Marc Pouzet

Éric Laurent Fribourg

Pascal Sotin

Henri- Charles Blondeel

Sebti Mouelhi

Pascal Fradet

Gregor Goessler

Gideon Smeding

Vagelis Babelis

Lȃcrȃmioara Aştefȃnoaei

Petro Poplavko

First of all, my thanks are directed to Bertrand Jeannet, who guided me with patience and consideration during the last three years, giving me the freedom to follow my own thoughts, but channelling the ideas towards the essential where necessary. Altogether, this resulted in smooth and productive collaborations, and consequently, in marvelous journeys to conferences around the globe.

I am extremely grateful to Alain Girault for sparking his enthusiasm for science, for his encouragements and his advice in any scientific or non-scientific issue, for carefully reviewing the manuscript, and inviting me to his "soirées de jeux

Résumé en français 0.1 Introduction

Motivation et contexte scientifique

Les deux dernières décennies ont été marquées par une explosion du nombre et de la complexité des systèmes embarqués. De plus en plus de tâches critiques dans les domaines de l'industrie, du transport, de la production d'énergie et de la médecine, par exemple, sont confiées à des systèmes informatiques : la sécurité des personnes et des biens dépend de leur bon fonctionnement. La validation de ces systèmes devient donc un enjeu considérable et les méthodes de vérification formelle automatique gagnent de l'importance.

Ces systèmes embarqués sont des systèmes de contrôle réactifs dans lesquels des programmes informatiques sont en interaction permanente avec leur environnement physique par l'intermédiaire des capteurs et des actionneurs. Nous considérons des programmes écrits dans les langages synchrones comme Lustre [START_REF] Caspi | LUSTRE: a declarative language for real-time programming[END_REF] qui sont conçus pour la programmation des systèmes temps-réel. Ces programmes impliquent des variables booléennes et numériques. Ainsi, nous appelons ces systèmes logico-numériques. Un contrôleur avec son environnement physique constitue un système hybride, i.e., un système ayant des comportements discrets et continus par rapport au temps.

Notre objectif est de vérifier des propriétés de sûreté qui expriment que « quelque chose de mauvais n'arrive jamais ». Ces propriétés peuvent être vérifiées par le calcul de toutes les configurations possibles dans les exécutions du système.

Nos techniques de vérification s'inscrivent dans le cadre de l'interprétation abstraite [START_REF] Cousot | Abstract interpretation: A unified lattice model for static analysis of programs by construction or approximation of fixpoints[END_REF], une méthode d'analyse algorithmique de programmes, qui permet une analyse de systèmes d'états infinis avec terminaison garantie. Toutefois, comme le problème de la vérification générale est indécidable pour les programmes logico-numériques, ces propriétés sont acquises au prix de sur-approximations, ce qui rend le problème semidécidable : l'analyseur répond « oui, propriété prouvée » ou « je ne sais pas ».

Problématique et objectifs

Cette thèse aborde les aspects suivants de la vérification des systèmes embarqués :

Le problème d'explosion de l'espace d'états : les techniques d'interprétation abstraite classiques ne traitent que des variables numériques. Dans le cas de programmes logico-numériques elles ont recours à l'énumération des états booléens. Cette énumération devient inapplicable déjà pour les programmes petits et moyens.

Nous prenons en compte cette préoccupation en suivant l'approche de Jeannet [START_REF] Jeannet | Partitionnement Dynamique dans l'Analyse de Relations Linéaires et Application à la Vérification de Programmes Synchrones[END_REF] qui a proposé une méthode d'interprétation abstraite basée sur un domaine abix Résumé en français x strait qui gère symboliquement les variables booléennes et qui utilise le partitionnement de l'espace d'états pour améliorer le compromis entre la précision et l'efficacité.

La perte de précision due à l'extrapolation : l'interprétation abstraite numérique utilise un opérateur d'extrapolation (l'« élargissement ») pour forcer la convergence de l'analyse, souvent entraînant une perte considérable de précision. Des méthodes diverses ont été proposées pour enrayer ce problème. Dans cette thèse nous considérons l'accélération abstraite [START_REF] Gonnord | Combining widening and acceleration in linear relation analysis[END_REF], qui exploite la régularité du comportement de certaines opérations numériques dans les boucles du programme pour effectuer une extrapolation précise dans le domaine abstrait de polyèdres convexes. Nous étudierons une deuxième méthode, l'itération de max-stratégies [START_REF] Gawlitza | Precise fixpoint computation through strategy iteration[END_REF], qui calcule la meilleure approximation de l'espace d'état atteignable dans le domaine abstrait des polyèdres gabarits à l'aide de la programmation mathématique.

Notre objectif est d'améliorer la précision des analyses logico-numériques en adaptant ces méthodes au cadre logico-numérique.

La vérification des langages de programmation de haut niveau pour les systèmes hybrides : le succès des outils industriels de modélisation et simulation comme Simulink montre la nécessité d'avoir des langages de haut niveau dans la conception de systèmes embarqués. Cependant, la vérification de systèmes hybrides se fonde sur l'automate hybride [ACH `95], un modèle de bas niveau.

Notre objectif est de rendre accessibles les méthodes d'interprétation abstraite à ces langages de simulation hybrides par une compilation vers les automates hybrides qui surmonte ce décalage conceptuel.

Développement d'outil : nous devons mettre en oeuvre nos méthodes de vérification pour évaluer leur efficacité et leur précision, ce qui est difficile à faire par des moyens théoriques.

Notre objectif est de développer un outil extensible qui est capable de se connecter à des langages de programmation et d'intégrer des méthodes d'analyse diverses pour pouvoir automatiser des comparaisons expérimentales. Nous baserons notre outil sur la bibliothèque des domaines abstraits Apron [START_REF] Jeannet | APRON: A library of numerical abstract domains for static analysis[END_REF].

Plan

La thèse se divise en trois parties :

La première partie présente des contributions par rapport à la vérification des programmes numériques qui comprennent des extensions de l'accélération abstraite.

La deuxième partie traite la vérification des programmes logico-numériques : nous présentons des méthodes qui généralisent l'accélération abstraite et l'itération de maxstratégies aux programmes logico-numériques.

La troisième partie porte sur la modélisation et la vérification des systèmes hybrides : nous décrivons une traduction d'un langage flot de données hybride en automates hybrides logico-numériques et nous montrons comment étendre les méthodes existantes d'analyse de systèmes hybrides à de tels automates.

Finalement, nous décrivons notre outil de vérification, ReaVer, qui implémente les méthodes proposées.

x xi 0.2. Spécification et vérification des systèmes critiques

Spécification et vérification des systèmes critiques

Nous considérons des programmes écrits dans des langages synchrones comme Lustre par exemple. Nous modélisons ces programmes comme des systèmes de transition discrets de la forme

"

Ipsq s 1 " f ps, iq où I définit les valeurs initiales des variables d'états s et f est la fonction de transition calculant la valeur suivante de s en fonction de l'état actuel et des entrées i. Une exécution d'un tel système est une suite (infinie) d'états

s 0 i 0 Ý Ñ s 1 i 1 Ý Ñ . . . s k i k Ý Ñ . . .

Propriétés et observateurs

Dans le contexte de langages synchrones une propriété de sûreté peut être spécifiée à l'aide d'un observateur synchrone [START_REF] Halbwachs | Synchronous observers and the verification of reactive systems[END_REF], qui est un programme écrit dans le même langage, composé de façon synchrone en parallèle avec le programme à vérifier. L'observateur a une sortie booléenne qui est vraie si le préfixe courant de l'exécution satisfait la propriété. Un observateur synchrone permet d'exprimer toute propriété de sûreté par l'invariant « la sortie de l'observateur est toujours vraie ».

Un invariant peut être vérifié en calculant l'ensemble d'états accessibles. Pour cette analyse d'accessibilité nous utilisons l'interprétation abstraite.

Analyse d'accessibilité par interprétation abstraite

L'ensemble d'états accessibles est défini par le plus petit point fixe de l'équation S " I Y postpSq, i.e., un état est accessible s'il se trouve dans l'ensemble initial I ou s'il est accessible par un pas d'exécution postpSq " ts 1 | Ds P S, Di : s 1 " f ps, iqu.

L'idée de l'interprétation abstraite est de calculer ce point fixe dans un espace de propriétés plus simple, le domaine abstrait, d'une façon qu'il soit garanti de sur-approximer l'ensemble d'états accessibles concrets.

Un exemple d'un domaine abstrait numérique est les polyèdres convexes qui sont des conjonctions de contraintes linéaires Ax ď b (où A est une matrice constante, x est le vecteur des variables d'états et b est un vecteur constant). Les opérations sur les domaines abstraits incluent par exemple l'union \, l'intersection [ et la projection, i.e., la quantification existentielle d'une variable.

La méthode classique du calcul de point fixe repose sur l'itération de Kleene et un opérateur d'élargissement qui garantit la terminaison dans le cas général.

Comme l'élargissement est souvent cause de perte importante de précision, nous considérons ci-après des méthodes d'accélération qui améliorent la précision de l'analyse.

Vérification de systèmes numériques

Les méthodes d'accélération [START_REF] Boigelot | Symbolic verification with periodic sets[END_REF][START_REF] Fribourg | Proving safety properties of infinite state systems by compilation into Presburger arithmetic[END_REF][START_REF] Bardin | Fast: Fast acceleration of symbolic transition systems[END_REF] visent à calculer l'ensemble exact des états accessibles dans les systèmes de transition numériques. Contrairement à l'interprétation abstraite, qui surmonte le problème d'indécidabilité en calculant une approximation conservatrice, l'accélération identifie des classes de systèmes pour lesquelles l'accessibilité est décidable et peut être résolue exactement. L'idée est d'accélérer les xi Résumé en français xii relations de transition τ associées aux cycles dans la structure de contrôle d'un programme en calculant l'effet de leur fermeture réflexive et transitive τ ˚" Ť kě0 τ k sur un ensemble d'états X.

Gonnord et al. [START_REF] Gonnord | Combining widening and acceleration in linear relation analysis[END_REF][START_REF] Gonnord | Accélération abstraite pour l'amélioration de la précision en Analyse des Relations Linéaires[END_REF] ont proposé le concept de l'accélération abstraite qui intègre l'idée d'accélération dans le cadre d'interprétation abstraite avec des polyèdres convexes : les boucles simples (« self loops ») sont accélérées dans le domaine abstrait quand c'est possible, et dans les autres cas (boucles imbriquées, transitions trop expressives) on recourt à l'élargissement pour garantir la convergence du calcul de point fixe.

L'accélération abstraite considère des transitions sous forme de commandes gardées :

τ : Ax ď b looomooon garde Ñ x 1 " Cx `d loooooomoooooon commande .
De telles transitions sont considérées accélérables si xC ˚, ¨y est un monoïde fini, i.e., l'ensemble C ˚" tC k | k ě 0u est fini.

Gonnord et al. fournissent des accélérations abstraites pour les cas de translations (C " I) et de translations avec resets (C est diagonale avec des coefficients P t0, 1u). Les autres cas de transitions accélérables (« ultimement périodiques ») sont ramenés à ces deux cas par un changement de base.

Extensions de l'accélération abstraite

Nous étendons l'accélération abstraite aux systèmes avec des entrées numériques, et nous formulons aussi l'accélération abstraite en arrière.

Accélération abstraite avec des entrées numériques

Les programmes réactifs, tels que les programmes Lustre, interagissent avec leur environnement : à chaque pas de calcul ils prennent en compte les valeurs des variables d'entrée. Les variables d'entrée booléennes peuvent être codées dans la structure de contrôle par des choix non-déterministes finis. Les variables d'entrée numériques ξ, par contre, exigent un traitement plus spécifique.

Nous considérons des transitions de la forme

τ : ˆA L 0 J ˙ˆx ξ ˙ď ˆb k looooooooooooomooooooooooooon Ax`Lξďb ^Jξďk Ñ x 1 " `C T ˘ˆx ξ ˙`u loooooooooomoooooooooon Cx`Tξ`u
Le défi posé par l'ajout des entrées se montre par le fait que toute transformation affine générale Ax ď b Ñ x 1 " Cx `d peut être exprimée par un reset à une entrée pAx ď b ^ξ " Cx `dq Ñ x 1 " ξ. Comme l'accélération de transformations affines générales, même sans entrées, est hors de portée de l'état de l'art actuel, il n'y a aucun espoir d'obtenir une accélération précise pour ces transitions. Néanmoins, nous pouvons accélérer les transitions avec des entrées si les variables d'état et les entrées ne sont pas liées dans la garde, i.e., la garde est de la forme Ax ď b ^Jξ ď k. Nous proposons une accélération abstraite dans le cas de ces gardes dites « simples ». Dans le cas de gardes « générales » nous relaxons, i.e., sur-approximons, la garde afin d'obtenir des gardes simples : G " pDξ : Gq ^pDx : Gq.

Dans le cas de gardes simples nous réécrivons la translation τ avec des entrées par une translation τ : G Ñ x 1 " x `D sans entrées mais où D est un polyèdre. Cela xii xiii 0.3. Vérification de systèmes numériques s'explique par le fait que à chaque pas d'exécution x est translaté par T ξ `u où ξ est inclus dans le polyèdre Jξ ď k et donc T ξ `u est un polyèdre également. Nous pouvons accélérer cette transition en calculant τ b pXq " X \ τ `pX [ Gq Õ D ˘, i.e., nous intersectons l'ensemble de départ X avec la garde G, puis nous y additionnons D un nombre α P R ě0 de fois en utilisant l'opérateur de « passage de temps » [START_REF] Halbwachs | Verification of realtime systems using linear relation analysis[END_REF], ce qui est une opération triviale dans le domaine de polyèdres convexes ; et finalement, nous appliquons la transition τ une dernière fois et nous calculons l'union avec X.

L'accélération de translations avec resets suit la même idée mais avec la différence qu'il faut distinguer les variables translatées des variables réinitialisées dans le calcul.

Nous prouvons la correction de nos formules d'accélération et nous montrons la nature des approximations impliquées. En outre, nous comparons l'accélération abstraite à des autres approches basées sur l'interprétation abstraite.

Accélération abstraite en arrière

Nous fournissons une accélération abstraite en arrière pour les translations et les translations avec resets. Bien que l'inverse d'une translation soit une translation, la différence est que l'intersection avec la garde survient après la translation (inversée). Le cas des translations avec resets est plus compliqué que dans l'accélération en avant. La relaxation des gardes générales aux gardes simples s'applique de la même manière à l'accélération en arrière.

Généralisation de l'accélérabilité linéaire

Jusqu'à présent, nous n'avons considéré que les translations et les resets. Cependant, nos expériences ont montré que d'autres types de transitions sont aussi fréquents dans les programmes synchrones : les échanges de variables (x 1 1 " x 2 ; x 1 2 " x 1 par exemple) et les retards (x 1 1 " x 2 ; x 1 2 " x 3 par exemple) sont des transformations (ultimement) périodiques; par conséquent, nous savons comment les accélérer en suivant l'approche de Gonnord et al. Cependant, les dépendances des variables non-modifiées (x 1 1 " x 1 `x2 ; x 1 2 " x 2 par exemple) ne sont pas considérés accélérables dans la théorie de l'accélération exacte. Néanmoins, intuitivement, nous devrions être capables de les accélérer parce que la variable x 2 est constante pendant les itérations de la boucle. Cette observation nous a conduit à réexaminer le concept de l'accélérabilité linéaire.

Une transition τ est linéairement accélérable si sa fermeture réflexive et transitive τ ˚peut être réécrite en τ ˚" λX. Ť i tA i x `kb i | k ě 0, x P Xu, i.e., elle peut être représentée par une union finie de transformations linéaires et de translations.

Le critère classique d'accélération exacte d'une transformation affine x 1 " Cx `d se fonde uniquement sur la matrice C (xC ˚, ¨y avec C ˚" tC k | k ě 0u est un monoïde fini).

Nous considérons ici un critère qui se base sur la forme homogène linéaire Nous montrons par décomposition en forme de Jordan qu'une transformation linéaire est linéairement accélérable si -les blocs de Jordan de taille 1 sont associés à des valeurs propres qui sont soit 0 soit des racines complexes de l'unité ;

xiii Résumé en français xiv -les blocs de Jordan de taille 2 sont associés à des valeurs propres qui sont soit 0 soit des racines complexes de l'unité et dans ce dernier cas la variable correspondant à la deuxième dimension d'un tel bloc a un nombre fini de valeurs dans l'ensemble initial (dans la base de Jordan) ; et -les blocs de Jordan d'une taille arbitraire strictement supérieure à 2 sont associés à la valeur propre 0. Ce critère est plus général que celui du monoïde fini, qui restreint les blocs de Jordan de taille 2 à des valeurs propres 0 et 1, et dans le dernier cas, la variable correspondant à la deuxième dimension d'un tel bloc doit valoir 1 dans l'ensemble initial.

Nous proposons des formules d'accélération abstraite pour les cas non-couverts par le critère du monoïde fini, qui correspondent aux transitions avec des dépendances des variables non-modifiées ou périodiques.

Vérification de systèmes logico-numériques

L'approche classique de l'application des méthodes numériques comme l'accélération abstraite aux programmes flot de données logico-numériques repose sur l'énumération de l'espace d'états booléen pour générer un graphe de contrôle purement numérique.

Par contraste, nous utilisons des analyses fondées sur des domaines abstraits logiconumériques qui permettent de traiter les variables booléennes ainsi que les variables numériques d'une manière symbolique. Ces domaines peuvent être construits en combinant des domaines abstraits Booléens et numériques afin de construire des domaines du type « produit » (A ˆB) ou « puissance » (A Ñ B). Nous considérons les domaines ℘pB m q ˆN pR n q [Jea00] et B m Ñ N pR n q [BCC `03, Jea] où la partie booléenne est représentée d'une manière exacte et le domaine N est par exemple les polyèdres convexes.

En plus, nous utilisons le partitionnement de l'espace d'états pour générer un graphe de contrôle, ce qui permet d'améliorer la précision en associant une valeur abstraite à chaque place du graphe. Le choix de la partition influence donc la précision et l'efficacité de l'analyse.

Nous dénotons s " ˆb x ˙resp. i " ˆβ ξ ˙les vecteurs de variables d'état resp.

d'entrées composés des sous-vecteurs booléen et numérique. Nous utilisons des représentations symboliques faisant usage de diagrammes de décisions binaires (Bdd) pour représenter les programmes logico-numériques et les domaines abstraits dédiés à leur analyse.

Accélération abstraite logico-numérique

Nous proposons une méthode pour analyser un programme logico-numérique à l'aide de l'accélération abstraite sans recourir à l'énumération d'états booléens, et une méthode de partitionnement efficace.

Accélération abstraite logico-numérique L'accélération numérique peut être appliquée à des boucles où l'état numérique évolue tandis que l'état booléen reste constant, i.e., la partie booléenne de la fonction de transition est l'identité. Cependant, il pourrait n'y avoir aucune boucle de cette sorte xiv xv 0.4. Vérification de systèmes logico-numériques dans le programme, tandis qu'en abstrayant légèrement le comportement des boucles nous pourrions bénéficier de techniques d'accélération précises plutôt que de compter sur l'élargissement qui risque de perdre beaucoup plus d'informations à la fin. Nous considérons des boucles simples (« self-loops ») dont la transition est de la forme τ : gps, iq Ñ ˆb1

x 1 ˙" ˆf b ps, iq apx, ξq ˙tel que gps, iq " g b pb, βq ^gx px, ξq, et

x 1 " apx, ξq soit une transformation accélérable. Cette forme peut être obtenu par une factorisation de gardes des fonctions de transitions. Notre accélération abstraite logico-numérique repose sur le découplage des parties booléennes et numériques de la fonction de transition :

τ b : gps, iq Ñ ˆb1 x 1
˙" ˆf b ps, iq λps, iq. x ˙and τ x : gps, iq Ñ ˆb1

x 1

˙" ˆλps, iq. b apx, ξq ˙.

Nous montrons que nous pouvons sur-approximer τ ˚dans le domaine abstrait logiconumérique « produit » comme suit : nous accélérons d'abord la partie numérique τ x en utilisant l'accélération abstraite numérique. Nous obtenons ainsi X b . Puis, nous itérons la partie booléenne partiellement évaluée sur X b jusqu'à la convergence : τ b pB, Xq " `pτ b rX b sq ˚pBq , X b ˘.

Au premier coup d'oeil les approximations induites par ce découplage partiel semblent plutôt grossières. Toutefois, cela n'est pas grave pour les raisons suivantes : Premièrement, les corrélations entre les variables booléennes et numériques qui sont perdues par notre méthode ne sont souvent pas représentable dans le domaine abstrait de toute façon, et deuxièmement, nous allons appliquer cette méthode à un graphe de contrôle obtenu par un partitionnement approprié, décrit ci-après.

Partitionnement par les modes numériques

L'idée est de regrouper dans une place ces états booléens qui impliquent le même comportement numérique (les « modes numériques ») et donc, le découplage des parties booléennes et numériques de la fonction de transition n'affectera probablement pas la précision.

Algorithmiquement, nous générons une telle partition efficacement en décomposant d'une manière adaptée les Bdds (diagrammes de décisions binaires) représentant les fonctions de transitions.

Résultats expérimentaux

Pour évaluer la précision et le passage à l'échelle de nos techniques nous avons effectué une comparaison avec les outils NBac [START_REF] Jeannet | Dynamic partitioning in linear relation analysis. application to the verification of reactive systems[END_REF] et Aspic [Gon]. Notre outil ReaVer est souvent en mesure de prouver les propriétés recherchées que les deux autres outils ne réussissent pas à montrer. Notre méthode de partitionnement génère des graphes de contrôle qui sont dix fois plus petits que ceux obtenus par l'énumération de l'espace d'états booléen (restreint aux états accessibles). Cela nous permet d'analyser de plus grands systèmes tout en étant suffisamment précis grâce à l'accélération abstraite logiconumérique.

L'accélération abstraite améliore la précision en réduisant le besoin de l'élargissement. Dans le chapitre suivant nous considérons les méthodes d'itération de strategies qui ne necéssitent pas d'opérateur de l'élargissement du tout. xv Résumé en français xvi 0.4.2 Itération de max-stratégies logico-numérique Les méthodes d'itération de stratégie résolvent les (in)équations de point fixe associées à l'analyse d'accessibilité par une séquence de calculs de point fixe sur des systèmes plus simples. Elles peuvent être appliquées à des domaines gabarits (templates) avec des formes de contraintes finies et a priori fixées, comme par exemple les polyèdres gabarits, i.e., des contraintes de la forme Tx ď d. Les bornes constantes d sont déterminées lors de l'analyse à l'aide de la programmation linéaire.

Itération de max-stratégies numérique

Nous considérons l'itération de max-stratégies [START_REF] Gawlitza | Precise fixpoint computation through strategy iteration[END_REF] pour les programmes affines, qui est une méthode de résolution de systèmes de point fixe d'inéquations sémantiques (sur les variables de bornes de polyèdres gabarits). Une stratégie contient exactement une inéquation par variable. Le point fixe du système est approché par les points fixes des stratégies successivement améliorées (en remplaçant une inéquation par une autre) jusqu'à ce que le point fixe du système soit atteint. Il est garanti que ce point fixe est le plus petit.

Itération de max-stratégies logico-numérique

Nous proposons un algorithme qui permet d'appliquer l'itération de stratégie numérique à des programmes logico-numériques, mais en comparaison avec une tentative précédente [START_REF] Sotin | Policy iteration within logico-numerical abstract domains[END_REF] qui necéssite de l'élargissement, notre méthode calcule toujours le plus petit point fixe dans le domaine logico-numérique.

Notre analyse se base sur l'alternance (1) d'une itération de Kleene tronquée dans un domaine abstrait logico-numérique avec des polyèdres gabarits et (2) l'itération de max-stratégies numériques.

L'itération de Kleene tronquée (propagation) explore le système jusqu'à ce que, pour tous les point de contrôle, l'ensemble des états accessibles booléens ne change pas quelle que soit la transition que nous prenons. L'idée sous-jacente est de découvrir un soussystème, dans lequel les variables booléennes sont stables pendant plusieurs itérations. Dans un tel sous-système, les variables numériques peuvent évoluer pendant que les transitions booléennes restent à l'intérieur du système, i.e., elles ne « découvrent » pas de nouveaux états booléens, jusqu'à ce que des conditions numériques soient remplies qui fassent que les variables booléennes « quittent » le sous-système.

On utilise l'itération de max-stratégies (phase (2)) pour calculer le point fixe pour les variables numériques pour un tel sous-système. Puis, l'itération de Kleene (phase (1)) continue à explorer un autre sous-système temporairement stable. L'algorithme se termine en un nombre fini d'étapes dès que l'itération de Kleene de la phase (1) a atteint un point fixe.

Résultats expérimentaux

Pour évaluer la précision et l'efficacité de nos techniques nous avons effectué une comparaison entre l'itération de max-stratégies numériques basée sur l'énumération des booléens et notre méthode logico-numérique. Les résultats montrent que, grâce à l'approche logico-numérique, nous gagnons un ordre de grandeur en temps de calcul tout en étant aussi précis. xvi xvii 0.5. Modélisation et vérification de systèmes hybrides En comparaison avec l'accélération abstraite il faut remarquer que bien que l'itération de max-strategies soit capable de calculer le plus petit point fixe, elle ne le peut que sur des formes de polyèdres donnés, tandis que l'accélération abstraite est en mesure de « découvrir » des nouvelles contraintes d'invariants.

Jusqu'à présent nous n'avons considére que des systèmes discrets. Dans la suite nous allons étendre les concepts logico-numériques aux contrôleurs discrets en interaction avec leur environnement physique continu, i.e., les systèmes hybrides.

Modélisation et vérification de systèmes hybrides

Le modèle classique pour la vérification de systèmes hybrides est l'automate hybride [ACH `95], qui combine un système de transition discret avec des équations différentielles.

En revanche, pour la modélisation en industrie, les outils et langages de simulation numériques comme Simulink [Sim] sont le plus largement utilisés. Pourtant, leur sémantiques ont quelques particularités.

Le langage de programmation hybride synchrone Zelus [START_REF] Benveniste | A hybrid synchronous language with hierarchical automata: static typing and translation to synchronous code[END_REF] aborde ces questions. Sa sémantique est basée sur l'analyse non-standard [START_REF] Robinson | Non-Standard Analysis[END_REF][START_REF] Lindstrøm | An invitation to nonstandard analysis[END_REF], ce qui permet de spécifier une sémantique déterministe du système hybride indépendamment des questions d'intégration numérique. De plus, elle s'intègre bien avec les langages synchrones.

Traduction des langages flot de données hybrides vers les automates hybrides logico-numériques

Notre objectif est de vérifier les systèmes hybrides écrits dans des langages de simulation comme Simulink ou Zelus. Cependant, il y a un décalage conceptuel entre ces langages de haut niveau et les automates hybrides, la représentation adaptée pour la vérification : dans les premiers, les transitions discrètes sont déclenchées par des zéro-crossings -des événements survenant lorsqu'une fonction passe du négatif au positif -tandis que dans les derniers les comportements discrets sont dirigés par des combinaisons d'invariants de place et les gardes des transitions discrètes -dans un automate hybride les variables continues peuvent évoluer aussi longtemps que l'invariant de place est satisfait et une transition discrète peut être prise pendant que la garde est satisfaite. Notre objectif est de formaliser la traduction d'un formalisme flot de données hybride, qui nous sert comme une base commune afin d'abstraire des constructions de haut niveau de langages comme Simulink ou Zelus, vers les automates hybrides logiconumériques, qui permettent une représentation compacte sans exiger l'énumération de l'espace d'états discret.

Formalisme flot de données hybride

Ce formalisme étend les systèmes de transition discrets par des équations différentielles ordinaires (EDO) et des zéro-crossings:

$ & % Ipsq " 9
x " f c ps, iq s 1 " f d ps, iq où s " ˆb x ˙, et 9

x est la dérivée de x par rapport au temps. Les modes continus xvii Résumé en français xviii (dans f c ) sont gardés par des variables discrètes ´par exemple, 9

x "

" x if b ´x if b ¯,
et les transitions discrètes (dans f d ) sont gardées par des zéro-crossings (par example, x 1 " y if uppzq, uppzq étant la condition de franchissement du 0).

La sémantique est (comme celle de Zelus) inspirée par le mode de fonctionnement d'un simulateur numérique, qui, après l'initialisation, intègre les EDOs jusqu'à ce qu'un zéro-crossing ait été activé. Puis les transitions discrètes sont effectuées, avant de reprendre l'intégration.

Automates hybrides logico-numériques

Nous étendons les automates hybrides par des variables discrètes booléennes (et numériques). Les relations de transitions continues, qui définissent les comportements continus et qui sont associées à des places de l'automate, ont donc la forme V pb, x, 9

xq. Les relations associées aux transitions discrètes ont la forme Rpb, x, b 1 , x 1 q.

Si nous éliminons toutes les variables booléennes en codant leurs valeurs en des places, la sémantique d'un tel automate est égale à celle d'un automate hybride standard qui ne traite que des variables numériques.

Traduction

La question principale dans la traduction est la question des zéro-crossings : la différence fondamentale entre le concept de zéro-crossings utilisé dans le langage d'entrée et la combinaison d'invariants de place et de gardes dans le langage de sortie est que l'activation d'un zéro-crossing dépend de l'histoire (c'est-à-dire une partie de la trajectoire antérieure) tandis que la satisfaction d'invariants de place et de gardes ne dépend que de l'état actuel. Donc, le principe de notre traduction consiste à ajouter des états discrets pour mémoriser l'historique de l'évolution continue. Nous discutons trois choix naturels pour la sémantique de zéro-crossing, et nous montrons comment traduire des zéro-crossings sans et avec des entrées, des combinaisons logiques de zéro-crossings et les zéro-crossings déclenchés par des transitions discretes.

Dans tous les cas, en raison des limitations du modèle d'automates hybrides, la traduction ajoutera des comportements qui ne sont pas présents dans le programme original. Par conséquent, la traduction entraîne une sur-approximation en termes de traces et d'états accessibles. Nous discutons la nature et l'ampleur de ces approximations.

La traduction vers les automates hybrides nous permet d'utiliser les outils actuels de vérification hybrides tels que HyTech [START_REF] Henzinger | HyTech: A model checker for hybrid systems[END_REF], PHaver [START_REF] Frehse | PHAVer: Algorithmic verification of hybrid systems past HyTech[END_REF] et SpaceEx [FGD `11]. Cependant, ces outils nécessitent de coder les états booléens explicitement en des places, ce qui peut causer une explosion de la taille de l'automate hybride. Pour éviter ce problème, nous appliquons le concept d'analyse logico-numérique aux méthodes d'analyse hybride dans le chapitre suivant.

Analyse des automates hybrides logico-numériques

En plus du calcul des transitions discrètes, l'analyse d'accessibilité des automates hybrides logico-numériques doit tenir compte des transitions continues. Le calcul de xviii xix 0.6. Implémentation cette évolution continue ressemble à l'accélération de boucles dans les systèmes discrets. Toutefois, par rapport à l'accélération abstraite logico-numérique, il est en fait plus simple, parce que seulement les variables continues (numériques) évoluent dans une transition continue, tandis que les variables discrètes (booléennes et numériques) restent constantes. Par conséquent, aucun découplage des variables booléennes et numériques n'est nécessaire comme nous avions dû le faire dans le cadre de l'accélération abstraite logico-numérique.

Analyse

Nous proposons une technique qui calcule à la volée des relations de transitions continues, convexes et spécialisées à l'état courant qui peuvent être traitées par des méthodes existantes d'accessibilité continue numérique.

Nous montrons comment appliquer cette technique à trois méthodes d'analyse hybrides d'horizon de temps non-borné : le passage de temps polyédrique [START_REF] Halbwachs | Verification of realtime systems using linear relation analysis[END_REF], l'itération de max-stratégies pour les systèmes hybrides affines [START_REF] Dang | Discretizing affine hybrid automata with uncertainty[END_REF] et les abstractions relationnelles [START_REF] Sankaranarayanan | Relational abstractions for continuous and hybrid systems[END_REF], une méthode qui abstrait les transitions continues par des boucles discrètes.

Partitionnement par les modes continus

Les relations continues des automates hybrides logico-numériques peuvent regrouper de nombreux comportements continus distincts, et donc l'analyse ne serait pas très précise.

Nous proposons deux méthodes de partitionnement pour découvrir des modes continus : pour détecter les modes définis par les états booléens nous appliquons la technique proposée dans le contexte de l'accélération abstraite logico-numérique aux relations de transitions continues. La deuxieme méthode se fonde sur une analyse disjonctive pour trouver les modes continus caractérisés par les états numériques discrets.

Implémentation

Nous avons mis en oeuvre les méthodes de vérification développées tout au long de cette thèse dans un outil appelé ReaVer, REActive system VERifier.

Afin de rendre l'outil le plus générique et extensible possible, nous avons séparé l'implémentation en (1) un « framework » qui définit des concepts génériques (graphe de contrôle, domaine abstrait, analyse, etc) et fournit des fonctions auxiliaires, et (2) les implémentations de ces concepts qui composent l'outil. Le framework se base sur la librarie de domaines abstraites BddApron [Jea]. Les implémentations peuvent en outre appeler d'autres bibliothèques, comme des solveurs LP et SMT.

L'outil accepte les formats d'entrée suivants: -Le format NBac [START_REF] Jeannet | Partitionnement Dynamique dans l'Analyse de Relations Linéaires et Application à la Vérification de Programmes Synchrones[END_REF], qui est une description textuelle d'un système dynamique discret avec la spécification d'une propriété. Nous l'avons étendu au format Hybrid NBac en ajoutant des équations différentielles et un opérateur de zéro-crossing. -Le langage Lustre, qui peut être analysé après transformation au format NBac à l'aide de l'outil Lus2NBac [START_REF] Jeannet | Partitionnement Dynamique dans l'Analyse de Relations Linéaires et Application à la Vérification de Programmes Synchrones[END_REF].

-Un sous-ensemble de Zelus (resp., Lucid Synchrone), en se basant sur la partie amont du compilateur Zelus [START_REF] Benveniste | Divide and recycle: types and compilation for a hybrid synchronous language[END_REF].

xix Résumé en français xx Les programmes hybrides sont traduits vers les automates hybrides. Puis, les programmes sont partitionnés selon les modes numériques par exemple. Parmi les méthodes d'analyse disponibles, il y a l'analyse standard sans ou avec accélération abstraite, l'itération des max-stratégies (basée sur le solveur de [START_REF] Dang | Discretizing affine hybrid automata with uncertainty[END_REF]), ainsi que leurs versions logico-numériques et hybrides.

Conclusions et perspectives

Dans le contexte de la vérification de propriétés de sûreté des systèmes embarqués, nous avons poursuivi l'objectif d'améliorer la précision des propriétés inférées tout en améliorant le passage à l'échelle vis-à-vis de la combinatoire booléenne. En plus, nous avons considéré l'analyse de systèmes embarqués modélisés dans les langages de simulation hybrides.

Notre approche se fonde sur des méthodes d'analyse logico-numériques, c'est-à-dire des méthodes d'interprétation abstraite qui sont capables de manipuler des variables booléennes de manière implicite à l'aide de domaines abstraits logico-numériques, et sur des méthodes de partitionnement de l'espace d'états.

Dans ce cadre, nous avons adapté des méthodes permettant d'améliorer la précision du contexte numérique au contexte logico-numérique.

En ce qui concerne les langages de simulation hybrides, nous avons proposé une traduction vers les automates hybrides logico-numériques, et nous avons montré que notre approche d'analyse logico-numérique s'applique également à de tels systèmes.

Nos expériences ont démontré que ces méthodes permettent d'améliorer l'efficacité des analyses par au moins un ordre de grandeur en comparaison aux approches purement numériques, tout en améliorant la précision des invariants calculés.

Perspectives. Nous pensons que le potentiel d'accélération abstraite numérique est loin d'être entièrement exploité. Ce travail est un premier pas vers la généralisation de ce concept. Des recherches plus poussées seront nécessaires afin de permettre le calcul d'approximations polyédriques qui sont en mesure de découvrir des invariants complexes, par exemple pour les transformations linéaires générales.

Notre itération de max-stratégies logico-numérique est basée sur un algorithme simple et générique. Il serait souhaitable de développer un solveur de max-stratégies logiconumérique plus intégrée afin d'améliorer les performances de cette approche.

Nous n'avons pas encore effectué une évaluation approfondie expérimentale de nos méthodes d'analyse de systèmes hybrides. À notre connaissance, il n'y a pas d'autres outils de vérification avec horizon de temps non-borné pour les systèmes hybrides logiconumériques. Cependant, nous pourrions comparer la version numérique avec la version logico-numérique des méthodes d'analyse hybride que nous avons choisies.

La version actuelle de notre outil ne prend qu'un sous-ensemble restreint du langage Zelus comme entrée. Nous devrions pousser notre développement vers une prise en compte plus complète. En outre, une intégration plus étroite avec la partie amont sera nécessaire pour mettre en oeuvre une approche plus pratique de retour au programme source.

Finalement, il serait intéressant de considérer des applications de nos méthodes, par exemple dans l'analyse de systèmes échantillonnés, la synthèse de contrôleurs et paramètres, la génération de cas de test et le débogage.

Motivation

The last two decades were shaped by an explosion in number and complexity of computerized systems. Computers get embedded almost everywhere and integrate a multitude of functions: home appliances and entertainment, mobile phones, portable computers, MP3 players, digital cameras, navigation assistants, electronic books, wearable fitness devices, electronic identification, ticketing and payment devices, a.s.o. This development of embedded systems is even more remarkable in applications where the presence of computers is less perceived by the users: a middle-class car for instance contains nowadays around fifty computers! In these applications more and more safety-critical tasks like braking, steering and engine control are automated and entrusted to computer systems: the safety of life and property depends on their correct operation. Safety-critical systems are mainly encountered in the following areas:

• In industry, manufacturing lines and process control, e.g., in chemical plants, are traditionally subject to automation. • In transport systems, mechanics and humans are more and more replaced by computers: avionics, automotive, automatic urban trains, railway and road signaling. • Energy production systems such as nuclear power plants and the control of energy distribution networks involve high environmental and financial risks. • In military systems they are omnipresent e.g., in transport and weapon systems, combat jets, cruise missiles, missile defense and unmanned aerial vehicles. • Space applications have extreme requirements on fault tolerance: spacecrafts, satellites, autonomous space vehicles and life support systems for spacemen. • Building automation comprises applications like heating and air-conditioning, elevators, and security and safety systems (e.g., access control and fire detectors). • Medicine is an expanding field for safety-critical applications like medical imaging, intensive care, radiotherapy, automated medication dispensing devices, implants (e.g., pacemakers), prostheses, and remote surgery. All these embedded systems are reactive control systems (Fig. 1.1) in which computer systems ("controllers") are in permanent interaction (feedback loops) with their physical environment ("plant") via sensors and actuators. Physical systems comprise, inter alia, electronics, mechanics, and hydraulics. These controllers are subject to realtime constraints and resource constraints (energy, weight, memory, processing power). The resource consumption and reaction time must be bounded statically (at compile . Systematic engineering processes (e.g., V-model) support the development of such systems in order to detect conceptual errors as early as possible. In several application areas there are norms on the quality assurance regarding the system and software development and maintenance process, e.g., DO-178B for avionics, and ISO/IEC-61508 for critical systems. Often certification by an authority is required before commissioning. The validation process, i.e., checking compliance between intended and actual behavior, becomes increasingly expensive and a huge challenge for industry. There are two general approaches to validation: testing and formal verification.

Testing can detect errors and increase the level of confidence in software, but it is not exhaustive in general and therefore it cannot guarantee the absence of errors.

Formal verification mathematically proves the absence of errors. Formal verification methods come in two flavors: Theorem proving is a semi-automatic approach which requires a human to interact with a proof assistant tool. Algorithmic methods are implemented in fully automatic tools. They are widespread in industry, e.g., in circuit verification, but they are still limited regarding software verification. The industrial need for automatic verification is confirmed by the success of tools like PolySpace1 and Astrée [CCF `05], which can prove the absence of runtime errors in large embedded C programs.

Model-based design methods iterate refinement-validation phases in a top-down manner. Software synthesis enables to automate such refinements and, thus, systems are correct by construction. Actually, the methods used for synthesis and verification are closely related and face similar difficulties, because they are somehow inverse operations: verification checks the compliance of a behavior with a specification, whereas synthesis determines the behavior compliant with a specification.

In this thesis we will concentrate on algorithmic verification methods for embedded systems.

Scientific Context

Embedded systems are modeled as discrete or hybrid, i.e., discrete and continuous, dynamical systems involving Boolean and numerical variables. Thus, we call such systems logico-numerical. Our goal is to check so-called safety properties which express that "something bad never happens". Such properties can be checked by computing the possible configurations of the system for any execution.

Synchronous languages. Synchronous languages were designed for programming reactive control systems, i.e., embedded controllers. Examples for such languages are Lustre [START_REF] Caspi | LUSTRE: a declarative language for real-time programming[END_REF], Esterel [START_REF] Berry | The ESTEREL synchronous programming language and its mathematical semantics[END_REF] and Signal [START_REF] Benveniste | Synchronous programming with events and relations: the SIGNAL language and its semantics[END_REF]. Their development was motivated by the fact that reactive systems are parallel systems by nature, but languages, 3 1.3. Problems and Objectives like assembler or C, are not adapted to dealing with the complexity of parallel systems. Hence, programming in such low-level languages is error-prone and programmers have to struggle with problems of non-determinism, race conditions and deadlocks. Moreover, these issues make the program analysis difficult.

In synchronous languages, parallel computations execute in lockstep in a sequence of synchronized reactions (synchronous paradigm). Hence, determinism and deadlockfreedom are guaranteed by construction. They abstract away all architectural and hardware issues of distributed, embedded systems so that the programmer can concentrate on the functionality. The link to real time and the execution platform is established by a worst-case reaction time (WCRT) analysis, which guarantees that the compiled code is schedulable under given application constraints.

Synchronous languages have been successfully used in avionics, railway and space applications, notably using the Scade [Sca] tool from Esterel Technologies which provides a DO-178B level A certified compiler.

Hybrid systems. A computer system together with its physical environment makes up a hybrid system: The controller is formalized as a discrete-time transition system and the plant is modeled using (continuous-time) differential equations. Hybrid automata [START_REF] Henzinger | The theory of hybrid automata[END_REF] are a classical formal model for hybrid systems that enable the modeling of the controller, the plant and their interactions in a single formalism. Simulation tools for hybrid systems, like Simulink/Stateflow [Sim], are widely used within a model-based design flow, for example, in automotive applications.

While control theorists design continuous-time controllers that perform the desired control task, we have to deal with event-or time-triggered discrete implementations of these controllers. Our focus is clearly on the discrete part of the system: we will target systems where the complexity of the discrete part largely exceeds the complexity of the continuous environment. [START_REF] Cousot | Abstract interpretation: A unified lattice model for static analysis of programs by construction or approximation of fixpoints[END_REF] is an algorithmic program analysis method, which enables unbounded (time) analysis of infinite state systems with guaranteed termination.

Static analysis by abstract interpretation. Abstract interpretation

However, since the verification problem is undecidable for general logico-numerical programs, these properties are purchased for the price of over-approximations that make the problem semi-decidable: the analyzer either replies "yes, property proved" or "don't know". Hence, such algorithms cannot find counter-examples and falsify properties.

Numerous academic and industrial tools have been developed within the abstract interpretation framework, inter alia, the above cited Astrée and PolySpace analyzers.

Problems and Objectives

This thesis addresses the following aspects of the verification of embedded systems:

(1) State space explosion problem: Classical abstract interpretation techniques deal only with numerical variables. In the case of logico-numerical programs, they enumerate first the Boolean states and encode them into program control points. It is wellknown from model checking of Boolean systems that explicitly enumerating states becomes intractable already for medium-sized programs. (2) Precision loss due to extrapolation: Numerical abstract interpretation uses an extrapolation operator ("widening") in order to force convergence of the analysis. How-ever, termination is dearly bought by a hard-to-predict loss of precision. (3) Verification of high-level programming languages: Verification methods are generally based on automata-based formal models. Yet, it is cumbersome to program real systems in such low-level formalisms lacking any programming language concepts.

We detail these three aspects:

State space explosion. We will take into account this challenge by following the approach of Jeannet et al. [START_REF] Jeannet | Dynamic partitioning in analyses of numerical properties[END_REF][START_REF] Jeannet | Partitionnement Dynamique dans l'Analyse de Relations Linéaires et Application à la Vérification de Programmes Synchrones[END_REF][START_REF] Jeannet | Dynamic partitioning in linear relation analysis. application to the verification of reactive systems[END_REF], who proposed an abstract interpretation method for logico-numerical programs based on an abstract domain that handles symbolically both Boolean and numerical variables, and state space partitioning which enables trading precision for efficiency.

Precision loss due to extrapolation. Various methods have been proposed to stem the precision loss by extrapolation operators in (numerical) abstract interpretation. In this thesis we consider abstract acceleration, introduced by Gonnord et al. [START_REF] Gonnord | Combining widening and acceleration in linear relation analysis[END_REF][START_REF] Gonnord | Accélération abstraite pour l'amélioration de la précision en Analyse des Relations Linéaires[END_REF], which exploits the regularity of the behavior of certain numerical operations in loops of the program to perform a precise extrapolation in the abstract domain of convex polyhedra. A second method that we consider is max-strategy iteration, proposed by Gawlitza et al. [START_REF] Gawlitza | Precise fixpoint computation through strategy iteration[END_REF][START_REF] Gawlitza | Precise relational invariants through strategy iteration[END_REF][START_REF] Thomas | Strategieverbesserungsalgorithmen für exakte Programmanalysen[END_REF], which computes the best approximation of the reachable state space in the abstract domain of template polyhedra with the help of mathematical programming.

Our goal is to improve the precision of logico-numerical analyses by adapting the above methods from the numerical to the logico-numerical setting.

Verification of high-level hybrid programming languages. The success of industrial modeling and simulation tools like Simulink [Sim] makes apparent that there is a need for high-level languages in the design of embedded systems, which serve as a common basis for simulation, code generation and verification. However, hybrid system verification is based mostly on the low-level representation of hybrid automata [ACH `95].

Our goal is to make abstract interpretation methods amenable to hybrid programming languages by a compilation into hybrid automata that copes with these conceptual discrepancies.

The efficiency and precision of verification methods is hard to evaluate by theoretical means. Therefore, the proposed techniques need to be implemented in order to enable experimental evaluation and comparison: Tool development. Our goal is to develop a tool that, apart from implementing our methods, enables the integration of available and future abstract interpretation methods and the connection to actual programming languages. This should make it easier to automatize experimental comparisons: for some of the numerous abstract interpretation methods proposed every year, academic prototypes are available, however, it is laborious to compare the efficiency and precision because often benchmarks have to be transformed in the proprietary input formats, and the tool output must be re-parsed in order to automatize comparisons.

Contributions

The first objective of this thesis is to provide methods that allow us to improve the precision while dealing with the state space explosion problem. To this end, we want to make numerical analysis methods, which are known to improve the precision, applicable in the logico-numerical context. We will consider two such methods: abstract acceleration and max-strategy iteration.

Verification of numerical programs.

Before tackling logico-numerical programs we have to settle a minor deficiency of abstract acceleration: it is not yet ready to handle numerical input variables, which are, e.g., used to model inputs from sensors. Thus, we extend abstract acceleration to numerical inputs (published in [START_REF] Schrammel | Extending abstract acceleration to dataflow programs with numerical inputs[END_REF][START_REF] Schrammel | Applying abstract acceleration to (co-)reachability analysis of reactive programs[END_REF]).

Moreover, we provide an extension of abstract acceleration to backward analysis, i.e., co-reachability analysis [START_REF] Schrammel | Applying abstract acceleration to (co-)reachability analysis of reactive programs[END_REF]. As a side effect, these contributions include detailed proofs for the abstract acceleration methods originally proposed by Gonnord et al.

Furthermore, we revisit the notion of linear accelerability and provide a more general characterization of linearly accelerable transitions.

Verification of logico-numerical programs.

Now, we are prepared to apply abstract acceleration to logico-numerical programs [START_REF] Schrammel | Logico-numerical abstract acceleration and application to the verification of data-flow programs[END_REF], a method based on decoupling Boolean and numerical transition functions and a partitioning technique for detecting "numerical modes", i.e., states with the same numerical behavior. Moreover, we provide experimental results that demonstrate the efficiency and precision of the approach.

As a second method, we present an algorithm for applying max-strategy iteration to logico-numerical programs [START_REF] Schrammel | Logico-numerical max-strategy iteration[END_REF]. Our experiments show that this is a promising approach.

The remaining contributions to theory concern the translation of high-level hybrid languages and their verification:

Modeling and verification of hybrid systems.

We want to verify programs written in high-level programming languages for hybrid systems, e.g., Zelus [START_REF] Benveniste | Divide and recycle: types and compilation for a hybrid synchronous language[END_REF][START_REF] Benveniste | A hybrid synchronous language with hierarchical automata: static typing and translation to synchronous code[END_REF]. To this end, we present a translation of a hybrid data-flow language to logiconumerical hybrid automata [START_REF] Schrammel | From hybrid data-flow languages to hybrid automata: A complete translation[END_REF], which addresses the problem of zero-crossings -an issue left open in existing translation attempts which raises tricky semantical issues. Moreover, the target formalism of the translation, logico-numerical hybrid automata, takes into account the state space explosion problem.

At last, we describe how to extend hybrid system analysis methods to logico-numerical hybrid automata. We present partitioning methods for detecting continuous modes and propose principles for adapting existing numerical hybrid system analysis methods to logico-numerical hybrid systems.

Implementation.

On the practical side, we have developed a verification tool, ReaVer2 ( §14) based on the Apron library [JM09], a widely accepted API for numerical abstract domains. Besides the methods we propose, it implements several existing techniques and it is easily extensible. Besides a low-level input format it supports a subset of the Zelus language.

Outline

The organisation of the thesis is illustrated in Fig. 1.2.

We start with an introduction to formal program models and analysis methods: §2 explains how we formally represent discrete programs and specify the properties we want to verify. §3 gives a detailed presentation of the state of the art in reachability analysis by abstract interpretation.

The following three parts of the thesis deal with our contributions in the three areas of (I) numerical programs, (II) logico-numerical programs and (III) hybrid systems.

Part I deals with numerical program analysis: We first recall the concepts of acceleration and abstract acceleration §4 before we present our contributions w.r.t. extending ( §5) and generalizing ( §6) abstract acceleration.

Part II is dedicated to logico-numerical analysis of discrete programs: We start with a detailed presentation of the state of the art in logico-numerical program analysis in §7. Then, §8 and §9 explain our contributions concerning logico-numerical abstract acceleration and logico-numerical max-strategy iteration respectively.

Part III deals with the modeling and analysis of hybrid systems: We give first an introduction to hybrid system modeling and the Zelus language ( §10). §11 details our translation from Zelus to logico-numerical hybrid automata. Then, we give an overview of the state of the art in hybrid system verification ( §12). Finally, §13 presents some methods for partitioning and analyzing logico-numerical hybrid automata.

The last two chapters are dedicated to the implementation of our tool ReaVer ( §14) and to the conclusions and perspectives ( §15).

Programs and Properties

Safety-critical embedded systems consist of reactive programs in interaction with their environment. Reactive programs can be modeled as discrete transition systems ( §2.1). Synchronous languages ( §2.2) like Lustre [START_REF] Caspi | LUSTRE: a declarative language for real-time programming[END_REF] and Lucid Synchrone [CP96] are high-level programming languages for reactive systems, which combine data-flow and synchronous paradigms and which can be compiled to discrete transition systems.

Safety properties express statements about a system of the form "something bad never happens". In the context of synchronous languages such properties can be specified by synchronous observers ( §2.3).

Program Models

We model reactive programs as discrete transition systems ( §2.1.1), possibly considering their control flow graphs (CFGs, §2.1.2).

Discrete Transition Systems

We will model reactive programs as discrete (input/output) transition systems (discrete dynamical systems): Definition 2.1 (Discrete transition system) A discrete transition system is defined by xΣ, Υ, R, Iy where

• Σ and Υ are the state and input spaces,

• R Ď Σ ˆΥ ˆΣ is the transition relation and • I Ď Σ is the set of initial states.

W.l.o.g. we can assume that the output of a system equals its state.

Definition 2.2 (Semantics) An execution of such a system is a sequence

s 0 i 0 Ý Ñ s 1 i 1 Ý Ñ . . . s k i k Ý Ñ . . .
such that s 0 P I and @k ě 0 : ps k , i k , s k`1 q P R.

A discrete transition system is deterministic iff the transition relation is a function, i.e., R Ď pΣ ˆΥ Ñ Σq, in other words: iff for each initial state and sequence of input valuations there is a unique execution trace.

Chapter 2. Programs and Properties 10 Numerical and logico-numerical transition systems. We will mostly deal with deterministic transition systems over state and input spaces Σ and Υ represented as " Ipsq s 1 " f ps, iq where s and i are the vectors of state and input variables respectively, and f is the vector of transition functions. The transition relation R is obtained by tps, i, s 1 q | s 1 " f ps, iqu.

Depending on the state and input spaces we can instantiate different types of discrete transition systems: Numerical transition systems with Σ " R n and Υ " R m are finitedifference equations. We denote the state and input vectors x and ξ respectively.

Example 2.1 (Numerical transition system) A simple example for a numerical transition system with Σ " R and Υ " R is the program that memorizes the maximum positive integer in the input sequence. On the right-hand side we give the beginning of a possible execution:

$ & % I " px " 0q x 1 " " ξ if ξ ą x x else k 0 1 2 3 4 . . . ξ 2 ´3 4 1 4 . . . x 0 2 2 4 4 . . .
Boolean transition systems with Σ " B n and Υ " B m are Mealy machines for instance. Logico-numerical transition systems have state and input spaces of the form B n ˆN m , where N can be any cartesian product of numerical sets; usually we assume N " R m . We denote the state and input vectors consisting of Boolean and numerical components pb, xq and pβ, ξq respectively. We will provide a detailed presentation of logico-numerical programs in §7.

Remark 2.1 (Number representations) Discrete transition systems are idealized versions of actual programs assuming unbounded integers instead of machine integers and real numbers instead of floating point numbers. In practice, verification tools often represent machine integers as arbitrary-sized integers and floating point numbers as arbitrary precision rationals resulting in sets of the form Z p ˆQq . Remark 2.2 (Continuous dynamical systems) Continuous dynamical systems have exactly the same form as discrete numerical dynamical systems, except that time is continuous and the dynamics is specified by differential equations instead of difference equations: @t ě 0 :

! xp0q P I 9 xptq " f pxptq, ξptqq

Control Flow Graphs

The transition relation of a discrete transition system has a complex structure, e.g., involving conditionals (if-then-else), which makes it hard to understand for humans. In program analysis it can be favorable to make this control structure explicit by encoding it into a control flow graph: • Σ 0 : L Ñ Σ defines for each location the set of initial states.

Definition 2.4 (Semantics) An execution of a CFG is a sequence

pℓ 0 , s 0 q i 0 Ý Ñ pℓ 1 , s 1 q i 1 Ý Ñ . . . pℓ k , s k q i k Ý Ñ . . .
such that for any k ě 0 : Dpℓ k , R, ℓ k`1 q P : ps k , i k , s k`1 q P R.

Imperative programs, e.g., C programs, can be translated directly into a CFG representation by associating control points with programming constructs as if-then-else or while:

Example 2.2 (CFG of an imperative program) The CFG of the following C program (cf. [START_REF] Gopan | Guided static analysis[END_REF]) is depicted in Fig. 2.1. The numbers in double parentheses are the control points. pp0qq x=0; y=0; pp1qq while(y>=0) { pp2qq if(x<=4) pp3qq y++; else pp4qq y--; pp5qq x++; } pp6qq

For any discrete transition system xΣ, Υ, R, Iy we can easily obtain the trivial control flow graph representation xΣ, Υ, tℓ 0 u, tpℓ 0 , R, ℓ 0 qu, tℓ 0 Ñ Iuy.

In Ex. 2.2, a detailed CFG is extracted from the imperative program source by syntactical criteria. In §7.3 we will discuss state space partitioning techniques for generating CFGs of arbitrary granularity from discrete transition systems.

Remark 2.3 (Hybrid automata) Hybrid automata [START_REF] Henzinger | The theory of hybrid automata[END_REF] (see §10.2) are CFGs where, in addition, locations are labeled by differential equations. That way, discrete and continuous dynamical systems are modeled in a single formalism. An execution of such a hybrid system is an alternation of discrete transitions between locations and continuous evolutions while staying in a location.

Synchronous Languages

Synchronous languages [START_REF] Halbwachs | Synchronous programming of reactive systems[END_REF][START_REF] Halbwachs | Synchronous programming of reactive systems -a tutorial and commented bibliography[END_REF]BCE `03] were developed for programming reactive systems. These languages apply the synchronous principle of digital hardware circuits to software: parallel computation steps are executed in lockstep. Such steps (called reactions) are triggered by a (logical) clock. This computation model guarantees deterministic concurrency, i.e., synchronous programs can be composed in parallel by their synchronous product [START_REF] Halbwachs | Synchronous observers and the verification of reactive systems[END_REF] (no interleavings as in the asynchronous case).

A large number of synchronous languages have been developed with different flavors. Generally, we distinguish languages that have an imperative language syntax like Esterel [START_REF] Berry | The ESTEREL synchronous programming language and its mathematical semantics[END_REF] from those with a data-flow syntax like Lustre [START_REF] Caspi | LUSTRE: a declarative language for real-time programming[END_REF]. We will focus on the verification of synchronous data-flow languages, but the methods apply also to imperative programs after having compiled them into a data-flow representation.

Lustre

Lustre was designed as a synchronous version of the data-flow language Lucid [AW85] for programming real-time systems (hence the name (in French) LUcid Synchrone Temps R Éel) [START_REF] Caspi | LUSTRE: a declarative language for real-time programming[END_REF]. By combining data-flow and synchronous paradigms, it has a semantics that is surprisingly simple and easy to understand.

In Lustre variables represent streams of values. Operators, e.g., if then else or +, are lifted to streams and applied point-wise to the elements of their operand streams. The previous value operator pre delays a stream by one clock tick:

ppre sqpkq " " uninitialized for k " 0 spk´1q for k ą 0
The initialization operator -> is used to initialize a stream:

ps 0 -> sqpkq " " s 0 p0q for k " 0 spkq for k ą 0
A program is structured in nodes, i.e., program blocks that have inputs and outputs, and encapsulate their internal state. Nodes can be called (instantiated) by other nodes; each instantiation has its own internal state. A node contains exactly one equation for each state and output variable s j of the form s j " f j ps, iq.

Example 2.3 (Lustre program)

The following program outputs at each clock tick the maximum value encountered so far in its integer input stream: node max(xi:int) returns (x:int); let x = xi -> if xi > pre x then xi else pre x; tel Equations like x = y + 1; y = 2*x are forbidden because of the instantaneous causality cycle they induce: we need to know y in order to compute x and vice versa. The language semantics does not resolve such cycles by computing fixed points, but it requires each cyclic dependency to be cut by a delay operator pre, otherwise the program is rejected by the compiler.

Accessing an uninitialized value of a stream, like in the equation x = pre x + 1, leads to a runtime error.

Compilation to a discrete transition system. We can easily obtain the form of a discrete transition system ( §2.1.1) by 13 2.2. Synchronous Languages -inlining the instantiated nodes (involves a renaming of the state variables in order to make them unique); -adding a finite number of variables p (called "memories") for memorizing the delayed values and their initialization, and replacing the delay operators by these variables, e.g., y=2*(0 -> (pre (x+1))) becomes y " 2p and we have the transition function p 1 " x`1 with the initial value p " 0; and -replacing the variables s occurring on the left-hand sides of the equations by the lefthand side of the equations defining s. For example, z=y+1 with the above definition of y becomes z " 2 ˚p `1. This rewriting terminates because dependencies are acyclic. The result consists of transition functions for the state variables p of the discrete transition system, their initial values, and the equations defining the outputs (which we are not interested in).

Example 2.4 (Lustre to discrete transition system) For the program computing the Fibonacci numbers node fibonacci (dummy:bool) returns (x:int); let x = 1 -> pre(x + (0 -> pre x)) tel we obtain the discrete transition system

I " pp 1 " 1 ^p2 " 0q " p 1 1 " p 1 `p2 p 1
2 " p 1 where the output x of the node has the value of p 1 .

We have seen in §2.1.2 that the trivial CFG of such a program consists of a single location with a self-loop.

Lucid Synchrone

Lucid Synchrone [CP96, Pou02, CGHP04, CPP05, Pou06, CHP08] combines the synchronous data-flow language Lustre with the features of a functional language like ML [START_REF] Milner | The Definition of Standard ML[END_REF]. From the former it inherits the data-flow operators, from the latter, inter alia, the syntax and the type inference.

Lucid Synchrone brings a lot of new features to synchronous languages -we will only give a small selection here. For an exhaustive presentation we refer to the user manual [START_REF] Pouzet | Lucid Synchrone Release version 3.0: Tutorial and Reference Manual[END_REF]. All the features presented in the following are mere syntactical sugar in order to lift programming to higher level. Such programs can still be reduced to a discrete dynamical system as explained above.

The initialized delay operator fby initializes a stream by the first value of its first operand and continues with the second operand delayed by one clock tick. Thus, s 0 fby s is equivalent to s 0 -> pre s.

Unlike Lustre V4, the Lucid Synchrone compiler features an initialization analysis that checks if all accessed stream elements have actually been initialized.

While Lustre V4 offers only a sampling (when) and a projection (current) operator for dealing with multi-clocked systems, Lucid Synchrone provides also the oversampling operator merge for combining streams with complementary clocks. Furthermore it comes with an automatic clock inference based on a dependent type system.

) continue Up end

There are transitions with weak preemption (until) where the transition guard is checked after executing the equations associated with the location, and transitions with strong preemption (unless) where the transition can be taken before executing the equations at all. The target locations of a transition can be entered by reset (then), i.e., as if it was the initial instant, or by history (continue), i.e., with the values the streams had the last time the location was visited. Communication between the locations of an automaton is handled via shared variables (last x). Moreover, automata can be nested (hierarchy).

Automata are translated to data-flow using multi-clocking: equations associated to locations are subsampled by the clock taking the values of the respective location labels and the streams for the shared variables are then merged over this multi-valued clock.

Scade. The commercial tool

Properties and Observers

The goal of formal verification is to prove the compliance of a program to its specification. The specification consists of a set of properties. An example for a specification language of properties is linear temporal logic (LTL) [START_REF] Pnueli | The temporal logic of programs[END_REF]. In LTL, invariants are of the form GG meaning that a "predicate G holds globally": for all execution traces s 0 Ñ s 1 Ñ . . . we have @k ě 0 : Gps k q.

Synchronous observers. In the context of synchronous languages a safety property can be specified with the help of a synchronous observer [START_REF] Halbwachs | Synchronous observers and the verification of reactive systems[END_REF], i.e., a program written in the same language, synchronously composed in parallel with the program under verification and with a Boolean output which is true iff the current prefix of the execution satisfies the property. A synchronous observer allows any safety property to be expressed as the invariant "the output of the observer is always true".

In practice, we have to take into account hypotheses about the environment, i.e., which input values (in dependency of the current system state) are considered realistic. Thus, one actually needs two observers: one for the assumption (or assertion) about the environment Aps, iq and one to specify the program behavior considered correct, i.e., the actual property Gpsq which shall be guaranteed if the assertion is satisfied: GA ñ GG. Fig. 2 A static analyzer actually truncates the traces at the point where A ceases to hold. If G holds along all these (partial) traces, the property is satisfied: GpA^Gq_pA^GqU A. This formula is equivalent to GA ñ GG under the condition that the assertion observer does not block the program under verification [START_REF] Halbwachs | Synchronous observers and the verification of reactive systems[END_REF], i.e., for every s k in a program execution Ds k`1 Di : Rps k , i, s k`1 q ^Aps k , iq. To put everything together, a discrete transition system with observers has the form

$ & % Ipsq Aps, iq Ñ s 1 " f ps, iq Gpsq , .
with A Ď pΣ Ñ ℘pΥqq and G Ď Σ.

Property specification with observers can be used for all synchronous representations of discrete and hybrid systems (see Rem. 2.3 and §10).

Remark 2.4 (Assume/guarantee) Another possible observer semantics comes from assume/guarantee reasoning: GpA ñ Gq, i.e., the property is considered to be satisfied if for all configurations the satisfaction of A implies the satisfaction of G. We have the following relationship w.r.t. the above semantics: GpA ñ Gq ùñ pGA ñ GGq.

Chapter 3

Reachability Analysis by Abstract Interpretation

Static analysis is the umbrella term for automatic program analysis methods that infer properties about a program without actually executing it.

Reachability analysis ( §3.1) is a static analysis that computes the states reachable by all possible program executions. Hence, it enables the verification of invariance properties. We consider reachability analyses using abstract interpretation [CC76, CC77, Cou81, CC92a], an analysis framework based on lattice theory ( §3.2) that consists of two ingredients: -an abstract domain ( §3.3), i.e., an abstract state space to which concrete program states are mapped; also, the concrete semantics of the program is mapped to an abstract semantics in the abstract domain; and -a method for resolving the abstract semantic fixed point equations associated to the program ( §3.4). Abstract interpretation methods are guaranteed to terminate for any program, but at the price of an approximate analysis result. There are several commercial and academic static analysis libraries and tools based on this framework ( §3.5).

Reachability Analysis

Reachability analysis aims at computing the reachable state space of a discrete transition system xΣ, Υ, R, Iy.

Post-and pre-condition (or image and pre-image) operators define the sets of states reachable from a given set of states by taking a transition in forward or backward direction respectively: Definition 3.1 (Pre-and post-condition operators)

Post-condition operator: postpSq " ts 1 | Ds P S, Di P Υ : ps, i, s 1 q P Ru, S Ď Σ Pre-condition operator: prepSq " ts | Ds 1 P S, Di P Υ : ps, i, s 1 q P Ru, S Ď Σ

The set of (co-)reachable states, i.e., the (co-)reachable state space of a discrete transition system, is defined by the reflexive and transitive closure of these operators: Definition 3.2 ((Co-)reachable state space)

Reachable state space: reachpIq " post ˚pI q " Ť kě0 post k pIq Co-reachable state space: co-reachpIq " pre ˚pI q " Ť kě0 pre k pIq with " post 0 pSq " S post k`1 pSq " post ˝post k pSq and analogously for pre k .

An invariance property G ( §2.3) can be checked by either a (forward) reachability analysis or a co-reachability analysis (backward analysis):

-reachpIq Ď G, or reachpIq X E " H with the error states E " Σ ´G -co-reachpEq X I " H Finite and infinite-state systems. If Σ is finite the computation of reachpIq is guaranteed to terminate in a finite number of computation steps, whereas in systems with an infinite state space termination is generally not guaranteed. As a fundamental consequence, reachability analysis in finite-state systems is decidable, whereas in infinitestate systems, e.g., systems with Σ " Z n , it is undecidable in general: a system with two counters with increment, decrement and test-to-zero (two-counter machine) is known to be Turing-complete [START_REF] Minsky | Computation: Finite and Infinite Machines[END_REF].

However, there are some important classes of infinite-state systems with restricted transition relations R such that reachability analysis becomes decidable, e.g., timed automata [START_REF] Alur | A theory of timed automata[END_REF]. We will deal with general infinite state systems.

Analysis approaches. Model checking subsumes methods for checking properties of finite state systems or systems abstracted to finite state systems. Model checking is successfully applied in digital circuit verification, i.e., on Boolean transition systems, for which the reachability problem is an NP-complete problem [START_REF] Cook | The complexity of theorem-proving procedures[END_REF]. Model checking methods rely either on enumeration, symbolic representations like Bdds, or SAT-solving. Bounded model checking [START_REF] Clarke | Bounded model checking using satisfiability solving[END_REF] considers only traces of bounded length. It is an efficient method to find bugs, but it cannot prove properties. An infinite state system can be model-checked by abstracting it (by an appropriate simulation relation) to a finite system (also called "quotient system" [START_REF] Henzinger | The theory of hybrid automata[END_REF]) such that the property to be verified is preserved [START_REF] Bensalem | Property preserving simulations[END_REF][START_REF] Clarke | Model checking and abstraction[END_REF]. For example, predicate abstraction [GS97, FQ02] considers a finite set of predicates in order to generate a finite state system, which is a (conservative, safe) over-approximation of the original system: this means that each execution trace of the original system is an execution trace of its abstraction, but conversely, a trace of the abstracted system may not be an actual trace of the original system. Hence, if the property is verified on the abstraction, it is also true on the original system. However, the additional behavior of the abstraction may disprove the property although it is true. Such spurious counterexamples can be used to derive additional predicates for refining the abstraction (counterexample-guided abstraction refinement [CGJ `00]). Yet, this refinement process is not guaranteed to terminate in general.

Other methods for infinite state systems make use of the power of modern SMTsolvers: k-induction for instance [SSS00, HT08, DHKR11], unrolls the transition relation k times and proves by induction that the property also holds for k `1. This method terminates if there exists a bounded k that enables the proof of the property.

Abstract interpretation is a framework for over-approximating the concrete states and semantics by abstract ones. Termination is guaranteed by an extrapolation operator. Similarly to finite state abstraction in model checking, the over-approximation adds behaviors, and thus the method can prove properties, but it cannot falsify them in general. Fig. 3.1 shows the scheme of an abstract interpreter for verifying safety properties: either the property is proved ("yes, safe") or the result remains inconclusive ("don't know").

Lattice Theory and the Principle of Abstract Interpretation

Abstract domains ( §3.3) are often complete lattices, i.e., algebras over partially ordered sets. We recall in this section the fundamental notions of lattice theory, which are the basis for the soundness of over-approximations of reachable state sets computed by abstract interpretation methods. For further details and proofs we refer to textbooks on lattice theory [START_REF] Davey | Introduction to Lattices and Order[END_REF] and static analysis [START_REF] Nielson | Principles of Program Analysis[END_REF].

From partial orders to complete lattices Definition 3.3 (Partial order) A partial order xS, Ďy is a set S equipped with a reflexive, transitive and anti-symmetric binary relation Ď: S ˆS.

For example, the powerset of integers with the set inclusion x℘pZq, Ďy is a partial order. Partial orders can be visualized with the help of Hasse diagrams. Definition 3.4 (Upper and lower bounds) Let S 1 Ď S: -Upper bound s P S: @s 1 P S 1 : s 1 Ď s -Lower bound s P S: @s 1 P S 1 : s 1 Ě s -Least upper bound (also called join or union operator) s " Ů S 1 : for all upper bounds s 1 P S 1 : s Ď s 1 -Greatest lower bound (also called meet or intersection operator) s " Ű S 1 : for all lower bounds s 1 P S 1 : s Ě s 1

For the powerset of integers x℘pZq, Ďy, we can define these operations as the usual intersection X and union Y for sets. For example, take S 1 " tt1, 2, 3u, t2, 4, 5u, t2, 5uu, then Ů S 1 " t1, 2, 3u \ t2, 4, 5u \ t2, 5u " t1, 2, 3, 4, 5u, and Ű S 1 " t2u.

Abstract domains are often complete lattices:

Definition 3.5 (Complete lattice) A complete lattice is an algebraic structure xS, Ď , \, [, K, Jy with a partially ordered set S such that -all subsets have least upper and greatest lower bounds, -the least element K " Ů H " Ű S, and -the greatest element J " Ű H " Ů S.

The powerset of integers is a complete lattice with K " H and J " Z.

Definition 3.6 (Ascending and descending chains) -A chain is a totally ordered subset S 1 Ď S, i.e., @s 1 , s 2 P S 1 :

s 1 Ď s 2 _ s 1 Ě s 2 .
-A sequence ps n q nPN with s n P S is called

-an ascending chain iff m ď n ñ s m Ď s n , -a descending chain iff m ď n ñ s m Ě s n .
The height of a lattice is defined as the length of its longest chain. A lattice has finite height iff all of its chains have finite length, otherwise it has infinite height. The powerset of integers lattice, for example, has infinite height.

Functions over lattices and their fixed points. The following definitions are needed to state the theorems that allow us to solve fixed point equations over complete lattices.

Definition 3.7 (Monotonic and continuous functions) Let xX, Ď X y and xY, Ď Y y be partial orders and f : X Ñ Y a function, then f is -monotonic iff @x 1 , x 2 P X : x 1 Ď X x 2 ùñ f px 1 q Ď Y f px 2 q -semi-\-continuous iff f is monotonic and preserves the upper bounds of ascending chains:

-for each ascending chain C of X: Ů Y tf pXq | X P Cu " f p Ů X Cq, and -semi-[-continuous iff f is monotonic and preserves the lower bounds of descending chains:

-for each descending chain C of X:

Ű Y tf pXq | X P Cu " f p Ű X Cq
Definition 3.8 (Least and greatest fixed point) Let xS, Ďy be a partial order and f : S Ñ S a function: -The elements s 1 P S satisfying f ps 1 q Ď s 1 are called the post-fixed points of f . -The elements s 1 P S satisfying f ps 1 q Ě s 1 are called the pre-fixed points of f . -The elements s P S satisfying s " f psq are called the fixed points of f . s " lfppf q is the least fixed point of f iff @s 1 P S : f ps 1 q Ď s 1 ñ s Ď s 1 .

s " gfppf q is the greatest fixed point of f iff @s 1 P S : f ps 1 q Ě s 1 ñ s Ě s 1 .

The theorem of Knaster-Tarski [START_REF] Tarski | A lattice-theoretical fixpoint theorem and its applications[END_REF] characterizes the set of fixed points of f :

Theorem 3.1 (Knaster-Tarski) Let S be a complete lattice and f a monotonic function, then the set of fixed points forms a (non-empty) complete lattice:

-lfppf q " Ű tS | f pSq Ď Su -gfppf q " Ů tS | S Ď f pSqu
Finally, the theorem of Kleene [START_REF] Stephen | Introduction to Metamathematics[END_REF] suggests an iterative method for computing fixed points (Kleene iteration, see §3.4.1): Theorem 3.2 (Kleene) Let S be a complete lattice and f a semi-\-continuous (resp. semi-[-continuous) function f , then -lfppf q " Ů kPN ě0 f k pKq (ascending Kleene iteration) -gfppf q " Ű kPN ě0 f k pJq (descending Kleene iteration) We have the following relationships, which are illustrated in Fig. 3.2:

K Ď f k pKq Ď Ů k f k pKq Ď lfppf q gfppf q Ď Ű k f k pJq Ď f k pJq Ď J 21
3.2. Lattice Theory and the Principle of Abstract Interpretation

J f k pJq Ű k f k pJq gfppf q lfppf q Ů k f k pKq f k pKq K f psq Ď s f psq " s s Ď f psq

Principle of reachability analysis using abstract interpretation

In abstract interpretation, sets of concrete program states in S P C " ℘pΣq are abstracted by abstract values S 7 from an abstract domain A. Their relationship is formalized by the notion of a Galois connection (illustrated in Fig. 3.3):

Definition 3.9 (Galois connection) Let xC, Ďy and xA, Ď 7 y be partial orders, and α : C Ñ A and γ : A Ñ C functions, then

C ´Ñ Ð ´ά γ
A is a Galois connection iff @S P C, S 7 P A : αpSq Ď 7 S 7 ðñ S Ď γpS 7 q.

The functions γ and α are called concretization and abstraction function respectively. The goal of a reachability analysis is to compute reachpIq " post ˚pI q, which is equivalent to computing the least fixed point of the monotonic function F " λS.I Y postpSq. An abstract interpretation-based reachability analysis computes this fixed point in the abstract domain, i.e., it computes lfppF 7 q where F 7 " α ˝F ˝γ.

The following theorem [START_REF] Cousot | Abstract interpretation: A unified lattice model for static analysis of programs by construction or approximation of fixpoints[END_REF] states the soundness of an abstract interpretationbased analysis: Theorem 3.3 (Sound over-approximation) Let C ´Ñ Ð ´ά γ A be a Galois connection and F a monotonic function, then αplfppF qq Ď 7 lfppα ˝F ˝γq.

This means that the fixed point in the abstract domain is an over-approximation of the fixed point in the concrete domain.

Abstract Domains

Abstract domains are used to represent and manipulate sets of program states. Since we are generally dealing with infinite state systems a finite representation of infinite sets is needed. For numerical state spaces convex geometric shapes like rectangles, octagons or polyhedra are typical candidates for numerical abstract domains. However, such shapes are not capable of representing the exact sets of program states. Thus, the choice of an abstract domain induces a static approximation (i.e., prior to the analysis) and restricts the set of possible invariants we can compute by a reachability analysis.

Characterizing domains. Fig. 3.4 compares the precision of some classical numerical abstract domains. Abstract domains can be characterized by their ability to represent relations between variables: -An abstract value in non-relational domains like signs (x'0 with ' P tă,ď,",ě,ąu), parity (x is even or odd) and intervals (l ď x ď u) is the cartesian product of the values of the individual dimensions. -Weakly relational domains allow a restricted coupling between dimensions. For example, octagons are defined by sum and difference constraints between two variables. -Fully relational domains like convex polyhedra -actually "polytopes", i.e., a generalization of polygons to n dimensions -allow a coupling between all dimensions. The precision of the domains increases from non-relational to fully relational domains, but so does the computational complexity of the associated domain operations.

Defining domains. Besides a concretization function γ and an abstraction function α, an abstract domain must provide the following operations: -The test for inclusion Ď is used for checking convergence (i.e., having reached a fixed point F 7 pS 7 q Ď S 7 ) of the analysis. -The join (or union) operator \ is used to merge abstract values from several incoming arcs of a location in a CFG for example. -Transformation by a program statement (image, post-condition) f 7 : During the analysis abstract values are transformed by the operators (statements) f occurring in the program. Ideally, we have the f 7 " α ˝ f ˝γ (where f denotes the concrete semantics of f ), but sometimes this "best abstract transformer" can only be overapproximated. We denote f ´1 the inverse of a transformation (pre-image).

Program statements are essentially ' assignments, like x 1 " Ax `b, which performs a linear (to be precise: affine) 3.3. Abstract Domains transformation of the abstract value; and ' guards (e.g., the conditions of an if-then-else construct) like the linear guard Ax ď b, which the abstract value is intersected with. We will call this operator intersection by a guard [ g . -The test for emptiness " K is used for checking whether the intersection of the reachable states with a given error set is empty. -The projection (existential quantification of a variable Dx i ) is needed for handling input variables, for example.

A low computational complexity of the domain operations is crucial for an efficient implementation. A canonical representation of abstract values is desirable because it enables a cheap test for equality and lowers memory consumption by sharing values.

We will now describe three abstract domains, intervals ( §3.3.1), convex polyhedra ( §3.3.2) and template polyhedra ( §3.3.3) in detail and we give a short overview of other abstract domains ( §3.3.4). §3.3.5 explains how to combine abstract domains.

Intervals

The interval domain [START_REF] Cousot | Static determination of dynamic properties of programs[END_REF] (also called box domain) abstracts the values of the program variables by their lower and upper bounds:

IntpR n q " tKu Y `trl, us | l, u P R ^l ď uu ˘n
where R " R Y t´8, 8u. Moreover, we denote J "s ´8, 8r.

The domain is ordered by the inclusion of intervals:

X Ď Y ðñ $ & % tt if X " K ff if X ‰ K ^Y " K Ź iPr1...ns l Y i ď l X i ď u X i ď u Y i otherwise
The union of two abstract values is the component-wise union of the intervals:

X \ Y " $ & % X if Y " K Y if X " K Ś iPr1...ns rmintl X i , l Y i u, maxtu X i , u Y i us otherwise
Transformations by program statements are computed using interval arithmetic [START_REF] Moore | Interval Analysis[END_REF].

For example:

x 1 1 " 2x 1 `x2 `1 x 1 2 " ´x2 7 ˆr0, 2s r1, 3s ˙" ˆ2r0, 2s`r1, 3s`1 ´r1, 3s ˙" ˆr2, 8s r´3, ´1s ˙.
Existential quantification of a variable x i simply means setting the respective component to J: Dx i : X " prl 1 , u 1 s, . . . , rl i´1 , u i´1 s, J, rl i`1 , u i`1 s, . . . , rl n , u n sq T Interval analysis is very cheap: all the domain operations can be performed in linear time and space in the number of dimensions.

Convex Polyhedra

The convex polyhedra domain [START_REF] Cousot | Automatic discovery of linear restraints among variables of a program[END_REF][START_REF] Halbwachs | Détermination automatique de relations linéaires vérifiées par les variables d'un programme[END_REF] is a fully relational domain.

A convex polyhedron can be either represented by

Inclusion pV 1 , R 1 q Ď pA 2 x ď b 2 q ðñ @v P V 1 : A 2 v ď b 2 ^@r P R 1 : A 2 r ě 0
Canonicalization canpXq Chernikova's algorithm Abstraction αpXq Chernikova's algorithm Concretization γpX 7 q Chernikova's algorithm -the sets of generators pV, Rq, i.e., the convex closure of vertices and rays γpV, Rq " tx | Dλ ě 0, µ ě 0 :

(Linear guard) pA 1 x ď b 1 q [ pA 2 x ď b 2 q " can ˆˆA 1 A 2 ˙x ď ˆb1 b 2 ˙intersection Union pV 1 , R 1 q \ pV 2 , R 2 q " can ˆˆV 1 V 2 ˙, ˆR1 R 2 ˙Linear trans- x 1 " Cx `d 7 pV, Rq " ptCv `b | v P V u,
ÿ i λ i " 1 ^x " ÿ i v i λ i `ÿ j r j µ j u
with the vertices V " tv 1 , . . . , v p u, v i P R n and the rays R " tr 1 , . . . , r q u, r j P R n , -or by a conjunction of linear constraints Ax ď b, i.e., an intersection of halfspaces γpAx ď bq " tx | Ax ď bu with x P R n , A P R mˆn and b P R m . J and K denote the polyhedra R n and H respectively.

We can convert from one representation to the other one using the double description method [START_REF] Motzkin | The double description method[END_REF][START_REF] Fukuda | Double description method revisited[END_REF], also known as Chernikova's algorithm [START_REF] Chernikova | Algorithm for finding a general formula for the non-negative solutions of a system of linear inequalities[END_REF][START_REF] Le | A note on Chernikowa's algorithm[END_REF]. The conversion between constraint and generator representations has exponential worst case complexity in the number of dimensions n (see [START_REF] Fukuda | Double description method revisited[END_REF]). However, it also depends on the size of the polyhedra representation (number of generators or number of constraints), which is unbounded in general.

Domain operations.

The definitions of the domain operations (cf., e.g., [START_REF] Halbwachs | Verification of realtime systems using linear relation analysis[END_REF]) are summarized in Table 3.1.

Once a polyhedron is represented in both ways, some domain operations can be performed more efficiently using the generator representation only, others based on the constraint representation, and some making use of both. Hence any composition of domain operations requiring both representations has a worst-case exponential complexity.

Assuming that concrete sets X are given by constraints or points (vertices), Chernikova's algorithm transforms them into non-redundant (canonical) generator and constraint representations X 7 . In the case of generators this operation involves a convex approximation (convex hull) of the concrete set of points.

Mind that a linear guard, i.e., the conjunction of linear constraints, is a convex polyhedron. The intersection of two convex polyhedra is again a convex polyhedron: X 1 X X 2 " X 1 [ X 2 . In contrast, the union of two convex polyhedra is not convex in 3.3. Abstract Domains general. It is computed by the union of their generators which implies that the result is the convex hull of the original polyhedra:

X 1 Y X 2 Ď X 1 \ X 2 .
For the projection Dx i : X Fourier-Motzkin elimination is used, which is an algorithm for eliminating variables from a system of linear inequalities (constraint representation) and which has doubly exponential worst-case complexity (see, e.g., [START_REF] Williams | Fourier's method of linear programming and its dual[END_REF] for details).

Furthermore, we will use the following operations: -The Minkowski sum of two polyhedra X " X 1 `X2 is defined by

X " tx 1 `x2 | x 1 P X 1 , x 2 P X 2 u. -The time elapse operation [HPR97], defined as X 1 Õ X 2 " tx 1 `tx 2 | x 1 P X 1 , x 2 P
X 2 , t P R ě0 u, can be implemented using the generator representations:

pV 1 , R 1 q Õ pV 2 , R 2 q " pV 1 , R 1 Y V 2 Y R 2 q.
All these domain operations are implemented in polyhedra libraries like PPL [BHZ05] or NewPolka [START_REF] Jeannet | Partitionnement Dynamique dans l'Analyse de Relations Linéaires et Application à la Vérification de Programmes Synchrones[END_REF].

Discussion. As already mentioned convex polyhedra operations have a high computational complexity. However, they provide a good precision: Since they are closed by affine transformations, images by statements x 1 " Cx `d can be computed without approximations. In comparison to template polyhedra (see below), which have a fixed shape, the shape of convex polyhedra is dynamic and, thus, analyses with convex polyhedra can "discover" non-trivial shapes of invariants.

We will use convex polyhedra in the context of abstract acceleration (see § §4-6 and §8) and hybrid system analysis ( §12 and §13).

Template Polyhedra

Abstract interpretation with template polyhedra was introduced by Sankaranarayanan et al [START_REF] Sankaranarayanan | Scalable analysis of linear systems using mathematical programming[END_REF]. It is based on polyhedra the shape of which is fixed by a so-called (linear) template constraint matrix, or short template, T P R mˆn where each row contains at least one non-zero entry. The set of template polyhedra Pol T generated by T is

tX d | d P R m u with X d " tx | Tx ď d, x P R n u.
For example,

ˆ1

´1 ˙is a template constraint matrix of intervals for a system with a single variable x: it represents the constraints x ď d 1 ^´x ď d 2 , i.e., ´d2 ď x ď d 1 . Similarly, zonal (˘x i ď d, x i ´xj ď d) and octagonal (˘x i ď d, ˘xi ˘xj ď d) constraints can be expressed using templates. J and K are naturally represented by the bound vectors 8 and ´8 respectively. When analyzing a CFG, the templates may vary from location to location.

In the following, the operators min, sup, a.s.o. are point-wisely lifted to vectors. Domain operations. Table 3.2 summarizes the domain operations. They involve min and max operators over infinite sets. These optimization problems are solved using linear programming. We recall the most important notions of linear programming (LP): A linear programming problem is of the form (primal problem): max c T x subject to Ax ď b ^x ě 0. c T x is the objective function and Ax ď b ^x ě 0 is the feasible region, which is a convex polyhedron. The dual problem is min b T y subject to A T y ě c ^y ě 0. The strong duality theorem says that if x ˚is an optimal solution of the primal problem, then y ˚is an optimal solution of dual problem, such that c T x ˚" b T y ˚. If the primal problem is unbounded (i.e., the optimal solution is 8), then the dual problem is infeasible and vice

Inclusion c Ď T d ðñ Ź i c i ď d i Abstraction α T pXq " mintd P R m | γ T pdq Ě Xu, X Ď R n Concretization γ T pdq " tx | x P R n , Tx ď du, d P R m Union d \ T d 1 " `maxpd 1 , d 1 1 q, . . . , maxpd m , d 1 m q Linear guard d [ g T pAx ď bq " mintd 1 | Ax ď b ^Tx ď d ^Tx ď d 1 u intersection Linear trans- x 1 " Ax `b 7 pdq " mintd 1 | x 1 " Ax `b ^Tx ď d ^Tx 1 ď d 1 u formation Emptiness γpdq " H ðñ d " ´8 Projection Dx i : d " mintd 1 | Tx ď d ^Tx 1 ď d 1 ^@j ‰ i : x 1 j " x j u
Table 3.2: Template polyhedra domain operations.

versa. The classical algorithm for solving LP problems is the simplex algorithm [START_REF] Dantzig | Linear programming 1: Introduction[END_REF].

There are other methods, e.g., interior point methods [START_REF] Karmarkar | A new polynomial-time algorithm for linear programming[END_REF], which have polynomial complexity, but the simplex algorithm is despite its exponential worst-case complexity the most efficient and most-widely used in practice. Hence, the theoretical complexity of the operations of the template polyhedra domain is polynomial in the number of dimensions and the size of the template constraint matrix.

Besides, there are extensions [START_REF] Adjé | Coupling policy iteration with semi-definite relaxation to compute accurate numerical invariants in static analysis[END_REF][START_REF] Gawlitza | Computing relaxed abstract semantics w.r.t. quadratic zones precisely[END_REF] from linear to quadratic templates using semi-definite programming for resolving the optimization problems involved.

Discussion. Template polyhedra are computationally efficient and they possess a great flexibility in defining the shape of possible invariants. However the shape must be fixed prior to the analysis, when no information except the program code itself is available. Guard conditions might be good candidates, but in general the shape of an invariant cannot be guessed from the source code. The proposed methods are heuristic and include the use of general shapes like octagonal constraints, deriving additional constraints from a given template [START_REF] Sankaranarayanan | Scalable analysis of linear systems using mathematical programming[END_REF], performing a truncated polyhedral analysis to discover constraints or adding random constraints.

However, a large template size penalizes the efficiency of the domain operations. Thus, finding templates consisting of a small number of relevant constraints is still an open problem.

We will use template polyhedra in the context of max-strategy iteration (see §3.4.3 and §9).

Other Domains

We pick some other domains to show the large variety of abstract domains:

There are weakly relational domains with low polynomial complexity, like zones [HNSY92, Min01a] (defined by constraints ˘xi ď d, x i ´xj ď d), octagons [START_REF] Miné | The octagon abstract domain[END_REF] (˘x i ď d, ˘xi ˘xj ď d) and their generalization logahedra [HK09], i.e., to two-variable constraints with coefficients that are powers of two up to some bound parameter.

Among the fully relational domains count zonotopes [Gir05, GP06], which are bounded, central-symmetric polyhedra defined by x " c`ř i g i λ i , λ i P r´1, 1s, i.e., the Minkowski 3.3. Abstract Domains sum of a central point and a finite set of line segments; and ellipsoids [KV00] (x T Ax ď b). These domains are both closed under linear transformations.

Tropical polyhedra [START_REF] Xavier Allamigeon | The tropical double description method[END_REF] are based on max-plus algebra and they are able to represent some non-convex shapes. Donut domains [GIB `12] are shapes computed by the difference between two convex sets.

The linear congruence domain [START_REF] Granger | Static analysis of linear congruence equalities among variables of a program[END_REF] ( Ź i a T i x " c i mod m i ) is used for proving divisibility properties, e.g., in algorithms involving gcd and lcm. Varieties [START_REF] Sriram Sankaranarayanan | Non-linear loop invariant generation using Gröbner bases[END_REF] are algebraic sets defined by the common zeros of a set of polynomials p j , i.e., tx P C n | Ź j p j pxq " 0u. This domain has been used for analyzing hardware division algorithms for instance.

Composite Abstract Domains

Composite abstract domains [CC79] enable, for example, to analyze different types of variables using suitable abstract domains. In a logico-numerical program with state space B n ˆRm , for instance, sets of Boolean states ℘pB n q can be presented (exactly) by Boolean formulas, while sets of numerical states ℘pR m q are abstracted by convex polyhedra Pol pR m q.

Another reason to combine domains is to improve the precision. For example, analyzing a numerical program with state space R n using a single analysis combining convex polyhedra Pol pR n q and linear congruences LinCongr pR n q yields more precise results than analyzing the program first with convex polyhedra and then with linear congruences or the other way around [START_REF] Cousot | Systematic design of program analysis frameworks[END_REF].

We consider the following two ways to construct composite abstract domains: -A product domain A ˆB is able to represent a conjunctive relation between the two subdomains A and B. For example in the logico-numerical setting above, we have the abstraction: ℘pB n ˆRm q ´Ñ Ð ´γ α ℘pB n q ˆPol pR m q: in this domain b ^x ě 0 can be presented exactly whereas b ô x ě 0 is abstracted to J ˆJ. -A power domain B A " A Ñ B can represent one abstract value of B for each value of the set A. For example for the logico-numerical state space above, we have the abstraction ℘pB n ˆRm q ´Ñ Ð ´γ α B n Ñ Pol pR m q: this domain can exactly represent b ô x ě 0, whereas b ^x ě 10 _ b ^x ď 0 is abstracted to b Ñ J.

Domain operations and reduction. Since the subdomains in a composite domain are not semantically independent, a naive combination of the domain operations would lead to non-canonical representations of abstract values. Hence, a canonicalization operation is needed in order to reduce the result of operations: For example, given two abstract domains A and B combined into a product domain with the abstraction and concretization functions α A , α B and γ A , γ B respectively, we have the canonicalization canpa 1 , b 1 q " Ű tpa 2 , b 2 q | γ A pa 1 q ^γB pb 1 q " γ A pa 2 q ^γB pb 2 qu. A consequence of the canonicalization is, for example, that in the combined domain an abstract value pa, bq equals K if a " K A or b " K B .

We give the resulting operations of the (reduced) product domain:

xA, Ď A , K A , J A , [ A , \ A y ˆxB, Ď B , K B , J B , [ B , \ B y " xA ˆB, Ď, K, pJ A , J B q, [, \y with $ & % Ď " λpa 1 , b 1 q, pa 2 , b 2 q.pa 1 Ď A a 2 q ^pb 1 Ď B b 2 q [ " λpa 1 , b 1 q, pa 2 , b 2 q.canpa 1 [ A a 2 , b 1 [ B b 2 q \ " λpa 1 , b 1 q, pa 2 , b 2 q.pa 1 \ A a 2 , b 1 \ B b 2 q
The abstraction and concretization functions are defined as αpSq " canpα A pSq, α B pSqq and γpa, bq " γ A paq ^γB pbq respectively. A transformation f is then abstracted to f 7 " α ˝ f ˝γ in the combined abstract domain.

Similarly, one can define the domain operations for the (reduced) power domain (see [START_REF] Cousot | Systematic design of program analysis frameworks[END_REF] for details). We will return to logico-numerical domains constructed by product and power domain combinations in §7.

Besides, disjunctive combinations of elements of the same domain have been considered too, e.g., in [CC79, GR98, BHZ04, SISG06]. This helps for example to overcome the convexity limitations of most numerical domains, but it entails an exponentially higher complexity and difficulties in canonicalizing representations.

Fixed Point Computation

The classical method for fixed point computation is Kleene iteration ( §3.4.1). However, in general this iteration does not terminate. Therefore an extrapolation operator called widening is used in order to speed up convergence for the price of additional approximations. Numerous improvements for widening ( §3.4.2) have been developed to reduce the involved loss of precision.

Strategy improvement (or strategy iteration) methods ( §3.4.3) enable the computation of the fixed point without the use of widening for certain abstract domains with infinite height, e.g., template polyhedra.

Kleene Iteration with Widening

We denote F 7 " λS 7 .S 70 \ post 7 pS 7 q with S 70 " αpIq and post 7 " α ˝post ˝γ. In order to avoid clutter, we will not put the 7 superscript in the following when it is clear from the context that we are manipulating abstract values. Moreover, we will use the term "Kleene iteration" to refer to the ascending Kleene iteration (see Thm. 3.2).

Widening. Kleene iteration computes the least fixed point lfppF q by Ů kPN ě0 pF q k pKq. However, it may require an infinite number of iterations when the abstract domain has infinite ascending chains or a large number of iterations for lengthy finite ascending chains.

For this reason, abstract interpretation introduces a widening operator that guarantees convergence: Definition 3.10 (Widening operator ∇) ∇ : S ˆS Ñ S is a widening operator iff

• @s 1 , s 2 P S : s 1 Ď s 1 ∇s 2 ^s2 Ď s 1 ∇s 2 • for any ascending chain s 0 Ď s 1 Ď . . ., the chain ps 1 i q with s 1 0 " s 0 , s 1 i`1 " s 1 i ∇s i`1 eventually stabilizes, i.e., Dn P N : @n 1 ą n :

s 1 n 1 " s 1 n
The standard widening operators of numerical abstract domains suppose that the program has a certain regularity, and thus, a constraint that changes in successive iterations will continue to be shifted in the same direction. Hence, it is extrapolated to infinity (resp. minus infinity). For instance the standard widening operator for intervals is defined as follows (component-wise):

$ & % K∇X " X∇K " X rl 1 , u 1 s∇rl 2 , u 2 s " " if l 2 ă l 1 then ´8 else l 1 , if u 2 ą u 1 then 8 else u 1  29 3.4. Fixed Point Computation F 7 pSq Ď S F 7 pSq Ě S F 7 pSq " S J gfppF 7 q lfppF 7 q K S 0 S 1 S 1 0 " S 2 S 1 N 1 S 2 0 S 2 1 S 2 2 Figure 3
.5: Kleene iteration with delayed widening (N " 2) and two descending iterations

For convex polyhedra X 1 ∇X 2 consists, roughly speaking, of those constraints of X 1 that are satisfied by X 2 (see [START_REF] Halbwachs | Détermination automatique de relations linéaires vérifiées par les variables d'un programme[END_REF][START_REF] Halbwachs | Verification of realtime systems using linear relation analysis[END_REF] for a detailed presentation).

Widening for template polyhedra [START_REF] Sankaranarayanan | Scalable analysis of linear systems using mathematical programming[END_REF] works similarly to intervals.

Fixed point computation. The classical analysis procedure [CC77, CC92b] consists of three phases:

(1) an ascending sequence pS n q 0ďnďN of post-condition computations:

" S 0 " S 0 S n`1 " F pS n q for n ă N
(2) a (delayed) widening sequence pS 1 n q 0ďnďN 1 that is guaranteed to converge to a postfixed point S 1 N 1 in a finite number of steps:

" S 1 0 " S N S 1 n`1 " S 1 n ∇pF pS 1 n qq until convergence pS 1 N 1 Ď S 1 N 1 `1q
(3) a (truncated) descending sequence pS 2 n q 0ďnďN 2 of post-condition computations for approaching the fixed point:

" S 2 0 " S 1 N 1 S 2 n`1 " F pS 2 n q for n ă N 2
This procedure is illustrated in Fig. 3.5.

Descending iterations generally do not converge: Cousot and Cousot [START_REF] Cousot | Abstract interpretation: A unified lattice model for static analysis of programs by construction or approximation of fixpoints[END_REF] propose the use of a narrowing operator in order to force the convergence to a fixed point. In practice, the descending sequence is usually truncated, which is sound because the result of the widening sequence satisfies F pS 1 N 1 q Ď S 1 N 1 , and hence, by Thm. 3.2 all elements of the descending sequence are upper bounds of the least fixed point.

Example 3.1 (Kleene Iteration with widening) We analyze the following program " I " px " 0q x 1 " if x ď 9 then x`1 else 0 in the interval domain with N " 2 and N 2 " 1:

S 0 " r0, 0s S 1 " r0, 0s \ r1, 1s " r0, 1s S 2 " r0, 0s \ r1, 2s " r0, 2s " S 1 0 S 1 1 " r0, 2s∇r0, 3s " r0, 8s " S 1 2 " S 2 0 S 2 1 " r0, 10s
Iteration strategies

When analyzing a CFG one assigns to each location ℓ P L an abstract value from an abstract domain A. Thus the overall abstract domain has the structure of the power domain pL Ñ Aq. Therefore, one has to solve the fixed point equation

S " S 0 \ λℓ 1 . ğ ℓ 1 PL post ℓ,ℓ 1 pSpℓqq
where S, S 0 P pL Ñ Aq.

A naive way to perform Kleene iteration is to apply all the post ℓ,ℓ 1 operators in parallel as suggested by the above equation. However, Kleene iteration actually propagates the abstract values through the graph in a wave-like fashion while transforming them by the post ℓ,ℓ 1 operators associated to the arcs (transitions) of the graph. Thus, the computation should be serialized.

It can be shown [START_REF] Cousot | Asynchronous iteration methods for solving a fixed point system of monotone equations in a complete lattice[END_REF][START_REF] Cousot | Abstract interpretation: A unified lattice model for static analysis of programs by construction or approximation of fixpoints[END_REF] that any order, i.e., iteration strategy, which does not forget any transition indefinitely, computes the least fixed point ("chaotic iteration").

Bourdoncle [START_REF] Bourdoncle | Efficient chaotic iteration strategies with widenings[END_REF] proposes heuristics to derive efficient iteration strategies from the graph structure. He first computes a weak topological ordering by depth-first exploration of the CFG. The ordering can be written as a well-parenthesized permutation of the locations L, such that the locations within two matching parentheses correspond to the strongly connected components of the graph. For example, the ordering obtained for the CFG in Fig. 3.6a is pℓ 1 pℓ 2 qq ℓ 3 .

He proposes two strategies: the iterative strategy (pℓ 1 ℓ 2 q ˚ℓ3 for Fig. 3.6a) stabilizes the outer strongly connected components, whereas the recursive strategy (pℓ 1 pℓ 2 q ˚q˚ℓ 3 ) recursively stabilizes components from the innermost to the outermost ones such that the inner components are re-stabilized in each iteration of an outer component.

Moreover, it suffices to apply widening only in the loop heads, i.e., the first location of a strategy component. Also, convergence can be detected by the stabilization of the loop heads. For Fig. 3.6a the widening points (marked with W ) are pℓ 1 W pℓ 2 W qq ℓ 3 .

Backward analysis

Co-reachability analysis of a CFG is performed by transposing the graph and inverting the transition relations associated to the arcs, i.e., the arcs are labeled by post ´1. The Kleene iteration is started from the error set E, and the set to be avoided is the set of initial states I. Hence, a backward analysis is just a forward analysis on the reverse CFG. Everything stated in this section applies analogously to backward analyses.

ℓ 1 ℓ 2 ℓ 3 Σ 0 " I " pℓ 1 Ñ px 1 " x 2 " 0q, tℓ 2 , ℓ 3 u Ñ Kq (a)
x 1 ě 10

x 1 ď 9 x1

2 " 0

x 2 ě 10 x1 1 " x 1 `1 x 2 ď 9 x1 2 " x 2 `1 ℓ 1 ℓ 2 ℓ 3 Σ 0 " E " λℓ.px 1 ě 11 ^x2 ě 11q (b)
x 1 ě 10

x 1 ď 9 ^x2 " 0 ^x1 2 P Z

x 2 ě 10 x1

1 " x 1 ´1

x 2 ď 10 x1

2 " x 2 ´1 x 1 " 0

x ď 99 ^x1 " x`1

x ě 100 ^x1 " 0

x 1 " x Starting from the set of error states E " px 1 ě 11 ^x2 ě 11q, the backward analysis converges with the invariant tℓ 1 , ℓ 3 u Ñ px 1 ě 11 ^x2 ě 11q, ℓ 2 Ñ px 1 ě 10 ^x2 ě 11q, which does not intersect with I " px 1 " x 2 " 0q. Mind that if post is not injective, post ´1 is a relation.

Improvements of Widening

Although Cousot and Cousot [START_REF] Cousot | Comparing the Galois connection and widening/narrowing approaches to abstract interpretation[END_REF] show that the approach using Kleene iteration with widening and infinite height lattices can discover invariants that finite height lattices cannot discover, the dynamic approximations induced by widening lead quite often to an important loss of precision. There are several reasons for these problems:

-The standard widening operators are not monotonic, e.g., r0, 2s∇r0, 4s " r0, 8s, but r1, 2s∇r0, 3s " J (although r1, 2s Ď r0, 2s and r0, 3s Ď r0, 4s). -Descending iterations fail to recover information if the result of the widening sequence S 1 N 1 is already a fixed point, i.e., postpS 1 N 1 q " S 1 N 1 .

Example 3.3 (Descending sequence fails) The program in Fig. 3.7 (cf. [START_REF] Monniaux | Automatic modular abstractions for linear constraints[END_REF]) exhibits the latter problem: After widening we obtain S 1 1 " r0, 8s " S 2 0 , but then S 2 1 " r0, 100s \ r0, 0s \ r0, 8s " r0, 8s " S 2 0 . The descending sequence fails to improve the result, because the transition x 1 " x keeps "injecting" the value S 2 0 " r0, 8s in the join of the three incoming transitions.

Moreover, the delay N of widening has an important effect on precision, as shows Ex. 3.4. However, delaying widening might be expensive, especially with convex polyhedra where coefficients quickly become huge. Mind that delaying widening is not equivalent to loop unrolling, because the convex union is taken after each iteration, whereas loop unrolling creates separate locations.

´1

x 1

x 2 Figure 3.9: Taking into account loop phases (Ex. 3.5): Reachable sets computed by Kleene iteration (whole shaded area) with widening (N " 1) and descending iterations (N 2 " 1), and by guided static analysis (dark gray).

Example 3.4 (Delayed widening) For the following program we get increasingly better approximations with increasing delay N (depicted in Fig. 3.8 for N " 1, 2, 3):

$ & % Ipx 1 , x 2 q " p0, 0q x 1 1 " if x 2 ě 0 then x 1 `x2 `1 else 0 x 1 2 " if x 2 ě 0 then x 2 `1 else 0
Taking into account loop phases. Standard widening performs an extrapolation based on the hypothesis that the program behavior is somehow regular. However, this is not the case if a loop body consists of several paths (loop phases, see e.g., CFG in Fig. 2.1). Distinguishing these loop phases can be exploited to obtain a better precision [START_REF] Halbwachs | Delay analysis in synchronous programs[END_REF].

Guided static analysis [START_REF] Gopan | Guided static analysis[END_REF] follows this idea by alternating ascending and descending sequences on a strictly increasing, finite sequence of restrictions of the program (by adding new transitions) which converges towards the original program. In many cases this method improves the precision, but it ultimately relies on the effectiveness of the descending iterations.

Example 3.5 (Loop phases) The overall reachable states for the CFG in Fig. 2.1 ( §2.1.2) obtained by a classical Kleene iteration with widening respectively guided static analysis are depicted in Fig. 3.9.

Widening with thresholds.

The idea of widening with thresholds (or "widening up to") is to limit widening by a given set of constraints [Hal93a, CCF `09]. To achieve this, the widening operator is parametrized with a set of threshold constraints T :

S n ∇ T pS n \postpS n qq " pS n ∇pS n \postpS n qqq[ ę tT P T | S n Ď T ^pS n \postpS n qq Ď T u
Hence, widening with thresholds is computed by applying the standard widening operator and then intersecting with those constraints in T that are satisfied by both arguments of the widening operator. 33

Fixed Point Computation

Example 3.6 (Widening with thresholds) An analysis of the CFG in Fig. 3.6a (cf. [START_REF] Lakhdar-Chaouch | Widening with thresholds for programs with complex control graphs[END_REF]) with Kleene iteration and widening (N " 2, N 2 " 2) yields the overall invariant x 1 ě 0 ^0 ď x 2 ď 10. Using widening with the threshold sets in locations ℓ 1 , ℓ 2 respectively T 1 " tx 1 ď 10, x 2 " 10u and T 2 " tx 1 ď 9, x 2 ď 10u yields the desired invariant 0 ď x 1 ď 10 ^0 ď x 2 ď 10.

The problem is, though, how to find a set of relevant threshold constraints. A static threshold inference method based on propagating the post-condition of a loop guard to the widening points of the CFG is proposed in [START_REF] Lakhdar-Chaouch | Widening with thresholds for programs with complex control graphs[END_REF]. Dynamic threshold inference methods are for example counterexample-refined widening [START_REF] Wang | Using counterexamples for improving the precision of reachability computation with polyhedra[END_REF], which is based on an (under-approximating) backward analysis, and widening with landmarks [START_REF] Simon | Widening polyhedra with landmarks[END_REF], which extrapolates threshold constraints by estimating the number of loop iterations until the guard of the loop is violated.

Loop acceleration methods. These techniques take into account information about the dynamics of the loop body in order to compute the precise effect of an unbounded number of loop iterations (e.g., [START_REF] Gonnord | Combining widening and acceleration in linear relation analysis[END_REF]). Since these methods have shown promising results, we will use them in this thesis for improving the precision. We will discuss them in detail in §5.

Strategy Iteration

Strategy (or policy) iteration methods [CGG `05, GGTZ07, AGG10a, GS07a, GS07b, GSA `12] are a way to solve fixed point equations over infinite height lattices without the need for a widening operator.

Originally, strategy iteration was developed for solving stochastic control problems. Later it was applied to two-player zero-sum games and min-max-plus systems, and more recently to solving abstract semantic equations in static analysis. More information on the historical background can be found, e.g., in [CGG `05].

The main idea of strategy iteration is to iteratively approximate the least fixed point of the abstract semantic equation S 7 " F 7 pS 7 q by fixed points of "simpler", more efficiently computable semantic equations F 7piq , called strategies, such that a fixed point of F 7 is guaranteed to be found after solving a finite number of equations S 7 " F 7piq pS 7 q. Depending on whether the least fixed point of F 7 is approached from above or below, the methods are called min-or max-strategy iteration respectively.

Current strategy iteration methods are limited to template domains ( §3.3.3).

Min-strategy iteration

Min-strategy iteration [CGG `05, GGTZ07, AGG10a] aims at computing least fixed points of monotone self-maps F where F pxq " mintπpxq | π P Πu for all x. The set of self-maps Π is called the min-strategies. For example, F could be the min of max of affine functions. Then a min-strategy π is the choice of an argument of the min operator.

The idea is that the least fixed point of a strategy lfp π can be computed more efficiently than lfp F , e.g., with the help of an LP solver. Starting with π p0q , the decreasing sequence of abstract values plfp π pkq q k stabilizes if lfp π pkq is a fixed point of F .

The improvement of a strategy π pkq amounts to finding a π pk`1q such that π pk`1q px pkq q " F px pkq q: Let x pkq " lfp π pkq , then we have F px pkq q Ă x pkq because otherwise x pkq would be a fixed point of F and we are done. This means that there is at least one component x pkq i of x pkq for which F px pkq q i ă x pkq i . Thus, we have to choose an argument π pk`1q of the min operator in F such that π pk`1q px pkq q i " F px pkq q i . Furthermore, this ensures that the new strategy actually improves the fixed point: lfp π pk`1q Ă lfp π pkq .

However, min-strategy iteration does not necessarily find the least fixed point of f : in order to guarantee that the procedure terminates with the least fixed point, f must be non-expansive, i.e., @x 1 , x 2 : }f px 1 q´f px 2 q} 8 ď }x 1 ´x2 } 8 . Moreover, the choice of the initial min-strategy is important, because otherwise the procedure may fail to find the least fixed point as well.

An advantage of min-strategy iteration is that the computation can be stopped before convergence and the obtained result will be a sound over-approximation.

Max-strategy iteration

Max-strategy iteration [GS07a, GS07b, GS08, GS10, GS11] is a method for computing the least solution of a system of equations M of the form δ " F pδq, where δ are the template bounds, and F i , 0 ď i ď n is a finite maximum of monotonic and concave operators R n Ñ R, e.g., affine functions.

The system of equations M is constructed from the abstract semantics of the CFG transitions in the template domain:

for each ℓ1 P L : δ ℓ 1 " max ´td 0 ℓ 1 u Y t R 7 pδ ℓ q | pℓ, R, ℓ 1 q P Ru where d 0 ℓ 1 are the initial bounds in location ℓ 1 . A max-strategy µ induces a subsystem of M by selecting an argument of the max-operator for each template bound variable

δ i P δ in each location ℓ 1 .
The least solution of the system of equations lfp M is computed with the help of the max-strategy improvement algorithm: Starting from the strategy µ p0q that yields the abstract value K, an increasing sequence of abstract values d pkq " lfp µ pkq is computed by improving the strategies until no more improvement is possible. The least fixed point of the current strategy µ pkq is computed with the help of mathematical programming.

The max-strategy improvement algorithm is guaranteed to compute the least fixed point. A more detailed presentation of max-strategy iteration will be given in §9.

Tools and Libraries

Until now, the commercial success of abstract interpretation manifests itself in proving the absence of runtime errors in C programs, which represent the majority of industrial embedded code. We list some commercial and academic tools that particularly target this kind of applications: -PolySpace Verifier 1 targets the languages C, C++ and Ada.

-Astrée2 (in French: Analyseur Statique de logiciels Temps-R Éel Embarqués) [BCC `02, BCC `03, CCF `05, CCF `09] is at its origin an academic development that is now Regarding other applications, there is a large number of academic tools and prototypes that implement a variety of methods. However, these tools often have proprietary input formats and abstract domain implementations. We list here some academic developments that had a significant impact in the last decade: -Libraries:

' The abstract domain library Apron 6 [JM09] aims at providing a common application programming interface for abstract domains: it includes a variety of domains like intervals, octagons, convex polyhedra, linear congruences, and the reduced product of convex polyhedra and linear congruences. Apron relies on the polyhedra library PPL 7 (Parma Polyhedra Library) for some if its domains. ' BddApron [Jea] is an extension of Apron that adds the direct product and power domains of Boolean formulas and any Apron domain. -Tools:

' Tvla 8 (Three-Valued Logic Analysis engine) is a static analysis framework for shape analysis, i.e., properties about memory usage. ' Fluctuat 9 [GMP02, GP06] is a static analyzer for evaluating the effect of rounding errors introduced by floating point operations, which is being adopted in industry to verify avionics software [DGP `09]. ' NBac 10 [JHR99, Jea00, Jea03] is an analyzer for Lustre programs based on logiconumerical abstract domains and partition refinement techniques. ' ConcurInterproc 11 is an abstract interpreter for computing invariants for a simple imperative, multi-threaded language. It is based on the BddApron library.

Acceleration and Abstract Acceleration

This chapter gives an overview of acceleration and abstract acceleration techniques.

Acceleration methods aim at computing the exact set of reachable states in numerical transition systems. They are motivated by the analysis of communication protocols often modeled using counter machines or Petri nets. First achievements date back to the 1990s [BW94, BG97, FO97, CJ98, Boi98]. Unlike abstract interpretation, which overcomes the undecidability issue by computing a conservative approximation, acceleration identifies classes of systems for which the reachability problem is decidable and can be solved exactly, e.g., programs of a certain structure with certain affine tests and assignments.

The idea of acceleration is to accelerate cycles labeled by a transition relation τ in the control structure of a program by computing the exact effect of its reflexive and transitive closure τ ˚" Ť kě0 τ k on a set of states X. Applied to the program of Fig. 4.1(a), we obtain the program of Fig. 4.1(b). If the program does not contain nested loops and all loops can be accelerated, then the method is complete. Otherwise, there are techniques for accelerating selected cycles in the hope to converge, but there is no guarantee to terminate in general.

Gonnord et al. [START_REF] Gonnord | Combining widening and acceleration in linear relation analysis[END_REF][START_REF] Gonnord | Accélération abstraite pour l'amélioration de la précision en Analyse des Relations Linéaires[END_REF] have proposed the concept of abstract acceleration that integrates the acceleration idea into the abstract interpretation framework with convex polyhedra: wherever possible, simple loops are accelerated in the abstract domain, and in any other cases (multiple self-loops, nested loops, too expressive transi- tions) one resorts to the use of widening to guarantee the convergence of the fixed point computation at the cost of over-approximations.

(a) X 0 l 0 l 1 x 3 ď 20 x 3 " x 3 `1 τ : 2x 1 `2x 2 ď x 3 Ñ ˇˇˇˇˇx 1 1 " x 1 `1 x 1 2 " 1 x 1 3 " x 3 (b) X 0 l 0 l 1 1 l 1 (c) X 0 " " px 1 , x 2 , x 3 q ˇˇˇ0 ď x 1 ^1 ď x 2 x 1 `x2 ď 2 ^x3 " 3 * x 3 ď 20 τ x3 " x 3 `1
After recalling in §4.1 some concepts of linear algebra used in the following chapters, we present classical exact acceleration in §4.2 and abstract acceleration in §4.3.

Introduction to Linear Algebra

In this section we recall some basic concepts of linear algebra. For further details we refer to textbooks on matrix theory and linear algebra, e.g., [START_REF] Lancaster | The Theory of Matrices[END_REF].

A matrix A P R nˆm has n rows and m columns. The element in the i th row and j th column is denoted A i,j . The i th row vector and the j th column vector are denoted respectively A i,¨a nd A ¨,j . Square matrices. A square matrix A P R nˆn , i.e., of dimension dimpAq " n, is called -a diagonal matrix A " diagpa 1 , . . . , a n q iff A i,i " a i and all other entries are zero; -the unit (or identity) matrix, denoted I, iff A " diagp1, . . . , 1q; -the zero matrix 0 iff all entries equal zero.

-idempotent iff A 2 " A; -nilpotent iff Dp ą 0 : A p " 0.
-invertible iff DB : AB " BA " I; B " A ´1 is called the inverse matrix; non-invertible matrices are called singular.

The determinant of A is defined by detpAq " ř j p´1q tpjq A 1,j 1 ¨. . . ¨An,jn where tpjq is the number of inversions in the permutation of indices pj 1 , . . . , j n q and the sum runs over all n! permutations pj 1 , . . . , j n q. The determinant of a 2-dimensional matrix is for example

A 1,1 A 2,2 ´A1,2 A 2,1 .
Vectors a 1 , . . . , a n are linearly independent iff ř n i"1 c i a i " 0 ùñ @1 ď i ď n : c i " 0. rankpAq denotes the number of linearly independent column vectors, which is equal to the number of linearly independent row vectors.

Linear spaces. xV, `, Fy is a linear space over a field F iff xV, `y is a commutative group and there is for each α P F and for each v P V an associative and distributive scalar multiplication α ¨v P V. We will consider linear spaces xR n , `, Ry or xC n , `, Cy.

A linear subspace is a subset S Ď V closed under the operations (vector addition `and scalar multiplication ¨). The kernel (or null space) kerpAq of a matrix is the linear space defined by tx | Ax " 0u. The image (or range) impAq is the linear space

tx 1 | x 1 " Axu.
The linear hull denoted spanta 1 , . . . , a n u is the linear space generated by linear combinations of the vectors a 1 , . . . , a n , i.e., ta | a " ř n i"1 c i a i u. A minimal number of vectors a 1 , . . . , a n spanning a linear space are called a basis of the linear space. The number n of the basis vectors equals the dimension of the space.

Two bases a 1 , . . . , a n and b 1 , . . . , b n are related by an invertible transition matrix P such that @i : b i " Pa i . Thus any vector x w.r.t. the first basis can be transformed into a vector Px w.r.t. the second basis. This transformation is called the change of basis.

A linear space L can be decomposed into a direct sum of subspaces 9

Ř i L i iff Ş i L i " 0, i.e.
, iff the union of basis vectors of the L i forms a basis of the sum space L.

Introduction to Linear Algebra

Linear transformations. A linear transformation is a homomorphism between n and m-dimensional linear spaces L 1 and L 2 .

We will only deal with endomorphisms, i.e., a linear transformation from an ndimensional linear space to itself. Such a transformation can be represented by a square matrix A with dimension n. A is not invariant w.r.t. the basis of the linear space. The basis of the transformation matrix can be changed by the transition matrix Q: A 1 " Q ´1AQ. The set of all representations A w.r.t. all bases is an equivalence class of similar matrices.

L 1 is an invariant subspace of A if it satisfies @x P L 1 : Ax P L 1 . If a linear space L can be decomposed into a direct sum of invariant subspaces L i w.r.t. A, then A has a representation in block diagonal form ¨A1 . . . 0 . . . . . . . . . 0 . . . A k ' s.t. a block A i corresponds to L i .
Eigenvalues. The set eigpAq " tλ | Dx ‰ 0 : Ax " λxu is the spectrum of A P R nˆn (or C nˆn ). The values λ P C and the vectors x P C n are called respectively the eigenvalues and eigenvectors of A. An n-dimensional matrix has at most n distinct eigenvalues. Eigenvectors corresponding to distinct eigenvalues are linearly independent.

The eigenspace associated with an eigenvalue is the linear hull of the eigenvectors. Similar matrices have the same spectrum. If λ is an eigenvalue of A then λ p is an eigenvalue of A p . A matrix is singular iff it has a zero eigenvalue.

An alternative characterization of the eigenvalues is pA ´λIqx " 0 with x ‰ 0. Hence, the eigenvalues can also be seen as the zeros in C of the characterstic polynomial (in λ) detpA ´λIq. The algebraic multiplicity of an eigenvalue is its multiplicity as a root of the characteristic polynomial. The geometric multiplicity of an eigenvalue is the dimension of its associated eigenspace: dimpkerpA ´λIqq. The geometric multiplicity is always less than or equal to the algebraic multiplicity.

If A has n distinct eigenvalues then the eigenvectors form a basis (eigenbasis): we can change the basis of A with a transition matrix Q P C nˆn of which the column vectors are the eigenvectors: Q ´1AQ " diagpλ 1 , . . . , λ n q, i.e., A is then called diagonizable.

Jordan canonical form. The Jordan canonical form J P C nˆn is the unique decomposition of a linear transformation A P R nˆn (or C nˆn ) into a direct sum of k linear transformations, i.e., J is a block diagonal matrix consisting of k blocks. Each block is associated with an eigenvalue λ i and has the form

¨λi 1 0 . . . 0 . . . . . . 0 . . . . . . λ i 1 0 . . . 0 λ i ‹ ‹ ‹ '
. The number of Jordan blocks associated with the same eigenvalue equals its geometric multiplicity; the sum of the sizes of these blocks is its algebraic multiplicity.

The generalized eigenspace associated to an eigenvalue with algebraic multiplicity m is kerppA ´λIq m q. There are m generalized eigenvectors forming a basis of the generalized eigenspace. The matrix where the column vectors are the generalized eigenvectors of A is a transition matrix Q P C nˆn such that J " Q ´1AQ.

For real matrices, complex eigenvalues are always conjugate, that is of the form ρe ˘iθ with ρ, θ P R. In this case there is a real Jordan form in which conjugate complex eigenvalues are associated with a block of the form

¨A I 0 . . . . . . I 0 . . . A ‹ ' with A " ˆρ cos θ ´ρ sin θ ρ sin θ ρ cos θ ˙.

Acceleration

Acceleration methods consider the program model of counter systems, but they have also been shown to be applicable to pushdown systems and systems of FIFO channels for instance (cf. [START_REF] Bardin | Flat acceleration in symbolic model checking[END_REF]). The acceleration of counter systems is based on Presburger arithmetic.

Presburger arithmetic.

Presburger arithmetic [START_REF] Presburger | Über die Vollständigkeit eines gewissen Systems der Arithmetik ganzer Zahlen, in welchem die Addition als einzige Operation hervortritt[END_REF] is the first-order additive theory over integers xZ, ď, `y. Satisfiability and validity are decidable in this theory. A set is Presburger-definable if it can be described by a Presburger formula. For example, the set of odd natural numbers x can be defined by the Presburger formula Dk ě 0 :

x " 1 `2k, whereas for example the formula Dk : y " k ¨k characterizing the quadratic numbers y is not Presburger because of the multiplication of variables.

Counter systems.

Counter systems are a subclass of discrete transition systems (cf. Def. 2.3): Definition 4.1 (Counter system) A counter system xΣ, L, , Σ 0 y is defined by -the state space Σ " Z n , -a set of locations L, -a set of transitions : L ˆΣ2 ˆL, where transitions are labeled with a relation Rpx, x 1 q Ď Σ 2 defined by a Presburger formula, and -Σ 0 : L Ñ Σ defines for each location the set of initial states using a Presburger formula.

Counter systems generalize Minsky machines [START_REF] Minsky | Computation: Finite and Infinite Machines[END_REF], thus the reachability problem is undecidable. In general, the reachable set reach of a counter system is not Presburgerdefinable [START_REF] Kelly | Transitive closure of infinite graphs and its applications[END_REF] because of the following two reasons:

(1) In the case where the system consists of a single self-loop and its transition relation R is Presburger-definable, then the reflexive and transitive closure R ˚is not Presburger-definable in general.

(2) In the case of a system with nested loops where the reflexive and transitive closures R ˚of all circuits in the system are Presburger-definable, reach of the whole system is not Presburger-definable in general, because there are infinitely many possible sequences of these circuits.

Issue (1) is addressed by identifying a class of accelerable relations R, i.e., for which the transitive closure R ˚is Presburger-definable: Definition 4.2 (Presburger-linear relations with finite monoid) The transition relation Rpx, x 1 q " pϕpxq ^x1 " Cx `dq is Presburger-linear with finite monoid iff ϕ is a Presburger formula and xC ˚, ¨y is a finite, multiplicative monoid, i.e., the set

C ˚" tC k | k ě 0u is finite.

Acceleration

Theorem 4.1 (Presburger-definable transitive closure) If R is a Presburger-linear relation with finite monoid, then R ˚is Presburger-definable [START_REF] Boigelot | Symbolic Methods for Exploring Infinite State Spaces[END_REF][START_REF] Finkel | How to compose Presburger-accelerations: Applications to broadcast protocols[END_REF].

The finiteness of the monoid is polynomially decidable [START_REF] Boigelot | Symbolic Methods for Exploring Infinite State Spaces[END_REF]. The tool Lash [Boi98, WB98] implements these results.

Example 4.1 (Translation) An example for transition relation of which the transitive closure is Presburger-definable are translations: Rpx, x 1 q " pϕpxq ^x1 " x `dq. The variables are translated in each iteration by a constant vector d. A translation is trivially finite monoid because C " I. The transitive closure is given by the Presburger formula: R ˚px, x 1 q " Dk ě 0 : x 1 " x `kd ^@k 1 P r0, k´1s : ϕpx `k1 dq Issue (2) is adressed by the concept of flat acceleration: Flat systems.

A system is called flat if it has no nested loops, or more precisely if any location of the system is contained in at most one elementary cycle of the system [START_REF] Bardin | Fast: Fast acceleration of symbolic transition systems[END_REF]. This notion allows us to identify a class of systems for which the set of reachable states can be computed exactly: Theorem 4.2 (Presburger-definable flat systems) The reachability set reach of a counter system is Presburger-definable if the system is flat and all its transitions are Presburger-linear relations with finite monoid [START_REF] Finkel | How to compose Presburger-accelerations: Applications to broadcast protocols[END_REF].

Although there are many practical examples of flat systems [START_REF] Leroux | Flat counter automata almost everywhere! In Automated Technology for Verification and Analysis[END_REF], most systems are non-flat (like Fig. 4.1).

Application to non-flat systems.

The idea of Finkel et al [START_REF] Finkel | How to compose Presburger-accelerations: Applications to broadcast protocols[END_REF][START_REF] Bardin | Flat acceleration in symbolic model checking[END_REF] is to partially unfold the outer loops (circuits) of nested loops in order to obtain a flat system that is simulated by the original system. Such a system is called a flattening.

The algorithm is based on heuristically selecting circuits of increasing length and enumerating flattenings of these circuits. Hence, the algorithm terminates in case the system is flattable, i.e., at least one of its (finite) flattenings has the same reachability set as the original system.

Abstract Acceleration

Abstract acceleration introduced by Gonnord et al [START_REF] Gonnord | Combining widening and acceleration in linear relation analysis[END_REF][START_REF] Gonnord | Accélération abstraite pour l'amélioration de la précision en Analyse des Relations Linéaires[END_REF] reformulates acceleration concepts within an abstract interpretation approach: it aims at computing the best correct approximation of the effect of loops in the abstract domain of convex polyhedra.

The objective of abstract acceleration is to over-approximate the set τ ˚pX q, X Ď R n by a convex polyhedron γpτ b pαpXqqq Ě τ ˚pX q that is "close" to the convex hull of the exact set.

We will focus on the acceleration of self-loops τ , but the technique can also deal with cycles by composing transitions.

Accelerable transitions. Abstract acceleration targets the model of affine counter automata, i.e., with transition relations τ (actually functions) of the form of guarded actions G Ñ A, meaning "while guard G do action A":

Ax ď b looomooon guard Ñ x 1 " Cx `d loooooomoooooon action (4.1)
where Ax ď b is a convex polyhedron, and x 1 " Cx `d is an affine transformation. We will use the same notation for polyhedra X interexchangeably for both the predicate Xpxq " pAx ď bq and the set X " tx | Ax ď bu.

Abstract acceleration distinguishes different types of transitions depending on the form of the square matrix C: -Resets iff C is the zero matrix.

-Translations iff C is the identity matrix.

-Translations with resets (or translation/reset) iff C is a diagonal matrix with zeros and ones only. -Periodic affine transformations iff Dp ą 0, Dl ą 0 : C p`l " C p . -General affine transformations otherwise. We observe that Presburger-linear relations with finite monoid (Def. 4.2) include the first four cases, which are thus considered accelerable.

We will now explain how to accelerate these types of transitions: Theorem 4.4 (Translations) Let τ be a translation G Ñ x 1 " x `d, then for every convex polyhedron X, the convex polyhedron

τ b pXq " X \ ´`pX [ Gq Õ tdu ˘[ pG `tduq īs a convex over-approximation of τ ˚pX q [Gon07].
Observe that the abstract acceleration of translations uses the time elapse operator Õ for polyhedra, originally considered in the analysis of timed or hybrid automata (see Starting from X " p0 ď x 1 ď 1 ^0 ď x 2 ď 4q we compute τ b pXq:

§3.3.2). Example 4.2 (Translation) (see Fig. 4.2) τ : x 1 `x2 ď 4 ^x2 ď 3 loooooooooooomoooooooooooon G Ñ ˆx1 1 x 1 2 ˙" ˆx1 x 2 ˙`ˆ2 1
X [ G " p0 ď x 1 ď 1 ^0 ď x 2 ď 3q pX [ Gq Õ tdu " " x 1 ě 0 ^x2 ě 0 ^x1 ´2x 2 ě ´6 x1 `2x 2 ě ´1q ppX [ Gq Õ tduq [ pG `tduq " " x 1 ě 0 ^0 ď x 2 ď 4 ^x1 ´2x 2 ě ´6 x1 `2x 2 ě ´1 ^x1 `x2 ď 7 τ b pXq " " x 1 ě 0 ^0 ď x 2 ď 4 ^´x 1 `2x 2 ě ´1 x1 `x2 ď 7
Remark 4.1 Ideally, τ b pXq as defined in Thm. 4.4 should be the best over-approximation of τ ˚pX q by a convex polyhedron. This is not the case as shown by the following example in one dimension. Let X " r1, 1s and τ : x 1 ď 4 Ñ x 1

1 " x 1 `2. τ b pXq " r1, 6s, whereas the best convex over-approximation of τ ˚pX q " t1, 3, 5u is the interval r1, 5s. This is because the operations involved in the definition of τ b pXq manipulate dense sets and do not take into account arithmetic congruences.

Theorem 4.5 (Translations with resets) Let τ be a translation with resets G Ñ x 1 " Cx `d, then for every convex polyhedron X, the convex polyhedron

τ b pXq " X \ τ pXq \ ´`pτ pXq [ Gq Õ tCdu ˘[ pG `tCduq īs a convex over-approximation of τ ˚pX q [Gon07].
Example 4.3 (Translation with resets) (see Fig. 4.3)

τ : x 1 `x2 ď 4 ^" x 1 1 " x 1 `2 x 1 2 " 1 Starting from X " p0 ď x 1 ď 3 ^2 ď x 2 ď 3q we compute τ b pXq: τ pXq " p2 ď x 1 ď 4 ^x2 " 1q τ pXq [ G " p2 ď x 1 ď 3 ^x2 " 1q pτ pXq [ Gq Õ tCdu " px 1 ě 2 ^x2 " 1q ppτ pXq [ Gq Õ tCduq [ pG `tCduq " p2 ď x 1 ď 5 ^x2 " 1q τ b pXq " " x 1 ě 0 ^1 ď x 2 ď 3 ^x1 `2x 2 ě 4 x1 `x2 ď 6
Remark 4.2 Thm. 4.5 exploits the property that a translation with resets to constants iterated N times is equivalent to the same translation with resets, followed by a pure translation iterated N ´1 times. Hence the structure of the obtained formula.

Periodic affine transformations. Let τ be a transition Ax ď b ^x1 " Cx `d such that the powers of C form a finite monoid (cf. Def. 4.2) with Dp ą 0, Dl ą 0 : C p`l " C p , i.e., the powers of C generate an ultimately periodic sequence with prefix p and period l. Gonnord [START_REF] Gonnord | Accélération abstraite pour l'amélioration de la précision en Analyse des Relations Linéaires[END_REF] uses the periodicity condition Dq ą 0 : C 2q " C q . This condition is equivalent to the one above with q " lcmpp, lq.

With the latter condition, τ ˚can be rewritten by enumerating the transitions induced by the powers of C:

τ ˚pX q " ď 0ďjďq´1 pτ q q ˚pτ j pXqq (4.2)
This means that one only has to know how to accelerate τ q which equals:

τ q " ľ 0ďiďq´1 ˜AC i x `ÿ 0ďjďi´1 C j d ď b ļoooooooooooooooooooooooomoooooooooooooooooooooooon A 1 xďb 1 Ñ x 1 " C q x `ÿ 0ďjďq´1 C j d looooooooooooooomooooooooooooooon x 1 "C 1 x`d 1 (4.3)
The periodicity condition above implies that C q is diagonizable and all eigenvalues of C q are in t0, 1u. Hence, τ q is a translation with resets in the eigenbasis of C q . Let us denote C 1 " C q : Lemma 4.1 (Translation with resets in the eigenbasis) A transition τ :

Ax ď b Ñ x 1 " C 1 x `d where C 1 " C
1 2 is a translation with resets τ 1 in the eigenbasis of C 1 :

τ 1 : AQx ď b Ñ x 1 " Q ´1C 1 Qx `Q´1 d where Q ´1C 1 Q " diagpλ 1 , .
. . , λ n q and λ i the eigenvalues of C 1 .

We can now state the theorem for abstract acceleration of finite monoid transitions:

Theorem 4.6 (Finite monoid) Let τ be a transition G ^x1 " Cx `d where Dq ą 0 : C 2q " C q , then for every convex polyhedron X, the convex polyhedron τ b pXq " ğ 0ďjďq´1 pτ q q b pτ j pXqq is a convex over-approximation of τ ˚pX q, where τ q is defined by Eq. 4.3 and pτ q q b is computed using Lem. 4.1 [START_REF] Gonnord | Accélération abstraite pour l'amélioration de la précision en Analyse des Relations Linéaires[END_REF].

Example 4.4 (Finite monoid) (see Fig. 4.4)

τ : x 1 `x2 ď 4 ^ˆx 1 1 x 1 2 ˙" ˆ0 1 1 0 ˙ˆx 1 x 2 ˙`ˆ2 1 Ẇe have C 2 " I " C 4 , thus q " 2.
Obviously C 2 has its eigenvalues in t0, 1u and Q " I. ) starting from X " tp1, 0qu, pτ 2 q b pXq (bold line), pτ 2 q b pτ pXqq " τ pXq " tp2, 2qu, and result τ b pXq (whole shaded area).

According to Eq. 4.3 we strengthen the guard by ApCx ď bq " px 1 `x2 ď 1q and compute d 1 " pC`Iqd " ˆ3 3 ˙. Hence we get:

τ 2 : px 1 `x2 ď 1q ^ˆx 1 1 x 1 2 ˙" ˆx1 x 2 ˙`ˆ3 3
Ṡtarting from X " px 1 " 1 ^x2 " 0q we compute τ b pXq " X \ pτ 2 q b pXq \ pτ 2 q b pτ pXqq:

τ pXq " px 1 " x 2 " 2q pτ 2 q b pXq " p1 ď x 1 ď 4 ^x1 ´x2 " 1q pτ 2 q b pτ pXqq " px 1 " x 2 " 2q τ b pXq " " 2x 1 ´x2 ě 2 ^x1 ´2x 2 ě ´2 x1 ´x2 ď 1
Widening and acceleration. Abstract acceleration gives us a formula for computing the transitive closure of accelerable transitions. Precision is gained in comparison to standard abstract interpretation relying only on Kleene iteration and widening to converge for the following reasons: -Abstract acceleration aims at precisely approximating α ˝τ ˚pX q, i.e., abstracting the result of the transitive closure of the concrete transition, whereas standard abstract interpretation iterates the abstracted transition pα ˝τ ˝γq ˚˝αpX q. We will discuss this issue in §5.3.1. -Abstract acceleration is monotonic, i.e., X 1 Ď X 2 ñ τ b pX 1 q Ď τ b pX 2 q, whereas standard widening is not, which makes the analysis more robust and predictible. -Widening is not needed at all in flat systems. Yet, widening is required in the case of non-accelerable transitions, outer loops of nested loops, and to guarantee convergence when there are multiple self-loops in the same control location.

Further results. Some special cases of multiple self-loops can be accelerated without widening [START_REF] Gonnord | Combining widening and acceleration in linear relation analysis[END_REF][START_REF] Gonnord | Accélération abstraite pour l'amélioration de la précision en Analyse des Relations Linéaires[END_REF]. The path focussing technique of Monniaux and Gonnord [START_REF] Monniaux | Using bounded model checking to focus fixpoint iterations[END_REF] is an improvement w.r.t. the abstract acceleration of cycles and nested loops.

Chapter 5

Extending Abstract Acceleration

In this chapter we extend abstract acceleration to systems with numerical inputs and to backward, i.e., co-reachability, analysis.

Reactive programs such as Lustre programs ( §2.2) interact with their environment: at each computation step, they have to take into account the values of input variables, which typically correspond to values acquired by sensors. Boolean input variables can be encoded in a CFG by finite non-deterministic choices, but numerical input variables require a more specific treatment. Indeed, they induce transitions of the form

τ : gpx, ξq Ñ x 1 " f px, ξq x, x 1 P R n ξ P R p
that depend on both, numerical state variables x and numerical input variables ξ.

A second aspect we are looking at is backward analysis (cf. §3.4.1): so far, abstract acceleration has only been defined to perform forward reachability analysis. Yet, applications of verification methods, like parameter synthesis, make use of backward analysis techniques. Moreover, the experience of verification tools, e.g., [START_REF] Jeannet | Dynamic partitioning in linear relation analysis. application to the verification of reactive systems[END_REF], shows that combining forward and backward analyses results in more powerful tools.

Outline. This chapter describes the following contributions (see Fig. 5.1):

1. We show how to extend abstract acceleration from closed to open systems, i.e., systems with numerical inputs ( §5.1). 2. We also extend abstract acceleration techniques from forward (reachability) analysis to backward (co-reachability) analysis ( §5.2). 3. In §5.3 we compare the abstract acceleration approach with Kleene iteration, widening and the affine derivative closure algorithm of Ancourt et al. [START_REF] Ancourt | A modular static analysis approach to affine loop invariants detection[END_REF], which is another abstract interpretation-based approach to computing transitive closures of transitions.

Abstract Acceleration with Numerical Inputs

We consider transitions τ of the form

1 ˆA L 0 J ˙ˆx ξ ˙ď ˆb k looooooooooooomooooooooooooon Ax`Lξďb ^Jξďk Ñ x 1 " `C T ˘ˆx ξ ˙`u loooooooooomoooooooooon Cx`Tξ`u (5.1)
General and simple guards. The following proposition shows the challenge raised by adding inputs:

Proposition 5.1 (General guards and general affine transformations) Any general affine transformation without inputs Ax ď b Ñ x1 " Cx `d can be expressed -as a "reset with inputs" pAx ď b ^ξ " Cx `dq Ñ x 1 " ξ, -as well as a "translation with inputs" pAx ď b ^ξ " pC´Iqx `dq Ñ x 1 " x `ξ. This means that there is no hope to get precise acceleration for such resets or translations with inputs, unless we know how to accelerate precisely general affine transformations without inputs, which is out of the scope of the current state of the art.

Nevertheless, we can accelerate transitions with inputs if the constraints on the state variables do not depend on the inputs, i.e., the guard is of the form Ax ď b ^Jξ ď k, i.e., when L " 0 in Eqn. (5.1). We call the resulting guards simple guards.

In the following, we show how to accelerate translations and translations with resets with simple guards. We provide in §5.1.3 an over-approximation of our results for general guards. The extension of further cases such as periodic affine transformations will be discussed in §5.4.

Translations with Inputs and Simple Guards

Definition 5.1 Translations with inputs and simple guards are defined as

ˆA 0 0 J ˙ˆx ξ ˙ď ˆb k looooooooooooomooooooooooooon Ax ď b loomoon G ^Jξďk Ñ x 1 " `I T ˘ˆx ξ ˙`u looooooooomooooooooon x`Tξ`u
The first step we perform is to reduce such a translation with inputs to a polyhedral translation τ : G Ñ x 1 " x `D and defined by τ pXq " pX [ Gq `D.

τ b pXq " X \ τ `pX [ Gq Õ D ȋs a convex over-approximation of τ ˚pX q. Proof x 1 P Ť kě1 τ k pXq ðñ x 1 P τ p Ť kě0 τ k pXqq ðñ Dk ě 0, Dx 0 P X, Dx k , Dd 1 . . . d k P D : $ ' & ' % x 1 P τ px k q x k " x 0 `řk j"1 d j Gpx 0 q ^@k 1 P r1, ks : Gpx 0 `řk 1 j"1 d j q ðñ Dk ě 0, Dx 0 P X, Dx k , Dd P D : x 1 P τ px k q ^xk " x 0 `kd ^Gpx 0 q ^Gpx k q
(because D and G are convex, see Rem. 5.1) ùñ Dα ě 0, Dx 0 P X, Dx k , Dd P D : x 1 P τ px k q ^xk " x 0 `αd ^Gpx 0 q (dense approximation; Gpx k q implied by x 1 P τ px k q) ðñ Dx 0 P X [ G, Dx k : x 1 P τ px k q ^xk P ptx 0 u Õ Dq ðñ x 1 P τ ppX [ Gq Õ Dq Mind that the only approximation takes place in the line (ñ) where the integer coefficient k ě 0 is replaced by a real coefficient α ě 0. This is the technical explanation of Rem. 4.1.

Remark 5.1 (Convexity argument) For any k loop iterations with d 1 , . . . , d k P D s.t. @k 1 P r0, ks : Gpx `řk 1 j"1 d j q we have Dd P D, Dα ě 0 : Gpxq ^Gpx `αdq s.t. ř k j"1 d j " αd: any intermediate point x `αd must be in G, because G is convex; moreover α ě 0 and a vector d P D actually exist: for example, take α " k and d "

1 k ř k j"1 d j , which is in D because D is convex.
Remark 5.2 (Inputs vs. constants) One might think that Thm. 4.4 can be applied directly by accelerating the transition for each d P D and taking the union, i.e. computing τ b pXq by

X \ Ů dPD X d with X d " `pX [ Gq Õ tdu ˘[ pG `tduq.
However, this formula is not correct for the last step beyond the guard, which is illustrated in the figure on the right-hand side for a polyhedral translation with X " tp0, 0qu, D " p0 ď d 1 ď 1 ^d2 " 1q and the guard

0 1 2 0 1 2 x 1 x 2 G
G given in the figure. For the step crossing the guard, e.g., at p2, 2q, there is actually a choice among all values in D (correct abstract acceleration: whole shaded area), whereas the wrong acceleration (dark gray) considers only the vector d " p1, 1q which led to p2, 2q.

We combine Propositions 5.2 and 5.3 to formulate the following theorem: Proof Follows directly from Prop. 5.2 and 5.3.

d 1 d 2 ξ 1 1 D J ξ ≤k x 1 x 2 1 1 X τ ⊗ (X) G
Example 5.1 (Translation with inputs and simple guards) Consider the polyhedron X " tpx 1 , x 2 q | 0 ď x 1 ď x 2 ď 1u and the transition

τ : ˇˇˇx 1 `x2 ď 4 1 ď ξ ď 2 Ñ ˇˇˇx 1 1 " x 1 `2ξ ´1 x 1
2 " x 2 `ξ Eliminating the inputs as in Proposition 5.2 yields D " tpd 1 , d 2 q|1 ď d 1 ď 3 ^´d 1 `2d 2 " 1u, see Fig. 5.2 left-hand side. After translation of X by D (Fig. 5.2 right-hand side) we obtain the polyhedron tpx

1 , x 2 q | x 1 ě 0 ^´x 1 `x2 ď 1 ^x1 `x2 ď 9 ^´2x 1 `4x 2 ď 9 ^2x 1 ´3x 2 ď 0u.
Remark 5.3 (Alternative, less precise formula) In analogy to Thm. 4.4, we could alternatively consider the formula X \ ppppX [ Gq Õ Dq [ pG `Dqq. In order to justify this, we extend the proof of Proposition 5.3 by continuing at the label (dense approximation): observed that for the translation of example 5.1 the latter formula results in an overapproximation (see Fig. 5.3) as compared to the result in Fig. 5.2. This reflects the additional approximation steps in the proof indicated by pùñq.

ðñ Dα ě 0, Dx 0 P X [ G, Dx k , Dd, d 1 P D : x 1 " x k `d1 ^xk " x 0 `αd ^Gpx k q ðñ Dα ě 0, Dx 0 P X [ G, Dd, d 1 P D : x 1 " x 0 `αd`d 1 ^Gpx 1 ´d1 q ùñ `Dα ě 0, Dx 0 P X [ G, Dd, d 1 P D : x 1 " x 0 `αd`d 1 ˘^`D d 1 P D : Gpx 1 ´d1 q ðñ `Dα 1 ě 1, Dx 0 P X [ G, Dd 2 P D : x 1 " x 0 `α1 d 2 ˘^`D d 1 P D : Gpx 1 ´d1 q ùñ x 1 P pX [ Gq Õ

Translations/Resets with Inputs and Simple Guards

Definition 5.2 Translations/resets with inputs and simple guards are defined as

ˆA 0 0 J ˙ˆx ξ ˙ď ˆb k looooooooooooomooooooooooooon Axďb ^Jξďk Ñ x 1 " `C T ˘ˆx ξ ˙`u loooooooooomoooooooooon Cx`Tξ`u
where C is a diagonal matrix with C i,i P t0, 1u for all i.

Notations. Let C 1 " I ´C, then we can decompose any vector x in Cx`C 1 x. We denote Cx " x t,0 a vector where the reset dimensions are set to zero, and C 1 x " x 0,r a vector where the translated dimensions are set to zero. We extend such notations to sets: X t,0 " tx t,0 | x P Xu and X 0,r " tx 0,r | x P Xu. We use a similar notation for projection: X t,' " tx | x t,0 P X t,0 u and X ',r " tx | x 0,r P X 0,r u denote the sets obtained by existential quantification of the reset (resp. translated) dimensions.

Observe that the over-approximation X t,' [ X ',r of a set X by the cartesian product w.r.t. to translated and reset dimensions is equal to the Minkowski sum X t,0 `X0,r .

The case of translations/resets with inputs can be handled similarly to translations: we combine Proposition 5.2 and Thm. 4.5 to reduce translations/resets with inputs to polyhedral translations with resets τ : G Ñ x 1 " Cx`D defined by τ pXq " pX [ Gq t,0 `D.

Mind, however, that Rem. 4.2 does not apply any more and cannot be exploited in the presence of inputs, because the variables being reset may be assigned a different value in each iteration.

Proposition 5.4 (Polyhedral translation with resets) Let τ be a polyhedral translation with resets G Ñ x 1 " Cx `D. Then, the set

τ b pXq " X \ τ pXq \ τ ´`pτ pXq [ Gq t,0 Õ D t,0 ˘`D 0,r
īs a convex over-approximation of τ ˚pX q.

In the formula above and in the proof below, we unfold τ twice, that is, we accelerate only the central part of the sequence x τ Ý Ñ x 0 . . . x n τ Ý Ñ x 1 with x P X because we have @k P r0, ns : x k P G [ D ',r , whereas we only have x P G at the start-point, and x 1 P D ',r at the end-point.

Proof The formula is trivially correct for 0 or 1 iterations of the self-loop τ . It remains to show that, for the case of k ě 2 iterations, our formula yields an over-approximation of Ť kě2 τ k pXq.

x 1 P Ť kě2 τ k pXq ðñ x 1 P τ `Ťkě0 τ k pτ pXqq ðñ Dk ě 0, Dx P X, Dx 0 . . . x k , Dd 1 . . . d k P D : $ ' ' ' ' ' & ' ' ' ' ' %
x 0 P τ pxq ^@k 1 P r1, ks :

# x i k 1 " x i 0 `řk 1 j"1 d i j for i P I t x i k 1 " d i k 1 for i P I r ^x1 P τ px k q ^@k 1 P r0, ks : Gpx k 1 q ðñ Dk ě 0, Dx P X, Dx 0 . . . x k , Dd 1 . . . d k P D : $ & % @k 1 P r1, ks : x k 1 " x t,0 0 `př k 1 j"1 d t,0 j q `d0,r k 1 ^@k 1 P r0, ks : Gpx k 1 q ^x0 P τ pxq ^x1 P τ px k q ùñ Dk ě 0, Dx P X, Dx 0 . . . x k , Dd t,0 1 . . . d t,0 k P D t,0 , Dd 0,r 1 . . . d 0,r k P D 0,r : $ & % @k 1 P r1, ks : x k 1 " x t,0 0 `př k 1 j"1 d t,0 j q `d0,r k 1
^@k 1 P r0, ks : Gpx k 1 q ^x0 P τ pxq ^x1 P τ px k q pD approximated by the sum pD t,0 `D0,r qq ðñ Dk ě 0, Dx P X, Dx 0 , x k , Dd t,0 P D t,0 , Dd 0,r k P D 0,r :

$ & % x k " x t,0
0 `kd t,0 `d0,r k ^Gpx 0 q ^Gpx k q ^x0 P τ pxq ^x1 P τ px k q (because D t,0 , D 0,r and G are convex and x 0,r 0 P D 0,r ) ùñ Dα ě 0, Dx P X, Dx 0 , x k , Dd t,0 P D t,0 , Dd 0,r k P D 0,r : " ^xk " x t,0 0 `αd t,0 `d0,r k ^x0 P τ pxq ^Gpx 0 q ^x1 P τ px k q (dense over-approximation; Gpx k q already implied by x 1 P τ px k q) ðñ x 1 P τ ´`pτ pXq [ Gq t,0 Õ D t,0 ˘`D 0,r Theorem 5.2 (Translation with resets, inputs and simple guards) The accelerated transition τ b for a translation/reset with inputs and a simple guard τ can be computed by applying Proposition 5.4 with D defined as in Proposition 5.2.

Example 5.2 (Translation with resets, inputs and simple guards) Consider the polyhedron X " tpx 1 , x 2 q | 0 ď x 1 ^1 ď x 2 ^x1 `x2 ď 2u and the transition

τ : ˇˇˇx 1 `2x 2 ď 3 0 ď ξ ď 1 Ñ ˇˇˇx 1 1 " x 1 `ξ `1 x 1 2 " ξ Eliminating the inputs yields D " tpd 1 , d 2 q | 1 ď d 1 ď 2 ^d1 ´d2 " 1u and D t,0 " tpd 1 , d 2 q | 1 ď d 1 ď 2 ^d2 " 0u. We obtain τ b pXq " tpx 1 , x 2 q | x 1 `x2 ě 1 ^x2 ě 0 ^x1 ´x2 ď 4 ^x1 `5x 2 ď 10 ^x1 ě 0u, see Fig. 5.4.

Relaxing General Guards to Simple Guards

As discussed at the beginning of §5.1, allowing constraints that relate state variables with input variables in guards, i.e. G " Ax `Lξ ď b ^Jξ ď k with L ‰ 0 (see Eqn. (5.1)), makes acceleration very difficult (Prop. 5.1). Our solution is to relax the guard G to a simple guard (or cartesian product) G " pDξ : Gq looomooon

A 1 xďb 1 ^pDx : Gq looomooon J 1 ξďk 1 . 55 5.2. Backward Abstract Acceleration x 1 x 2 1 1 G X x 1 x 2 1 1 G X Figure 5
.4: Translation/reset with inputs: Ex. 5.2. Left-hand side: τ pXq (dark shaded) and ppτ pXq [ Gq t,0 Õ D t,0 q `D0,r (whole shaded area). Right-hand side: τ pppτ pXq [ Gq t,0 Õ D t,0 q `D0,r q (dark shaded) and τ b pXq (whole shaded area).

x 1 x 2 1 1 X G Figure 5
.5: Ex. 5.3: accelerated transition τ b pXq using the relaxed guard G (result shaded).

x 1

x 2 1 1 Figure 5.6: Ex. 5.3: comparison between convex hull of the exact result (dark gray), our method (gray), and widening with no delay and 3 descending iterations (light gray).

We can now apply the accelerated transition from Theorems 5.1 and 5.2 with G 1 " pA 1 x ď b 1 q and D 1 " td | Dξ : d " T ξ `u ^J1 ξ ď k 1 u. This trivially results in a sound over-approximation because a weaker guard is used for abstract acceleration.

Note however that in the corresponding acceleration formulas, we can still compute exactly the function τ using the original guard G. Indeed, the proofs of those theorems are not based on the assumption L ‰ 0 when they introduce the function τ .

Example 5.3 (Relaxed guard) Consider the polyhedron X " tpx 1 , x 2 q | x 1 ď 1 ^x2 ď 1 ^x1 `x2 ě 1u and the transition τ :

ˇˇˇˇˇ2 x 1 `x2 `ξ ď 6 x 2 ´ξ ď 2 0 ď ξ ď 1 Ñ ˇˇˇx 1 1 " x 1 `ξ `1 x 1 2 " x 2 `1 The relaxed guard is G " p2x 1 `x2 ď 6 ^x1 `x2 ď 4 ^x2 ď 3q ^p0 ď ξ ď 1q. Eliminating the inputs yields D " tpd 1 , d 2 q | 1 ď d 1 ď 2 ^d2 " 1u. We obtain τ b pXq " tpx 1 , x 2 q | x 1 `x2 ě 1 ^x2 ´x1 ď 1 ^´4 ď x 1 ´2x 2 ď 1 ^x1 `2x 2 ď 10 ^2x 1 `x2 ď 10u, see Fig. 5.5. The convex hull of the exact result is tpx 1 , x 2 q | x 1 `x2 ě 1 ^´2 ď x 2 ´x1 ď 1 ^x1 ´2x 2 ď 1 ^x2 ď 3 ^2x 1 `x2 ď 10u, see Fig. 5.6.

Backward Abstract Acceleration

Abstract acceleration has been applied to forward reachability analysis in order to compute the reachable states starting from a set of initial states. Backward analysis computes the states co-reachable from the error states. For example, combining forward and backward analysis allows to obtain an approximation of the sets of states belonging to a path from initial to error states (see for instance [START_REF] Jeannet | Dynamic partitioning in linear relation analysis. application to the verification of reactive systems[END_REF]). Moreover, a backward analysis allows us to synthesize constraints on parameter variables that ensure that a property is satisfied (see, e.g., [ACH `95]).

In this section, we present how to compute the accelerated backward transitions in the case of translations and translations/resets. Although the inverse of a translation is a translation, the difference is that the intersection with the guard occurs after the (inverted) translation. The case of backward translations with resets is more complicated than for the forward case, because resets are not invertible. Finally, the relaxation of general guards to simple guards applies in the same way to backward acceleration.

Translations

Proposition 5.5 (Polyhedral backward translation) Let τ be a polyhedral translation G Ñ x 1 " x `D. Then the set τ ´bpX 1 q " X 1 \ `pτ ´1pX 1 q Õ p´Dq ˘[ G is a convex over-approximation of τ ´˚pX 1 q, where τ ´˚" pτ ´1q ˚" pτ ˚q´1 is the reflexive and transitive backward closure of τ .

p´Dq denotes the reflexion of D w.r.t. the origin: d P p´Dq ðñ p´dq P D.

Proof

x 0 P Ť kě1 τ ´kpX 1 q ðñ Dx 1 P X 1 :

x 1 P τ `Ťkě0 τ k ptx 0 uq ðñ Dk ě 0, Dx 1 P X 1 , Dx k , Dd 1 , . . . , d k P D : $ ' & ' %
x k " x 0 `řk j"1 d j @k 1 P r0, ks : Gpx 0 `řk 1 j"1 d j q x 1 P τ ptx k uq (forward reachability)

ðñ Dk ě 0, Dx 1 P X 1 , Dx k , Dd 1 , . . . , d k P D : $ ' & ' % x k P τ ´1ptx 1 uq x 0 " x k ´řk j"1 d j @k 1 P r0, ks : Gpx k ´řk j"k 1 `1 d j q (rewritten as backward reachability) ðñ Dk ě 0, Dx 1 P X 1 , Dx k , Dd P D : x k P τ ´1ptx 1 uq ^x0 " x k ´kd ^Gpx 0 q ^Gpx k q (because D and G are convex) ùñ Dα ě 0, Dx 1 P X 1 , Dx k , Dd P D : x k P τ ´1ptx 1 uq ^x0 " x k ´αd ^Gpx 0 q (dense approximation; Gpx k q implied by x k P τ ´1ptx 1 uq) ðñ x 0 P `pτ ´1pX 1 q Õ p´Dq ˘[ G.
Example 5.4 (Polyhedral backward translation) Consider the polyhedron X 1 " tpx 1 , x 2 q | 3 ď x 1 ď 6 ^4 ď x 2 ď 5u and the transition

τ : ˇˇˇx 1 `2x 2 ď 10 ^0 ď x 1 ď 4 0 ď x 2 ^1 ď ξ ď 2 Ñ ˇˇˇx 1 1 " x 1 `1 x 1 2 " x 2 `ξ The polyhedron D is tpd 1 , d 2 q|d 1 " 1 ^1 ď d 2 ď 2u.
As result of the backward acceleration (Fig. 5.7) we obtain the polyhedron tpx 1 , x 2 q | 0 ď x 1 ď 6 ^0 ď x 2 ď 5 ^´x 1 `x2 ď 2 ^4x 1 ´3x 2 ď 12u. 57 5.2. Backward Abstract Acceleration

x 1 x 2 1 1 X ′ G x 1 x 2 1 1 X ′ G Figure 5
.7: Backward acceleration of a translation loop (Ex. 5.4) starting from X 1 with τ ´1pX 1 q (dark gray) and τ ´1pX 1 q Õ p´Dq (whole shaded area) on the left-hand side and the final result (right-hand side).

Translations with Resets

Proposition 5.6 (Polyhedral backward translation with resets) Let τ be a polyhedral translation with resets G Ñ x 1 " Cx `D. Then, the set

τ ´bpX 1 q " X 1 \ τ ´1pX 1 q \ τ ´1´`p τ ´1pX 1 q t,' Õ p´D t,0 q ˘[ D ',r [ G īs a convex over-approximation of τ ´˚pX 1 q.
Proof The formula is trivially correct for 0 or 1 backward iterations of the self-loop τ , thus, it remains to show that, for the case of k ě 2 iterations, our formula yields an over-approximation of Ť kě2 τ ´kpX q. x P Ť kě2 τ ´kpX 1 q ðñ Dx 1 P X 1 :

x 1 P τ `Ťkě0 τ k pτ pxqq ðñ Dk ě 0, Dx 1 P X 1 , Dx 0 . . . x k , Dd 1 . . . d k P D : $ & % x 0 P τ pxq ^x1 P τ px k q ^@k 1 P r1, ks : x k 1 " x t,0 0 `řk 1 j"1 d t,0 j `d0,r k 1 ^@k 1 P r0, ks : Gpx k 1 q (forward reachability) ðñ Dk ě 0, Dx 1 P X 1 , Dx 0 . . . x k , Dd 1 . . . d k P D : $ & % @k 1 P r0, k´1s : x k 1 " x t,0 k ´řk j"k 1 `1 d t,0 j `d0,r k 1
^@k 1 P r0, ks : Gpx k 1 q ^xk P τ ´1ptx 1 uq ^x P τ ´1ptx 0 uq (rewritten as backward reachability) ùñ Dk ě 0,

Dx 1 P X 1 , Dx 0 . . . x k , Dd t,0 1 . . . d t,0 k P D t,0 , Dd 0,r 1 . . . d 0,r k P D 0,r : $ & % @k 1 P r0, k´1s : x k 1 " x t,0 k ´řk j"k 1 `1 d t,0 j `d0,r k 1
^@k 1 P r0, ks : Gpx k 1 q ^xk P τ ´1ptx 1 uq ^x P τ ´1ptx 0 uq pD approximated by the sum pD t,0 `D0,r q) ðñ Dk ě 0, Dx 1 P X 1 , Dx 0 , x k , Dd t,0 P D t,0 , Dd 0,r P D 0,r : $ & % x 0 " x t,0 k ´kd t,0 `d0,r ^Gpx 0 q ^Gpx k q ^xk P τ ´1ptx 1 uq ^x P τ ´1ptx 0 uq (because D t,0 , D 0,r and G are convex and x 0,r k P D 0,r )

x 1 x 2 1 1 X ′ G x 1 x 2 1 1 X ′ G Figure 5
.8: Backward acceleration of a loop with translations and resets (Ex. 5.5) starting from the initial set X 1 . Right-hand side: τ ´1pX 1 q (dark gray) and `pτ ´1pX 1 q| t Õ p´D t q ˘[ G (whole shaded area). Left-hand side: final result (whole shaded area).

ùñ Dα ě 0, Dx 1 P X 1 , Dx 0 , x k , Dd t,0 P D t,0 , Dd 0,r P D 0,r : " x 0 " x t,0 k ´αd t,0 `d0,r ^xk P τ ´1ptx 1 uq ^x P τ ´1ptx 0 uq ^Gpx 0 q (dense approximation; Gpx k q implied by x k P τ ´1ptx 1 uq)

ðñ x P τ ´1´`p τ ´1pX 1 qq t,' Õ p´D t,0 q ˘[ D ',r [ G (because x P τ ´1ptx 1 uq ñ x 1 P D ',r q
Example 5.5 (Polyhedral backward translation with resets) Consider the polyhedron X 1 " tpx 1 , x 2 q | 4 ď x 1 ď 5 ^1 ď x 2 ď 4u and the transition

τ : ˇˇˇ3 ď x 1 `x2 ď 5 1 ď ξ ď 3 ^0 ď x 2 Ñ ˇˇˇx 1 1 " x 1 `1 x 1 2 " ξ The polyhedron D is tpd 1 , d 2 q|d 1 " 1 ^1 ď d 2 ď 3u.
As result of the backward acceleration (Fig. 5.8), we obtain the polyhedron tpx 1 , x 2 q | ´1 ď x 1 ď 5 ^0 ď x 2 ^x1 `x2 ě 3 ^x1 ´x2 ď 4 ^x1 `3x 2 ď 17u.

Evaluation and Comparison

This section discusses the advantages and shortcomings of abstract acceleration in comparison with more general abstract-interpretation-based methods like standard widening [START_REF] Cousot | Abstract interpretation: A unified lattice model for static analysis of programs by construction or approximation of fixpoints[END_REF] and the affine derivative closure method of Ancourt et al [START_REF] Ancourt | A modular static analysis approach to affine loop invariants detection[END_REF].

Comparing Abstract Acceleration with Kleene Iteration

Abstract acceleration aims at computing a tight over-approximation of αp Ť kě0 τ k pX 0 qq where X 0 is a convex polyhedron and τ is an affine transformation with an affine guard. Since convex polyhedra are closed under affine transformations (αpτ pX 0 qq " τ pX 0 q), we have αp Ť kě0 τ k pX 0 qq " Ů kě0 τ k pX 0 q. The latter formula is known as Merge-Over-All-Paths (MOP) solution of the reachability problem [START_REF] Kam | Monotone data flow analysis frameworks[END_REF], which computes the limit of the sequence:

X 0 X 1 " X 0 \ τ pX 0 q X 2 " X 0 \ τ pX 0 q \ τ 2 pX 0 q . . . 59

Evaluation and Comparison

In contrast, the standard approach in abstract interpretation computes the fixed point X 1 8 of X " X 0 \ τ pXq, known as the Minimal-Fixed-Point (MFP) solution. It proceeds as follows:

X 1 0 " X 0 X 1 1 " X 1 0 \ τ pX 1 0 q X 1 2 " X 1 0 \ τ pX 1 0 \ τ pX 1 0 qq . . .
The MOP solution is more precise than the MFP solution [START_REF] Kam | Monotone data flow analysis frameworks[END_REF]. The reason is that, in general, τ does not distribute over \ and we have τ pX 1 q \ τ pX 2 q Ď τ pX 1 \ X 2 q. For instance, if X 0 " r0, 0s and τ : x ď 1 Ñ x 1 " x`2, we have X 2 " r0, 0s \ r2, 2s \ K " r0, 2s and X 1 2 " r0, 0s \ τ pr0, 2sq " r0, 3s. Since abstract acceleration should deliver a tight over-approximation of the MOP solution, we should generally have the relationship

Ů kě0 τ k pX 0 q Ď τ b pX 0 q Ď X 1 8 , i.e.
, abstract acceleration should be more precise than the standard abstract interpretation approach (MFP) even without widening. Fig. 5.9 shows an example illustrating this issue: in the standard abstract interpretation approach (MFP), each iteration translates the approximation added by the convex union with the result of the previous iteration in each step and converges slowly. Abstract acceleration translates only the intersection with the guard and takes the union as a last step. Observe, however, that in the case where X 0 is contained in the guard G, MOP and MFP solutions give identical results for this example [START_REF] Leroux | Acceleration in convex data-flow analysis[END_REF].

Non-flat systems.

Generally, the invariants computed by abstract acceleration of a single self-loop τ are not inductive, which implies that τ b is not idempotent, i.e., τ b pτ b pX 0 qq ‰ τ b pX 0 q. While this is not a problem for flat systems, it has negative effects in the presence of nested loops.

For example, in the system pid ˝τ ˚q˚w e can apply abstract acceleration to the innermost loop: pid ˝τ b q ˚" pτ b q ˚. If τ b is not idempotent (like in Fig. 5.9b), then the outer loop might not converge and thus widening is needed. Thus, the considerations w.r.t. MOP and MFP solutions for τ ˚above apply to pτ b q ˚in the same manner.

Since this problem arises in particular when the initial set is not contained in the guard G (like in Fig. 5.9b), Leroux and Sutre [START_REF] Leroux | Acceleration in convex data-flow analysis[END_REF] propose to accelerate translations by the formula τ b pXq " τ pX Õ Dq, i.e., without initially intersecting with G, which is idempotent and hence convergence without widening can be expected more often. However, this formula is clearly less precise and should not be used for accelerating non-nested loops.

Comparing Abstract Acceleration with Widening

In this section, we illustrate by some examples where abstract acceleration helps increasing the predictability and the robustness of the analysis.

Widening in self-loops. We consider Ex. 5.3, which has the structure depicted in Fig. 5.10 when analyzed with abstract acceleration or Kleene iteration with widening and descending iterations respectively.

We try first an analysis with undelayed widening, i.e., N " 0:

X 1 1 " tpx 1 , x 2 q | x 1 `x2 ě 1u (result of converged widening sequence) X 2 1 " tpx 1 , x 2 q | x 1 `x2 ě 1 ^2x 1 `x2 ď 10 ^x2 ď 4 ^0 ď x 1 ď 6 ^3x1`5x 2 ě 3u . . . X 2 3 " tpx 1 , x 2 q | x 1 `x2 ě 1 ^2x 1 `x2 ď 10 ^3x 2 ´2x 1 ď 6 ^3x 2 ´4x 1 ď 35 x 1 ´22x 2 ď 8 ^29x 1 ´157x 2 ď 29u Ą τ b pXq . . . (descending sequence) x 1 x 2 1 1 X G 1 2 3 ∞ (a)
MFP: X dark gray, iteration 1 medium gray, iterations 2 and 3 dashed, final result whole shaded area.

x 1 x 2 1 1 X G ≥ 1 ⊗ (b)
Abstract acceleration: X dark gray, iterations ě 1 medium gray, final result whole shaded area.

: G Ñ px 1 1 , x 1 2 q " px 1 `1, x 2 `1q
with G and X as given in the figures.

X ℓ 1 1 ℓ 1 τ b X ℓ 1 τ Figure 5
.10: Analysis with acceleration (left-hand side) and with widening (right-hand side) for Ex. 5.3. 5.11: Analysis with acceleration (lefthand side) and with widening (right-hand side) for Ex. 5.6. G " p2x 1 `2x 2 ď x 3 q.

X ℓ 0 ℓ 1 1 ℓ 1 x 3 ď 20 τ b G Ñ x 1 3 " x 3 `1 X ℓ 0 ℓ 1 x 3 ď 20 τ G Ñ x 1 3 " x 3 `1 Figure
Here, the descending iterations do not converge and improve the result slowly. See Fig. 5.6 for X 2 3 . By increasing the delay to N " 1, we can improve the result, and we get the same result as with abstract acceleration: X 2 1 " τ b pXq. However, this is not guaranteed in general, because widening is not monotonic. Moreover, abstract acceleration is more efficient computationally: delaying widening and a long descending sequence increase the number of iterations. In flat programs, like in Ex. 5.3, abstract acceleration does not even require convergence tests.

Widening in nested loops. In the previous example, delayed widening and descending iterations allowed to get the same result as with abstract acceleration. However, this is less likely if the loop is embedded in an outer loop as in Fig. 5.11: descending iterations cannot be applied during the ascending iterations, but only after convergence of the widening sequence of the whole program, otherwise convergence would not be guaranteed.

Example 5.6 (Widening in nested loops)

We consider the program depicted in Fig. 5.11 in which the inner loop τ is adapted from Ex. 5.2:

τ : ˇˇˇ2 x 1 `2x 2 ďx 3 0 ď ξď1 Ñ ˇˇˇˇˇx 1 1 " x 1 `ξ `1 x 1 2 " ξ x 1 3 " x 3 X " " px 1 , x 2 , x 3 q ˇˇˇ0 ď x 1 ^1 ď x 2 x 1 `x2 ď 2 ^x3 " 3 *
The analysis without abstract acceleration yields for any widening delay N ě 1 (widening point ℓ 1 ) and any number of descending iterations N2 ě 1 the following very 61 5.3. Evaluation and Comparison weak invariant:

X 1 1 " tpx 1 , x 2 , x 3 q | 0 ď x 1 ^3 ď x 3 u X 2 1 " tpx 1 , x 2 , x 3 q | 0 ď x 1 ^1 ď x 1 `x2 ^3 ď x 3 u
Abstract acceleration with widening delay N ě 1 (widening point ℓ 1 ) and one descending iteration gives much better results: we give here a simplified (over-approximated) invariant, because the actual result consists of more constraints:

X 2 1 " tpx 1 , x 2 , x 3 q | 0 ď x 1 ď 12 ^0 ď x 2 ď 3 ^3 ď x 3 ď 20 ^1 ď x 1 `x2 u
One can also consider widening with thresholds (see §3.4.2). A natural threshold set for our example is the postcondition of the guard of τ by the body of τ : τ pJq " tpx 1 , x 2 q | 0 ď x 2 ď 1u. Yet, this does improve the result.

Extending the threshold set with the postcondition of the guard of the outer loop x 3 ď 21 improves the result (all variables are bounded), but it is still less precise than the result obtained by combining abstract acceleration and widening (in particular the descending iteration does not converge).

Comparing Abstract Acceleration with the Affine Derivative Closure Algorithm

The affine derivative closure algorithm of Ancourt et al. [START_REF] Ancourt | A modular static analysis approach to affine loop invariants detection[END_REF] is another abstract interpretation-based analysis method. The idea is to compute an abstract transformer, i.e., a relation between variables x and x 1 , independently of the initial state of the system. The abstract transformer abstracts the effect of the loop by a polyhedral translation

true Ñ x 1 " x `DR with D R " td | Dx, ξ, x 1 : Rpx, ξ, x 1 q ^x1 " x `du
where R is the concrete transition relation. The polyhedron D R is called the "derivative" of the relation R. The effect of several self-loops with relations R 1 , . . . , R k is abstracted by considering the convex union Ů i D R i . Then, the reflexive and transitive closure R ˚" tpx, x 1 q | Dk ě 0 : x 1 " x`kd ^DR pdqu is applied to a polyhedron X of initial states:

R ˚pX q " tx 1 | Dx : R ˚px, x 1 q ^Xpxqu
The final result is obtained by computing one "descending" iteration, in the same way as it is done in standard abstract interpretation after widening.

The affine derivative closure algorithm is implemented in the code optimization tool Pips 2 .

In single self-loops with translations or translations/resets, the method works similarly to abstract acceleration, as illustrated by the following example involving resets and inputs:

X G x 1 x 2 1 1 (a)
Derivative closure method: R ˚applied to X (whole shaded area), final result (dark gray).

x 1 ≤ 9 → x ′ 1 = x 1 + 1 ∧ x ′ 2 = 0 x 2 ≤ 9 → x ′ 1 = x 1 ∧ x ′ 2 = x 2 + 1 x ′ 1 = 0 ∧ x ′ 2 = 0
τ : ˇˇˇˇˇx 1 ď 4 x 2 ď 4 0 ď ξ ď 1 Ñ ˇˇˇx 1 1 " x 1 `ξ `1 x 1 2 " ξ `2 X " " px 1 , x 2 q ˇˇˇx 1 ď 1 ^x2 ď 1 x 1 `x2 ě 1 * The transition relation R " tpx 1 , x 2 , ξ, x 1 1 , x 1 2 q | x 1 1 " x 1 `ξ `1 ^x1 2 " ξ `2 ^x1 ď 4 ^x2 ď 4 ^0 ď ξ ď 1u expressed in terms of derivatives is D R " tpd 1 , d 2 q | Dx 1 , x 2 , ξ, x 1 1 , x 1 2 : Rpx 1 , x 2 , ξ, x 1 1 , x 1 2 q ^x1 1 " x 1 `d1 ^x1 2 " x 2 `d2 u " tpd 1 , d 2 q | 1 ď d 1 ď 2 ^d1 ´d2 ď 3u
The closure of the loop starting from X gives

R ˚pX q " tpx 1 1 , x 1 2 q | Dk ě 0, x 1 , x 2 : x 1 1 ě x 1 `k ^x1 1 ď x 1 `2kx 1 1 ´x1 2 ď x 1 ´x2 `3k ^Xpx 1 , x 2 qu " " tpx 1 1 , x 1 2 q | 0 ď x 1 1 ^2x 1 1 `x1 2 ě 1u Finally, a descending iteration is computed: X \ τ pR ˚pX qq " tpx 1 1 , x 1 2 q | x 1 1 `x1 2 ě 1 ^x1 1 ´2x 1 2 ď 1 ^x1 1 ´x1 2 ď 3x 1 2 ď 3 ^x1 1 ´x1 2 ě ´1u
This result equals the one obtained by abstract acceleration (see Fig. 5.12).

Resets cannot be expressed as polyhedral translations: for instance, if Rpx, x 1 q " px 1 " 0q, then D R " td |Dx, x 1 : x 1 " 0 ^x1 " x `d u " J. However, this information is recovered during the descending iteration. Hence, similarly to widening, these descending iterations may fail (cf. §3.4.2) in the presence of multiple loops:

Example 5.8 (Multiple loops) For the CFG in Fig. 5.13, the derivatives for the upper and the lower loop are D R 1 " pd 1 " 1q and D R 2 " pd 1 " 0 ^d2 " 1q respectively. Their convex union is D R 1,2 " p0 ď d 1 ď 1q. The transitive closure applied to X " px 1 " x 2 " 0q gives R 1,2 pXq " px 1 ě 0q, and the final result after the descending iteration is X 1 " px 1 ě 0 ^x2 ď 10q. Here, in the same way as in Ex. 3.3, the descending iteration fails to recover the upper bound of x 1 .

In contrast, abstract acceleration converges after two ascending iterations with the invariant X 2 " p0 ď x 1 ď 10 ^0 ď x 2 ď 10q. Hence, even though the derivative closure method elegantly deals with multiple loops by taking the convex union of the derivatives, it is also less precise than abstract acceleration for such programs. However, the main advantage of the derivative closure method is that it is more general than abstract acceleration, because it automatically approximates any kind of transformations. Moreover, since it computes abstract transformers, it is modular and can be used in the context of interprocedural analyses.

τ b pXq " X \ τ pXq \ τ ´`pτ pXq [ Gq t,0 Õ D t,0 ˘`D 0,r Backward acceleration: Translations τ ´bpX 1 q " X 1 \ `pτ ´1pX 1 q Õ p´Dq ˘[ G Translations/resets τ ´bpX 1 q " X 1 \ τ ´1pX 1 q\ \τ ´1´`p τ ´1pX 1 q t,' Õ p´D t,0 q ˘[ D ',r [ G with τ : p G 0 px, ξq hkkkkkkkikkkkkkkj Ax `Lξ ď b ^G1 pξq hkkikkj Jξ ď kq ÝÑ x 1 " Cx `Tξ `u C diagonal

Conclusions and Perspectives

We have presented an extension of abstract acceleration to numerical inputs for forward and backward analysis. Table 5.1 shows a summary of the formulas. This extension is less straightforward than supposed -most notably due to the observation that inputs can be used to turn translations into arbitrary affine transformations; also, resetting variables to input values may cause some subtle behavior. Regarding approximations, Table 5.1 shows the cases where our method is precise in the sense that we perform only dense and convex approximations, and the more complex cases for which additional approximations are necessary to abstract away the number of iterations.

Abstract acceleration can be elegantly integrated into an abstract interpretationbased verification tool, where it is normally used in combination with widening: as pointed out in §5.3.2, it is possible to accelerate the innermost loops precisely while using widening for the outer loops in nested loop situations. Thus, better invariants can be computed for programs for which a lot of information is lost when using widening only (cf. experimental results in §8.4).

In comparison to other abstract interpretation-based transitive closure methods, for instance the affine derivative closure algorithm [START_REF] Ancourt | A modular static analysis approach to affine loop invariants detection[END_REF], abstract acceleration deals only with some frequently occurring types of self-loop transitions and needs to resort to widening in the general case. However, the derivative closure may be less precise in nested loops since it ultimately relies on descending iterations to recover the information about loop guards, whereas abstract acceleration can precisely accelerate the innermost loops.

Improving precision.

Regarding integer (e.g., divisibility) properties, our techniques based on convex polyhedra cannot express them and Rem. 4.1 discusses the effect of the induced dense approximation. To improve on this, we could combine our techniques with the linear congruence abstract domain introduced in [START_REF] Granger | Static analysis of linear congruence equalities among variables of a program[END_REF]. This domain satisfies the finite ascending chain condition, hence it does not require widening nor acceleration. By this means we could tighten the results.

For instance, when px 1 , x 2 q is iteratively translated by p4, 2q starting from p1, 0q, we know from the linear congruences domain that x 1 " 1 mod 4 ^x2 " 0 mod 2. Then, assuming that the abstract acceleration results in a convex polyhedron 1 ď x 1 ^0 ď x 2 ^x1 `x2 ď 4, we can tighten this polyhedron to x 1 " 1 ^0 ď x 2 ď 2.

Compared to Presburger arithmetic, we still limit ourselves to convex sets with such a technique.

Periodic affine transformations with inputs. In this chapter we dealt only with translations (e.g., x 1 " x`2) and resets (e.g., x 1 " 1). Yet, our experiments showed that there are other kinds of transitions in synchronous programs that would be worthwhile to accelerate: variable exchanges (e.g., x 1 1 " x 2 ; x 1 2 " x 1 ) and delays (e.g., x 1 1 " x 2 ; x 1 2 " x 3 ) result in transitions that fall into the category of (ultimately) periodic transformations; hence, we know how to accelerate them by applying Thm. 4.6.

We can extend the abstract acceleration of these transformations to inputs based on Eq. (4.2) τ ˚pX q " Ť 0ďjďq´1 pτ q q ˚pτ j pXqq, where, in the case of inputs, τ q is defined as:

Ź 0ďiďq´1 ´AC i x `LC i ξ i `ř0ďjďi´1 TC j ξ j ´Cj u ď b ¯Ñ ´x1 " C q x `ř0ďjďq´1 TC j ξ j ´Cj u
Then we can accelerate each τ q by relaxing the guard according to §5.1.3 and applying respectively the theorems for translations with inputs (Thm. 5.1) and translations with resets and inputs (Thm. 5.2) in the eigenbasis of C q according to Lem. 4.1. Mind that we need to duplicate the inputs q times. Another interesting case of transitions we encountered are dependencies on unmodified variables (e.g., x 1 1 " x 1 `x2 ; x 1 2 " x 2 ) which we will deal with in the next chapter.

Chapter 6

Revisiting Acceleration

In chapter 5 we considered abstract accelerations of translations and translations with resets, and discussed shortly the general case of (ultimately) periodic transformations. Yet, in our experiments, we encountered transitions which involve dependencies on unmodified variables (e.g.,

x 1 1 " x 1 `x2 ; x 1 2 "
x 2 ) that are not (ultimately) periodic and hence they are not considered accelerable in exact acceleration theory. Nonetheless, intuitively, we should be able to accelerate them. This observation led us to revisit the concept of linear accelerability.

Outline.

We start with a motivating example below. Then we restate the definition of linear accelerability using a characterization based on the Jordan form ( §6.1) of homogenized affine transformations and we show that it is more general than finite monoid acceleration ( §6.2). In §6.3 we generalize abstract acceleration to our linear accelerability criterion. We conclude with a discussion about the practical implications of these results and further research directions in generalizing abstract acceleration ( §6.4).

Motivating example

We give a simple example that is not finite-monoidal: Example 6.1 (Dependencies on unmodified variables I)

τ : tt Ñ x 1 " ˆ1 1 0 1 ˙x with X 0 " p0 ď x 1 " x 2 q x 1 x 2 0 1 2 3 0 1 2 3 4 5 6 7 τ b pXq X G Figure 6.2: Dependencies on unmodified variables: τ : x 1 `x2 ď 7 Ñ x 1 1 " x 1 `x2 ^x1 2 "
x 2 with X 0 " p0 ď x 1 " x 2 ď 4q: reachable integer points and polyhedron computed by abstract acceleration.

We have C k " ˆ1 k 0 1 ˙, which means that it is not finite-monoid (Def. 4.2), and thus not accelerable. And indeed, although the example seems trivial, its transitive closure is not Presburger-definable because of the multiplicative term kx 2 :

τ ˚pX 0 q " tx 1 | Dk ě 0 : x 1 1 " x 1 `kx 2 ^x1 2 " x 2 ^X0 px 1 , x 2 q ^@0 ď k 1 ă k : Gpx 1 `k1 x 2 , x 2 qu
By substituting a dense coefficient α for k (dense approximation) we obtain

Dα P R ě0 : 0 ď x 2 " x 1 ^x1 1 " x 1 `αx 2 ^x1 2 " x 2 " Dα P R ě0 : 0 ď x 1 2 ď x 1 1 ^x1 1 " x 1 2 `αx 1 2 " Dα P R ě0 : 0 ď x 1 2 ď x 1 1 ^x1 2 " 1 1`α x 1 1 " x 1 1 " x 1 2 " 0 _ 0 ă x 1 2 ď x 1 1
We observe that the topological closure of this set, i.e., 0 ď x 1 2 ď x 1 1 , is a convex polyhedron. Hence, a precise abstract acceleration should be possible. Fig. 6.2 illustrates the example with a guard and the result we obtain by abstract acceleration using Prop. 6.1 which we are going to formulate in §6.3.

Linear Accelerability of Linear Transformations

We propose the following definition of linear accelerability: Definition 6.1 (Linear accelerability) A transition τ is linearly accelerable iff its reflexive and transitive closure τ ˚can be written as a finite union of sets

τ ˚" λX. ď l tA l x`kb l | k ě 0, x P Xu
In Def. 4.2 we gave the accelerability criterion based on the matrix C of an affine transformation x 1 " Cx `d, i.e., tC k | k ě 0u is finite ("finite monoid"). This characterization is merely based on the matrix C and it does not takes into account possible correlations between the coefficients of C and d, neither the initial set X. 67

Linear Accelerability of Linear Transformations

In this chapter, we give an alternative characterization based on the homogeneous form of affine transformations: any affine transformation of dimension n can be written as a linear transformation ˆx1

x 1 n`1 ˙" ˆC d 0 1 looooomooooon C 1 ˆx x n`1 ȯf
dimension n`1 and with x n`1 " 1 in the initial set X.

Our criterion considers the Jordan normal form J P C n of C 1 P R n which can be obtained by a similarity transformation J " Q ´1C 1 Q with a nonsingular matrix Q P C n as described in §4.1. J is a block diagonal matrix consisting of Jordan blocks J i associated with the eigenvalues

λ i P C of C 1 .
Furthermore, we have J k " Q ´1C 1 k Q and thus:

J k " ¨Jk 1 . . . 0 . . . . . . . . . 0 . . . J k j ‹ '
We will now examine the linear accelerability of a Jordan block w.r.t. its size and associated eigenvalue: Lemma 6.1 (Jordan block of size 1) A transition τ pXq : x 1 " Jx where J is a Jordan block of size 1 is linearly accelerable iff its associated eigenvalue is either zero or a complex root of unity, i.e., λ P t0u Y te i2π q p | p, q P Nu.

Proof A Jordan block of size m " 1 consists of its associated eigenvalue: J " pλq. The linear acceleration for τ is thus

τ ˚pX q " ď kě0 tλ k x | x P Xu " ď l ta l x`b l k | k ě 0, x P Xu
This means that we have to look for values of λ such that there is a finite number of values for the coefficients a l , b l as solutions of the equation @k ě 0, x P X : λ k x " a l x `bl k. We distiniguish cases according to k:

• k " 0: λ 0 " 1 for any λ, hence a 0 " 1, b 0 " 0.

• k ě 1: By writing λ k in polar form ρ k e iθk we get the solutions # λ " 0, a 0 " 0, b 0 " 0 (i.e., 0 k e iθk " 0x `0k) λ " e i2π q p , a k " e i2π q p k , b k " 0, p, q P N (i.e., 1 k e i2π q p k x " e i2π q p k x `0k). For the second solution, the number of values for a k is finite because they are periodic: e i2π q p " e ip2π q p `2πqjq , j P Z. Hence, there are p distinct values for a k with 0 ď k ď p´1. This yields: λ " 0: τ ˚" λX.X Y t0u

λ " e i2π q p : τ ˚" λX. Ť 0ďlďp´1 t ´ei2π q p l x ¯| x P Xu Lemma 6.2 (Jordan block of size 2) A transition τ pXq : x 1 " Jx where J is a Jordan block of size 2 is linearly accelerable iff its associated eigenvalue is -either zero (λ " 0) or -a complex root of unity (λ P te i2π q p | p, q P Nu) and if in this case the variable associated to the second dimension of the block has only a finite number of values in X.

Proof A Jordan block of size m " 2 has the form J " ˆλ 1 0 λ ˙. The linear acceleration for τ is

τ ˚pX q " X Y Ť kě1 "ˆλ k kλ k´1 0 λ k ˙ˆx 1 x 2 ˙| ˆx1 x 2 ˙P X * " Ť l "ˆa l,1 a l,2 a l,3 a l,4 ˙ˆx 1 x 2 ˙`k ˆbl,1 b l,2 ˙| k ě 0, ˆx1
x 2 ˙P X *

The case k " 0 is the identity for any eigenvalue λ, thus, we concentrate on k ě 1: We have to find values of λ such that there is a finite number of values for the coefficients a l,¨, b l,¨i n the equation @k ě 1, x P X :

" λ k x 1 `kλ k´1 x 2 " a l,1 x 1 `al,2 x 2 `bl,1 k λ k x 2 " a l,3 x 1 `al,4 x 2 `bl,2 k
We distinguish cases by values of k:

• k " 1: The left-hand side of the first equation reduces to λx 1 `x2 . Hence, we can match left and right-hand sides for any values of λ: a 0,1 " a 0,4 " λ, a 0,2 " 1, all other coefficents are 0. • k ě 2: In this case we cannot match kλ k´1 x 2 with a l,2 x 2 , but we can match it with b l,1 k under the assumption that x 2 has a finite number of values in X, which gives us (besides λ " 0) the following solution (p, q P N):

@k ě 2, x P X : $ ' ' ' & ' ' ' % e i2π q p k lo omo on λ k
x 1 `k e i2π q p pk´1q loooomoooon λ k´1

x 2 " e i2π q p k lo omo on

a kx 2 ,1
x 1 `0 lo omo on

a kx 2 ,2 ¨x2 `ei2π q p pk´1q x 2 loooooomoooooon b kx 2 ,1 k e i2π q p k lo omo on λ k x 2 " 0 lo omo on a kx 2 ,3 ¨x1 `ei2π q p k lo omo on a kx 2 ,4
x 2 `0 lo omo on

b kx 2 ,2 ¨k
As in the proof for Lem. 6.1 there is a finite number of values for e i2π q p k because it is periodic. This yields:

λ " 0: τ ˚" λX.X Y "ˆx 2 0 ˙, ˆ0 0 ˙* λ " e i2π q p : τ ˚" $ ' & ' % λX.XY Ť 1ďlďp,x 2 #˜e i2π q p l x 1 `kle i2π q p pl´1q
x 2 e i2π q p l x 2 ¸| x P X, k ě 0 + Lemma 6.3 (Jordan block of size ą 2) A transition τ pXq : x 1 " Jx where J is a Jordan block of size ą 2 is linearly accelerable iff its associated eigenvalue is zero.

Proof Jordan blocks of size m ą 2 have the form: J " Their powers have the form:

J k " ¨λk C k 1 λ k´1 C k 2 λ k´2 . . . C k m´1 λ k´m`1 0 λ k C k 1 λ k´1 . . . C k m´2 λ k´m`2 . . . . . . . . . . . . . . . 0 . . . 0 λ k C k 1 λ k´1 0 . . . 0 0 λ k ‹ ‹ ‹ ‹ ‹ ‹ '
where C k j are the binomial coefficients. For any value of λ ‰ 0 we have polynomials in k of order m, hence we cannot match the coefficients with a linear form in k.

Thus, we have only λ " 0: τ ˚" λX.

Ť 0ďkďm tJ k x | x P Xu
We summarize these results:

Theorem 6.1 (Accelerable linear transformations) A linear transformation τ pXq :

x 1 " C 1 x is linearly accelerable iff its Jordan form consists of Jordan blocks J satisfying the following criteria:

• J is of size 1 and its associated eigenvalue λ P t0u Y te i2π q p | p, q P Nu. • J is of size 2 and its associated eigenvalue λ " 0 or λ P te i2π q p | p, q P Nu, and in the latter case the variable associated with the second dimension of the block has only a finite number of values in X in the Jordan basis.

• J is of size greater than 2 and its associated eigenvalue λ " 0.

Comparison with Finite Monoid Acceleration

The background of the "finite monoid" criterion of Def. 4.2 is the following characterization of Boigelot (Theorem 8.53, [START_REF] Boigelot | Symbolic Methods for Exploring Infinite State Spaces[END_REF]): x 1 " Cx `d is accelerable if Dq ą 0 such that C q is diagonizable and all its eigenvalues are in t0, 1u. In other words: the eigenvalues are either zero or roots of unity and all Jordan blocks of non-zero eigenvalues have size 1. Theorem 6.2 (Jordan form of finite monoid affine transformations) The Jordan form of the homogeneous transformation matrix ˆC d

0 1 ˙, where tC k | k ě 0u is
finite, consists of -Jordan blocks of size 1 with eigenvalues which are complex roots of unity, -at most one block of size 2 with eigenvalue 1 where the variable associated with the second dimension is a constant equal to 1, and -blocks with eigenvalue 0 of any size.

Proof We will show that (1) extending C to the homogeneous form adds the eigenvalue 1 to the spectrum. Hence, only the Jordan blocks in the Jordan form of C associated with an eigenvalue 1 are affected by homogenization, and (2) the Jordan form of the homogenized matrix has at most one Jordan block of size 2 associated to an eigenvalue 1.

(1) follows from the fact that the characteristic polynomial of the homogeneous form is the characteristic polynomial of C multiplied by 1´λ:

det ˆC´λI d 0 1´λ
˙" p1´λq ¨detpC´λIq (because the left-hand side matrix is triangular). The variable corresponding to the dimension added during homogenization is known to equal the constant 1.

(2) We show that the Jordan form of C 1 has at most one Jordan block of size 2 associated with an eigenvalue 1: Assume that the Jordan form of the pn´1q-dimensional matrix C has m´1 blocks of size 1 associated with eigenvalue 1. Then, the homogeneous form C 1 has ' exactly 1 Jordan block of size 2 (with eigenvalue 1) and m´2 blocks of size 1 (with eigenvalue 1) if kerpC 1 ´Iq has dimension m´1, i.e., rankpC 1 ´Iq " n´m`1; ' no Jordan block of size 2 (with eigenvalue 1) and m blocks of size 1 (with eigenvalue 1) if kerpC 1 ´Iq has dimension m, i.e., rankpC 1 ´Iq " n´m.

Since the eigenvalues 1 of C have all geometric multiplicity 1, C´I has n´m linearly independent column vectors. Hence, C 1 ´I has n ´m linearly independent column vectors iff the additional column vector ˆd 0 ˙is not linearly independent from the others; otherwise it has n´m`1 linearly independent column vectors. Hence, we have n´m ď rankpC 1 ´Iq ď n´m`1.

Example 6.2 (Jordan form characterization) Consider C " ¨0 1 0 0 0 1 1 0 0 'and d " p0, 1, 2q T . C has the eigenvalues t1, ´1 2 ˘1 2 i ? 3u. Hence, the homogeneous form C 1 has 4 dimensions (n " 4) and an eigenvalue 1 with algebraic multiplicity m " 2.

The matrix C 1 ´I " ¨´1 1 0 0 0 ´1 1 1 1 0 ´1 2 0 0 0 0 ‹ ‹
' has n ´m `1 " 3 linearly independent column vectors, hence the Jordan form has one block with size 2 associated with the eigenvalue 1.

Assume that d " p´1, 0, 1q T , then C 1 ´I would have only n´m " 2 linearly independent column vectors, hence the Jordan form would have 2 blocks of size 1 associated with the eigenvalue 1. Table 6.1 gives the Jordan form characterization of the homogeneous transformation for the different types of transformations.

Non-finite monoid case.

The only Jordan blocks of size two with non-zero eigenvalue that are considered accelerable by the finite monoid characterization are those with eigenvalue 1 and the second dimension of the block equal to 1 in the initial set X (w.r.t. the Jordan basis).

The criterion of Thm. 6.1 is slightly more general: It identifies furthermore those transformations as accelerable where the eigenvalue is a root of unity and the second dimension of the block has a finite set of values in the initial set X.

We give two examples for such transformations and show how to accelerate them: 71 6.2. Comparison with Finite Monoid Acceleration transition type ult. per.

Jordan form Translations

x 1 " I pnq x `d, d ‰ 0 p " 0, l " 1 ' 1 translation block ' n´1 identity blocks Translations with resets

x 1 " ˆ0pmq 0 0 I pn´mq ˙x`ˆd d 1 ˙, d 1 ‰ 0 p " 1, l " 1
' m nilpotent blocks of size 1 ' 1 translation block ' n´m´1 identity blocks Purely periodic transformations

x 1 " Cx `d, C l " I
p " 0 ' rotation (by θ " 2π q i p i ) blocks ' zero or one translation blocks (depending on d) Ultimately periodic transformations λ " e i2π q p , size 1 A pkq denotes a square matrix of size k.

x 1 " Cx `d, C p`l " C p p ą 0 ' rotation (by θ " 2π q i p i ) blocks ' nilpotent
τ : x 1 `2x 2 ď 6 Ñ x 1 " ˆ1 1 0 1 ˙x with X 0 " px 1 " 0 ^x2 P t2, 3, 4uq
We can exactly accelerate the loop τ by enumerating the values of x 2 in X 0 and translating x 1 by each of these values:

τ ˚pX 0 q " tpx 1 1 , 2q | Dk ě 0 : x 1 1 " x 1 `2k ^X0 pxq ^@0 ď k 1 ă k : x 1 1 ď 2uY tpx 1 1 , 3q | Dk ě 0 : x 1 1 " x 1 `3k ^X0 pxq ^@0 ď k 1 ă k : x 1 1 ď 0uY tpx 1 1 , 4q | Dk ě 0 : x 1 1 " x 1 `4k ^X0 pxq ^@0 ď k 1 ă k : x 1 1 ď ´2u " tp0, 2q, p2, 2q, p4, 2q, p0, 3q, p3, 3q, p6, 3q, p0, 4qu
Example 6.4 (Rotation with translation by rotated variables) The linear transformation

C " ¨0 ´1 1 0 1 0 0 1 0 0 0 ´1 0 0 1 0 ‹ ‹ ' is a rotation by π
2 in dimensions 3 and 4, and it also rotates dimensions 1 and 2 by π 2 while translating them by dimensions 3 and 4 respectively. C has conjugate complex eigenvalues p˘iq 4 " 1 with algebraic multiplicity 2 and geometric multiplicity 1, i.e., it is not finite-monoidal. The Jordan form is

J " ¨´i 1 0 0 0 ´i 0 0 0 0 i 1 0 0 0 i ‹ ‹ '
Let us consider the loop τ : ´9 ď x 1 `x2 ď 9 ^´5 ď x 1 ď 10 Ñ x 1 " Cx with X 0 " tp0, 0, 1, 2qu. Since the values for x 3 and x 4 are finite in X 0 , the transition is accelerable according to Thm. 6.1.

The matrix C is of the form C " ˆJ I 0 J ˙, thus its powers have the form C k " ˆJk kJ k´1 0 J k ˙. Moreover, J has periodicity p " 4. With this information, x 1 " Cx can be accelerated by enumerating the powers of J and the values of x 3 , x 4 in X 0 as follows (cf. proof of Lem. 6.2):

px 1 " Cxq ˚" λX.X Y ď 1ďlďp,x 3 ,x 4 $ ' ' & ' ' % ¨Jl ˆx1 x 2 ˙`klJ pl´1q ˆx3 x 4 Jl ˆx3 x 4 ˙‹ ‹ ' | x P X, k ě 0 , / / .
/ / -Using this formula and taking into account the guard G, τ ˚is computed by

τ ˚pX 0 q " tpx 1 1 , x 1 2 , 1, 2q | Dk ě 0 : x 1 1 " x k 1 ^x1 2 " x k 2 xk 1 " x 1 `2 ¨4k ^xk 2 " x 2 ´1 ¨4k ^Xpx 1 , x 2 , 1, 2q ^@0 ď k 1 ă k : Gpx k 1 1 , x k 1 2 , 1, 2qu Y tpx 1 1 , x 1 2 , ´2, 1q | Dk ě 0 : x 1 1 " x k 1 ^x1 2 " x k 2 xk 1 " ´x2 `1p4k`1q ^xk 2 " x 1 `2p4k`1q ^Xpx 1 , x 2 , ´2, 1q ^@0 ď k 1 ă k : Gpx k 1 1 , x k 1 2 , ´2, 1qu Y tpx 1 1 , x 1 2 , ´1, ´2q | Dk ě 0 : x 1 1 " x k 1 ^x1 2 " x k 2 xk 1 " ´x1 ´2p4k`2q ^xk 2 " ´x2 `1p4k`2q ^Xpx 1 , x 2 , ´1, ´2q ^@0 ď k 1 ă k : Gpx k 1 1 , x k 1 2 , ´1, ´2qu Y tpx 1 1 , x 1 2 , 2, ´1q | Dk ě 0 : x 1 1 " x k 1 ^x1 2 " x k 2 xk 1 " x 2 ´1p4k`3q ^xk 2 " ´x1 ´2p4k`3q ^Xpx 1 , x 2 , 2, ´1q ^@0 ď k 1 ă k : Gpx k 1 1 , x k 1 2 , 2, ´1qu
We obtain the result τ ˚pX 0 q " tp0, 0, 1, 2q, p8, ´4, 1, 2q, p1, 2, ´2, 1q, p5, 10, ´2, 1q, p´4, 2, ´1, ´2q, p´3, ´6, 2, ´1qu

See Fig. 6.3 for a plot of these points. x 1

x 2 τ b pXq X G px 3 , x 4 q " p´2, 1q px 3 , x 4 q " p´1, ´2q px 3 , x 4 q " p2, ´1q px 3 , x 4 q " p1, 2q

Figure 6.3: Rotation with translation by rotated variables: reachable integer points and polyhedron computed by abstract acceleration (dark gray, bold frame) projected on plane x 1 , x 2 ; guard G (light gray), the four sets involved in the union (bold lines) with their associated values of x 3 and x 4 .

Generalizing Abstract Acceleration

Thanks to the work of Gonnord et al. [START_REF] Gonnord | Combining widening and acceleration in linear relation analysis[END_REF][START_REF] Gonnord | Accélération abstraite pour l'amélioration de la précision en Analyse des Relations Linéaires[END_REF], abstract acceleration can handle finite monoid transformations. In this section, we will generalize abstract acceleration to the additional case of linearly accelerable transformations we identified in the previous sections, i.e., Jordan blocks of size two with eigenvalues that are roots of unity.

We consider transitions of the form τ :

Ax ď b Ñ x 1 " ˆJ I 0 J looooomooooon C
x where the transformation matrix is in real Jordan form ( §4.1), i.e., J " ˜cos 2π q p ´sin 2π q p sin 2π q p cos 2π q p for conjugate complex eigenvalues e 2π q p , p, q P N, and J " p1q for the eigenvalue 1. We use notations similar to §5.1.2 where we partitioned the dimensions into translated and reset dimensions. Here, we distinguish the translated dimensions T from the non-translated ones N . In the case of conjugate complex eigenvalues, T is t1, 2u and N " t3, 4u, for the eigenvalue 1 we have T " t1u and N " t2u. Then, X ',N for example, denotes the projection of the polyhedron X onto the non-translated dimensions. x T and x N denote the subvectors of translated and non-translated dimensions respectively. ' τ l is expressed as in Eq. 4.3, i.e.:

τ l " ľ 0ďiďl´1 ˜AC i x `ÿ 0ďjďi´1 C j d ď b ¸Ñ x 1 " C l x `ÿ 0ďjďl´1 C j d ' D plq " ˆ0 J l 1 0 0 ˙¨`p X [ Gq ',N ˘with l 1 " pl´1q mod p.
This means that we enumerate the powers of J and translate the dimensions T by the polyhedron D plq corresponding to the pl´1q th power of J. The polyhedron D plq originates from the right upper block in C k x " ˆJk x T kJ k´1 x N 0 J k x N ˙where it over-approximates the set tJ l´1 x N | x P Xu by which the dimensions T are translated.

Proof

The formula is trivially correct for 0 iterations. It remains to show that our formula yields an over-approximation for k ě 1 iterations:

x 1 P Ť kě1 τ k pXq ðñ Dk ě 0, Dx 0 P X, Dx k :

x 1 P τ px k q ^xk " C k x 0 ^@k 1 P r0, ks : Gpx k 1 q ðñ Dk ě 0, Dx 0 P X, Dx pk`l , Dl P r0, p´1s :

x 1 " Ť l τ px pk`l q ^xpk`l " C pk`l x 0 ^@k 1 P r0, pk`ls : Gpx k 1 q ðñ Dk ě 0, Dx 0 P X, Dx pk`l , Dl P r0, p´1s :

x 1 " Ť l τ px pk`l q ^xT pk`l " J l x T 0 `ppk`lqJ l 1 x N 0 ^xN pk`l " J l x N 0 @k 1 P r0, pk`ls : Gpx k 1 q pwith l 1 " pl´1q mod pq ùñ Dk ě 0, Dx 0 P X, Dx pk`l , Dl P r0, p´1s, Dd plqT P D plqT " J l 1 pX [ Gq N :

x 1 " Ť l τ px pk`l q ^xl " τ l px 0 q ^xT pk`l " x T l `ppk`lqd plqT ^xN pk`l " x N l @k 1 P r0, pk`ls : Gpx k 1 q (over-approximation of J l 1 x N l by d plqT q ùñ Dα ě 0, Dx 0 P X, Dx pk`l , Dl P r0, p´1s, Dd plqT P D plqT " J l´1 pX [ Gq N :

x 1 " Ů l τ px pk`l q ^xl " τ l px 0 q ^xT pk`l " x T l `αd plqT ^xN pk`l " x N l Źl Gpx l q ^Gpx pk`l q (dense and convex approximations)

ðñ x 1 P Ů 0ďlďp´1 τ `pτ l pXq [ Gq Õ D plq
The first approximation (ùñ) in the proof due to the projection on the non-translated dimensions occurs only if the non-translated dimensions are not independent from the translated dimensions in the initial set X.

Mind that we do not require as in Thm. 6.1 that the variables corresponding to the non-translated dimensions have a finite number of values in the initial set: this generalization is justified by the dense approximation that we perform (second ùñ in the proof). Figures 6.2 and 6.3 depict the result of the application of Prop. 6.1 to Examples 6.1 and 6.4 respectively. 75 6.4. Conclusions and Perspectives

Conclusions and Perspectives

In this chapter we have seen that the Jordan normal form is a powerful theoretical tool which made us gain more insight into the accelerability of linear transformations. However, there are two challenges in exploiting these results in a practical abstract acceleration approach:

First, we have to build the Jordan form, i.e., we have to compute the eigenvalues of the transformation matrix and their algebraic and geometric multiplicities. Determining the eigenvalues requires finding the roots of the characteristic polynomial, which is a hard problem: by the theorem of Abel-Ruffini there is no solution based on radicals for polynomials of degree 5 and higher. Hence, in general only numerical approximations can be computed (see, e.g., [START_REF] Wilkinson | The algebraic eigenvalue problem[END_REF]). However, for our characterization it is essential to know whether an eigenvalue (exactly) equals zero or one. Nevertheless, a solution might be possible, because we are only interested in eigenvalues which are 0 or roots of unity.

Second, we have to find and apply an abstract acceleration formula. We have to remark that our theorems and those of Gonnord et al. for abstract acceleration -in contrast to exact acceleration -require to perform a basis change in order to reduce the acceleration problem to the simple cases of translations, resets and the new case introduced in §6.3. However, for above-mentioned reasons this basis change is hard to implement: for instance also the tool Aspic [Gon] does not fully implement Thm. 4.6, but only the case C 2 " C, where no change of basis is necessary. It has not been considered so far, whether there is an abstract acceleration formula of periodic affine transformations for instance which can do without a basis change.

Detecting accelerable sub-transformations.

Another direction for future research could be to detect the maximal linearly accelerable sub-transformations within a general linear transformation or even in a general transition function. Then, the transition function can be decomposed w.r.t. the accelerable dimensions which are treated using abstract acceleration and the non-accelerable dimensions which can be handled with widening or the derivative closure technique.

We will use a similar idea in §8 for accelerating transition functions involving numerical and Boolean variables.

Acceleration of not linearly accelerable transformations.

At last, it would be of great interest to generalize the abstract acceleration concept to not linearly accelerable linear transformations: for example, to compute a reasonably simple, but precise, convex, polyhedral over-approximation of the transitive closure of the self-loop x ď 10 Ñ x 1 " 2x which has an exponential trajectory as a function of time. Computing precise approximations of such behavior is also of high importance in the analysis of hybrid systems (see §10), of which the time-continuous behavior is often specified by linear dynamics 9

x " Cx.

Part II

Verification of Logico-Numerical Systems

Chapter 7

Logico-Numerical Program Analysis: Our Approach

We call programs with numerical and Boolean variables logico-numerical programs. Synchronous data-flow programs, e.g., Lustre programs, count among such programs. We model them as logico-numerical discrete transition systems ( §7.1). Symbolic representations ( §7.2) for such programs and abstract domains for their analysis, as e.g., implemented in the library BddApron [Jea], make use of binary decision diagrams. Such logico-numerical abstract domains are constructed by combining Boolean and numerical abstract values so as to build product or power domains.

State space partitioning ( §7.3) allows CFG representations of discrete dynamical systems to be generated. The overall abstract domain associated with a CFG is a power domain. Hence, the choice of the partition determines the abstract domain, and thus, influences precision and efficiency of the analysis.

Finally, we discuss related work w.r.t. the analysis of logico-numerical programs ( §7.4).

Logico-Numerical Programs

We model logico-numerical programs as deterministic discrete transition systems (see §2.1.1). We include the assertion observer A (see §2.3) in the definition:

Definition 7.1 (Logico-numerical discrete transition system) A logico-numerical discrete transition system xΣ, Υ, f , A, Iy over the state space Σ and the input space Υ is defined as ! Ipsq

Aps, iq Ñ s 1 " f ps, iq where f : Σ ˆΥ Ñ Σ is the vector of transition functions, -Aps, iq Ď pΣ Ñ ℘pΥqq is an assertion constraining the inputs depending on the current state, and -Ipsq Ď Σ defines the initial states.

We use the following notations:

s " pb, xq : state variable vector, with b Boolean and x numerical subvectors i " pβ, ξq : input variable vector, with β Boolean and ξ numerical subvectors Cpx, ξq : vector of constraints over numerical variables (for short C)

The semantics of such a system is defined in the style of Def. 2.2: Definition 7.2 (Semantics) An execution of such a system is a sequence

s 0 i 0 Ý Ñ s 1 i 1 Ý Ñ . . . s k i k Ý Ñ . . .
such that Ips 0 q and for any k ě 0:

Aps k , i k q ^`s k`1 " f ps k , i k q ˘.
Example 7.1 (Logico-numerical program) The following program computes in x 1 the sum over the input ξ for 10 time steps after receiving an input β " tt provided that the input ξ is between 1 and 3. $ ' ' ' ' ' ' ' & ' ' ' ' ' ' ' %

Ipb, x 1 , x 2 q " b ^px 1 " x 2 " 0q 1 ď ξ ď 3 Ñ ¨b1 x 1 1 x 1 2 ‹ ‹ ‹ ‹ ' " ¨ b ^β _ b ^x2 ă 9 " x 1 `ξ if b x 1 else " 0 if β x 2 `1 else ‹ ‹ ‹ ‹ '
We distinguish the Boolean and numerical components of the transition function: ˆb1

x 1 ˙" ˆf b ps, iq f x ps, iq

Ȧ

Boolean transition function is written as a Boolean formula ϕ involving Boolean variables and numerical constraints:

f b ps, iq " ϕpb, β, Cq
A numerical transition function is written as a disjunction of guarded actions:

f x ps, iq " ł j
`aj px, ξq if g j pb, β, Cq with Ž j g j and pg i ^gj q for i ‰ j. The guards g j are Boolean formulas involving Boolean variables and numerical constraints and the actions a j are arithmetic expressions without tests. The program in Ex. 7.1 conforms to these notations.

Symbolic Representations

The library BddApron [Jea] provides symbolic representations for logico-numerical programs and abstract domains for their analysis.

It exploits the well-known efficiency of Bdds ( §7.2.1) for representing logico-numerical formulas, functions ( §7.2.2) and abstract values, ( §7.2.3).

Introduction to Binary Decision Diagrams

Binary decision diagrams (Bdds) were introduced by Bryant [Bry86, Bry92] as a representation of Boolean functions B m Ñ B. In this section we briefly summarize the most important concepts. For further details we refer to textbooks, e.g., [START_REF] Meinel | Algorithms and Data Structures in VLSI Design: OBDD Foundations and Applications[END_REF].

The basic idea is to recursively apply the Shannon expansion f " f rb Ð tts _ f rb Ð ffs to the variables b occurring in f in order to build a decision tree (Fig. 7.1a): the

Representations of the Boolean function f pb 1 , b 2 , b 3 q " b 1 pb 2 ô b 3 q _ b 1 ^ b 3 : solid edge = tt, dashed edge = ff (cf. [Jea00]).
inner nodes of the tree are labeled with the variables b, the leaves (terminal nodes) are labeled with the truth values tt, ff, and the edges are labeled with the truth value of the decision on the parent node tt, ff. Such a decision tree can be structurally represented as a formula with the help of the if-then-else operator itepb, f rb Ð tts, f rb Ð ffsq.

If the Shannon expansion is applied using the same order of variables on all branches, then the binary decision diagram is called ordered (OBDD).

In order to obtain a Bdd in the narrow sense, it must be compressed to a reduced, ordered binary decision diagram (ROBDD, Fig. 7.1b): (1) Identical subgraphs are merged, and (2) nodes of which both children are identical subtrees are removed.

The result is a directed, acyclic graph such that (a) all non-terminal nodes have two children, (b) there is a single root (which has no parent), and (c) there are two terminal nodes (without children).

Variable ordering. Given a variable ordering, a Bdd is a canonical representation of a Boolean function. However, the size of the Bdd depends on the ordering of the variables.

Example 7.2 (Variable ordering) For example (cf. [START_REF] Bryant | Graph-based algorithms for boolean function manipulation[END_REF]) the function

f pb 1 , . . . , b 2n q " b 1 ^b2 _ b 3 ^b4 _ . . . _ b 2n´1 ^b2n has -Θp2 n q nodes with the variable ordering b 1 ă b 3 ă . . . ă b 2n´1 ă b 2 ă b 4 ă . . . ă b 2n , and -Θpnq nodes for b 1 ă b 2 ă . . . ă b 2n´1 ă b 2n .
A rule of thumb is that variables related by conjunctions should be close to each other. Finding the best order, though, is an NP-complete problem [START_REF] Bollig | Improving the variable ordering of OBDDs is NP-complete[END_REF]. In practice heuristics, e.g., [START_REF] Rudell | Dynamic variable ordering for ordered binary decision diagrams[END_REF], are used to find a variable ordering minimizing the size of a set of Bdds. Nonetheless, some functions, e.g., the binary encoding of integer multiplication [START_REF] Bryant | On the complexity of VLSI implementations and graph representations of boolean functions with application to integer multiplication[END_REF], have always an exponential Bdd representation regardless of the variable ordering.

Operations. The operations are implemented by recursive traversal of the operand Bdds and by using hashtables to store and reuse already computed subgraphs (see [START_REF] Bryant | Graph-based algorithms for boolean function manipulation[END_REF]). The basic operations are the following (the computational complexity is given in terms of the number of nodes n i of the operands): -apply 2 lifts any binary operator BˆB Ñ B like ^, _ or ñ to Bdds: pB m Ñ BqˆpB m Ñ Bq Ñ pB m Ñ Bq. Complexity: Opn 1 n 2 q.

-apply 1 applies any unary operator B Ñ B, e.g., , to the terminal nodes of the Bdd. Complexity: Optq, where t is the number of terminal nodes. -cofactor f rb Ð cs substitutes the constant c for the variable b. Complexity: Opnq. We can compose these operators to define: -Function composition:

f 1 rb Ð f 2 s " f 1 rb Ð tts ^f2 _ f 1 rb Ð ffs ^ f 2 . Complexity:
Opn 2 1 n 2 q. -Existential quantification Db.f " f rb Ð tts _ f rb Ð ffs. Complexity: Opn 2 q. Some other operations are trivial: -Equality f 1 ô f 2 : since a Bdd is a canonical representation of a Boolean function, it suffices to compare physical equality in memory (pointer equality). Complexity:

Op1q. -Validity f ô tt and unsatisfiability f ô ff amounts to comparing with the constant Bdds for tt and ff respectively. Complexity: Op1q.

Partial evaluation. An important operation in our context is the partial evaluation (see e.g., [START_REF] Neil | Partial Evaluation and Automatic Program Generation[END_REF]) of a Boolean formula f by a Boolean formula g, denoted f Ò g. This can be seen as the generalization of the cofactor operation (f rb Ð cs " f Ò pb ô cq) to formulas. Partial evaluation is implemented by a generalized cofactor operator [CBM89]:

Definition 7.3 (Generalized cofactor) A generalized cofactor f Ò g of a formula f w.r.t. a formula g is a formula h such that g ñ pf ô hq and h is a "smaller" formula than f .

We use the variant of the operator proposed by Raymond [START_REF] Raymond | Compilation efficace d'un langage déclaratif synchrone: Le générateur de code LUSTRE-V3[END_REF].

Example 7.3 (Generalized cofactor) Using this operator we have for example:

pb 1 ^b2 q Ò pb 1 _ b 2 q " b 2
We can easily verify the validity:

$ & % pb 1 _ b 2 q ñ ppb 1 ^b2 q ô b 2 q ðñ b 1 ^b2 _ pb 1 ^b2 _ b 1 ^ b 2 _ b 2 q ðñ tt
Multi-Terminal Binary Decision Diagrams.

These are Bdds with more than two terminal nodes [CMZ `93], i.e., they represent functions B m Ñ E. E can be any type, but in order to preserve canonicity and for implementation reasons it must be equipped with an equality operator and a hash function.

Most operations can be transferred directly from Bdds to MtBdds: for example, apply 2 lifts a binary operator

E 1 ˆE2 Ñ E to pB m Ñ E 1 q ˆpB m Ñ E 2 q Ñ pB m Ñ Eq.
However, some operations need to be adapted to be meaningful: Existential quantification for Bdds combines terminal nodes using _ (see above). In the case of MtBdds we need to use an operator adapted to the type E: A generic solution for combining terminal nodes is the set union Y: then, existential quantification becomes an operator transforming an MtBdd pB m Ñ Eq into an MtBdd pB m Ñ 2 E q. In the case where E is an abstract domain, for example, then the adequate operation is \. Another operation which we are going to use is the product of MtBdds pB m Ñ E 1 q ˆpB m Ñ E 2 q Ñ pB m Ñ pE 1 ˆE2 qq, which can again be implemented using the generic apply 2 operator.

The library CUDD. The library Cudd1 implements Bdds, MtBdds and other variants of binary decision diagrams and many operations on them. The actual implementation of Bdds uses so-called typed decision graphs [START_REF] Billon | Perfect normal forms for discrete programs[END_REF] which allow Bdds to be compressed even further by merging subgraphs that are isomorphic up to negation. Moreover, isomorphic subgraphs are shared among the set of Bdds being manipulated.

Formulas and Functions

In this section we explain the representations and operations for logico-numerical formulas and functions offered by the BddApron library.

Variables of the following types are supported: Boolean, enumerated types, bounded integers and numerical types (integer, rationals, . . . ). Tab. 7.1 lists the (simplified) grammar of expressions of these types. Enumerated types (Etype " label 1 | . . . |label n ) and bounded integers are only syntactic sugar: they are encoded as bit arrays and thus treated as vectors of Booleans -in the following we will employ the term "Boolean" to refer to all these finite data types.

Hence, we can concentrate on four types of expressions:

- This means that the numerical constraints xAconsy are mapped to additional (interpreted) Boolean variables: for example the constraint x ě 0 will be mapped to a new variable p b; this implies that its negation x ă 0 is mapped to p b. See Fig. 7.5 for an example of a mixed Bdd.

Operations on such expressions are simply those defined for Bdds. Mind that existential quantification cannot be applied to a numerical variable but only to a numerical constraint.

However, the problem is that these interpreted Booleans are not semantically independent, i.e., they may be redundant resp. contradictory (see Fig. 7.2). Removing such decisions from such a mixed Bdd is expensive, because it requires a decision procedure w.r.t. the arithmetic theory corresponding to the constraints.

Jeannet [START_REF] Jeannet | Partitionnement Dynamique dans l'Analyse de Relations Linéaires et Application à la Vérification de Programmes Synchrones[END_REF] proposes a more light-weight solution using a "care set", i.e., a Boolean formula that is the disjunction of some valid implications between the numerical constraints occurring in the expressions. This formula is computed on demand using a decision procedure. Then, certain redundant/contradictory decisions can be removed from a mixed Bdd with the help of the generalized cofactor operator.

Arithmetic expressions with tests.

Analogously to xBexpry, xAexpry are represented by mixed MtBdds with arithmetic expressions as terminal nodes: B m xAconsy ˚Ñ xaAexpry. With the help of the operators apply 1 and apply 2 operations are lifted from purely arithmetic expressions to arithmetic expressions with tests. Fig. 7.3 shows as an example the addition of two arithmetic expressions with tests f 1 `f2 .

Further operations on formulas and functions

Vectorization of transition functions with factorization of their guards. In some cases we need to vectorize the actions a j of the numerical transition functions and factorize their common guards, i.e., to transform the system of transition functions

$ & % x 1 1 " f x 1 ps, iq . . . x 1
n " f x n ps, iq into a vector transition function x 1 " ł j `aj px, ξq if g j pb, β, Cq This operation is in fact the MtBdd product Ś j f x j ( §7.2.1) of the numerical transition functions.

Numerically convex formulas.

Sometimes we need to decompose a Boolean formula ϕpb, Cq into a disjunction of numerically convex formulas: decomp convexpϕq " Ž j ϕ b j pbq^ϕ x j pCq where ϕ b j are general purely Boolean formulas and ϕ x j are conjunctions of numerical constraints. This operation can be implemented efficiently by imposing a variable ordering of the Bdd such that the Boolean and numerical variables are separated: for example with a variable order b 1 ă . . . ă b m ă C 1 ă . . . ă C p (Boolean variables towards the root and numerical constraints towards the leaves), the formulas ϕ x j are simply the formulas represented by the paths leading from the nodes with the lowest constraint indices to terminal node tt, and ϕ b j are the formulas guarding these nodes. See Fig. 7.5.

Partial evaluation of a formula by a polyhedron ϕ Ò X.

This operation (cf. [START_REF] Jeannet | Partitionnement Dynamique dans l'Analyse de Relations Linéaires et Application à la Vérification de Programmes Synchrones[END_REF]) simplifies a Bdd or MtBdd by evaluating the numerical decisions (interpreted Booleans) over the polyhedron X along the paths of the decision diagram. Decisions that are valid or unsatisfiable are removed and their predecessor edges are redirected to the respective child nodes.

Abstract Domains

We abstract sets ℘pB m ˆRn q by an abstract domain that combines Boolean formulas, which exactly represent sets ℘pB m q, and a numerical abstract domain N abstracting ℘pR n q. We will consider the following two combinations (cf. §3.3.5):

-the power domain N pB m q (also written B m Ñ N ), and -the product domain ℘pB m q ˆN .

Power Domain B m Ñ N

Values of this domain have the natural representation as MtBdds pB m Ñ N q (cf.

[BCC `03]).

The definitions of the domain operations are summarized in Table 7.2. Operations inherited from the numerical domain are marked with the superscript x.

Our programs use mixed Boolean formulas with numerical constraints ϕpb, Cq P xBexpry to specify the concrete values of initial and error states. Hence, abstraction and concretization operators allow us to convert abstract values into such formulas and vice versa:

-α : xBexpry Ñ pB m Ñ N q -γ : pB m Ñ N q Ñ xBexpry
The γ operator converts the MtBdd into a Bdd by "replacing" the numerical abstract value in the terminal nodes of the MtBdd by the Boolean formula representing the numerical abstract value: γpSq " Ž pg b j ÑX j qPS g b j ^to constraintspX j q, where to constraints : N Ñ xBexpry turns a numerical abstract value into a Boolean expression: for a convex polyhedron, for instance, this is the conjunction of the constraints of its constraint representation.

The binary operators and predicates (Ď x , \ x , [ x , ∇ x ) on numerical abstract domains are lifted to MtBdds with the help of the apply 2 operator, e.g., S 1 \ S 2 :" apply 2 pλX 1 , X 2 .X 1 \ x X 2 qpS 1 , S 2 q. Complexity is Opn 1 n 2 q for the Bdd operations and Opt 1 t 2 q joins of numerical abstract values (where n i are the number of nodes and t i are the number of terminal nodes).

Existential quantification of a numerical variable Dx : S corresponds to applying existential quantification to the numerical abstract values of the terminal nodes: 87 7.2. Symbolic Representations

Inclusion S 1 Ď S 2 = apply 2 pλpX 1 , X 2 q.X 1 Ď x X 2 qpS 1 , S 2 q Abstraction αpϕpb, Cqq = J [ g ϕpb, Cq Concretization γpSq see text Emptyness pS ô Kq = pS ô λb.K x q Union S 1 \ S 2 = apply 2 pλpX 1 , X 2 q.X 1 \ x X 2 qpS 1 , S 2 q Intersection S 1 [ S 2 = apply 2 pλpX 1 , X 2 q.X 1 [ x X 2 qpS 1 , S 2 q Guard intersection S [ g g see text
Transformation

ˆf b f x ˙pSq, ˆf b f x ˙´1 pSq see text Projection Dx : S = apply 1 pλX.Dx : XqpSq Db : S = apply 2 pλpX 1 , X 2 q.X 1 \ x X 2 qpSrb Ñ tts, Srb Ñ ffsq Widening S 1 ∇S 2 = apply 2 pλpX 1 , X 2 q.X 1 ∇ x X 2 qpS 1 , S 2 q
' b S ´S`[ g b g ´g`" b S ´[g g ´S`[g g ' S [ g C g ´g`" pS [ g Cq [ g g ´\ pS [ g Cq [ g g
Transformations (image and pre-image computation) work in a similar manner as the guard intersection.

The widening operator of the numerical abstract domain is applied to the terminal nodes using apply 1 . The Boolean component does not actually need to be widened because the corresponding lattice has finite height Op2 m q, thus we simply take the disjunction of the formulas. Moreover, it is difficult to define a reasonable widening operator: as already mentioned, widening supposes that there is some regularity in the operations as, e.g., translations, but there is no such regularity in Boolean operations. Moreover, Boolean extrapolation operators on Bdds are highly dependent on the variable ordering. Mauborgne [START_REF] Mauborgne | Abstract interpretation using typed decision graphs[END_REF] proposes an operator that over-approximates a Bdd

Inclusion pB 1 , X 1 q Ď pB 2 , X 2 q :" B 1 ñ B 2 ^X1 Ď x X 2 Abstraction αpϕpb, Cqq :" cvxpJ [ g ϕpb, Cqq
Concretization γpB, Xq :" B ^to constraintspXq Canonicalization canpB, Xq :"

" K if B ô ff _ X " K x pB, can x pXqq else Emptiness pB, Xq ô K :" pB, Xq ô K Union pB 1 , X 1 q \ pB 2 , X 2 q :" pB 1 _ B 2 , X 1 \ x X 2 q Intersection pB 1 , X 1 q [ pB 2 , X 2 q :" canpB 1 ^B2 , X 1 [ x X 2 q Guard intersection S [ g g :" cvxpS [ g gq Transformation ˆf b f x ˙ˆB X ˙:" ˆpf b Ò Xq Ò B Ů j a j 7 pX [ pg j Ò Bqq ḟ b f x ˙´1 ˆB X ˙:" ˆBrb Ð pf b Ò Xqs Ů j a j 7´1 pXq [ pg j Ò Bq Ṗrojection Db, Dx : pB, Xq :" pDb : B, Dx : Xq Widening pB 1 , X 1 q∇pB 2 , X 2 q :" pB 1 _ B 2 , X 1 ∇ x X 2 q Table 7
.3: Operations of the logico-numerical product domain ℘pB m q ˆN . by another Bdd that has at most a given number of nodes.

Product domain ℘pB m q ˆN

This domain approximates a set of states coarsely by a conjunction of a Boolean formula and a single abstract value. For example, Jeannet [START_REF] Jeannet | Partitionnement Dynamique dans l'Analyse de Relations Linéaires et Application à la Vérification de Programmes Synchrones[END_REF] considers the product domain ℘pB m q ˆP olpR n q. In such a domain the formula pb ^x ď 2q _ p b ^x ď 4q is abstracted by tt ^x ď 4. This domain is not implemented in BddApron, but its operations can be easily derived from those of the power domain.

The definitions of the domain operations are summarized in Table 7.3. The operations for union and intersection are applied component-wise. Inclusion must hold for both components. The value K requires a canonicalization.

Guard intersection by a Boolean formula with numerical constraints can be implemented by the corresponding operator of the power domain followed by a convexification of the result (cvx): All non-K terminal nodes are joined (\ x ) resulting in an MtBdd of the form itepϕpbq, X, K x q, which is then transformed into the pair pB, Xq with B " itepϕpbq, tt, ffq in constant time.

Transformations can be composed from the previously defined operators using guard intersection and partial evaluation: The postcondition operators, for example, are computed as follows: the numerical constraints in the Boolean transition function are evaluated over the numerical abstract value X and its Boolean variables are evaluated over the Boolean states B; the numerical image is obtained by the convex union of applying the numerical actions a j associated with each case of the if-then-else to the numerical abstract value X constrained by the associated guard g j evaluated over the Boolean states B.

We will mainly use the product domain. Since this abstract domain provides only 7.3. State Space Partitioning relatively coarse approximations, we follow the approach of building a power domain by partitioning the program as explained in the next section §7.3.

State Space Partitioning

Static analysis is usually performed over the CFG of a program. This allows us to assign an abstract value from an abstract domain A to each location ℓ P L of the graph, inducing the power domain A L . However, the basic CFG of a data-flow program, e.g., a Lustre program, consists of a single location.

In order to conduct a classical analysis of such programs using numerical abstract domains, it is necessary to explicitly unfold the Boolean control structure by enumerating the Boolean state space and encoding the Boolean states in locations of a CFG. In addition, by interpreting Boolean input variables as non-deterministic choices, one obtains a CFG that has only numerical transition relations (Fig. 7.6b).

The problem is that this enumeration becomes intractable with larger programs because the number of locations and arcs grows exponentially with the number of Boolean state and input variables respectively (state space explosion problem).

Since we perform a logico-numerical analysis, such an enumeration is not required. Nevertheless, when using the logico-numerical product domain, we would like to benefit from the power domain induced by a CFG in order to enable more precise analyses.

Considering a partition of the state space of a system allows us to generate a CFG ( §7.3.1) by associating to each partition element (equivalence class) to a location. Defining a partition ( §7.3.2) is usually based on heuristics. §7.3.3 describes the partitioning process in practice.

Control Flow Graphs Induced by State Space Partitioning

We extend the definition of a control flow graph (Def. 2.3) by labeling each location ℓ with a location definition (or location invariant) ϕ ℓ . We view ϕ ℓ alternatively as the predicate ϕ ℓ psq or the set tϕ ℓ psq | s P Σu. Definition 7.4 (Partition-induced CFG) A partition-induced CFG xΣ, Υ, L, , Σ 0 y is a directed graph where -Σ and Υ are the state and input spaces, -L is the set of locations; each location ℓ P L is labeled with its location definition ϕ ℓ psq such that the sets ϕ ℓ psq form a partition of Σ, i.e., ϕ ℓ X ϕ ℓ 1 " H for ℓ ‰ ℓ 1 and Ť ℓ ϕ ℓ " Σ. -Ď L ˆR ˆL defines arcs between the locations. The arcs are labeled with a transition relation R P R " pΣ ˆΥ ˆΣq.

-Σ 0 : L Ñ Σ defines, for each location ℓ, the set of initial states, such that Σ 0 pℓq Ď ϕ ℓ psq.

We take into account this location definition in the semantics of Def. 2.3: Definition 7.5 (Semantics) An execution of a partitioned CFG is a sequence

pℓ 0 , s 0 q i 0 Ý Ñ pℓ 1 , s 1 q i 1 Ý Ñ . . . pℓ k , s k q i k Ý Ñ . . .
such that for any k ě 0 : Dpℓ k , R, ℓ k`1 q P : Rps k , i k , s k`1 q ^ϕℓ k`1 ps k`1 q where ℓ P L and s P Σ. $ ' ' ' ' ' ' ' ' ' ' & ' ' ' ' ' ' ' ' ' ' %

b 1 b 1 ℓ 1 ℓ 2 (a) b 1 ^b2 b 1 ^ b 2 b 1 ^ b 2 (b) b 1 2 " tt ^x1 1 " 0 ^x1 2 " 0 b 2 ^x1 ą 9 ^b1 2 " ff b 1 2 " b 2 ^x2 ą 9 x 1 1 " " x 1 `1 if b 2 ^x1 ď 9 x 1 if b 2 x 1 2 " $ & % 0 if b 2 ^x1 ď 9 x 2 `1 if b 2 ^x2 ď 9 x 2 if b 2 ^x2 ą 9 loooooooooooooooooooooooooooooooooooooooooooooooooooooooooomoooooooooooooooooooooooooooooooooooooooooooooooooooooooooon x 1 1 " 0 ^x1 2 " 0 x 1 ą 9 x 2 ď 9 ^x1 2 " x 2 `1 x 1 ď 9x 1 1 " x 1 `1 ^x1 2 " 0 x 2 ą 9
Ipb 1 , b 2 , x 1 , x 2 q " pb 1 ^b2 ^x1 " 0 ^x2 " 0q b 1 1 " b 1 ^ b 2 _ b 1 ^b2 ^x1 ď 9 b 1 2 " b 1 ^ b 2 ^x2 ą 9 x 1 1 " " x 1 `1 if b 1 ^b2 ^x1 ď 9 x 1 else x 1 2 " $ & % x 2 `1 if b 1 ^ b 2 ^x2 ď 9 0 if b 1 ^b2 ^x2 ď 9 x 2 else
^b2 , b 1 ^ b 2 , b 1 ^ b 2 u ( b 1 ^b2 is trivially not reachable, see §7.3.

3).

A partition-induced CFG can be transformed into an equivalent discrete transition system (Def. 2.1.1) xΣ, Υ, R 1 , Iy with R 1 ps, i, s 1 q " Ť pℓ,R,ℓ 1 qP Rps, i, s 1 q X ϕ ℓ 1 ps 1 q and I " Ť ℓPL Σ 0 pℓq. Analysis. The use of a CFG implies the power abstract domain pL Ñ Aq where the concrete states S are connected to their abstract counterparts S 7 by the Galois connection:

S 7 " αpSq " λℓ . αpS X ϕ ℓ q S " γpS 7 q " ď ℓPL γpS 7 ℓ q 91 7.3. State Space Partitioning reachpS 70 q is the least fixed point of

S 7 " S 70 \ λℓ . ğ ℓ 1 PL ´post 7 pS 7 ℓ 1 q [ ϕ ℓ
where S 7 , S 70 P pL Ñ Aq.

Example 7.5 (Analysis) We analyze the CFG in Fig. 7.6a (Ex. 7.4) using the logiconumerical power domain (with intervals) B m Ñ IntpR n q with Kleene iteration and widening pN " 0q: We start with the initial state:

S0 " ´ℓ1 Ñ pb1 ^b2 Ñ x1 P r0, 0s ^x2 P r0, 0sq, ℓ2 Ñ K

The widening sequence converges with

S 1 5 " ´ℓ1 Ñ " pb1 ^b2 Ñ x1 P r0, 8r^x2 P r0, 8rq _ pb1 ^ b2 Ñ x1 P r1, 8r^x2 P r0, 8rq , ℓ2 Ñ pb1 ^ b2 Ñ x1 P r10, 8r^x2 P r0, 8rq
We get the final result after the descending iterations:

S 2 3 " ´ℓ1 Ñ " pb1 ^b2 Ñ x1 P r0, 8r^x2 P r0, 10sq _ pb1 ^ b2 Ñ x1 P r1, 8r^x2 P r0, 10sqq , ℓ2 Ñ p b1 ^ b2 Ñ x1 P r10, 8r^x2 P r0, 10sq
The analysis using the logico-numerical product domain ℘pB m q ˆIntpR n q yields the weaker result: ´ℓ1 Ñ pb1 ^x1 P r0, 8r^x2 P r0, 8rq, ℓ2 Ñ p b1 ^ b2 ^x1 P r10, 8r^x2 P r0, 8rq

7.3.2

Defining Partitions

Techniques for defining partitions were developed in the context of model checking (cf. §3.1) for minimizing and abstracting systems.

Our approach for generating a partition follows the idea of predicate abstraction [GS97, FQ02], which considers the truth values of a finite set of predicates Ψ usually obtained by heuristics. Hence, the generated partition consists of Op2 |Ψ| q equivalence classes, i.e., the possible combinations of conjunctions of the predicates and their negations.

The basic partition we use for verification [START_REF] Jeannet | Partitionnement Dynamique dans l'Analyse de Relations Linéaires et Application à la Vérification de Programmes Synchrones[END_REF] divides the system into initial and error states and those that are neither initial nor error states. The set of predicates is Ψ " Ť j tI j u Y Ť j tE j u where the initial states I and error states E are decomposed into (disjoint) convex formulas I j and E j respectively in order to represent them exactly -taking simply αpIq and αpEq would lead to a coarse approximation if I and E have non-convex numerical parts. Fig. 7.7 shows the schema of such a CFG.

Then, we can further partition the location I ^ E by another set of predicates obtained by a partitioning heuristics. We will propose such heuristics for discrete systems in §8.3 and then for hybrid systems in §13.2.

It can be considered to alternate analysis and partitioning so as to iteratively refine the partition in case the analysis was inconclusive (see §7.4). Such techniques are orthogonal to the one-shot partitioning/analysis approach considered in this thesis.

Partitioning Process

In this section we describe how we implement state space partition of a logico-numerical program.

Boolean analysis. Before starting the actual partitioning process, we perform a cheap reachability analysis of the Boolean abstraction of the system in order to restrict the state space Σ that is going to be partitioned. This analysis ignores the numerical The reachability computation is guaranteed to converge in a finite number of steps because the state space is finite.

I 1 E 1 . . . I ^ E . . . I p E q

Example 7.6 (Boolean analysis) We analyze the following program:

$ ' ' & ' ' % Ipb 1 , b 2 , xq " p b 1 ^b2 ^x " 0q b 1 1 " b 1 ^x ě 0 b 1 2 " b 2 ^x ă 0 x 1 " . . .
After two iterations we reach the fixed point b 1 _ b 2 . Hence, the system has at most three reachable Boolean states.

Incremental partitioning. Partitioning is done by incrementally dividing the locations of the CFG. For all predicates ψ P Ψ, each location ℓ is tried to be split by ψ.

A location can be divided only if ψ splits the location definition ϕ ℓ into two formulas that are neither ϕ ℓ itself nor ff, i.e., pϕ ℓ ^ψ ñ ϕ ℓ q ^pϕ ℓ ^ ψ ñ ϕ ℓ q. The splitting algorithm is listed in Fig. 7.8 and illustrated in Fig. 7.9. Mind that this splitting algorithm results in a fully connected graph. However, many transitions are not feasible. Hence, the CFG is simplified during incremental partitioning:

Simplification of transition functions by origin location. We simplify the transition function f associated to an arc ℓ ℓ 1 by partial evaluation: f Ò ϕ ℓ .

Example 7.7 (Simplification by origin location) We simplify the following transition function associated with an outgoing arc of location ℓ with ϕ ℓ " b 1 :

¨x1 " " x `1 if b 1 ^x ď 9 0 if b 1 _ x ą 9 b 1 1 " b 1 ^ b 2 ^x ą 5 b 1 2 " b 2 ‹ ‹ ' Ò b 1 ô ¨x1 " 0 b 1 1 " f alse b 1 2 " b 2 ' 93 7.3. State Space Partitioning
split location(CFG,ℓ,ψ): if pϕ ℓ ^ψ ñ ϕ ℓ q ^pϕ ℓ ^ ψ ñ ϕ ℓ q then begin add locations ℓ 1 with ϕ ℓ 1 " ϕ ℓ ^ψ and ℓ 2 with ϕ ℓ 2 " ϕ ℓ ^ ψ duplicate arcs: for all incoming (non-loop) arcs pℓ p , R, ℓq: add pℓ p , R, ℓ 1 q and pℓ p , R, ℓ 2 q for all outcoming (non-loop) arcs pℓ, R, ℓ s q: add pℓ 1 , R, ℓ s q and pℓ 2 , R, ℓ s q for all loop arcs pℓ, R, ℓq: add pℓ 1 , R, ℓ 1 q, pℓ 2 , R, ℓ 2 q, pℓ 1 , R, ℓ 2 q and pℓ 2 , R, ℓ 1 q remove ℓ end return CFG Figure 7.8: Incremental partitioning: algorithm for splitting a location ℓ by a predicate ψ. Removal of infeasible arcs. A transition ℓ ℓ 1 is feasible iff Dx, i : ϕ ℓ psq ^s1 " f ps, iq ^ϕℓ 1 ps 1 q. If an arc is proved to be infeasible it is removed. This can be done by checking the satisfiability of the above formula using -an Smt solver, -the abstract post-condition post 7 , or -the Boolean post-condition post b . The latter method removes the least number of arcs, but it is also the least expensive. Observe that the infeasible arcs have been removed in the CFGs in Fig. 7.6. Arc assertions. An arc assertion is the condition that must be satisfied in order to reach the destination location definition ϕ ℓ 1 of a transition. We can over-approximate this condition by computing the Boolean pre-image of the destination location by an arc: gpb, β, Cq " Db 1 : pb 1 ô f b pb, Cqq ^ϕℓ 1 pb 1 , Cq ^Apb, β, Cq.

ϕ ℓ R ℓp,ℓ R ℓ,ℓs R ℓ,ℓ ϕ ℓ ^ψ ϕ ℓ ^ ψ R ℓp,ℓ R ℓp,ℓ R ℓ,ℓs R ℓ,ℓs R ℓ,ℓ R ℓ,ℓ R ℓ,ℓ R ℓ,ℓ (
The arc assertion can also be viewed as a factorization of the guards in the transition function: g Ñ ps 1 " f Ò gq. Fig. 7.10 gives an example for the computation of arc assertions.

R " $ ' ' & ' ' % b 1 1 " b 1 b 1 2 " x ď 9 x 1 " " x`1 if x ď 9 x if x ą 9 (a) b 1 ^ b 2 b 1 b 1 ^b2 (b) x ą 9 Ñ x 1 " x x ď 9 Ñ x 1 " x`1

Alternative Approaches

In this section we discuss related work w.r.t. alternative logico-numerical abstract domains, partition refinement techniques and alternative (not abstract-interpretationbased) approaches to the analysis of logico-numerical programs.

Logico-numerical abstract domains

Mixed BDD domain. Mauras [START_REF] Mauras | Calcul symbolique et automates interprétés[END_REF] proposes mixed Bdds (Boolean formulas with numerical constraints) as a logico-numerical abstract domain. The problem is that the representation is exact, i.e. there is no abstraction. Moreover, mixed Bdds are not well-suited as abstract domain representation, because they have no canonical form and their manipulation is less efficient than the convex representations used by numerical abstract domains. At last, it is difficult to define a widening operator.

Presburger arithmetic and BDDs. Another approach originates from model checking logico-numerical systems. Bultan et al. [BGP97, BGL00, YKTB01] propose a combination of Bdds and Presburger arithmetic as implemented by the library Omega. Omega uses disjunctions of convex polyhedra and divisibility constraints to represent Presburger formulas. However, in order to contain the explosion in number of polyhedra they bound the number of disjunctions and they force the convex hull when the bound is exceeded.

Partition Refinement

The goal of partition refinement is to improve precision in case the analysis result is inconclusive.

Avoiding convex unions. Apart from widening, the main reason for losing precision is the convex approximation in the abstract domain.

Identifying in the CFG the convex unions that lose most precision requires an efficiently computable quantitative measure for precision loss. Jeannet [START_REF] Jeannet | Partitionnement Dynamique dans l'Analyse de Relations Linéaires et Application à la Vérification de Programmes Synchrones[END_REF], for instance, suggests to count the number of equalities lost in the constraint representation of a polyhedron.

Trace partitioning [HT98, RM07] avoids convex unions by distinguishing program paths according to the history of program states and control flow.

Alternative Approaches

Property-based refinement. The prevalent partition refinement methods try to identify the locations where the decisive information to prove the property is lost by the abstraction.

The classical method in model checking for such a property-based, systematic partition refinement uses spurious counterexamples, i.e., behavior that is only present in the abstraction but not in the concrete program. The abstraction is refined by eliminating this behavior.

The well-known CEGAR-method ([CGJ `00], cf. §3.1) is based on computing concrete counterexamples traces corresponding to a spurious abstract counterexample in order to determine the first location where the abstract trace starts to exhibit spurious behavior. Then this location is split such that the spurious counterexample is eliminated. Since finding the coarsest refinement is an NP-hard problem (reduction to partition-into-cliques problem) [CGJ `00], they propose a heuristic algorithm for deriving an appropriate splitting predicate.

In the abstract interpretation context, such a refinement has already been proposed by Wong-Toi [START_REF] Wong-Toi | Symbolic approximations for verifying real-time systems[END_REF]. However, his method makes use of an under-approximated backward analysis -which is difficult to compute -in order to check whether the a counterexample is spurious or not.

Jeannet [JHR99, Jea00, Jea03] proposes heuristic methods for property-based partition refinement (dynamic partitioning) implemented in the tool Nbac. Again, the idea is to split locations based on abstract counterexamples such that potentially "dangerous" paths from initial to error states are cut: the locations privileged are those which allow strongly connected components to be cut in the graph. Candidates for splitting predicates are the arc assertions. Since the only numerical constraints considered for refinement are those occurring in the program source, there is a "finest" partition with a finite number of locations. Thus, in contrast to CEGAR, these heuristics guarantee the termination of the partitioning process.

SMT-based approaches

Alternative approaches for verifying properties about discrete logico-numerical data-flow programs rely on bounded model-checking (cf. [START_REF] Clarke | Bounded model checking using satisfiability solving[END_REF]) or k-induction (cf. [START_REF] Sheeran | Checking safety properties using induction and a sat-solver[END_REF]) techniques, which both exploit the efficiency of modern SMT solvers (see [START_REF]Handbook of Satisfiability[END_REF]).

Hagen and Tinelli [START_REF] Hagen | Scaling up the formal verification of Lustre programs with SMT-based techniques[END_REF] describe the application of these two approaches to the verification of Lustre programs. The transition relation Rpnq " ps n " f ps n´1 , i n qq and the observers Apnq " Aps n , i n q and Gpnq " Gps n q are unrolled k times and then a k-induction-based proof is tried using an SMT-solver: -Base case (i.e., bounded model checking up to k): Like abstract interpretation, k-induction provides unbounded verification. However, there are several differences: k-induction does not explicitly compute the reachable state space, which on the one hand can be an advantage in terms of performance, but on the other hand, the method cannot be used for computing invariants, but only for verifying them. Moreover, there is in general no guarantee for termination. Yet, in combination with bounded model checking, one can falsify properties and obtain counterexamples.

Chapter 8

Logico-Numerical Abstract Acceleration

In this chapter we extend abstract acceleration from purely numerical programs to logico-numerical ones.

The classical approach to applying the abstract acceleration concepts of Gonnord et al. [START_REF] Gonnord | Combining widening and acceleration in linear relation analysis[END_REF][START_REF] Gonnord | Accélération abstraite pour l'amélioration de la précision en Analyse des Relations Linéaires[END_REF] to logico-numerical programs relies on the enumeration of the Boolean state space (see §8.1). However, this technique suffers from the state space explosion. In contrast, our approach alleviates this problem with the help of an analysis in a logico-numerical abstract domain ( §7.2.3) and state space partitioning ( §7.3).

For this purpose we present an efficient method for (i) building an appropriate CFG without resorting to Boolean state space enumeration, and (ii) analyzing it using abstract acceleration. Our methods allow us to treat these two problems independently of each other. Our contributions can be summarized as follows (Fig. 8.1):

1. We propose methods for accelerating self-loops in the CFG of logico-numerical data-flow programs ( §8.2). 2. We define Boolean partitioning heuristics, ( §8.3) which favor the applicability of abstract acceleration and enable a reasonably precise reachability analysis. 3. We provide experimental results ( §8.4) on the use of abstract acceleration enhancing the analysis of logico-numerical programs.

b 0 ∧ x 1 = 0∧ x 2 = 0 x 1 ≤ 9 → x 1 + +; x 2 + + x 1 ≤ 9 → x 1 + +; x 2 + +; b 2 := ¬b 2 x 1 > 9 → x 1 := 0; b 1 := ¬b 1 x 1 > 9 → x 1 := 0; x 2 := 0; b 1 := ¬b 1 Figure 8
.2: Self-loop ready to be accelerated (location b 1 ). Acceleration not applicable (location b 1 ).

Analysis Using Abstract Acceleration

In this section, we describe the classical approach to applying abstract acceleration to the analysis of logico-numerical programs, as followed by the tool Aspic [Gon], for which we propose major enhancements.

Example 8.1 We will try to infer invariants on the following running example:

Ipb, xq " b 0 ^ b 1 ^x0 " 0 ^x1 " 0 ^x2 " 0 tt Ñ $ ' ' ' ' ' ' ' ' ' ' ' ' & ' ' ' ' ' ' ' ' ' ' ' ' % b 1 0 " b 0 _ p b 0 ^x0 ą 10 ^x1 ą 10q b 1 1 " b 1 _ p b 1 ^x0 ą 20q x 1 0 " $ & % x 0 `1 if p b 0 ^ b 1 ^x0 ď 10 ^βq _ pb 0 ^ b 1 ^x0 ď 20q 0 if b 0 ^ b 1 ^x0 ą 10 ^x1 ą 10 x 0 otherwise x 1 1 " " x 1 `1 if b 0 ^ b 1 ^x1 ď 10 ^ β x 1 otherwise x 1 2 " " x 2 `1 if p b 0 ^ b 1 ^px 0 ď 10 ^β _ x 1 ď 10 ^ βqq _ pb 0 ^ b 1 q x 2 otherwise
Numerical acceleration can be applied to self-loops where the numerical state evolves while the Boolean state does not, i.e., the Boolean part of the transition function is the identity (see Fig. ˙" ˆb apx, ξq ˙, where g x pCq Ñ x 1 " apx, ξq is accelerable.

First, Boolean states are enumerated using the techniques described in §7.3, which trivially induce a CFG in which the Boolean part of the transition functions of the self-loops is the identity. However, the guards of the loops might still be non-convex. Transforming the guard into a minimal disjunctive normal form (DNF) and splitting the transition into several transitions, one for each disjunct, yields a CFG with self-loops accelerable according to Def. 8.1. A single self-loop, like in location b 0 ^ b 1 in Fig. 8.3b can now be "flattened" into a transitive closure transition as done in Fig. 4.1b.

In case of multiple self-loops, like in location b 0 ^ b 1 in Fig. 8.3b, a simple "flattening" of the loop is not possible: For the fixed point computation, we must take into account all sequences of self-loop transitions in this location. For the two accelerable loops we have to compute: . . This infinite sequence may not converge, thus in general, widening is necessary to guarantee termination. However, in practice the sequence often converges after the first few elements.

τ b 1 pXq \ τ b 2 pXq \ τ b 2 ˝τ b 1 pXq \ τ b 1 ˝τ b 2 pXq \ τ b 1 ˝τ b 2 98 99 8.2. Logico-Numerical Abstract Acceleration b 0 ∨ ¬b 1 τ (a) Initial CFG ¬b 0 ∧ ¬b 1 b 0 ∧ ¬b 1 b 0 ∧ b 1 x 0 ≤ 10 → x ′ 0 = x 0 + 1; x ′ 2 = x 2 + 1 x 1 ≤ 10 → x ′ 1 = x 1 + 1; x ′ 2 = x 2 + 1 x 0 > 10 ∧ x 1 > 10 → x ′ 0 = 0 x 0 ≤ 20 → x ′ 0 = x 0 + 1; x ′ 2 = x 2 + 1 x 0 > 20 → x ′ 2 = x 2 + 1 (
The technique implemented in Aspic involves expanding multiple self-loops into a graph of which the paths represent these sequences, as shown in Fig. 8.4 in the case of three self-loops, and to solve iteratively the fixed point equations induced by the CFG, using widening if necessary. Moreover, there are also techniques [BFLP08, Gon07, MG11] for detecting circuits of length greater than one and accelerating them by concatenating their transitions. We focus here on self-loops.

Logico-Numerical Abstract Acceleration

Our goal is to exploit abstract acceleration techniques without resorting to a Boolean state space enumeration in order to overcome the limitations of current tools (e.g., [Gon]) w.r.t. the analysis of logico-numerical programs.

In this section, we will first discuss some related issues in order to motivate our approach, before presenting methods that make abstract acceleration applicable to a CFG that now may contain loops with operations on both, Boolean and numerical, variables.

Motivations for Our Approach

A first observation is that identifying self-loops is more complex when Boolean state variables are not fully encoded in the CFG. Indeed, if a CFG contains a "syntactic" selfloop pℓ, τ, ℓq with τ : gpb, x, ξq Ñ pb1 , x 1 q " f pb, x, ξq, there is an "effective" self-loop only for those Boolean states b P ϕ ℓ in location ℓ such that gpb, x, ξq ^b " f b pb, x, ξq is satisfiable 1 . For instance, the self-loop around location b 1 in Fig. 8.2 is not an "effective" self-loop.

This observation also applies to circuits, where, moreover, numerical inputs have to be duplicated: If there is a circuit pℓ, τ 1 , ℓ 1 q and pℓ 1 , τ 2 , ℓq with τ i : g i ps, ξq Ñ s 1 " f i ps, ξq

i 1 2 3 o τ i τ i τ i τ o τ o τ o τ ⊗ 1 τ ⊗ 2 τ ⊗ 1 τ ⊗ 3 τ ⊗ 2 τ ⊗ 3 Figure 8
.4: Computation of three accelerable self-loops τ 1 , τ 2 and τ 3 . τ i and τ o are the incoming resp. outgoing transitions of the location.

b 0 ∨ ¬b 1 τ 1 : ¬b 0 ∧ ¬b 1 ∧ x 0 ≤ 10 → x ′ 0 = x 0 + 1; x ′ 2 = x 2 + 1 τ 2 : ¬b 0 ∧ ¬b 1 ∧ x 1 ≤ 10 → x ′ 1 = x 1 + 1; x ′ 2 = x 2 + 1 τ 3 : b 0 ∧ ¬b 1 ∧ x 0 ≤ 20 → x ′ 0 = x 0 + 1; x ′ 2 = x 2 + 1 τ r Figure 8
.5: Acceleration of Ex. 8.1 in a CFG with a single location: The upper three selfloops are accelerable. The rest of the system is summarized in the transition τ r where the Boolean equations are not the identity. for i " 1, 2, the composed transition has the form τ : gps, ξ, ξ 1 q Ñ s 2 " f ps, ξ, ξ 1 q. This limits in practice the length of circuits that can be accelerated. Here, we will not deal with such circuits and we focus on self-loops.

A naive approach to our problem could be to partition the system into sufficiently many locations, until we get self-loops that correspond to Def. 8.1. This approach is simple-minded for two reasons: (i) There might be no such Boolean states in the program at all; (ii) in the case of Fig. 8.2, simply ignoring the Boolean variable b 2 would make the (syntactic) self-loop accelerable without impacting the precision. More generally, it may pay off to slightly abstract the behavior of self-loops in order to benefit from precise acceleration techniques rather than relying on widening which may lose much more information in the end.

Another important remark is that we do not necessarily need to partition the system into locations to apply acceleration: it is sufficient to decompose the self-loops: Starting from the basic CFG with a single location and a single self-loop, we could split the loop into self-loops where the numerical transition function can be accelerated and the Boolean transition is the identity and a last self-loop where this is not the case. Fig. 8.5 shows the result of the application of this idea to our running example of Fig. 8.3. This allows us to separate the issue of accelerating self-loops in a symbolic CFG, addressed in this section, from the issue of finding a suitable CFG, addressed in §8.3.

Decoupling Numerical and Boolean Transition Functions

We consider self-loops pℓ, τ, ℓq with τ : gps, iq Ñ ˆb1

x 1
˙" ˆf b ps, iq f x ps, iq ˙without any restriction on f b . We use the abstraction ℘pEq " ℘pB m ˆRn q ´Ñ Ð ´π id ℘pB m q ˆ℘pR n q, where π is the function that approximates a set S P E by a Cartesian product, e.g., πppB 1 ˆX1 qYpB 2 ˆX2 qq " pB 1 YB 2 qˆpX 1 YX 2 q. If τ is accelerable in the sense of abstract acceleration, then π ˝τ ˚Ď τ b . Our logico-numerical abstract acceleration method relies on decoupling the numerical and Boolean parts of the transition function τ with

τ b : gps, iq Ñ ˆb1 x 1
˙" ˆf b ps, iq λps, iq. x ˙and τ x : gps, iq Ñ ˆb1

x 1 ˙" ˆλps, iq. b f x ps, iq ˙.
We can approximate τ ˚as follows (Fig. Proof We prove first τ Ď π ˝τb ˝pid Y τ x q: Let S " tpb, xqu, then τ b pSq " tpb 1 , xqu, τ x pSq " tpb, x 1 qu, and τ pSq " tpb 1 , x 1 qu: tpb, xq, pb, x 1 qu Ď pid Y τ x qpSq " S 1 ñ tpb 1 , xq, pb 2 , x 1 qu Ď τ b pS 1 q " S 2 with tpb 2 , x 1 qu " τ b ptpb, x 1 quq ñ tpb 1 , x 1 qu Ď πpS 2 q " S 3 The graphical intuition of these steps is depicted in Fig. 8.7. We conclude by τ Ď π ˝τb ˝pid Y τ x q ñ τ Ď π ˝τb ˝τ x pbecause of pid Y τ x q Ď τ x q ñ τ ˚Ď pπ ˝τb ˝τ x q Now, we assume that τ x is accelerable in the sense of Def. 8.1, which implies that gps, iq " g b pb, βq ^gx px, ξq and f x ps, iq " apx, ξq. By applying Prop. 8.1, we obtain that pπ ˝τb ˝τ b x q ˚is a sound over-approximation of τ ˚. However, this formula still involves Kleene iteration and thus widening is required (cf. §5.3.1).

But, there exists an alternative in which numerical and Boolean parts are computed in sequence, so that numerical acceleration is applied only once (Fig. 8.6): Proposition 8.2 (Decoupling Boolean and numerical transition functions) If τ x is accelerable, then (1) pπ ˝τb q ˚˝π ˝τ x ˝π is idempotent, and (2) τ ˚Ď pπ ˝τb q ˚˝π ˝τ x ˝π

Proof The intuition for (1) is the following: If the guard g x ^gb is satisfied, i.e., the transition can be taken, then we compute first the transitive closure w.r.t. the numerical states before saturating the Boolean states. The application of τ b does not enable "more"

b 1 1 ^b1 2 ^x1 " 0 x ě 2 Ñ id τ : x ă 2 Ñ $ & % x 1 " x`1 b 1 1 " pb 2 ^x " 0q b 1 2 " pb 1 ^ b 2 ^x " 1q ¬b 1 b 1 ¬b 2 / x = 0 b 2 x = 1 x = 2
Figure 8.9: CFG of a counterexample (left-hand side) to show why the Boolean iterations cannot be computed exactly: the state pff, tt, 2q contained in τ ˚ptptt, tt, 0quq " tptt, tt, 0q, ptt, ff, 1q, pff, tt, 2qu (dots in the right-hand side figure) is not part of π ˝τ b π ˝τ x ˝πptptt, tt, 0quq " tptt, ttq, ptt, ffq, pff, ffqu ˆt0, 1, 2u.

behavior of the numerical variables; hence, re-applying the τ x has no effect. We first compute pπ ˝τb q ˚˝π ˝τ x ˝πpSq:

πpSq " B ˆX τ x ˝πpSq " pB ˆXq Y `pB X pDβ : g b qqˆX 1 with

X 1 s.t. pDξ : appX YX 1 q X g x qq Ď X 1 (i) S 1 " π ˝τ x ˝πpSq " B ˆpX YX 1 q pπ ˝τb q ˚˝π ˝τ x ˝πpSq " S 1 Y S 2 hkkkkkkkkkkkkkkkkikkkkkkkkkkkkkkkkj B 1 ˆ`pX YX 1 q X pDξ : g x q
where

B 1 " Ť kě1 τ k b pB, pX Y X 1 q X pDξ : g x qq and with the property pπ ˝τb qpS 1 Y S 2 q Ď S 2 (ii) S 3 " pπ ˝τb q ˚˝π ˝τ x ˝πpSq " pB YB 1 qˆpX YX 1 q Fig. 8.8 illustrates the sets S, S 1 , and S 3 . S 3 is obviously stable by application of π. We show that it is also stable by application of τ x and π ˝τb , which allows to conclude that pπ ˝τb q ˚˝π ˝τ x ˝πpS 3 q " S 3 , hence the idempotency of the function:

τ x pS 3 q " ppB YB 1 q X pDβ : g b qqˆX 2
with X 2 Ď X 1 because of property (i) above, hence τ x pS 3 q Ď S 3 , and π ˝τ x pS 3 q " S 3 π ˝τb pS 3 q " π ˝τb pS 3 X pB m ˆpDξ : g x qqq " π ˝τb ppB YB 1 q ˆppX YX 1 q X pDξ : g x qqq Ď π ˝τb pS 1 YS 2 q Ď S 3 according to property (ii). Now, we can prove (2): from Prop. 8.1 follows τ ˚Ď pπ ˝τb ˝τ x q " ppπ ˝τb q ˚˝τ x q Ď ppπ ˝τb q ˚˝π ˝τ x ˝πq " pπ ˝τb q ˚˝π ˝τ x ˝π. For the last step, we use the idempotency of the function and the fact that it includes the identity.

Remark 8.1 (Why not τ b ?) We cannot compute Boolean iterations exactly using τ b instead of pπ ˝τb q ˚. Fig. 8.9 gives a counterexample where τ ˚Ę π ˝τ b ˝π ˝τ x ˝π, which shows that using exact iterations τ b would not give a sound decoupling.

Logico-Numerical Abstract Acceleration

The following theorem implements Prop. 8.2 in the logico-numerical product domain A with the Galois connection ℘pB m ˆRn q ´Ñ Ð ´ά id ℘pB m q ˆP olpR n q (see §7.2.3).

Theorem 8.1 (Logico-numerical abstract acceleration) If a transition τ is such that τ x is accelerable, then τ ˚can be approximated in the logico-numerical product domain A with

τ b pB, Xq " ´´τ b b " X b ‰ ¯˚pBq , X b where • X b " pτ x x q b pXq • pτ x x q b is the abstract acceleration of τ x x : g x px, ξq Ñ x 1 " apx, ξq • τ b b rXspBq " τ b pB, X b [ g pDξ : g x qq • pτ b b rXsq ˚pBq " lfppλB 1 . B Y τ b b rXspB 1 qq. pτ b
b rXsq ˚converges in a finite number of iterations as it is the least fixed point of a monotonic function in the finite lattice ℘pB m q.

In other words, we compute the reflexive and transitive closure X b of τ x using numerical abstract acceleration and saturate τ b partially evaluated over X b .

Proof We prove that τ b pSq over-approximates the result of the formula of Prop. 8.2, i.e., ppπ ˝τb q ˚˝π ˝τ x ˝πqpSq Ď τ b ˝αpSq with S Ď ℘pB m ˆRn q. This over-approximation is due to the convex approximations by the numerical abstract domain Pol pR n q. pπ ˝τb q ˚˝π ˝τ x ˝πpSq " p Ť kě0 τ k b pB, pX Y X 1 q X pDξ : g x qq , X Y X 1 q with πpSq " pB, Xq and X 1 s.t. pDξ : appX YX 1 q X g x qq Ď X 1 (see proof of Prop. 8.2) Ď λpB, Xq. `Ťkě0 τ k b pB, X b [ g pDξ : g x qq , X b q ˘˝αpSq with τ x x " λX.Dξ : apX X g x q due to the soundness of numerical abstract acceleration: pX Y X 1 q Ď pτ x x q b ˝αpXq " X b " λpB, Xq.ppτ b b rX b spBqq ˚, X b q ˝αpSq with the notation τ b b rXspBq " τ b pB, X [ g pDξ : g x qq Then, by τ ˚pSq Ď ppπ˝τ b q ˚˝π˝τ x ˝πqpSq (Prop. 8.2), we conclude τ ˚pSq Ď τ b ˝αpSq.

Mind that, due to the convex approximation of the numerical sets, τ b is not idempotent in general (cf. §5.3.1).

Discussion

At the first glance, the approximations induced by this partial decoupling seem to be rather coarse. However, this is not severe in our context for two reasons:

1. The relations between Boolean and numerical variables that are lost by our method are mostly not representable in the abstract domain A anyway. For example, consider the loop x ď 4 Ñ pb 1 " b; x 1 " x `1q, where b could be the least significant bit of a binary counter for instance: starting from pb, xq P tptt, 0qu the exact reachable set is tttu ˆt0, 2, 4u Y tffu ˆt1, 3, 5u; its abstraction in A is tJu ˆt0 ď x ď 5u. Hence, these relations will also be lost in a standard analysis merely relying on widening. Yet, due to numerical acceleration, we can even expect a better precision with our method. 2. We will apply this method to CFGs (see §8.3) in which the Boolean states defining a location exhibit the same numerical behavior and thus, decoupling is supposed not to seriously affect the precision.

Until now we studied the case of a single self-loop. In the presence of multiple selfloops, we expand the graph in the same way as with purely numerical transitions, e.g., as shown in Fig. 8.4, and we apply Thm. 8.1 to each loop. As in the purely numerical case, widening must be applied in order to guarantee convergence.

Example 8.2 We give the results obtained for Ex. 8.1: Analyzing the enumerated CFG in Fig. 8.3b using abstract acceleration gives 0 ď x 0 ď 21^0 ď x 1 ď 11^x 0 `x1 ď x 2 ď 44 bounding all variables2 . Analyzing the system on a CFG with a single location using decoupling and abstract acceleration still bounds two variables (0 ď x 0 ď 21 ^0 ď x 1 ď 11 ^x0 `x1 ď x 2 ), whereas, even on the enumerated CFG a standard analysis does not find any upper bound at all: 0 ď x 0 ^0 ď x 1 ^x0 `x1 ď x 2 .

Variants

Decoupling accelerable from non-accelerable and Boolean transition functions. Theorem 8.1 applies only if the numerical transition functions are accelerable. If this is not the case, we can reuse the idea of Prop. 8.1, but now by decoupling the accelerable numerical functions (marked by the sub/superscript a) from Boolean and non-accelerable numerical functions (sub/superscripts b and n respectively): However, we cannot remove the Kleene iteration as in Prop. 8.2, because the function τ a depends on non-accelerated numerical variables updated by τ n,b , and hence, widening is needed.

Using inputization techniques. Inputization (see [START_REF] Bres | State abstraction techniques for the verification of reactive circuits[END_REF], for instance) is a technique that treats some state variables as input variables. This method is useful to cut dependencies between the state variables, and thus, to remove loops. For example, it can be employed to reduce `pπ ˝τb q ˚˝π ˘to `π ˝τ 1 b ˝π˘i n Prop. 8.2, where τ 1 b is obtained by inputizing in τ b those Boolean state variables that have a transition function that is neither the identity nor constant.

τ b : ˇˇˇˇˇb 1 0 " b 0 b 1 1 " b 1 b 1 2 " b 2 ^x ě 0 τ 1 b : ˇˇˇˇˇb 1 0 " β 0 b 1 1 " b 1 b 1 2 " β 2 ^x ě 0
where g x ij pCq may be non-convex. The equivalence relation " of Def. 8.2 can be reformulated as b 1 " b 2 ðñ @i@j : g b ij pb 1 q ô g b ij pb 2 q. This last formulation reflects the fact that, in the resulting CFG, the numerical function f x specialized on a location ℓ does not depend any more on b, and hence, the precision loss is supposed to be limited.

Reducing the size of the partition. An option for having a less discriminating equivalence relation is to make equivalent the Boolean states that can execute the same set of numerical actions regardless of the numerical constraints guarding them. Definition 8.3 (Numerical modes (forgetting numerical guards))

b 1 « b 2 ô $ & % @β 1 , C 1 : Apb 1 , β 1 , C 1 q ñ Dβ 2 , C 2 : Apb 2 , β 2 , C 2 q ^f x pb 1 , β 1 , C 1 q " f x pb 2 , β 2 , C 2

q and vice versa

We clearly have "Ď«. For example, if we have two guarded actions b^x ď 10 Ñ x 1 " x`1 and b^x ď 20 Ñ x 1 " x`1, " will separate the Boolean states satisfying resp. b and b, whereas « will keep them together.

Another option is to consider only a subset of the numerical actions, that is, we ignore the transition functions of some numerical variables in Defs. 8.2 or 8.3. One can typically focus only on variables involved in the property. According to our experiments, this method is very efficient, but it relies on manual intervention.

Refining the partition by backward bisimulation. Given a partition, it can be refined by Boolean backward bisimulation (cf. [START_REF] Bouajjani | Minimal model generation[END_REF]). Definition 8.4 (Boolean backward bisimulation) Given an equivalence relation ", its backward Boolean bisimulation equivalence " 8 is defined by

b 1 " 0 b 2 ô b 1 " b 2 ^pIpb 1 q " Ipb 2 qq b 1 " k`1 b 2 ô $ & % @β 1 , C 1 , b 1 1 such that Apb 1 1 , β 1 , C 1 q ^b1 " f b pb 1 1 , β 1 , C 1 q : Db 1 2 , β 2 , C 2 : Apb 1 2 , β 2 , C 2 q ^b2 " f b pb 1 2 , β 2 , C 2 q ^b1 1 " k b 1 2 and

vice versa

The rationale behind this refinement is that partitioning the state space with Def. 8.2 (") and stabilizing it by backward bisimulation yields a CFG with locations that group together states that are reachable (in the graph sense) by the same sequence of numerical actions from an initial state.

Experimental Evaluation

We have implemented the proposed methods in our experimentation tool ReaVer3 on the basis of the logico-numerical abstract domain library BddApron.

Benchmarks. Besides some small, but difficult benchmarks, we used primarily benchmarks that are simulations of production lines (see Fig. library Quest for the LCM language4 , for evaluating scalability. These models consist of building blocks like sources, buffers, machines, routers for splitting and combining flows of material and sinks, that synchronize via handshakes. The properties we want to prove depend on numerical variables, e.g., (1) maximal throughput time of the first element passing the production line, or (2) minimal throughput of the production line.

Inputs could model non-deterministic processing and arrival times, but we did not choose benchmarks with numerical inputs in order to enable a comparison with Aspic [Gon].

Results. We compared our tool ReaVer with NBac [JHR99, Jea00, Jea03] and Aspic. The results are summarized in Discussion. The experimental comparison gives evidence about the advantages of abstract acceleration, but also some potential for future improvement:

-ReaVer can prove a lot of examples where NBac fails: this is due to the fact that abstract acceleration improves precision, especially in nested loops where the innermost loop can be "flattened", which makes it possible to recover more information in descending iterations. -ReaVer seems to scale better than NBac: First, abstract acceleration reduces the number of iterations and fixed point checks. Second, our heuristics generates a partition that is well-suited for analysis -though, for some of the larger benchmarks, e.g., LCM quest 4-1, the dynamic partitioning of NBac starts to pay off, whereas our static partition is more fine-grained than necessary, which makes us waste time during analysis. -Once provided with an enumerated CFG, Aspic is very fast on the smaller benchmarks. However, the current version (3.1) cannot deal with CFGs larger than a few hundred locations. We were surprised that some of the small examples were not proved by Aspic. We found out that this is due to our fixed point iteration strategy that uses a higher widening delay in strongly connected components resulting from the unfolding of multiple self-loops. -The analysis using logico-numerical acceleration proved twice as many benchmarks and turned out to be 20% faster than a standard analysis of the same CFG with widening with delay 2 and two descending iterations. -Applying the more refined partition of Def. 8.2 to our benchmarks had only a minor influence on performance and precision, and not applying inputization had no impact on the verification of properties, but it slowed down the analysis by 25% on average. -Generally, for the benchmarks LCM quest 1 to 4, property 2 was not proved by the tools. Here, the combination of our heuristics with dynamic partitioning for further refining the critical parts of the CFG could help.

Conclusions and Perspectives

We proposed techniques for accelerating logico-numerical transitions, that allow us to benefit from the precision gain by numerical abstract acceleration as used in the tool Aspic, while tackling the Boolean state space explosion problem encountered when analyzing logico-numerical programs. Experimentally, our tool ReaVer is often able to prove properties for the larger benchmarks, unlike the two other tools we tested -and this on CFGs that are ten times smaller than the CFGs obtained by enumeration of the reachable Boolean state space.

Although our method is based on the partial decoupling of the Boolean and numerical transitions, the experiments confirm our intuition that our method generally improves the precision. We attribute this to the following observations: first, numerical abstract acceleration reduces the need for widening; second, the information that we might lose by decoupling would often not be captured by the abstract domain anyway; and at last, the CFG obtained by our partitioning method particularly favors the application of our logico-numerical acceleration method.

Perspectives.

Regarding abstract acceleration, the acceleration of multiple selfloops deserves additional investigation: We explained that, in case of nested loops, we have to resort to widening in order to guarantee convergence. Multiple self-loops, i.e., several self-loops around one location, are a special case of nested loops. Gonnord et al [START_REF] Gonnord | Combining widening and acceleration in linear relation analysis[END_REF][START_REF] Gonnord | Accélération abstraite pour l'amélioration de la précision en Analyse des Relations Linéaires[END_REF] developed abstract acceleration formulas for some special cases of multiple self-loops. In the general case, they apply a graph transformation method based on a partial unfolding (see §8.1) in order to compute more precise fixed points of multiple self-loops. However, this graph transformation is costly since it transforms 1 location with n self-loops into n locations with npn´1q arcs.

In the context of applying Presburger-based acceleration to program parallelization, Beletska et al. [START_REF] Beletska | Computing the transitive closure of a union of affine integer tuple relations[END_REF] propose an interesting approach which avoids this problem: for multiple self-loops τ i " g i Ñ a i , they do not compute p Ť i τ i pXqq ˚, but they use the more efficient, though less precise formula: Ť i ´τi ´Ťj a j pXq ¯˚¯. This computation scheme resembles the one of the derivative closure method of Ancourt et al. [START_REF] Ancourt | A modular static analysis approach to affine loop invariants detection[END_REF] (cf. §5.3.3). This approach could be considered to improve the abstract acceleration of multiple self-loops.

Concerning partition refinement, the combination of our approach with dynamic partitioning à la [START_REF] Jeannet | Dynamic partitioning in linear relation analysis. application to the verification of reactive systems[END_REF] seems to be worth pursuing. In particular, partitioning according to numerical constraints is mandatory for proving properties relying on non-convex invariants -our partitioning techniques partition only the Boolean state space. Such improvements should allow a wider range of benchmarks to be tackled. Chapter 9

Logico-Numerical Max-Strategy Iteration

In this chapter we present a method for applying max-strategy iteration to the analysis of logico-numerical programs. Strategy iteration methods (see §3.4.3) are able to solve the fixed point equation associated with the reachability analysis without the need for a widening operator. They can be applied to template domains, i.e., abstract domains with a priori fixed constraints for which constant bounds are determined during the analysis. However, these techniques are limited to numerical programs. In order to avoid the state space explosion involved in transforming a logico-numerical program into a numerical one, we will use the approach of state space partitioning and abstract interpretation with logiconumerical abstract domains (see §7). Our method is based on max-strategy iteration, to which we will give an introduction in §9.1.

Outline. Our contributions can be summarized as follows (see Fig. 9.1): 1. We describe a method for computing the set of reachable states of a logico-numerical program based on max-strategy iteration ( §9.2). The technique interleaves truncated Kleene iterations over a logico-numerical abstract domain with numerical max-strategy iterations. The method is optimal, i.e., it computes the least fixed point w.r.t. the abstract semantics. 2. We give the results of an experimental evaluation ( §9.3) examining various aspects concerning the efficiency and precision of the approach.

Numerical Max-Strategy Iteration

Preliminaries. We consider programs modeled as control flow graphs ( §2.1.2) over a state space Σ with transition relations R Ď Σ 2 . In the case of affine programs Σ " R n and the relations R are convex polyhedra.

We use the abstract domain of template polyhedra Pol T ( §3.3.3). A template polyhedron pTx ď dq is defined by a template constraint matrix T P R mˆn ; an abstract value is represented by the vector of bounds d P R m where R m " R Y t´8, 8u. The analysis tries to find the smallest values of d representing a fixed point of the semantic equations.

J and K are naturally represented by the bound vectors 8 and ´8 respectively. The domain operations can be performed efficiently with the help of linear programming (LP) solvers.

Max-Strategy Iteration

Max-strategy iteration [GS07a, GS07b, GS08, GS10, GS11] is a method for computing the least solution of a system of equations M of the form δ " F pδq, where δ are the template bounds, and F i , 0 ď i ď n is a finite maximum of monotonic and concave operators R n Ñ R; in our case they are affine functions. The max-strategy improvement algorithm for affine programs is guaranteed to compute the least fixed point of F , and it has to perform at most exponentially many improvement steps, each of which takes polynomial time.

Semantic equations. The equation system M is constructed from the abstract semantics of the program's transitions:

for each ℓ 1 P L : δ ℓ 1 " max ´td 0 ℓ 1 u Y t R 7 pδ ℓ q | pℓ, R, ℓ 1 q P Ru where d 0 " λℓ.

" 8 for ℓ " ℓ 0 ´8 for ℓ ‰ ℓ 0 denotes the initial values of the bounds, and

R 7 pd ℓ q " suptT ℓ 1 x 1 | T ℓ x ď d ℓ ^Rpx, x 1 qu.
We will view d alternatively as the concatenated vector of the bound vectors of all locations and the map L Ñ R m that assigns a vector of bounds d ℓ to each location ℓ: dpℓq " d ℓ . Note, also, that we use δ for denoting the vector of bound variables appearing in syntactic expressions, and d for the vector carrying the actual bounds. δ ℓ,i is the bound variable corresponding to the i th line of the template in location ℓ.

ℓ 0 ℓ 1 ℓ 2 x 1 " 5 x ď 9 ^px 1 " x`1q x ě 10 ^px 1 " xq x ď 0 ^px 1 " xq x ě 1 ^px 1 " x´1q Figure 9.2: CFG of an affine program δ 1,1 " max $ ' ' & ' ' % ´8, supt x 1 | x ď δ 0,1 ^´x ď δ 0,2 ^x1 " 5 u, supt x 1 | x ď δ 1,1 ^´x ď δ 1,2 ^x ď 9 ^x1 " x`1 u, supt x 1 | x ď δ 2,1 ^´x ď δ 2,2 ^x ď 0 ^x1 " x u , / / . / / - δ 1,2 " max $ ' ' & ' ' % ´8, supt ´x1 | x ď δ 0,1 ^´x ď δ 0,2 ^x1 " 5 u, supt ´x1 | x ď δ 1,1 ^´x ď δ 1,2 ^x ď 9 ^x1 " x`1 u, supt ´x1 | x ď δ 2,1 ^´x ď δ 2,2 ^x ď 0 ^x1 " x u , / / .
/ / -Strategies. A strategy µ induces a "subsystem" δ " p F pδq of M in the sense that exactly one argument p F i of the max operator on the right-hand side of each equation δ i " maxp. . . , p F i pδq, . . .q is chosen. Intuitively, this means that a strategy selects exactly one "incoming transition" for each template bound variable in each location ℓ 1 .

Example 9.2 (Strategy) A strategy in the example in Fig. 9.2 corresponds for instance the following system of equations:

δ 0,1 " 8 δ 0,2 " 8 δ 1,1 " supt x 1 | x ď δ 1,1 ^´x ď δ 1,2 ^x ď 9 ^x1 " x`1 u δ 1,2 " supt ´x1 | x ď δ 0,1 ^´x ď δ 0,2 ^x1 " 5 u δ 2,1 " ´8 δ 2,2 " ´8
We see that for δ 1,1 we have chosen the third and for δ 1,2 the second argument of the max operators in the equations of Example 9.1.

One has to compute the least solution lfp M of the system M, where M is defined as

M pdq " max µ in M µ pdq
and with µ pdq " δ " p F pδq pdq " p F pdq.

Max-strategy improvement. lfp M is computed with the help of the max-strategy improvement algorithm (see Fig. 9.3) which iteratively improves strategies µ until the least fixed point lfp µ of a strategy equals lfp M . The least fixed point lfp µ of a strategy µ can be computed by solving the LP problem with the constraint system for each `δℓ 1 " R 7 pδ ℓ q ˘in µ : d ℓ 1 ď T ℓ 1 x 1 ^Tℓ x ď d ℓ ^Rpx, x 1 q 115 9.2. Logico-Numerical Max-Strategy Iteration are required to be monotonic, the bounds are always monotonically increasing and, thus, arguments that have already been selected in previous strategies need not be considered again.

Logico-Numerical Max-Strategy Iteration

We will present an algorithm which enables the use of max-strategy iteration in a logiconumerical context, i.e., programs with a state space B p ˆRn .

Abstract Domain

We consider the logico-numerical abstract domain A " ℘pB p q ˆRm which combines Boolean formulas with template polyhedra. An abstract value S 7 " pB, dq consists of the cartesian product of valuations of the Boolean variables B (represented as Boolean formulas using Bdds for example) and the template bounds d. We define the domain operations:

-Abstraction: Since we are analyzing a CFG with locations L, we have the overall abstract domain Σ 7 " L Ñ A. An abstract value S 7 " λℓ.pB ℓ , d ℓ q P Σ 7 assigns to each location a value of the above logico-numerical domain. Note that the dimension m of d ℓ may depend on ℓ if the templates differ from location to location.

α T pSq " ˆtb | Dx : pb, xq P Su mintd | pb, γ x T pdqq P Su - Concretization: γ T pS 7 q " B ^γx T pdq -Join: ˆB d ˙\T ˆB1 d 1 ˙" ˆB _ B 1 d \ x T d 1 - Image: R ℓ,ℓ 1 7 ˆB d ˙" ˆtb 1 | T ℓ x ď d ^b P B ^Rpb, b 1 , x, x 1 qu sup tT ℓ 1 x 1 | T ℓ x ď d ^b P B ^Rpb, b 1 , x,

1

S :" S 0 2 S 1 " postpSq 3 while stablepS, S 1 q do 4 while p stablepS, S 1 q do S :" S

Algorithm

Our analysis is based on alternating (1) a truncated Kleene iteration over the logiconumerical abstract domain and (2) numerical max-strategy iteration, see Fig. 9.4.

The truncated Kleene iteration (phase (1)) explores the system until a certain criterion is satisfied; we say that the system preliminarily stable. We use the following criterion: we stop Kleene iteration if for all locations the set of reachable Boolean states does not change whatever transition we take. The underlying idea is to discover a subsystem, in which Boolean variables are stable during a presumably larger number of iterations. In such a subsystem numerical variables evolve, while Boolean transitions switch only within the system, i.e., they do not "discover" new Boolean states, until numerical conditions are satisfied that make Boolean variables leave the subsystem.

We use max-strategy iteration (phase (2)) to compute the fixed point for the numerical variables for such a subsystem. Then Kleene iteration (phase (1)) continues exploring the next preliminary stable subsystem. The algorithm terminates in a finite number of steps, as soon as the Kleene iteration of phase (1) has reached a fixed point.

Formal description. See Fig. 9.4. Since we only manipulate abstract quantities, we will omit the superscript 7 in the sequel in order to improve readability.

For phase (1) we use the definitions:

-Initial abstract value: S 0 " λℓ. -Condition for preliminary stability: p stablepS, S 1 q " p@ℓ : B ℓ " B 1 ℓ q -Condition for stability (global convergence): stablepS, S 1 q " pS " S 1 q For phase (2) we define the following: -The max-strategy improvement operator max improve M is defined as described in §9.1. -The operator generate dynamically derives the system of equations for the current preliminary stable subsystem: this means that we restrict the system to those transitions that stay within the subsystem defined by the current Boolean states λℓ.B ℓ .

" J for ℓ " ℓ 0 K for ℓ ‰ ℓ 0 -Post-condition: postpSq " λℓ 1 .Spℓ 1 q \ Ů ℓ R ℓ,ℓ 1 pSpℓqq 117 9.2. Logico-Numerical Max-Strategy Iteration ℓ 0 ℓ 1 ℓ 2 b 1 1 ^b1 2 ^x1 " 0 pb 1 1 " b 1 q ^pb 1 2 " b 2 q ^x ď 19 ^x1 " " x`1 if b 1 x´1 if b 1 pb 1 1 " b 1 q ^pb 1 2 " b 2 q ^x ě 20 ^px 1 " xq pb 1 1 " px ď 100qq ^pb 1 2 " b 2 q ^x ě 100 ^px 1 " x´100q $ & % pb 1 1 " b 1 q ^pb 1 2 " b 2 q ^x ď 99x 1 " " x`1 if b 2 x if b 2
For this purpose we conjoin the term b P B ℓ ^b1 P B ℓ 1 to the transition relation in the definition below. Strategies may only contain convex constraints: thus, we transform the relation into disjunctive normal form and generate one strategy per disjunct:

generatepSq " ď ℓ 1 ,ℓ decomp convexpDb, b 1 : R ℓ,ℓ 1 pb, x, b 1 , x 1 q ^b P B ℓ ^b1 P B ℓ 1 q
where decomp convexpR ℓ,ℓ 1 q " Ť j `δℓ 1 " R j ℓ,ℓ 1 pδ ℓ q ˘with R ℓ,ℓ 1 "

Ž j R j ℓ,ℓ 1 and R j ℓ,ℓ 1 convex.
Remark 9.1 Since the bounds d are monotonically increasing, we use the constant strategy δ " d (where d are the previously obtained bounds) as initial strategy for phase (2) (see line 10 in Fig. 9.4). This prevents the numerical max-strategy improvement from restarting with δ " ´8 each time.

We illustrate this algorithm by applying it to the CFG in Fig. 9.5:

Example 9.5 We use the template constraint matrix

ˆ1

´1 ˙which corresponds to an interval analysis. In order to make the presentation more concise, we will write states pℓ Ñ ˆB d ˙q P Σ as ℓ Ñ ˆϕpb 1 , b 2 q r ´δℓ,2 , δ ℓ,1 s ˙where ϕ is a Boolean formula.

The initial state in ℓ 0 is ˆtt r´8, 8s ˙. We start exploring the system by taking transition pℓ 0 , R, ℓ 1 q: ℓ 1 Ñ ˆb1 ^b2 r0, 0s ˙. We continue propagating through pℓ 1 , R, ℓ 1 q:

ℓ 1 Ñ ˆb1 ^b2 r0, 1s ˙. Now, we have reached preliminary stability because none of the transitions makes us discover new Boolean states in the next iteration (pℓ 0 , R, ℓ 1 q and pℓ 1 , R, ℓ 1 q yield nothing new w.r.t. Boolean states and the other transitions are infeasible, i.e., they give K). Hence, we go ahead to phase (2) and extract the numerical equation system for each pℓ, R, ℓ 1 q. E.g. for pℓ 1 , R, ℓ 1 q, we compute:

Db, b 1 : R ^b1 ^b2 ^b1 1 ^b1 2 " px 1 " x`1 ^x ď 19q which gives us the partial equations:

δ 1,1 " supt x 1 | x ď δ 1,1 ^´x ď δ 1,2 ^x1 " x`1 ^x ď 19 u δ 1,2 " supt ´x1 | x ď δ 1,1 ^´x ď δ 1,2
^x1 " x`1 ^x ď 19 u which have to be completed by the other incoming arcs of ℓ 1 . We start the max-strategy iteration with the strategy corresponding to the values obtained in phase (1):

µ " tδ 0 " 8, δ 1,1 " 1, δ 1,2 " 0, δ 2 " ´8u
We observe that we can improve this strategy w.r.t. δ 1,1 :

µ 1 " $ & % δ 1 " 8 δ 1,1 " suptx 1 | x ď δ 1,1 ^´x ď δ 1,2 ^x1 " x`1 ^x ď 19u, δ 1,2 " 0 δ 2 " ´8
, .

-

The max-strategy iteration terminates with:

ℓ 1 Ñ ˆb1 ^b2 r0, 20s ˙.
We continue propagating (phase (1)): By pℓ 1 , R, ℓ 2 q we get ℓ 2 Ñ ˆb1 ^b2 r20, 20s ˙; then pℓ 2 , R, ℓ 2 q results in ˆb1 ^ b 2 r21, 21s ˙; by joining these values we get ℓ 2 Ñ ˆb1 r20, 21s

˙.

Taking pℓ 2 , R, ℓ 2 q a second time does not change the Boolean state:

ℓ 2 Ñ ˆb1 r20, 22s ˙.
Taking any other transition does not discover new Boolean states either, thus, we move on to phase (2) and compute the numerical equation system w.r.t. the current Boolean state: For example for pℓ 2 , R, ℓ 2 q, we compute pDb, b 1 : R ^b1 ^b1 1 q " `px 1 " x`1 _ x 1 " xq ^x ď 99 which results in the partial equations

δ 2,1 " max " supt x 1 | x ď δ 2,1 ^´x ď δ 2,2 ^x1 " x`1 ^x ď 99 u, supt x 1 | x ď δ 2,1 ^´x ď δ 2,2 ^x1 " x ^x ď 99 u * δ 2,2 " max " supt ´x1 | x ď δ 2,1 ^´x ď δ 2,2 ^x1 " x`1 ^x ď 99 u, supt ´x1 | x ď δ 2,1 ^´x ď δ 2,2
^x1 " x ^x ď 99 u * which have to be completed by the other incoming arcs of ℓ 2 . The only possible improvement w.r.t to the current state is w.r.t. δ 2,1 ; phase (2) results in ℓ 2 Ñ ˆb1 r20, 100s ˙.

We continue with phase (1), which filters the above value through pℓ 2 , R, ℓ 1 q augmenting the abstract value in ℓ 1 to ˆb1 r0, 20s ˙. Then, none of the transitions makes the reachable state sets increase (neither Boolean nor numerical), hence we have reached the global fixed point:

ℓ 0 Ñ J, ℓ 1 Ñ ˆb1 r0, 20s ˙, ℓ 2 Ñ ˆb1 r20, 100s 119

Logico-Numerical Max-Strategy Iteration

Note that a logico-numerical analysis in the same domain with widening and descending iterations yields no information about this example: S " λℓ.J.

Application to data-flow programs. For our experiments in §9.3, we used Lustre programs. We generated a CFG using the state space partitioning technique of Def. 8.2. Then, the transition relations are constructed from the transition functions as follows:

R ℓ,ℓ 1 " Dβ :

" x 1 " f x pb, x, β, ξq b 1 " f b pb, x, β, ξq * ^ϕℓ px, bq ^ϕℓ 1 px 1 , b 1 q ^Apb, x, β, ξq
where ϕ ℓ are the location definitions. Boolean input variables β are simply quantified existentially. Numerical inputs ξ appear as auxiliary variables (i.e., variables without associated bounds) in the max-strategy iteration, hence, they are treated without modification of the algorithms.

Properties

Theorem 9.1 (Termination) The logico-numerical max-strategy algorithm terminates after a finite number of iterations.

Proof Termination follows from these observations: (a) Phase (1) only propagates as long as new Boolean states are discovered; the number of Boolean states is finite. (b) Max-strategy iteration is called at most once for each subset of Boolean states. The number of subsets of Boolean states is finite. (c) There is a unique system of numerical equations (built by generate) for each subset of Boolean states. (d) Max-strategy iteration terminates after a finite number of improvement steps, because there is a finite number of strategies and each strategy is visited at most once [START_REF] Gawlitza | Precise relational invariants through strategy iteration[END_REF]. (e) Max-strategy iteration returns the unique least fixed point w.r.t. the given system of equations [START_REF] Gawlitza | Precise relational invariants through strategy iteration[END_REF]. Thus, as soon as all reachable Boolean states have been discovered and the associated numerical fixed point has been computed, the overall fixed point has been reached and the algorithm terminates.

Theorem 9.2 (Soundness) The logico-numerical max-strategy algorithm computes a fixed point of λS.S 0 \ R 7 pSq.

Proof Let us denote ' F " λS.S 0 \ R 7 pSq. ' λS.plfp B F qpSq the truncated Kleene iteration phase (1) (lines 4 to 7 in Fig. 9.4), i.e., λS. `while B ‰ B 1 do S :" S 1 ; S 1 " F pSq end; return S 1 ˘.

' λpB, dq.pB, plfp X F X qpdqq the max-strategy iteration in phase (2) (lines 9 to 16 in Fig. 9.4), i.e., λS. `M " generatepSq; µ :" pδ " dq; µ 1 " max improve M pµ, dq; while µ 1 ‰ µ do µ :" µ 1 ; d :" lfp µ ; µ 1 " max improve M pµ, dq done; return S ˘.

Then, we can write the whole algorithm as lfpppid B , lfp X F X q ˝plfp B F q ˝F q.

Since lfp B F and pid B , lfp X F X q are both extensive, we can under-approximate them by id " λS.S. Hence, we conclude from lfp F Ď lfpp id lo omo on idĎpid B ,lfp X F X q ˝id lo omo on idĎplfp B F q ˝F q that our algorithm computes an over-approximation of the least fixed point, i.e., it is sound.

Theorem 9.3 (Optimality) The logico-numerical max-strategy algorithm computes the least fixed point of λS.S 0 \ R 7 pSq.

Proof Additionally to Thm. 9.2, we have to show that lfpppid B , lfp X F X q ˝plfp B F q ˝F q Ď lfp F . (a) Phase (1) computes a certain number of iterations F k pKq " plfp B F q ˝F pKq taking into account the whole transition system. We trivially have F k pKq Ď lfp F pKq. (b) Phase (2) pid B , lfp X F X q iterates over the transitions of a subsystem. It is known [START_REF] Gawlitza | Precise relational invariants through strategy iteration[END_REF] that it computes the least fixed point w.r.t. this subsystem. Hence, the result of phase (2) cannot go beyond the fixed point of the whole system: pid B , lfp X F X qF k pKq Ď lfp F . (c) We can repeat arguments (a) and (b) for the outer loop:

. . . ˝pid B , lfp X F X q ˝F k 2 ˝pid B , lfp X F X q ˝F k 1 pKq Ď lfp F where k n is the number of iterations in the n th phase (1). Thus, we have ppid B , lfp X F X q ˝F kn q n pKq Ď lfp F for n ě 0. Hence, we conclude from lfpppid B , lfp X F X q ˝plfp B F q ˝F q Ď lfp F and Thm. 9.2 that our algorithm computes the least fixed point, i.e., it is optimal.

Discussion

An important observation is that, since the overall abstract domain is of the form L Ñ ℘pB p q ˆRm , the choice of the CFG has two effects on the performance: first, it determines the set of representable abstract properties, and second, it influences the approximations made in the generation of the numerical equation system for the maxstrategy iteration phase (2), because there is only one template polyhedron per location.

Generalization. The structure of the algorithm we presented is quite general. In particular, it does not depend on the method used to compute the numerical least fixed point in phase (2). We conjecture that the algorithm makes every method, that is able to compute the least fixed point of a numerical system by ascending iterations, compute the least fixed point of a logico-numerical system.

For example, we suppose that our algorithm can be used without any modification with the variant of max-strategy iteration for quadratic programs and quadratic templates proposed in [START_REF] Gawlitza | Computing relaxed abstract semantics w.r.t. quadratic zones precisely[END_REF].

If a method computes the fixed point by descending iterations, as for example minstrategy iteration [CGG `05, GGTZ07], our algorithm can still be used, but requires a small adaptation because the abstract value computed in phase (1), which is an under-approximation of the least fixed point, cannot be used to initialize phase (2), which requires an over-approximation: hence, line 10 in Fig. 9.4 must be replaced by 9.2. Logico-Numerical Max-Strategy Iteration guessing appropriate initial bounds and an initial strategy for phase (2). This makes the algorithm less elegant and the analysis, probably, less efficient.

Logico-numerical max-strategy iteration using a power domain. The algorithm is also rather generic w.r.t. the kind of logico-numerical abstract domain we use. For example, we could consider the logico-numerical power domain B p Ñ ℘pR n q (cf. 7.2.3) where ℘pR n q is abstracted by any domain that is supported by strategy iteration. Then, the overall domain for our method is L Ñ B p Ñ R m . This domain implicitly dynamically partitions each location into sub-locations corresponding to Boolean valuations sharing a common numerical abstract value. The construction of the equation system (generate in our algorithm, Fig. 9.4) must take into account these partitions. This domain is more precise than the product domain described in §9.2, however, the drawback is that the number of partitions might explode if only few Boolean valuations share a common numerical abstract value.

Comparison with logico-numerical min-strategy iteration. The power domain B p Ñ R m is also used by Sotin et al [START_REF] Sotin | Policy iteration within logico-numerical abstract domains[END_REF] who propose an approach to analyzing logico-numerical programs using min-strategies. In accordance with the form of the abstract domain, they consider logico-numerical strategies B p Ñ Π (where Π is the set of min-strategies), which dynamically associates the numerical min-strategies to the reachable Boolean states during analysis. They start with an initial logico-numerical strategy P p0q " λb.π p0q with a chosen numerical min-strategy π p0q and compute a fixed point using logico-numerical Kleene iteration with widening and descending iterations. Then they iteratively improve the min-strategies in P piq and recompute the fixed point. This approach does not integrate well with mathematical programming because the only known method for computing the fixed point of a logico-numerical strategy is logico-numerical Kleene iteration (with widening). Hence, in contrast to our approach, there is no guarantee to compute the least fixed point.

Comparison with abstract acceleration. Numerous methods have been developed to alleviate the problem of bad extrapolations due to widening, e.g., abstract acceleration (see § §4-6 and 8), a method for computing the transitive closure of numerical loops. These methods are able to accelerate some cases of self-loops and cycles with certain types of affine transformations, and they rely on widening in the general case. However, due to the use of general convex polyhedra, they are able to "discover" complex invariant constraints.

In contrast, max-strategy iteration is able to "accelerate" globally the whole transition system regardless of the graph structure or type of affine transformation, and it effectively computes the least fixed point. However, this is only possible on the simpler domain of template polyhedra.

Although the use of template polyhedra is a restriction, this kind of (static) approximation is much more predictable than the (dynamic) approximations made by widening.

Remark 9.2 Guided static analysis [GR07] is a framework for analyzing monotonically increasing subsystems, which makes it possible to reduce the impact of widening by applying descending iterations "in the middle" of an analysis. Our algorithm proceeds in a similar fashion -although for different technical reasons -by applying max-strategy iteration on monotonically increasing subsystems. Alternative approach handling Booleans as integers. A naive approach to treating Booleans is to encode them as integers P t0, 1u p . The advantage is that maxstrategy iteration can be used "as is" by adding template constraints for those Booleans. Yet, such an analysis will yield very rough approximations because templates can only describe convex sets, whereas Boolean state sets are usually highly non-convex.

Experimental Evaluation

We implemented our method in our tool ReaVer ( §14) based on the logico-numerical abstract domain library BddApron [Jea] and the max-strategy iteration solver of Gawlitza et al [START_REF] Dang | Discretizing affine hybrid automata with uncertainty[END_REF]. Since template polyhedra are not yet implemented in the Apron library [JM09], we emulated template polyhedra operations in phase (1) with the help of general polyhedra, which certainly impaired the efficiency -nonetheless we obtained encouraging results.

Benchmarks. We took 18 of the benchmarks used in §8.4, which are Lustre programs of up to a few hundred lines of code, 27 Boolean and 7 numerical variables, which produce enumerated CFGs of up to 650 locations and 5000 transitions after simplification by Boolean reachability. The focus of the experiments was on comparing the precision of the inferred invariants rather than proving properties.

Results. We performed experiments with octagonal constraints (˘x i , x i ˘xj ) in order to evaluate efficiency and precision. We compared max-strategy iteration on the enumerated CFGs (MSI) with logico-numerical max-strategy iteration (LNMSI) on CFGs obtained by the static partitioning method by "numerical modes" described in §8.3. The resulting CFGs are on average five times smaller than the enumerated CFGs for the medium-sized benchmarks.

-LNMSI scales clearly better than MSI (see Fig. 9.6): our method was on average 9 times faster -for those benchmarks where both methods terminated before the timeout: MSI hit the timeout in 8 out of 18 cases (versus 3 for our method). The gain in efficiency grows with increasing benchmark sizes. 123 9.4. Conclusions -The precision is almost preserved: only 0.38% (!) of the bounds were worse but still finite, and 0.16% were lost. This precision loss did not impact the number of proved properties. Due to the better scalability we were even able to prove 3 more benchmarks (10 as opposed to 7). -We compared the precision of LNMSI with octagonal constraints with a logiconumerical analysis with octagons using the standard approach with widening (N " 2) and 2 descending iterations on the same CFG. 18% of the bounds of our invariants were strictly better than those computed using the standard analysis. In two cases, these improvements made the difference to prove the property. However, the standard analysis was 19 times faster on average. Furthermore, we experimented with different templates and CFG sizes: -Thegain in speed increases with the template size: 3.3 for interval analysis (˘x i ), 5

for zones (˘x i , x i ´xj ) and 9 for octagons (for those benchmarks which did not run into timeouts). -The precision of LNMSI depends on the CFG size: the general trend is "the bigger the more precise", but the results are less clear: CFGs of the same size seem to have very different quality w.r.t. precision. Partitioning methods that find good partitions matter! -A smaller CFG does not automatically mean faster analysis: the fact that a smaller graph means more complicated logico-numerical transition functions and more numerical strategies per location outweighs the advantage of dealing with less locations. -It is interesting that LNMSI scales also better on the enumerated CFG: it seems to be advantageous to start with a small system with few strategies, iteratively increase the system, and finally, when computing the numerical fixed point of the full system, most of the strategies are already known not to improve the bounds, and thus max-strategy iteration converges faster. We also experimented with LNMSI using the logico-numerical power domain discussed in §9.2.4, which performed on our CFGs still 6 to 7 times faster and with a 100% preservation of bounds compared to MSI.

Conclusions

We presented logico-numerical max-strategy iteration, a solution to the intricate problem of combining numerical max-strategy iteration with techniques that are able to deal with Boolean variables implicitly and therefore allow to trade off precision for efficiency.

In contrast to the previous attempt of Sotin et al [START_REF] Sotin | Policy iteration within logico-numerical abstract domains[END_REF] of extending strategy iteration to logico-numerical programs, which relies on widening operators to converge, our method enables the use of mathematical programming and hence, it indeed computes the best logico-numerical invariant w.r.t. the chosen abstract domain.

The effectiveness of our method depends on two factors: (1) The choice of the templates: in our experiments, we used mainly octagonal constraints, but we could have used methods for inferring template constraints, e.g., [START_REF] Sankaranarayanan | Scalable analysis of linear systems using mathematical programming[END_REF].

(2) The considered CFG (either of the imperative program, or the one obtained by partitioning in the case of data-flow programs) which determines the abstract domain: the partitioning method by "numerical modes" turned out to be surprisingly effective: compared to the solution based on an enumeration of the reachable Boolean states, the obtained CFGs were 5 times smaller on average, still the precision loss was negligible, i.e., almost zero, and we gained at least one order of magnitude w.r.t. efficiency. Furthermore, we deliver the first experimental results of applying numerical maxstrategy iteration to larger programs: on the one hand max-strategy iteration is guaranteed to compute more precise invariants than standard techniques in the same domain; on the other hand our implementation is not (yet) able to compete with standard techniques w.r.t. efficiency.

Perspectives. Our algorithm is quite generic w.r.t. the numerical analysis method and logico-numerical abstract domain. Yet, in order to tackle efficiency issues evoked above, it would be interesting to design a more integrated logico-numerical max-strategy solver. This would enable us to share more information between subsequent calls to the max-strategy iteration, e.g., to avoid the retesting of strategies that will definitely not lead to an improvement. Beyond that, we could more extensively use SMT-solvers. For instance, checking whether a strategy is an improvement is currently done after having constructed the numerical equation system; it would be beneficial to find the improving strategies already on the logico-numerical level.

We will apply the method presented in this chapter to the analysis of logico-numerical hybrid automata (see §11.2) by extending the hybrid max-strategy iteration method of Dang and Gawlitza [START_REF] Dang | Template-based unbouded time verification of affine hybrid automata[END_REF][START_REF] Dang | Discretizing affine hybrid automata with uncertainty[END_REF] (see also §12.2.2).

Part III

Modeling and Verification of Hybrid Systems

Chapter 10

Hybrid System Modeling

This chapter gives on overview of concepts and languages for hybrid system modeling.

As explained in the introduction, an embedded system (Fig. 1.1) consists of a computer system interacting with its physical environment -in terms of control theory: a (discrete-time) controller and a (continuous-time) plant -which form together a hybrid system. The plant is modeled using differential equations (the physical laws) ( §10.1), whereas the controller is a computer program represented by a discrete transition system. The prevalent model for hybrid system verification is the hybrid automaton ( §10.2), which combines these models.

Numerical simulation languages and tools ( §10.3), e.g., Simulink, are most widely used for hybrid systems modeling. They provide an integrated environment supporting simulation, code generation and test automation. However, their semantics has some peculiarities.

The hybrid synchronous programming language Zelus ( §10.4) tackles these semantical issues. Its semantics is based on non-standard analysis, which allows to specify a deterministic hybrid system semantics independently of numerical integration issues. Moreover, it integrates elegantly with synchronous languages.

Dynamical Systems

We recall a few concepts from continuous dynamical systems. For further details we refer to textbooks, e.g., [START_REF] Stoer | Introduction to Numerical Analysis[END_REF].

Ordinary Differential Equations. An ordinary differential equation (ODE) of order n is of the form

d n x dt n " F ˆt, x, dx dt , d 2 x dt 2 , . . . , d n´1 x dt n´1 ẇith x P R, t P R ě0 .
An ODE of order n can be written as a system of n ODEs of first order:

$ ' & ' % x 1 " x dx k dt " x k`1 for k P r1, n´1s dxn dt " F pt, x 1 , x 2 , . . . , x n q in vector notation: 9 xptq " F pt, xptqq
The existence and uniqueness of a solution to an ODE depends on the continuity of F :

DK P R ě0 : @x 1 , x 2 P R n : ||f px 1 q ´F px 2 q|| ď K ¨||x 1 ´x2 || Theorem 10.1 (Picard-Lindelöf ) If F is Lipschitz continuous, then 9
xptq " F pt, xptqq has a unique solution xptq for a given initial condiiton xp0q " x 0 .

Linear time-invariant systems. A system of ODEs is time-invariant if F does not depend on t: 9

xptq " F pxptqq. The function F can be viewed as a constant vector field R n Ñ R n , which maps each point x to its derivative vector 9

x.

Definition 10.2 (Linear time-invariant system) A linear time-invariant (LTI) system is characterized by the linear ODE system with constant coefficients 9 xptq " Axptq `Bξptq with state variables x P R n , input variables ξ P R m and matrices A P R nˆn , B P R nˆm .

The solution of such a system for the initial conditions xp0q " x 0 is given by:

xptq " e At x 0 `ż t 0 e Apt´t 1 q Bξpt 1 qdt 1 (10.1)

Example 10.1 (LTI system) (see Fig. 10.1)

$ & % x 1 p0q " 0 x 2 p0q " 0 ξptq " 1 9 x 1 ptq " x 2 ptq 9 x 2 ptq " ξptq´x 1 ptq´1 2 x 2 ptq
Differential inclusions. A differential inclusion is given by a relation 9 xptq P F pt, xq. For time-invariant systems we denote this relation V px, 9

xq. A linear differential inclusion with constant coefficients is defined by Axptq `C 9 xptq ď d, i.e., V px, 9 xq is a convex polyhedron.

The set of solutions of the ODE system 9

x " F px, ξq generated by all inputs ξ satisfying a predicate Apx, ξq and the initial conditions xp0q P I equals the set of solutions of the linear differential inclusion V px, 9

xq " Dξ : p 9

x " F px, ξqq ^Apx, ξq with initial conditions xp0q P I. xp0q " 1 @t ě 0 : 3 ď ξptq ď 4 9 xptq " xptq`ξptq , .

ðñ

" xp0q " 1 3 ď 9 xptq´xptq ď 4

Hybrid Automata

Hybrid automata [ACHH92, ACH `95, Hen96, HHWT97] are a well-established formalism for specifying hybrid systems in the context of verification.

Definition 10.3 A hybrid automaton (HA) is a directed graph defined by xL, F, J, Σ 0 y where -L is the finite set of locations; -F : L Ñ V maps a flow relation (a differential inclusion) V px, 9 xq P V to each stat; -J Ď L ˆR ˆL defines a finite set of arcs between locations with the discrete transition relation Rpx, x 1 q P R over the state variables x; and -Σ 0 : L Ñ X maps to each state the set of initial states X 0 P X , which satisfy the condition @ℓ : @x : Σ 0 pℓqpxq ñ D 9

x : F pℓqpx, 9 xq.

Further notations:

-C ℓ pxq " D 9

x : V ℓ px, 9 xq is the staying condition of the flow V ℓ " F pℓq. -G ℓ,ℓ 1 pxq " Dx 1 : Rpx, x 1 q is the guard of the arc pℓ, R, ℓ 1 q P J.

Semantics. We use the following definitions: Let T r0,δs be the set of differentiable trajectories τ : r0, δs Ñ R n . The function flow V ℓ returns the set of end states of trajectories τ starting in the given state x and that obey the flow relation V ℓ :

flow V ℓ pxq " $ ' ' & ' ' % x 1
ˇˇˇˇˇˇˇD δ ą 0, Dτ P T r0,δs : τ p0q " x ^τ pδq " x 1 @δ 1 P r0, δs : C ℓ pτ pδ 1 qq @δ 1 P p0, δq : V ℓ pτ pδ 1 q, 9 τ pδ 1 qq , / / . / / -Definition 10.4 (Semantics) An execution of a hybrid automaton is a (possibly) infinite trace pℓ 0 , x 0 q Ñ pℓ 1 , x 1 q Ñ pℓ 2 , x 2 q Ñ . . . with Ñ"Ñ c Y Ñ d and pℓ, xq Ñ c pℓ 1 , x 1 q ô ℓ " ℓ 1 ^Vℓ " F pℓq ^x1 P flow V ℓ pxq pℓ, xq Ñ d pℓ 1 , x 1 q ô Dpℓ, R, ℓ 1 q P J : Rpx, x 1 q ^Cℓ 1 px 1 q Fig. 10.3 depicts a hybrid automaton and Fig. 10.4 shows some of its possible executions.

Note that the concrete semantics of hybrid automata exhibit three kinds of nondeterminism: -Non-determinism w.r.t. flow transitions, i.e., the choice between different continuous evolutions compatible with the differential inclusions V . -Non-determinism w.r.t. flow and jump transitions: The choice between flow and jump transitions due to an overlapping of staying condition and guards. -Non-determinism w.r.t. jump transitions, which is the choice between several jump transitions. Verification. We will discuss the verification of hybrid automata in §12.

Modeling languages. Hybrid automata are a very low-level formalism and it is cumbersome to use them as a specification or programming language for large systems. However, they can be decomposed into the synchronous product of several hybrid automata in order to enable modular specification in form of hierarchical networks of communicating hybrid automata. This idea is used for example in the languages/tools Shift1 , HyVisual2 [LZ05] (based on the Ptolemy II framework) and Charon3 [ADE `03].

They offer tools for simulation; Charon has also verification support. Conceptually close to these languages are hybrid process calculi, like Hybrid CC4 ("concurrent constraints") [START_REF] Gupta | Hybrid cc, hybrid automata and program verification[END_REF], ϕ-calculus [START_REF] Rounds | The phi-calculus: A language for distributed control of reconfigurable embedded systems[END_REF], and Hybrid Chi5 [vBMR `06]. These languages generally support simulation. Hybrid Chi also provides a translation of subsets of the language to input formats for hybrid and timed automata verification tools, e.g., Uppaal [BLL `95].

Simulation Languages

Although the hybrid automaton model is well-suited for verification, the most widely used modeling languages for hybrid systems are those provided by numerical simulation tools like Simulink [Sim]. They offer features like modularity, hierarchy and a dataflow or equational syntax. We shortly describe some languages and tools and sketch the At last we will discuss some odd phenomena occurring in hybrid systems w.r.t. discrete events and time: there might be an infinite number of discrete transitions in a finite time interval.

Languages

Simulink [Sim] is an integrated tool platform for modeling, simulation, code-generation and test automation of hybrid systems. It has a graphical data-flow-based input language for specifying the continuous and discrete behavior (see Fig. 10.5a). Additionally the Stateflow extension enables automata-based specification of the discrete behavior (rightmost block in Fig. 10.5b).

Scicos6 has features similar to Simulink. Modelica7 [FE98, OEM99] is a standardized language. Its particularity is that it supports equation-based specifications of continuous behavior (differential algebraic equations f px, 9 xq " 0), which are common in physics, e.g., for conservation laws like Kirchhoff's laws. There are several commercial and open source simulator implementations.

Zelus [BCP10, BBCP12, BBCP11a, BBCP11b] (see §10.4) is a recent academic hybrid synchronous data-flow language for modeling, simulation, code-generation and verification (see §11).

Simulators

The simulation of such hybrid models uses numerical ODE solvers for handling continuous evolution. Discrete execution steps that interrupt the continuous-time evolution are triggered by the activation of zero-crossings. A zero-crossing uppzq is an event occurring during the integration of an ODE system 9

xptq " f c pxptqq, when some expression zpxptqq changes sign from negative to positive. A zero-crossing may also be triggered by a discrete execution step.

Such a simulator works as follows (Fig. 10.6): At start, the main simulation loop initializes the ODE solver with an initial state x 0 , a system of ODEs 9

xptq " f c pxptqq, and a finite set of zero-crossing expressions z j . Then the ODE solver integrates using the specified integration method -in Fig. 10.6 an Euler scheme is indicated -until at least one of the zero-crossings is activated. When this happens, the control is given back to the main simulation loop, which executes one or several discrete execution steps s 1 " f d psq before reinitializing the ODE solver and continuing the integration.

For the detection of a zero-crossing, ODE solvers usually have to backtrack and decrease the integration step in order to accurately approximate the point of zero-crossing. Since this is quite expensive and slows down simulation, e.g., Simulink/Stateflow offers the option to execute discrete actions without zero-crossing detection, i.e., the discrete equations s 1 " f d psq are evaluated at every integration step. However, this can easily result in unpredictable behavior.

Peculiar behaviors of hybrid systems

The plant model is often a hybrid system itself because of simplifications and idealizations: for example, fast behaviors like opening of a valve or highly non-linear behavior like the one of diodes are often modeled as discontinuities (jumps), i.e., discrete transitions. These (over-)simplifications of reality, but also the interaction with the discrete controller, can result in peculiar behaviors.

Zeno behavior.

Fig. 10.7 shows the model of a ball that bounces on a surface losing energy: the time interval between the jump transitions decreases to zero. The sum of the time intervals has a limit (the so-called "Zeno point"): time approaches this point, but it cannot advance beyond it. Hence, there is an infinite number of discrete transitions in a finite time interval.

Numerical simulators face difficulties in such "chattering" situations, because the number of events (zero-crossings) explodes and the simulation advances very slowly. Usually, the simulator issues a warning when a certain number of events per time interval is exceeded. Moreover, simulation results are very unpredictible due to numerical errors and the simulation might erroneously continue beyond the Zeno point.

There are methods for "regularizing" and extending certain types of systems beyond the Zeno point [START_REF] Zheng | Beyond Zeno: Get on with it! In Hybrid Systems: Computation and Control[END_REF], but there is no general theory. In practice, Zeno behavior is avoided in design by introducing a threshold below which the system jumps to the asympotic value.

Sliding modes. Chattering along a surface can also arise without time being blocked, like in the following example:

Example 10.3 (Chattering) Assume a system where initially, xp0q " ´1 and 9

xptq " 1; then, every time when x becomes strictly greater than zero (uppxptq), x continues evolving according to the dynamics 9

xptq " ´1, and every time when x becomes strictly less than zero upp´xptqq, x continues with the dynamics 9

x " 1. The resulting trajectory is illustrated in Fig. 10.8a. 133 10.4. Zelus -A Hybrid Synchronous Language 9 y " v9 v " ´9.81ŷ ě 0 Such infinitely fast switching between modes is the principle of sliding mode control, used for non-linear and uncertain systems, e.g., anti-lock braking systems. The goal is to control a system by chattering along the desired trajectory. This trajectory lying "in" the intersection of the switching surfaces is called the sliding mode (Fig. 10.8b). For certain cases of physical systems, the sliding mode behavior can be computed in closed form [START_REF] Aleksei | Differential equations with discontinuous right-hand sides[END_REF][START_REF] Vadim | Sliding modes in Control and optimization[END_REF][START_REF] Acary | Numerical Methods for Nonsmooth Dynamical Systems: Applications in Mechanics and Electronics[END_REF].

y 1 " 5v 1 " 0 v ď 0 ^y " 0v 1 " ´0.6v (a
In some applications, for example, if Ex. 10.3 represented a thermostat system, it would not be desirable to incessantly switch on and off the gas boiler. In such cases one introduces two switching thresholds, i.e., hysteresis, in the model (cf. Fig. 10.3).

Remark 10.1 Chattering in the context of sliding modes cannot be exactly modeled in hybrid automata. We will discuss this issue in §11.1.

Zelus -A Hybrid Synchronous Language

Embedded controllers interact tightly with the plant. Hence, for validation purposes, it is propitious to integrate a plant model into the development process and consider the whole system. For this reason, simulation platforms, like Simulink, have become very popular in industry, because they support such an approach.

However, the semantics of these hybrid simulators is not so well-understood: Usually the semantics is induced by the simulation engine and the multitude of its parameters like fixed or variable integration methods, zero-crossing detection, thresholds and step sizes. Additionally numerical issues due to floating point arithmetics play an important rule. Besides that, there are also strange semantical choices: e.g., in Simulink the evaluation order of the block elements in a diagram depends on their graphical position. All these issues sometimes result in hardly reproducible simulation results with limited trustworthiness. Table 10.1: Zelus syntax (subset).

There are several attempts of designing languages that reconcile the requirements for an easy-to-use all-in-one platform for programming, simulation, and verification of an embedded (hybrid) system, e.g., Ptolemy II [START_REF] Lee | Operational semantics of hybrid systems[END_REF] or Zelus [BCP10, BBCP12, BBCP11a, BBCP11b]. The latter combines the synchronous programming language Lucid Synchrone ( §2.2) with ODEs.

We present the Zelus language in §10.4.1. Interesting is the aspect that the semantics ( §10.4.3) is based on non-standard analysis ( §10.4.2), which allows an "ideal" discretization of the evolution of continuous variables. Thus, it provides an elegant formal definition of the semantics of hybrid systems, which is independent of numerical integration methods.

Actually, non-standard analysis has already been employed by Iwasaki et al [IFS `95] in the context of hybrid systems. Later, Bliudze et al [START_REF] Bliudze | Modelling of complex systems: Systems as dataflow machines[END_REF][START_REF] Bliudze | Un cadre formel pour l'étude des systèmes industriels complexes: un exemple basé sur l'infrastructure de l'UMTS[END_REF] have proposed nonstandard analysis as a semantic domain for specifiying and analyzing hybrid systems. These ideas have then influenced the development of Zelus as well as the imperative language While dt [SH11].

Syntax of Zelus

Zelus is a language in development and hence undergoes an evolution. We present here roughly the (stable) subset of the language presented in [START_REF] Benveniste | A hybrid synchronous language with hierarchical automata: static typing and translation to synchronous code[END_REF]. The syntax rules are listed in Table 10.1).

Most of the constructs are similar to Lucid Synchrone ( §2.2). We explain the additional concepts with the help of examples:

Example 10.4 (Zelus program) The following program describes a ball that starts to move from the initial position x0 with the initial speed v0 as soon as start is enabled. The change of speed is governed by gravity. There is a floor at x " 0 from which it 135 10.4. Zelus -A Hybrid Synchronous Language rebounces with inverted and reduced speed until the speed on hitting the floor falls below a threshold eps. In this case the speed is set to 0 in order to avoid Zeno behavior. let hybrid bouncingball (x0,v0,start,eps) = x where rec der x = v init x0 and der v = -9.81 init 0.0 reset v0 every start | -0.6*(last v) every (up(-x)) | 0.0 every ((up(-x)) on (-v<eps))

In addition to stateless functions and stateful, discrete nodes, Zelus has also stateful, hybrid nodes. Only hybrid nodes may contain ODEs. der x = v init x0 defines an ODE 9

xptq "v with initial condition xp0q "x0. Discontinuities (jumps) are defined by reset handlers: v0 every start states that v will be set to v0 every time the zero-crossing start (here an input of the node) occurs. In the second reset handler, the zero-crossing is defined by (up(-x)), meaning that v will be set to -0.6*v every time x crosses zero from above. The third reset handler sets v to zero if (up(-x)) is activated and the condition (-v<eps) is satisfied. If several zero-crossings are enabled simultaneously, then the first enabled one appearing in the list has priority.

Zelus has also hierarchical automata [START_REF] Benveniste | A hybrid synchronous language with hierarchical automata: static typing and translation to synchronous code[END_REF] with the same features as in Lucid Synchrone (cf. §2.2). Ex. 10.4 can be reformulated using this construct: In this example, jumps are defined by location parameters (v00 in Bounce(v00)) and entry by reset (then): for instance, when the zero-crossing start is activated in location Wait, then we switch to location Bounce where v is initialized with the value of v0 given as parameter.

We will describe the semantics of Zelus in §10.4.3 after having introduced the basics of non-standard analysis which it is based on.

Introduction to Non-Standard Analysis

Non-standard analysis was proposed by Robinson [Rob96] in the 1960s to allow the explicit manipulation of infinitesimals in analysis. Robinson's formulation is an axiomatic approach. We follow here the constructive formulation of Lindstrøm [START_REF] Lindstrøm | An invitation to nonstandard analysis[END_REF], which defines non-standard numbers as equivalence classes of infinite sequences: this is similar to the definition of R as the set of equivalence classes of Cauchy sequences xx n y over rational numbers Q N { " with the equivalence relation xx n y " xy n y ô lim nÑ8 px n ´yn q " 0.

Non-standard real numbers. Non-standard real numbers ‹ R shall extend R with infinitely large numbers and numbers infinitely close to zero (infinitesimals). Hence, an equivalence relation ‹ " must be defined such that ‹ R " R N { ‹ ".

For this purpose a finitely additive8 measure µ over N is fixed with the following properties:

(1) µ : ℘pNq Ñ t0, 1u, (2) µpXq " 0 for all finite sets X, (3) µpNq " 1. This measure partitions ℘pNq into two classes: "small" sets (which include all finite sets) with µ " 0 and "big" sets with µ " 1. The existence of such a measure is proved using Zorn's lemma (see [START_REF] Lindstrøm | An invitation to nonstandard analysis[END_REF] for details).

B P ‹ R is infinitesimal if @a P R ą0 : ´a ă B ă a x P ‹ R is infinite if Da P R ą0 : ´a ă x ă a
For example, x 1 n y is an infinitesimal, because for any a P R the set tn | ´a ă 1 n ă au is infinite and thus µ " 1. Observe that 0 is the only infinitesimal number in R. Conversely, xn 2 y and x´ny, for instance, are positive and negative infinite numbers respectively.

The following proposition describes the relationship between finite real and nonstandard real numbers: Proposition 10.1 (Standard part) [Lin88] Any finite x P ‹ R can be written uniquely as a sum x " a`B where a P R and B is an infinitesimal.

We denote a " stpxq the standard part of x.

The real numbers are embedded within the non-standard reals: the non-standard version ‹ a of a P R is the constant sequence xa, a, a, . . .y.

See Fig. 10.9 for an illustration of the real and non-standard number lines.

Sets, functions and the transfer principle. A non-standard set X " xA n y can be constructed by a sequence of A n P R such that

xa n y P xA n y iff µtn | a n P A n u " 1
Similarly, a non-standard function xf n y : ‹ R Ñ ‹ R can be constructed by a sequence of functions f n : R Ñ R such that xf n ypxx n yq " xf n px n qy Sets and functions constructed in this way are called internal: the construction is applied componentwise to the elements of the sequence. This principle can be generalized to first-order formulas: Theorem 10.2 (Transfer principle) [START_REF] Lindstrøm | An invitation to nonstandard analysis[END_REF] Let denote ϕ a first-order formula over R, and ‹ ϕ its non-standard version, i.e., where all symbols have been replaced by their nonstandard versions. Then

xA n y |ù ‹ ϕ ðñ µtn | A n |ù ϕu " 1
In other words, a first-order formula ϕ is true iff its non-standard version ‹ ϕ is true.

As a consequence all operations over subsets of R carry over to internal subsets of ‹ R, for instance:

a`b xa n y `xb n y " xa n `bn y a ă b xa n y ă xb n y ðñ µtn | a n ă b n u " 1 A X B xA n y X xB n y " xA n X B n y ş A f dx ş xAny xf n ydx " x ş An f n dxy
Hyperfinite sets and non-standard calculus.

In the same way as ‹ R, we can define non-standard natural numbers ‹ N " N{ ‹ " that extend N by infinite natural numbers represented by sequences xa n y of natural numbers a n of which the limit is infinity.

Definition 10.7 (Hyperfinite set) [Lin88] An internal set X " xA n y is called hy- perfinite if µtn | A n is finiteu " 1.
A hyperfinite set is an infinite set with all the combinatorial structure of finite sets: in particular, it has a smallest and greatest element and all other elements have a unique predecessor and a unique successor.

Let us consider the hyperfinite set T " xT n y and an infinite number N " xN n y P ‹ N:

T n " " 0, 1 N n , 2 N n , 3 N n , . . . N n ´1 N n , 1
* and a continuous function f : R Ñ R: we compute the sum

ÿ tPT 1 N ‹ f ptq " C ÿ tPTn 1 N n f pt n q G Since 1
Nn converges towards 0, the right-hand side above converges to the Riemann integral ş 1 0 f ptqdt:

ż 1 0 f ptqdt " st ˜ÿ tPT 1 N ‹ f ptq
Hence, the Riemann integral in R is the standard part of a hyperfinite sum. Now, consider the following standard initial value problem: 9 a " f pa, tq, ap0q " a 0

Assume that the ODE has a solution a : R Ñ R. We rewrite the ODE in its equivalent integral form aptq " a 0 `şt 0 f papτ q, τ qdτ which equals the hyperfinite sum

aptq " st ˜‹a 0 `ÿ tPT 1 N ‹ f p ‹ aptq, tq
By substituting B " 1{N , we get T " tt n " nB | n " 0, . . . , N u and we can write the solution aptq of the initial value problem for n " 0, . . . , N as the standard part stpxqptq of the solution of an equivalent non-standard "hyperdiscrete" dynamical system

xpt 0 q " ‹ a 0 xpt n`1 q " xpt n q `B ¨‹ f pxpt n q, t n q (10.2)
Hence, like the semantics of discrete systems, the semantics of continuous systems can be described by a (non-standard) discrete sequence of states. This is exploited in the semantics of Zelus.

Sketch of the Semantics of Zelus

As in Lucid Synchrone, discrete statements and nodes in Zelus execute on a logical base clock. ODEs, however, execute on continuous (physical) time. The relation between the two is established with the help of zero-crossings: discrete statements are activated by zero-crossings, i.e., the "base clock" of a discrete statement in a hybrid program consists of the instants when its associated zero crossings are enabled.

Example 10.6 (Relating physical and logical time) let node cnt () = n where rec n = 0 fby n+1 let hybrid main () = x where rec der t = 1 init 0 reset 0 every (up (t-10)) and x = (cnt ()) every init or (up (t-10))

One step of the discrete node cnt is executed at the initial instant ("zero-crossing" init) and every time the physical clock t reaches 10. Observe that the output of cnt is discrete, whereas x is a (piecewise-constant) continuous variable.

All discrete behaviors -discrete variable changes, discontinuities of continuous variables, and changes of the dynamics of continuous variables -happen on the activation of a zero-crossing. Hence, an execution of a program starts with an initialization followed by an alternation of a continuous evolution phase and a discrete transition phase. The discrete transition phase may consist of several discrete transitons, because a discrete transition may activate a zero-crossing and thus another discrete transition.

This operational semantics actually emulates the behavior of a simulator described in §10.3 and depicted in Fig. 10.6. Non-standard analysis comes into the semantics w.r.t. the following aspects: 139 10.4. Zelus -A Hybrid Synchronous Language

init uppt´10q pt k´1 ´10 ă 0 ^tk ´10 ě 0q ' ' ¨¨¨' ' ¨¨ẗ 0 " 0 x 0 " n 0 " 0 t 1 " t 0 `B t k " t k´1 `B t k`1 " 0 x k`1 " n k`1 " n k `1 t k`2 " t k`1 `B Figure 10
.10: Execution of the program in Ex. 10.6

-The continuous evolution of an ODE is defined using §10.4.2 according to Eq. (10.2), i.e., the continuous evolution phase is actually a non-standard infinite sequence of infinitesimal integration steps x 1 " x`B¨f c psq, i.e., in Fig. 10.6 the integration step δ P R ą0 is replaced by a non-standard infinitesimal B. This allows us to describe the whole execution of a program as a (non-standard) sequence of infinitesimal (continuous) and discrete steps. -The semantics of a zero-crossing is then defined as a predicate over two neighboring configurations in the execution sequence . . . Ñ x k´1 Ñ x k Ñ . . ., e.g., upp10 ´xq is enabled if p10´x k´1 ď 0q ^p10´x k ą 0q. Fig. 10.10 illustrates the execution of the program in Ex. 10.6.

In §11.1 we will present a basic hybrid data-flow formalism that can be obtained from Zelus by replacing the syntactic sugar by the corresponding data-flow primitives (see [START_REF] Pouzet | Lucid Synchrone: un langage synchrone d'ordre supérieur[END_REF][START_REF] Colaço | A conservative extension of synchronous data-flow with state machines[END_REF]). The semantics of this hybrid data-flow formalism can be defined in ten lines (Def. 11.2). For a formal definition of the semantics over Zelus itself, we refer to [START_REF] Benveniste | Nonstandard semantics of hybrid systems modelers[END_REF][START_REF] Benveniste | Divide and recycle: types and compilation for a hybrid synchronous language[END_REF].

Compilation

The current Zelus compiler [START_REF] Benveniste | Divide and recycle: types and compilation for a hybrid synchronous language[END_REF] targets simulation. It features type inference, initialization and causality analysis (inherited from Lucid Synchrone ( §2.2)) and it ensures the proper combination of discrete and continuous statements.

After these passes, the compiler performs a source-to-source compilation, which translates the hybrid program into a discrete one. This transformation extends the function signatures in order to enable communication with the ODE solver. Currently, the variable-step numerical solver Sundials CVODE [HBG `05] is supported.

The obtained program is called by the ODE solver in order to evaluate the derivatives and the zero-crossing expressions, and by the main simulation loop for computing the discrete transitions.

While this transformation enables simulation, -besides the passes for ensuring semantical consistency -it is not useful for program verification. Therefore, we will present a translation of the language to hybrid automata, the prevalent representation for hybrid system verification, in the next section §11.

Chapter 11

From Hybrid Data Flow to Logico-Numerical Hybrid Automata

Our goal is to verify hybrid systems written in simulation languages like Simulink [Sim], Modelica [START_REF] Fritzson | Modelica -a unified object-oriented language for system modeling and simulation[END_REF], or Zelus ( §10.4).

However, there is a conceptual mismatch between these high-level hybrid system languages and hybrid automata ( §10.2), the representation well-suited for verification. The main differences between these simulation and verification formalisms can be summarized as follows: -equations with implicitly (i.e., in Boolean variables) encoded continuous modes vs their explicit encoding in locations of an automaton, -discrete transitions triggered by zero-crossings vs combinations of staying conditions and guards, -deterministic, open systems with inputs vs non-deterministic, closed systems.

Our primary goal is to formalize the translation from a hybrid data-flow formalism to hybrid automata, and in particular to focus on the translation of zero-crossings. However, a secondary aspect we have in mind is that we want to address hybrid systems specified as the composition of a discrete controller and its physical environment. Hence, the discrete part of the system's state space might be complex, and defined by Boolean and numerical variables (e.g., counters and thresholds manipulated by the controller).

Consequently, we show how to translate the data-flow input language to logiconumerical hybrid automata that can manipulate symbolically discrete variables, in addition to the continuous variables governed by differential equations. Such automata allow a compact representation by not requiring the enumeration of the discrete state space.

Outline. Our contributions presented in this chapter can be summarized as follows, see Fig. 11.1: 1. We present a simple, yet complete hybrid data-flow formalism ( §11.1) inspired by Zelus. The purpose of this formalism is to serve as a common low-level basis for the translation of languages like Simulink or Zelus. 2. We introduce logico-numerical hybrid automata ( §11.2), i.e., an extension of classical hybrid automata by Boolean variables. This extension prepares us w.r. 3. We propose sound translations ( §11.3) from the hybrid data-flow formalism to logiconumerical hybrid automata and we discuss various zero-crossing semantics. Since the target language of the translation is less expressive than the source language, the translation entails an over-approximation. We investigate the extent to which the original semantics is preserved in the translation.

Related work. There are existing translations of Simulink/Stateflow to hybrid automata, but they only treat a subset of the ways in which discrete transitions may be activated. They suppose that the diagram obeys a specific scheme (cf. Fig. 10.5b) where the discrete behavior is defined only by Stateflow diagrams and the output of the Stateflow diagram is used to select the continuous behavior using switches in the Simulink diagram. Such diagrams are straightforward to translate because the structure is already the one of a hybrid automaton and they contain no zero-crossings. Such translations of subsets of the Simulink/Stateflow language are for example proposed by Agrawal et al [START_REF] Agrawal | Semantic translation of Simulink/Stateflow models to hybrid automata using graph transformations[END_REF] for the purpose of verification, by Alur et al [START_REF] Alur | Symbolic analysis for improving simulation coverage of Simulink/Stateflow models[END_REF] with the goal of improving simulation coverage, and in the tool HyLink [START_REF] Manamcheri | A step towards verification and synthesis from Simulink/Stateflow models[END_REF] targeting the applications of verification and controller synthesis. HyLink also introduces blocks for specifying non-deterministic inputs as required by verification methods. A formal definition of their translation is ongoing work.

Briand and Jeannet [START_REF] Briand | Combining control and data abstraction in the verification of hybrid systems[END_REF] pursue a similar goal to ours: the verification of hybrid systems with a large discrete state space. However, they do not consider an integrated hybrid system language, but a kind of hybrid automata embedding Lustre programs with their own semantics, whereas our goal is to be compatible with standard hybrid automata model.

The translation of discrete-time Simulink models with periodic triggers to Lustre is presented in [START_REF] Tripakis | Translating discrete-time Simulink to Lustre[END_REF]. The inverse of what we are doing, namely the embedding of hybrid automata in a hybrid system language (here Scicos), is the goal of [START_REF] Najafi | Implementation of hybrid automata in SCICOS[END_REF].

Hybrid Data-flow Formalism

Simulink and Zelus are full programming languages with constructs for modularity. In order to abstract from such constructs, we present here a lower-level data-flow formalism that will serve as the generic input language for the translation.

As this formalism is dedicated not only to simulation, but also serves as a specification language, we use the notion of inputs constrained by an assertion as in Lus- tre ( §2.2). This allows us to give a semantics to the components of a more general system. Simulation can still be performed by connecting a component with inputs to an input generator, see for instance [START_REF] Raymond | Lutin: A language for specifying and executing reactive scenarios[END_REF] for the simulation of discrete synchronous systems.

Notations. Additional to our notational conventions of logico-numerical programs ( §7.1), we will use the following notations: eps, iq : an arithmetic expression without test, e.g., n`2x`ξ; uppzps, iqq : a zero-crossing, e.g., uppx`ξ ´nq; ϕ Z ps, iq : a logical combination of zero-crossings, e.g., uppz 1 q ^ uppz 2 q _ uppz 3 q; φpbq : a Boolean expression over discrete state variables; Φps, iq : an arbitrary expression without zero-crossings.

Program model. A hybrid data-flow program is defined similarly to a logico-numerical program ( §7.1), but extended with ODEs:

Definition 11.1 (Hybrid data-flow program) A hybrid data-flow program is defined by: $ & % Ipsq Aps, iq ^" 9

x " f c ps, iq s 1 " f d ps, iq where the predicate Ipsq defines the initial states, the predicate Aps, iq is the global assertion constraining the inputs, the continuous flow equations 9

x " f c ps, iq and the discrete transition functions s 1 " f d ps, iq are of the form:

9 x " $ & % ¨¨ë l ps, iq if φ l pbq ¨¨¨s 1 " $ & % ¨¨Φ j ps, iq if ϕ Z j ps, iq ¨¨Ẅ
e assume that the conditions φ l define a partition of the discrete state space, and that @sDi : Aps, iq (i.e., the assertion does not constrain the state-space, see §2.3).

Although hybrid system languages often include explicit automata representations, for uniformity of presentation we assume that they have first been transformed into data-flow equations (see [START_REF] Colaço | A conservative extension of synchronous data-flow with state machines[END_REF]).

Example 11.1 (Thermostat system) As an illustrative example we use a variant of the classical thermostat example: on ^x ď 20 22´x ď 9

x ď 52´x on ^x ě 20 22´x ď 9

x ď 52´x on ^x ě 17.9 ´x ď 9

x ď 30´x on ^x ď 18.1 ´x ď 9

x ď 30´x stop ^n " 0 19 ă x ď 30 0 ď x ď 19 tt 17.9 ď x ď 18.1 ^n1 " n`1q1 " pn´10 ď 0q stop 1 " q ^pn´10 ě 0qq 1 " pn´10 ď 0q tt x " 20 The input xi represents the external temperature, the input eps models the inaccuracy of the temperature sensor 1 , room temperature, the discrete Boolean state variable on indicates the state of the heating system, and the discrete integer state variable n counts the number of times the temperature goes from below to above 18 degrees (modulo the uncertainty). At last, the state variable stop becomes true when n reaches 10 from below.

The output pair (assert,ok) corresponds to the outputs pA, Gq of a synchronous observer used for specifying a property to verify -in the sequel we need only the assumption A on the inputs.

Translating this program to our hybrid data-flow formalism we obtain:

Ipon, stop, n, xq " stop ^n " 0 ^0 ď x ď 30 ppx ď 19 ^onq _ px ą 19 ^ onqq Appon, stop, n, xq, pξ, ǫqq " 0 ď ξ ď 30 ^´0.1 ď ǫ ď 0.1

9 x " " ξ ´x `22 if on ξ ´x if on pon 1 , stop 1 , n 1 , x 1 q " $ & % pff, stop, n, xq if uppx ´20q ptt, stop, n `1, xq if upp18 ´x `ǫq pon, tt, n, xq if uppn ´10q
Observe that this translation factorizes the evolution of discrete variables according to the zero-crossing conditions. Semantics of zero-crossings. A zero-crossing is an expression of the form uppzq that becomes true when the sign of zps, iq, an arithmetic expression without tests, switches from negative to positive during an execution. Instead of just a valuation of variables of the form ps k , i k q zero-crossings are interpreted on an execution fragment of the form ps k´1 , i k´1 q Ñ ps k , i k q, i.e., two consecutive configurations of an execution trace. We will use the notation ps k´1 , i k´1 , s k , i k q for short. Several interpretations are possible, which are discussed in §11.1. For now, we arbitrarily select the so-called "contact" semantics, formally defined as:

ps k´1 , i k´1 , s k , i k q |ù uppzps, iqq iff " zps k´1 , i k´1 q ă 0 zps k , i k q ě 0 (11.1)
In other words, a zero-crossing uppzq is activated (and taken into account for computing the next step k `1) if the expression z was strictly negative in the previous step k ´1 and evaluates to some positive value or zero in the current step k.

A conjunction ϕ Z ps, iq " Ź p uppz p ps, iqq is activated if for all p, uppz p ps, iqq is activated in the same step.

Semantics. We define a trace semantics based on an ideal discretization of the continuous equations that follows the one of Zelus ( §10.4.3). This semantics uses the theory of non-standard analysis ( §10.4.2) to model the way typical numerical simulators proceed (cf. Fig. 10.6): Such solvers are given an initial state x 0 , an ODE 9

xptq " f pxptqq, and a finite set of zero-crossing expressions z j . They integrate the ODE until at least one of the zero-crossings is activated. When this happens, the control is given back to the main simulation loop, which executes one or several discrete execution steps before continuing integration. Definition 11.2 (Semantics) An execution of a hybrid data-flow program is a trace ps 0 , i 0 q Ñ ps 1 , i 1 q Ñ ps 2 , i 2 q Ñ . . . such that Ips 0 q, Ñ"Ñ c Y Ñ d , ps k , i k q Ñ c ps k`1 , i k`1 q ðñ Aps k , i k q Dl, DB ą 0 : # φ l pb k q ^@j : `ps k´1 , i k´1 , s k , i k q |ù ϕ Z j ps, iq pb k`1 , x k`1 q " pb k , x k `el ps k , i k q¨Bq where B is a non-standard infinitesimal, and

ps k , i k q Ñ d ps k`1 , i k`1 q ðñ Aps k , i k qD j : $ & % ps k´1 , i k´1 , s k , i k q |ù ϕ Z j ps, iq @j 1 ă j : `ps k´1 , i k´1 , s k , i k q |ù ϕ Z j 1 ps, iq sk`1 " Φ j ps k , i k q
A transition Ñ c corresponds to an infinitesimal continuous-time evolution, which is possible only if no zero-crossing condition ϕ Z j has been activated in the previous execution step. A transition Ñ d corresponds to a discrete transition triggered by the first enabled ϕ Z j . We pinpoint some properties of this formalism:

(1) Discrete transitions are always guarded by zero-crossings, and continuous modes are always defined by a Boolean expression over discrete variables, which are piecewise constant in continuous time. This is to make sure that a mode change (change of dynamics) can only happen on discrete transitions.

(2) Furthermore, discrete transitions are urgent, i.e., they must be taken at the first point in time possible.

(3) In case of simultaneously occurring zero-crossings -as in Zelus -the only the first activated zero-crossings in the program source is taken into account.

(4) Zero-crossings may not only be triggered by continuous evolution, but also by discrete transitions. This is the case in Example 11.1: if the zero-crossing upp18´x`ǫq occurs when n " 9, n is first incremented to 10, activating the zero-crossing uppn´10q that makes stop become true. This feature can cause infinite sequences of discrete zerocrossings. Such a behavior can be avoided by forbidding circular dependencies between states variables through zero-crossings in the source program.

Partitioned representation. The hybrid data-flow model we have defined does not have any concept of control structure. However, for pedagogical purpose, one can partition the state space to generate an explicit automaton that may be easier to understand, see Fig. 11.2. When doing so, partial evaluation may be used to simplify expressions and removing infeasible transitions (cf. §7.3.3). This has been done in Fig. 11.2.

Standardization. As already mentioned the semantics of the hybrid data flow model is based on non-standard analysis ( §10.4.2), which gives an unambiguous meaning to hybrid systems even if they contain Zeno behavior for instance.

However, the semantics of the output formalism of our translation, i.e., hybrid automata, relies on standard analysis. Hence non-standard behaviors need to be mapped to standard behaviors. This standardization is based on the transfer principle (Thm. 10.2): since each standard system has a non-standard representation, a non-standard system is standardizable if it is a non-standard representation of a standard system.

For instance, w.r.t. continuous evolution, we have the following property: a nonstandard sequence consisting of infinitesimal continuous steps ps 0 , i 0 q Ñ . . . Ñ ps n , i n q with n P ‹ N, s k " pb k , x k q T , x 0 P R p , x n P R p , has the following standard meaning: assuming that the input sequence i 0 Ñ . . . Ñ i n forms a continuous function i : r0, δs Ñ I, the sequence s 0 Ñ . . . Ñ s n corresponds to a continuous function s : r0, δs Ñ S with (cf. Eq. 10.2)

xpδ 1 q " x 0 `ż δ 1 0 e ℓ ppb 0 , xptqq T , iptqqdt
for δ 1 P r0, δs, δ " stpnBq P R ě0 , and I and S denote the input and state space respectively. However, we can write programs that are not standardizable, i.e., for which nonstandard and standard meaning differ: For example the program fragment b 1 " px ą 0q if uppxq with "crossing" semantics (see below) gives us b 1 " tt in the non-standard interpretation, but b 1 " ff in the standard interpretation.

Naturally, we can only correctly translate standardizable programs.

Semantics of zero-crossings

As mentioned above, a zero-crossing can be activated in two ways (Fig. 11.4):

-It can be triggered by a continuous time evolution, as uppx´20q in Fig.

i Ý Ñ d s 1 i 1 Ý Ñ d s 2 .
Because a zero-crossing may depend both on discrete and continuous variables, the same zero-crossing uppzq can be triggered in both ways in an execution. We will use the terms continuous (resp. discrete) zero-crossing to indicate its source of activation.

Three semantics for zero-crossings. We consider an execution fragment

i k´1 Ý Ý Ñ s k´1 i k Ý Ñ
s k and we define z k " zps k , i k q. There are three natural choices for the semantics of zero-crossings: -"At-zero" semantics : z k´1 ď 0 ^zk ě 0 -"Contact" semantics : z k´1 ă 0 ^zk ě 0 -"Crossing" semantics : z k´1 ď 0 ^zk ą 0 Figs. 11.5b, 11.6a and 11.6d illustrate the activation of continuous zero-crossings for some typical trajectories according to each semantics.

The last two semantics are used in simulators. The zero-crossing semantics of Simulink is the disjunction of "contact" and "crossing" semantics. In Modelica it is up to the programmer to choose between these two semantics. We state the first option, because it fits better to the semantics of hybrid automata (as it does not involve strict inequalities).

Chattering behavior. An issue specific to the "crossing" semantics is that it is possible to write programs that produce executions that contain periodic sequences of infinitesimal continuous evolutions with distinct dynamics. This happens for example when a trajectory chatters along a surface with opposed zero-crossings, like in Ex. 10.3.

As explained in §10.3 one way to treat such behavior would be to transform the program such as to replace the chattering by its corresponding sliding mode (Fig. 10.8b); yet, since we do not know how to achieve this in general, we have chosen to translate such programs into hybrid automata that allow chattering in their concrete semantics.

Logico-Numerical Hybrid Automata

We extend hybrid automata (cf. §10.2) in the sense that we allow also Boolean variables in the expressions occurring in the automaton. Definition 11.3 (Logico-numerical hybrid automaton) A logico-numerical hybrid automaton (HA) is a directed graph defined by xL, F, J, Σ 0 y where -L is the finite set of locations, -F : L Ñ V is a function that returns for each location the flow relation V ps, 9

xq P V relating the state variables s and the time-derivatives 9

x of the numerical state variables, and -J Ď L ˆR ˆL defines a finite set of arcs between locations with the discrete transition relation Rps, s 1 q P R over the state variables s, and -Σ 0 : L Ñ S is a function that returns for each location the set of initial states S 0 P S, which have to satisfy @ℓ : @s : Σ 0 pℓqpsq ñ D 9

x : F pℓqps, 9 xq.

Further notations:

-C ℓ psq " D 9

x : V ℓ ps, 9 xq is the staying condition of the flow V ℓ " F pℓq. -G ℓ,ℓ 1 psq " Ds 1 : Rps, s 1 q is the guard of the arc pℓ, R, ℓ 1 q P J. Semantics. We use the following auxiliary definitions: Let T r0,δs be the set of differentiable trajectories r0, δs Ñ R n . The function flow V returns the set of end states of trajectories τ P T starting in the given state and that obey the flow relation V ℓ :

flow V ℓ pb, xq " $ ' ' & ' ' % pb, x 1 q
ˇˇˇˇˇˇˇD δ ą 0, Dτ P T r0,δs : τ p0q " x ^τ pδq " x 1 @δ 1 P r0, δs : C ℓ pb, τ pδ 1 qq @δ 1 P p0, δq : V ℓ ppb, τ pδ 1 qq, 9 τ pδ 1 qq , / / .

/ / -

We define the concrete semantics in terms of an execution of a hybrid automaton:

Definition 11.4 (Semantics) An execution of a logico-numerical hybrid automaton is a (possibly) infinite trace pℓ 0 , s 0 q Ñ pℓ 1 , s 1 q Ñ pℓ 2 , s 2 q Ñ . . . with Ñ"Ñ c Y Ñ d and pℓ, sq Ñ c pℓ 1 , s 1 q ô ℓ " ℓ 1 ^Vℓ " F pℓq ^s1 P flow V ℓ psq pℓ, sq Ñ d pℓ 1 , s 1 q ô Dpℓ, R, ℓ 1 q P J : Rps, s 1 q ^Cℓ 1 ps 1 q

If we eliminate all Boolean variables by enumerating their valuations and encoding them with locations, the semantics above will be equivalent to the semantics of standard hybrid automata that deal only with numerical variables (see §10.2).

Translation

The main issue in the translation are the zero-crossings: the fundamental difference between the zero-crossing concept used in our input language and the combination of staying and jump conditions in our output language is that the activation of a zerocrossing depends on the history (i.e., a part of the past trajectory) whereas the truth value of staying and jump conditions depends only on the current state. We start with translations for continuous zero-crossings without ( §11.3.1) and with ( §11.3.2) inputs; then we will show how to translate logical combinations of zerocrossings in §11.3.3. §11.3.4 will discuss the case of discrete zero-crossings, the translation of which is much less dependent on the choice between the three zero-crossing semantics. However, because of the limitations of the hybrid automata model, in all cases the translation will add behaviors that are not present in the original program. (2) When s does not appear in the jump condition of a HA, the equality s 1 " s is implicit.

φ 1 ẑ ě 0 φ 1 ẑ ď 0 φ 2 ℓ 0 ℓ 1 ℓ 2 tt z " 0 ŝ1 " Φpsq
(3) The flow equation 9

x " e1psq if φ1pbq in location ℓ1 in (a), is translated to the flow relation V p 9

x, sq " pφ1pbq ^9 x " e1psqq in locations ℓ0 and ℓ1 in (d) (only the staying conditions are given in the figures).

Continuous Zero-Crossing without Inputs

We investigate here the translation of a continuous zero-crossing of the form uppzpxqq: for the sake of simplicity, we assume that there are neither inputs i nor discrete variables b in z. We consider the simple case of an origin location ℓ 1 with a single discrete transition s 1 " Φpsq if uppzpxqq going from ℓ 1 to a location ℓ 2 , such that φ 1 pbq ^ps 1 " Φpsqq ñ φ 2 pb 1 q, see Fig. 11.5a. The continuous dynamics in location ℓ 1 corresponds to the flow equation 9

x " e 1 psq if φ 1 pbq. As the satisfaction of a zero-crossing depends on the history, the principle of the translation is to add locations to record the history of the continuous evolution. In the sequel, we develop translations corresponding to the three zero-crossing semantics stated in §11.1.

"At-zero" semantics. The translation of "at-zero" semantics (z k´1 ď 0 ^zk ě 0) is depicted in Fig. 11.5. The origin location ℓ 1 in Fig. 11.5a is partitioned in two locations, ℓ 0 and ℓ 1 , in Fig. 11.5d: there is a discrete transition from ℓ 0 to ℓ 1 , but not from ℓ 1 to z t (a) Exact "contact" semantics z t (b) Induced "contact" semantics ℓ 0 to force the urgency of the discrete transition when z " 0 is reached from below 0. The zero-crossing condition translates to z " 0 (see transition from ℓ 1 to ℓ 2 ). The rationale for the condition z " 0 is based on the assumption of continuity of the function zptq " zpxptqq and the urgency of the zero-crossing: zpt k´1 q ă 0 ^zpt k q ě 0 with t k´1 ă t k implies that there exists t P pt k´1 , t k s such that zptq " 0.

φ 1 ẑ ě 0 φ 1 ẑ ď 0 φ 1 ẑ ď 0 φ 2 ℓ ´1 ℓ 0 ℓ 1 ℓ 2 tt z ă 0 z " 0 ŝ1 " Φpsq
φ 1 ẑ ě 0 φ 1 ẑ ď 0 φ 1 0 ď z ď ǫ φ 2 ℓ ´1 ℓ 0 ℓ 1 ℓ 2 tt tt 0 ď z ď ǫ ŝ1 " Φpsq
This translation induces two kinds of approximations in terms of executions: -We lose urgency for all trajectories but the second one in Fig. 11.5c. In case of the first trajectory the zero-crossing may be triggered in a dense interval of time. -We add a jump transition in the fourth trajectory because the resulting hybrid automaton is not able to distinguish whether the state z " 0 is reached from below or from above 0.

We will not consider any more the "at-zero" semantics in the sequel, as -to our knowledge -it is not used by any simulation tool.

"Contact" semantics. In order to translate the "contact" semantics defined as z k´1 ă 0 ^zk ě 0, we split the original location into three locations, ℓ ´1, ℓ 0 , and ℓ 1 , as depicted in Fig. 11.6c. The two locations, ℓ 0 and ℓ 1 , both with the staying condition z ď 0, are connected by a transition guarded by z ă 0: this is in order to check that the trajectory was actually strictly below zero before touching zero. This prohibits the triggering of 151 11.3. Translation the jump transition in the first, third and last trajectory in Fig. 11.6b. This induces the following approximation: -The loss of urgency for the fifth trajectory that touches (possibly several times) the line z " 0 from below. Observe, that the "at-zero" translation in Fig. 11.5d is actually a sound translation of the "contact" semantics, though with coarser approximations.

"Crossing" semantics. The "crossing" semantics (z k´1 ď 0 ^zk ą 0) is more subtle to translate. By continuity of the function zptq " zpxptqq we can deduce that zptq " 0 is valid at the zero-crossing point in standard semantics: by standardizing zptq ď 0 ^zpt`Bq ą 0 we get stpzptqq " stpzpt`Bqq " 0.

However, we cannot simply reuse the "at-zero" translation in Fig. 11.5d, because it is not sound w.r.t. chattering behaviors: in Ex. 10.3, time cannot advance, because only discrete transitions can be taken. Since we do not rely on standardizing chattering behaviors, we have to allow chattering in the standard semantics. For this reason, we allow the trajectories to actually go above zero, but only up to a constant ǫ ą 0 (see Fig. 11.6f). As a consequence, we have the following approximation: -Urgency is completely lost. In case of the second, third, and last trajectories, the zero-crossing may be triggered in a bounded time interval with a dense interval of values for z (see Fig. 11.6e). Observe, that this translation simulates the translations of the two other semantics. Yet, it is also possible to move to location ℓ 1 when this trajectory reaches zero, but then it gets stuck at zero: neither continuous nor discrete transitions are possible in ℓ 1 .

However, this phenomenon has no effect w.r.t. reachability properties, on which we focus: the goal of our translation is to obtain a precise model suitable for safety verification techniques.

Remark 11.2 (Choice of ǫ) Any translation involving an ǫ close to zero is not really well-suited for verification: computations with arbitrary-precision rationals become indeed very expensive ( e.g., least common denominators become huge).

Remark 11.3 (Exploiting derivatives)

The difficulty of translating "crossing" semantics comes from the fact that being at z " 0 we have to peek an infinitesimal step into the future of the continuous evolution. In standard semantics, this is possible by looking at the time derivatives d n z dt n of the zero-crossing expression -if the zero-crossing contains inputs we also need bounds on the derivatives of the inputs.

Theoretically, this would allow avoiding the activation of the discrete transition in the translation w.r.t. the first, fourth, and fifth trajectory in Fig. 11.6e. However, firstly, without any restrictions on the dynamics and the form of z, we would have to look at all derivatives before being able to decide that a trajectory is actually crossing zero. Secondly, the translation would still be unsound w.r.t. chattering behavior of sliding modes because only discrete transitions would be taken, and hence, time cannot advance.

Continuous Zero-Crossing with Inputs

Now, we investigate the translation of zero-crossings of the form uppzpx, iqq, where the inputs i have to satisfy an assertion Aps, iq, see §11.1. We assume that in the discrete infinitesimal semantics of §11.1 inputs tend to continuous trajectories (between two discrete transitions). Inputs allow us to introduce non-determinism in a model, as illustrated by Fig. 11.3. The principle of translation as described in §11.3.1 and depicted in Fig. 11.5 remains the same, except that the computation of jump and flow transition relations involves an existential quantification of the inputs i.

We use the notation ψ " ψ, where ¯denotes the topological closure operator. We have for instance pz ď 0q " z ě 0.

Considering the"contact" semantics and using the continuity of the function zpxptq, iptqq during continuous evolution (see §11.1) the condition Di k´1 , i k : zpx k´1 , i k´1 q ă 0 ^Aps k´1 , i k´1 q ẑpx k , i k q ě 0 ^Aps k , i k q ^s1 " Φps k , i k q is equivalent to Di k´1 , i k : zpx k´1 , i k´1 q ă 0 ^Aps k´1 , i k´1 q ẑpx k , i k q " 0 ^Aps k , i k q ^s1 " Φps k , i k q which in turn is equivalent to Dξ : p´0.1 ď ξ ď 0.1 ^x`ξ " 0 ^b1 " tt ^x1 " x ^y1 " ξq " Dξ : p´0.1 ď x ď 0.1 ^x " ´ξ ^b1 ^x1 " x ^y1 " ´xq " ´0.1 ď x ď 0.1 ^b1 ^x1 " x ^y1 " ´x

Observe that we obtain the non-trivial relation y " ´x after the jump transition.

Logical Combinations of Zero-Crossings

We consider here a discrete transition function of the form s 1 " Φpsq if ϕ Z psq where ϕ Z is a logical combination of zero-crossings uppz 1 q, . . . , uppz M q satisfying the assumption of §11.1. In order to simplify the presentation, we consider the case without inputs first (see §11.3.5 for the general case). Why do we need such logical combinations? Conjunctions and negations typically occur when combining two parallel equations s 1 i " Φ i if uppz i q for i " 1, 2, which results in an equation

ps 1 1 , s 1 2 q " $ & % pΦ 1 , Φ 2 q if uppz 1 q ^uppz 2 q pΦ 1 , s 2 q if uppz 1 q ^ uppz 2 q ps 1 , Φ 2 q if uppz 2 q ^ uppz 1 q
A discrete transition function of the form s 1 " " Φ 1 if uppz 1 q Φ 2 else if uppz 2 q is rewritten as s 1 " " Φ 1 if uppz 1 q Φ 2 if uppz 1 q ^uppz 2 q Disjunctions allow us to express that the same transition may be triggered by different zero-crossings:

s 1 " Φ if uppz 1 q _ uppz 2 q
Because successive graph refinements are cumbersome to describe, we reformulate the translation scheme of the previous sections by using additional discrete state variables to the system, rather than by introducing locations. This will make it easier to define this generalization. We sketch this principle using the "contact" semantics (the translation for the general case will be presented in §11.3.5).

To encode locations, we add M discrete state variables q 1 . . . q M of the enumerated type tabove, below, readyu for each distinct zero-crossing uppz m q occurring in the zerocrossing formulas ϕ Z . -Their transition relations are defined as R m " match q m with above Ñ q 1 m P tabove, belowu below Ñ z m ă 0 ^q1 m " ready _ q 1 m " q m ready Ñ z m " 0 ^q1 m P tabove, belowu _ q 1 m " q m -The staying condition defined by the zero-crossing uppz m q is: C m " match q m with above Ñ z m ě 0 below Ñ z m ď 0 ready Ñ z m ď 0 -The guard G m associated to the zero-crossing uppz m q is G m " pq m " readyq ^pz m " 0q

We can now build the global flow and discrete transition relations:

Rppq, sq, pq 1 , s 1 qq " p Ź m R m q ^p H ^s1 " s _ H ^s1 " Φq V ppq, sq, 9
xq " p Ź m C m q ^pŽ l pφ l pbq ^9 x " 9 e l psqqq (11.3) with H " ϕ Z r@m : uppz m q Ð G m s where erx Ð ys means that y is substituted for x in expression e.

In order to obtain an explicit automaton one has to enumerate the valuations of the discrete state variables q and to encode them into explicit locations (see §11.4).

It is interesting to mention that this translation keeps enough information in order to preserve urgency in case of conjunctions like s 1 " Φ if uppz 1 q ^uppz 2 q where the trajectory can move all around the intersection z 1 " 0 ^z2 " 0 while not satisfying both zero-crossings at the same time. Fig. 11.8 gives an illustration of such a trajectory and Fig. 11.9 shows the corresponding automaton.

z1 ă 0 z2 ă 0 z2 ă 0 z2 ă 0 z1 ă 0 G2 G2 G2 G2 G1 G1 G1 G1 G1 ^G2 ^s1 " Φ Figure 11
.9: Translation of conjunctions of zero-crossings: example of two zerocrossings with "contact" semantics. G 1 " pz 1 " 0q, G 2 " pz 2 " 0q, AA " pq 1 " above^z 1 ě 0 ^q2 " above ^z2 ě 0q, analogously for B (below) and R (ready). The urgency of the discrete transition G 1 ^G2 ^s1 " Φ is preserved to the same extent as for single zero-crossings.

Remark 11.4 (Conjunctions of zero-crossings in simulation) Conjunctions of zero-crossings are quite delicate in hybrid simulation models. The problem is that models relying on conditions stating that two physical quantities become zero simultaneously are not numerically robust and produce unpredictable simulation results. However, from a programming language semantics point of view we have to deal with them.

Discrete Zero-Crossings

Discrete zero-crossings are activated by discrete transitions. Discrete zero-crossings occur in so-called zero-crossing cascades, which are sequences of zero-crossings, the first of which is triggered by continuous evolution, whereas the others are discrete zerocrossings. Example 11.1 contains such a zero-crossing cascade, which is commented in §11.1 point 4.

Principle of translation.

The translation that we propose applies the same principle as above to encode the history of the execution into locations (using discrete state variables). We explain it using the "contact" semantics (again without inputs and logical combinations of zero-crossings). We consider s 1 " Φ if uppzq and we introduce a Boolean variable q d , which holds at each step k the value of z ă 0 at step k ´1.

-The evolution of q d is defined by the initial state q d " ff and the relation R d " ppq d q 1 " pz ă 0qq; -the condition uppz m q is translated to the guard G d " pq d ^z ě 0q; -the global transition relation R is generated as in Eqn. (11.3).

Interrupting continuous evolution. The transitions as translated above are not urgent, i.e., the continuous states can evolve on intermediate states of a cascade. We need to prohibit this evolution explicitly if one of the discrete zero-crossings is activated. This is done by strengthening the global flow relation V pq, s, 9

xq with V 1 " V ^ G d . In case of inputs, we have G d " pq d ^zps, iq ě 0q and we take V 1 " V ^ p@i : G d q: the idea is that in a state pq, sq, if the discrete zero-crossing is activated for any input (i.e., @i : G d ), then the continuous evolution is blocked. Otherwise, for some input, the discrete zero-crossing is not activated and the continuous evolution should be possible.

Remark 11.5 (Discrete/continuous zero-crossings) A zero-crossings can be both discrete and continuous, e.g., uppx`nq. In this case it must be translated twice: once as a continuous zero-crossing and a second time as a discrete one. The resulting guard is the disjunction of both translations.

Mind that a conjunction of a purely discrete and a purely continuous zero-crossing is not satisfiable.

Remark 11.6 (Compressing cascades) Zero-crossing cascades can be "compressed" into a single discrete transition triggered by a continuous zero-crossing by composing the discrete transitions forming the cascade. This is possible if there are no instantaneous cyclic dependencies between the variables. The advantage of this kind of pre-processing is that the translation does not have to deal with discrete zero-crossings. However, care must be taken w.r.t. safety verification, because this transformation does not preserve the set of reachable states (it removes intermediate states).

Remark 11.7 (Discrete zero-crossings in system modeling) The main use of discrete zero-crossings is to trigger a cascade of several discrete transitions by a single continuous zero-crossing. For this purpose, discrete zero-crossings enable very concise modeling, but the resulting behavior can be very hard to understand, and thus, they can easily result in undesirable behavior. On the other hand, if a language does not support discrete zero-crossings, the programmer has to program such a behavior himself by manually composing transitions explicitly, as mentioned in Remark 11.6.

The Complete Translation

We give here the formulas for the complete translation of a hybrid data-flow program

Ipsq , Aps, iq ^$ ' ' ' ' ' ' & ' ' ' ' ' ' % 9 x " ! ¨¨ë l ps, iq if φ l pbq ¨¨s 1 " ! ¨¨Φ j ps, iq if ϕ Z j ps, iq ¨¨ä
s defined in §11.1 into a hybrid automaton by combining all the concepts presented in § §11.3.1 to 11.3.4. We use the notation ζ σ m to denote the constraints induced by a zero-crossing uppz m q, e.g., ζ ¨"0 m " `zm " 0 ˘or ζ 0ă¨ďǫ m " `0 ă z m ď ǫ ˘.

Discrete zero-crossings. For each discrete zero-crossing uppz m q we introduce a Boolean state variable q d m and define its transition relation R d m and guard

G d m : R d m " pq 1 d m " ζ σ m q G d m " pq d j ^ζσ m q σ σ "contact"
¨ă 0 ¨ě 0 "crossing" ¨ď 0 ¨ą 0 157 11.3. Translation Continuous zero-crossings. For each continuous zero-crossing uppz m q we introduce a state variable q c m . -Their transition relations are defined as follows:

θ σ "contact" ¨ă 0 ¨" 0 "crossing" ¨" 0 0 ď ¨ď ǫ R c
m " match q c m with above Ñ q 1 c m P tabove, belowu below Ñ ppq c m q 1 " q c m q _ ppq c m q 1 " readyq ^ζθ m ready Ñ pq c m q 1 P tabove, belowu ^ζσ m _ ppq c m q 1 " q c m q

-The guards G c m are defined as

G c m " pq c m " readyq ^ζσ m σ "contact" ¨" 0 "crossing" 0 ď ¨ď ǫ -Using ψ " Ž l `φl pbq ^9
x " e l ps, iq ˘we define the partial flow relations (containing the staying conditions):

V m " match q c m with above Ñ Rppq, sq, pq 1 , s 1 qq " Di :

$ ' ' & ' ' % Aps, iq ^`Ź m R m ˘^ `Žj H j ˘^s 1 " s _ Ž j `Hj ^s1 " Φ j ˘V ppq, sq, 9 xq " # Ž m V m ppq, sq, 9
xq ^ `@i : Aps, iq ^Žj H d j with H j " ϕ Z j r@m : uppz m q Ð G m s. We obtain a hybrid automaton xtℓ 0 u, F, J, Σ 0 y with -F pℓ 0 q " V , -J " tpℓ 0 , R, ℓ 0 qu, and -Σ 0 pℓ 0 q " tpq, sq | q d " ff ^Źm q c m P tabove, belowu ^Ipsqu Theorem 11.1 (Sound translation) All executions of a hybrid data-flow program are simulated by an execution of its translation to a logico-numerical hybrid automaton, i.e., the translation is a sound over-approximation.

Proofs. The proofs are based on demonstrating that the translation induces a left-toright simulation relation À between the hybrid data-flow formalism (HDF) and logiconumerical hybrid automata (HA). We sketch here only the scheme for the inductive construction of this simulation relation following the semantics of the hybrid data flow formalism as illustrated below (the thick dots symbolize the configurations of an execution).

Base case:

The initial state of HDF is included in the initial state of HA. ' lo omo on |ùI Then, we split the induction step in several sub-steps:

Induction step:

In a given state, every trajectory compliant to a flow equation in HDF up to a zero-crossing must be included in the set of trajectories compliant to the flow relation in HA up to the staying condition. (A corner case is that there is no zerocrossing in the future.)

' Ñ c . . . Ñ c ' Ñ c ' loomoon |ùϕ Z j
If a continuous zero-crossing is activated in HDF then the guard of the corresponding jump transition in HA is satisfied.

' Ñ c ' loomoon |ùϕ Z j
If a discrete zero-crossing is activated in HDF then the guard of the corresponding jump transition in HA is satisfied.

' Ñ d ' loomoon |ùϕ Z j
The resulting state of a discrete transition in HDF is included in the set of states resulting from taking the corresponding jump transition in HA.

' Ñ d ' lo omo on s 1 "Φ j psq
The details of the proofs of the translation can be found in [START_REF] Schrammel | From hybrid data-flow languages to hybrid automata: A complete translation[END_REF].

Discussion

We have presented the complete translation of a hybrid data-flow specification to a hybrid automaton. However, further pre-processing steps are necessary to enable verification using classical hybrid analysis methods.

Explicit representation. As explained in §11.3.3, we have chosen to present our translation by encoding the locations of the HA with N additional finite-state variables q. This results in a HA with a single location and a single self-loop jump transition. Of course, it is possible to expand this "compressed" representation into a more explicit one, such as shown in Figs. 11.5 and 11.7. This is done by enumerating the valuations of these finite-state variables and by partitioning the system into these Op2 N q states. As already mentioned in §11.1, partial evaluation may be used to simplify expressions and to remove infeasible jump transitions.

Non-convex staying conditions and guards. The induced staying conditions Cpsq and guards Gpsq of jump transitions might be non-convex w.r.t. numerical constraints. However, most hybrid verification methods require convex staying conditions and guards. We will deal with this issue when developing logico-numerical hybrid verification methods in §13.

Approximations during analysis. In §11.3.1 we have explained that the translation to hybrid automata loses several properties, like determinism and urgency, which may result in an over-approximation in terms of reachable states. Moreover, hybrid reachability analysis methods further approximate the reachable states with (finite disjunctions of) convex sets, such as convex polyhedra.

Conclusions

The translation with "contact" semantics involves strict inequalities. Thus, the analysis may benefit from the ability to represent open sets. In this case, a suitable abstract domain might be convex polyhedra with strict inequalities [START_REF] Bagnara | Not necessarily closed convex polyhedra and the double description method[END_REF]. Otherwise, if the analysis can only handle closed sets, the translation with "contact" semantics (Fig. 11.6b) will behave like the one for "at-zero" semantics (Fig. 11.5c).

Experiments. We have implemented the translation in our tool ReaVer ( §14). Preliminary experiments have confirmed our intuition that the major parameter affecting verification efficiency is the number of zero-crossings. This becomes apparent when making locations explicit. In the applications that we are targeting, i.e., synchronous controllers connected to their physical environment, zero-crossings are (1) those used for modeling the sampling of inputs and (2) those in the environment model. Since the number of (1) is usually small, the total number of zero-crossings inherently depends on the complexity of the environment model in practice.

Conclusions

We have presented a complete translation of a hybrid data-flow formalism to logiconumerical hybrid automata. In comparison with previously proposed translations, our translation handles zero-crossings. Moreover, we have proved that it is sound w.r.t. the semantics of the source language.

To achieve this, we considered a simple yet expressive hybrid data-flow formalism to which large subsets of existing hybrid system languages can actually be reduced.

We discussed different choices of zero-crossing semantics and their possible translations to hybrid automata. Since hybrid automata are not as expressive as the source language, we can only provide sound over-approximations of the original semantics.

However, this enables the use of existing hybrid verification tools such as HyTech [HHWT97], PHaver [START_REF] Frehse | PHAVer: Algorithmic verification of hybrid systems past HyTech[END_REF] and SpaceEx [FGD `11], which are all based on the standard hybrid automaton model.

Yet, these tools require to encode Boolean variables explicitly in locations. As this enumeration results in an exponential blow-up of the hybrid automaton size, we assume that this is a major bottleneck in verifying controllers with complex discrete state spaces jointly with their physical environment. Therefore, §13 will propose methods for combining existing hybrid system analysis with implicit handling of Boolean variables in order to counter state space explosion. Our translation to logico-numerical hybrid automata lays the basis for such an approach.

Chapter 12

Hybrid System Verification Before we propose methods for analyzing logico-numerical hybrid automata in §13, we give an overview of existing verification methods for numerical hybrid systems in this chapter.

In addition to handling discrete transitions, the reachability analysis of hybrid automata ( §12.1) requires computing the states reachable by continuous evolution.

A vast variety of continuous reachability methods has been proposed. We will concentrate on unbounded-time methods ( §12.2) which are based on abstract interpretation with widening or strategy iteration. In contrast, bounded-time methods ( §12.3) have their origin in model-checking and set-based simulation.

At last, we list some alternative approaches ( §12.4) which are not necessarily based on the computation of the reachable state space.

Reachability Analysis of Hybrid Automata

The reachability analysis of hybrid automata by abstract interpretation is formulated as the following fixed point equation over the power domain L Ñ A:

S 7 " S 70 \ λℓ . ´post 7 V ℓ pS 7 ℓ q [ C ℓ ¯\ λℓ . ˜ğ ℓ 1 PL post 7 R ℓ 1 ,ℓ pS 7 ℓ 1 q [ C ℓ
where S 7 , S 70 P pL Ñ Aq. The discrete post-conditions post 7 R of the jump transitions is computed in the same way as for discrete systems. The difference to discrete systems is the continuous postcondition post 7

V of a flow transition, which requires continuous reachability methods.

Continuous reachability.

Most continuous reachability methods have their origin in set-based simulation: they seek a precise over-approximation of trajectories emanating from a given set X 0 following a given dynamics. Since these trajectories (for non-constant dynamics) form non-convex sets, disjunctions of convex sets, e.g., polyhedra, are often used. Different methods for computing such approximations have been developed according to the dynamics, which we categorize roughly in piece-wise constant, piece-wise linear, and non-linear. Time-horizon and convergence. Set-based simulation methods consider the analysis up to a bounded time horizon. Convergence (X k`1 Ď X k ) is detectable if the system is stable (e.g., constant or bounded asymptotic behavior). If the system is metastable (e.g., limit cycle) then inclusion is only guaranteed if no over-approximation is added over one period. For convergence of unstable systems, extrapolation (widening) is needed. Since standard widening operators extrapolate linearly, they yield very imprecise results for systems with non-constant dynamics.

We are interested in unbounded time analysis ( §12.2) provided by methods like relational abstractions that, similarly to abstract acceleration, try to find better extrapolations than standard widening, and very recently, strategy iteration-based methods that are able to compute the best inductive invariants for systems with linear dynamics using template polyhedra.

Decidability Results. Hybrid automata are infinite state systems, hence the reachability problem is undecidable in general. Nevertheless, there are classes of hybrid automata with restricted forms of transitions such that the reachability problem is decidable [HKPV98]: -Timed automata: flow transitions of the form 9

x " 1 ^C and jump transitions of the form G ^x1 " f pxq where C and G are conjunctions of constraints of the form x i ď c or x i ´xj ď c, and f i " x i or f i " 0.

-Initialized rectangular hybrid automata: flow transitions of the form a ď 9

x ď b ^c ď x ď d and jump transitions g ď x ď h ^j ď x 1 ď k. "Initialized" means that a jump transition g ď x ď h ^x1 " x is only allowed if the flow transitions in origin and destination locations are equal. [START_REF] Henzinger | What's decidable about hybrid automata[END_REF] prove that dropping any of the restrictions (variables decoupled in dynamics, staying condition and guards, and "initialization") makes reachability undecidable.

[AMP95] show that the reachability problem for hybrid automata with flow transitions 9

x " c^Ax ď b and jump transitions Gx ď h^x 1 " x is decidable in two dimensions but undecidable in three dimensions.

Unbounded-Time Analysis Methods

Generalizing timed automata, early methods for hybrid systems deal with piece-wise constant dynamics, which have linear analytic solutions. Thus, methods for computing the continuous post-condition ("time-elapse", §12.2.1) are very close to discrete program analysis with polyhedra. Unbounded time is achieved with the help of widening.

Hybrid max-strategy iteration ( §12.2.2) extends the max-strategy iteration approach ( §3.4.3) for computing invariants over template polyhedra to hybrid automata with linear dynamics.

Relational abstractions ( §12.2.3) transform a hybrid system into a discrete one by approximating the effect of the continuous evolution by a discrete transition.

We will explain these methods in detail because we are going to use them in §12. Then the set of reachable states by continuous evolution up to the staying condition C starting from a convex polyhedron X 0 can be easily computed as:

Polyhedral Time-Elapse

X " pX 0 Õ Dq [ C where X 0 Ď C.
This formula is very similar to the case of polyhedral translations C Ñ x 1 " x`D in abstract acceleration, except that, in the discrete case, we had to account for the fact that the number of iterations is integral. Since the behavior of the considered systems is linear, standard widening with polyhedra performs reasonably well and enables an unbounded-time analysis.

Hybrid Max-Strategy Iteration

Dang and Gawlitza [START_REF] Dang | Template-based unbouded time verification of affine hybrid automata[END_REF][START_REF] Dang | Discretizing affine hybrid automata with uncertainty[END_REF] formulate the reachability analysis of hybrid systems with linear dynamics in the framework of max-strategy iteration (see §3.4.3) with linear templates. Definition 12.1 (Positive invariant) Let T be a linear template. S " tx | Tpxq ď du is a positive invariant w.r.t the affine vector field V : R n Ñ R n iff @j : @x : T j¨x " d j ^ľ i‰j T i¨x ď d i ùñ T j¨V pxq ă 0 i.e., on the boundaries of S all vectors of V point inside S.

A positive invariant is an inductive invariant. The continuous post-condition post V pX 0 q associated with the flow relation V is the least positive invariant w.r.t. V starting from X 0 . post V must be encoded as the fixed point of a monotonic, concave operator f in order to be integrated into the max-strategy iteration framework. f is defined as follows:

f pdq " d `ǫ ¨∆pdq with the j th component of the vector ∆ defined as: ∆ j pdq " suptT j 9

x | Tx ď d ^Tj x ě d j ^px, 9 xq P V u and a "small enough" ǫ, such that f is monotonic on R m (see [START_REF] Dang | Discretizing affine hybrid automata with uncertainty[END_REF] for the conditions on ǫ). Moreover, the closure clpdq of an abstract value d w.r.t. the staying condition C (of which the constraints must be contained in the template) is defined as:

cl j pdq " suptT j x | Tx ď d ^x P Cu
Then the continuous evolution up to the staying condition is given by post V pX 0 q [ C " ´`lfpλX.X \ pcl ˝f qpXq ˘˝cl ¯pX 0 q Fig. 12.1 illustrates this encoding, which results in a discrete CFG.

The corresponding semantic inequations are then solved by max-strategy iteration. x " 1 9 y " y x`y ď 4

W X 0 X 0 \ post V pX 0 q [ C A B W (
9 x " ´x 9 y " ´1 x´y ď ´1 ℓ 0 ℓ 1 ℓ 2 x 1 " 0 ^y1 " 2 x`y " 4
x´y " ´1 Notice that the locations ℓ 1 and ℓ 2 are actually replaced by the structure according to Fig. 12.1b. We denote the bound variables associated to these locations with the corresponding subscripts A, B, W . For example, δ 1A denotes the bound variable vector corresponding to the location A in the structure replacing ℓ 1 .

Let us assume that we have already performed the first iteration having improved the strategies w.r.t. δ 1A and that we obtain the valuation:

d 1 " $ & % δ 0 Ñ 8 δ 1A Ñ p0, 2, ´2q δ 1B Ñ ´8 δ 1W Ñ ´8 δ 2 Ñ ´8
, .

-

In the second step p0, 2, ´2q will be propagated to ℓ 1B and ℓ 1W -it is inside the staying condition, thus clp¨q has no effect. In the third step we can improve the strategies w.r.t. δ 1B :

µ 3 " $ ' ' & ' ' % δ 0 ě 8 δ 2 ě ´8 δ 1A ě sup " T ˆx1 y 1 ˙| T ˆx y ˙ď δ 0 ^px, yq 1 " p0, 2q * δ 1B ě clpδ 1B `ǫ ¨∆V 1 pδ 1B qq δ 1W ě δ 1A , / / . / / - where ∆ V 1 j pδ 1B q " sup " T j ˆ9 x 9 y ˙| T ˆx y ˙ď δ 1B ^Tj ˆx y ˙ě δ 1Bj ^ˆ9 x 9 y ˙" ˆ1 y ˙*.
We thus get the valuation:

d 3 " $ & % δ 0 Ñ 8 δ 1A Ñ p0, 2, ´2q δ 1B Ñ p0, 4, ´2q δ 1W Ñ ´8 δ 2 Ñ ´8
, .

-

In
µ 7 " $ ' ' ' ' & ' ' ' ' % δ 0 ě 8 δ 1A ě p0, 2, ´2q δ 1B ě clpδ 1B `ǫ ¨∆V 1 pδ 1B qq δ 1W ě δ 1B δ 2A ě suptT ˆx1 y 1 ˙| T ˆx y ˙ď δ 1W ^x`y " 4u δ 2B ě clpδ 2B `ǫ ¨∆V 2 pδ 2B qq δ 2W ě δ 2A
, / / / / . / / / /which results in the valuation:

d 7 " $ & % δ 0 Ñ 8 δ 1A Ñ p0, 2, ´2q δ 1B Ñ p0, 4, ´2q δ 1W Ñ p0, 4, ´2q δ 1A Ñ p0, 4, ´2q δ 1B Ñ p0, 4, ´1q δ 1W Ñ p0, 4, ´2q
, .

-p0, 4, ´1q will be propagated to ℓ 2W , ℓ 1A , ℓ 1B , ℓ 1W and ℓ 2A . At this point no more strategy improvement is possible, i.e., we have reached the least fixed point, with the valuation:

d 10 " $ & % δ 0 Ñ 8 δ 1¨Ñ p0, 4, ´1q δ 2¨Ñ p0, 4, ´1q
, .

-As with all template-based methods, the precision crucially depends on the choice of the template. Also the computed invariants are inductive: some dynamics like rotations have no inductive invariants w.r.t. linear templates. The advantage of the technique in comparison with discretization-based methods is that the analysis is time-unbounded and thus the computation time is independent from the time horizon.

Relational Abstractions

Several methods for turning hybrid automata into discrete transition systems have been considered since the early times of hybrid automata based on finite bisimulation abstractions [Hen95, CK01, ADI02, GT08].

A recent method are relational abstractions [Tiw03, Tiw08, ST11, ZST12]. The idea is very similar to loop acceleration ( §4): the flow transition is replaced by a discrete selfloop transition labeled with the jump relation Rpx, x 1 q, i.e., a relation between values entering a location x and all values reachable by the flow relation x 1 . Definition 12.2 (Relational abstraction) [ST11] R Ď R 2n is a relational abstraction if for all trajectories τ : r0, δq Ñ R n it is the case that @t P r0, δq : pτ p0q, τ ptqq P R.

A relational abstraction is complete, if, whenever Rpx, x 1 q holds, then there is a trajectory τ from x to x 1 .

Relational abstractions for certain dynamics of hybrid automata can be given right away [START_REF] Sankaranarayanan | Relational abstractions for continuous and hybrid systems[END_REF]: -Piecewise constant dynamics ( 9x " d with d i ‰ 0):

Rpx, x 1 q " n ľ i"2 ˆx1 1 ´x1 d 1 " x 1 i ´xi d i ˙^ˆx 1 1 ´x1 d 1 ě 0
Ṫhis abstraction is complete. A special case are timed automata for which d " 1. Rpx, x1 q " 0 ď maxpApx 1 ´xq.{bq ď minpA 1 px 1 ´xq.{b 1 q This abstraction is complete. A special case are rectangular hybrid automata for which A " A 1 " I.

-Linear dynamics ( 9x " Cx) have (in general incomplete) abstractions depending on the matrix C:

-If C " diag pλ 1 , . . . , λ n q then Rpx, x 1 q " Dt ě 0 : Ź j x 1 j " e λ j t x j . In practice, the existential quantification is performed approximately over linear templates, or the relational abstraction is constructed by splitting cases w.r.t. the values of λ i (e.g., asymptotic behavior).

-If C is diagonizable with rational eigenvalues, then one can perform a basis change to reduce it to the previous case. -If C is nilpotent, then one can obtain a complete abstraction [START_REF] Sankaranarayanan | Relational abstractions for continuous and hybrid systems[END_REF]. Moreover, a single flow transition can be abstracted by a logical combination of relational abstractions.

Example 12.2 (Relational abstraction) We relationalize the hybrid automaton in Fig. 10.3: In the first mode we have the dynamics 30 ď 9 x´x ď 40 with the staying condition x ď 22: Exploiting the information about the asymptotic behavior of the solution we get the abstraction R 1 px, x 1 q " `px ă 40 ñ x ď x 1 ă 40q _ px ą 30 ñ 30 ă x 1 ď xq ˘^x ď 22 " x ď x 1 ď 22

Analogously, we get for the second mode R 2 px, x 1 q " 16 ď x 1 ď x. Fig. 12.3 shows the resulting discrete CFG.

This method represents a lightweight way to derive useful continuous invariants in some practical cases. Furthermore, the whole arsenal of existing discrete methods can be employed for analysis. It is implemented in the tool HybridSAL 1 .

Bounded-Time Analysis Methods

Initially, bounded model checking techniques for hybrid automata considered systems piecewise-constant dynamics that can be dealt with using the polyhedral time-elapse. More complicated dynamics require a time-discretization. Hence, such methods actually perform a set-based simulation.

2 3 4 5 6 x 1 x 2 X 0 X 1 X 2 Figure 12
.4: Flow pipe approximation of the set of trajectories starting from X 0 : the segment X 1 over-approximating time interval r0, δs, X 2 over-approximating rδ, 2δs; dashed. . . trajectories emanating from the vertices of X 0 .

HyTech and PHAVer HyTech2 was the first reachability analysis tool for hybrid systems [HH94, Ho95, HHWT97, HHWT98] and it had a major impact on subsequent developments. It considers systems with (or approximated by) constant differential inclusions and performs a polyhedral analysis (see §12.2.1) without widening.

PHAVer3 [START_REF] Frehse | PHAVer: Algorithmic verification of hybrid systems past HyTech[END_REF] improves HyTech in several aspects, inter alia, it uses state space partitioning based on a user-provided set of hyperplanes (predicates) and overapproximates on-the-fly linear dynamics by piecewise constant dynamics.

Set-based simulation. The idea of set-based simulation is to divide time into intervals r0, t 1 s, rt 1 , t 2 s,. . . and enclose the trajectories in each interval by, e.g., a polyhedron. The resulting disjunction of sets is called a flow-pipe (see Fig. 12.4). Starting from an initial set X 0 each integration step with a time step δ adds a new segment X k to the flow-pipe. These techniques generalize guaranteed integration [Löh88, NJC99, Bou08] from enclosing intervals to relational domains.

Academic verification tools for linear differential inclusions based on this technique are for example CheckMate4 [CK98, CK99, CK03] and d/dt5 [DM98, ABDM00]. Besides, zonotopes [START_REF] Girard | Reachability of uncertain linear systems using zonotopes[END_REF] and ellipsoids [KV00, BT00] have been considered for such computations, too.

A certain effort has been made in order to scale up the flow pipe computation while keeping an acceptable level of precision (e.g., [START_REF] Mark | Reachability analysis using polygonal projections[END_REF], [START_REF] Stursberg | Efficient representation and computation of reachable sets for hybrid systems[END_REF]). A breakthrough has been achieved by Le Guernic and Girard [START_REF] Le | Reachability analysis of hybrid systems using support functions[END_REF] with their double representation of convex sets using template polyhedra and support functions (see e.g., [START_REF]Convex optimization[END_REF]). This method is implemented in the tool SpaceEx6 [FGD `11], which can handle systems with more than 100 variables.

For linear systems, the flow-pipe segments are computed based on the analytic solution. However, this is no more possible in the case of non-linear systems. Hybridization [ADG07, DGM09] techniques enable to exploit the efficiency of linear system methods with the help of state space partitioning and linearization of the non-linear dynamics.

Alternative Approaches

Other approaches include methods involving level sets, satisfiability solving, quantifier elimination and theorem proving.

Level set methods.

Using level sets for proving safety properties is similar to Lyapunov functions for proving stability: a function f must be found of which the zero level set tx | f pxq " 0u separates safe and unsafe states. f is constructed by formulating a sum of squares problem and solving by semidefinite programming [START_REF] Prajna | Safety verification of hybrid systems using barrier certificates[END_REF], or from the Hamilton-Jacobi differential equation associated with the level set function (see [START_REF] Tomlin | Hybrid Control of Air Traffic Management Systems[END_REF][START_REF] Mitchell | Level set methods for computation in hybrid systems[END_REF] for details). These methods provide unbounded time verification for arbitrary dynamics, although their scalability is limited to at most 5 dimensions.

Constraint propagation and SAT-based approaches. HySAT [FH07, FHT `07] is a bounded model checker (BMC, see §3.1) for logico-numerical hybrid systems (see §11.2) with piece-wise constant dynamics. The BMC problem for a hybrid automaton is encoded as the SAT-problem of a formula involving constraints. Inside the DPLL procedure, the satisfiability of constraints is checked using an LP solver, arithmetic inference methods are employed to derive new facts about linear relations, and the repetitive structure of the BMC formula is exploited to prune the search space.

iSAT [START_REF] Eggers | SAT Modulo ODE: A direct SAT approach to hybrid systems[END_REF][START_REF] Eggers | Improving SAT Modulo ODE for hybrid systems analysis by combining different enclosure methods[END_REF] provides BMC for hybrid systems with arbitrary dynamics. It is based on a Boolean SAT-solver and interval constraint propagation. It uses a guaranteed interval ODE solver for the enclosure of trajectories. Due to these overapproximations, iSAT can only prove unsatisfiability. The advantage of the tool is that it can deal with logico-numerical hybrid systems with non-linear dynamics. The drawbacks are that an interval analysis yields quite coarse results and that it is limited to bounded time analysis.

HSolver [START_REF] Ratschan | Safety verification of hybrid systems by constraint propagation-based abstraction refinement[END_REF] combines interval constraint propagation with a grid-based abstraction refinement technique.

Other recent techniques like [START_REF] Gulwani | Constraint-based approach for analysis of hybrid systems[END_REF] rely on generic SMT solvers to compute templatebased invariants: i.e., the hybrid automaton and the property are translated into a big D@ formula. Then the least positive invariant w.r.t. the vector field is computed by mapping rational numbers to bounded-range integers and solving the system by a bit-vector decision procedure.

Differential dynamic logic.

A completely different approach is differential dynamic logic [START_REF] Platzer | Differential dynamic logic for hybrid systems[END_REF], which is first-order real arithmetic equipped with embedded dynamic behavior, i.e., ODEs, and modal operators "for all states" and "exists a state" for defining properties. A system is proved with the help of a sequent calculus based on symbolic decomposition according to proof rules and real quantifier elimination. The method is implemented in the semi-automatic tool KeYmaera [PQ08] which combines a deductive theorem prover, a computer algebra system, and differential induction [START_REF] Platzer | Differential-algebraic dynamic logic for differential-algebraic programs[END_REF].

The advantages are unbounded time verification for systems with arbitrary dynamics and the fact that it is not restricted to safety properties. The drawbacks are that the size of the proof may explode for systems with a complex logical structure and that user intervention is required when the theorem prover fails to find a proof automatically.

Chapter 13

Analysis of Logico-Numerical Hybrid Automata

The problem of analyzing logico-numerical hybrid automata bears much resemblance to the analysis of discrete logico-numerical programs: we have analysis methods for numerical systems available, but we cannot directly apply them to a logico-numerical system because the transition relations are formulas mixing Boolean and numerical variables. Also, we want to avoid enumerating the Boolean states by using logiconumerical analysis methods instead.

Hence, in this chapter, we will adapt and apply the basic concepts that we developed in the context of discrete logico-numerical systems to the analysis of hybrid logiconumerical systems.

The contributions of this chapter can be summarized as follows, see Fig. 13.1:

1. In §13.1 we propose techniques for adapting existing numerical hybrid analysis methods to logico-numerical systems and we apply them to three unbounded-time analysis methods.

2. Regarding state space partitioning, a good candidate for equivalence classes which we want to identify in hybrid systems are the continuous modes, i.e., distinct continuous behaviors. In §13.2 we propose two methods for discovering continuous modes within a logico-numerical hybrid system.

Logico-Numerical Hybrid Analysis Methods

The flow relations in a logico-numerical hybrid automaton are general logico-numerical formulas, but most existing continuous reachability methods require convex numerical flow relations.

b 1 ^"pb 2 ^x1 ď 10 ^9 x 1 " 1 _ b 2 ^x1 ě 0 ^9 x 1 " ´1q . . . . . . pb 2 ^x " 10 _ b 2 ^x " 0q ^b1 2 " b 2 (a) b 1 . . . . . . b 2 ^x1 ă 10 ^x1 1 " x 1 `1 _ b 2 ^x1 ą 0 ^x1 1 " x 1 ´1 pb 2 ^x " 10 _ b 2 ^x " 0q ^b1 2 " b 2 (b)
Figure 13.2: Analogies between a logico-numerical hybrid automaton (a) and a CFG of a logico-numerical program (b).

Since a flow transition can be somehow considered as a self-loop (see Fig. 13.2), the problem resembles the one of logico-numerical abstract acceleration ( §8). But actually, it is even simpler, because only continuous (numerical) variables evolve in flow transitions, while the discrete (Boolean and numerical) variables are known to stay unmodifiedwhereas in discrete self-loops, both, Boolean and numerical variables evolve "hand-inhand". Therefore, decoupling Boolean and numerical variables is not necessary.

We describe first the principles (13.1.1) for adapting numerical hybrid analysis methods to logico-numerical hybrid automata. Then we will show how to apply these principles to three selected hybrid analysis methods (13.1.2): polyhedral time elapse, hybrid max-strategy iteration, and relational abstractions.

Basic Techniques

Structure of abstract domains. Logico-numerical hybrid automata have the state space B m ˆN p ˆRn with the discrete state space B m ˆN p , where N p may be e.g., Z q ˆRp´q , and the continuous state space R n .

We abstract all numerical variables together in the same abstract domain. Hence, we get the structure of logico-numerical domains for discrete programs (see §7.2.3) with the product domain ℘pB m q ˆApR p`n q and the power domain B m Ñ ApR p`n q, where A is an abstract domain, e.g., convex polyhedra or template polyhedra.

This choice enables us to establish relations between discrete and continuous numerical variables:

Example 13.1 (Discrete/continuous relations) let hybrid dcrel () = (x,n) where rec der t = 1 reset 0 every (up(10-t)) init 0 and der x = 2 init 0 and n = (last n+1) every (up(10-t)) init 0 Using the techniques described below, we can prove the mixed discrete/continuous property: 20n ď x ď 20pn`1q.

We propose an on-the-fly computation of a numerical flow-relation that can be processed by a continuous reachability method: 171 13.1. Logico-Numerical Hybrid Analysis Methods Specializing the flow relation. The first step is the partial evaluation (specialization) of the flow relation by the current reachable states in the respective location. For this purpose, we compute the current state S zero-dynamics of all variables s zero-dynamics which are constant during the flow transition of the location: these are all the discrete variables and those continuous variables the derivatives of which evaluate to zero: S zero-dynamics " Ds non-zero-dynamics : S.

Example 13.2 (Specializing the flow relation) We explain this procedure for the flow relation

V " `pb 1 ^b2 ^9 x 1 " x 2 ´x1 ^9 x 2 " n´1q _ pb 1 ^ b 2 ^9 x 1 " 1 ^9 x 2 " x 1 q ȃnd
the current state S " `b2 ^n " 1 ^0 ď x 1 ^0 ď x 2 ^x1 `x2 ď 4 ˘. In order to find out which variables have non-zero dynamics, we simplify the flow relation by the discrete states S discrete " Dx : S " pb 2 ^n " 1q:

Db 1 , b 2 , n : V Ò S discrete " p 9 x 1 " x 2 ´x1 ^9 x 2 " 0q
Hence, the only variable with non-zero dynamics is x 1 :

S zero-dynamics " pDx 1 : Sq " pb 2 ^n " 1 ^0 ď x 2 ď 4q and we can compute the flow relation specialized w.r.t. the current reachable states:

V Ò S zero-dynamics " pb 1 ^0 ď 9 x 1 `x1 ď 4 ^9 x 2 " 0q
Extracting convex flow relations. The second step is to extract convex numerical flow relations. There are two opposite approaches: (1) enumerating and splitting disjunctions or (2) convexifying disjunctions. Method (1) involves splitting V ps, 9 xq into a disjunction of numerically convex formulas Ž j V j ps, 9 xq " decomp convexpV q (see §7.2.2), and then computing the continuous post-condition by Ů j post V j .

Example 13.3 (Splitting disjunctions) The flow relation pb 1 _ b 2 q ^px ď 0 _ x ě 5q ^p 9

x " 1´xq _ p b 1 ^b2 q ^p0 ď x ď 5q ^p 9

x " 1q is decomposed into three numerically convex disjuncts pb 1 _ b 2 q ^px ď 0q ^p 9

x " 1´xq _ pb 1 _ b 2 q ^px ě 5q ^p 9

x " 1´xq _ p b 1 ^b2 q ^p0 ď x ď 5q ^p 9

x " 1q

The less precise but also less expensive technique is (2), i.e., to take the convex hull of the flow relation V 1 " cvxpV q.

Example 13.4 (Convexifying disjunctions) For the flow relation in Ex. 13.3 we obtain the convexified flow relation 1 ď 9

x`x ď 6.

pon ^9 x " n`20´x ^x ď n`1q _ p on ^9 x "´x ^x ě n´1q on 1 ^x1 " n 1 ^18 ď n 1 ď 22 pon 1 " onq ^px 1 " xq pn 1 " nq ^pon ^x " n`1 _ on ^x " n´1q

Figure 13.3: Logico-numerical polyhedral time-elapse Ex. 13.5

Application to Numerical Hybrid Analysis Methods

We show the application of these principles to three hybrid system analysis techniques:

Polyhedral Time-elapse

The polyhedral time elapse method ( §12.2.1) computes the reachable states by a flow transition with the constant differential inclusion 9

x P D and the staying condition C by pX Õ Dq [ C.

We can apply the convexification method to logico-numerical flow transitions by computing D " cvxpDx : V 1 q and C " cvxpD 9

x : V 1 q where V 1 " Db : `V pb, x, 9 xq Ò pDx non-zero-dynamics : Sq ˘.

Splitting disjunctions means applying the computation above to each disjunct in Ť i V i " decomp convexpV q and computing the continuous post-condition for each pair pD i , C i q, i.e., Ů i pX Õ D i q [ C i .

Example 13.5 (Logico-numerical polyhedral time-elapse) We analyze the thermostat system with setpoint n shown in Fig. 13.3 using the logico-numerical product domain and the splitting method:

The initial state w.r.t. variables with zero-dynamics is S zero-dynamics 0 " pon ^18 ď n ď 22q. Thus, in the first iteration the flow relation simplifies to the first disjunct:

V 1 " `on ^9 x " n`20´x ^x ď n`1 ˘. We compute V 1 1 " `Dn, on : on ^9 x " n`20´x ^x ď n`1 ^18 ď n ď 22
˘" `38 ď 9

x`x ď 42 ^x ď 23 By existential quantification of x and 9

x respectively, we get D 1 " p19 ď 9 xq and C 1 " px ď 23q. The result after the flow transition is S 1 " pon ^18 ď n ď 22 ^18 ď x ď 23q and after the discrete transition S 2 " p18 ď n ď 22 ^18 ď x ď 23q.

In the next iteration we have S zero-dynamics 1 " p18 ď n ď 22q, thus, the whole flow relation is active and we decompose it into the two disjuncts V 1 _ V 2 . D 1 and C 1 do not change, for V 2 " p on ^9 x "´x ^x ě n´1q we obtain the polyhedra D 2 " p 9

x ď ´17q and C 2 " p17 ď xq.

The flow transition results in S 3 " p18 ď n ď 22 ^17 ď x ď 23q, which is a fixed point.

Relational Abstractions

Relational abstractions ( §12.2.3) over-approximate the flow relation by a discrete transition, and thus, they transform a hybrid automaton into a discrete CFG. The extension to logico-numerical hybrid automata is straightforward. However, in order to enable the reuse of existing discrete analysis tools, it is not possible to simplify the flow relation on-the-fly. So, we have to relationalize the whole hybrid automaton before analyzing the obtained discrete system.

Using the splitting technique, the continuous part of each disjunct is relationalized separately. The convexification method, i.e., relationalizing the convex hull, is very likely to lose important information, because it is applied without any knowledge about reachable states.

Example 13.6 (Logico-numerical relationalization) We analyze the thermostat system in Fig. 13.4a): We split V " V 1 _ V 2 with V 1 " on ^9 x " 40´x ^x ď 20 and V 2 " on ^9 x"´x ^x ě 18. We compute the relational abstraction of V 1 by exploiting the asymptotic behavior of the dynamics: R 1 " `px ă 40 ñ x ď x 1 ă 40q _ px ą 40 ñ 40 ă x 1 ď xq ˘^on ^x ď 20 ^x1 ď 20 " on ^x ď x 1 ď 20

In the same way we obtain for V 2 : R 2 " p on ^18 ď x 1 ď xq. The resulting discrete CFG is shown in Fig. 13.4b. The analysis using the logico-numerical product domain yields the invariant 18 ď x ď 20.

Using the convexification method, we obtain cvxpV q " p0 ď 9

x `x ď 40q and after relationalization R 1 " px ă 0 ñ x ď x 1 ă 40q _ p0 ď x ď 40 ñ 0 ď x 1 ď 40q _ px ą 40 ñ 0 ă x 1 ď xq. Here, the convexification loses the important constraints of the staying condition, thus the analysis yields the weaker invariant 0 ď x ď 40.

Max-Strategy Iteration

We extend the logico-numerical max-strategy iteration ( §9) to hybrid systems using the encoding of flow transitions as explained in §12.2.2.

As in §9, we use the splitting method for decomposing numerically non-convex transitions into several strategies. This results in an encoding of a flow relation according to the automaton scheme of Fig. 12.1, but with one self-loop per disjunct in location B.

The number of strategies can be reduced by using the convexification technique, which generates only a single continuous strategy per flow transition.

Example 13.7 (Hybrid logico-numerical max-strategy iteration) We analyze the thermostat system in Fig. 13.4a using an interval template ˘x in the product domain B n ˆPol T pRq.

We start in the state pon, xq " ptt, r19, 19sq. No discrete transition which changes a Boolean state can be taken. We switch to phase (2): there are three available strategies associated to the transitions px 1 " 19q, `p 9

x " 40´xq ^x ď 20 ˘and px 1 " xq. We can improve w.r.t. the upper bound of x by using the second strategy and obtain ptt, r19, 20sq. No more improvement is possible. We continue with phase (1) and take the discrete transition that results in pJ, r19, 20sq. Then, in phase (2), four strategies are available: the three above and `p 9

x " ´xq ^x ě 18 ˘. We can improve the lower bound of x by the latter one and obtain pJ, r18, 20sq, which is a fixed point.

Partitioning Techniques for Hybrid Systems

In logico-numerical hybrid automata, a flow relation is a logico-numerical formula containing the staying condition and differential inclusions. One location can regroup many distinct continuous behaviors, and thus, the analysis over a CFG consisting of a single location is not very precise.

As for discrete systems, our approach is to increase the precision by partitioning the system into locations such that distinct continuous behaviors are associated with separate locations.

We propose two partitioning methods for discovering these continuous modes: one detects modes defined by equivalence classes of Boolean states ( §13.2.1), whereas the other one performs an analysis to detect modes defined by equivalence classes of discrete numerical states ( §13.2.2).

Boolean-Defined Continuous Modes

The first method we describe is the hybrid analog of the method described in §8.3 to find the Boolean states that imply the same numerical actions (Boolean-defined "discrete numerical modes"). Now, we apply it to the flow relation in order to detect the Boolean states with the same continuous dynamics.

We represent flow relations V pb, x, 9 xq with the help of flow functions of the form 9 x i " f cx i pb, β, C, x, ξq (where f cx i is an arithmetic expression with tests, see §7.2.2), such that, together with the assertion Apb, β, Cq, we obtain semantically V pb, x, 9

xq " Dβ, ξ : A ^Źi p 9

x i " f cx i q. f cx i is represented as an MtBdd (in the same way as discrete transition functions (see §7.2.2)). We denote f cx the vectorized form with factorized guards (MtBdd product, §7.2.2) of the flow functions f cx i :

f cx pb, β, C, x, ξq " ł $ & % @β 1 , C 1 : Apb 1 , β 1 , C 1 q ñ Dβ 2 , C 2 : Apb 2 , β 2 , C 2 q ^f cx pb 1 , β 1 , C 1 q " f cx pb 2 , β 2 , C 2 q and vice versa

The intuition of this heuristics is to make equivalent the Boolean states which imply to the same set of ODEs.

Numerically Defined Continuous Modes

Often the continuous modes are characterized by the values of discrete numerical variables, like in the following example: This system has two modes 9

x " 40 `ξ ´x and 9

x " ξ ´x according to the values of n. Hence, we want to assign these two modes to distinct locations by considering the partition t35 ď n ď 45, ´5 ď n ď 5u of the reachable state space.

Thus, our goal is to find a finite partition of valuations of those discrete numerical variables occurring in the flow relation. We could detect such partitions syntactically by inspecting the transition relations. However, we can do better by performing the following analysis:

Analysis

The idea is to perform an interval analysis in an abstract domain that represents the reachable values of those variables as a disjunction of interval vectors for which the numerical transitions are guaranteed to generate only a finite set of intervals. The other variables are abstracted by a single interval vector as in the standard interval domain ( §3.3.1).

We define the following abstract domain:

Finitely disjunctive, partitioned interval domain FdpInt pR n q. This domain partitions the set of variables in two partitions with q and n´q variables respectively and abstracts them as follows:

℘pR n q ´Ñ Ð ´ά γ ℘pInt pR q qq ˆIntpR n´q q An abstract value pP J , I K q P FdpInt pR n q is a pair consisting of a finite set (disjunctions) P of interval vectors for the set of variables J (|J| " q), and one interval vector I for the set of variables K (|K| " n´q). J and K form a partition of the set of variables. We list the domain operations in Tab. 13.1. We denote cvxpP q the convex hull operation which transforms a set of interval vectors P into a single interval vector. J and K are represented as pH, Jq and pH, Kq respectively.

The partition of variables tJ, Ku changes dynamically according to the operations: For example, the resulting partition of a union of two abstract values with partitions tJ 1 , K 1 u and tJ 2 , K 2 u is tJ 1 X J 2 , K 1 Y K 2 u.

The post-condition (image) of a transition f gathers only the values of those variables into the disjunctive component P J 1 of the abstract value that result from so-called "finitely generating transitions" (defined below).

The image operator is defined as f pP J , I K q " pP J 1 , I K 1 q with ' P J 1 " Ś i f i pP J , I K q for those f i which are finitely generating w.r.t. pP J , I K q, ' I K 1 " Ś i f i pcvxpP J q, I K q for those f i which are not finitely generating w.r.t. pP J , I K q.

Definition 13.3 (Finitely generating transitions) A transition f i " `gpx, ξq Ñ x 1 i " a i px, ξq ˘is finitely generating w.r.t. pP J , I K q if it is (1) an assignment to a constant: gpx, ξq Ñ x 1 i " d i , or (2) an assignment to inputs: g 1 pxq ^g2 pξq Ñ x 1 i " C i ξ `di , or 13.2. Partitioning Techniques for Hybrid Systems Inclusion:

pP J 1 1 , I K 1 1 q Ď pP J 2 2 , I K 2 2 q ô K 1 Ď K 2 ^$ ' & ' % P J 2 1 Ď P J 2 2 I K 1 1 Ď Int I K 1 2 cvxpP J 1 XK 2 1 q Ď Int I J 1 XK 2 2
Abstraction: αpXq = pα Int pXq, Kq Concretization:

γpP, Iq = `ŤpPP γ Int ppq ˘ˆγ Int pIq Union:

pP J 1 1 , I K 1 1 q \ pP J 2 2 , I K 2 2 q = pP J 1 XJ 2 , I K 1 YK 2 q where $ ' ' ' & ' ' ' %

P J 1 XJ 2 " P J 1 XJ 2 1 Y P J 1 XJ 2 2 I K 1 YK 2 " ¨IK 1 XK 2 1 \ Int I K 1 XK 2 2 cvxpP J 1 XK 2 1 q \ Int I J 1 XK 2 2 I J 2 XK 1 1 \ Int cvxpP J 2 XK 1 2 q '
Image: f pP J , I K q = pP J 1 , I K 1 q as defined in the text Widening: pP 1 , I 1 q∇pP 2 , I 2 q = " same as union, but with ∇ Int instead of \ Int Table 13.1: Operations of the finitely disjunctive, partitioned interval domain. The superscript Int indicates the operations of the standard interval domain.

(3) the identity or a "simple" variable exchange possibly with negation: g 1 px nf , ξq ĝ2 px f , ξq Ñ x 1 i " cx j with c P t´1, 1u and variables x f , x j in J and variables x nf in K.

Mind that case (2) requires that the inputs are not related to the state variables in the guard, and case (3) requires that the variables occurring on the right-hand side of the assignment are not related to variables in K via the guard. The reason for these requirements is the observation made in Prop. 5.1 that, otherwise, we could encode any (non-finitely generating) transition.

The conditions (1) to (3) assure that a transition generates a only finite number of intervals, however, they probably do not characterize the maximal set of such transitions.

The domain FdpInt pR n q can be combined with Booleans in the usual way, resulting either in the power domain B p Ñ FdpInt pR n q or the product domain ℘pB p q FdpInt pR n q. The behavior of continuous variables in a location is abstracted by the staying condition.

Partitioning

After having computed the fixed point with Kleene iteration, widening and descending iterations, for example in the domain L Ñ ℘pB p q ˆFdpInt pR n q, we obtain for each location ℓ with abstract value A ℓ " pB, P J , I K q, a set Ψ " tpB, p, I KXU q | p P P JXU u where U are the numerical variables occurring in the flow relation V ℓ . The elements of Ψ (viewed as predicates) are then used in the partitioning process (see §7.3.3). We apply this method to the following (purely numerical) example using the domain FdpInt pR n q:

Example 13.11 (Partitioning by numerically defined modes II) We consider a system of two particles with positions x and y and velocities v and w respectively. With 9 x " v ^9 y " w ^x1 ď y 1 ^q " below 9

x " v ^9 y " w ^x1 ď y 1 ^q " ready I x 1 ă y 1

x 1 " y 1 ^v1 " w ^w1 " v (a) Before partitioning. 9

x " v " v 0 9 y " w " w 0 x1 ď y 1 ^q " below 9

x " v " v 0 9 y " w " w 0 x1 ď y 1 ^q " ready 9

x " v " w 0 9 y " w " v 0 x1 ď y 1 ^q " below 9

x " v " w 0 9 y " w " v 0 x1 ď y 1 ^q " ready I

x 1 ă y 1

x 1 ă y 1

x 1 " y 1 ^v1 " w 0 ^w1 " v 0 x 1 " y 1 ^v1 " v 0 ^w1 " w 0 (b) After partitioning.

Figure 13.5: Partitioning by numerically defined modes: Ex. 13.11 particle collision (The location corresponding to q " above is not depicted; it is not reachable anyway.)

the given initial state, they collide when x 1 " y 1 .

I " ˆx0 " ˆ0 3 ˙^y 0 " ˆ6 4 ˙^v 0 " ˆ2

´3 ˙^w 0 " ˆ´4 ´4 ˙$ ' ' & ' ' % 9
x " v 9 y " w v 1 " w if uppx 1 ´y1 q w 1 " v if uppx 1 ´y1 q Fig. 13.5a depicts the hybrid automaton obtained by applying the translation of §11 and partitioning by q. Applying our analysis above, we get the following results in both locations: ¨¨v

Conclusions and Perspectives

Conclusions and Perspectives

This chapter actually unified two extensions: on the one hand, we extended the logiconumerical analysis approach from discrete to hybrid systems, and on the other hand we extended hybrid analysis methods from numerical to logico-numerical hybrid systems.

In this spirit, we reused the technique for identifying modes according to equivalence classes of Boolean states, which we developed in the context of logico-numerical abstract acceleration, for detecting the continuous modes of a hybrid system. Besides, we complemented this technique by a method for detecting modes defined by numerical states, which is based on a particular disjunctive interval analysis.

Regarding analysis methods, we showed how to employ the basic techniques, for example to deal with non-convex conditions or to extract numerical relations from logico-numerical ones, for extending hybrid analysis methods from numerical to logiconumerical systems. We have already used these basic techniques in a similar way in the context of our discrete logico-numerical methods.

As a consequence of this unified approach, we could also use our analysis methods originally developed for discrete systems, logico-numerical abstract acceleration for instance, to treat the discrete transitions during the analysis of a hybrid system.

Perspectives.

In the context of abstract interpretation, we are mainly interested in unbounded-time reachability. However, the principles of §13.1.1 are also applicable in the same manner to the set-simulation methods ( §12.3) targeting bounded modelchecking. Hence, they could also help to speed up these techniques when applied to logico-numerical systems.

Our techniques for turning numerical hybrid analysis methods into logico-numerical ones considered only the extreme techniques for convexifying flow transitions, i.e., either splitting disjunctions or computing the convex hull: it should be investigated whether there are reasonable heuristics for an intermediate treatment allowing precision traded off for efficiency.

The abstract-interpretation-based analysis of logico-numerical hybrid systems in a more implicit way is a novel approach. In this work, we have shown its basic feasibility. However, further research and experimentation are necessary in order to assess and exploit the full potential of such methods.

Part IV

Implementation and Conclusion

Chapter 14

Implementation: The Tool ReaVer

We have implemented the verification methods developed throughout this thesis in a tool called ReaVer, REActive system VERifier.

In order to keep it as generic and extensible as possible, we separated the implementation into (1) a framework providing general facilities and defining generic concepts and (2) the implementations of these concepts making up the actual tool. The framework is built upon the logico-numerical abstract domain library BddApron. Implementations may additionally call other libraries, such as LP or SMT solvers. The tool is implemented using the OCaml language; the size of the code is approximately 4KLOC for (1) and 8KLOC for (2).

We will first briefly give an overview of the framework ( §14.1) before describing which methods ( §14.2) are implemented in the tool.

The Framework

CFG Transformations

These comprise CFG preprocessing and simplifications ( §7.3.3, §8.1) as well as partitioning methods (and their variants) for discrete and hybrid programs: -"manual" partitioning by a given set of predicates; -partition by initial (I), error (E) and other ( pI _ Eq) states ( §7.3.2); -enumeration of Boolean states ( §7.3); -partitioning by (Boolean-defined) discrete numerical modes ( §8.3); -partition refinement by Boolean backward bisimulation ( §8.3); -partitioning by Boolean-defined continuous numerical modes ( §13.2.1); -partitioning by numerically defined continuous numerical modes ( §13.2.2).

Besides a forward and backward Boolean analysis ( §7.3.3), for discrete programs the following analyses are available: -logico-numerical standard analysis (cf. §7.2.3, §7.3.1) in forward and backward direction parametrized with a logico-numerical product or power domain with a numerical domain from the Apron library; -forward logico-numerical abstract acceleration ( §8.2) with convex polyhedra in logiconumerical product or power combination; -forward logico-numerical max-strategy iteration ( §9.2) using a logico-numerical product or power domain with template polyhedra. For hybrid programs, the following analyses are available ( §13.1.2): -forward logico-numerical polyhedral time-elapse parametrized with the logico-numerical product or power domain with convex polyhedra; 187 14.2. The Tool -forward logico-numerical hybrid max-strategy iteration using the logico-numerical product or power domain with template polyhedra; -forward relational abstractions (currently restricted to abstractions not requiring a basis change) as preprocessing for a discrete analysis.

The purely numerical versions of the analyses (including backward abstract acceleration ( §5.2)) are applicable after proper preprocessing of the CFG, i.e., enumeration of the Boolean states.

The max-strategy iteration-based methods call the solver of Gawlitza [START_REF] Dang | Discretizing affine hybrid automata with uncertainty[END_REF] (which is based on the LP solver QSopt ex2 and the SMT solver Yices3 ).

Analysis Example with ReaVer

In order to illustrate the basic output of the analyzer, we analyze the following small Lucid Synchrone program: let node main i = (assert,ok) where rec assert = true and ok = true fby (ok && -10<=x && x<=10) and x = 0 fby (if i then -x else if x<=9 then x+1 else x)

We launch the analyzer with the command reaver example.ls and we get the output (compressed): -We analyzed the program using forward abstract acceleration, which inferred the displayed invariants in the locations. -The variables occurring in the invariants correspond to the expressions in the source program listed after variable mapping. -The analysis concluded with the result PROPERTY TRUE. We can also display the CFG (using the Dot format, see Fig. 14.4).

We refer to the tool's website http://pop-art.inrialpes.fr/people/schramme/ reaver/ for additional information.

Conclusions and Perspectives

We briefly described the tool ReaVer for the verification of discrete and hybrid dataflow programs and its underlying framework, which makes the tool easy to extend. Throughout this work, the tool has proved its utility for experimenting various methods and their combinations as well as for automating benchmark series with different analysis options.

The wish list of features to be integrated into the tool is long. We describe here those that we think are the most important:

Broader support for high-level languages. The current connection of Zelus/Lucid Synchrone to our tool serves as proof-of-concept -e.g., state machines (automaton)

are not yet supported. In order to provide a broader support for the analysis of highlevel synchronous (hybrid) programs, the integration of the Zelus/Lucid Synchrone Chapter 15

Conclusions and Perspectives

Summary and Discussion

We started this thesis with the motivation to verify safety-critical embedded systems, and more precisely, systems with Boolean and numerical variables and exhibiting discrete and continuous behavior.

We pursued the objective of improving the precision of inferred properties while enhancing scalability w.r.t. the Boolean combinatorics of logico-numerical systems. In addition, we considered the analysis of embedded systems modeled in hybrid simulation languages.

Our verification approach is based on logico-numerical analysis methods, i.e., abstract interpretation methods that are capable of handling both, Boolean and numerical, variables in an implicit way, and state space partitioning. Within this framework, we adapted numerical methods that are known to improve the precision to the logiconumerical context. Regarding hybrid simulation languages, we proposed a translation to logical-numerical hybrid automata, and we showed that our logical-numerical analysis approach also applies to such systems.

Our experiments have shown that these methods can improve the efficiency of the analysis by at least one order of magnitude compared to purely numerical approaches, while improving the precision of the discovered invariants.

Verification of discrete numerical systems using abstract acceleration. The first numerical method for discrete systems we considered was abstract acceleration -a precise polyhedral extrapolation operator for some types of affine transformations -to which we contributed the following extensions:

We made it handle numerical inputs, which was less straightforward than expected due to the observation that resetting a variable to an input occurring without restrictions in the guard of the transition can emulate a general transformation that we do not (yet) know how to accelerate. In our experiments, we perceived that abstract acceleration was always at least as precise as standard Kleene iteration with widening and descending iterations, and in most cases faster than the latter.

We extended abstract acceleration to co-reachability analysis which is slightly different from the forward direction because of the asymmetry of the type of transitions (guarded actions) we considered.

However, in these extensions we only considered translations and translations with resets, which are not the only transitions types that are worth being accelerated. This led us to revisit linear accelerability and to provide a characterization of linearly accelerable linear transformations based on the Jordan canonical form of the homogenized, linear form of affine transformations, which takes into account the initial set. This criterion turned out to be slightly more general than the finite monoid characterization used in exact acceleration. We used this result to formulate an additional abstract acceleration formula. Yet, in general, this requires a change of basis, which is difficult to implement in practice. Thus, we do not yet know how to exploit these results to their full extent in practice.

Verification of discrete logico-numerical systems using abstract acceleration and max-strategy iteration. The adaptation of numerical analysis methods to the logico-numerical context has to cope with the tight coupling between Boolean and numerical variables in logico-numerical transitions.

Our approach to logico-numerical abstract acceleration consisted in relaxing this coupling without losing too much precision. The method is supported by suitable partitioning techniques: we proposed a partitioning method by numerical modes, which proved very effective in our experiments.

Our logico-numerical max-strategy iteration algorithm solves the issue of the coupling between Boolean and numerical variables by exploring increasingly larger Boolean subsystems by alternating propagation and max-strategy iteration phases. While a previous attempt for logico-numerical strategy iteration relied on Kleene iteration and widening, our algorithm relies on LP solving, and thus, it is indeed able to compute the least fixed point for affine programs w.r.t. logico-numerical domains with linear templates.

Our experiments have shown that these techniques can improve the efficiency of the analysis by at least one order of magnitude (w.r.t. system size or computation time) compared to purely numerical approaches, while enhancing the precision of the inferred invariants.

Translation of the hybrid synchronous language Zelus to logico-numerical hybrid automata. Another goal was the verification of high-level languages for embedded systems. We considered the hybrid synchronous language Zelus, which enables tightly integrated programming of systems with discrete and continuous behavior with a semantically clear interaction based on zero-crossings. However, we do not know how to verify systems with zero-crossings using existing hybrid analysis methods.

For this reason, we proposed a sound translation from an intermediate hybrid dataflow formalism with zero-crossings to logico-numerical hybrid automata. This translation entails over-approximations because the semantics of zero-crossings cannot be expressed exactly in hybrid automata. There are several choices for defining the semantics of zero-crossings, which result in qualitatively quite different translations. Moreover, our translation introduces a new finite-type variable for each zero-crossing, which makes the discrete state space larger.

Unbounded-time verification of logico-numerical hybrid automata. These logico-numerical hybrid automata could be verified using existing hybrid verification tools by resorting to Boolean state space enumeration. We showed how to extend the concept of logico-numerical analyses to hybrid systems in order to avoid this enumeration:

Although flow transitions in hybrid systems and self-loops in discrete systems raise similar problems, the situation is easier with flow transitions, because only numerical 193 15.2. Perspectives variables evolve continuously, and thus, Boolean and numerical variables are already decoupled. We proposed a method that dynamically derives flow relations that can be handled by existing hybrid analysis methods, and we exemplified this technique for three unbounded-time hybrid analysis methods. Moreover, we proposed techniques for partitioning the system by its continuous numerical modes.

Verification tool ReaVer. We implemented a verification tool ReaVer for abstract interpretation of discrete and hybrid programs. We used logico-numerical hybrid automata as a common internal representation and the BddApron and Apron abstract domain libraries for representing formulas and abstract values. The tool is designed as an extensible framework: new front ends, domains, partitioning and analysis techniques can be added. The current version supports a front end for a simple hybrid data flow format and a subset of Zelus, logico-numerical product and power domains of the available Apron domains, as well as the numerical and logico-numerical versions of the techniques proposed in this thesis.

Summing up, this work proposes a unified approach to the verification of discrete and hybrid logico-numerical systems based on abstract interpretation, which is capable of integrating sophisticated numerical abstract interpretation methods while successfully trading precision for efficiency.

Perspectives

We conclude by summarizing the most important enhancements, extensions and research directions w.r.t. the proposed methods.

Generalization of the abstract acceleration concept. The currently used graphexpansion to deal with multiple loops in abstract acceleration could be a possible bottleneck in scaling up further. It would be an interesting approach to experiment heuristics for reducing the number of loops by joining them, similarly to the derivative closure method [START_REF] Ancourt | A modular static analysis approach to affine loop invariants detection[END_REF]. Moreover, we have only dealt with self-loops. Monniaux and Gonnord [START_REF] Monniaux | Using bounded model checking to focus fixpoint iterations[END_REF] propose an improvement of abstract acceleration of cycles supported by an SMT solver. We could take advantage of this method, although an adaptation will be necessary to deal with numerical inputs of synchronous programs.

We assume that the potential of abstract acceleration is far from being fully exploited. In this work, we have only made a first step in generalizing the abstract acceleration concept. Further research will be necessary in order to enable the computation of polyhedral approximations that are able to discover complex invariants e.g., of general linear transformations. Such methods are not only of interest for discrete loop analysis but also for computing continuous evolutions in hybrid systems.

Template inference and a logico-numerical max-strategy solver. A related topic is template inference: although max-strategy iteration computes the least fixed point, it cannot discover complex invariants, because the template has to be fixed in advance. Abstract acceleration could be used to guess a better template before computing the precise fixed point using max-strategy iteration.

Our logico-numerical max-strategy is based on a simple, generic algorithm. It would be desirable to develop a more integrated logico-numerical max-strategy solver in order to boost the performance of this approach, possibly by making more extensive use of SMT solvers.

Further improving scalability. Our experimental results showed that partitioning heuristics are crucial for making analyses tractable. In this thesis we considered only static partitioning. Yet, in our experiments the dynamic partitioning technique of Jeannet et al [START_REF] Jeannet | Dynamic partitioning in analyses of numerical properties[END_REF] proved to be superior to our static partitioning in some cases. We believe that partition refinement techniques are indispensable in further improving the scalability of our verification tool.

The Astrée tool [BCC `03] uses grouping ("packing") of variables by syntax-based heuristics in order to scale up the analysis of C programs. Packing induces product domains that enable the analysis of groups of variables with distinct precision and thus, it focuses the use of expensive domains like convex polyhedra to presumably relevant sets of variables. Such techniques are orthogonal to ours and could be integrated in our tool. However, their effectiveness in the context of data flow programs remains to be evaluated.

Another point we have not yet exploited until now is the modular structure of highlevel programs: in designing complex systems, modularity has proved to be the key to success. We suppose that this is also true for verification: interprocedural analyses have shown that modular approaches help to scale up in static analysis.

All these techniques ultimately trade precision for efficiency.

More complete support for high-level languages. The current version of our tool supports only a small subset of the Zelus language. We should push our development further to a more complete support. Moreover, a tighter integration with the front end will be necessary in order to implement a more practical return-to-source. Most existing benchmarks for hybrid systems aim at assessing the precise computation of the continuous behavior, whereas the discrete controller part is rather simplistic. Since it is much easier to program complex examples using these high-level programming languages, we assume that this will give us access to a larger range of relevant benchmarks.

Further experimental evaluation and comparison of methods. We have not yet performed a thorough experimental evaluation of our hybrid system analysis methods. We can only compare the numerical with the logico-numerical version of the hybrid analysis methods we considered, since, to our knowledge, there is no other logico-numerical, unbounded-time verification tool for hybrid systems. It is difficult to reasonably compare unbounded-time methods with bounded-time model checkers like HySAT and iSAT, as well as with set-simulation-based methods like SpaceEx, because their goal is primarily to find bugs and not to prove their absence. However, in the discrete case, a comparison with tools based on k-induction, e.g., Kind, which are able to provide unbounded-time proofs, would be interesting.

Finally, there is a plethora of proposed abstract interpretation methods often implemented in prototype tools with incompatible input formats, which makes their comparison cumbersome and time-consuming. A comparison of a wide range of methods would be possible by plugging these techniques into our tool framework.

Further applications and combining approaches. The hybrid programs we consider are general event-triggered systems that can emulate time-triggered systems. However, time-triggered systems can probably be analyzed more precisely when taking into account the strictly periodic structure of their discrete transitions associated to the controller. Zutshi et al [START_REF] Zutshi | Timed relational abstractions for sampled data control systems[END_REF] propose an analysis method for time-triggered (hybrid)

  χ " 1) d'une transformation affine.

  Figure 1.1: Embedded system

Figure 1 . 2 :

 12 Figure 1.2: Organization of the thesis: state of the art (shaded) and contributions.

Definition 2. 3 (

 3 Control flow graph) A control flow graph (CFG) xΣ, Υ, L, , Σ 0 y is a directed graph where • Σ and Υ are the state and input spaces, • L is the set of locations (the vertices of the graph), • Ď L ˆR ˆL defines arcs (the edges of the graph) between the locations. The arcs are labeled with a transition relation R P R " pΣ ˆΥ ˆΣq.

Figure 2 . 1 :

 21 Figure 2.1: CFG for the program in Ex. 2.2.

Figure 2 . 2 :

 22 Figure 2.2: Scade diagram of the program in Ex. 2.3.

Figure 3 . 1 :

 31 Figure 3.1: Abstract interpreter for verifying safety properties.

Figure 3 . 2 :

 32 Figure 3.2: Fixed points of f concrete (C) abstract (A) S αpSq

( a )Figure 3 . 4 :

 a34 Figure 3.4: Comparison of the precision of various abstract domains w.r.t. abstracting a concrete set of points.

Figure 3 . 6 :

 36 Figure 3.6: Example 3.2: a CFG (a) and its reverse CFG (b).

Figure 3 . 7 :

 37 Figure 3.7: CFG for Example 3.3: the descending sequence fails.

Figure 3 . 8 :

 38 Figure3.8: Delayed widening (Ex. 3.4): Abstract reachable sets for N " 1 (whole shaded area), N " 2 (gray and dark gray) and N " 3 (dark gray)

3. 5 .

 5 Tools and Libraries commercialized by Absint 3 . It has been successfully used in the verification of avionics software. -F-Soft 4 and Frama-C 5 are static analyzers for C programs.

Figure 4 . 1 :

 41 Figure 4.1: Example program (a), transformed program (b) where τ ˚denotes the reflexive and transitive closure of the transition τ , and set of initial states (c).

  Theorem 4.3 (Reachability in flattable systems) The set of reachable states reach of flattable systems can be computed exactly [BFLS05]. However, flattability is undecidable [BFLS05]. All these techniques are implemented in the tool Fast [BFLP03, Ler03, BFL04, BFLS05, BFLP08].Acceleration of relations. It has been shown that the transitive closure of difference bounds constraints[START_REF] Comon | Multiple counters automata, safety analysis and Presburger arithmetic[END_REF] and octagonal relations[START_REF] Bozga | Iterating octagons[END_REF] is also Presburger-definable. A performant algorithm for accelerating such relations is implemented in the tool Flata[START_REF] Bozga | Fast acceleration of ultimately periodic relations[END_REF].

  Figure 4.2:Abstract acceleration of a translation (Ex. 4.2) by vector d starting from X (dark gray) resulting in τ b pXq (whole shaded area).

Figure 4 . 4 :

 44 Figure4.4: Abstract acceleration of a finite monoid (Ex. 4.4) starting from X " tp1, 0qu, pτ 2 q b pXq (bold line), pτ 2 q b pτ pXqq " τ pXq " tp2, 2qu, and result τ b pXq (whole shaded area).

  Figure 5.1: Chapter organization

  Proposition 5.2 (Translation with inputs " polyhedral translation) A translation τ with inputs and a simple guard (Def. 5.1) is equivalent to a polyhedral translation defined by G Ñ x 1 " x `D with D " td | Dξ : d " T ξ `u ^Jξ ď ku (D can be computed by standard polyhedra operations.) 51 5.1. Abstract Acceleration with Numerical Inputs Proof x 1 P τ pXq ðñ Dx P X, Dξ : Ax ď b ^Jξ ď k ^x1 " x `Tξ `u ðñ Dx P X [ G, Dξ, Dd : Jξ ď k ^d " Tξ `u ^x1 " x `d ðñ Dx P X [ G, Dd P D : x 1 " x `d with D " td | Dξ : Jξ ď k ^d " Tξ `uu We now generalize Thm. 4.4 from ordinary translations to polyhedral translations. Proposition 5.3 (Polyhedral translation) Let τ be a polyhedral translation G Ñ x 1 " x `D. Then, the set

Figure 5 . 2 :

 52 Figure 5.2: Translation with inputs (Ex. 5.1): The lefthand side shows the computation of D: Jξ ď k ^d " Tξ`u (bold line) is projected on variables d to obtain D. The shaded area in the right-hand side figure is τ b pXq.

Figure 5

 5 Figure 5.3: Precision loss in example 5.1 when using the approximate formula according to Rem. 5.3.

  D ^x1 P pG `Dq using tx | Dd P D ^Gpx ´dqu " tz `d | d P D ^Gpzqu " pG `Dq. It can be 53 5.1. Abstract Acceleration with Numerical Inputs

Figure 5 . 9 :

 59 Figure 5.9: Comparison between standard abstract interpretation (MFP) (a) and abstract acceleration (b): τ : G Ñ px 11 , x 1 2 q " px 1 `1, x 2 `1q with G and X as given in the figures.

  Abstract acceleration: iterations ě 1 (dark gray), final result (whole shaded area).

Figure 5 . 12 :

 512 Figure 5.12: Comparison between the affine derivative closure algorithm (a) and abstract acceleration (b), Ex. 5.7.

Figure 5 .

 5 Figure 5.13: Ex. 5.8.

  63 5.4. Conclusions and Perspectives Forward acceleration: Translations τ b pXq " X \ τ `pX [ Gq Õ D Translations/resets

  Figure 6.1: Chapter organization

Proposition 6. 1

 1 Let τ : Ax ď b Ñ x 1 " ˆJ I 0 J ˙x be a transition as explained above. Then τ b pXq " X \ ğ 0ďlďp´1 τ `pτ l pXq [ Gq Õ D plq ȋs a sound over-approximation of τ ˚, where

  Figure 7.1: Representations of the Boolean function f pb 1 , b 2 , b 3 q " b 1 pb

  xBexpr y ::= tt | ff | xBvar y | xBexpr y | xBexpr y (^| _ | . . . ) xBexpr y | xexpr y = xexpr y | xIexpr y (< | <=) xIexpr y | xAconsy Arithmetic expressions: xAexpr y ::= cst | xAvar y | (-| ' )xAexpr y | xAexpr y (+|-|*|/|%) xAexpr y | if xBexpr y then xAexpr y else xAexpr y Arithmetic conditions: xAconsy ::= xAexpr y (< | <=) xAexpr y Enumerated types: xEexpr y ::= label | xEvar y | if xBexpr y then xEexpr y else xEexpr y Bounded integers: xIexpr y ::= xcsty | xIvar y | xIexpr y (+ | -| *) xIexpr y | xIexpr y (<< | >>) n | if xBexpr y then xIexpr y else xIexpr y Expressions: xexpr y ::= xBexpr y | xEexpr y | xIexpr y | xAexpr y

  purely arithmetic expressions xaAexpry, e.g., x`1; -purely Boolean expressions xbBexpry, e.g., b 1 ^ b 2 ; -Boolean expressions xBexpry with arithmetic constraints xAconsy, e.g., b _ x ě 0; -arithmetic expressions xAexpry with tests on Booleans and arithmetic constraints, e.g., if b _ x ě 0 then x`1 else 0. Purely arithmetic expressions. xaAexpr y ::= cst | xAvar y | (-| ' )xAexpr y | xaAexpr y (+|-|*|/|%) xaAexpr y Affine arithmetic expressions, i.e., of the form ř i a i x i `b, are canonically represented by the array of the coefficients pa 1 , . . . , a n , bq. Other expressions are represented as operator trees. Purely Boolean expressions. xbBexpr y ::= tt | ff | xBvar y | xbBexpr y | xbBexpr y (^| _ | . . . ) xbBexpr y Purely Boolean expressions are represented by a Bdd pB m Ñ Bq. Boolean expressions with arithmetic constraints. xBexpry are represented by mixed (or interpreted) Bdds pB m ˆxAconsy ˚Ñ Bq.

Fig. 7 .

 7 4 shows an example of creating the Boolean expression f ą 0 of an arithmetic expression with tests f . Transition functions. Boolean transition functions f b pb, β, Cq are represented as Boolean expressions xBexpry. Numerical transition functions f x pb, β, C, x, ξq are represented as arithmetic expressions with tests xAexpry. A guard g is a Boolean expression xBexpry, and an action a is a purely arithmetic expression xaAexpry. Initial states I and error states E are also represented by xBexpry.

Figure 7 . 3 :Figure 7 . 4 :

 7374 Figure 7.2:In this mixed Bdd, the decision x ě 0 is redundant (w.r.t. tt branch) and contradictory (w.r.t. ff branch).

Figure 7 . 5 :

 75 Figure 7.5: Decomposition of a Boolean expression into a disjunction of numerically convex formulas: framed nodes are nodes with the lowest numerical constraint indices.

Figure 7 . 6 :

 76 Figure 7.6: Two CFGs of the logico-numerical program in Ex. 7.4 obtained by state space partitioning.

Fig. 7 .

 7 Fig. 7.6a shows a CFG of this program induced by the partition tb 1 , b 1 u. Fig. 7.6b depicts the CFG obtained by the enumeration of the (reachable) Boolean state space, i.e., induced by the partition tb 1 ^b2 , b 1 ^ b 2 , b 1 ^ b 2 u ( b 1 ^b2 is trivially not reachable, see §7.3.3).

Figure 7 . 7 :

 77 Figure 7.7: Partitioning by initial and error states.

Figure 7 . 9 :

 79 Figure 7.9: Incremental partitioning: splitting a location (a) by a predicate ψ into two locations (b).

Figure 7 . 10 :

 710 Figure 7.10: Arc assertions and refinement of the location definition by the destination location: (a) original transition relation associated to the two outgoing arcs of location b 1 in (b); (b) refinement of the transitions by arc assertions.

-

  Induction step m Ñ pm`1q: ľ n"m...m`k`1 Rpnq ^Apnq ^ľ n"m...m`k Gpnq ùñ Gpm`k`1q If the proof fails, it is retried with increasing values of k. This technique has been implemented in the tool Kind 2 and has proved powerful [HT08, Hag08, DHKR11].

  Figure 8.1: Chapter organization

  8.2 for an example and a counterexample): Definition 8.1 (Accelerable logico-numerical transition) A transition τ is accelerable if it has the form g b pb, βq^g x pCq Ñ ˆb1 x 1

  Figure 8.3: Transformation of the program of Example 8.1. τ is the global transition. The guards are already convex in the obtained CFG.

Figure 8 . 8 :

 88 Figure 8.6: Decoupling numerical and Boolean transitions

  . b λps, iq. x n apx, ξq ' , τ n,b : gps, iq Ñ ¨b1 b ps, iq f n ps, iq λps, iq. x a ' Proposition 8.3 (Decoupling accelerable and non-accelerable transitions) τ ˚Ď pπ ˝τn,b ˝τ å q ˚Ď pπ ˝τn,b ˝τ b a q

  Example 8.3 (Inputization) The loop τ b can be approximated by the transition τ 1 b where β 0 and β 2 correspond to b 0 and b 2 manipulated as Boolean inputs:

  Figure 8.10: Schematic example of a production line with buffers, machines, and splitting and combining material flows.

  Figure 9.1: Chapter organization

Example 9. 1 (

 1 Semantic equations)Using the template constraints ˆ1´1˙x ď ˆdℓ,1 d ℓ,2 ˙in locations ℓ, the equation system for location ℓ 1 of the example in Fig.9.2 consists of one equation for each template bound variable of which the arguments of the max operator are the initial value ´8 and one expression R 7 for each of the three incoming arcs: 113 9.1. Numerical Max-Strategy Iteration

Example 9. 4

 4 Fig.9.5 in §9.2.2 shows a CFG corresponding to this program. Note that we allow numerical constraints in assignments to Boolean variables. A program property we want to prove is for instance the invariant 0 ď x ď 100.

Figure 9 . 5 :

 95 Figure 9.5: CFG of the program in Example 9.4

Figure 9 . 6 :

 96 Figure 9.6: Scalability of logico-numerical max-strategy iteration in comparison with numerical max-strategy iteration on the enumerated CFG, using octagonal constraints. The timeout was set to 3600 seconds. Note the logarithmic scales.

Figure 10 . 1 :

 101 Figure 10.1: Trajectory of the solution for x 1 ptq of the LTI system in Ex. 10.1

  Example 10.2 (Differential inclusions) (see Fig.10.2)

ď x 1 ď 20 x ě 20 x ď 18 Figure 10 . 3 :Figure 10 . 4 :

 18103104 Figure 10.3: Hybrid automaton: Thermostat example (cf. [ACH `95])

  Figure 10.5: Hybrid system modeling with Simulink/Stateflow

Figure 10 . 7 :

 107 Figure 10.7: Bouncing ball: hybrid automaton (a) and zeno behavior (b)

  xdecly ::= xtypedecly | xfundecly | xdecly xdecly xtypedecly ::= type t = L | . . . | L xfundecly ::= let [node | hybrid] f [xpaty] = xexpr y xpaty ::= v | (xpaty,...,xpaty) xexpr y ::= v | cst | op xexpr y | f xexpr y | (xexpr y,...,xexpr y) | xexpr y fby xexpr y | xexpr y -> xexpr y | pre xexpr y | last v | up xexpr y | init | xexpr y on xexpr y | let [rec] xequy in xexpr y xequy ::= v = xexpr y | xequy and xequy | der v = xexpr y init xexpr y reset xresy | v = xresy init xexpr y | automaton (S [xpaty] -> xlocy unless xtransy | . . . | xtransy done) xres y ::= xexpr y every xexpr y | . . . | xexpr y every xexpr y xlocy ::= local v in xlocy | do xequy until xtransy | . . . | xtransy xtransy ::= xexpr y (then | continue) S

  Example 10.5 (Zelus program) (cf. [BBCP11b]) let hybrid bouncingball (x0,v0,start,eps) = x where rec init x = x0 and automaton | Wait -> do der v = 0.0 until start then Bounce(v0) done | Bounce(v00) -> local z,v in do der v = -9.81 init v00 and der x = v and z = up(-x) until (z on (-v<eps)) then Wait | z then Bounce(-0.6*v) done end

  Definition 10.5 ( ‹ ")[START_REF] Lindstrøm | An invitation to nonstandard analysis[END_REF] xx n y ‹ " xy n y iff µtn | x n " y n u " 1 i.e., xx n y equals xy n y almost everywhere.Definition 10.6 (Infinitesimals and infinite numbers)[START_REF] Lindstrøm | An invitation to nonstandard analysis[END_REF]

Figure 10 . 9 :

 109 Figure 10.9: Number line of non-standard reals and their relation to standard reals (cf. [Lin88])

translationFigure 11 . 1 :

 111 Figure 11.1: Chapter organization

143 11 .Figure 11 . 2 :

 11112 Figure 11.2: Thermostat (Example 11.1): partitioned data-flow model.

Figure 11 . 3 :

 113 Figure 11.3: Thermostat (Example 11.1): resulting hybrid automaton (q is a Boolean state variable introduced by the translation).

145 11 .

 11 1. Hybrid Data-flow Formalism

Figure 11 . 4 :

 114 Figure 11.4: Continuous (a) and discrete (b) zero-crossings

Fig. 11 .

 11 Fig. 11.3 depicts an example of such a logico-numerical hybrid automaton.

( d )

 d Translation according to "at-zero" semantics Notes: (1) The arrows pointing upwards in (b) indicate the points where zero-crossings are activated, and in (c), the points where the jump transition may be taken nondeterministically. The dotted trajectories indicate that the preceding transition is urgent.

Figure 11 . 5 :

 115 Figure 11.5: Zero-crossing semantics of the hybrid data-flow language and their translations. The diagram in (b) shows typical trajectories in the original semantics of the partitioned data flow model in (a), the one in (c) shows typical trajectories in the semantics of the proposed translation to the hybrid automaton in (d).

  (c) Translation according to "contact" semantics

( f )

 f Translation according to "crossing" semantics

Figure 11 . 6 :

 116 Figure 11.6: Zero-crossing semantics of the hybrid data-flow language and their translations (continuation, see Fig.11.5 for explanations).

Remark 11 . 1 (

 111 Blocked executions) These translations may add so-called blocked executions. Consider the fifth trajectory of Fig.11.6d ("crossing" semantics): this trajectory is possible when staying in the second location in Fig.11.6f.

DiFigure 11 . 7 :

 117 Figure 11.7: Translation of a continuous zero-crossing with inputs, described in Example 11.2.

155 11 .Figure 11 . 8 :

 11118 Figure 11.8: Conjunction of two zero-crossings

  " `Di : Aps, iq ^ζ¨ě0 m ^ψ˘^ Di : Aps, iq ^ζ¨ď0 m below Ñ Di : Aps, iq ^ζ¨ď0 m ^ψ ready Ñ Di : Aps, iq ^ζσ m ^ψ σ "contact" ¨ď 0 "crossing" 0 ď ¨ď ǫ Transition relations. We define G m " G c m _ G d m and R m " R c m ^Rd m . Now, we can finally put things together and define the jump and flow transition relations:

Figure 12 . 1 :

 121 Figure 12.1: Discrete encoding (b) of the flow relation V in (a).

  9

Figure 12 . 2 :

 122 Figure 12.2: Hybrid max-strategy iteration: Ex. 12.1

Chapter 12 .18 ď x 1 ď 20 x ď x 1 ď 22 x ě 20 16 ď x 1 ď x x ď 18 Figure 12 . 3 :-

 1218123 Figure 12.3: Relational abstraction (Ex. 12.2) of the hybrid automaton in Fig. 10.3

  Figure 13.1: Chapter organization

  173 13.1. Logico-Numerical Hybrid Analysis Methods on ^9 x " 40´x ^x ď 20 _ on ^9 x "´x ^x ě 18 on 1 ^x1 " 19 pon 1 " onq ^px 1 " xq pon ^x " 20q _ p on ^x " 18q (a) Hybrid automaton. tt on 1 ^x1 " 19 pon ^x ď x 1 ď 20q _ p on ^18 ď x 1 ď xq pon 1 " onq ^"pon ^x " 20q _ p on ^x " 18q (b) Relationalized (discrete) system.

Figure 13 . 4 :

 134 Figure 13.4: Logico-numerical relationalization Ex. 13.6

j` 9

 9 x " e j px, ξq ˘^φ j pb, β, Cq Then a partition is characterized by the following equivalence relation (cf. Def. 8.3): 13.2. Partitioning Techniques for Hybrid Systems Definition 13.1 (Boolean states with the same set of ODEs) b 1 " b 2 ô

  Example 13.8 (Boolean-defined modes I) We compute the product of the flow relations9 x " " 2´x if b 1 ^x ď 1 _ b 2 ^x ě 3 ´y if b 1 ^b2 ^x ě 0 ^y ě 0 9 y " " 5´y if b 2 ^y ď 3 ´x if b 2 ^x ě 0 ^y ě 0 if `pb 1 ^x ď 1q _ p b 1 ^x ě 3q ˘^ b 2 ^y ď 3 p2´x, ´x q if b 1 ^b2 ^0 ď x ď 1 ^y ě 0 p ´y , ´x q if b 1 ^b2 ^x ě 0 ^y ě 0 Thus, we have the partition t b 2 , b 1 ^b2 , b 1 ^b2 u,in which each equivalence class corresponds to a distinct pair of ODEs.Variants. Analogously to Def. 8.2, we can formulate an equivalence relation identifying the Boolean states associated to the same set of ODEs and the same staying conditions: Definition 13.2 (Boolean states with the same set of ODEs and stay. cond.)b 1 " b 2 ô $ & % @β 1 , C : Apb 1 , β 1 , Cq ñ Dβ 2 : Apb 2 , β 2 , Cq ^f cx pb 1 , β 1 , Cq " f cx pb 2 , β 2 ,Cq and vice versa Example 13.9 (Boolean-defined modes II) Let's consider the first case in the product equation in Ex. 13.8: p 9 x, 9 yq " p2´x, 5´yq if `pb 1 ^x ď 1q _ p b 1 ^x ě 3q ˘^ b 2 ^y ď 3 Requiring that the ODEs and the staying conditions must be equal, we obtain two equivalence classes for this case: b 1 ^ b 2 and b 1 ^ b 2 . Hence the complete partition is tb 1 ^ b 2 , b 1 ^ b 2 , b 1 ^b2 , b 1 ^b2 u.

  After partitioning we obtain the hybrid automaton shown in Fig.13.5b.

  Figure 14.3: Hybrid NBac format.

[ 0 .

 0 020] INFO [Main] ReaVer, version 0.9.0 [0.028] INFO [Main] variables(bool/num): state=(2/1), input=(1/0) [0.038] INFO [Verif] CFG (3 location(s), 3 arc(s)): LOC -1: arcs(in/out/loop)=(0,1,0), def = init LOC -3: arcs(in/out/loop)=(1,0,0), def = not init and not p1_ LOC -4: arcs(in/out/loop)=(1,1,1), def = not init and p1_ [0.039] INFO [Verif] analysis 'forward analysis with abstract acceleration' [0.070] INFO [VerifUtil] analysis result: LOC -1: reach = (init) and top LOC -3: reach = bottom LOC -4: reach = (not init and p1_) and [|-p2_+10>=0; p2_+10>=0|] [0.074] INFO [Main] variable mapping: "p2_" in File "example.ls", line 4, characters 17-55: > and x = 0 fby (if i then -x else if x<=9 then x+1 else x) > ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^" p1_" in File "example.ls", line 3, characters 21-42: > and ok = true fby (ok && -10<=x && x<=10) > ^^^^^^^^^^^^^^^^^^^^[ 0.075] INFO [Main] PROPERTY TRUE (final unreachable)This tells us that:-The program has two Boolean state variables and one numerical state variable and one Boolean input variable. -After partitioning, the CFG has three locations with the displayed location definitions.

Figure 14 . 4 :

 144 Figure 14.4: CFG printed to Dot: The locations are labeled with their location definitions. The arcs are labeled with "arc assertion Ñ transition function".

  Scade [Sca] (Software Critical Application Development Environment) extends Lustre with several features of Lucid Synchrone, like fby, merge and automata. It provides a graphical, block diagram representation, i.e., data flow graphs, of programs. Fig. 2.2 shows the Scade diagram of the program of Ex. 2.3.

  Safety and liveness properties. One distinguishes two types of properties[START_REF] Lamport | Proving the correctness of multiprocess programs[END_REF]:

				2.3. Properties and Observers
			A	realistic
	i	Program s	Observer
			G	correct
	Figure 2.3: Verification of a synchronous program with the help of a synchronous
	observer

-Safety properties state that nothing bad happens. Many important properties in practice fall into this category: state properties (invariants) such as the absence of runtime errors (e.g., overflows and division-by-zero) and mutual exclusion, and trace properties like deadlock freedom or guarantees w.r.t. response times and deadlines. The violation of safety properties can be shown by a finite execution trace (counterexample). -Liveness properties state that something good eventually happens, i.e., a desirable action is eventually executed. Examples for such properties are termination or fair choice. Such properties cannot be violated by finite execution traces. We will consider only safety properties.

  .3 illustrates this verification schema. Lustre provides an assert statement which can be used to specify A. For G, we define a Boolean output variable ok.

	node system(xi:int) returns (ok:bool);
	var x:int;
	let
	x = program(xi);
	assert 1<=xi and xi<=2;
	ok = property(x,xi);
	tel
	Example 2.6 (Observer) node program(xi:int) returns (x:int);
	let
	x = 1 -> pre x*xi;
	tel
	node property(x,xi:int) returns (ok:bool);
	var t:int;
	let
	t = 1 -> pre t + 1;
	ok = true -> pre ok and ((t<=8) => (1<=x and x<=16*t));
	tel

  G and D are decoupled. Translations/resets D is approximated by the Cartesian product D t ˆDr .

	Approximations:
	In all cases	dense and convex approximation
	L ‰ 0
	Table 5.1: Overview of abstract acceleration formulas

with 0 or 1 only Gpxq " Dξ : G 0 px, ξq D " td | Dξ : d " T ξ `u ^G1 pξq ^Dx : G 0 px, ξqu

Table 6 . 1 :

 61 Jordan form characterization of finite monoid transformations Example 6.3 (Dependencies on modified variables II)

Table 7

 7

.1: Expressions available in BddApron (subset).

Table 7

 7

.2: Operations of the logico-numerical power domain B m Ñ N . apply 1 pλX.Dx : XqpSq. Mind that we can existentially quantify a numerical variable in a mixed Boolean formula (approximately w.r.t. an abstract domain) by computing γpDx.αpϕpb, Cqqq.

Existential quantification of a Boolean variable is almost identical to existential quantification in Bdds, except that we have to use \ x (instead of _) to combine the terminal nodes.

Intersection with a guard (a Boolean formula with numerical constraints) S [ g gpb, Cq is implemented by the following recursion: -Base cases:

' S [ g tt " S ' S [ g ff " K ' No constraint in g: S [ g gpbq " S [ itepg, J, Kq ' Single constraint in g: S [ g C " apply 1 pλS.S [ x αpCqqpSq -Recursion:

Table 8

 8

.1. The tools where launched with the default options; for ReaVer we use the partitioning heuristics of Def. 8.3 and the inputization technique of §8.2.4. We do not need the decoupling technique of Prop. 8.3 for our examples.

Table 8 .

 8 1: Experimental comparison between Aspic, ReaVer and Nbac.

  11.2; in this case it is active during the second step of an execution fragment s

	147	11.2. Logico-Numerical Hybrid Automata
	z(x(t))	up(z)
	0	t
		i Ý Ñ c s 1 i 1 Ý Ñ d s 2 ;

  2B and ℓ 2W . Then we can improve the strategy w.r.t. δ 2B :

	165	12.2. Unbounded-Time Analysis Methods
	ℓ

the next steps p0, 4, ´2q will be propagated (by strategy improvement) to ℓ 1W , ℓ 2A ,

http://www.mathworks.fr/products/polyspace

http://pop-art.inrialpes.fr/people/schramme/reaver/

http://www.mathworks.com/products/polyspace

http://www.astree.ens.fr

Note that the 0 in the matrix of the guard does not imply a loss of generality.

http://pips4u.org

http://vlsi.colorado.edu/~fabio/CUDD/

http://clc.cs.uiowa.edu/Kind/

We assume here that Boolean inputs β have been encoded by non-determinism (cf. §7.3).

This is an over-approximated result: the actual polyhedron has more constraints.

A first version of the tool which implemented only logico-numerical abstract acceleration methods was called nbACCel[START_REF] Schrammel | Logico-numerical abstract acceleration and application to the verification of data-flow programs[END_REF].

http://www.3ds.com

http://path.berkeley.edu/SHIFT/

http://ptolemy.eecs.berkeley.edu/hyvisual/

http://rtg.cis.upenn.edu/mobies/charon/

http://xenon.stanford.edu/~vgupta/hcc/hcc.html

http://se.wtb.tue.nl/sewiki/chi/start

http://www.scicos.org

http://modelica.org

µpX Y Y q " µpXq`µpY q for X X Y " H

We do not use eps in the expression uppx ´20q, in order to show an example of a deterministic zero-crossing.

We use the operator instead of in order to obtain a topologically closed flow relation.

http://sal.csl.sri.com/hybridsal/

http://www-cad.eecs.berkeley.edu/~tah/HyTech/

http://www-verimag.imag.fr/~frehse/phaver_web/

http://www.mathworks.com/matlabcentral/fx_files/15441/3/content/doc/main.htm

http://www-verimag.imag.fr/~tdang/Tool-ddt/ddt.html

http://spaceex.imag.fr

Current version ReaVer 0.9

http://www.dii.uchile.cl/~daespino/ESolver_doc/main.html

http://yices.csl.sri.com

Acknowledgements

In our experiments ( §8.4) we observed that the speed-up gained often pays off in comparison to the approximations it brings about.

Partitioning Techniques

The logico-numerical acceleration method described in the previous section can be applied to any CFG. However, in order to make it effective, we apply it to a CFG obtained by a partitioning technique that aims at alleviating the impact of decoupling Boolean and numerical transition functions on the precision. This section proposes such partitioning techniques that generate CFGs in which those Boolean states that exhibit the same numerical behavior ("numerical modes") are grouped in the same locations.

Basic technique. In order to implement this idea, we generate a CFG that is characterized by the following equivalence relation:

The intuition of this heuristics is to make equivalent the Boolean states that can execute the same set of numerical actions, guarded by the same numerical constraints.

Example 8.4 (Numerical modes) We illustrate the application of this method to Example 8.1. We first factorize the numerical transition functions by actions:

Then by applying Def. 8.2, we get the equivalence classes

the obtained CFG is the one of Fig. 8.3b.

In the worst case, as in Ex. 8.4 above, a different set of actions can be executed in each Boolean state, thus the Boolean states will be enumerated. In the other extreme case, in all Boolean states the same set of actions can be executed, which induces a single equivalence class. Both cases are unlikely to occur in larger, real systems.

From an algorithmic point, we vectorize the numerical actions and factorize their common guards, which is equivalent to computing the product of the MtBdds representing the numerical transition functions (see §7.2.2): µ 1 is called an improvement of µ w.r.t. d, i.e., µ 1 " max improve M pµ, dq iff 1. µ 1 is "at least as good" as µ: µ 1 pdq ě µ pdq, and 2. µ 1 is "strictly better for the changed equations": if pδ i " p F i pδqq in µ and pδ i ě p

Example 9.3 (Max-strategy iteration) We illustrate some steps of the analysis of the example in Fig. 9.2. Assume the current strategy is:

, / / / / / / . / / / / / /and the current template bounds are:

-

The strategy can only be improved w.r.t. δ 1,1 :

/ / / / / / -We compute the new fixed point w.r.t. µ 2 :

-

In the next step we can improve the strategy w.r.t. δ 2,1 and δ 2,2 , a.s.o.

An improving strategy is selected by testing for each equation whether an argument of its max-operator leads to a greater bound. Since the arguments of the max-operator end parses the input file and transforms the program do a DF program. The DF program to CFG transformation converts it into a CFG. Then the verification block (Fig. 14.2) performs the actual verification: it is given a list of verification strategies (via the tool options), i.e., CFG transformations and analyses, and executes them sequentially until all verification strategies have been processed or a conclusive analysis result has been obtained.

The concept of verification strategies allows the user to compose analysis and partitioning methods in a flexible way. For example, we can start with a Boolean analysis, then we perform a first coarse partitioning followed by an interval analysis; then we refine the partition and finally, we apply some more expensive analysis, e.g., using convex polyhedra.

The next section §14.2 gives an overview of the implementations of the five interfaces provided in ReaVer. 185 14.2. The Tool

The Tool

The tool ReaVer 1 provides the following implementations of the framework's interfaces:

Front Ends

The tool supports the following input formats:

(1) NBac and Hybrid NBac formats, (2) Lustre (after transformation into the NBac format using the tool Lus2NBac

[Jea00]), (3) subsets of Lucid Synchrone and Zelus.

NBac and Hybrid NBac. The NBac format is the input file format used by the tool NBac [START_REF] Jeannet | Partitionnement Dynamique dans l'Analyse de Relations Linéaires et Application à la Vérification de Programmes Synchrones[END_REF]. It is a textual description of a discrete dynamical system ( §2.1.1) together with a specification of a property pA, Gq. We have extended it with ODEs and a zero-crossing operator to the Hybrid NBac format.

The Hybrid NBac grammar is listed in Fig. 14.3; the expressions are those allowed by the BddApron library (see §7.2.2): besides the type definitions of enumerated types, the available types are bool, real, int and signed (sint[n]) and unsigned (uint[n] bounded integers represented by n bits.

The property is specified by the expressions following the keywords assertion A and invariant G (or alternatively by the error states: final E).

Zelus and Lucid Synchrone. The front ends for a subset of Zelus (and Lucid Synchrone) are based on the front end of the Zelus compiler [START_REF] Benveniste | A hybrid synchronous language with hierarchical automata: static typing and translation to synchronous code[END_REF] followed by a translation to the abstract syntax of the Hybrid NBac format. The top-level function must have two Boolean outputs (assert,ok), which correspond to the two outputs pA, Gq of the observers specifying the property.

By translating the abstract syntax of NBac/Hybrid NBac into BddApron formulas ( §7.2.2) we obtain a DF program.

DF program to CFG

In case of a discrete program, the trivial CFG with a single self-loop (cf. §2.1.2) can be constructed from the DF program right away, whereas for hybrid programs with zerocrossings, we have to apply the translation from hybrid data flow to logico-numerical hybrid automata ( §11).

Abstract Domains

BddApron provides an implementation of a logico-numerical power domain ( §7.2.3) based on any numerical domain available in Apron, like convex polyhedra and octagons.

Based on this implementation, we provide the emulation of a logico-numerical product domain ( §7.2.3) parametrized with any numerical domain available in Apron.

For experimental purposes, we have also implemented the product and power combination of a logico-numerical linear template domain emulated with the help of convex polyhedra, because template polyhedra are not yet available in Apron.

The partitioning by numerically defined continuous modes uses the (logico-numerical) finitely disjunctive, partitioned interval domain ( §13.2.2). 189 14.3. Conclusions and Perspectives front end must be pushed further. Also, the direct integration of the Lustre (V6) front end is desirable.

Return to source. A practical issue when analyzing programs obtained by a translation from high-level languages is that there is no one-to-one correspondence between variables in the source code and the variables used in low-level representation during the analysis. For example, the inlining of nodes requires the duplication of variables, delay operators like fby introduce memory variables, and in the case of automata, a variable is added to hold the current state of the automaton. Thus, simply re-substituting corresponding expressions from the program source into the analysis result is not so easy.

Currently, we print the mapping between the state variables in the low-level representation and the corresponding expressions and equations together with their location in the source code. This should be improved to make the user's life easier w.r.t. interpretation of the computed invariants. A graphical user interface could probably help improving the usability in this respect. Moreover, semantic manipulations on the source language level will be necessary, e.g., to simplify expressions.

Partitioning. In our translation to hybrid automata, we assumed that state machines in the Zelus program have been compiled to data-flow. However, it would be desirable to exploit the existing structure of these automata for partitioning the CFG used for analysis.

We have observed in our experimental comparison that the iterative partition refinement based on the heuristics of [Jea00] (cf. §7.4) is sometimes superior to our static partitioning methods (cf. §8.4). Since these refinement techniques are orthogonal to our partitioning and analysis methods, we could combine them with our approach.

Abstract domains. Concerning abstract domains, an efficient LP-solver based template domain implementation within Apron has highest priority. The logico-numerical product domain is currently implemented on top of the power domain: an optimized implementation will certainly speed up the analyses.

Some partitioning and analysis methods require quantifier elimination of numerical variables in formulas: currently, we use the operations for abstract domains available in BddApron, thus, we have to convert formulas to abstract domain values and convert the result back, which is not very efficient. Hence, it would make sense to use dedicated real quantifier elimination methods [START_REF] Sankaranarayanan | Relational abstractions for continuous and hybrid systems[END_REF] for this purpose.

We are convinced that ReaVer could serve as a platform for connecting various source languages and integrating a variety of abstract interpretation methods for discrete and hybrid systems, which would considerably simplify the automization of experimental comparisons. 195 15.2. Perspectives systems based on relational abstractions. It would be worthwhile to extend their method to logico-numerical systems.

Traditionally, methods developed for verification have their applications in related areas like controller and parameter synthesis [START_REF] André | Timed Parametrization of Embedded System Components[END_REF][START_REF] Fribourg | Parametric verification and test coverage for hybrid automata using the inverse method[END_REF], test case generation [DB99, JJ05, JJRZ05] and debugging [START_REF] Gaucher | Automatic state reaching for debugging reactive programs[END_REF][START_REF] Gaucher | Étude du débogage de systèmes réactifs et application au langage synchrone Lustre[END_REF]. It would be interesting to investigate to which extent we could exploit our methods in these applications.

Recently, theorem provers have been used in static analysis [ZLKR04, MV06], SMTbased k-induction is enhanced by abstract interpretation [START_REF] Roux | SMT-AI: an abstract interpreter as oracle for k-induction[END_REF] and abstract interpretation methods are boosted by SMT solvers (e.g., [START_REF] Monniaux | Using bounded model checking to focus fixpoint iterations[END_REF][START_REF] Gawlitza | Improving strategies via SMT solving[END_REF]). Moreover, SAT solving is viewed as deductive proving [START_REF] Flanagan | Theorem proving using lazy proof explication[END_REF] and the analogies of SMT solving, and abstract interpretation are pointed out [START_REF] Vijay | Satisfiability solvers are static analyzers[END_REF][START_REF] Cousot | The reduced product of abstract domains and the combination of decision procedures[END_REF]. This tendency to a convergence of these different approaches opens an interesting field of research.

Résumé

Cette thèse étudie la vérification automatique de propriétés de sûreté de systèmes logiconumériques discrets ou hybrides. Ce sont des systèmes ayant des variables booléennes et numériques et des comportements discrets et continus. Notre approche est fondée sur l'analyse statique par interprétation abstraite.

Nous traitons les problèmes suivants : les méthodes d'interprétation abstraite numériques exigent l'énumération des états booléens, et par conséquent, elles souffrent du problème d'explosion d'espace d'états. En outre, il y a une perte de précision due à l'utilisation d'un opérateur d'élargissement afin de garantir la terminaison de l'analyse. Par ailleurs, nous voulons rendre les méthodes d'interprétation abstraite accessibles à des langages de simulation hybrides.

Dans cette thèse, nous généralisons d'abord l'accélération abstraite, une méthode qui améliore la précision des invariants numériques inférés. Ensuite, nous montrons comment étendre l'accélération abstraite et l'itération de max-stratégies du contexte numérique au contexte logico-numérique, ce qui aide à améliorer le compromis entre l'efficacité et la précision. En ce qui concerne les systèmes hybrides, nous traduisons le langage de programmation synchrone et hybride Zelus vers les automates hybrides logico-numériques, et nous étendons les méthodes d'analyse logico-numérique aux systèmes hybrides. Enfin, nous avons mis en oeuvre les méthodes proposées dans un outil nommé ReaVer et nous fournissons des résultats expérimentaux.

En conclusion, cette thèse propose une approche unifiée à la vérification de systèmes logiconumériques discrets et hybrides fondée sur l'interprétation abstraite, qui est capable d'intégrer des méthodes d'interprétation abstraite numériques sophistiquées tout en améliorant le compromis entre l'efficacité et la précision.

Mots-clés: vérification, programmes logico-numériques, langages synchrones, systèmes hybrides, analyse statique, interprétation abstraite, accélération abstraite, itération de stratégies.

Abstract

This thesis studies the automatic verification of safety properties of logico-numerical discrete and hybrid systems. These systems have Boolean and numerical variables and exhibit discrete and continuous behavior. Our approach is based on static analysis using abstract interpretation.

We address the following issues: Numerical abstract interpretation methods require the enumeration of the Boolean states, and hence, they suffer from the state space explosion problem. Moreover, there is a precision loss due to widening operators used to guarantee the termination of the analysis. Furthermore, we want to make abstract interpretation-based analysis methods accessible to simulation languages for hybrid systems.

In this thesis, we first generalize abstract acceleration, a method that improves the precision of the inferred numerical invariants. Then, we show how to extend abstract acceleration and max-strategy iteration to logico-numerical programs while improving the trade-off between efficiency and precision. Concerning hybrid systems, we translate the Zelus hybrid synchronous programming language to logico-numerical hybrid automata and extend logiconumerical analysis methods to hybrid systems. Finally, the proposed methods are implemented in ReaVer, a REActive System VERification tool, and we provide experimental results.

To conclude, this thesis proposes a unified approach to the verification of discrete and hybrid logico-numerical systems based on abstract interpretation, which is capable of integrating sophisticated numerical abstract interpretation methods while successfully trading precision for efficiency.

Keywords: verification, logico-numerical programs, synchronous languages, hybrid systems, static analysis, abstract interpretation, abstract acceleration, strategy iteration.