1. Linzhang Wang Joint work with Lei Bu, You Li and Xuandong Li Department of Computer Science and Technology, National Key Laboratory for Novel Software Technology, Nanjing University BACH: Bounded reAchability Checker for Linear Hybrid Automata

2. Outline Preliminary BACH  Path-Oriented Reachability Checker  Bounded Reachability Checker Case Study Conclusion  2015-5-19  FMCAD08 22

3. Preliminary BACH  Path-Oriented Reachability Checker  Bounded Reachability Checker Case Study Conclusion  2015-5-19  FMCAD08 33

4. Preliminary Hybrid System: Systems contain both discrete and continuous components Practical Examples:  Embedded System Controller  VLSI circuits Linear Hybrid Automata:  Widely studied formal models for hybrid systems  2015-5-19  FMCAD08 44

5. State of The Art General Reachability Technique  Polyhedral-Computation Tool  HyTech  PHAVer Limitation  Exponential Complexity BMC Reachability Technique  SAT+LP Tool  HySAT  MathSAT Limitation  Encoding->Huge Formula->Memory…?  2015-5-19  FMCAD08 55

6. Motivation Path-oriented Reachability Checking By LP  Encoding: linear complexity  Solving: polynomial complexity Depth First Search Enumeration  Online Checking: Only one path in the memory  2015-5-19  FMCAD08 66

7. Preliminary BACH  Path-Oriented Reachability Checker  Bounded Reachability Checker Case Study Conclusion  2015-5-19  FMCAD08 77

8. BACH LHA Reachability Java Based Tool Linear Programming Solver : OR-Objects. http://OpsResearch.com/OR-Objects/index.html Available online: http://seg.nju.edu.cn/BACH/BACH.html  2015-5-19  FMCAD08 88

9. BACH Structure  2015-5-19  FMCAD08 99

10. Graphical LHA Editor Reachability Checker  Path-oriented Reachability Checker  Bounded Reachability Checker  2015-5-19  FMCAD08  10 BACH Functionality

11. Path-Oriented Reachability Check Water-Level Monitor Path: v 0 ˆv 1 ˆv 2 ˆv 3 ˆv 4 ˆv 1 ˆv 5 1. time sequence representation: (v 0, t 0 )ˆ(v 1, t 1 )ˆ(v 2, t 2 )ˆ(v 3, t 3 ) ˆ(v 4, t 4 )ˆ(v 1, t 5 )ˆ(v 5, t 6 ) -> t i ≥ 0, t 0 = 0 2. location invariant encoding: y ≤ 10 in location v 1 -> y v 1in ≤ 10, y v 1out ≤ 10, y v 1in +t 1 = y v 1out, 3. transition guard encoding: y = 10 in transition e 1 -> y v 1out = 10 4. reset action encoding y := 1 in transition e 0 -> y v 1in = 1  2015-5-19  FMCAD08  11

12. Bounded Reachability Check  2015-5-19  FMCAD08  12 Water-Level Monitor Bound: 6 Target: v 5 v 0 ˆv 1 v 0 ˆv 1 ˆv 2 v 0 ˆv 1 ˆv 2 ˆv 3 v 0 ˆv 1 ˆv 2 ˆv 3 ˆv 4 v 0 ˆv 1 ˆv 2 ˆv 3 ˆv 4 ˆv 1 v 0 ˆv 1 ˆv 2 ˆv 3 ˆv 4 ˆv 1 ˆv 2 v 0 ˆv 1 ˆv 2 ˆv 3 ˆv 4 ˆv 1 ˆv 5 v 0 ˆv 1 ˆv 5  2015-5-19  12

13. Preliminary BACH  Path-Oriented Reachability Checker  Bounded Reachability Checker Case Study Conclusion  2015-5-19  FMCAD08  13

14.  2015-5-19  FMCAD08  14 Case Study Water Level Monitor Temperature Controller

15. Path-Oriented Reachability Check  2015-5-19  FMCAD08  15

16. Bounded Reachability Check Scalability Performance  2015-5-19  FMCAD08  16

17. Preliminary BACH  Path-Oriented Reachability Checker  Bounded Reachability Checker Case Study Conclusion  2015-5-19  FMCAD08  17

18. Conclusion Convenient Tool  Graphical LHA Editor  Reachability Checker Path-oriented Reachability Checker Bounded Reachability Checker Linear Programming Based Verification Depth-First-Search Based Traverse Good Scalability and Performance  2015-5-19  FMCAD08  18

19.  2015-5-19  FMCAD08  19