1. Succinct Approximations of Distributed Hybrid Behaviors P.S. Thiagarajan School of Computing, National University of Singapore Joint Work with: Yang Shaofa IIST, UNU, Macau (To be presented at HSCC 2010)

2. Hybrid Automata Hybrid behaviors: Mode-specific continuous dynamics + discrete mode changes Standard model: Hybrid Automata Piecewise constant rates Rectangular guards

3. 3 AA BB DD CC {x 1, x 2, x 3 } A B D C  B (x1, x2, x3) = (2, -3.5, 1) dx 1 /dt = 2 x 1 (t) = 2t + x 1 (0) dx 2 /dt = -3.5 dx 3 /dt = 1 Piecewise Constant Rates g

4. 4 AA BB DD CC x  c | x  c |    ’ g x2x2 x1x1 Rectangular Guards

5. 5 AA BB DD CC (x 1  2  x 1  1)  (x 2  3.5  x 2  0.5) g x2x2 x1x1 Initial Regions

6. Highly Expressive Piecewise constant rates; rectangular guards The control state (mode) reachability problem is undecidable.  Given q f, Whether there exists a trajectory (q 0, x 0 ) (q 1, x 1 ) ……. (q m, x m ) such that q m = q f  q 0 = initial mode; x 0 in initial region.  HKPV’95

7. 7 (q 0, x 0 ) (q 1, x 1 ) g  (q 0 ) (q 2, x 2 ) (q 3, x 3 ) (q 4, x 4 )

8. Two main ways to circumvent undecidability If its rate changes as the result of a mode change,  Reset the value of a variable to a pre- determined region

9. 9 Hybrid Automata with resets. dx/dt = 3 dx/dt = -1.5 x  5 x  2.8 VF VD 5 2.8

10. 10 Hybrid Automata with resets. dx/dt = 3 dx/dt = -1.5 x  5 x  2.8 VF VD 5 2.8 x  [2, 4]

11. 11 Control Applications PLANT Digital Controller Sensors actuators The reset assumption is untenable.

12. 12 PLANT Digital Controller Sensors actuators [HK’97]: Discrete time assumption. The plant state is observed only at (periodic) discrete time points T 0 T 1 T 2 ….. T i+1 – T i = 

13. 13 Discrete time behaviors The discrete time behavior of a hybrid automaton:  Q : The set of modes  q 0 q 1 …q m is a state sequence iff there exists a run (q 0, v 0, ) (q 1, v 1 ) … (q m, v m ) of the automaton.  The discrete time behavior of Aut is L(Aut)  Q* the set of state sequences of Aut.

14. [HK’97]:  The discrete time behavior of (piecewise constant + rectangular guards) an hybrid automaton is regular.  A finite state automaton representing this language can be effectively constructed. Discrete time behavior is an approximation. With fast enough sampling, it is a good approximation.

15. [AT’04]: The discrete time behavior of an hybrid automaton is regular even with delays in sensing and actuating (laziness)

16. 16 g gg g +  g k-1 k The value of x i reported at t = k is the value at some t’ in [(k-1)+ g, (k-1)+g +  g ] g and  g are fixed rationals

17. 17 h h +  h hh k+1k If a mode change takes place at t = k is then x i starts evolving at  ’(x i ) at some t’ in [k+ h, k+h +  h ] h and  h are fixed rationals.

18. 18 Global Hybrid Automata PLANT Digital Controller Sensors Actuators ? x1 ? x2 ? x3  (x1)   (x2)   (x3) 

19. 19 PLANT Sensors Actuators ? x1 ? x2 ? x3  (x1)   (x2)   (x3)  p 1 p 2 p 3 Distributed Hybrid Automata

20. No explicit communication between the automata.. However, coordination through the shared memory of the plant’s state space.

21. The Communictaion graph of DHA Obs(p) --- The set of variables observed by p Ctl(p) --- The set of variables controlled by p Ctl(p)  Ctl(q) =  Nbr(p) = Obs(p)  Ctl(p)

22. 22 [(s 0 1, v 0 1 ), (s 0 2, v 0 2 ), (s 0 3, v 0 3 )] [  (s 0 1 ),  (s 0 2 ),  (s 0 3 )]

23. 23 [(s 0 1, v 0 1 ), (s 0 2, v 0 2 ), (s 0 3, v 0 3 )] [(s 1 1, v 1 1 ), (s 1 2, v 1 2 ), (s 1 3, v 1 3 )] [(s 2 1, v 2 1 ), (s 2 2, v 2 2 ), (s 2 3, v 2 3 )] [  (s 0 1 ),  (s 0 2 ),  (s 0 3 )]

24. 24 [(s 0 1, v 0 1 ), (s 0 2, v 0 2 ), (s 0 3, v 0 3 )] [(s 1 1, v 1 1 ), (s 1 2, v 1 2 ), (s 1 3, v 1 3 )] [(s 2 1, v 2 1 ), (s 2 2, v 2 2 ), (s 2 3, v 2 3 )] [  (s 0 1 ),  (s 0 2 ),  (s 0 3 )] [(s 3 1, v 3 1 ), (s 3 2, v 3 2 ), (s 3 3, v 3 3 )]

25. 25 [(s 0 1, v 0 1 ), (s 0 2, v 0 2 ), (s 0 3, v 0 3 )] [(s 1 1, v 1 1 ), (s 1 2, v 1 2 ), (s 1 3, v 1 3 )] [(s 2 1, v 2 1 ), (s 2 2, v 2 2 ), (s 2 3, v 2 3 )] [  (s 0 1 ),  (s 0 2 ),  (s 0 3 )] [(s 4 1, v 4 1 ), (s 4 2, v 4 2 ), (s 4 3, v 4 3 )] [(s 3 1, v 3 1 ), (s 3 2, v 3 2 ), (s 3 3, v 3 3 )]

26. 26 Discrete time behavior: (Global) state sequences [s 0 1, s 0 2, s 0 3 ] [s 1 1,s 1 2,s 1 3 ] [s 2 1, s 2 2, s 2 3 ] [s 3 1, s 3 2, s 3 3 ]....

27. 27 Discrete time behaviors The discrete time behavior of DHA is L(DHA)  (S p1  S p2  …..  S pn )* the set of global state sequences of DHA. L(DHA) is regular?

28. 28 Discrete time behaviors The discrete time behavior of DHA is L(DHA)  (S p1  S p2  …..  S pn )* the set of global state sequences of DHA. L(DHA) is regular? Yes. Construct the (syntactic product) AUT of DHA. AUT will have piecewise constant rates and rectangular guards. Hence…..

29. Network of HAs Global HA m ---- the number of component automata in DHA The size of DHA will be linear in m The size of AUT will be exponential in m. Can we do better? Global FSA Syntactic product Discretization

30. Global FSA Syntactic Product Discretization Local discretization Network of FSAs Product Network of HAs Global HA

31. Global FSA Local discretization Network of FSAs Network of HAs

32. Location node Variable node For each node, construct an FSA Each FSA will “read” from all its neighbor FSAs to make its moves. Nbr(p) = Ctl(p)  Obs(p) Nbr(x) = {p | x  Ctl(p)  Obs(p) }

33. Aut x Aut x will keep track of the current value of x CTL(x) = p if x  Ctl(p) A move of Aut x :  read the current rate of x from Aut CTL(x) and update the current value of x Can only keep bounded information Quotient the value space of x

34. Quotienting the value space of x v min v max

35. Quotienting the value space of x INIT x

36. Quotienting the value space of x cc’ c, c’,.,.., the constants that appear in some guard

37. Quotienting the value space of x ,  ’ ….. rates of x associated with modes in AUT CTL(x) |||||  ’| Find the largest positive rational that evenly divides all these rationals. Use it to divide [v min, v max] into uniform intervals

38. Quotienting the value space of x

39. Quotionting the value space of x ) ( ( ) A move of Aut x : If Aut x is in state I and CTL(x) = p and Aut p ’s state is  then Aut x moves from I to I’ =  (I)

40. ) ( ( ) I’ =  1 (I) I (s 1,  1 ) I’ Aut(x 1 ) (s 2,  2 ) )( I I’

41. I1 (s 2,  2 ) I3 (s’ 2,  ’ 2 ) g (s 2,  2 ) (s’ 2,  ’ 2 ) (v1, v3) satisfies g for some (v1, v3) in I1  I3 I2 Aut (p 2 )

42. Aut(x 1 ) Aut(p 3 ) Aut(x 3 )Aut(x 2 ) Aut(p 2 ) Aut(p 1 ) Each automaton will have a parity bit. This bit flips every time the automaton makes a move. Initially all the parities are 0. A variable node automaton makes a move only when its parity is the same as all its neighbors’ A location node automaton makes a move only when its parity is different from all its neighbors.

43. Aut(x 1 ) Aut(p 3 ) Aut(x 3 )Aut(x 2 ) Aut(p 2 ) Aut(p 1 )

44. Aut(x 1 ) Aut(p 3 ) Aut(x 3 )Aut(x 2 ) Aut(p 2 ) Aut(p 1 )

45. Aut(x 1 ) Aut(p 3 ) Aut(x 3 )Aut(x 2 ) Aut(p 2 ) Aut(p 1 )

46. Aut(x 1 ) Aut(p 3 ) Aut(x 3 )Aut(x 2 ) Aut(p 2 ) Aut(p 1 )

47. Aut(x 1 ) Aut(p 3 ) Aut(x 3 )Aut(x 2 ) Aut(p 2 ) Aut(p 1 )

48. Aut(x 1 ) Aut(p 3 ) Aut(x 3 )Aut(x 2 ) Aut(p 2 ) Aut(p 1 )

49. Aut(x 1 ) Aut(p 3 ) Aut(x 3 )Aut(x 2 ) Aut(p 2 ) Aut(p 1 )

50. Aut(x 1 ) Aut(p 3 ) Aut(x 3 )Aut(x 2 ) Aut(p 2 ) Aut(p 1 )

51. Aut(x 1 ) Aut(p 3 ) Aut(x 3 )Aut(x 2 ) Aut(p 2 ) Aut(p 1 )

52. Aut(x 1 ) Aut(p 3 ) Aut(x 3 )Aut(x 2 ) Aut(p 2 ) Aut(p 1 ) The automata can ‘drift” in time steps.

53. Aut(x 1 ) Aut(p 3 ) Aut(x 3 )Aut(x 2 ) Aut(p 2 ) Aut(p 1 ) Aut ------ The asynchronous product of { Aut(x 1 ), Aut(p 1 ), Aut(x 2 ), Aut(p 2 ), Aut(x 3 ), Aut(p 3 ) } Each global state of Aut will induce a global state of DHA. [(I1, (s1,  1), I2, (s2,  2), I3, (s3,  3)] [s1, s2, s3] In fact, each complete state sequence of Aut will induce a global state sequence of DHA. f

54. [s10, s20, s30] [ --, s21, -- ][ --, s22, -- ] [ --, s23, -- ] A state sequence  of Aut is complete iff all the FSA make an equal number of moves along .

55. [s10, s20, s30] [s11, --, --] [s12, --, --] [s13, --, --]

56. [s10, s20, s30] [---, ---, s31] [---, ---, s32]

57. [s10, s20, s30] [ --, s21, -- ][ --, s22, -- ] [ --, s23, -- ] [s11, --, --] [s12, --, --] [s13, --, --] [---, ---, s31] [---, ---, s32] [s10, s20, s30] [s11, s21, s31] [s12, s22, s32] [s13, s23, s33]

58. The main results Suppose  is a complete state sequence of Aut. Then f(  ) is a global state sequence of DHA. If  is global state sequence of DHA then there exists a complete sequence  of Aut such that f(  ) = . In the absence of deadlocks, every state sequence of Aut can be extended to a complete state sequence.

59. Extensions Laziness Delays in communictions between the plant and controllers. Different granularities of time for the controllers …….

60. The marked graph connection Can be used to derive partial order reduction verification algorithms.

61. 61 PLANT Sensors ? x1 ? x2 ? x3  (x1)   (x2)   (x3)  p 1 p 2 p 3 Communicating hybrid automata: Synchronize on common actions; message passing; shared memory …

62. p 1 p 2 p 3 Time-triggered protocol; Each controller is implemented on an ECU Study interplay between plant dynamics and the performance of the computational platform Plant

63. Summary The discrete time behavior of distributed hybrid automata can be succinctly represented.  as a network of FSA (communicating as in asynchronous cellular automata).  many extensions possible.  Finite precision assumption can yield stronger results.