Stability of Hybrid Automata with Average Dwell Time: An Invariant Approach

Transcription

1 1 Stability of Hybrid Automata with Average Dwell Time An Invariant Approah Sayan Mitra* Computer Siene and Artifiial Intelligene Laboratory Massahusetts Institute of Tehnology 200 Tehnology Square Cambridge, MA 02139, USA Daniel Liberzon** Coordinated Siene Laboratory University of Illinois at Urbana-Champaign, 1308 W. Main Street Urbana, IL 61801, USA Abstrat A formal method based tehnique is presented for proving the average dwell time property of a hybrid system, whih is useful for establishing stability under slow swithing. The Hybrid Input/Output Automaton (HIOA) framework of [12] is used as the model for hybrid systems, and it is shown that some known stability theorems from system theory an be adapted to be applied in this framework. The average dwell time property of a given automaton, is formalized as an invariant of a orresponding transformed automaton, suh that the former has average dwell time if and only if the latter satisfies the invariant. Formal verifiation tehniques an be used to hek this invariane property. In partiular, the HIOA framework failitates invariant proofs by breaking them down into a systemati ase analysis for the disrete ations and ontinuous trajetories. The invariant approah to proving the average dwell time property is illustrated by analyzing the hysteresis swithing logi unit of a supervisory ontrol system. Index Terms Average dwell time, Stability, Formal methods, Invariant, Hybrid systems, Hybrid I/O automaton. I. INTRODUCTION Systems with both disrete and ontinuous dynamis are alled hybrid systems. Computer sientists have onentrated on verifiation of hybrid systems, and have developed a wide range of tehniques for proving saftey properties, from model heking [1], [6], [12] whih is automati but limited to moderate sized linear hybrid systems, to interative theorem proving [2], [5] whih is appliable to larger and more ompliated hybrid systems. Control theorists, on the other hand, have viewed hybrid systems as swithed systems or as dynamial systems with speial boolean variables, and have addressed stability, ontrollability, and ontroller synthesis of suh systems [18], [10]. The differenes in these approahes espoused different terminologies and mathematial models, whih has led to a lak of interation between the two ommunities and isolated developments. A platform bridging the gap by allowing both omputer sientists and ontrol theorists to apply their tehniques in the same modeling framework is desirable. To this end, we introdue the Hybrid Input/Output Automaton (HIOA) [12] *Researh supported by AFRL ontrat number F C-1850 **Supported by the MURI projetdarpa/afosr MURI F Award to the Control Systems ommunity. HIOA is a mathematial model for developing ompositional speifiations for a very general lass of hybrid systems and it subsumes the lass of untimed and timed distributed systems. Hybrid behavior is modeled as an alternating sequene of ations and trajetories; the ations orrespond to disrete state transitions and the trajetories apture ontinuous evolution of the state variables of an automaton. Most of the prior work with HIOA foused on verifying safety of hybrid systems [16], [11], [4]. Owing to this speial struture of the HIOA, its safety properties, whih are atually its invariants, an be proved indutively by a systemati ase analysis of its ations and trajetories. In this paper we demonstrate how formal methods and the HIOA framework an be useful for proving invariants arising in stability analysis of hybrid systems. First, we show the straightforward adaptation of some known stability theorems from system theory to the HIOA framework. Then, we show that the task of proving the average dwell time property [7] whih is used to prove stability of hybrid systems under slow swithing, an be redued to heking a set of invariants. We have hosen the average dwell time property to demonstrate the invariant approah beause it deouples the problem of finding the Lyapunov funtions (whih we assume are given), from the problem of heking that all the exeutions of the HIOA satisfy ertain properties. In general, properties of the exeutions of an automaton, are harder to prove than invariant properties whih are properties of the state. We transform the given HIOA, to a new HIOA and find a ondition on the states of, suh that satisfies the average dwell time property if and only if is an invariant of. This enables us to prove the average dwell time property by heking with a suitable formal verifiation tehnique. We illustrate our approah by analyzing the stability of the hysteresis swithing logi unit in a supervisory ontrol system. In this ase study we have proved the invariants by hand, however our long term goal is to develop an integrated system whih uses automati theorem provers to effiiently verify the invariants arising in stability analysis of hybrid systems. The rest of this paper is organized as follows In Setion II we desribe the HIOA model, in Setion III we define

2 S C 7 < 2 the various notions of stability and restate some known stability theorems in the HIOA framework. In Setion IV we define the aforementioned transformations and proeed to formalize the average dwell time property as a set of invariants. In Setion V we present the analysis of the hysteresis swithing unit of a supervisory ontrol system using our invariant approah. In Setion VI we onlude with a synopsis of ontributions and future researh diretions. II. MATHEMATICAL PRELIMINARIES The hybrid I/O automaton framework [12] evolved from the generalization of the timed I/O automaton model [9] for real time distributed systems. Earlier versions of the model appeared in [13] and [14]. A hybrid I/O automaton models hybrid behavior in terms of disrete transitions and ontinuous evolution of its state variables. Let be the set of variables of automaton. Eah is assoiated with a (stati) type whih is the set of values an assume. A valuation for is a funtion that assoiates eah variable to a value in. The set of all valuations of is denoted by. A trajetory of is a mapping ", where is a left losed interval of time. The domain of is the interval and is denoted by $ %&'. The first time of is the infimum of ( %&', also written as $ )*+'. If $ %&' is right losed then is losed and its limit time is the supremum of $ %,&', also written as ( *'. Eah variable - is also assoiated with a %. /0'1*+2 3 (or %, 4 ) whih is the set of trajetories that may follow. Dynami type %, 45 of a ontinuous (disrete) variable is the pasting losure of ontinuous (onstant) funtions from left losed intervals of time to. A. HIOA Model A hybrid I/O automaton onsists of 1) A set of variables, partitioned into internal 6, input, and output variables 8. The internal variables are also alled state variables. The set 9; 7< 8 is the set of external variables. And, the set 8 is alled the set of loally ontrolled or loal variables. 2) A set A of ations, partitioned into internal B, input, and output ations D. 3) A set of states EGF 6H, 4) A non-empty set of start states IJFKE, 5) A set of disrete transitions L FMEONPAQNRE. A transition 5SUTTS V WL is written in short as YZS. The subsript is sometimes omitted and written as S[ S when the automaton is lear from the ontext. 6) A set of trajetories \ for, suh that for every trajetory in \, and for every V ]$ %&', 05 ^ 6 _E and \ is losed under prefix, suffix, of traje- is finite then and onatenation. The first state 0`,a 6 tory is denoted by $b)deff. If $ %&' $ gf,fhk0$ *+'1i^ 6. Further, is (1) input ation enabled, that is, it annot blok input ations, and (2) input trajetory enabled, that is, it aepts any trajetory of the input variables either by allowing time to progress for the entire length of the trajetory or by reating with some internal ation before that. For this paper we assume that (1) All variables are either disrete or ontinuous. For a set of variables j, we denote its disrete and ontinuous subsets by jlk and j0m, and the the orresponding state vetors by nok and nm. And, (2) disrete transitions do not hange the valuation of the ontinuous variables, that is, if S S, then SU Spmq@S Spm. B. Exeutions An exeution fragment of is a finite or infinite sequene of ations and trajetories rw gs,tt$ut utvuge, where eah ewx J\xTtwy JA, and if gw is not the last trajetory in r then gw is finite and ew gff ^z {} ew~ uib)dgff. If r is an exeution fragment, then we define the first state of r, rb)dgf,f to be es,b)dgff. An exeution fragment r is an exeution if r b)deffƒ I. An exeution fragment is losed if it is a finite sequene and the domain of the final trajetory is a finite losed interval. We say a state of is reahable if it is the last state of some losed exeution of. An exeution fragment r is reahable if rb)dgff is reahable. The length of a losed exeution fragment is the number of elements (ations and trajetories) in the sequene. The first time rb)*+'1 of an exeution fragment r is s b)*', and if r is losed then its limit time r 5*+'1 is 4 d *+'1, where g is the last trajetory of r. The duration of a losed exeution fragment is its length in time and is defined as r %, J ˆ wšds 5ew *+'1Œ Pew )*+'. We denote the valuation of the ontinuous variables 6 m at time ^Tr b)*' Žẍ_r b)*', in the exeution fragment r by r. Note that r is uniquely determined beause the disrete ations do not alter the valuation of the ontinuous variables. C. Invariants An invariant property or simply an invariant of is a ondition on that remains true in all reahable states of. The struture of HIOA allows systemati proof of invariants. An invariant is either derived from other invariants or proved by indution on the length of a losed exeution of. The indution onsists of the following steps 1) base step is true for all -I, 2) indution step onsisting of a) disrete part for every disrete transition, implies, and b) ontinuous part for any losed trajetory \, with $b)deff and $ gff?, implies. So, the indutive proof of an invariant breaks down into a set of ases, one for eah ation and trajetory. This is partiularly helpful in organizing large, omplex proofs and for automating invariant proofs in a theorem prover.

3 3 III. STABILITY THEOREMS IN HIOA FRAMEWORK In this setion we define what it means for a HIOA to be stable. In this and the following setion, we are onerned with hybrid systems with no ontinuous inputs, and we assume that there exists a family of suffiiently regular 1 funtions ),, suh that every trajetory of satisfies Spm P) Spm^ for some, where is a finite index set. A. Stability Definitions Let us assume that all the subsystems of have the origin their the ommon equilibrium point, that is, ) ` P` for all. The origin is a stable equilibrium point of a HIOA, in the sense of Lyapunov, if for every W`, there exists a `, suh that for every exeution r of, we have r `, r 5 J` r 5*+'1T (1) and we say that is stable. A HIOA is asymptotially stable if it is stable and an be hosen so that r ` r Q`? (2) If the above ondition holds for all then is globally asymptotially stable. Uniform stability is a onept whih guarantees that the stability property in question holds, not just for exeutions, but for any exeution fragment. Therefore, is uniformly stable in the sense of Lyapunov, if for every ` there exists a onstant `, suh that for any exeution fragment r, r s r 5 4T s T^T ` *' A HIOA is said to be uniformly asymptotially stable if it is uniformly stable and there exists suh that for every fragment r, r s ` there exists a, suh that for any exeution r 4T s (3) It is said to be globally uniformly asymptotially stable if the above holds for all. All the above stability properties are by definition uniform over exeutions. We will also make use of the following weaker notion of stability a given exeution is stable (uniformly stable, asymptotially stable, et.) if the orresponding property is satisfied for this exeution. In the remaining part of this setion we show how some known theorems on stability (see, e.g., [10]), an be adapted for the stability analysis of HIOA. B. Common Lyapunov Funtion The basi tool for studying stability of hybrid systems relies on the existene of a single Lyapunov funtion whose derivative along the trajetories of all the subsystems in satisfies the suitable inequalities. 1 Loally Lipshitz, we say that it is a ommon Definition 1. Given a positive definite ontinuously differentiable funtion Lyapunov funtion for a HIOA if there exists a positive definite ontinuous funtion 9, suh that we have " " Spm ) S m 9 5S m S m T$ (4) Theorem 1. If a HIOA has a radially unbounded ommon Lyapunov funtion then is globally uniformly asymptotially stable. C. Multiple Lyapunov Funtions When a ommon Lyapunov funtion for all the subsystems in is not known or does not exist, the stability of a HIOA depends on the hoie of an exeution. Multiple Lyapunov funtions [3] is an useful tool for proving stability of a hosen exeution. In this ase, eah subsystem [ % is assoiated with a Lyapunov funtion &, and one attempts to prove the stability of the exeution using the ontinuous deay of the ' s and the swithing logi between the subsystems. In ontrol theory literature [10], [7] are defined in the swithes between the subsystems ( terms of a swithing signal whih is a piee-wise onstant funtion ) &* `(T+,. In the HIOA model the swithes are defined by the disrete transitions of the automaton, so we define the notion of swithing times as follows Let - \. be a funtion that gives the index of the funtion ), whih is ative over the trajetory. Whenever a disrete ation w ours suh that - 5 w0/du 21-5gw, the HIOA is said to undergo a swith. Definition 2. For any exeution fragment r s u u ge, an instant of time 1 r %,&' is alled a swithing time if there exists * suh that w 5*+', and - 5 w 1-5 w ~ u. Theorem 2. Let be a radially unbounded Lyapunov funtion orresponding to the globally asymptotially stable system 3 ) 3 for eah 4. An exeution r of a HIOA is globally asymptotially stable if there exists a family of positive definite ontinuous funtions 95T 6 suh that, for every pair of suessive swithing times ^T in r, and the orresponding trajetories w T+7, if - 5 w K and - 59o21 pt<; Tq*>=?;=A@ then B $+7,5 B(5 w 5 q 9( $5 w 5. D. Stability Under Slow Swithing It is well known that a swithed system is stable if all the individual subsystems are stable and the swithing is suffiiently slow, so as to allow the dissipation of the transient effets after eah swith. The dwell time [17] and the average dwell time [7] riteria define restrited lasses of swithing signals, based on swithing speeds, and one an onlude the stability of a system with respet to these restrited lasses. In the HIOA framework, the disrete transitions of the automaton define the speed of swithing, and so the average dwell time property an be formalized as an invariant of the automaton.

4 r " " r 4 Definition 3. Let ẗuTfvoTege be the swithing times of an exeution fragment r of a HIOA. The exeution fragment has a dwell time k ` if it satisfies the inequality fw~ u$ fw k, for all *. If all reahable exeution fragments of have dwell times k then has a dwell time k. Definition 4. Let r denote the number of swithes over an exeution fragment r of a HIOA. The exeution fragment has an average dwell time ` if there exists a positive number s suh that rlq s r %, 3 (5) If all reahable exeution fragments of have average dwell times then has an average dwell time. The following theorem, adapted to the HIOA framework from the results in [7], uses the onept of average dwell time to give a suffiient ondition for stability. Sine dwell time is a speial ase of average dwell time with s, a separate theorem for dwell time is not neessary. Theorem 3. Consider a HIOA with its trajetories speified by a family of funtions ) T. Suppose there exist positive definite, radially unbounded, and ontinuously differentiable funtions, for eah, and positive numbers (s and suh that B Spm ) m m S m m m m 5S q (si 5S at T 6 (6) 5S q p.5s ats T$pT x (7) v. Then is globally uniformly asymptotially stable if it has an average dwell time Theorem 3 roughly states that a hybrid system is uniformly stable if the disrete swithes are between modes whih are individually stable, provided that the swithes do not our too frequently on the average. This stability ondition effetively allows us to deouple the onstrution of Lyapunov funtions one for eah P, whih we assume are known from available methods of system theory from the problem of heking that every exeution of the automaton satisfies Equation (5). In the next setion we shall formalize this latter property as an invariant of a orresponding transformed automaton and show how formal methods an be used to verify it. IV. AVERAGE DWELL TIME INVARIANT APPROACH In general, it is harder to prove properties of exeutions of automata than it is to prove invariants, whih are properties of state. Several formal verifiation tehniques have been developed expressly for heking invariants of hybrid automata (see [1], [6], [5], and Chapters 5 and 6 of [18]). So, one we have translated the average dwell time property to a set of invariant properties, we an appeal to the suitable formal verifiation tool for heking the invariants. A. Transformed Automaton for Stability Verifiation We transform the given HIOA to a new HIOA as follows In addition to all the variables of, automaton has two new internal variables; a ounter E and a timer, both initialized `. The ounter E ounts the number of mode swithes, and the timer redues the ount by in every time. For every disrete transition Y of, automaton has a orresponding transition Y, suh that bej,be. In addition has internal ation whih ours every time and derements E by one. Finally, for every trajetory of, the projetion of on the set of ontinuous variables of is a trajetory of, i.e., = m \Y, and. Lemma 1. All losed exeutions of satisfy Equation (5) if and only if E s in all reahable states of. Proof. Sine r is a losed exeution of, we an replae r %, 3 in Equation (5) with r 5*+'. For the if part, onsider a losed exeution r of and let r be the orresponding exeution of. Let of r, therefore from the invariant we know that be From onstrution of we know that, r and r *+'1 ]r 5*+'1 and therefore w"%$ be &(' ). It follows that rlu &' w"%$ s. be the last state s. r r For the only if part, onsider a reahable state of. There exists an exeution r suh that is the last state of. Sine. Let r be an * exeution of orresponding to r rlq s & w+"%$ ',) implies r q s - & ' w+"%$ ), beg s. it follows that Theorem 4. All exeutions of satisfy Equation (5) if and only if EG s in all reahable states of. Proof. We only have to show that if any exeution r of violates (5), then there exists a losed exeution r of that violates (5) as well. If r is infinite, then there is a losed prefix of r that violates (5). Otherwise, r is finite and open, and the losed prefix of r exluding the last trajetory of r violates (5). B. Transformed Automaton for Uniform Stability Verifiation The above transformation is aeptable for asymptoti stability, but it allows E to beome negative, and then rapidly return to zero, so it does not guarantee uniform stability. For uniform stability we want all reahable exeution fragments of to satisfy (5). Consider any reahable exeution fragment r of, with r )*+' u, and r 5*+'1_ v. Let 5 v T u and EŒ v T u denote the number of swithes and the number of extra swithes over r with respet to dwell time, that is, EŒ5 v T u 5 v T u l v H u.i. Thus, every reahable exeution fragment r of satisfies (5), if ^T s4 PEŒ^T`, ƒeœ5s,t`,l s s s that is, EŒ^T s s T where s r )*+', and r 5*+'. So, we introdue an additional variable E/"qw whih stores the magnitude

5 r s 5 of the smallest value ever attained by E. Then, for uniform stability we need to show that the total hange in E between any two reahable states is bounded by s. Theorem 5. All reahable exeution fragments of satisfy Equation (5), if and only if E "E/"qw s in all reahable states of. Proof. For the if part, onsider a reahable losed exeution fragment r of whih is a part of the exeution, suh that r )dgffx 5 u and r gffy 5 v. Let and be the orresponding exeution (fragment) of. Based on whether or not E "qw hanges over the interval * u T v, we have the following two ases If E "qw does not hange in the interval, then u ^be "qw v a E "qw ^be for some "qw?=? u, and EŒ v T u y EŒ v T "qw ( KEŒ5 u T "qw 3Œ EŒ v T " w (. Sine 5 v satisfies the invariant, EŒ v T " w (Z v a E 5 v ^be "qw from whih we get EŒ v T u s. Otherwise, there exists some "qw * u T v, suh that 5fv4^bE "qw "qw a E = 5uaa E/" w, and EŒfvoTua? EŒfvoT "qw EŒ5 "qw T ue_ Ex5fvoT "qw. Again, from the invariant property at 5fv4, we get EŒfvoTuaq@EŒ5fv.T "qw s. For the only if part, let be a reahable state, and be a losed exeution of, suh that eff. Further, let be the orresponding exeution of, and s be the intermediate point where E attains its minimal value over, that is, ^be " w x s a E. Sine is a reahable exeution fragment of, it satisfies Equation (5), and we have ^T s s / &('. Rewriting, Ex5^T` ƒeœs.t`l be "qw, there- By assumption, Ex5 s Tt`, fore, it follows that bep s s ^be "qw E " w C. Finding the Required Invariants s. l Hs For a general HIOA, there are no obvious ways of finding the orret invariants that would lead to the average dwell time property, however, based on some ase studies, we provide the following guidelines. First, for eah mode we identify a variable that is monotoni; and ould be the same, for 1. Then, we introdue disrete history variables w, *,,T Tgeg, whih reord the value of when the system swithed out of mode for the * time. Now, we want two invariants of the following forms 1) w 9 ~ u K) w 9, for all *, where ) is some monotoni inreasing funtion, and 2) w 9 ~ u, where is some monotoni funtion of time. Roughly speaking, the seond invariant sets an upper bound on how fast an grow, and the first invariant sets a lower bound on how muh has to grow in order to perform a ertain number of swithes. Together, they bound the minimum time that has to elapse between swithes. The ase study presented in the next setion will illustrate these priniples further. V. HYSTERESIS SWITCHING In this setion the invariant based tehnique is applied to a hysteresis swithing logi unit whih is a subsystem of an adaptive supervisory ontrol system taken from [8] (also Chapter 6 of [10]). Our goal is to prove the average dwell time property of this swithing logi, whih guarantees stability of the overall supervisory ontrol system (see the above referenes for details). An adaptive supervisory ontroller onsists of a family of andidate ontrollers T, whih orrespond to the parametri unertainty range of the plant in a suitable way. Suh a ontroller struture is partiularly useful when the parametri unertainty is so large that robust ontrol design tools are not appliable. The ontroller operates in onjuntion with a set of on-line estimators that provide monitoring signals or time-varying estimates of the unknown parameters of the plant model and at eah instant of time, the swithing logi unit generates, the index )U of the ontroller to be applied to the plant. In building the HIOA model, we take as inputs the monitoring signals and fous on the swithing logi unit whih implements sale independent hysteresis swithing as follows at an instant of time when ontroller is operating, suh that is, ) V for some, if there exists a that h for some fixed hysteresis onstant, then the swithing logi sets ) and applies output of ontroller to the plant. Below we desribe and analyze the HIOA representing this swithing logi unit, whih we all HysteresisSwithingLogi automaton. We onsider a finite set of ontinuous, monotonially satisfying nondereasing monitoring signals, 6 ` s (8) u vg v T for some h (9) where s T u and v are positive onstants for eah. Equation (8) sets a lower bound on the initial values of all the monitoring signals, and Equation (9) states that there exists some h 6 for whih the orresponding monitoring signal satisfies the exponential upper bound. A. HIOA Speifiation In speifying the hysteresis swith as a HIOA (Figure 1), we adopt the style desribed in [16]. The input, output, and state (internal) variables are delared and initialized in the variables setion of the ode. Eah variable s type is listed, after a olon, following its name in the delaration. The variables delared with the preeding analog keyword are ontinuous, the rest are disrete. The monitoring signals,, are delared as input variables beause they are ontrolled by an external soure. And, the disrete swithing signal ) is an output variable beause it is visible to the outside word; all other variables are internal and are not visible outside the automaton. The variables 2 and % ount the number of swithes and the number of

6 * K 6 periods elapsed; together they define E, the number of extra swithes. The history variables w s store the values of at the instants when ) beomes equal to for the time. The variable 2 ounts the number of intervals in whih ) has been equal to, and the real variable is a reset timer measuring the length of this interval. The disrete transitions setion defines the two ations of the automaton, namely %, 4 and *+f2 T 6. An ation is enabled or in other words, it an our when the ondition following the preondition keyword is true. The hange in the state variables when the ation does our is desribed by the effet part of the transition definition. The trajetories setion defines the evolution of the ontinuous variables in terms of the differential and algebrai equations. The %fb in the evolve setion stands for derivative. The stopping ondition, in this automaton, is the disjuntion of the ation preonditions, so it fores the ations to our whenever they are enabled. B. Invariant Properties In this setion we prove a sequene of invariants whih show that the exeutions of the HysteresisSwithingLogi automaton satisfy the average dwell time property with u ~ v". For simpliity of presentation, we prove the invariants required for asymptoti stability, and not uniform asymptoti stability, and aordingly the average dwell time property we get is over exeutions and not over exeution fragments of the automaton. The invariants losely orrespond to those outlined in Setion IV-C. The first three invariants lead to Corollary 2, whih orresponds to the first invariant of Setion IV-C and gives the lower bound on the hange in the history variables neessary to perform a ertain number of swithes. As for the seond invariant of Setion IV-C, we already have an upper bound on the rate of growth of the monitoring signals from Equations (8) and (9). Putting these two piees together in Invariant 5, and using Theorem 4 we derive the average dwell time property. Invariant 1. EG 2 & '. Proof. Initial states satisfy. The *+f2 ation does not affet the invariant. Consider the %, g ation ;. We know E,bE[ and the right hand side of the inequality does not hange, therefore the invariant is preserved. Also, all trajetories preserve the invariant. Invariant 2. For all, ) xt( J T, ) 12 ` V` xt( $ Proof. Part(1) Initial states satisfy. For the indution step we need to onsider only disrete transitions, Let, )R, we know that )R. By indutive hypothesis,,, for all. By preondition of *f2, (, K,. By ontinuity of s ( ḧk J, for all. From the above it follows that ḧp( all. The stopping ondition of ativity ) &, for ensures that the invariant is preserved over all trajetories. Part(2) Initial states satisfy the invariant beause ' *+/. For the indution step, onsider a disrete transition, where *f2. Let, )P, we know that ). From Part (1),,,, for all. By preondition of and by ontinuity of s,, for all. We note that the %, g ations do not alter any of the variables involved in the invariant. Now, onsider any trajetory. If is a point trajetory, then the invariant holds. If is not a point trajetory, then the invariant holds vauously beause $ gff, 1 `. Corollary 1. For all T, )K (. Invariant 3. For all, m m /du. 2 P( Proof. Initial states have for all. For the indution step we only have to onsider disrete transitions of the form, where V *+f2. Let, ) W,, 2 ;, that is, is the ; *+f2 ation. From the transition relation, and Corollary 1 9 ~ u ( (10) Let be the post state of the ; *f2 ation. From Invariant 2 Part(1) _ 9. From monotoniity of, K. Sine 9 is not hanged after, 9 (11) Combining (10) and (11), 9 ~ u J 9. m Corollary 2. 6 xt J m /du u. Invariant 4. There exists " suh that 2 m /du ". Proof. We observe that, the ounter 2 is inremented every, and for time a *f2 ation ours for any Q eah 4 the ounter 2 is inremented when the orresponding *+f2 ation ours. Sine there are ' possible values of, it follows that at least m /du " out of the 2 *f2 ations would orrespond to some in. Invariant 5. If we set the uf~ v" then, "$% &(' )+*-, $.0/ &(') "7 398 (12) Proof. Consider any reahable state, from Corollary 2, Invariant 4 and monotoniity of s we know that there m exists in suh that. P( ;=<>?A@ } /0u, u. Taking logarithm and rearranging we have, B C D, E% &(' ) 1 B C HJI &(' )+*-, F.G/ B C H K 5 Let be the post state of the 2 *f2 ation, then mml,. From Invariant 2 Part(2) and monotoniity

7 L 7 hybridautomaton HysteresisSwithingLogi( PosReal, IndexSet) variables input analog L, for eah, output, initially Š "qw L L, internal analog, initially s, internal m k, initially s, internal L z, for and w s u v, initially L Š L, } Š, otherwise Lz Š, Š, and m Šxu internal mml, initially s, for " internal L, initially s, for eah, derived variables onst "$ pš&% % ' pš m / k disrete transitions swithl for eah preondition u(~ L)( effet Š ; m Š m ~u ; mml Š mml ~u ; L < Š L ; L Šys dequeue preondition Š 9 & ' effet k Š k ~ u trajetories ativity flow evolve k Š u+* k L Š u -, stop at. u$~ L ( 0/ Š 9 &(' Fig. 1. HIOA speifiation of the hysteresis swithing logi in the supervisory ontroller it follows that, that, B C D, % m &(')0*-, F.0/ m _ &(' ) 1 B C H21 B C H 5 K 43 _,. It follows Form monotoniity and property (8) of the monitoring signals, u s s. Therefore, B C D, E% &(' )0*-, $.0/ &(') 1 BC H;1 3 8 <3 5=628>9 Replaing with of (9), we get B C D, % &(' ) ? 7A@CB D EF G &(' )0*-, $.0/ 398 IH B C D, % &(' ) "7 BC JLKM &(' )0*-, $.0/ &(' )0*-, E.0/ 398 Using Invariant 1, and putting result. u ~ v", we get the u ~ v". Theorem 6. The HysteresisSwithingLogi automaton has an average dwell time of at least Proof. Follows from Invariant 5 and Theorem 4. VI. REMARKS AND FUTURE WORK We have introdued the hybrid I/O automaton framework [12] as a ommon modeling platform in whih analysis tehniques from both omputer siene and ontrol theory an be applied. To demonstrate the utility and expressive power of this framework, we have shown how known stability theorems from system theory literature an be adapted and applied in the HIOA framework. Our main ontribution is to formalize the average dwell time property of hybrid systems as a set of invariants and thereby making it possible to prove (uniform) stability of hybrid systems under slow swithing using formal verifiation tehniques. The suggested method has been illustrated by analyzing the stability of a hysteresis swithing logi unit in a supervisory ontrol system. In this paper we examined internal stability only, however, the HIOA framework expliitly inorporates external variables and is also useful for studying input-output properties of hybrid systems. Further, we have proved the invariants in this paper by hand, but it is possible to mehanize the invariant proofs using theorem provers, and in ertain speial ases to ompletely automate the proofs with symboli model hekers. Of ourse, substantial work remains to be done both in terms of building software tools and developing the theory, in order to have an effiient and seamless proess for stability analysis of hybrid systems, and we plan to pursue these in the future. VII. ACKNOWLEDGMENTS This work signifiantly benefited from disussions with Nany Lynh on the use of formal methods in stability analysis of hybrid systems. We also thank Peter B. Jones for his omments on related ase studies. REFERENCES [1] Rajeev Alur, Costas Couroubetis, Niolas Halbwahs, Thomas A. Henzinger, P.-H. Ho, avier Niollin, Alfredo Olivero, Joseph Sifakis, and Sergio Yovine. The algorithmi analysis of hybrid systems. Theoretial Computer Siene, 138(1)3 34, [2] M. Arher, C. Heitmeyer, and S. Sims. TAME A PVS interfae to simplify proofs for automata models. In Proeedings of UITP 98, July [3] M. Braniky. Multiple lyapunov funtions and other analysis tools for swithed and hybrid systems. IEEE Transations on Automati Control, , [4] Ekaterina Dolginova and Nany Lynh. Safety verifiation for automated platoon maneuvers A ase study. In HART 97 (International Workshop on Hybrid and Real-Time Systems), volume 1201 of Leture Notes in Computer Siene series, Grenoble, Frane, Marh Springer Verlag. [5] Connie Heitmeyer and Nany Lynh. The generalized railroad rossing A ase study in formal verifiation of real-time system. In Proeedings of the 15th IEEE Real-Time Systems Symposium, San Juan, Puerto Rio, Deember IEEE Computer Soiety Press. [6] Thomas Henzinger. The theory of hybrid automata. In Proeedings of the 11th Annual IEEE Symposium on Logi in Computer Siene (LICS 96), pages , New Brunswik, New Jersey, [7] J. Hespanha and A. Morse. Stability of swithed systems with average dwell-time. In Proeedings of 38th IEEE Conferene on Deision and Control, pages , 1999.

8 8 [8] J.P. Hespanha, D. Liberzon, and A.S. Morse. Hysteresis-based swithing algorithms for supervisory ontrol of unertain systems. Automatia, , [9] Dilsun K. Kaynar, Nany Lynh, Roberto Segala, and Frits Vaandrager. Timed I/O automata A mathematial framework for modeling and analyzing real-time system. In RTSS 2003 The 24th IEEE International Real-Time Systems Symposium, Canun,Mexio, Deember [10] Daniel Liberzon. Swithing in Systems and Control. Systems and Control Foundations and Appliations. Birkhauser, Boston, June [11] Carolos Livadas, John Lygeros, and Nany A. Lynh. High-level modeling and analysis of TCAS. In Proeedings of the 20th IEEE Real-Time Systems Symposium (RTSS 99),Phoenix, Arizona, pages , Deember [12] Nany Lynh, Roberto Segala, and Frits Vaandraage. Hybrid I/O automata. Information and Computation, 185(1) , August [13] Nany Lynh, Roberto Segala, Frits Vaandrager, and H. B. Weinberg. Hybrid I/O automata. In T. Henzinger R. Alur and E. Sontag, editors, Hybrid Systems III, volume 1066 of Leture Notes in Computer Siene, New Brunswik, New Jersey, Otober Springer- Verlag. [14] Nany A. Lynh, Roberto Segala, and Frits W. Vaandrager. Hybrid I/O automata revisited. In M.D. Di Benedetto and A.L. Sangiovanni- Vinentelli, editors, Proeedings Fourth International Workshop on Hybrid Systems Computation and Control (HSCC 01), Rome, Italy, volume 2034 of LNCS, pages Springer, Marh [15] Sayan Mitra, Yong Wang, Nany Lynh, and Eri Feron. Appliation of hybrid I/O automata in safety verifiation of pith ontroller for model heliopter system. Tehnial Report MIT-LCS-TR-880, MIT Laboratory for Computer Siene, Cambridge, MA 02139, January http//theory.ls.mit.edu/mitras/researh/. [16] Sayan Mitra, Yong Wang, Nany Lynh, and Eri Feron. Safety verifiation of model heliopter ontroller using hybrid Input/Output automata. In HSCC 03, Hybrid System Computation and Control, Prague, the Czeh Republi, April Also, long version in [15]. [17] A. S. Morse. Supervisory ontrol of families of linear set-point ontrollers, part 1 exat mathing. IEEE Transations on Automati Control, , [18] A. van der Shaft and H. Shumaher. An Introdution to Hybrid Dynamial Systems. Springer, London, 2000.