In the field of formal verification of real-time systems, major developments have been recorded in the last fifteen years. It is about logics, automata, process algebra, programming languages, etc. From the beginning, a formalism has played an important role: timed automata and their natural extension,hybrid automata. Those models allow the definition of real-time constraints using real-valued clocks, or more generally analog variables whose evolution is governed by differential equations. They generalize finite automata in that their semantics defines timed words where each symbol is associated with an occurrence timestamp. The decidability and algorithmic analysis of timed and hybrid automata have been intensively studied in the literature. The central result for timed automata is that they are positively decidable. This is not the case for hybrid automata, but semi-algorithmic methods are known when the dynamics is relatively simple, namely a linear relation between the derivatives of the variables. With the increasing complexity of nowadays systems, those models are however limited in their classical semantics, for modelling realistic implementations or dynamical systems. In this thesis, we study the algorithmics of complex semantics for timed and hybrid automata. On the one hand, we propose implementable semantics for timed automata and we study their computational properties: by contrast with other works, we identify a semantics that is implementable and that has decidable properties. On the other hand, we give new algorithmic approaches to the analysis of hybrid automata whose dynamics is given by an affine function of its variables.

The verification of analog designs has been a challenging task for a few years now. Several approaches have been taken to tackle the main problem related to the complexity that such task presents to design and verification teams. The methodology presented in this document is based on the experiences and research work carried out by the Concordia University's Hardware Verification and the U. of Texas' IC systems design groups. The representation of complex systems where different interactions either mechanical or electrical take place requires an intricate set of mathematical descriptions which greatly vary according to the system under test. As a simple and very relevant example one can look at the integration of RF-MEMS as active elements in System-On-Chip architectures. In order to tackle such heterogeneous interaction for a consistent model, the use of stochastic hybrid models is described and implemented for very simple examples using high level modeling tools for a succinct and precise description. / text

<p align="justify">Computer Science is currently facing a grand challenge : finding good design practices for embedded systems. Embedded systems are essentially computers interacting with some physical process. You could find one in a braking systems or in a nuclear power plant for example. They present several design difficulties : first they are reactive systems, interacting indefinitely with their environment. Second,they must satisfy real-time constraints specifying when they should respond, and not only how. Finally, their environment is often deeply continuous, presenting complex dynamics. The formal models of choice for specifying such systems are timed and hybrid automata for which model checking is pretty well studied.</p> <p align="justify">In a first part of this thesis, we study a complete design approach, including verification and code generation, for timed automata. We have to define a new semantics for timed automata, the AASAP semantics, that preserves the decidability properties for model checking and at the same time is implementable. Our notion of implementability is completely novel, and relies on the simulation of a semantics that is obviously implementable on a real platform. We wrote tools for the analysis and code generation and exemplify them on a case study about the well known Philips Audio Control Protocol.</p> <p align="justify">In a second part of this thesis, we study the problem of controller synthesis for an environment specified as a hybrid automaton. We give a new solution for discrete controllers having only an imperfect information about the state of the system. In the process, we defined a new algorithm, based on the monotonicity of the controllable predecessors operator, for efficiently finding a controller and we show some promising applications on a classical problem : the universality test for finite automata.

Dans le cadre de ce sujet de thèse, on s'intéresse à la surveillance des systèmes hybrides à forte dynamique événementielle. L'objectif est de détecter les défauts permanents et intermittents qui causent l'accélération et le ralentissement des tâches des systèmes. C'est dans ce contexte que se situent les principales contributions suivantes des travaux consignés dans la présente thèse : - Le développement d'une méthode de surveillance des processus basée sur les automates hybrides linéaires (AHL). Cette méthode consiste en premier lieu à l'établissement du modèle AHL du système dynamique en tenant compte des contraintes physiques et dynamiques de celui-ci. - La réalisation d'une analyse d'atteignabilité qui consiste à définir toutes les trajectoires pouvant amener le système à son objectif tout en respectant le cahier des charges qui lui est imposé. L'extension de l'approche en utilisant les automates hybrides rectangulaires. Cette sous-classe d'automates nous a permis de modéliser des systèmes plus complexes donc une modélisation hybride riche et a permis également une analyse formelle. Cette partie a été ponctuée par l'implémentation du système de surveillance qui consiste à déterminer les équations caractérisant chaque sommet de l'automate qui modélise le système. / As part of this thesis, we focus on the monitoring of hybrid systems with high dynamic event. The aim is to detect faults that cause permanent and intermittent acceleration and deceleration systems tasks. It is in this context that the following are the main contributions of the work reported in this thesis: - The development of a method for process monitoring based on linear hybrid automata (AHL). This method involves first the establishment of the AHL model the dynamic system taking into account the physical and dynamic one. - The realization of a reachability analysis of defining all paths that can cause the system to its target while respecting the specifications imposed on it. The extension of the approach using the rectangular hybrid automata. This class of controllers has allowed us to model more complex systems, therefore, a hybrid modeling rich and also allowed a formal analysis. This part was punctuated by the implementation of the monitoring system by determining equations characterizing each summit of the automaton that models the system.

Notre travail de recherche concerne l’étude de la commande à base de modèles pour une sous-classe de systèmes dynamiques hybrides (SDH). L’outil de modélisation choisi est l’automate hybride rectangulaire (AHR) pour sa puissance d’analyse. Nous proposons ainsi une méthode pour la synthèse de la commande des SDH modélisés par des AHR. Cette méthode repose sur l’application d’une procédure amont/aval de commande hors-ligne qui détermine d’une façon maximale permissive les nouvelles gardes de transition de l’automate respectant des spécifications de commande imposées par l’utilisateur. Tous les calculs réalisés reposent sur la détermination de la durée de séjour, valeur contrainte par l’espace atteignable du sommet correspondant. La garde portant à la fois sur l’état continu et sur l’événement discret, la commande se fait par ce dernier car il s’agit du seul élément contrôlable. Nous nous intéressons alors à la construction du contrôleur temporisé autorisant l’occurrence des événements contrôlables du système dans un intervalle d’horloge défini au sens de la maximale permissivité. / In this thesis, we study the control of a class of hybrid dynamic systems (HDS). The chosen modeling tool is the rectangular hybrid automaton (RHA) for his analysis power. We propose a method for the control synthesis of HDS modeled with RHA. This method consists on the application of a downstream/upstream offline control procedure that determines in a maximal permissive way the new automaton transition guards respecting the desired control specifications. All computations are based on the determination of the duration of stay, a value constrained by the reachable space of the corresponding location. Since the guard refers to both continuous state and discrete event, the control is made by the latter because it is the controllable element. Then we are interested in the construction of the timed controller authorizing the system controllable event occurrence in a clock interval defined in a maximal permissive way.

abstract: Critical infrastructures in healthcare, power systems, and web services, incorporate cyber-physical systems (CPSes), where the software controlled computing systems interact with the physical environment through actuation and monitoring. Ensuring software safety in CPSes, to avoid hazards to property and human life as a result of un-controlled interactions, is essential and challenging. The principal hurdle in this regard is the characterization of the context driven interactions between software and the physical environment (cyber-physical interactions), which introduce multi-dimensional dynamics in space and time, complex non-linearities, and non-trivial aggregation of interaction in case of networked operations. Traditionally, CPS software is tested for safety either through experimental trials, which can be expensive, incomprehensive, and hazardous, or through static analysis of code, which ignore the cyber-physical interactions. This thesis considers model based engineering, a paradigm widely used in different disciplines of engineering, for safety verification of CPS software and contributes to three fundamental phases: a) modeling, building abstractions or models that characterize cyberphysical interactions in a mathematical framework, b) analysis, reasoning about safety based on properties of the model, and c) synthesis, implementing models on standard testbeds for performing preliminary experimental trials. In this regard, CPS modeling techniques are proposed that can accurately capture the context driven spatio-temporal aggregate cyber-physical interactions. Different levels of abstractions are considered, which result in high level architectural models, or more detailed formal behavioral models of CPSes. The outcomes include, a well defined architectural specification framework called CPS-DAS and a novel spatio-temporal formal model called Spatio-Temporal Hybrid Automata (STHA) for CPSes. Model analysis techniques are proposed for the CPS models, which can simulate the effects of dynamic context changes on non-linear spatio-temporal cyberphysical interactions, and characterize aggregate effects. The outcomes include tractable algorithms for simulation analysis and for theoretically proving safety properties of CPS software. Lastly a software synthesis technique is proposed that can automatically convert high level architectural models of CPSes in the healthcare domain into implementations in high level programming languages. The outcome is a tool called Health-Dev that can synthesize software implementations of CPS models in healthcare for experimental verification of safety properties. / Dissertation/Thesis / Ph.D. Computer Science 2012

Les réseaux de transport multimodaux modernes sont essentiels pour la durabilité écologique et l’aisance économique des agglomérations urbaines, par conséquent aussi pour la qualité de vie de leurs habitants. D’ailleurs, le bon fonctionnement sur le plan de la compatibilité entre les différents services et lignes est essentiel pour leur acceptation, étant donné que (i) la plupart des trajets nécessitent des changements entre les lignes et que (ii) des investissements coûteux, dans le but de créer des liens plus directs avec la construction de nouvelles lignes ou l’extension de lignes existantes, ne sont pas à débattre. Une meilleure compréhension des interactions entre les modes et les lignes dans le contexte des transferts de passagers est ainsi d’une importance cruciale. Toutefois, comprendre ces transferts est singulièrement difficile dans le cas de situations inhabituelles comme des incidents de passagers et/ou si la demande dévie des plans statistiques à long terme. Ici le développement et l’intégration de modèles mathématiques sophistiqués peuvent remédier à ces inconvénients. À ce propos, la supervision via des modèles prévoyants représente un champ d’application très prometteur, analysée ici. La supervision selon des modèles prévoyants peut prendre différentes formes. Dans le présent travail, nous nous intéressons à l’analyse de l’impact basé sur des modèles de différentes actions, comme des départs en retard de certains véhicules après un arrêt, appliqué sur le fonctionnement du réseau de transport et sa gestion de situations de stress qui ne font pas partie des données statistiques. C’est pourquoi nous introduisons un nouveau modèle, un automate hybride avec une dynamique probabiliste, et nous montrons comment ce modèle profondément mathématique peut prédire le nombre de passagers dans et l’état de fonctionnement du véhicule en question du réseau de transport, d’abord par de simples estimations du nombre de tous les passagers et la connaissance exacte de l’état du véhicule au moment de l’incident. Ce nouvel automate réunit sous un même regard les passagers demandeurs de services de transport à parcours fixes ainsi que les véhicules capables de les assurer. Il prend en compte la capacité maximale et le fait que les passagers n’empruntent pas nécessairement des chemins efficaces, dont la représentation sous la forme d’une fonction de coût facilement compréhensible devient nécessaire. Chaque passager possède son propre profil de voyage qui définit un chemin fixe dans l’infrastructure du réseau de transport, et une préférence pour les différents services de transport sur son chemin. Les mouvements de véhicules sont inclus dans la dynamique du modèle, ce qui est essentiel pour l’analyse de l’impact de chaque action liée aux mouvements de véhicule. De surcroît, notre modèle prend en compte l’incertitude qui résulte du nombre inconnu de passagers au début et de passagers arrivant au fur et à mesure. Comparé aux modèles classiques d’automates hybrides, notre approche inspirée du style des réseaux de Pétri ne requiert pas le calcul de ces équations différentielles à la main. Ces systèmes peuvent être dérivés de la représentation essentiellement graphique d’une manière automatique pour le calcul en temps discret d’une prévision. Cette propriété de notre modèle réduit le risque de précisions faites par des humains et les erreurs qui en résulteraient. Après avoir introduit notre nouveau modèle, nous développons dans ce rapport également quelques éléments constitutifs sous la forme d'algorithmes qui visent les deux types d'impasses qui sont probables d'occurir pendant la simulation faisant un pronostic, c-à-d l'intégration numérique des systèmes de haute dimension d'équations différentielles et l'explosion combinatoire de son état discret. En plus, nous prouvons la faisabilité des calculs et nous montrons les bénéfices prospectifs de notre approche dans la forme de quelques tests simplistes et quelques cas plus réalistes. / Without any doubt, modern multimodal transportation systems are vital to the ecological sustainability and the economic prosperity of urban agglomerations, and in doing so to the quality of life of their many inhabitants. Moreover it is known that a well-functioning interoperability of the different modes and lines in such networked systems is key to their acceptance given the fact that (i) many if not most trips between different origin/destination pairs require transfers, and (ii) costly infrastructure investments targeting the creation of more direct links through the construction of new or the extension of existing lines are not open to debate. Thus, a better understanding of how the different modes and lines in these systems interact through passenger transfers is of utmost importance. However, acquiring this understanding is particularly tricky in degraded situations where some or all transportation services cannot be provided as planned due to e.g. some passenger incident, and/or where the demand for these scheduled services deviates from any statistical long term-plannings. Here, the development for and integration of sophisticated mathematical models into the operation of such systems may provide remedy, where model-predictive supervision seems to be one very promising area of application which we consider here. Model-predictive supervision can take several forms. In this work, we focus on the model-based impact analysis of different actions, such as the delayed departure of some vehicle from a stop, applied to the operation of the considered transportation system upon some downgrading situation occurs which lacks statistical data. For this purpose, we introduce a new stochastic hybrid automaton model, and show how this mathematically profound model can be used to forecast the passenger numbers in and the vehicle operational state of this transportation system starting from estimations of all passenger numbers and an exact knowledge of the vehicle operational state at the time of the incident occurrence. Our new automaton model brings under the same roof, all passengers who demand fixed-route transportation services, and all vehicles which provide them. It explicitly accounts for all capacity-limits and the fact that passengers do not necessarily follow efficient paths which must be mapped to some simple to understand cost function. Instead, every passenger has a trip profile which defines a fixed route in the infrastructure of the transportation system, and a preference for the different transportation services along this route. Moreover, our model does not abstract away from all vehicle movements but explicitly includes them in its dynamics, which latter property is crucial to the impact analysis of any vehicle movement-related action. In addition our model accounts for uncertainty; resulting from unknown initial passenger numbers and unknown passenger arrival flows. Compared to classical modelling approaches for hybrid automata, our Petri net-styled approach does not require the end user to specify our model's many differential equations systems by hand. Instead, all these systems can be derived from the model's predominantly graphical specification in a fully automated manner for the discrete time computation of any forecast. This latter property of our model in turn reduces the risk of man-made specification and thus forecasting errors. Besides introducing our new model, we also develop in this report some algorithmic bricks which target two major bottlenecks which are likely to occur during its forecast-producing simulation, namely the numerical integration of the many high-dimensional systems of stochastic differential equations and the combinatorial explosion of its discrete state. Moreover, we proof the computational feasibility and show the prospective benefits of our approach in form of some simplistic test- and some more realistic use case.

Many critical systems are based on the combination of components from different physical domains (e.g. mechanical, electrical, hydraulic), and are mathematically modeled as Switched Multi-Domain Kirchhoff Networks (SMDKN). In this thesis, we tackle a major obstacle to formal verification of SMDKN, namely devising a global model amenable to verification in the form of a Hybrid Automaton. This requires the combination of the local dynamics of the components, expressed as Differential Algebraic Equations, according to Kirchhoff's laws, depending on the (exponentially many) operation modes of the network. We propose an automated SMT-based method to analyze networks from multiple physical domains, detecting which modes induce invalid (i.e. inconsistent) constraints, and to produce a Hybrid Automaton model that accurately describes, in terms of Ordinary Differential Equations, the system evolution in the valid modes, catching also the possible non-deterministic behaviors. The experimental evaluation demonstrates that the proposed approach allows several complex multi-domain systems to be formally analyzed and model checked against various system requirements.

Die Dissertationsschrift stellt eine Toolkette zum abstrakten Entwurf von Mikrosystemen vor. Mikrosysteme können aus Elementen verschiedener physikalischer Domänen bestehen und zusätzlich digitale Hardware sowie Software enthalten. Die Erfassung und Formalisierung dieser heterogenen Systeme stellt den ersten Schritt im Entwurfsprozess dar, die damit verbundene neue Methodik des Designs von Mikrosystemen bildet den Kern der vorliegenden Arbeit. Zur Erfassung der analogen Spezifikationsteile enthält die Arbeit die Schilderung und Implementierung neuer Datenstrukturen, die ausgehend von einer ausführlichen Anforderungsanalyse geschaffen wurden. Das abstrakte Systemverhalten wird mit Hilfe hybrider Automaten modelliert, die sowohl mit speziellen hybriden Werkzeugen als auch mit SystemC-AMS simulierbar sind. Darüber hinaus beschäftigt sich die Arbeit mit der Erfassung von Signalverläufen und Schaltplaninformationen. Die formalisierten Anforderungen ermöglichen erste Prüfungen der Spezifikation auf Konsistenz. Zur Unterstützung niedriger Abstraktionsebenen wie der Differentialgleichungsebene steht ein Wandler von SystemC-AMS nach VHDL-AMS bereit. In die Systembeschreibung mit SystemC-AMS ist die Definition und Verknüpfung von Kostenparametern integrierbar. Das daraus entstehende globale Gütemaß hilft dem Entwerferteam, die optimale Systemrealisierung zu finden. / The PhD thesis proposes a toolflow for the design of microsystems on higher abstraction levels. Microsystems may consist of components using effects in different physical domains plus additional digital hardware and software. The collection and formalization of these heterogeneous systems is a first step in the design process, the associated design method ist the key point of this work. The system behavior is modeled using hybrid automata, which are checkable using hybrid modelcheckers and simulable using SystemC-AMS. Furthermore the work deals with signal forms and circuit parameters. To support modeling on lower abstraction levels like differential algebraic equations a syntax conversion from SystemC-AMS to VHDL-AMS was included. The integration of cost factors into SystemC-AMS allows design space exploration during system simulation.

Les systèmes hybrides sont au cœur des systèmes cyber-physiques. De tels systèmes représentent l’interaction de processus physiques continus modélisant généralement l'environnement avec des décisions discrètes issues d'un système de contrôle commande électronique. La vérification de ces systèmes est cruciale pour assurer leur sûreté dès la phase de modélisation. Les recherches sur les systèmes hybrides ont de nombreux domaines d’application, notamment le transport, l’aéronautique et la biologie. La thèse étudie des principes du raisonnement qualitatif et les applique à la vérification des systèmes hybrides. Le travail consiste à élaborer une méthode pour abstraire le système hybride en utilisant des principes qualitatifs. On recourt à une discrétisation finie de l'espace d'état tout en conservant des caractéristiques qualitatives du système. L'abstraction calculée permet de prouver des propriétés au niveau du système hybride concret et fournit une représentation du comportement global du système. Un outil développé en C++ permet de calculer l'abstraction d'un système hybride donné. Une évaluation de ses performances est établie. On s'intéresse particulièrement à une propriété de sûreté des systèmes appelée diagnosticabilité. Un modèle de système est dit diagnosticable s'il permet d'identifier sans ambiguïté la survenue de toute faute modélisée à partir des seules observations disponibles du système jusqu’à un certain délai après l’occurrence de la faute. Une méthode qui consiste à utiliser l'abstraction établie précédemment pour vérifier la diagnosticabilité d'un système hybride est proposée. / Hybrid systems are at the core of cyber-physical systems. Such systems represent the interaction between continuous physical processes generally modelling the environment with discrete decisions from control electronic signaling. The verification of these systems is crucial to ensure safety at the modeling stage. The application of hybrid systems is present in many fields such as transportation, biology and avionics. The thesis studies principals from the qualitative reasoning domain and applies them to the verification of hybrid systems. The accomplished work elaborates methods to abstract a hybrid system using qualitative principles. These methods consist in discretizing the state space to a finite number of states while conserving qualitative characteristics. The computed abstraction allows to prove properties at the level of the concrete hybrid system and presents a representation of the global behavior of the system. A tool developed in C++ computes the abstraction of a given hybrid system. An evaluation of its performance is performed. We are also interested in a particular property called diagnosability. The system is said to be diagnosable when it is capable to identify modeled faults using limited specified observations. A method that uses the computed abstraction to verify diagnosability of a given hybrid system is proposed.