard φ 1 z 0 tt φ 1 z < 0 z 0 φ 1 z 0 z = 0 s = Φ(s) φ 2 z above below ready z t t Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 21 / 29

46 Translation Translation of Continuous Zero-Crossings Further Cases Zero-crossing with inputs Inputs quantified existentially s = Φ(s,i) if up(z(s,i)) Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 22 / 29

47 Translation Translation of Continuous Zero-Crossings Further Cases Zero-crossing with inputs Inputs quantified existentially s = Φ(s,i) if up(z(s,i)) Example I(b, x, y) = b... A(b, x, ( y, ξ) ) = 0.1 ξ ( ) 0.1 b ff y = if up(x ξ) ξ... b x 0.1 tt b x <0.1 x 0.1 b x x 0.1 b x =x y =x b Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 22 / 29

48 Translation Translation of Continuous Zero-Crossings Further Cases Zero-crossing with inputs Inputs quantified existentially s = Φ(s,i) if up(z(s,i)) Conjunctions of zero-crossings s = Φ if M p=1 up(z p) Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 22 / 29

49 Translation Translation of Continuous Zero-Crossings Further Cases Zero-crossing with inputs Inputs quantified existentially s = Φ(s,i) if up(z(s,i)) Conjunctions of zero-crossings s = Φ if M p=1 up(z p) Loss of urgency Example up(z 1 ) up(z 2 ) up(z 2 ) up(z 1 ) up(z 2 ) up(z 1 ) up(z 1 ) up(z 2 ) Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 22 / 29

50 Translation Translation of Continuous Zero-Crossings Further Cases Zero-crossing with inputs Inputs quantified existentially s = Φ(s,i) if up(z(s,i)) Conjunctions of zero-crossings Lists of zero-crossings s = Φ if M p=1 up(z p) Φ 1 if ϕ Z s 1 else = Φ 2 if ϕ Z 2 else Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 22 / 29

51 Translation Translation of Continuous Zero-Crossings Further Cases Zero-crossing with inputs Inputs quantified existentially s = Φ(s,i) if up(z(s,i)) Conjunctions of zero-crossings Lists of zero-crossings s = Φ if M p=1 up(z p) Φ 1 if ϕ Z s 1 else = Φ 2 if ϕ Z 2 else Iterative translation of all zero-crossings: cumbersome graph transformations Encoding of locations into additional state variables q of the enumerated type {above, below, ready} Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 22 / 29

52 Translation Translation of Discrete Zero-Crossings Translation of Discrete Zero-Crossings In zero-crossing cascades: s k c s k+1 d s k+2... Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 23 / 29

53 Translation Translation of Discrete Zero-Crossings Translation of Discrete Zero-Crossings In zero-crossing cascades: s k c s k+1 d s k+2... Example n = n + 1 if up(x) m = tt if up(n) } = n =... q d = n<0 { (m = tt) q d n 0 (m =m) (q d n 0) Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 23 / 29

54 Translation Translation of Discrete Zero-Crossings Translation of Discrete Zero-Crossings In zero-crossing cascades: s k c s k+1 d s k+2... Example n = n + 1 if up(x) m = tt if up(n) } = n =... q d = n<0 { (m = tt) q d n 0 (m =m) (q d n 0) Translating urgency Interrupting continuous evolution if a discrete zero-crossing is active Example: V ( q d n 0) Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 23 / 29

55 Translation Complete Translation Complete Translation (1) Translate each zero-crossing formula ϕ Z j and obtain: Staying conditions Jump transitions for s and q (2) Create a logico-numerical hybrid automaton: L = {l 0 } Flow relation V in l 0 S 0 V R Jump relation l 0 R l 0 l 0 Initial states S 0 in l 0 Explicit representation Enumerating the valuations of variables q and Partitioning the system into O(2 N ) states Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 24 / 29

56 Conclusion Outline 1 Introduction Motivation Related Work 2 Hybrid Data-Flow Model 3 Logico-Numerical Hybrid Automata 4 Semantics of Zero-Crossings 5 Translation Translation of Continuous Zero-Crossings Translation of Discrete Zero-Crossings Complete Translation 6 Conclusion Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 25 / 29

57 Conclusion Conclusion Translation: sound over-approximation Handle zero-crossings Large subsets of actual languages reduced to our formalism Insight: Some semantics of simulation languages are badly suited for translation to hybrid automata Translation to standard hybrid automata: Analysis with existing tools: HyTech (Henzinger et al 1997) PHaver (Frehse 2005) SpaceEx (Frehse et al 2011) Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 26 / 29

58 Conclusion Conclusion Translation: sound over-approximation Handle zero-crossings Large subsets of actual languages reduced to our formalism Insight: Some semantics of simulation languages are badly suited for translation to hybrid automata Translation to standard hybrid automata: Analysis with existing tools: HyTech (Henzinger et al 1997) PHaver (Frehse 2005) SpaceEx (Frehse et al 2011) Future Work Tools above require full enumeration of discrete state space: Adaption of methods to the analysis of logico-numerical hybrid automata Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 26 / 29

59 Conclusion Related Work Translation of restricted Simulink/Stateflow Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 27 / 29

60 Conclusion Semantics of Logico-numerical Hybrid Automata Executions (l 0,s 0 ) (l 1,s 1 ) (l 2,s 2 )... (l,s) c (l,s ) l=l s flow Vl (s) (l,s) d (l,s ) R l,l : R l,l (s,s ) C l (s ) flow V (b,x) = (b,x ) Set of differentiable trajectories T [0,δ] : [0, δ] R n δ>0, τ T [0,δ] : τ(0) = x τ(δ) = x δ [0, δ] : C(b, τ(δ )) δ (0, δ) : V(b, τ(δ ), τ(δ )) Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 28 / 29

61 Conclusion One Zero-Crossing without Inputs History must be memorized s = Φ(s) if up(z(s)) encoded by locations φ 1 φ 2 Crossing semantics z(s k 1 ) 0 z(s k ) > 0 Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 29 / 29

62 Conclusion One Zero-Crossing without Inputs History must be memorized s = Φ(s) if up(z(s)) encoded by locations φ 1 φ 2 Crossing semantics 0 z(s k 1 ) ǫ } {{ } staying condition before zero-crossing z(s k ) 0 } {{ } guard φ 1 z 0 tt φ 1 z 0 tt 0 z ǫ φ 1 s =Φ(s) 0 z ǫ φ 2 z above below ready z t ǫ t Schrammel and Jeannet (INRIA) From Hybrid Data-Flow to Hybrid Automata 29 / 29