Compositional Refinement for Hierarchical Hybrid Systems Rajeev Alur, Insup Lee, Oleg Sokolsky University of Pennsylvania Radu Grosu SUNY Stony Brook

Outline Motivation Charon modeling lanaguage Compositional semantics for Charon Refinement HSCC'01 4/5/2019

Motivation ? Verification of hybrid systems is very hard Refinement – reasoning about change Refinement should be modular ? M M’ HSCC'01 4/5/2019

Motivation II ? ! Formal semantics to reason about refinement Compositional semantics for modular reasoning ? M M’ M M’ ! HSCC'01 4/5/2019

Main results Modular semantics for a hierarchical modeling language for hybrid systems Semantics allows compositional refinement rules HSCC'01 4/5/2019

Related work Hybrid system specification languages SHIFT Modelica Simulink/STATEFLOW Masaccio Compositional semantics (hybrid) reactive modules hierarchical reactive machines HSCC'01 4/5/2019

CHARON Language for hierarchical modeling of hybrid systems Two kinds of hierarchy: architectural hierarchy concurrent components data flow behavioral hierarchy discrete control flow control laws HSCC'01 4/5/2019

CHARON Language Features Individual components described as agents Composition, instantiation, and hiding Individual behaviors described as modes Encapsulation, instantiation, and scoping Support for concurrency Shared variables as well as message passing Support for discrete and continuous behavior Differential as well as algebraic constraints HSCC'01 4/5/2019

Syntax: modes and agents local t, rate global level, infusion {t = 1} • global level global infusion level { level[2,10] } {level = f(infusion)} • Compute Emergency level[4,8] e x infusion t=10 de dx t:=0 level[2,10] dx de Maintain dx de {t<10} Normal Agent Controller Agent Tank Agents describe concurrency Modes describe sequential behavior Control flow between control points Group transitions describe exceptions HSCC'01 4/5/2019

Informal semantics Semantics of a component: interface set of traces agent: global variables mode: global variables and control points set of traces level Controller Tank infusion level[4,8] de dx global level, infusion global level, infusion level[2,10] Normal Emergency dx de HSCC'01 4/5/2019

Traces 3 kinds of execution steps: continuous steps discrete steps environment steps Continuous steps: take time all agents together Discrete steps: instantaneous interleaved HSCC'01 4/5/2019

System vs. environment: it’s a game The choice between discrete and continuous steps is external to every component Chosen component completes the step before next one can be chosen Agent 1 Pass time Agent 2 HSCC'01 4/5/2019

Compositional step construction Discrete step of a mode (macro-step) mode transitions discrete steps of submodes micro-steps de local t, rate, h global level, infusion Controller Normal dx Emergency level[4,8] de dx level[2,10] de dx HSCC'01 4/5/2019

Continuous steps: all in due time Cannot let time pass at arbitrary moments: All modes need to be properly initialized All applicable constraints must be used { v1 = f(v2) } • e1 { v1 = g(v2) } • x1 x2 e2 v2:=0 M11 M21 M1 M2 HSCC'01 4/5/2019

Closure of a mode add default entry and exit transitions manipulate history variable de local t, rate, h global level, infusion Controller h=Normal h := Emergency Normal dx Emergency h := Normal level[4,8] de dx level[2,10] h := Emergency de dx HSCC'01 4/5/2019

States and flows (c,s) valuations for a set of variables V: QV state of a mode (c,s) control state: c is an entry or exit point data state: sQV flows for V: FV flow: differentiable function HSCC'01 4/5/2019

Steps of a mode Continuous steps set of flows for a given data state Discrete steps set of macro-steps between two control points HSCC'01 4/5/2019

Executions and traces of modes Mode execution: sequence of states i is one of: f, if and o, if , if , , and Trace: an execution restricted to global variables HSCC'01 4/5/2019

From agents to modes Modes define behavior of agents HSCC'01 4/5/2019

Executions and traces of agents Agent execution: sequence of states i is one of: f, if and o, if , if , , and Trace: an execution restricted to global variables HSCC'01 4/5/2019

Executions and traces of agents HSCC'01 4/5/2019

Refinement < Refinement is trace inclusion Every trace of Normal is also a trace of Normal’ control points and global variables are the same transition guards and constraints are relaxed {t = 1} • {t = 1} • { level[2,10] } { level  10 } Compute Compute < e x e x de de t:=0 t:=0 t=10 t  10 dx de dx de Maintain Maintain dx dx {t<10} {t<10} Normal Normal’ HSCC'01 4/5/2019

Compositional Reasoning I < G N N’ < M M’ N’ N < N < N M M M M’ Sub-mode refinement Context refinement HSCC'01 4/5/2019

Sub-mode refinement v Controller’ Normal’ Controller Normal Emergency level[4,8] de dx level[2,10] dx de v Controller Normal Emergency level[4,8] de dx level[2,10] dx de HSCC'01 4/5/2019

Compositional reasoning II parallel composition preserves refinement local t, rate global level, infusion Agent Controller’ global level global infusion level Normal’ Emergency level[4,8] {level = f(infusion)} • de dx level[2,10] infusion Agent Tank dx de v local t, rate global level, infusion Agent Controller global level global infusion level Normal Emergency level[4,8] {level = f(infusion)} • de dx level[2,10] infusion Agent Tank dx de HSCC'01 4/5/2019

Conclusions HSCC'01 4/5/2019