1. Compositional Refinement for Hierarchical Hybrid Systems
Rajeev Alur, Insup Lee, Oleg Sokolsky
University of Pennsylvania
Radu Grosu
SUNY Stony Brook

2. Outline Motivation Charon modeling lanaguage
Compositional semantics for Charon
Refinement
HSCC'01
4/5/2019

3. Motivation ? Verification of hybrid systems is very hard
Refinement – reasoning about change
Refinement should be modular ? M M’
HSCC'01
4/5/2019

4. Motivation II ? ! Formal semantics to reason about refinement
Compositional semantics for modular reasoning ? M M’ M M’ !
HSCC'01
4/5/2019

5. Main results
Modular semantics for a hierarchical modeling language for hybrid systems
Semantics allows compositional refinement rules
HSCC'01
4/5/2019

6. Related work Hybrid system specification languages
SHIFT
Modelica
Simulink/STATEFLOW
Masaccio
Compositional semantics
(hybrid) reactive modules
hierarchical reactive machines
HSCC'01
4/5/2019

7. CHARON Language for hierarchical modeling of hybrid systems
Two kinds of hierarchy:
architectural hierarchy
concurrent components
data flow
behavioral hierarchy
discrete control flow
control laws
HSCC'01
4/5/2019

8. CHARON Language Features
Individual components described as agents
Composition, instantiation, and hiding
Individual behaviors described as modes
Encapsulation, instantiation, and scoping
Support for concurrency
Shared variables as well as message passing
Support for discrete and continuous behavior
Differential as well as algebraic constraints
HSCC'01
4/5/2019

9. Syntax: modes and agents
local t, rate
global level, infusion
{t = 1} •
global level
global infusion
level
{ level[2,10] }
{level = f(infusion)} •
Compute
Emergency
level[4,8] e x
infusion
t=10 de dx
t:=0
level[2,10] dx de
Maintain dx de
{t<10}
Normal
Agent Controller
Agent Tank
Agents describe concurrency
Modes describe sequential behavior
Control flow between control points
Group transitions describe exceptions
HSCC'01
4/5/2019

10. Informal semantics Semantics of a component: interface set of traces
agent: global variables
mode: global variables and control points
set of traces
level
Controller
Tank
infusion
level[4,8] de dx
global level, infusion
global level, infusion
level[2,10]
Normal
Emergency dx de
HSCC'01
4/5/2019

11. Traces 3 kinds of execution steps: continuous steps discrete steps
environment steps
Continuous steps:
take time
all agents together
Discrete steps:
instantaneous
interleaved
HSCC'01
4/5/2019

12. System vs. environment: it’s a game
The choice between discrete and continuous steps is external to every component
Chosen component completes the step before next one can be chosen
Agent 1
Pass time
Agent 2
HSCC'01
4/5/2019

13. Compositional step construction
Discrete step of a mode (macro-step)
mode transitions
discrete steps of submodes
micro-steps de
local t, rate, h
global level, infusion
Controller
Normal dx
Emergency
level[4,8] de dx
level[2,10] de dx
HSCC'01
4/5/2019

14. Continuous steps: all in due time
Cannot let time pass at arbitrary moments:
All modes need to be properly initialized
All applicable constraints must be used
{ v1 = f(v2) } • e1
{ v1 = g(v2) } • x1 x2 e2
v2:=0
M11
M21 M1 M2
HSCC'01
4/5/2019

15. Closure of a mode add default entry and exit transitions
manipulate history variable de
local t, rate, h
global level, infusion
Controller
h=Normal
h := Emergency
Normal dx
Emergency
h := Normal
level[4,8] de dx
level[2,10]
h := Emergency de dx
HSCC'01
4/5/2019

16. States and flows (c,s) valuations for a set of variables V: QV
state of a mode
(c,s)
control state: c is an entry or exit point
data state: sQV
flows for V: FV
flow: differentiable function
HSCC'01
4/5/2019

17. Steps of a mode Continuous steps set of flows for a given data state
Discrete steps
set of macro-steps between two control points
HSCC'01
4/5/2019

18. Executions and traces of modes
Mode execution: sequence of states
i is one of:
f, if and
o, if
, if , , and
Trace: an execution restricted to global variables
HSCC'01
4/5/2019

19. From agents to modes
Modes define behavior of agents
HSCC'01
4/5/2019

20. Executions and traces of agents
Agent execution: sequence of states
i is one of:
f, if and
o, if
, if , , and
Trace: an execution restricted to global variables
HSCC'01
4/5/2019

21. Executions and traces of agents
HSCC'01
4/5/2019

22. Refinement < Refinement is trace inclusion
Every trace of Normal is also a trace of Normal’
control points and global variables are the same
transition guards and constraints are relaxed
{t = 1} •
{t = 1} •
{ level[2,10] }
{ level  10 }
Compute
Compute
< e x e x de de
t:=0
t:=0
t=10
t  10 dx de dx de
Maintain
Maintain dx dx
{t<10}
{t<10}
Normal
Normal’
HSCC'01
4/5/2019

23. Compositional Reasoning I
< G N N’
< M M’ N’ N
< N
< N M M M M’
Sub-mode refinement
Context refinement
HSCC'01
4/5/2019

24. Sub-mode refinement v Controller’ Normal’ Controller Normal Emergency
level[4,8] de dx
level[2,10] dx de v
Controller
Normal
Emergency
level[4,8] de dx
level[2,10] dx de
HSCC'01
4/5/2019

25. Compositional reasoning II
parallel composition preserves refinement
local t, rate
global level, infusion
Agent Controller’
global level
global infusion
level
Normal’
Emergency
level[4,8]
{level = f(infusion)} • de dx
level[2,10]
infusion
Agent Tank dx de v
local t, rate
global level, infusion
Agent Controller
global level
global infusion
level
Normal
Emergency
level[4,8]
{level = f(infusion)} • de dx
level[2,10]
infusion
Agent Tank dx de
HSCC'01
4/5/2019

26. Conclusions
HSCC'01
4/5/2019