3.1 Hybrid Systems Modeling

Systems industries today make extensive use of mathematical modeling tools to design computer controlled physical systems. This class of tools addresses the modeling of physical systems with models that are simpler than usual scientific computing problems by using only Ordinary Differential Equations (ODE) and Difference Equations but not Partial Differential Equations (PDE). This family of tools first emerged in the 1980's with SystemBuild by MatrixX (now distributed by National Instruments) followed soon by Simulink by Mathworks, with an impressive subsequent development.

In the early 90's control scientists from the University of Lund (Sweden) realized that the above approach did not support component based modeling of physical systems with reuse 1. For instance, it was not easy to draw an electrical or hydraulic circuit by assembling component models of the various devices. The development of the Omola language by Hilding Elmqvist was a first attempt to bridge this gap by supporting some form of Differential Algebraic Equations (DAE) in the models. Modelica quickly emerged from this first attempt and became in the 2000's a major international concerted effort with the Modelica Consortium. A wider set of tools, both industrial and academic, now exists in this segment 2. In the Electronic Design Automation (EDA) sector, VHDL-AMS was developed as a standard  58 and also enables the use of differential algebraic equations. Several domain-specific languages and tools for mechanical systems or electronic circuits also support some restricted classes of differential algebraic equations. Spice is the historic and most striking instance of these domain-specific languages/tools 3. The main difference is that equations are hidden and the fixed structure of the differential algebraic results from the physical domain covered by these languages.

Despite these tools are now widely used by a number of engineers, they raise a number of technical difficulties. The meaning of some programs, their mathematical semantics, is indeed ambiguous. A main source of difficulty is the correct simulation of continuous-time dynamics, interacting with discrete-time dynamics: How the propagation of mode switchings should be handled? How to avoid artifacts due to the use of a global ODE solver causing unwanted coupling between seemingly non interacting subsystems? Also, the mixed use of an equational style for the continuous dynamics with an imperative style for the mode changes and resets, is a source of difficulty when handling parallel composition. It is therefore not uncommon that tools return complex warnings for programs with many different suggested hints for fixing them. Yet, these “pathological” programs can still be executed, if wanted so, giving surprising results — See for instance the Simulink examples in  27, 19 and  20.

Indeed this area suffers from the same difficulties that led to the development of the theory of synchronous languages as an effort to fix obscure compilation schemes for discrete time equation based languages in the 1980's. Our vision is that hybrid systems modeling tools deserve similar efforts in theory as synchronous languages did for the programming of embedded systems.

3.2 Background on non-standard analysis

Non-Standard analysis plays a central role in our research on hybrid systems modeling  19, 27, 21, 20, 3, 11. The following text provides a brief summary of this theory and gives some hints on its usefulness in the context of hybrid systems modeling. This presentation is based on our paper 2, a chapter of Simon Bliudze's PhD thesis  33, and a recent presentation of non-standard analysis, not axiomatic in style, due to the mathematician Lindström  65.

Non-standard numbers allowed us to reconsider the semantics of hybrid systems and propose a radical alternative to the super-dense time semantics developed by Edward Lee and his team as part of the Ptolemy II project, where cascades of successive instants can occur in zero time by using ${ℝ}_{+}\times \mathbb{N}$ as a time index. In the non-standard semantics, the time index is defined as a set $𝕋=\{n\partial \mid n\in {}^{*}\mathbb{N}\}$, where $\partial$ is an infinitesimal and ${}^{*}\mathbb{N}$ is the set of non-standard integers. Remark that (1) $𝕋$ is dense in ${ℝ}_{+}$, making it “continuous”, and (2) every $t\in 𝕋$ has a predecessor in $𝕋$ and a successor in $𝕋$, making it “discrete”. Although it is not effective from a computability point of view, the non-standard semantics provides a framework that is familiar to the computer scientist and at the same time efficient as a symbolic abstraction. This makes it an excellent candidate for the development of provably correct compilation schemes and type systems for hybrid systems modeling languages.

Non-standard analysis was proposed by Abraham Robinson in the 1960s to allow the explicit manipulation of “infinitesimals” in analysis  75, 50, 46. Robinson's approach is axiomatic; he proposes adding three new axioms to the basic Zermelo-Fraenkel (ZFC) framework. There has been much debate in the mathematical community as to whether it is worth considering non-standard analysis instead of staying with the traditional one. We do not enter this debate. The important thing for us is that non-standard analysis allows the use of the non-standard discretization of continuous dynamics “as if” it was operational.

Not surprisingly, such an idea is quite ancient. Iwasaki et al.  59 first proposed using non-standard analysis to discuss the nature of time in hybrid systems. Bliudze and Krob  32, 33 have also used non-standard analysis as a mathematical support for defining a system theory for hybrid systems. They discuss in detail the notion of “system” and investigate computability issues. The formalization they propose closely follows that of Turing machines, with a memory tape and a control mechanism.

3.3 Structural Analysis of DAE Systems

The Modelica language is based on Differential Algebraic Equations (DAE). The general form of a DAE is given by:

where $F$ is a system of $n_e$ equations $\{f_1,\cdots ,f_{n_e}\}$ and $x$ is a finite list of $n_v$ independent real-valued, smooth enough, functions $\{x_1,\cdots ,x_{n_v}\}$ of the independent variable $t$. We use $x^{\text{'}}$ as a shorthand for the list of first-order time derivatives of $x_j$, $j=1,\cdots ,n_v$. High-order derivatives are recursively defined as usual, and $x^{\left(k\right)}$ denotes the list formed by the $k$-th derivatives of the functions $x_j$. Each $f_i$ depends on the scalar $t$ and some of the functions $x_j$ as well as a finite number of their derivatives.

Let ${\sigma }_{i,j}$ denote the highest differentiation order of variable $x_j$ effectively appearing in equation $f_i$, or $-\infty$ if $x_j$ does not appear in $f_i$. The leading variables of $F$ are the variables in the set

The state variables of $F$ are the variables in the set

A leading variable $x_j^{\left({\sigma }_j\right)}$ is said to be algebraic if ${\sigma }_j=0$ (in which case, neither $x_j$ nor any of its derivatives are state variables). In the sequel, $v$ and $u$ denote the leading and state variables of $F$, respectively.

DAE are a strict generalization of ordinary differential equations (ODE), in the sense that it may not be immediate to rewrite a DAE as an explicit ODE of the form $v=G\left(u\right)$. The reason is that this transformation relies on the Implicit Function Theorem, requiring that the Jacobian matrix $\frac{\partial F}{\partial v}$ have full rank. This is, in general, not the case for a DAE. Simple examples, like the two-dimensional fixed-length pendulum in Cartesian coordinates  72, exhibit this behaviour.

For a square DAE of dimension $n$ (i.e., we now assume $n_e=n_v=n$) to be solved in the neighborhood of some $(v^{*},u^{*})$, one needs to find a set of non-negative integers $C=\{c_1,\cdots ,c_n\}$ such that system

can locally be made explicit, i.e., the Jacobian matrix of $F^{\left(C\right)}$ with respect to its leading variables, evaluated at $(v^{*},u^{*})$, is nonsingular. The smallest possible value of ${max}_i{c}_i$ for a set $C$ that satisfies this property is the differentiation index  40 of $F$, that is, the minimal number of time differentiations of all or part of the equations $f_i$ required to get an ODE.

In practice, the problem of automatically finding a ”minimal” solution $C$ to this problem quickly becomes intractable. Moreover, the differentiation index may depend on the value of $(v^{*},u^{*})$. This is why, in lieu of numerical nonsingularity, one is interested in the structural nonsingularity of the Jacobian matrix, i.e., its almost certain nonsingularity when its nonzero entries vary over some neighborhood. In this framework, the structural analysis (SA) of a DAE returns, when successful, values of the $c_i$ that are independent from a given value of $(v^{*},u^{*})$.

A renowned method for the SA of DAE is the Pantelides method; however, Pryce's $\Sigma$-method is introduced also in what follows, as it is a crucial tool for our works.

3.4 Contract-Based Design, Interfaces Theories, and Requirements Engineering

System companies such as automotive and aeronautic companies are facing significant difficulties due to the exponentially raising complexity of their products coupled with increasingly tight demands on functionality, correctness, and time-to-market. The cost of being late to market or of imperfections in the products is staggering as witnessed by the recent recalls and delivery delays that many major car and airplane manufacturers had to bear in the recent years. The specific root causes of these design problems are complex and relate to a number of issues ranging from design processes and relationships with different departments of the same company and with suppliers, to incomplete requirement specification and testing.

We believe the most promising means to address the challenges in systems engineering is to employ structured and formal design methodologies that seamlessly and coherently combine the various viewpoints of the design space (behavior, space, time, energy, reliability, ...), that provide the appropriate abstractions to manage the inherent complexity, and that can provide correct-by-construction implementations. The following technology issues must be addressed when developing new approaches to the design of complex systems:

• The overall design flows for heterogeneous systems and the associated use of models across traditional boundaries are not well developed and understood. Relationships between different teams inside a same company, or between different stake-holders in the supplier chain, are not well supported by solid technical descriptions for the mutual obligations.
• System requirements capture and analysis is in large part a heuristic process, where the informal text and natural language-based techniques in use today are facing significant challenges 10. Formal requirements engineering is in its infancy: mathematical models, formal analysis techniques and links to system implementation must be developed.
• Dealing with variability, uncertainty, and life-cycle issues, such as extensibility of a product family, are not well-addressed using available systems engineering methodologies and tools.

The challenge is to address the entire process and not to consider only local solutions of methodology, tools, and models that ease part of the design.

Contract-based design has been proposed as a new approach to the system design problem that is rigorous and effective in dealing with the problems and challenges described before, and that, at the same time, does not require a radical change in the way industrial designers carry out their task as it cuts across design flows of different types. Indeed, contracts can be used almost everywhere and at nearly all stages of system design, from early requirements capture, to embedded computing infrastructure and detailed design involving circuits and other hardware. Contracts explicitly handle pairs of properties, respectively representing the assumptions on the environment and the guarantees of the system under these assumptions. Intuitively, a contract is a pair $C=(A,G)$ of assumptions and guarantees characterizing in a formal way 1) under which context the design is assumed to operate, and 2) what its obligations are. Assume/Guarantee reasoning has been known for a long time, and has been used mostly as verification mean for the design of software  70. However, contract based design with explicit assumptions is a philosophy that should be followed all along the design, with all kinds of models, whenever necessary. Here, specifications are not limited to profiles, types, or taxonomy of data, but also describe the functions, performances of various kinds (time and energy), and reliability. This amounts to enrich a component's interface with, on one hand, formal specifications of the behavior of the environment in which the component may be instantiated and, on the other hand, of the expected behavior of the component itself. The consideration of rich interfaces is still in its infancy. So far, academic researchers have addressed the mathematics and algorithmics of interfaces theories and contract-based reasoning. To make them a technique of choice for system engineers, we must develop:

• mathematical foundations for interfaces and requirements engineering that enable the design of frameworks and tools;
• a system engineering framework and associated methodologies and toolsets that focus on system requirements modeling, contract specification, and verification at multiple abstraction layers.

A detailed bibliography on contract and interface theories for embedded system design can be found in 4. In a nutshell, contract and interface theories fall into two main categories:

• Assume/guarantee contracts.
  By explicitly relying on the notions of assumptions and guarantees, A/G-contracts are intuitive, which makes them appealing for the engineer. In A/G-contracts, assumptions and guarantees are just properties regarding the behavior of a component and of its environment. The typical case is when these properties are formal languages or sets of traces, which includes the class of safety properties  61, 43, 69, 18, 45. Contract theories were initially developed as specification formalisms able to refuse some inputs from the environment  51. A/G-contracts were advocated in  25 and are is still a very active research topic, with several contributions dealing with the timed  31 and probabilistic  35, 36 viewpoints in system design, and even mixed-analog circuit design  71.
• Automata theoretic interfaces.
  Interfaces combine assumptions and guarantees in a single, automata theoretic specification. Most interface theories are based on Lynch's Input/Output Automata  68, 67. Interface Automata  14, 13, 15, 41 focus primarily on parallel composition and compatibility: Two interfaces can be composed and are compatible if there is at least one environment where they can work together. The idea is that the resulting composition exposes as an interface the needed information to ensure that incompatible pairs of states cannot be reached. This can be achieved by using the possibility, for an Interface Automaton, to refuse selected inputs from the environment in a given state, which amounts to the implicit assumption that the environment will never produce any of the refused inputs, when the interface is in this state. Modal Interfaces  74 inherit from both Interface Automata and the originally unrelated notion of Modal Transition System  63, 17, 34, 62. Modal Interfaces are strictly more expressive than Interface Automata by decoupling the I/O orientation of an event and its deontic modalities (mandatory, allowed or forbidden). Informally, a must transition is available in every component that realizes the modal interface, while a may transition needs not be. Research on interface theories is still very active. For instance, timed  16, 28, 30, 48, 47, 29, probabilistic  35, 49 and energy-aware  42 interface theories have been proposed recently.

Requirements Engineering is one of the major concerns in large systems industries today, particularly so in sectors where certification prevails  76. Most requirements engineering tools offer a poor structuring of the requirements and cannot be considered as formal modeling frameworks today. They are nothing less, but nothing more than an informal structured documentation enriched with hyperlinks. As examples, medium size sub-systems may have a few thousands requirements and the Rafale fighter aircraft has above 250,000 of them. For the Boeing 787, requirements were not stable while subcontractors were working on the development of the fly-by-wire and of the landing gear subsystems, leading to a long and cahotic convergence of the design process.

We see Contract-Based Design and Interfaces Theories as innovative tools in support of Requirements Engineering. The Software Engineering community has extensively covered several aspects of Requirements Engineering, in particular:

• the development and use of large and rich ontologies; and
• the use of Model Driven Engineering technology for the structural aspects of requirements and resulting hyperlinks (to tests, documentation, PLM, architecture, and so on).

Behavioral models and properties, however, are not properly encompassed by the above approaches. This is the cause of a remaining gap between this phase of systems design and later phases where formal model based methods involving behavior have become prevalent—see the success of Matlab/Simulink/Scade technologies. We believe that our work on contract based design and interface theories is best suited to bridge this gap.

4.1 Modelica

Mathematical modeling tools are a considerable business, with major actors such as MathWorks, with Matlab/Simulink, or Wolfram, with Mathematica. However, none of these prominent tools are suitable for the engineering of large systems. The Modelica language has been designed with this objective in mind, making the best of the advantages of DAEs to support a component-based approach. Several industries in the energy sector have adopted Modelica as their main systems engineering language.

Although multimode features have been introduced in version 3.3 of the language  54, proper tool support of multimode models is still lagging behind. The reason is not a lack of interest from tool vendors and academia, but rather that multimode DAE systems poses several fundamental difficulties, such as a proper definition of a concept of solutions for multimode DAEs, how to handle mode switchings that trigger a change of system structure, or how impulsive variables should be handled. Our work on multimode DAEs focuses on these crucial issues  26.

Thanks to the experimental coupling of Dymola (Dassault Systèmes' commercial implementation of the Modelica language) with our IsamDAE prototype  39, 37, that is being tested at the time of writing of this activity report, a larger class of Modelica models are expected to be compiled and simulated correctly. This should enable industrial users to have cleaner and simpler multimode Modelica models, with dynamically changing structure of cyberphysical systems. On the longer term, our ambition is to provide efficient code-generation techniques for the Modelica language, supporting, in full generality, multimode DAE systems, with dynamically changing differentiation index, structure and dimension.

4.2 Dynamical Systems Verification

In addition to well-defined operational semantics for hybrid systems, one often needs to provide formal guarantees about the behavior of some critical components of the system, or at least its main underlying logic. To do so, we are actively developing new techniques to automatically verify whether a hybrid system complies with its specifications, and/or to infer automatically the envelope within which the system behaves safely. The approaches we developed have been already successfully used to formally verify the intricate logic of the ACAS X, a mid-air collision avoidance system that advises the pilot to go upward or downward to avoid a nearby airplane which requires mixing the continuous motion of the aircraft with the discrete decisions to resolve the potential conflict  60. This challenging example is nothing but an instance of the kind of systems we are targeting: autonomous smart systems that are designed to perform sophisticated tasks with an internal tricky logic. What is even more interesting perhaps is that such techniques can be often "reverted" to actually synthesize missing components so that some property holds, effectively helping the design of such complex systems.

5.1 Impact of research results

The expected impact of our research is to allow both better designs and better exploitation of energy production units and distribution networks, enabling large-scale energy savings. At least, this is what we can observe in the context of the FUI ModeliScale collaborative project, which is focused on electric grids, urban heat networks and building thermal modeling.

The rationale is as follows: system engineering models are meant to assess the correctness, safety and optimality of a system under design. However, system models are still useful after the system has been put in operation. This is especially true in the energy sector, where systems have an extremely long lifespan (for instance, more than 50 years for some nuclear power plants) and are upgraded periodically, to integrate new technologies. Exactly like in software engineering, where a software and its model co-evolve throughout the lifespan of the software, a co-evolution of the system and its physical models has to be maintained. This is required in order to maintain the safety of the system, but also its optimality.

Moreover, physical models can be instrumental to the optimal exploitation of a system. A typical example are model-predictive control (MPC) techniques, where the model is simulated, during the exploitation of the system, in order to predict system trajectories up to a bounded-time horizon. Optimal control inputs can then be computed by mathematical programming methods, possibly using multiple simulation results. This has been proved to be a practical solution  56, whenever classical optimal control methods are ineffective, for instance, when the system is non-linear or discontinuous. However, this requires the generation of high-performance simulation code, capable of simulating a system much faster than real-time.

The structural analysis techniques implemented in IsamDAE 39 generate a conditional block dependency graph, that can be used to generate high-performance simulation code : static code can be generated for each block of equations, and a scheduling of these blocks can be computed, at runtime, at each mode switching, thanks to an inexpensive topological sort algorithm. Contrarily to other approaches (such as  55), no structural analysis, block-triangular decompositions, or automatic differentiation has to be performed at runtime.

7.1 New software

8.1 Handling Multimode Models and Mode Changes in Modelica

Participants: Albert Benveniste, Benoît Caillaud, Mathias Malandain.

Since version 3.3, the Modelica language offers the possibility of specifying multimode dynamics, by describing state machines with different DAE dynamics in each different state  53. This feature enables describing large complex cyber-physical systems with different behaviors in different modes.

While being undoubtedly valuable, multimode modeling has been the source of serious difficulties for non-expert users of the current generation of Modelica tools. Indeed, while many large-scale Modelica models are properly handled, some physically meaningful models do not result in correct simulations with most Modelica tools. As such problematic models are actually easy to construct, the likelihood of such bad cases occurring in large models is significant.

It is unfortunately unclear which multimode Modelica models will be properly handled, and which ones will fail. As a consequence, quite often, end users have to ask Modelica experts, or even tool developers themselves, to tweak their models in order to make them work as expected. While it is accepted that physical modeling itself requires expertise, requiring expertise in how to get around tool idiosyncrasies is not desirable. This situation hinders a wider spreading of Modelica tools among a larger class of users, such as Simulink-trained engineers.

As our review of several examples, presented in 8 and 9, reveals, this problem is due to an inadequate structural analysis, performed during compilation. As far as we know, no industrial-strength Modelica tool implements a mode-dependent structural analysis. Worse, it is not even understood what kind of structural analysis should be associated with mode change events.

Some years ago, we started a project aiming at addressing all the above issues  24, 23, 26. In 8, we cast our approach in the context of the Modelica language, by illustrating it on two simple yet physically meaningful examples that current Modelica tools fail to properly simulate. The use of nonstandard analysis allows us to perform the analysis of both modes and mode changes in a unified framework, including the handling of transient modes and that of impulsive mode changes. Standardization techniques are then used in order to generate effective code for restarts at mode changes. As an efficient implementation of such methods in Modelica compilers would greatly expand the class of multimode models amenable to reliable numerical simulation, we hint at possible mechanizations towards the end of the paper; this aspect is developed further in both the companion paper 7 and the previously published article  38.

Another issue is the existence, in many physical models, of impulsive behaviors for some variables. With existing tools, such models give rise to failed or inaccurate simulations. Impulsive behaviors are already a problem from a mathematical standpoint, as they do not fall within the classical concepts of solutions of a DAE system, that assume the smoothness of the trajectories.

To cope with this issue, distributions were considered by some authors. To our knowledge, the most comprehensive approach was provided by Stephan Trenn. In his PhD thesis  77 and his article  78, he pointed out the difficulty in defining piecewise smooth distributions: several mathematically sound definitions of the “Dirac part” of such a distribution can be considered, so that it has no intrinsic definition. This indicates that distributions are not the ultimate answer to deal with impulsive variables in multimode DAE systems. Still, 64 were able to define complete solutions for a class of switched DAE systems in which each mode is in quasi-linear form and switching conditions are time-based, not state-based.

Another important step forward was done in  22. An interesting subclass of multimode DAE systems was identified, which possibly exhibit impulsive variables at mode changes. They extend the “quasi-linear systems” proposed by Trenn in the sense that switching conditions are no longer restricted to time-based ones, instead including state-based switching conditions. The analysis and discretization schemes proposed in  22 are mathematically sound. Building on this work, Martin Otter has developed the ModiaMath tool for semi-linear multimode DAE systems.

Since this work, this approach was refined and extended in  26, and is illustrated on examples in 8. In a nutshell, a complete structural analysis of multimode DAE systems is proposed in these papers. In particular, this approach distinguishes between long modes, in which the dynamics is continuous-time and governed by a DAE system for a strictly positive duration, and transient modes, which are zero duration events at which state-jumps may occur.

We develop in 7 another important aspect of our approach, by focusing on impulsive behaviors. To analyze this behavior, we propose a general compile-time analysis, acting as an additional step of the multimode structural analysis presented in the companion paper 8. Since distributions fail to properly handle impulsive behaviors in general, our mathematical tool for this is nonstandard analysis 75, 46, 65, which allows for a correct use of infinities and infinitesimals in mathematical analysis. We use this setting in two ways:

• First, we discretize the DAE dynamics in each long mode using an explicit first-order Euler scheme with an infinitesimal time step $\partial$; this provides us with an approximation of the DAE solutions up to an infinitesimal error. Infinitesimal time steps are also used to capture restarts at mode changes: the values of states in the new mode are computed, from values before the change, in one or several infinitesimal time steps.
• Second, we compute impulse orders, i.e., orders of magnitude of algebraic variables at mode changes, for both long and transient modes, with reference to the infinitesimal time step $\partial$; for example, an order of $1/\partial$ for an algebraic variable indicates that this variable is impulsive.

A compile-time calculus that evaluates the impulse order of algebraic variables is detailed in the paper. Finite impulse orders can be used to renormalize impulsive variables when implementing a numerical scheme that approximates the restart values for each state variable of the system.

In a third paper 9, presented at the Modelica'21 conference, we propose a systematic way of rewriting a multimode Modelica model, based on the results of an already implemented multimode structural analysis. The rewritten Modelica model is guaranteed to be correctly compiled by state-of-the-art Modelica tools. Simulation results are presented on a simple, yet meaningful, physical system whose original Modelica model is not correctly handled by state-of-the-art Modelica tools.

We demonstrate how the results of this multimode structural analysis can be used for transforming a multimode Modelica model into its RIMIS (Reduced Index Mode-Independent Structure) form, which is guaranteed to yield correct execution on state-of-the-art Modelica tools. This method is illustrated on a water tank model for which current Modelica tools fail to execute; in this model, the differentiation index depends on the mode, which is a difficulty for these tools. In particular, we explain how existing structural analysis methods fail to yield correct execution code for this model, then demonstrate the generation of a target Modelica code under RIMIS form, resulting in a correct simulation of the model. Our approach is then formalized for its broad application to a large class of Modelica multimode models.

8.2 Functional Decision Diagrams: A Unifying Data Structure For Binary Decision Diagrams

Participants: Joan Thibault, Khalil Ghorbal.

We present concise and canonical representations of Boolean functions akin to Binary Decision Diagrams, a versatile data structure with several applications beyond computer science. Our approach is functional: we encode the process that constructs the Boolean function of interest starting from the constant function zero (or False). This point of view makes the data structure more resilient to variable ordering, a well-known problem in standard representations. The experiments on both dense and sparse formulas are very encouraging and show not only a better compression rate of the final representation than all existing related variants but also a lower memory peak.

For Ordered Functional Decision Diagrams, we introduce a novel framework, termed λDD, that revisits Binary Decision Diagrams from a purely functional point of view. The framework allows to classify the already existing variants, including the most recent ones like Chain-DD and ESRBDD, as implementations of a special class of ordered models. We enumerate, in a principled way, all the models of this class and isolate its most expressive model. This new model, termed λDD-O-NUCX, is suitable for both dense and sparse Boolean functions, and is moreover invariant by negation. The canonicity of λDD-O-NUCX is formally verified using the Coq proof assistant. We furthermore give bounds on the size of the different diagrams: the potential gain achieved by more expressive models can be at most linear in the number of variables n.

8.3 Characterizing Q-matrices

Participants: Khalil Ghorbal, Christelle Kozaily.

In the context of Christelle Kozaily's PhD, we have shown that the existence of solutions for linear complementarity problems amounts to a covering of the entire space by a set of finite cones defined by the involved vectors as well as the standard basis. We give several full characterizations in dimension 2 and detail how these could be used to derive several necessary conditions for higher dimensions. The local existence of solutions is also investigated. It is shown that the positivity condition on the determinant, or equivalently, the orientation of the vectors forming the complementarity cones cannot be captured purely structurally.

8.4 Characterizing Positively Invariant Sets: Inductive and Topological Methods

Participants: Khalil Ghorbal.

In 12, we present two characterizations of positive invariance of sets for systems of ordinary differential equations. The first characterization uses inward sets which intuitively collect those points from which the flow evolves within the set for a short period of time, whereas the second characterization uses the notion of exit sets, which intuitively collect those points from which the flow immediately leaves the set. Our proofs emphasize the use of the real induction principle as a generic and unifying proof technique that captures the essence of the formal reasoning justifying our results and provides cleaner alternative proofs of known results. The two characterizations presented in this article, while essentially equivalent, lead to two rather different decision procedures (termed respectively LZZ and ESE) for checking whether a given semi-algebraic set is positively invariant under the flow of a system of polynomial ordinary differential equations. The procedure LZZ improves upon the original work by Liu, Zhan and Zhao  66. The procedure ESE, introduced in this article, works by splitting the problem, in a principled way, into simpler sub-problems that are easier to check, and is shown to exhibit substantially better performance compared to LZZ on problems featuring semi-algebraic sets described by formulas with non-trivial Boolean structure.

9.1 Bilateral contracts with industry

10.1 International research visitors

10.2 National initiatives

11.1 Promoting scientific activities

11.2 Teaching - Supervision - Juries

12.1 Major publications

• 1 articleA.Albert Benveniste, T.Timothy Bourke, B.Benoît Caillaud, J.-L.Jean-Louis Colaço, C.Cédric Pasteur and M.Marc Pouzet. Building a Hybrid Systems Modeler on Synchronous Languages Principles.Proceedings of the IEEE1069September 2018, 1568--1592
  HALDOI
• 2 articleA.Albert Benveniste, T.Timothy Bourke, B.Benoît Caillaud and M.Marc Pouzet. Non-standard semantics of hybrid systems modelers.Journal of Computer and System Sciences783This work was supported by the SYNCHRONICS large scale initiative of INRIA2012, 877-910
  HALDOIback to text
• 3 articleA.Albert Benveniste, B.Benoît Caillaud and M.Mathias Malandain. The mathematical foundations of physical systems modeling languages.Annual Reviews in Control502020, 72-118
  HALDOIback to text
• 4 articleA.Albert Benveniste, B.Benoît Caillaud, D.Dejan Nickovic, R.Roberto Passerone, J.-B.Jean-Baptiste Raclet, P.Philipp Reinkemeier, A.Albert Sangiovanni-Vincentelli, W.Werner Damm, T.Thomas Henzinger and K. G.Kim G. Larsen. Contracts for System Design.Foundations and Trends in Electronic Design Automation122-32018, 124-400
  HALDOIback to text
• 5 articleJ.-B.Jean-Baptiste Jeannin, K.Khalil Ghorbal, Y.Yanni Kouskoulas, A.Aurora Schmidt, R.Ryan Gardner, S.Stefan Mitsch and A.André Platzer. A Formally Verified Hybrid System for Safe Advisories in the Next-Generation Airborne Collision Avoidance System.International Journal on Software Tools for Technology Transfer196November 2017, 717-741
  HALDOI
• 6 articleA.Andrew Sogokon, K.Khalil Ghorbal and T. T.Taylor T Johnson. Operational Models for Piecewise-Smooth Systems.ACM Transactions on Embedded Computing Systems (TECS)165sOctober 2017, 185:1--185:19
  HALDOI

12.2 Publications of the year

12.3 Cited publications

• 13 inproceedingsL.Luca de Alfaro. Game Models for Open Systems.Verification: Theory and Practice2772Lecture Notes in Computer ScienceSpringer2003, 269-289
  back to text
• 14 inproceedingsL.Luca de Alfaro and T. A.Thomas A. Henzinger. Interface automata.Proc. of the 9th ACM SIGSOFT International Symposium on Foundations of Software Engineering (FSE'01)ACM Press2001, 109--120
  back to text
• 15 inproceedingsL.Luca de Alfaro and T. A.Thomas A. Henzinger. Interface-based design.In Engineering Theories of Software Intensive Systems, proceedings of the Marktoberdorf Summer SchoolKluwer2004
  back to text
• 16 inproceedingsL.Luca de Alfaro, T. A.Thomas A. Henzinger and M.Mariëlle Stoelinga. Timed Interfaces.Proc. of the 2nd International Workshop on Embedded Software (EMSOFT'02)2491Lecture Notes in Computer ScienceSpringer2002, 108--122
  back to text
• 17 articleA.Adam Antonik, M.Michael Huth, K. G.Kim G. Larsen, U.Ulrik Nyman and A.Andrzej Wasowski. 20 Years of Modal and Mixed Specifications.Bulletin of European Association of Theoretical Computer Science1942008
  back to text
• 18 bookC.Christel Baier and J.-P.Joost-Pieter Katoen. Principles of Model Checking.MIT Press, Cambridge2008
  back to text
• 19 articleA.Albert Benveniste, T.Timothy Bourke, B.Benoît Caillaud, J.-L.Jean-Louis Colaço, C.Cédric Pasteur and M.Marc Pouzet. Building a Hybrid Systems Modeler on Synchronous Languages Principles.Proceedings of the IEEE1069September 2018, 1568--1592
  HALDOIback to textback to textback to text
• 20 miscA.Albert Benveniste, T.Timothy Bourke, B.Benoît Caillaud, B.Bruno Pagano and M.Marc Pouzet. A Type-Based Analysis of Causality Loops In Hybrid Systems Modelers.Deliverable D3.1_1 v 1.0 of the Sys2soft collaborative project ''Physics Aware Software''December 2013
  HALback to textback to text
• 21 miscA.Albert Benveniste, T.Timothy Bourke, B.Benoît Caillaud and M.Marc Pouzet. Semantics of multi-mode DAE systems.Deliverable D.4.1.1 of the ITEA2 Modrio collaborative projectAugust 2013
  HALback to text
• 22 incollectionA.Albert Benveniste, B.Benôit Caillaud, H.Hilding Elmqvist, K.Khalil Ghorbal, M.Martin Otter and M.Marc Pouzet. Multi-Mode DAE Models - Challenges, Theory and Implementation.Computing and Software Science: State of the Art and Perspectives10000Lecture Notes in Computer ScienceSpringerOctober 2019, 283-310
  HALDOIback to textback to text
• 23 incollectionA.Albert Benveniste, B.Benoît Caillaud, H.Hilding Elmqvist, K.Khalil Ghorbal, M.Martin Otter and M.Marc Pouzet. Multi-Mode DAE Models: Challenges, Theory and Implementation.Lecture Notes in Computer Science Celebrates 10,000th Manuscript!10000Lectures Notes in Computer Scienceto appearSpringer2019
  back to text
• 24 inproceedingsA.Albert Benveniste, B.Benôit Caillaud, H.Hilding Elmqvist, K.Khalil Ghorbal, M.Martin Otter and M.Marc Pouzet. Structural Analysis of Multi-Mode DAE Systems.Proceedings of the 20th International Conference on Hybrid Systems: Computation and Control, HSCC 2017Pittsburgh, PA, United StatesApril 2017
  HALDOIback to text
• 25 inproceedingsA.Albert Benveniste, B.Benoît Caillaud, A.Alberto Ferrari, L.Leonardo Mangeruca, R.Roberto Passerone and C.Christos Sofronis. Multiple Viewpoint Contract-Based Specification and Design.Proceedings of the Software Technology Concertation on Formal Methods for Components and Objects (FMCO'07)5382Revised Lectures, Lecture Notes in Computer ScienceAmsterdam, The NetherlandsSpringerOctober 2008
  back to text
• 26 articleA.Albert Benveniste, B.Benôit Caillaud and M.Mathias Malandain. The mathematical foundations of physical systems modeling languages.Annual Reviews in Control502020, 72-118
  HALDOIback to textback to textback to text
• 27 inproceedingsA.Albert Benveniste, B.Benôit Caillaud, B.Bruno Pagano and M.Marc Pouzet. A type-based analysis of causality loops in hybrid modelers.HSCC '14: International Conference on Hybrid Systems: Computation and ControlProceedings of the 17th international conference on Hybrid systems: computation and control (HSCC '14)Berlin, GermanyACM PressApril 2014, 13
  HALDOIback to textback to text
• 28 inproceedingsN.Nathalie Bertrand, A.Axel Legay, S.Sophie Pinchinat and J.-B.Jean-Baptiste Raclet. A Compositional Approach on Modal Specifications for Timed Systems.11th International Conference on Formal Engineering Methods (ICFEM'09)5885LNCSRio de Janeiro, BrazilSpringerDecember 2009, 679-697URL: http://hal.inria.fr/inria-00424356/en
  back to text
• 29 articleN.Nathalie Bertrand, A.Axel Legay, S.Sophie Pinchinat and J.-B.Jean-Baptiste Raclet. Modal event-clock specifications for timed component-based design.Science of Computer Programming2011, URL: http://dx.doi.org/10.1016/j.scico.2011.01.007
  DOIback to text
• 30 inproceedingsN.Nathalie Bertrand, S.Sophie Pinchinat and J.-B.Jean-Baptiste Raclet. Refinement and Consistency of Timed Modal Specifications.3rd International Conference on Language and Automata Theory and Applications (LATA'09)5457LNCSTarragona, SpainSpringerApril 2009, 152-163URL: http://hal.inria.fr/inria-00424283/en
  DOIback to text
• 31 inproceedingsP.Purandar Bhaduri and I.Ingo Stierand. A proposal for real-time interfaces in SPEEDS.Design, Automation and Test in Europe (DATE'10)IEEE2010, 441-446
  back to text
• 32 articleS.S. Bliudze and D.D. Krob. Modelling of Complex Systems: Systems as Dataflow Machines.Fundam. Inform.9122009, 251--274
  back to text
• 33 phdthesisS.S. Bliudze. Un cadre formel pour l'étude des systèmes industriels complexes: un exemple basé sur l'infrastructure de l'UMTS.Ecole Polytechnique2006
  back to textback to text
• 34 articleG.Gérard Boudol and K. G.Kim G. Larsen. Graphical Versus Logical Specifications.Theor. Comput. Sci.10611992, 3-20
  back to text
• 35 inproceedingsB.Benoît Caillaud, B.Benoît Delahaye, K. G.Kim G. Larsen, A.Axel Legay, M. L.Mikkel L. Pedersen and A.Andrzej Wasowski. Compositional design methodology with constraint Markov chains.QEST 2010Williamsburg, Virginia, United StatesSeptember 2010, URL: http://hal.inria.fr/inria-00591578/en
  DOIback to textback to text
• 36 articleB.Benoît Caillaud, B.Benoît Delahaye, K. G.Kim G. Larsen, A.Axel Legay, M. L.Mikkel L. Pedersen and A.Andrzej Wasowski. Constraint Markov Chains.Theoretical Computer Science41234May 2011, 4373-4404URL: http://hal.inria.fr/hal-00654003/en
  DOIback to text
• 37 miscB.Benoit Caillaud, M.Mathias Malandain and J.Joan Thibault. Demo: IsamDAE, an Implicit Structural Analysis Tool for Multimode DAE Systems.PosterApril 2020, 1
  HALback to text
• 38 inproceedingsB.B. Caillaud, M.M. Malandain and J.J. Thibault. Implicit Structural Analysis of Multimode DAE Systems.23rd ACM International Conference on Hybrid Systems: Computation and Control (HSCC 2020)to appearSydney, AustraliaApril 2020
  back to textback to text
• 39 inproceedingsB.Benôit Caillaud, M.Mathias Malandain and J.Joan Thibault. Implicit structural analysis of multimode DAE systems.HSCC 2020 - 23rd ACM International Conference on Hybrid Systems: Computation and ControlSydney New South Wales Australia, FranceACMApril 2020, 1-11
  HALDOIback to textback to text
• 40 articleS. L.S. L. Campbell and C. W.C. W. Gear. The index of general nonlinear DAEs.Numerische Mathematik722dec 1995, 173--196URL: http://dx.doi.org/10.1007/s002110050165
  DOIback to text
• 41 phdthesisA.Arindam Chakrabarti. A Framework for Compositional Design and Analysis of Systems.EECS Department, University of California, BerkeleyDec 2007, URL: http://www.eecs.berkeley.edu/Pubs/TechRpts/2007/EECS-2007-174.html
  back to text
• 42 inproceedingsA.Arindam Chakrabarti, L.Luca de Alfaro, T. A.Thomas A. Henzinger and M.Mariëlle Stoelinga. Resource Interfaces.EMSOFT2003, 117-133
  back to text
• 43 inproceedingsE. Y.Edward Y. Chang, Z.Zohar Manna and A.Amir Pnueli. Characterization of Temporal Property Classes.ICALP1992, 474-486
  back to text
• 44 inproceedingsK.Koen Claessen and J.John Hughes. QuickCheck: a lightweight tool for random testing of Haskell programs.Proceedings of the Fifth ACM SIGPLAN International Conference on Functional Programming (ICFP '00), Montreal, Canada, September 18-21, 2000.2000, 268--279URL: https://doi.org/10.1145/351240.351266
  DOIback to text
• 45 bookE.E. Clarke, O.O. Grumberg and D.D. Peled. Model Checking.MIT Press1999
  back to text
• 46 bookN. J.N. J. CutlandNonstandard analysis and its applications.Cambridge Univ. Press1988
  back to textback to text
• 47 inproceedingsA.Alexandre David, K. G.Kim G. Larsen, A.Axel Legay, U.Ulrik Nyman and A.Andrzej Wasowski. ECDAR: An Environment for Compositional Design and Analysis of Real Time Systems.Automated Technology for Verification and Analysis - 8th International Symposium, ATVA 2010, Singapore, September 21-24, 2010. Proceedings2010, 365-370
  back to text
• 48 inproceedingsA.Alexandre David, K. G.Kim G. Larsen, A.Axel Legay, U.Ulrik Nyman and A.Andrzej Wasowski. Timed I/O automata: a complete specification theory for real-time systems.Proceedings of the 13th ACM International Conference on Hybrid Systems: Computation and Control, HSCC 2010, Stockholm, Sweden, April 12-15, 20102010, 91-100
  back to text
• 49 inproceedingsB.Benoît Delahaye, J.-P.Joost-Pieter Katoen, K. G.Kim G. Larsen, A.Axel Legay, M. L.Mikkel L. Pedersen, F.Falak Sher and A.Andrzej Wasowski. Abstract Probabilistic Automata.VMCAI2011, 324-339
  back to text
• 50 bookF.F. Diener and G.G. Reeb. Analyse non standard.Hermann1989
  back to text
• 51 bookD. L.David L. Dill. Trace Theory for Automatic Hierarchical Verification of Speed-Independent Circuits.ACM Distinguished DissertationsMIT Press1989
  back to text
• 52 articleJ.J. Edmonds and R. M.R. M. Karp. Theoretical improvements in algorithmic efficiency for network flow problems.Journal of the ACM1921972, 248--264URL: http://dx.doi.org/10.1145/321694.321699
  DOIback to text
• 53 inproceedingsH.Hilding Elmqvist, F.Fabien Gaucher, S. E.Sven Erik Mattsson and F.Franċois Dupont. State Machines in Modelica.Proc. of the Int. Modelica ConferenceModelica AssociationMunich, Germany09 2012, 37--46
  back to text
• 54 inproceedingsH.H. Elmqvist, S. E.S. E. Mattsson and M.M. Otter. Modelica extensions for Multi-Mode DAE Systems.Proceedings of the 10th International Modelica Conference, March 10-12, 2014, Lund, SwedenLinköping University Electronic Pressmar 2014
  DOIback to text
• 55 inproceedingsH.Hilding Elmqvist, A.Andrea Neumayr and M.Martin Otter. Modia-dynamic modeling and simulation with julia.Juliacon'18University College London, UKAugust 2018
  back to text
• 56 inproceedingsH. J.H. J. Ferreau, S.S. Almér, H.H. Peyrl, J. L.J. L. Jerez and A.A. Domahidi. Survey of industrial applications of embedded model predictive control.2016 European Control Conference (ECC)2016, 601-601
  DOIback to text
• 57 inproceedingsA. V.A. V. Goldberg and R. E.R. E. Tarjan. A new approach to the maximum flow problem.Proceedings of the eighteenth annual ACM symposium on Theory of computing (STOC'86)1986, URL: http://dx.doi.org/10.1145/12130.12144
  DOIback to text
• 58 miscIEEE Standard VHDL Analog and Mixed-Signal Extensions, Std 1076.1-1999.1999, URL: http://dx.doi.org/10.1109/IEEESTD.1999.90578
  DOIback to text
• 59 inproceedingsY.Y. Iwasaki, A.A. Farquhar, V.V.A. Saraswat, D.D.G. Bobrow and V.V. Gupta. Modeling Time in Hybrid Systems: How Fast Is ``Instantaneous''?IJCAI1995, 1773--1781
  back to text
• 60 inproceedingsJ.-B.Jean-Baptiste Jeannin, K.Khalil Ghorbal, Y.Yanni Kouskoulas, R.Ryan Gardner, A.Aurora Schmidt, E.Erik Zawadzki and A.André Platzer. Formal verification of ACAS X, an industrial airborne collision avoidance system.2015 International Conference on Embedded Software, EMSOFT 2015, Amsterdam, Netherlands, October 4-9, 20152015, 127--136
  back to text
• 61 articleL.Leslie Lamport. Proving the Correctness of Multiprocess Programs.IEEE Trans. Software Eng.321977, 125-143
  back to text
• 62 inproceedingsK. G.Kim G. Larsen, U.Ulrik Nyman and A.Andrzej Wasowski. On Modal Refinement and Consistency.Proc. of the 18th International Conference on Concurrency Theory (CONCUR'07)Springer2007, 105--119
  back to text
• 63 inproceedingsK. G.Kim G. Larsen and B.Bent Thomsen. A Modal Process Logic.Proceedings of the Third Annual Symposium on Logic in Computer Science (LICS'88)IEEE1988, 203-210
  back to text
• 64 articleD.Daniel Liberzon and S.Stephan Trenn. Switched nonlinear differential algebraic equations: Solution theory, Lyapunov functions, and stability.Automatica4852012, 954--963
  DOIback to text
• 65 incollectionT.T. Lindstr\om. An Invitation to Nonstandard Analysis.Nonstandard Analysis and its ApplicationsCambridge Univ. Press1988, 1--105
  back to textback to text
• 66 inproceedingsJ.Jiang Liu, N.Naijun Zhan and H.Hengjun Zhao. Computing semi-algebraic invariants for polynomial dynamical systems.Proceedings of the 11th International Conference on Embedded Software, EMSOFT 2011, part of the Seventh Embedded Systems Week, ESWeek 2011, Taipei, Taiwan, October 9-14, 2011ACM2011, 97--106URL: https://doi.org/10.1145/2038642.2038659
  DOIback to text
• 67 inproceedingsN. A.Nancy A. Lynch. Input/Output Automata: Basic, Timed, Hybrid, Probabilistic and Dynamic.CONCUR2003, 187-188
  back to text
• 68 articleN. A.Nancy A. Lynch and E. W.Eugene W. Stark. A Proof of the Kahn Principle for Input/Output Automata.Inf. Comput.8211989, 81-92
  back to text
• 69 bookZ.Zohar Manna and A.Amir Pnueli. Temporal verification of reactive systems: Safety.Springer1995
  back to text
• 70 articleB.Bertrand Meyer. Applying "Design by Contract".Computer2510October 1992, 40--51URL: http://dx.doi.org/10.1109/2.161279
  DOIback to text
• 71 articleP.P. Nuzzo, A. L.Alberto L. Sangiovanni-Vincentelli, X.X. Sun and A.A. Puggelli. Methodology for the Design of Analog Integrated Interfaces Using Contracts.IEEE Sensors Journal1212Dec. 2012, 3329--3345
  back to text
• 72 articleC.C. Pantelides. The consistent initialization of differential-algebraic systems.SIAM J. Sci. Stat. Comput.921988, 213--231
  back to textback to text
• 73 articleJ. D.J. D. Pryce. A Simple Structural Analysis Method for DAEs.BIT Numerical Mathematics412March 2001, 364--394URL: http://dx.doi.org/10.1023/a:1021998624799
  DOIback to textback to text
• 74 articleJ.-B.Jean-Baptiste Raclet, E.Eric Badouel, A.Albert Benveniste, B.Benoît Caillaud, A.Axel Legay and R.Roberto Passerone. A Modal Interface Theory for Component-based Design.Fundamenta Informaticae1081-22011, 119-149URL: http://hal.inria.fr/inria-00554283/en
  DOIback to text
• 75 bookA.A. Robinson. Non-Standard Analysis.ISBN 0-691-04490-2Princeton Landmarks in Mathematics1996
  back to textback to text
• 76 articleE.Ernst Sikora, B.Bastian Tenbergen and K.Klaus Pohl. Industry needs and research directions in requirements engineering for embedded systems.Requirements Engineering172012, 57--78URL: http://link.springer.com/article/10.1007/s00766-011-0144-x
  DOIback to text
• 77 phdthesisS.Stephan Trenn. Distributional Differential Algebraic Equations.Technischen Universität Ilmenau2009
  back to text
• 78 articleS.Stephan Trenn. Regularity of distributional differential algebraic equations.MCSS2132009, 229--264
  DOIback to text