This paper presents the overal structure, the design criteria, and the main features of the tool box Uppaal. It gives a detailed user guide which describes how to use the various tools of Uppaal version 2.02 to construct abstract models of a real-time system, to simulate its dynamical behavior, to specify and verify its safety and bounded liveness properties in terms of its model. In addition, the paper also provides a short review on case-studies where Uppaal is applied, as well as references to its theoretical foundation.

UPPAAL in a Nutshell

https://www.cis.upenn.edu/~alur/TCS95.pdf

The algorithmic analysis of hybrid systems

We summarize several recent results about hybrid automata. Our goal is to demonstrate that concepts from the theory of discrete concurrent systems can give insights into partly continuous systems, and that methods for the verification of finite-state systems can be used to analyze certain systems with uncountable state spaces.

The theory of hybrid automata

This paper introduces the concept of a hybrid system and some of the challenges associated with the stability of such systems, including the issues of guaranteeing stability of switched stable systems and finding conditions for the existence of switched controllers for stabilizing switched unstable systems. In this endeavour, this paper surveys the major results in the (Lyapunov) stability of finite-dimensional hybrid systems and then discusses the stronger, more specialized results of switched linear (stable and unstable) systems. A section detailing how some of the results can be formulated as linear matrix inequalities is given. Stability analyses on the regulation of the angle of attack of an aircraft and on the PI control of a vehicle with an automatic transmission are given. Other examples are included to illustrate various results in this paper.

Perspectives and results on the stability and stabilizability of hybrid systems

In this paper, we propose a method for the automatic construction of an abstract state graph of an arbitrary system using the Pvs theorem prover.

/pdf/construction-of-abstract-state-graphs-with-pvs-1t340arenf.pdf

Construction of Abstract State Graphs with PVS

We present two methods for translating nonlinear hybrid systems into linear hybrid automata. Properties of the nonlinear systems can then be inferred from the automatic analysis of the translated linear hybrid automata. The first method, called clock translation, replaces constraints on nonlinear variables by constraints on clock variables. The second method, called linear phase-portrait approximation, conservatively overapproximates the phase portrait of a hybrid automaton using piecewise-constant polyhedral differential inclusions. Both methods are sound for safety properties. We illustrate both methods by using HYTECH, a symbolic model checker for linear hybrid automata, to automatically check properties of a nonlinear temperature controller and of a predator-prey ecology.

Algorithmic analysis of nonlinear hybrid systems

HyTech is a tool for the automated analysis of embedded systems. This document, designed for the first-time user of HyTech, guides the reader through the underlying system model, and through the input language for describing and analyzing systems. The guide gives several examples of usage, some hints for gaining maximal computational efficiency from the tool, and the complete grammar for the input language. The version of HyTech described in this guide was released in August 1995, and is available through anonymous ftp from ftp.cs.cornell.edu in the directory ~pub/tah/HyTech, and through the World-Wide Web via HyTech''s home page http://www.cs.cornell.edu/Info/People/tah/hytech.html

/pdf/a-user-guide-to-hytech-1kyrwmpyhw.pdf

A User Guide to HyTech

We describe a new implementation of HYTECH, a symbolic model checker for hybrid systems. Given a parametric description of an embedded system as a collection of communicating automata, HYTECH automatically computes the conditions on the parameters under which the system satisfies its safety and timing requirements. While the original HYTECH prototype was based on the symbolic algebra tool Mathematica, the new implementation is written in C++ and builds on geometric algorithms instead of formula manipulation. The new HYTECH offers a cleaner and more expressive input language, greater portability, superior performance (typically two to three orders of magnitude), and new features such as diagnostic error-trace generation. We illustrate the effectiveness of the new implementation by applying HYTECH to the automatic parametric analysis of the generic railroad crossing benchmark problem and to an active structure control algorithm.

HYTECH: the next generation

This paper is addressed to potential users of HyTech, the Cornell Hybrid Technology Tool, an automatic tool for analyzing hybrid systems. We review the formal technologies that have been incorporated into HyTech, and we illustrate the use of HyTech with three nontrivial case studies.

/pdf/hytech-the-cornell-hybrid-technology-tool-12v4oe3wr1.pdf

HYTECH: The Cornell HYbrid TECHnology Tool

Although model checking is an exhaustive formal verification method, a bug can still escape detection if the erroneous behavior does not violate any verified property. We propose a coverage metric to estimate the "completeness" of a set of properties verified by model checking. A symbolic algorithm is presented to compute this metric for a subset of the CTL property specification language. It has the same order of computational complexity as a model checking algorithm. Our coverage estimator has been applied in the course of some real-world model checking projects. We uncovered several coverage holes including one that eventually led to the discovery of a bug that escaped the initial model checking effort.

Pei-Hsin Ho

Papers

Algorithmic analysis of nonlinear hybrid systems

A User Guide to HyTech

HYTECH: the next generation

HYTECH: The Cornell HYbrid TECHnology Tool

Coverage estimation for symbolic model checking