DIVES: Design, Implementation and Validation of Embedded Software

1
DIVES Design, Implementation andValidation of
Embedded Software
Alur, Kumar, Lee(PI), Pappas, Sokolsky
GRASP/SDRL University of Pennsylvania
www.cis.upenn.edu/mobies/
MOBIES PI Meeting, Jan 2001
2
CHARON Team

• Faculty
• Rajeev Alur (CIS)
• Vijay Kumar (MEAM)
• Insup Lee (CIS)
• George Pappas (EE)

PhD Students Joel Esposito Yerang Hur Franjo
Ivancic Salvatore La Torre Pradumna Mishra
Jiaxiang Zhou
Research Associates Rafael Fiero (GRASP) John
Koo (GRASP) Oleg Sokolsky (SDRL)
Programmers Usa Samuppan Valya Sokolsky
3
DIVES Summary

• High-level modeling language and design
  environment CHARON
• Combines the state-of-the-art in formal and
  object-oriented methods
• Tools for Formal Analysis
• Simulation
• Model Checking
• Controller Synthesis
• Runtime monitoring
• Focus on Hierarchy and Compositionality

4
CHARON Language Features

• Individual components described as agents
• Composition, instantiation, and hiding
• Individual behaviors described as modes
• Encapsulation, instantiation, and Scoping
• Support for concurrency
• Shared variables as well as message passing
• Support for discrete and continuous behavior
• Differential as well as algebraic constraints
• Discrete transitions can call Java routines

5
Accomplishments

• Language Design
• Syntax and Semantics
• Tool Development
• Parser, Type checker, Simulator, GUI
• Research Results
• Accurate event detection
• Modular (multi-rate) simulation
• Compositional semantics refinement
• Optimal control in timed automata
• Synthesis of mode switching

See www.cis.upenn.edu/mobies/ for tool/papers
6
Talk Outline

• Overview
• Research in Formal Verification
• Compositional Refinement (AGLS01)
• Synthesis of Mode Switching (KPS01)
• Optimal Control in Timed Automata (ALP01)
• Demo (today evening)

7
Automated Formal Analysis

• Background
• Decidability results Timed automata,
  o-minimal systems .
• Reachability tools Polyhedra-based (HyTech),
  ellipsoidal, flowpipes (Checkmate)
• Research Themes
• Can modular reasoning be combined with
  state-space analysis?
• Beyond reachability Optimization
• Systematic abstraction techniques

8
Talk Outline

• Compositional Semantics/Refinement for
  Hierarchical Hybrid Systems
• Synthesis of Mode Switching
• Optimal Control in Weighted Timed Automata

9
Why Modular Reasoning?

• Behavior of a component can be computed from
  behaviors of its parts
• Components can be analyzed in isolation
• Assume-guarantee rules -gt Scalable analysis

MoBIES Theme Composable Behavioral Interfaces!
10
Syntax Modes and Agents
local t, rate global level, infusion
global level global infusion
level
level?2,10
Emergency
Compute
level?4,8
infusion
e
x
dx
de
t10
t0
level?2,10
de
dx
Maintain
dx
de
tlt10
Agent Controller
Agent Tank
Normal

• Modes describe sequential behavior
• Agents describe concurrency

11
Mode Executions
(ctl,t,level,infusion,rate,h)
(dx,0,5.1,1,0.2,Maintain)
Flow Step
(dx,10,15.1,3,0.2,Maintain)
Env Step
(de,10,15.1,5,0.2,Maintain)
Discrete Mode Step
(dx,10,15.1,5,0.1,Compute)
12
Semantics of modes

• Semantics of a mode consists of
• entry and exit points
• global variables
• traces
• Key Thm Semantics is compositional
• traces of a mode can be computed from traces of
  its sub-modes

13
Refinement

• Refinement is trace inclusion

Normal
Normal

• Same control points and global variables
• Guards and constraints are relaxed

level?2,10
level ? 10
Compute
Compute
lt
e
x
e
x
de
de
t0
t0
t10
t ? 10
de
dx
de
dx
Maintain
Maintain
dx
dx
tlt10
tlt10
Normal
Normal
14
Sub-mode refinement
Controller
de
Normal
dx
Refines
Controller
de
Normal
dx
15
Compositional Reasoning
16
Talk Outline

• Compositional Semantics/Refinement
• Synthesis of Mode Switching
• Optimal Control of Timed Automata

17
Synthesis of Mode Switching

• Background
• Multi-agent, multi-objective systems are
  designed for many modes of operation
• Input collection of control modes
• Research Challenge
• Does there exist a finite switching sequence of
  control modes for satisfying a set of given
  reachability specifications?

18
Illustrative Example

• Multi-Modal Control of a Helicopter Model
• Control Modes Hover, Cruise, Ascend, Descend
• Task High-altitude take-off

Hover
Ascend
Cruise
19
Key Computational Step

• Consistent mode switching condition
• Pair-wise controlled bisimulation
• Output-tracking controllers simplify required
  reachability computation

20
Results Summary

• Algorithm Consistent Control Mode Graph
• Input Control Modes
• Output Control Mode Graph
• Computation for N control modes
• Reachability Computation N2
• Intersection Computation N3
• Framework for Multi-Modal Control
• Offline Synthesis of control mode graph
• Online Synthesis of control switching sequence

21
Talk Outline

• Compositional Semantics/Refinement
• Synthesis of Mode Switching
• Optimal Control of Timed Automata

22
Background Timed Automata
Model for real-time systems Many Theoretical
Results Tools Key step Finite bisimulation
partitions
23
Optimal Controller Synthesis

• System Model
• Timed Automaton weights (costs) on
  transitions and locations (WTA)
• Goal
• Synthesize a Controller to drive System form
  Start to Target at minimal cost
• Key Step of the Solution
• Solve Shortest Paths Problem in WTA

24
An Air-traffic Control Problem
xgt1
Land1
wait2
c0 w2
c4
w2
y0
xlt2
1ltylt2 xgt1
c2
xlt1 ylt1
hold2
ygt1
x0
w2
Start
Done
c0
hold1
x0
c3
y0
w1
c1
xlt1 ylt1
ygt1 1ltxlt2
land2
wait1
xgt1
w1
ylt2
c0 w1
ygt1
25
Shortest Paths in WTA
xlt2
x2
Start
w1
Target
w0

• Optimum solution may only be a limit
• Region graph construction not enough

• Algorithm
• Reduce to Parametric Shortest Path Problem on
  graphs (PSP)
• Solve PSP

26
From WTA to Weighted Graphs
y0 x0
c3
hold1
y0 0ltxlt1
wait1
(1)
(1,2)
c3
w1 (q2 q3)
c3 w1 (q2 q3)
x0 Ygt0
hold1

0ltyltxlt1
(1,2)
x0 0ltylt1
wait1
(2,1)
hold1
(2,1)

• Augmented Region Automaton
• Regions are split in boundary sub-regions

27
Summary of Results

• Algorithmic solution to Shortest Paths Problem
  in WTA
• Reduction causes exponential blow-up
• Symbolic fix-point algorithm can compute solution
  to all source states

(Optimal Controller Synthesis can be solved
similarly)
28
Ongoing Work

• Tool Development
• Modular simulator
• Research
• Distributed simulation
• Predicate Abstraction for hybrid systems
• Applications/Case-studies
• Inverted pendulum, Robot soccer
• MoBIES challenge problems
• Animation, Biomolecular networks