Modeling, Verification and Testing using Timed and Hybrid Automata

ion. The main idea of this approach is to start with a rough (conservative and often discrete) approximation of a hybrid system and then iteratively refine it. This refinement is often local in the sense that it uses the previous analysis results to determine where the approximation error is too large to prove the property (see for example [96, 8, 28]). A popular abstraction approach is predicate abstraction where a conservative abstraction can be constructed by mapping the infinite set of states of the hybrid system to a finite set of abstract states using a set of predicates. The property is then verified in the abstract system. If it holds in the abstract system, it also holds in the concrete hybrid system. Oth1.3. EXHAUSTIVE VERIFICATION 25 erwise, a counter-example can be generated. If the abstract counter-example corresponds to a concrete trajectory, then the hybrid system does not satisfy the property; otherwise, the abstract counter-example is spurious because the abstraction is too conservative, and the abstraction can then be refined to achieve a better precision. In the following, we illustrate this approach by explaining the method using polynomials proposed in [96]. The continuous state space R is partitioned using the signs of a set of polynomials. As an example, an abstract state s defined by g1(x) 0 corresponds to a (possibly infinite) set c(s) of concrete states. Then, the abstract transition over-approximates the concrete one such that there is a transition from s to s′ if there exists a trajectory from a concrete state in c(s) to another concrete state in c(s′). More precisely, in this method, first the set of polynomials is saturated by adding all the high-order derivatives of the initial polynomials. Then, by looking at the sign of the polynomials, it is possible to decide whether a trajectory can go from one abstract state to another. For example, if there are only two polynomials g1 and g2 such that g2 = ġ1. Suppose that the abstract state s satisfies g1 = 0 and g2 > 0, then the new sign of g1 is positive and from s we add a transition to s′ satisfying gi > 0. The abstraction can be refined by adding more polynomials. Another abstraction method in [8] uses linear predicates to partition the continuous state space, and thus each abstract c(s) is a convex polyhedron. The abstract transition from s to s′ is determined by computing the reachable set from c(s) and check whether it reaches c(s′). This is less expensive than the reachability computation on the hybrid system which requires handling accumulated reachable sets with geometric complexity that grows after successive continuous and discrete evolutions. Box decompositions are also commonly used to define abstract systems, such as in [90, 59]. The abstract system can then be built by exploiting the properties of the system’s vector fields over such decompositions. The method proposed in [59] makes use of the following special property of multi-affine systems: the value of a multi-affine function f(x) with x inside some box can be expressed as a linear combination of the values of f at the vertices of the box. Using this, one can determine whether the derivative vector on the boundary 8Multi-affine systems are a particular class of polynomial systems such that if all the variables xi are constant, the derivatives are linear in xj with j not equal to i. 26CHAPTER 1. MODELING, VERIFICATION AND TESTING USING TIMED AND HYBRID AUTOMATA of a box points outwards or inwards, in order to over-approximate the reachability between adjacent boxes. While discrete abstractions allow benefiting from the well-developed verification algorithms for discrete systems, they might be too coarse to preserve interesting properties. Timed abstractions can be built by adding bounds on the time for the system to reach from one abstract state to another. A generalization of this idea is called hybridization [12] involving approximating a complex system with a simpler system, for which more efficient analysis tools are available. To this end, using a partition of the state space, one can approximate locally the system’s dynamics in each region by a simpler dynamics. Globally, the dynamics changes when moving from one region to another, and the resulting approximate system behaves like a hybrid system and this approximation process is therefore called hybridization. Then, the resulting system is used to yield approximate analysis results for the original system. The usefulness of this approach (in terms of accuracy and computational tractability) depends on the choice of the approximate system. For example, the hybridization methods using piecewise affine approximate systems, proposed in [12], allows approximating a nonlinear system with a good convergence rate and, additionally, preserving the attractors of the original system. In addition, the resulting approximate systems can be handled by the existing tools for piecewise affine systems (presented earlier in this section). 1.4 Partial verification Exhaustive verification is desirable since, if it succeeds, it guarantees that a model satisfies a property. But exhaustive verification has its limitations as we have seen: state-explosion or even undecidability. In fact, state-explosion is a phenomenon that is also prevalent in the exhaustive verification of much simpler, finite-state models. This phenomenon has so far hindered a wider adoption of exhaustive verification in industrial applications, because the size of the problems tackled there is far too big to treat exhaustively. Instead, practitioners use simulation as their main verification tool. Even though simulation cannot prove that a 9The term “verification” usually denotes simulation-based verification in industrial jargon, whereas “formal verification” is used to denote exhaustive verification. 1.4. PARTIAL VERIFICATION 27 property is satisfied, it can certainly reveal cases where it is not satisfied, that is, potential bugs of the real system, its model, or its specification. An advantage of simulation is that it has some time-scalability properties: running 200 simulations is better (i.e., likely to discover more bugs) than running 100 simulations, and running longer simulations is also better. Moreover, if 100 simulations can be run in one day, say, then in two days we can most likely run 200 simulations. In contrast, most exhaustive verification tools suffer from a “hitting the wall” type of problem. Once they exhaust the main memory of the computer that they run on, they start using disk space, which involves a lot of swapping on the OS side. Disk swapping virtually takes all processing time, leading verification to a halt. This means that the number of new states that are explored per unit of time radically decreases to practically zero, as illustrated in Figure 1.14. Usually this wall is hit after relatively little time, in the order of minutes. Then, running the tool for many hours will not improve the number of states that are explored compared to running it for ten minutes. This is not time-scalable.