A Uniform Approach to Three-Valued Semantics for µ-calculus on Abstractions of Hybrid Automata

Transcription

1 A Uniform Approach to Thr-Valud Smantics for µ-calculus Abstractis of Hybrid Automata K. Baur, R. Gntilini, and K. Schnidr Dpartmnt of Computr Scinc, Univrsity of Kaisrslautrn, Grmany {k Abstract. Abstracti/rfinmnt mthods play a cntral rol in th analysis of hybrid automata, that ar rarly dcidabl. Soundnss (of valuatd proprtis) is a major challng for ths mthods, sinc abstractis can introduc unralistic bhaviors. In this papr, w csidr th dfiniti of a thr-valud smantics for μ- calculus abstractis of hybrid automata. Our approach rlis two stps: First, w dvlop a framwork that is gnral in th sns that it provids a prsrvati rsult that holds for svral possibl smantics of th modal oprators. In a scd stp, w instantiat our framwork to two particular abstractis. To this nd, a ky issu is th csidrati of both ovr- and undr-approximatd rachability analysis, whil classic simulati-basd abstractis rly ly ovrapproximatis, and limit th prsrvati to th univrsal (μ-calculus ) fragmnt. To spcializ our gnral rsult, w csidr (1) so-calld discrt boundd bisimulati abstractis, and (2) modal abstractis basd may/must transitis. 1 Introducti Hybrid automata [16,1] provid an appropriat modling paradigm for systms whr ctinuous variabls intract with discrt mods. Such modls ar frquntly usd in complx nginring filds lik mbddd systms, robotics, aviics, and arautics [2,12,24,25]. In hybrid automata, th intracti btwn discrt and ctinuous dynamics is naturally xprssd by associating a st of diffrntial quatis to vry locati of a finit automat. Finit automata and diffrntial quatis ar wll stablishd formalisms in mathmatics and computr scinc. Dspit of thir lg-standing traditi, thir combinati in form of hybrid automata lads to surprisingly difficult problms that ar oftn undcidabl. In particular, th rachability problm is undcidabl for most familis of hybrid automata [1,14,20,21,22], and th fw dcidability rsults ar built up strg rstrictis of th dynamics [3,17]. Th rachability analysis of hybrid automata is a fundamntal task, sinc chcking safty proprtis of th undrlying systm can b rducd to a rachability problm for th st of bad cfiguratis [16]. For this ras, a growing body of rsarch is bing dvlopd th issu of daling with approximatd rachability undcidabl yt rasably xprssiv hybrid automata [9,11,23,25,26]. To this nd, most of th tchniqus proposd so far ithr rly boundd stat-rachability or th dfiniti of finit abstractis. Whil th first approach suffrs inhrntly of incompltnss, th qust for soundnss isakyissuin H. Chocklr and A.J. Hu (Eds.): HVC 2008, LNCS 5394, pp , c Springr-Vrlag Brlin Hidlbrg 2009

2 A Uniform Approach to Thr-Valud Smantics for μ-calculus 39 th ctxt of mthods basd abstractis. In fact, abstractis can introduc unralistic bhaviors that may yild to spurious rrors bing rportd in th safty analysis. Usually, a simulati prordr is rquird to rlat th abstracti to th ccrt dynamics of th hybrid systm undr csidrati, nsuring at last th corrctnss of ach rsps of (abstract) n rachability. In this work, w provid a uniform approach to th sound valuati of gnral ractiv proprtis abstractis of hybrid automata. Hr, gnral rfrs to th fact that w spcify proprtis by mans of th highly xprssiv logic of μ-calculus, that covrs in particular CTL and othr spcificati logics. Uniform, instad, mphasizs that w csidr diffrnt possibl classs of abstractis, whos analysis prmits to rcovr both undr- and ovrapproximatis of stat-sts fulfilling a givn rachability rquirmnt. Intuitivly, this rquirmnt is a minimal prrquisit for rcovring sound abstract valuatis of arbitrary μ-calculus formulas. To achiv our rsults w procd by two stps: W start with th dvlopmnt of a gnric smantics schm for th μ-calculus, whr th maning of th modal oprators can b adaptd to particular abstractis. Assuming crtain cstraints for th smantics of ths oprators, w can prov a prsrvati rsult for our gnric smantics schm, thus providing a gnral framwork for diffrnt classs of abstractis. In a subsqunt stp, w spcializ our framwork to suitabl abstractis. In particular, w dmstrat th applicability of our framwork by csidring (1) th class of so-calld discrt boundd bisimulati (DBB) abstractis [10], and (2) a kind of modal abstractis basd may/must transitis. As a final ctributi, w compar ths instancs of our framwork with rspct to th issu of moticity of prsrvd μ-calculus formulas. Th papr is organizd as follows: Prliminaris ar givn in Scti 2. Scti 3 introducs th classs of abstractis usd in Scti 5 to instantiat th gnric rsult prsrvativ thr-valud μ-calculus smantics outlind in Scti 4. Th moticity issu is dalt with in Scti 6, whil Scti 7 ccluds th papr discussing its ctributis. All proofs ar givn in th appndix and in [4]. 2 Prliminaris In this scti, w introduc th basic notis usd in th rmaindr of th papr. Dfiniti 1 (Hybrid Automata [3]). A Hybrid Automat is a tupl H = L, E, X, Init, Inv,F,G,R with th following compnts: a finit st of locatis L a finit st of discrt transitis (or jumps) E L L a finit st of ctinuous variabls X = {x 1,...x n } that tak valus in R an initial st of cditis: Init L R n Inv : L 2 Rn,thinvariant locati labling F : L R n R n, assigning to ach locati l L a vctor fild F (l, ) that dfins th voluti of ctinuous variabls within l G : E 2 Rn,thguard dg labling R : E R n 2 Rn,thrst dg labling.

3 40 K. Baur, R. Gntilini, and K. Schnidr W writ v to rprsnt a valuati (v 1,...,v n ) R n of th variabls vctor x = (x 1,...,x n ), whras ẋ dnots th first drivativs of th variabls in x (thy all dpnd th tim, and ar thrfor rathr functis than variabls). A stat in H is a pair s =(l, v), whrl L is calld th discrt compnt of s and v is calld th ctinuous compnt of s. Arun of H is a path in th tim abstract transiti systm of H, givn in Dfiniti 2. Dfiniti 2. Th tim abstract transiti systm of th hybrid automat H = L, E, X, Init, Inv,F,G,R is th transiti systm T H = Q,Q 0,l,, whr: Q L R n and (l, v) Q if and ly if v Inv(l) Q 0 Q and (l, v) Q 0 if and ly if v Init(l) Inv(l) l = {, } is th st of dg labls, that ar dtrmind as follows: thrisactinuous transiti (l, v) (l, v ), if and ly if thr is a diffrntiabl functi f :[0,t] R n, with f :[0,t] R n such that: 1. f(0) = v and f(t) =v 2. for all ε (0,t), f(ε) Inv(l), and f(ε) =F (l, f(ε)). thrisadiscrt transiti (l, v) (l, v ) if and ly if thr xists an dg (l, l ) E, v G(l) and v R((l, l ), v). Dfiniti 3 and Dfiniti 4 rcapitulat th syntax and th smantics of th μ-calculus languag L μ hybrid automata, rspctivly [6,7]. Dfiniti 3 (L μ Syntax). Th st of μ-calculus prformulas for a st of labls a {, } and propositis p AP is dfind by th following syntax: φ := p φ φ 1 φ 2 φ 1 φ 2 a φ [a]φ E(φ 1 Uφ 2 ) A(φ 1 Uφ 2 ) μz.φ νz.φ Th st L μ of μ-calculus formulas is dfind as th subst of pr-formulas, whr ach subformula of th typ μz.φ and νz.φ satisfis that all occurrncs of Z in φ occur undr an vn numbr of ngati symbols. Dfiniti 4 (Smantics of L μ Hybrid Automata). Lt AP b a finit st of propositial lttrs, lt p AP and csidr H = L, E, X, Init, Inv,F,G,R. Givn l AP : Q 2 AP and φ L μ, th functi φ : Q {0, 1} is inductivly dfind: p (q) =1iff p l AP (q) φ := φ φ ψ := φ ψ for {, } E(φUψ) (q) =1iff thr xists a run ρ dparting from q that admits a prfix ρ a := q 1 a n qn,whrq = q 1, a i {, }, q i =(l, v i ), satisfying: ψ (q n )=1and for 1 i<n: φ (q i )=1 for a i = : a diffrntiabl functi f :[0,t] R n, for which: 1. f(0) = v i and f(t) =v i+1 2. for all ε (0,t), f(ε) Inv(l), and f(ε) =F (l, f(ε)) 3. for all ε (0,t), q =(l i,f(ε)) satisfis φ ψ (q )=1 A(φUψ) (q 1 )=1ifffor all runs ρ dparting from q thr xists a prfix ρ := a q 1 a n qn,whrq = q 1, a i {, }, q i =(l, v i ), satisfying:

4 A Uniform Approach to Thr-Valud Smantics for μ-calculus 41 ψ (q n )=1and for 1 i<n: φ (q i )=1 for a i = : a diffrntiabl functi f :[0,t] R n, for which: 1. f(0) = v i and f(t) =v i+1 2. for all ε (0,t), f(ε) Inv(l), and f(ε) =F (l, f(ε)) 3. for all ε (0,t), q =(l i,f(ε)) satisfis φ ψ (q )=1 a φ (q) =1iff q a q : φ (q )=1 [a]φ (q) =1iff q a q : φ (q )=1 Th fixpoint oprators ar dfind in th following way: Lt [φ] ψ Z b th formula obtaind by rplacing all occurrncs of Z with ψ. Givn a fixpoint formula σz.φ with σ {μ, ν} its k-th approximati apx k (σz.φ) is rcursivly dfind as follows: apx 0 (μz.φ) :=0and apx k+1 (μz.φ) :=[φ] apx k(μz.φ) Z apx 0 (νz.φ):=1and apx k+1 (νz.φ):=[φ] apx k(νz.φ) Z Thn smallst and gratst fixpoints σz.φ ar dfind by smallst fixpoint: μz.φ := apx k (μz.φ) k N gratst fixpoint: νz.φ := apx k (μz.φ) k N H φ iff q 0 Q 0 : φ (q 0 )=1. Th following dfiniti rcalls th noti of simulati rlati, that plays a cntral rol in th ctxt of hybrid automata abstractis. Dfiniti 5 (Simulati). Lt T 1 = Q 1,Q 1 0,l, 1, T 2 = Q 2,Q 2 0,l, 2, Q 1 Q 2 =, b two dg-labld transiti systms and lt P b a partiti Q 1 Q 2.Asimulati from T 1 to T 2 is a n-mpty rlati ρ Q 1 Q 2 such that, for all (p, q) ρ: p Q 1 0 iff q Q 2 0 and [p] P =[q] P. for ach labl a l, if thr xists p such that p a p, thn thr xists q such that (p,q ) ρ and q a q. If thr xists a simulati from T 1 to T 2, thn w say that T 2 simulats T 1, dnotd T 1 S T 2.IfT 1 S T 2 and T 2 S T 1,thnT 1 and T 2 ar said similar, dnotd T 1 S T 2.Ifρis a simulati from T 1 to T 2, and th invrs rlati ρ 1 is a simulati from T 2 to T 1,thnT 1 and T 2 ar said bisimilar, dnotd T 1 B T 2 3 Abstractis of Hybrid Automata for Paralll ovr- and Undrapproximatd Rachability Analysis In this scti, w introduc two kinds of abstractis that w will us in th squl to spcializ our gnral prsrvati rsult for μ-calculus smantics. Most of th abstracti/rfinmnt mthods for hybrid automata in th litratur ar basd ovrapproximatis of th rachabl stats 1. In particular, thy rly a gnric noti of abstractis basd th simulati prordr. Th lattr is rquird to rlat th abstracti to th dynamics of th hybrid automat, as formalizd blow. 1 Not that th rachability problm is undcidabl for most classs of hybrid automata.

5 42 K. Baur, R. Gntilini, and K. Schnidr Dfiniti 6 (Abstracti). Lt H b a hybrid automat. An abstracti of H is a finit transiti systm A = R, R 0,, in which 1. R is a finit partiti of th stat spac of H, R 0 R is a partiti of th initial stats, R R and R R 2. A := R, R 0, simulats th tim abstract transiti systm T H associatd to H, whr dnots th transitiv closur of th ctinuous transitis Sinc this basic noti of abstracti givs ly an ovrapproximati of th hybrid automat s rachabl stats, its usag is inhrntly limitd to th univrsal fragmnt of th μ-calculus [5]. As w ar intrstd in unrstrictd μ-calculus proprtis,w nd a mor powrful abstracti/rfinmnt approach. To this nd, a minimum rquirmnt is th combinati of both ovr- and undrapproximatis of stat-sts satisfying a givn rachability proprty. Th csidrati of paralll ovr- and undrapproximatd rachability hybrid automata is quit nw: In [10], discrt boundd bisimulati (DBB) abstractis, brifly rcalld in Subscti 3.1, wr dsignd for this purpos. Anothr approach that lads to ovr- and undrapproximatis is givn by modal abstractis for hybrid automata, that w dvlop in Subscti 3.2 (gnralizing th dfinitis givn in ctxt of discrt systms [13]). 3.1 Discrt Boundd Bisimulati (DBB) Abstractis It is wll known that th classic bisimulati quivalnc can b charactrizd as a coarsst partiti stabl with rspct to a givn transiti rlati [18]. Boundd bisimulati imposs a bound th numbr of tims ach dg can b usd for partiti rfinmnt purposs. For th quivalnc of discrt boundd bisimulati (DBB), th lattr bound applis ly to th discrt transitis of a givn hybrid automat, as rcalld in Dfiniti 7, blow. Dfiniti 7 (Discrt Boundd Bisimulati [10]). Lt H b an hybrid automat, and csidr th partiti P th stat-spac Q of T H = Q, Q 0,l,. Thn: 1. 0 Q Q is th maximum rlati Q such that for all p 0 q (a) [p] P =[q] P and p Q 0 iff q Q 0 (b) p p q : p 0 q q q (c) q p q : p 0 q p p 2. n Q Q is th maximum rlati Q such that for all p n q (a) p n 1 q (b) p p q : p n q q q (c) q p p : p n q p p (d) p p q : p n 1 q q q () q q p : p n 1 q p p For n N, th rlati n will b calld n-dbb quivalnc.

6 A Uniform Approach to Thr-Valud Smantics for μ-calculus 43 Th succssi of n-dbb quivalncs ovr an hybrid automat H naturally inducs a sris of abstractis for H, as statd in Dfiniti 8. Dfiniti 8 (Sris of DBB Abstractis [10]). Lt H b a hybrid automat and T H = Q, Q 0,l, b th associatd tim abstract transiti systm. Lt P b a partiti of Q and csidr th n-dbb quivalnc n. Thn, th n-dbb abstracti H n = Q,Q 0,l is dfind as follows: Q = Q / n, Q 0 = Q 0/ n α, β Q : α β iff a α b β : a b α β iff a α b β : a b and th path a b ly travrss α and β Th xistnc of a simulati prordr rlating succssiv lmnts in a sris of DBB abstractis allows th rfinmnt of ovrapproximatis of rachabl sts in th csidrd hybrid automat [10]. Morovr, H n prsrvs th rachability of a givn rgi of intrst (in th initial partiti) whnvr th lattr can b stablishd H following a path that travrss at most n locatis [10]. On this ground, it is also possibl to us th succssi of DBB abstractis to obtain -motic undrapproximatis of th st of stats fulfilling a givn rachability rquirmnt. 3.2 Modal Abstractis Basd May/Must Rlatis For discrt systms [13], a may-transiti btwn two abstract classs r and r ncods that for at last som stat in r thr is a transiti to som stat in r. In turn, a must-transiti btwn r and r stats that all stats in r hav a transiti to a stat in r. Naturally, may-transitis (rsp. must-transitis) rfr to ovrapproximatd (rsp. undrapproximatd) transitis amg classs of an abstract systm. Th abov idas can b xtndd to th ctxt of hybrid automata as formalizd in Dfiniti 9. Dfiniti 9 (Modal Abstractis). Lt A = R, R 0,, b an abstracti of th hybrid automat H.ThnA is a modal abstracti (or may/must abstracti)ofh iff th following proprtis hold:,whr is dfind as follows: r r iff for all x r thr xists an x r such that H can volv ctinuously from th stat x to th stat x by travrsing th ly rgis r and r. must whr must is dfind as follows: r must r iff for all x r thr xists an x r s.t. x x in H. Th subautomat R, R 0, must, must of A is calld A must. Givn th modal abstracti A for th hybrid automat H, Lmma 1 stats that A must is simulatd by th tim abstract transiti systm T H of H. Lmma 1. Lt H b a hybrid automat and lt A b a may/must abstracti of H. Thn, th subautomat A must of A is simulatd by T H,i..A must S T H S A.

7 44 K. Baur, R. Gntilini, and K. Schnidr On this ground, may/must abstractis can b usd not ly to ovrapproximat, but also to undrapproximat th st of stats modling a givn rachability proprty, as statd in Corollary 1. Corollary 1. Lt A = R, R 0, b a modal abstracti for th hybrid automat H, and lt F b a st of (final) stats in H. Assum that F is csistnt with rspct to R, i.. for all r R : r F = r r F =. Ifr R admits a path to r F in A must, thn for all s r, xistss r such that H admits a run from s to s. 4 A Gnric Smantics for µ-calculus Abstractis of Hybrid Automata In this scti, w prsnt of th main ingrdints of our approach: a gnric thrvalud smantics for μ-calculus abstractis of hybrid automata. Hr, two kywords dsrv our attnti: Gnric and thr-valud. Th choic of a thr-valud logic as th bas of our smantics is motivatd by th broad family of abstractis that w csidr for our framwork. In fact, th abstractis w hav in mind ar in gnral lss prcis than a bisimulati (which allows for xact rachability analysis, but is sldom finit), and mor prcis than a simulati (that allows ly for ovrapproximatd rachability analysis). Hnc, w can not xpct that any μ-calculus formula is prsrvd, howvr it should b possibl to rcovr at last all tru univrsal μ-calculus subformulas 2. By mans of a thr-valud logic, w can us th third valu to distinguish th cass for which it is not possibl to driv a boolan truth valu, du to th coarsnss of th abstracti. Instad, th prsrvati applis to all th boolan rsults stablishd using th abstract smantics. In th following, w writ 3, 3, 3 for th thr-valud xtnsis of th boolan opratis,,, rspctivly 3. Th scd kyword gnric is bttr undrstood as a way of stablishing a link btwn (1) th qust for soundnss in our smantics, and (2) th varity of pattrns according to which diffrnt abstractis split th informati ovr thir rgis. Our gnric smantics is an abstract smantics schm, whr th valuati is fixd for som oprators (namly boolan and fixpoint oprators), and ly subjct to som cstraints for th othrs. Th cstraints ar sufficint to stablish a gnral prsrvati rsult, though th smantics schm can b adaptd to svral classs of abstractis. Givn th abov prmiss, w ar now rady to formaliz in Dfiniti 10 our thrvalud gnric smantics for μ-calculus abstractis of hybrid automata. Not that for a μ-calculus formula φ, w distinguish btwn th smantics φ H a hybrid automat H (as givn in Dfiniti 4) and th smantics φ (r) th rgi r of an abstracti of H. Dfiniti 10 (Gnric μ-calculus Smantics). Lt H b a hybrid automat whos stat spac is partitid into finitly many rgis of intrst by th labling functi l AP : Q 2 AP,whrAP is a finit st of propositial lttrs. Lt φ b a 2 Rcall that bisimulati prsrvs th whol μ-calculus, whil simulati prsrvs th ly tru univrsally quantifid formulas. 3 W us Kln s dfiniti of thr-valud logic [19].

8 A Uniform Approach to Thr-Valud Smantics for μ-calculus 45 μ-calculus formula with atomic propositis AP, and csidr th abstracti A = R, R 0,l, whr R isassumdtorfin 4 th rgis of intrst in H. { 1 φ lap (r) 1. If φ is an atomic propositi, thn φ (r) = 0 othrwis 2. If φ = ϕ, thn ϕ = 3 ϕ 3. If φ = ϕ ψ, thn ϕ ψ = ϕ 3 ψ 4. If φ = ϕ ψ, thn ϕ ψ = ϕ 3 ψ 5. If φ { ϕ, ϕ, []ϕ, []ϕ, E(ϕUψ),A(ϕUψ)}, thn φ is rquird to fulfill th following cditis: φ (r) =1 x r : φ H (x) =1 φ (r) =0 x r : φ H (x) =0 6. Lt φ {μz.ϕ, νz.ϕ} b a fixpoint formula. Lt [ϕ] ψ Z b th formula obtaind by rplacing all occurrncs of Z with ψ. Givn a fixpoint formula σz.ϕ with σ {μ, ν}, its k-th approximati apx k (σz.ϕ) is rcursivly dfind as follows: apx 0 (μz.ϕ) :=0and apx k+1 (μz.ϕ) :=[ϕ] apx k(μz.ϕ) Z apx 0 (νz.ϕ):=1and apx k+1 (νz.ϕ):=[ϕ] apx k(νz.ϕ) Z Th smantics of last and gratst fixpoints σz.ϕ ar dfind by apxˆkσz.ϕ whr ˆk is th smallst indx whr apxˆk(σz.ϕ) = apxˆk+1 (σz.ϕ) holds. Lt φ b a μ-calculus formula and lt A = R, R 0, b an abstracti of th hybrid automat H. On th ground of Dfiniti 10, w can dfin a thr-valud rlati 3 stating whthr A is a modl of th formula φ: 1 r R 0 : φ (r) =1 A 3 φ = 0 r R 0 : φ (r) =0 othrwis Thorm 1 blow stats that both rsults tru and fals stablishd A via 3 ar prsrvd th undrlying hybrid automat. Not that Thorm 1 has a sort of uniform charactr, sinc 3 subsums indd many possibl ffctiv smantics for μ-calculus, th lattr rcovrd by spcializing th smantics of th modal oprators according to th proprtis of diffrnt classs of abstractis. For th rst of this work lt b th partial ordr ovr {0, 1, } dfind by th rflxiv closur of {(, 0), (, 1)}. Thorm 1 (Uniform Prsrvati Thorm). Lt H b a hybrid automat, lt A b an abstracti of H. Thn, for any μ-calculus formula φ, w hav A 3 φ H φ. Hnc, if A 3 φ is 1, so is H φ,andifa 3 φ is 0, so is H φ, andifa 3 φ is, thn H φ is compltly unknown. For this ras, both valid and invalid subformulas can b prsrvd with our framwork as lg as th abstracti is not too coars. 4 Not that our assumpti (th partiti of Q into rgis of intrst is rfind by th abstracti A = R, R 0,l, ) implis that r R x 1,x 2 R : l AP (x 1)=l AP (x 2) holds. Thus, th labling functi can b asily xtndd to l AP : R 2 AP.

9 46 K. Baur, R. Gntilini, and K. Schnidr 5 Instantiati to DBB- and May/Must-Abstractis In this scti, w spcializ th gnral prsrvati rsult givn in Scti 4 to two particular instancs, namly to modal and DBB abstractis. As a rsult, w obtain two prsrvativ abstracti/rfinmnt framworks for μ-calculus hybrid automata. 5.1 Smantics Complti for May/Must-Abstractis In modal abstractis, ach must (rsp. must ) dg undrapproximats a ctinuous (rsp. discrt) voluti for th undrlying hybrid automata. In turn, ach (rsp. ) dg ovrapproximats a ctinuous (rsp. discrt) voluti for th csidrd hybrid automat. Th abov csidratis can b usd to proprly instantiat th smantics for th modal oprators may/must abstractis, complting th smantics schm givn in Dfiniti 10. Csidr for xampl th modal oprator. According to th adaptiv smantics schm in Dfiniti 10, w should instantiat th smantics ϕ in such a way that whnvr ϕ valuats to 1 (rsp. 0) an abstract rgi, thn it valuats to 1 (rsp. 0) all th stats of th rgi. This cstraint is naturally guarantd modal abstractis if w us ly must dgs (rsp. dgs) to inspct for tru (rsp. fals) valuatis. A similar way of rasing allows to compltly adapt th smantics schm in Dfiniti 10 to th cas of modal abstractis, as formalizd in Dfiniti 11. Dfiniti 11. Lt H b a hybrid automat, A = R, R 0, b a may/must abstracti of H and lt ϕ and ψ b μ-calculus formulas. Thn, th smantics of th thr-valud μ-calculus of Dfiniti 10 for a, a i {, } is compltd by: 1 r must r : ϕ (r )=1 ϕ (r) 0 r r : ϕ (r )=0 othrwis 1 r r : ϕ (r )=1 ϕ (r) 0 r r : ϕ (r )=0 othrwis [a]φ = ( a φ) Lt {r n } n N (rsp. {r n } must n N ) dnot an infinit path of A (rsp. A must) starting in r = r 0. Thn: 1 {r n } must n N k N : ψ (r k)=1 ϕ (r i<k )=1 E(ϕUψ) (r) 0 {r n } n N k N : ψ (r k ) 0 i<k: ϕ (r i )=0 othrwis 1 {r n } n N k N : ψ (r k )=1 ϕ (r i<k )=1 A(ϕUψ) (r) 0 {r n } must n N k N : ψ (r k) 0 i<k: ϕ (r i )=0 othrwis Lmma 2, blow, stats th corrctnss of our instantiati, namly it nsurs that th smantics for th modal oprators may/must abstractis in Dfiniti 11 fulfill th cstraints providd in Dfiniti 10.

10 A Uniform Approach to Thr-Valud Smantics for μ-calculus 47 (20,24) must (22,24) (20,24) must (22,24) 20 [19,22] 20 [19,22] must (18,20) (18,19) (19.5,20) (18,19) (18,19.5] Fig. 1. May/Must Abstracti A 1 of th Hating Ctrollr Fig. 2. May/Must Abstracti A 2 of th Hating Ctrollr Lmma 2. Lt A b a modal abstracti for th hybrid automat H, and assum to intrprt μ-calculus formulas according to Dfiniti 11. Thn, for any formula φ { ϕ, ϕ, []ϕ, []ϕ, E(ϕUψ), A(ϕUψ)}, w hav: φ (r) =1 x r : φ H (x) =1 φ (r) =0 x r : φ H (x) =0 On this ground, th uniform prsrvati thorm givn in th prvious scti (cfr. Thorm 1) applis to our spcializd smantics, as statd in Corollary 2. Corollary 2. Lt A b a modal abstracti for th hybrid automat H, and assum to intrprt μ-calculus formulas according to Dfiniti 11. Thn A 3 φ H φ. x>18 ẋ = 0.1x x>22, x = x x<20, x = x Fig. 3. Hating Ctrollr x<24 ẋ =5 0.1x W cclud this subscti by providing a ccrt xampl, which illustrats our thr-valud smantics modal abstractis. Figur 3 dpicts a hating ctrollr csisting of th two discrt stats and. Whil th hating is, th tmpratur x falls via th diffrntial rul ẋ = 0.1x. Cvrsly, whil th hating is, th tmpratur riss via ẋ =5 0.1x. Th locati may b lft, whn th tmpratur falls blow 20 dgr and it has to b lft, whn x falls blow 18 dgr. Symmtric cditis hold for. Initially, th hating ctrollr starts at th locati with a

11 48 K. Baur, R. Gntilini, and K. Schnidr tmpratur of 20 dgrs. Figur 1 and Figur 2 dpict two diffrnt modal abstractis A 1 and A 2 for th hating ctrollr. Csidr th formula ψ = μz.φ Z, whr φ dnots a propositial lttr bing tru for th abstract stat (, (20, 24)). This formula holds in th stats that can rach a cfigurati whr th tmpratur is btwn 20 and 24 dgr and th hating is. Applying th smantics schm A 1, this formula can not b provn sinc A 1 dos not admit a must-path from th initial rgi to (, (20, 24)). Cvrsly,ψ can not b falsifid, sinc thr xists a may-path from th initial rgi to th targt rgi. Using A 2 instad w can stablish A 2 ψ, sinca 2 ctains a must-path lading to (, (20, 24)). This yilds H ψ, by our prsrvati thorm. 5.2 Smantics Complti for DBB Abstractis W now turn out to th csidrati of DBB abstractis, providing a furthr spcializati of th uniform prsrvati rsult discussd in scti 4. DBB abstractis ncod th informati for paralll ovr- and undrapproximatd rachability analysis diffrntly from modal abstractis. In particular, thr is no distincti btwn dgs that ovr-stimat (rsp. undr-stimat) th voluti of th undrlying hybrid automat. Rathr, a discrt dg btwn th abstract stats [r] n and [r] n in H n mans that H can volv from [r] n to [r ] n 1 [r ] n,viaa discrt dg. Th ctinuous dgs in H n rprsnt instad with fidlity th ctinuous voluti alg th rgis of th abstracti. Ths csidratis ar usful to undrstand th ratio undrlying th dvlopmnt of th xact smantics for th modal oprators DBB abstractis, givn in Dfiniti 12. Dfiniti 12. Lt H b a hybrid automat and H n = Q / n,q 0/ n,l, / n b its n-dbb abstracti. Thn th smantics schm in Dfiniti 10 is compltd by th following ruls: Th valu of ϕ n ([x] n ) is givn by 1 [x ] n Q / n :[x] n [x ] n ϕ n ([x ] n )=1 0 [x ] n Q / n :[x] n [x ] n ϕ n ([x ] n )=1 othrwis Th valu of ϕ n ([x] n ) is givn by 1 [x ] n Q / n :[x] n [x ] n ϕ n 1 ([x ] n )=1 0 [x ] n Q / n :[x] n [x ] n ϕ n ([x ] n ) 0 othrwis [a]ϕ n := ( a ϕ) n for a {, } Lt us us th notati {[x i ] n } to rprsnt an infinit path in H n. Thn: Th valu of E(ϕUψ) n ([x 0 ] n ) is givn by 1 {[x i] n} k N :1.[x i<k ] n [x i+1] n ϕ ψ n([x i] n) =1 2. ψ n([x k ] n) =1or [x k ] n [x k+1 ] n E(ϕUψ) n 1([x k+1 ] n 1) =1 0 {[x i] n} k N : ψ n([x k ] n) 0 j<k: ϕ ψ n([x j] n) =0 othrwis

12 A Uniform Approach to Thr-Valud Smantics for μ-calculus 49 Th valu of A(ϕUψ) n([x 0] n) is givn by 1 {[x i] n} k N : ψ n([x k ] n) =1 ϕ ψ n([x i<k ] n) =1 0 {[x i] n} k N :1.[x i<k ] n [x i+1] n ϕ ψ n([x i] n) =1 2. ϕ ψ n([x k ] n) =0or [x k ] n [x k+1 ] n A(ϕUψ) n 1([x k+1 ] n 1) =0 othrwis On th ground of Lmma 3 th uniform prsrvati thorm in Scti 4 applis also to our spcializd smantics for DBB abstractis, as formally statd in Corollary 3. Lmma 3. Lt H n b an n-dbb abstracti for th hybrid automat H, and assum to intrprt μ-calculus formulas according to Dfiniti 12. Thn, for any formula φ { ϕ, ϕ, []ϕ, []ϕ, E(ϕUψ),A(ϕUψ)}: φ (r) =1 x r : φ H (x) =1 φ (r) =0 x r : φ H (x) =0 Corollary 3. Lt H n b an n-dbb abstracti for th hybrid automat H, and assum to intrprt μ-calculus formulas according to Dfiniti 12. Thn for any formula φ L μ : H n 3 φ H φ x 2 10 ẋ 1 =1 ẋ 2 =1 shut x 1 =0 x 2 =10 x 1 0 ẋ 1 = 1 ẋ 2 = 2 opn Fig. 4. Watr Lvl Ctrollr Th following xampl illustrats th instantiati of th smantic framwork to DBB abstractis dscribd so far. Th hybrid automat dpictd in Fig. 4 modls a watr lvl ctrollr with two variabls. Th first variabl x 1 rprsnts a clock, whil th scd variabl x 2 modls th watr lvl in th tank. Whn th valv at th bottom of th tank is closd, th watr lvl incrass by 1ms 1, othrwis it dcrass by 2ms 1. Intuitivly, th clock allows to stablish that th valv rmains opn as lg as it was closd in th prvious stp. This hybrid automat dos not blg to any known dcidabl class, and it yilds infinit bisimulatis for suitabl initial partitis [15]. This is th cas.g. for th initial partiti P = {shut X, shut Y, opn X, opn Y } whr X =[0, 6] {10} and Y =[0, ) (, 10]\X. Howvr, th abov automat is fully O-minimal and thus th cstructi of DBB-Abstractis trminats [10]. Csidr th following qusti Whn starting in Init = opn [0, 6] {10}, dos th watr lvl ctrollr always admit an voluti to r = shut [0, 6] {10}?. Such a qusti corrspds to comput whthr H ψ, whrψ = μz.r Z. W us DBB abstractis to falsify th abov proprty. Figur 5 and Fig. 6 dpict th 0-DBB and 1-DBB abstracti, rspctivly. In th 0-DBB abstracti th formula ψ valuats to 1 r 1, r 2, r 3 and s 1, and is indfinit lswhr. Thus, (H ψ) = sinc ψ (s 2 )= for th ly initial rgi s 2 of H 0.Inth1-DBB abstracti H 1 th rgi s 2 gts split to t 2,t 3 and ψ valuats to 0 t 3. Sinc all a paths starting in t 3 do not allow to rach a rgi, whr ψ valuats to 1 or, w can cclud that (H 1 ψ) =0. Thus, du to th prsrvati thorm w can stat that H ψ.

13 50 K. Baur, R. Gntilini, and K. Schnidr r 1 r x r 3 r 4 y shut s 1 s x y s 5 opn r 2 r 3 s 5 s 2 r 4 Fig DBB Abstracti: Partitiing of th Rgis and Ctrol Graph of th Abstracti (for simplificati th cycl r 1 s 1 is lft out) r 5 r 1 r 3 r 2 r 4 r 7 x r 2 r 3 r 5 t 7 t 6 t 2 r 6 y shut t 1t 2 t 3 t 4 t 6 t 7 t 5 t 8 x opn x r 7 r 4 r 6 t 8 t 5 t 4 t 3 Fig DBB Abstracti: Partitiing of th Rgis and Ctrol Graph of th Abstracti (for simplificati th cycl r 1 s 1 is lft out) 6 Abstracti Rfinmnt and Moticity A ky issu in th ctxt of thr-valud abstract smantics for μ-calculus hybrid automata is rlatd to moticity. Givn an abstracti-rfinmnt framwork, it is dsirabl that th st of formulas valuating to dcrass motically in its siz alg any succssi of finr abstractis. Such a rquirmnt is rminiscnt of th usual rgularity proprty for Kln s thr-valud logics [8,19]. In this scti, w compar th two abstracti rfinmnt framworks basd DBB-abstractis and modal abstractis with rspct to moticity. Thorm 2 provs that th DBB succssi of abstractis allows to motically rcovr tru/fals μ-calculus formulas alg th sris of rfining abstractis. Thorm 2 (Moticity). Lt H n and H k with n>kb DBB abstractis of th hybrid systm H, and lt φ b a μ-calculus formula. Thn, (H k φ) (H n φ). Th following xampl shows instad that th abstracti/rfinmnt framwork basd modal abstractis dos not bhav wll with rspct to moticity. Exampl 1. Lt us csidr th abstracti A 3 dpictd in Fig. 7 which is a rfinmnt of th abstracti A 2 givn in Fig. 2. In Scti 5.1 w wr abl to stablish th rsult

14 A Uniform Approach to Thr-Valud Smantics for μ-calculus 51 (18,19.5] (19.5,20) 20 (20,24) must (18,19) (19,19.7) [19.7,22] (22,24) Fig. 7. Abstracti A 3 with may/must of th hating ctrollr (A 2 3 μz.φ Z) =1,whrφ is a propositial lttr bing tru (20, 24). Howvr, w cannot prov (A 3 3 μz.φ Z) = 1 sinc thr xist no must - transitis from th cfigurati to th cfigurati. 7 Cclusis In this papr, w dvlopd a framwork for infrring gnral μ-calculus proprtis abstractis of hybrid automata. Basd th dfiniti of a sound thr-valud smantics abstractis, our framwork dos not fatur th inhrnt limitatis of boundd modl chcking or tchniqus using th simulati prordr. In particular, our mthod can both prov and disprov arbitrary μ-calculus proprtis abstractis ovr- and undrapproximating (unboundd) volutis of th systm. To cop with th varity of candidat abstractis for our framwork, w rly a top-down approach in which w (1) fix th smantics of boolan and fixpoint oprators whil ly cstraining th modal oprators, and (2) csidr suitabl classs of abstractis to instantiat th modal oprators according to th cstraints. W finally show that, dspit of th gnrality of th prsrvati rsult, th choic of th abstracti is rlvant for th motic prsrvati of tru/fals valuatis alg abstracti rfinmnts. Rfrncs 1. Alur, R., Dill, D.L.: A thory of timd automata. Thortical Computr Scinc 126(2), (1994) 2. Alur, R., Hnzingr, T.A., Ho, P.: Automatic symbolic vrificati of mbddd systms. In: IEEE Ral-Tim Systms Symposium, pp (1993) 3. Alur, R., Hnzingr, T.A., Laffrrir, G., Pappas, G.J.: Discrt abstractis of hybrid systms. Proc. of th IEEE 88, (2000) 4. Baur, K.: Thr-valud μ-calculus hybrid automata. Mastr s thsis, Mastr Thsis, Univrsity of Kaisrslautrn, Dpartmnt of Computr Scinc (2008)

15 52 K. Baur, R. Gntilini, and K. Schnidr 5. Bnsalm, S., Bouajjani, A., Loisaux, C., Sifakis, J.: Proprty prsrving simulatis. In: v Bochmann, G., Probst, D. (ds.) CAV LNCS, vol. 663, pp Springr, Hidlbrg (1993) 6. Davorn, J.: On hybrid systms and th modal μ-calculus. In: Antsaklis, P.J., Kohn, W., Lmm, M.D., Nrod, A., Sastry, S.S. (ds.) HS LNCS, vol. 1567, pp Springr, Hidlbrg (1999) 7. Davorn, J., Nrod, A.: Logics for hybrid systms. Proc. of th IEEE 88, (2000) 8. Fitting, M.: Kln s thr valud logics and thir childrn. Fund. Inf. 20, (1994) 9. Fränzl, M.: What will b vntually tru of polynomial hybrid automata? In: Kobayashi, N., Pirc, B.C. (ds.) TACS LNCS, vol. 2215, pp Springr, Hidlbrg (2001) 10. Gntilini, R., Schnidr, K., Mishra, B.: Succssiv abstractis of hybrid automata for motic CTL modl chcking. In: Artmov, S.N., Nrod, A. (ds.) LFCS LNCS, vol. 4514, pp Springr, Hidlbrg (2007) 11. Ghosh, R., Tiwari, A., Tomlin, C.: Automatd symbolic rachability analysis with applicati to dlta-notch signaling automata. In: Malr, O., Pnuli, A. (ds.) HSCC LNCS, vol. 2623, pp Springr, Hidlbrg (2003) 12. Ghosh, R., Tomlin, C.J.: Latral inhibiti through dlta-notch signaling: A picwis affin hybrid modl. In: Di Bndtto, M.D., Sangiovanni-Vincntlli, A.L. (ds.) HSCC LNCS, vol. 2034, pp Springr, Hidlbrg (2001) 13. Godfroid, P., Huth, M., Jagadsan, R.: Abstracti-basd modl chcking using modal transiti systms. In: Larsn, K.G., Nilsn, M. (ds.) CONCUR LNCS, vol. 2154, pp Springr, Hidlbrg (2001) 14. Hnzingr, M.R., Hnzingr, T.A., Kopk, P.W.: Computing simulatis finit and infinit graphs. In: Proc. of36thann. Symp. Found. ofcomp. Sc., p IEEE,LosAlamitos(1995) 15. Hnzingr, T.: Hybrid automata with finit bisimulatis. In: Fülöp, Z., Gcsg, F. (ds.) ICALP LNCS, vol. 944, pp Springr, Hidlbrg (1995) 16. Hnzingr, T.A.: Th thory of hybrid automata. In: Proc. of th 11th IEEE Symp. Logic in Comp. Scinc, pp IEEE Computr Socity, Los Alamitos (1996) 17. Hnzingr, T.A., Kopk, P.W., Puri, A., Varaiya, P.: What s dcidabl about hybrid automata? In: Proc. of th 27th Symp. Thory of Computing, pp ACM, Nw York (1995) 18. Kannllakis, P.C., Smolka, S.A.: CCS xprssis, finit stat procsss, and thr problms of quivalnc. Informati and Computati 86(1), (1990) 19. Kln, S.C.: Introducti to Mtamathmatics. Woltrs-Noordh, Gringn (1971) 20. Laffrrir, G., Pappas, G., Sastry, S.: O-minimal hybrid systms. Mathmatics of Ctrol, Signals, and Systms 13, 1 21 (2000) 21. Laffrrir, G., Pappas, J., Yovin, S.: A nw class of dcidabl hybrid systms. In: Vaandragr, F.W., van Schuppn, J.H. (ds.) HSCC LNCS, vol. 1569, pp Springr, Hidlbrg (1999) 22. Millr, J.: Dcidability and complxity rsults for timd automata and smi-linar hybrid automata. In: Lynch, N.A., Krogh, B.H. (ds.) HSCC LNCS, vol. 1790, pp Springr, Hidlbrg (2000) 23. Piazza, C., Antiotti, M., Mysor, V., Policriti, A., Winklr, F., Mishra, B.: Algorithmic algbraic modl chcking i: Challngs from systms biology. In: Etssami, K., Rajamani, S.K. (ds.) CAV LNCS, vol. 3576, pp Springr, Hidlbrg (2005) 24. Alur, C.C.R., Hnzingr, T.A.: Computing accumulatd dlays in ral-tim systms. Formal Mthods in Systm Dsign 11, (1997) 25. Ratschan, S., Sh, Z.: Safty vrificati of hybrid systms by cstraint propagati basd abstracti rfinmnt. In: Morari, M., Thil, L. (ds.) HSCC LNCS, vol. 3414, pp Springr, Hidlbrg (2005) 26. Tiwari, A., Khanna, G.: Sris of abstractis for hybrid automata. In: Tomlin, C.J., Grnstrt, M.R. (ds.) HSCC LNCS, vol. 2289, pp Springr, Hidlbrg (2002)