Symbolic Analysis for Improving Simulation Coverage of SimulinkStateflow Models

1
Symbolic Analysis for Improving Simulation
Coverage of Simulink/Stateflow Models

• Rajeev Alur Univ. of Pennsylvania
• Aditya Kanade Univ. of Pennsylvania
• S. Ramesh GM India Science
  Lab
• K.C. Shashidhar GM India Science Lab

2
Embedded Control Software

• Modeling tool Simulink/Stateflow
• Formal semantics Hybrid systems
• Discrete control logic
• State-machines
• Continuous plant dynamics
• Differential- and algebraic-equations
• Analysis of safety requirements
• Verification and Testing

3
Testing
Initial states
Bad states
Testing tools Reactis, SDV, Beacon tester,
Redirect, etc.
4
Testing

• Advantages
• Testing is lightweight
• Testing scales to large and complex systems
• Drawbacks
• Testing is incomplete
• Ad-hoc testing may result in redundant
  simulations and is inefficient
• Testing tools give structural coverage
• (over states, transitions, etc. of the model)

5
Improving Simulation Coverage
Initial states
Bad states
Numerical simulations Symbolic analysis
6
Analysis Framework
Translation
Linear hybrid system
Simulink model
Simulation Trajectory
Simulation
Symbolic Analysis
Covered region
Complete coverage?
Next input
Yes!
7
Linear Hybrid Systems

• A linear hybrid system H (Q,X,Init,Flow,Jump)

g2
g3
v0
g1
g4
g1/r1
g3/r3
g2/r2
Init g1
q1
q0
g4/r4
dx A1x b1
dx A0x b0
8
Simulink Vehicle Climate Control
Temperature control Stateflow chart
9
Simulink Vehicle Climate Control
10
Simulink Vehicle Climate Control
Temperature control Stateflow chart
11
Scope of the Translation Scheme

• The translation covers many commonly used blocks
• Concurrent and hierarchical Stateflow charts
• Linear lookup tables
• Enabled subsystems, etc.
• The translation does not cover
• User defined S-functions
• Non-linear blocks
• Multi-rate systems, etc.

12
Analysis Framework
Translation
Linear hybrid system
Simulink model
Simulation Trajectory
Simulation
Symbolic Analysis
Covered region
Coverage complete?
Next input
Yes!
13
Discrete-time Simulation Trajectories
g2
v0
g3
v1
v1
v2
v2
g1
v0
v3
g4
v3
v0
g1/r1
g3/r3
g2/r2
g1
q1
q0
dx e1
dx e0
g4/r4
(q0,v0)
(q0,v1)
(q1,v2)
(q1,v3)
(q1,v3)
14
Equivalent Simulation Trajectories
g2
g3
g1
g4
g1/r1
g3/r3
g2/r2
g1
q1
q0
dx e1
dx e0
g4/r4
(q0,v0)
(q0,v1)
(q1,v2)
(q1,v3)
(q1,v3)
(q0,w0)
(q0,w1)
(q1,w2)
(q1,w3)
(q1,w3)
15
Computation of Equivalent Initial States
g2
g3
g1
g4
g1/r1
g3/r3
g2/r2
g1
q1
q0
dx e1
dx e0
g4/r4
16
Next Simulation Input
g2
g3
g1
g4
g1/r1
g3/r3
g2/r2
g1
q1
q0
dx e1
dx e0
g4/r4
17
Experimental Evaluation

• Implemented with Parma Polyhedra Library
• Effectiveness of the approach
• Room heating benchmark Fehnker, Ivancic
• Vehicle climate control Mathworks
• Effect of simulation length

18
Vehicle Climate Control
Coverage for the VCC model on 5 initial states
19
Room Heating Benchmark
(a) Estimated coverage for simulations of length
10
(b) Estimated coverage for simulations of length
50
20
Summary

• Numerical simulations Symbolic analysis
• Two case studies VCC and RHB
• Non-trivial coverage of the initial state-space
• Translation scheme from SL/SF to hybrid systems
• Future work
• Scalability to large no. of continuous variables
• Efficient under-approximations of state sets

21
Related Work

• Coverage of initial state-space using
  bisimulation metrics or expansion functions
  GP06,JF07,DM07
• Test generation tools Reactis, STB, T-VEC,
  Simulink Design Verifier, Beacon Tester,
  AutoMOTgen, REDIRECT
• Formal semantics of Simulink language
  denotational H05, operational HR07,
  communicating pushdown automata T02
• Translation of Simulink designs to hybrid
  automata AS04, Lustre TS05, SMV BK99,
  SAL GY08

22
References
GP06 Girard, Pappas, Verification using
simulation, HSCC06 JF07 Julius, Robust test
generation and coverage for hybrid systems,
HSCC07 DM07 Donze, Maler Systematic
simulation using sensitivity analysis,
HSCC07 H05 Hamon, A denotational semantics for
Stateflow, EMSOFT05 HR07 Hamon, Rushby, An
operational semantics for Stateflow,
STTT07 T02 Tiwari, Formal semantics and
analysis methods for Simulink Stateflow models,
SRI Technical Report 2002. AS04 Agrawal,
Simon, Semantic translation of
Simulink/Stateflow models to hybrid automata
using graph transformations, ENTCS04 TS05
Tripakis, Sofronis, Translating discrete-time
Simulink to Lustre, TECS05 BK99
Banphawatthanarak, Krogh, Symbolic verification
of executable control specifications,
CACS99 GY08 Gadkari, Yeolekar, AutoMOTGen
Automatic model oriented test generator for
embedded control systems, CAV08
23
Numerical Simulations

• Simulation Parameters
• A simulation time step h
• An integration routine (fixed-step solver)
• Euler(xi,ei,h) xi h ei
• A simulation length k
• Simulation step Discrete-time evolution Jump
• Discrete-time evolution of the continuous state

24
Average Run-time
Average run-time for different simulation lengths