A Uniform Approach to Three-Valued Semantics for µ-calculus on Abstractions of Hybrid Automata

A Uniform Approach to Thr-Valud Smantics for µ-calculus on Abstractions of Hybrid Automata (Haifa Vrification Confrnc 2008) Univrsity of Kaisrslautrn Octobr 28, 2008

Ovrviw 1. Prliminaris and 2. Gnric Smantics for L µ on Abstractions of Hybrid Automata Gnric Prsrvation Rsult 3. May-/Must Abstractions DBB Abstractions Monotonicity Issus 4. and Futur Work

Hybrid Automata (HA) A hybrid automaton consists of Graph with finitly many locations Exampl: (Hating controllr) on

Hybrid Automata (HA) A hybrid automaton consists of Graph with finitly many locations Finitly many continuous variabls changing valu within a location according to diffrntial ruls Initial Conditions, Location invariants, guards and rsts for discrt transitions Exampl: (Hating controllr) x > 22, x = x x = 20 x > 18 ẋ = 0.1 x < 24 ẋ = 5 on x < 20, x = x

Dcidability Rsults Problm: (Dcidability vs Exprssivnss) In gnral, hybrid automata ar undcidabl w.r.t. rachability Dcidability rsults only xist, whn discrt and/or continuous dynamics ar highly rstrictd Exampl: Timd automata ar dcidabl Adding skwd clocks maks timd automata undcidabl x i [a i, b i ] ẋ i = 1 ẋ i = 1 x i = x i x i [a i, b i ] ẋ i = c i,l ẋ i = c i,l x i = x i

Goal and Prspctiv Goal: Dvloping a framwork for th automatd rasoning on hybrid automata outsid th dcidability ralm, faturing: combind ovrapprox./undrapprox. analysis safty crtication + countrxampls ability to both prov and disprov ractiv systm proprtis xprssd in L µ. Mthod: Thr-valud gnric smantics for L µ adaptabl to propr abstraction framworks Spcialization of th gnric smantics to diffrnt typs of abstractions providing ovr-/undrapprox. DBB abstractions Modal abstractions

3-Valud L µ on HA-Abstractions A = R, R 0, δ, abstraction of H ncoding ovrand undrapproximation of th runs in H AP finit st of atomic propositions R a partition w.r.t. l AP : Q 2 AP

3-Valud L µ on HA-Abstractions A = R, R 0, δ, abstraction of H ncoding ovrand undrapproximation of th runs in H AP finit st of atomic propositions R a partition w.r.t. l AP : Q 2 AP Dfinition: (L µ for gnric HA-Abstractions) { 1 φ lap (r) φ AP : φ (r) = 0 φ / l AP (r) φ := 3 φ φ ψ := φ 3 ψ, φ ψ := φ 3 ψ Paramtrizd modal oprators { δ φ, φ, [δ]φ, []φ, E(φUψ), A(φUψ)}: (r) = 1 x r : H (x) = 1 (r) = 0 x r : H (x) = 0

3-Valud L µ on HA-Abstractions A = R, R 0, δ, abstraction of H ncoding ovrand undrapproximation of th runs in H AP finit st of atomic propositions R a partition w.r.t. l AP : Q 2 AP Dfinition: (L µ for gnric HA Abstractions) Fixpoints: Lt σ {µ, ν} σz.φ := apxˆkσz.φ satisfying ˆk is th smallst indx with apxˆk(σz.φ) = apxˆk+1 (σz.φ) A φ : r R 0 : φ (r) = 1 A φ : r R 0 : φ (r) = 0

Prsrvation Rsults Thorm: (Prsrvation) Lt H b a hybrid automaton and A b an abstraction of H. Thn for all φ L µ : φ (r) = 1 x r : φ H (x) = 1 φ (r) = 0 x r : φ H (x) = 0

Prsrvation Rsults Thorm: (Prsrvation) Lt H b a hybrid automaton and A b an abstraction of H. Thn for all φ L µ : φ (r) = 1 x r : φ H (x) = 1 φ (r) = 0 x r : φ H (x) = 0 Proof: (Sktch) By structural induction: boolan oprators: obvious modal oprators: by assumption fixpoint oprators: σz.φ = apx k (σz.φ) for som k N structural induction + monotonicity of fixpoints yild th claim

Gnral Ida: Adapt idas for may/must transitions from discrt systms may must

Gnral Ida: Adapt idas for may/must transitions from discrt systms may must Dfinition: Lt A = R, R 0, δ, b an abstraction. Thn, All transitions in A ar may-transitions r δ must r if all x r hav a dirct succ. x x r r must r if all x r hav a succ. x x r Lmma: A must S T H S A (A uss th transitiv closur δ δ of )

Smantics Compltion on May/Must Abs. Smantics Compltion of 3-valud L µ on May/Must Abstractions: Dfinition: Lt A b a may/must abstraction. Thn: 1 r r : r satisfis φ δ φ (r) = 0 r δ r : r satisfis φ ls φ (r) = 1 r must r : r satisfis φ 0 r r : r satisfis φ ls a {, δ}: [a]φ = ( a φ)

Smantics Compltion on May/Must Abs. Smantics Compltion of 3-valud L µ on May/Must Abstractions: Dfinition: Lt A b a may/must abstraction. Thn: 1 r must r satisfying φuψ 0 may-paths φuψ can b E(φUψ) (r) = disprovn ls 1 all may-paths satisfy φuψ 0 r A(φUψ) (r) = must r not satisfying φuψ ls

Prsrvation for May/Must Abs. Corollary: (Prsrvation) Lt H b a hybrid automaton and A b a may/must abstraction of H. Thn for all φ L µ : A φ H φ A φ H φ Rmark: May/must abstractions do not provid monotonicity rsults

Exampl: Hating Controllr x = 20 x > 18 ẋ = 0.1 x > 22, x = x x < 20, x = x x < 24 ẋ = 5 on µ-calculus formula: φ := µz.(on [22, 24]) Z

Exampl: Hating Controllr x = 20 x > 18 ẋ = 0.1 x > 22, x = x x < 20, x = x x < 24 ẋ = 5 on µ-calculus formula: φ := µz.(on [22, 24]) Z δ Abstraction: (18,19.5] (19.5,20) 20 (20,24) must must (18,19) on [19,22) on [22,24) on

Exampl: Hating Controllr x = 20 x > 18 ẋ = 0.1 x > 22, x = x x < 20, x = x x < 24 ẋ = 5 on µ-calculus formula: φ := µz.(on [22, 24]) Z δ Abstraction: A 3 φ = 1 H φ = 1 (18,19.5] (19.5,20) must 20 (20,24) must (18,19) on [19,22) on [22,24) on

Exampl: Hating Controllr x = 20 x > 18 ẋ = 0.1 x > 22, x = x x < 20, x = x x < 24 ẋ = 5 on µ-calculus formula: φ := µz.(on [22, 24]) Z δ Rfinmnt: (18,19.5] (19.5,20) 20 (20,24) must (18,19) on [19,19.7) on [19.7,22) on [22,24) on

Exampl: Hating Controllr x = 20 x > 18 ẋ = 0.1 x > 22, x = x x < 20, x = x x < 24 ẋ = 5 on µ-calculus formula: φ := µz.(on [22, 24]) Z δ Rfinmnt: A 3 φ = (18,19.5] (19.5,20) 20 (20,24) must (18,19) on [19,19.7) on [19.7,22) on [22,24) on

Dfinition: (Discrt Boundd Bisimulation) Lt H b a hybrid automaton with stat spac Q. Lt P b a partition of Q. 0 Q Q is th max. rlation on Q s.t. for all p 0 q: [p] P = [q] P and p Q 0 iff q Q 0 p δ p q : p 0 q q δ q q δ p p : p 0 q p δ [p] 0 [p p ]0

Dfinition: (Discrt Boundd Bisimulation) Lt H b a hybrid automaton with stat spac Q. Lt P b a partition of Q. n Q Q is th max. rlation on Q s.t. for all p n q: p n 1 q p δ p q : p n q q δ q q δ p p : p n q p δ [p]n [p p must p p q : p n 1 q q q q q p : p n 1 q p p [p] n may [p ] n ]n [p ] n 1 Th rlation n is calld n-dbb quivalnc.

Smantics Compltion on DBB-Abs. Smantics Compltion of thr-valud L µ : Dfinition: Lt H n b an n-dbb abstraction. Thn: δ φ n ([x] n ) = 1 iff [x] n δ [x ] n : [x ] n satisfis φ δ φ n ([x] n ) = 0 iff δ [x] n [x ] n : [x ] n satisfis φ δ φ n ([x] n ) = ls [δ]φ n = ( δ φ) n

Smantics Compltion on DBB-Abs. Smantics Compltion of thr-valud L µ : Dfinition: Lt H n b an n-dbb abstraction. Thn: φ n ([x] n ) = 1 iff [x] n [x ] n : [x ] n 1 satisfis φ φ n ([x] n ) = 0 iff [x] n [x ] n : [x ] n 1 satisfis φ φ n ([x] n ) = ls []φ n = ( φ) n

Smantics Compltion on DBB-Abs. Smantics Compltion of thr-valud L µ : Dfinition: Lt H n b an n-dbb abstraction. Thn: For E(φUψ) n : E(φUψ) n ([x] n ) = 1 iff δ [x] n [x ] n satisfying φuψ in H n or δ [x] n [x ] n [x ] n satisfying φ on th first part and [x ] n 1 satisfying E(φUψ) E(φUψ) n ([x] n ) = 0 iff paths in H n φuψ can b disprovn E(φUψ) n ([x] n ) = othrwis

Smantics Compltion on DBB-Abs. Smantics Compltion of thr-valud L µ : Dfinition: Lt H n b an n-dbb abstraction. Thn: For A(φUψ) n : A(φUψ) n ([x] n ) = 1 iff all paths in H n starting in [x] n satisfy φuψ A(φUψ) n ([x] n ) = 0 iff [x] n δ [x ] n not satisfying φuψ in H n or [x] n δ [x ] n [x ] n satisfying φ on th first part and [x ] n 1 not satisfying AφUψ A(φUψ) n ([x] n ) = othrwis

Prsrvation Rsults for DBB-Abs. Corollary: (Prsrvation) Lt H b a hybrid automaton and H n b an n-dbb abstraction of H. Thn for all φ L µ : H n φ H φ H n φ H φ

Prsrvation Rsults for DBB-Abs. Corollary: (Prsrvation) Lt H b a hybrid automaton and H n b an n-dbb abstraction of H. Thn for all φ L µ : H n φ H φ H n φ H φ Thorm: (Monotonicity) Lt H n and H k, n > k, b DBB abstractions. Thn for all φ L µ and all x in th stat spac of H: φ k ([x] k ) = 1 φ n ([x] n ) = 1 φ k ([x] k ) = 0 φ n ([x] n ) = 0

y 10 ẋ = 1 ẏ = 1 shut x = 0 y = 10 Exampl: Watrlvl Controllr x 1 0 ẋ = 1 ẏ = 2 opn 1-DBB Abstraction: r 1 r 6 2 10 x r 3 r 4 µ-calculus formula: φ = µz.r Z r = shut [0, 6] {10} y shut s 1 s 2 6 10 x r 2 δ r 3 δ s 5 s 2 r 4 s 5 y opn

y 10 ẋ = 1 ẏ = 1 shut x = 0 y = 10 Exampl: Watrlvl Controllr x 1 0 ẋ = 1 ẏ = 2 opn 1-DBB Abstraction: A 3 φ = r 1 r 6 2 10 x r 3 r 4 µ-calculus formula: φ = µz.r Z r = shut [0, 6] {10} y shut s 1 s 2 6 10 x r 2 δ r 3 s 5 δ s 2 r 4 s 5 y opn

r 5 r 6 r 1 y 10 ẋ = 1 ẏ = 1 shut x = 0 y = 10 Exampl: Watrlvl Controllr x 1 0 ẋ = 1 ẏ = 2 opn 2-DBB Abstraction: r 3 r 2 r 4 r 7 x r 2 δ r 3 δ r 5 µ-calculus formula: φ = µz.r Z r = shut [0, 6] {10} t 7 δ t 6 δ t 2 y shut t 1 t 2 t 3 t 4 t 6 t 7 t 5 t 8 x r 7 δ r 4 δ r 6 t 8 δ t 5 δ t 4 δ t 3 x opn

r 5 r 6 r 1 y 10 ẋ = 1 ẏ = 1 shut x = 0 y = 10 Exampl: Watrlvl Controllr x 1 0 ẋ = 1 ẏ = 2 opn µ-calculus formula: φ = µz.r Z r = shut [0, 6] {10} 2-DBB Abstraction: A 3 φ = 0 H φ = 0 r 3 r 2 r 4 r 7 x r 2 δ r 3 δ r 5 t 7 δ t 6 δ t 2 y shut t 1 t 2 t 3 t 4 t 6 t 7 t 5 t 8 x r 7 δ r 4 δ r 6 t 8 δ t 5 δ t 4 δ t 3 x opn

and Futur Work : A paramtrizd thr-valud intrprtation of L µ has bn dvlopd Prsrvation rsults hav bn provd Safty crtification + countrxampls Diffrnt applications for th gnral framwork hav bn providd: May/must abstractions DBB abstractions Futur Work Dvlopmnt of a thr-valud modl-chcking tool for hybrid automata Proprty drivn abstraction rfinmnts...

Th U-Oprator on Hybrid Automata Discrt tim framworks: U-Oprator rdundant E(φUψ) = µz.ψ φ Z A(φUψ) = µz.ψ φ Z Continuous tim framworks: U-oprator not rdundant

Th U-Oprator on Hybrid Automata Discrt tim framworks: U-Oprator rdundant E(φUψ) = µz.ψ φ Z A(φUψ) = µz.ψ φ Z Continuous tim framworks: U-oprator not rdundant Exampl: x = 0 ẋ = 1 0 1 2 3 x

Th U-Oprator on Hybrid Automata Discrt tim framworks: U-Oprator rdundant E(φUψ) = µz.ψ φ Z A(φUψ) = µz.ψ φ Z Continuous tim framworks: U-oprator not rdundant Exampl: x = 0 ẋ = 1 φ := E(x < 2)U(x = 3) ψ := µz.(x = 3) (x < 2) Z 0 1 2 3 x Lmma: In th stting of hybrid automata th languag L µ with th tmporal oprators E(φUψ) and A(φUψ) is strictly mor xprssiv than L µ without ths oprators.

Rdundancy of U on Abstractions Lt th modal oprator δ satisfy: δ φ (r) = 1 a dirct succssor of r satisfis φ (*) Thorm: (Rdundancy) Lt H b a hybrid automaton and A b an abstraction of H satisfying (*). Thn for all φ, ψ L µ : 1. A µz.ψ φ Z H E(φUψ) A µz.ψ φ Z H E(φUψ) 2. A µz.ψ φ Z H A(φUψ) A µz.ψ φ Z H A(φUψ)