[PPT] - Hybrid systems and computer science a short tutorial Eugene Asarin PowerPoint Presentation

SLIDE 1

Hybrid systems and computer science a short tutorial

Eugene Asarin Universit´ e Paris 7 - LIAFA

SFM’04 - RT, Bertinoro – p. 1/4

SLIDE 2

Introductory equations

Hybrid Systems = Discrete+Continuous

SFM’04 - RT, Bertinoro – p. 2/4

SLIDE 3

Introductory equations

Hybrid Systems = Discrete+Continuous
Hybrid Automata = A class of models of Hybrid

systems

SFM’04 - RT, Bertinoro – p. 2/4

SLIDE 4

Introductory equations

Hybrid Systems = Discrete+Continuous
Hybrid Automata = A class of models of Hybrid

systems

Original motivation (1990)= physical plant +

digital controller

SFM’04 - RT, Bertinoro – p. 2/4

SLIDE 5

Introductory equations

Hybrid Systems = Discrete+Continuous
Hybrid Automata = A class of models of Hybrid

systems

Original motivation (1990)= physical plant +

digital controller

New applications = also scheduling, biology,

economy, numerics, and more

SFM’04 - RT, Bertinoro – p. 2/4

SLIDE 6

Introductory equations

Hybrid Systems = Discrete+Continuous
Hybrid Automata = A class of models of Hybrid

systems

Original motivation (1990)= physical plant +

digital controller

New applications = also scheduling, biology,

economy, numerics, and more

Hybrid community = Control scientists’ + Applied

mathematicians + Some computer scientists’

SFM’04 - RT, Bertinoro – p. 2/4

SLIDE 7

Outline

1. Hybrid automata - the model
2. Verification
3. Conclusions and perspectives

SFM’04 - RT, Bertinoro – p. 3/4

SLIDE 8

1. The Model

SFM’04 - RT, Bertinoro – p. 4/4

SLIDE 9

Outline

1. Hybrid automata - the model
The definition
Semantic issues
Modeling with hybrid automata
“Hybrid” languages
Running a hybrid automaton
2. Verification
3. Conclusions and perspectives

SFM’04 - RT, Bertinoro – p. 5/4

SLIDE 10

The first example

I’m sorry, a thermostat.

SFM’04 - RT, Bertinoro – p. 6/4

SLIDE 11

The first example

I’m sorry, a thermostat.

When the heater is OFF, the room cools down :

˙ x = −x

When it is ON, the room heats:

˙ x = H − x

SFM’04 - RT, Bertinoro – p. 6/4

SLIDE 12

The first example

I’m sorry, a thermostat.

When the heater is OFF, the room cools down :

˙ x = −x

When it is ON, the room heats:

˙ x = H − x

When t>M it switches OFF
When t<m it switches ON

SFM’04 - RT, Bertinoro – p. 6/4

SLIDE 13

The first example

I’m sorry, a thermostat.

When the heater is OFF, the room cools down :

˙ x = −x

When it is ON, the room heats:

˙ x = H − x

When t>M it switches OFF
When t<m it switches ON

A strange creature. . .

SFM’04 - RT, Bertinoro – p. 6/4

SLIDE 14

A bad syntax

Some mathematicians prefer to write

˙ x = f(x, q)

where

f(x, Off) = −x f(x, On) = H − x

with some switching rules on q.

SFM’04 - RT, Bertinoro – p. 7/4

SLIDE 15

A bad syntax

Some mathematicians prefer to write

˙ x = f(x, q)

where

f(x, Off) = −x f(x, On) = H − x

with some switching rules on q. But we will draw an automaton!

SFM’04 - RT, Bertinoro – p. 7/4

SLIDE 16

Hybrid automaton

label invariant dynamics guard reset

x = M x ≤ M ˙ x = H − x x ≥ m ˙ x = −x

Off On

x = m /γ

SFM’04 - RT, Bertinoro – p. 8/4

SLIDE 17

Hybrid automaton

label invariant dynamics guard reset

x = M x ≤ M ˙ x = H − x x ≥ m ˙ x = −x

Off On

x = m /γ

A formal definition: It is a tuple . . .

SFM’04 - RT, Bertinoro – p. 8/4

SLIDE 18

Hybrid automaton

label invariant dynamics guard reset

x = M x ≤ M ˙ x = H − x x ≥ m ˙ x = −x

Off On

x = m /γ

m x t M

SFM’04 - RT, Bertinoro – p. 8/4

SLIDE 19

Hybrid versus timed

label invariant dynamics guard reset

x = M x ≤ M ˙ x = H − x x ≥ m ˙ x = −x

Off On

x = m /γ

q1 q2 q3 q4 a, x = 5/x := 0 b, x = 2 a, x < 10 b, x > 7 a, x = 8 b, x = 5/x := 0

SFM’04 - RT, Bertinoro – p. 9/4

SLIDE 20

Hybrid versus timed

Element Timed Aut. Hybrid Aut. Discrete locations q ∈ Q (finite) q ∈ Q (finite) Continuous variables

x ∈ Rn
x ∈ Rn

x dynamics ˙ x = 1 ˙ x = f(x) (and more) Guards

bool. comb. of xi ≤ ci
x ∈ G

SFM’04 - RT, Bertinoro – p. 9/4

SLIDE 21

Semantic issues

A trajectory (run) is an f : R → Q × Rn
Some mathematical complications (notion of

solution, existence and unicity not so evident).

Zeno trajectories (infinitely many transitions in a

finite period of time).

can be forbidden
one can consider trajectories up to the first

anomaly (Sastry et al., everything OK)

one can consider the complete Zeno

trajectories (very funny : Asarin-Maler 95)

SFM’04 - RT, Bertinoro – p. 10/4

SLIDE 22

Variants

Discrete-time (xn+1 = f(xn)) or continuous-time

˙ x = f(x)

Deterministic (e.g. ˙

x = f(x)) or non-deterministic

(e.g. ˙

x ∈ F(x))

Eager or lazy.
With control and/or disturbance (e.g. ˙

x = f(x, u, d))

Various restrictions on dynamics, guards and

resets: “Piecewise trivial dynamics”. LHA, RectA, PCD, PAM, SPDI . . . They are still highly non-trivial.

SFM’04 - RT, Bertinoro – p. 11/4

SLIDE 23

Special classes of Hybrid Automata 1

The famous one: Linear Hybrid Automata

˙ x = c1 ˙ x = c2 x ∈ P1/x := A1x + b1 x ∈ P2/x := A2x + b2

SFM’04 - RT, Bertinoro – p. 12/4

SLIDE 24

Special classes of Hybrid Automata 2

My favorite: PCD = Piecewise Constant

Derivatives

x y P1 c1

˙ x = ci for x ∈ Pi

SFM’04 - RT, Bertinoro – p. 13/4

SLIDE 25

PCD is a linear hybrid automaton (LHA)

e3 e2 e4 e5 e9 e12 e1 e8 e11 e7 e6 e10

SFM’04 - RT, Bertinoro – p. 14/4

SLIDE 26

PCD is a linear hybrid automaton (LHA)

e2 e3 e9 e12 e4 e3 e1 e2 e12 e11 e1 e8 e7 e8 e11 e7 e6 e10 e6 e5 e4 e5 e9 e10

SFM’04 - RT, Bertinoro – p. 14/4

SLIDE 27

PCD is a linear hybrid automaton (LHA)

˙ x = a7 ˙ x = a8 ˙ x = a4 Inv(ℓ2) ˙ x = a2

R2

˙ x = a1 x = e7 x = e6 x = e8 x = e1 x = e10 x = e11 x = e4 x = e5 Inv(ℓ4) Inv(ℓ1) Inv(ℓ8) Inv(ℓ7) Inv(ℓ6) ˙ x = a6 Inv(ℓ5) ˙ x = a5

R1 R5 R8 R7 R6 R4

e2 e3 e9 e12

SFM’04 - RT, Bertinoro – p. 14/4

SLIDE 28

PCD is a linear hybrid automaton (LHA)

˙ x = a7 ˙ x = a8 ˙ x = a4 Inv(ℓ2) ˙ x = a2 x = e3

R2

˙ x = a1 x = e2 ˙ x = a3 x = e7 x = e6 x = e8 x = e1 x = e10 x = e11 x = e12 x = e9 x = e4 x = e5 Inv(ℓ4) Inv(ℓ3) Inv(ℓ1) Inv(ℓ8) Inv(ℓ7) Inv(ℓ6) ˙ x = a6 Inv(ℓ5) ˙ x = a5

R1 R5 R8 R7 R6 R3 R4

SFM’04 - RT, Bertinoro – p. 14/4

SLIDE 29

PCD is a linear hybrid automaton (LHA)

˙ x = a7 ˙ x = a8 ˙ x = a4 Inv(ℓ2) ˙ x = a2 x = e3

R2

˙ x = a1 x = e2 ˙ x = a3 x = e7 x = e6 x = e8 x = e1 x = e10 x = e11 x = e12 x = e9 x = e4 x = e5 Inv(ℓ4) Inv(ℓ3) Inv(ℓ1) Inv(ℓ8) Inv(ℓ7) Inv(ℓ6) ˙ x = a6 Inv(ℓ5) ˙ x = a5

R1 R5 R8 R7 R6 R3 R4

SFM’04 - RT, Bertinoro – p. 14/4

SLIDE 30

Special classes of Hybrid Automata 3

The most illustrative: Piecewise Affine Maps

P1 P2 A1x+b1 A2x+b2

a control system
a scheduler with preemption
a genetic network

A network of interacting Hybrid automata

SFM’04 - RT, Bertinoro – p. 16/4

SLIDE 35

Hybrid languages

SHIFT
Charon
Hysdel
IF, Uppaal (Timed + ε)
why not Simulink? or Simulink+CheckMate.

SFM’04 - RT, Bertinoro – p. 17/4

SLIDE 36

What to do with a hybrid model

Simulate
With Matlab/Simulink
With dedicated tools
Analyze with techniques from control science:
Stability analysis
Optimal control
etc..
Analyze with your favorite techniques. The most important

invention is the model.

SFM’04 - RT, Bertinoro – p. 18/4

SLIDE 37

2. Verification

SFM’04 - RT, Bertinoro – p. 19/4

SLIDE 38

Outline

1. Hybrid automata - the model
2. Verification
Verification and reachability problems
Exact methods
The curse of undecidability
Decidable classes
Can realism help?
Approximate methods
The abstract algorithm
Data structures and concrete algorithms
Beyond reachability, beyond verification
Verification tools
3. Conclusions and perspectives

SFM’04 - RT, Bertinoro – p. 20/4

SLIDE 39

Verification and reachability problems

Is automatic verification possible for HA?

SFM’04 - RT, Bertinoro – p. 21/4

SLIDE 40

Verification and reachability problems

Is automatic verification possible for HA?
Safety: are we sure that HA never enters a bad

state?

It can be seen as reachability : verify that

¬Reach(Init, Bad)

SFM’04 - RT, Bertinoro – p. 21/4

SLIDE 41

Verification and reachability problems

Is automatic verification possible for HA?
Safety: are we sure that HA never enters a bad

state?

It can be seen as reachability : verify that

¬Reach(Init, Bad)

It is a natural and challenging mathematical

problem.

Many works on decidability
Some works on approximated techniques

SFM’04 - RT, Bertinoro – p. 21/4

SLIDE 42

The reachability problem

Given a hybrid automaton H and two sets

A, B ⊂ Q × Rn, find out whether there exists a

trajectory of H starting in A and arriving to B. All parameters rational.

SFM’04 - RT, Bertinoro – p. 22/4

SLIDE 43

Exact methods: Decidable classes

Reach(x, y) ⇔ ∃ a trajectory from x to y Reach is decidable for

AD: timed automata
HKPV95: initialized rectangular automata,

extensions of timed automata

LPY01: special linear equations + full resets.

Method : finite bisimulation (stringent restrictions on the dynamics) KPSY: Integration graphs???

SFM’04 - RT, Bertinoro – p. 23/4

SLIDE 44

Decidability 2

Reach is decidable for

MP94: 2d PCD.
CV96: 2d multi-polynomial systems.
ASY01: 2d “non-deterministic PCD”

SFM’04 - RT, Bertinoro – p. 24/4

SLIDE 45

Decidability 2 - geometric method

consider signatures
signatures are simple on the plane

(Poincaré-Bendixson)

s1 s2 sn rn rn+1 r3 r2 r1

finitely many patterns

exact acceleration of the cycles is possible.
Algorithm: for each pattern compute successors,

accelerate cycles. Restrictions: planarity, no jumps

SFM’04 - RT, Bertinoro – p. 25/4

SLIDE 46

Exact methods: The curse of undecidability

Koiran et al.: Reach is undecidable for 2d PAM.
AM95: Reach is undecidable for 3d PCD.
HPKV95 Many results of the type : “3clocks + 2

stopwatches = undecidable”

SFM’04 - RT, Bertinoro – p. 26/4

SLIDE 47

Anatomy of Undecidability — Preliminaries

Proof method: simulation of 2-counter (Minsky) machine, TM etc...

A counter: values in N; operations: C + +, C − −;

test C > 0?

A Minsky (2 counter) machine

q1 : D + +;

goto q2

q2 : C − −;

goto q3

q3 :

if C > 0 then goto q2 else q1

Reachability is undecidable (and Σ0

1-complete) for

Minsky machines.

SFM’04 - RT, Bertinoro – p. 27/4

SLIDE 48

Simulating a counter

1 2 3 4

C x 0 1

Counter PAM State space N State space [0; 1] State C = n

x = 2−n C + + x := x/2 C − − x := 2x C > 0? x < 0.75?

SFM’04 - RT, Bertinoro – p. 28/4

SLIDE 49

Encoding a state of a Minsky Machine

q1 q2 q3

(0,3) (2,1) (3,3)

Minsky Machine PAM State space {q1, . . . , qk} × N × N State space [1; k + 1] × State (qi, C = m, D = n)

x = i + 2−m, y = 2−n

SFM’04 - RT, Bertinoro – p. 29/4

SLIDE 50

Simulating a Minsky Machine

Minsky Machine PAM State space {q1, . . . , qk} × N × N State space [1; k + 1] × [0; 1] State (qi, C = m, D = n) x = i + 2−m, y = 2−n q1 : D + +; goto q2

8 < :

x := x + 1 y := y/2 if 1 < x ≤ 2 q2 : C − −; goto q3

8 < :

x := 2(x − 2) + 3 y := y if 2 < x ≤ 3 q3 : if C > 0 then goto q2 else q1

8 < :

x := x − 1 y := y if 3 < x < 4

8 < :

x := x − 2 y := y if x = 4

SFM’04 - RT, Bertinoro – p. 30/4

1d piecewise affine maps (PAMs): f : R → R

f(x) = aix + bi for x ∈ Ii

I3 R a2x + b2 I5 I2 a4x + b4 a1x + b1 a5x + b5 I4 I1

Old Open Problem. Is reachability decidable for 1d PAM?

SFM’04 - RT, Bertinoro – p. 32/4

SLIDE 58

Can realism help?

Maybe even undecidability is an artefact? Maybe it never occurs in real systems?

SFM’04 - RT, Bertinoro – p. 33/4

SLIDE 59

Proof method – Abstract View

Proof by simulation of an infinite state machine by

a DS

State of machine ↔ state of the DS
Dynamics of DS simulates transitions of the

machine

SFM’04 - RT, Bertinoro – p. 34/4

SLIDE 60

Consequences for bounded DS witnessing undecidability

Important states (sets) of the DS are very dense

(have accumulation points)

Dynamics should be very precise (at least around

accumulation points)

It is difficult (impossible) to realize such systems

physically

...and also: dynamics should be chaotic...

infinite state

SFM’04 - RT, Bertinoro – p. 35/4

SLIDE 61

The Conjecture

Reachability is decidable for realistic, un- precise, noisy, “fuzzy”, “robust” systems Arguments:

The only known proof method uses unbounded

precision (or unbounded state space)

Noise could regularize...
This world is nice and bad things never happen...
Engineers design systems and never deal with

undecidability.

SFM’04 - RT, Bertinoro – p. 36/4

SLIDE 62

Some Thoughts and Results

All the arguments are weak
The problem is interesting
I know 3 natural formalizations of “realism”
Non-zero noise: undecidable (Σ1-hard)
uniform noise: open problem
Infinitesimal noise: undecidable and co-r.e.

(Π0

1-complete)

Both positive or negative solution would be

interesting for the second one

Most of these effects are not specific for a class of

systems, they can be ported to any reasonable class. All this is very intriguing.

SFM’04 - RT, Bertinoro – p. 37/4

SLIDE 63

Approximate methods for reachability

In practice approximate methods should be used

for safety verification.

Several tools, many methods.
General principles are easy, implementation

difficult.

SFM’04 - RT, Bertinoro – p. 38/4

SLIDE 64

Abstract algorithm

For example consider forward breadth-first search. F=Init repeat F=F ∪ SuccFlow(F) ∪ SuccJump(F) until fixpoint |(F∩ Bad = ∅) | tired A standard verification (semi-)algorithm.

SFM’04 - RT, Bertinoro – p. 39/4

SLIDE 65

How to implement it

Needed data structure for (over-)approximate representation of subsets of Rn, and algorithms for efficient computing of

unions, intersections;
inclusion tests;
SuccFlow;
SuccJump.

SFM’04 - RT, Bertinoro – p. 40/4

SLIDE 66

Known implementations

Polyhedra (HyTech - exact. Checkmate)
“Griddy polyhedra” (d/dt)
Ellipsoids (Kurzhanski, Bochkarev)
Level sets of functions (Tomlin)

f(x)<0

SFM’04 - RT, Bertinoro – p. 41/4

SLIDE 67

Does it work?

Up to 10 dimensions. Sometimes.

SFM’04 - RT, Bertinoro – p. 42/4

SLIDE 68

Using advanced verification techniques

Searching for better data-structures (SOS, *DD)
Abstraction and refinement
Combining model-checking and theorem proving
Acceleration
Bounded model-checking

SFM’04 - RT, Bertinoro – p. 43/4

SLIDE 69

Beyond verification

Generic verification algorithms + hybrid data structures allow:

Model-checking
Controller synthesis
Phase portrait generation

SFM’04 - RT, Bertinoro – p. 44/4

SLIDE 70

A picture

35 36 40 39 R32 38 37 44 33 R33 R34 R35 R30 R29 34 R31 59 60

SFM’04 - RT, Bertinoro – p. 45/4

SLIDE 71

3. Final Remarks

SFM’04 - RT, Bertinoro – p. 46/4

SLIDE 72

Outline

1. Hybrid automata - the model
2. Verification
3. Conclusions and perspectives
Conclusions for a pragmatical user
Conclusions for a researcher

SFM’04 - RT, Bertinoro – p. 47/4

SLIDE 73

Conclusions for a pragmatical user

A useful and proper model : HA. Modeling

languages available.

Simulation possible with old and new tools
No hope for exact analysis
In simple cases approximated analysis (and

synthesis) with guarantee is possible using verification paradigm. Tools available

(Not discussed) Some control-theoretical

techniques available (stability, optimal control etc).

SFM’04 - RT, Bertinoro – p. 48/4

SLIDE 74

Perspectives for a researcher

Obtain new decidability results (nobody cares for

undecidability).

Explore noise-fuzziness-realism issues
Apply modern model-checking techniques to

approximate verification of HS

Create hybrid theory of formal languages
etc.

SFM’04 - RT, Bertinoro – p. 49/4