Je Tiens À Remercier

Sandrine Blazy

Khalil Ghorbal

André Platzer

Stefan Mitsch

Andreas Muller

Rajesh Gupta

Shuling Wang La

Loic Besnard

Thierry Gautier

Vania Joloboff

Hai Nam Tran

Alexandre Honorat

Jean-Joseph Marty

Liangcong Zhang

Lucas Franceschino

Merci

ai eu avec d'autres chercheurs, notamment

ont accepté de faire partie de mon jury de thèse et je les en remercie.

Je tiens à remercier tout particulièrement mon directeur de thèse, Jean-Pierre TALPIN, Directeur de recherche à l'INRIA, pour m'avoir guidé tout au long de ces trois années de doctorat et sans qui je n'aurais pu accomplir ce travail. Ses retours ont toujours été pertinents et ont abondamment nourri ma réflexion. Je remercie aussi Benoit BOYER, Ingénieur de Recherche à Mitsubishi Electric qui m'a encadré sur toute la durée de mes travaux et qui a toujours été présent pour répondre à mes nombreuses questions. Son enthousiasme m'a aidé à continuer à de nombreuses reprises.

Résumé en français

Les systèmes cyber-physiques mélangent des comportements physiques continus, tel la vitesse d'un véhicule, et des comportement discrets, tel que le régulateur de vitesse d'un véhicule. Ils sont désormais omniprésents dans notre société. Un grand nombre de ces systèmes sont dits critiques, i.e. une mauvaise conception entrainant un comportement non prévu, un bug, peut mettre en danger des êtres humains. Ainsi, un régulateur de vitesse qui autoriserait un véhicule à dépasser les limitations de vitesse met en danger les passagers du véhicule.

Il est nécessaire de développer des méthodes pour garantir le bon fonctionnement de tels systèmes. La méthode la plus répandue est le test. On va tester de manière approfondie si une voiture se comporte comme attendue ou si le programme réagit comme souhaité pour un grand nombre de situations possibles. Mais si cette approche permet de mettre en évidence des problèmes, elle n'est pas en mesure de garantir l'absence de problèmes. En effet, si on teste la voiture pendant un millier d'heures, il est possible qu'un problème arrive uniquement à partir de la mille-et-unième heure de fonctionnement. Une autre approche a été développé ces dernières décennies en informatique et qui permet de garantir l'absence problèmes : les méthodes formelles.

Les méthodes formelles regroupent des procédés mathématiques pour garantir qu'un programme se comporte comme attendu, par exemple que le régulateur de vitesse n'autorise pas de dépasser la vitesse maximale autorisée. Mais les procédés développés l'ont principalement été pour des programmes, i.e. que l'on ne considère pas la partie continue du système comme l'évolution de la vitesse, et on peuvent donc garantir le bon fonctionnement du système physique. Il est donc souhaitable de développer des méthodes formelles spécifiques pour garantir le bon fonctionnement de systèmes cyber-physiques.

Une telle tâche rencontre néanmoins un problème de taille qui est de réussir à conjuguer deux formalismes de natures différentes. En effet, les systèmes physiques sont représentés par des équations différentielles à valeur dans l'ensemble des nombre réels R. Les programmes sont eux modélisés comme étant à valeur dans les entiers naturels N. Cela est particulièrement problématique pour la représentation du temps. Quand un programme s'exécute, on ne s'intéresse pas au temps qui peut s'écouler entre deux instructions, la représentation du temps est discrète. Mais l'évolution d'un phénomène physique est continue : il n'y a pas de pause.

André Platzer a proposé en 2007 un nouveau formalisme, la logique dynamique différentielle, réunissant ces deux aspects. Ce formalisme permet de modéliser formellement, i.e. avec une sémantique définie mathématiquement, des systèmes exhibant à la fois des comportements continus et discrets, ainsi que leurs interactions possibles. De plus, André Platzer a défini un système de preuve permettant de raisonner sur de tel systèmes et donc de garantir leur bon fonctionnement. Il devient alors possible de modéliser formellement un régulateur de vitesse avec l'évolution réelle de la vitesse et de démontrer qu'il est impossible que le véhicule dépasse les vitesses maximales autorisées, cela pour un intervalle de temps arbitrairement long et non pour les mille premières heures.

Malheureusement, la mise en oeuvre de cette méthode requiert une connaissance approfondie des systèmes étudiés ainsi que des mécanismes de preuves formelles associées. En effet, le système est représenté dans sa globalité, en un bloc monolithique, et la complexité de la preuve augmente en fonction de la taille du système. Ainsi, des systèmes relativement simples du point de vue d'un ingénieur dans l'industrie nécessitent un effort important de preuve qui ne peut être supporté par un ordinateur. Il nous faut donc développer des méthodes pour passer à l'échelle et augmenter la complexité des systèmes étudiés.

La complexité d'un système cyber-physique revêt deux aspects à notre connaissance. Le premier aspect est la complexité que nous appelons mathématique. Il s'agit de la complexité inhérente à un phénomène physique, par exemple le déplacement d'un satellite où l'on est obligé de prendre en compte la théorie de la relativité. Le deuxième aspect est la complexité que nous appelons structurelle. Elle provient de la répétition de composants élémentaires, par exemple une usine de traitement des eaux où plusieurs cuves sont connectées ensemble. Chaque cuve prise individuellement est simple à comprendre, modéliser, et de là, à prouver son bon fonctionnement. Mais il est difficile de considérer l'usine en entier car la répétition rend la modélisation plus complexe ainsi que la preuve. Ces systèmes sont très courants dans les milieux industriels. C'est ce dernier aspect que nous avons voulu traiter dans ce mémoire. Notre problématique est comment modéliser efficacement des systèmes cyber-physiques dont la complexité réside dans une répétition de morceaux élémentaires. Et une fois que l'on a obtenu une modélisation, comment garantir le bon fonctionnement de tels systèmes.

L'approche classique où l'on modélise le système d'un seul tenant et essaye ensuite de montrer son bon fonctionnement n'est pas applicable. La modélisation serait laborieuse et sujette à erreurs dues à la taille du modèle. La preuve du modèle résultant ne pourra pas être prise complètement en charge par un ordinateur car la puissance de calcul nécessaire est beaucoup trop élevée. Un expert en démonstration de système cyber-physique sera donc nécessaire.

Notre approche consiste à modéliser le système de manière compositionnelle. Plutôt que de vouloir le modéliser d'un seul tenant, il faut le modéliser morceaux par morceaux, appelés composants. Chaque composant correspond à une brique élémentaire du système et il est donc possible de le modéliser facilement. On obtient le système complet en assemblant les composants ensembles. Ainsi l'usine de traitement des eaux est obtenue en assemblant les cuves ensembles. L'intérêt de cette méthode est qu'elle correspond à l'approche des ingénieurs dans l'industrie : considérer des éléments séparés que l'on compose ensuite.

Mais cette approche seule ne résout pas le problème de la preuve de bon fonctionnement du système. Il faut aussi rendre la preuve compositionnelle. Pour cela, on associe à chaque composant des propriétés et on prouve qu'elles sont respectées. Cette preuve peut être effectué par un expert, mais aussi par un ordinateur si les composants sont de tailles raisonnables. Il faut ensuite nous assurer que lors de l'assemblage des composants, les propriétés continuent à être respectées. Ainsi, la charge de la preuve est reportée sur les composants élémentaires, l'assurance du respect des propriétés désirées est conservée lors des étapes de composition. On peut alors obtenir une preuve du bon fonctionnement de systèmes industriels avec un coût de preuve réduit.

Notre contribution majeure est de proposer une telle approche compositionnelle à la fois pour modéliser des systèmes cyber-physiques, mais aussi pour prouver qu'ils respectent les propriétés voulues. Ainsi, à chaque étape de la conception, on s'assure que les propriétés sont conservées, si possible à l'aide d'un ordinateur. Le système résultant est correct par construction.

Plus précisément, nous avons défini formellement une notion de composant dans la logique dynamique différentielle. Un composant est constituée d'une partie discrète, par exemple le contrôleur du niveau d'eau dans une cuve, et d'une partie continue -sous la forme d'une équation différentielle-, par exemple l'évolution du niveau d'eau, le tout formant un système cyber-physique. On ne fait pas d'hypothèses de priorité entre chaque partie, ce qui correspond à la réalité de fonctionnement des systèmes cyber-physiques. Le système est réactif, et peut s'exécuter pour une durée de temps arbitrairement longue. Il est possible pour un composant d'être uniquement discret, par exemple le contrôleur du niveau d'eau, ou uniquement continue, par exemple l'évolution du niveau d'eau. Cette définition est assez générique pour permettre de modéliser un vaste ensemble de systèmes industriels.

Une fois la notion de composant définie, il nous faut un moyen pour les assembler. On a défini un opérateur de composition parallèle. Il permet de modéliser deux composants s'exécutant simultanément -en parallèle-, par exemple deux cuves d'eau. Le parallélisme des parties discrètes est obtenue par entrelacement; n'importe quelle ordre d'exécution est possible. Le parallélisme des parties continues est obtenue en considérant le système composée de chaque équation différentielles. Le composant résultant est la réunion des deux parties, encore une fois sans hypothèse de priorité.

Notre opérateur de composition parallèle est syntaxique et peut donc être implémentée par un ordinateur. Ainsi, un ingénieur aurait à définir chaque composant formellement, puis le système résultant par composition serait générée par l'ordinateur, réduisant les risques d'erreurs d'inattention.

Notre opérateur possède deux importantes propriétés algébriques : la commutativité et l'associativité. La commutativité veut dire que l'ordre de composition n'est pas pertinent. Composer une cuve d'eau A en parallèle avec une autre cuve d'eau B en parallèle revient exactement à la même chose que de composer la cuve B en parallèle avec la cuve d'eau A. L'associativité veut dire que l'on peut construire notre système pas-à-pas. On n'est pas obligé de composer tout les composants d'un coup. Ainsi la composition d'une cuve A avec une cuve B, puis le tout composé avec une troisième cuve C est équivalent à la composition des cuves B et C d'abord, puis composé ensuite avec A.

L'associativité est une propriété clé pour obtenir une approche vraiment modulaire. Des travaux précédents avaient déjà proposé une approche compositionnelle dans la logique dynamique différentielle, mais leur opérateur de composition parallèle n'était pas associatif.

On a donc une méthode permettant de modéliser un système cyber-physique de manière modulaire grâce à une approche par composant. Mais ce n'est que la moitié du résultat désiré. On veut aussi pouvoir faire les preuves de correction des systèmes cyber-physique de manière modulaire.

A chacun de nos composants, on associe ce que l'on appelle un contrat. Un contrat est une structure formelle permettant de représenter les hypothèses sous lesquelles un composant peut s'exécuter ainsi que les garanties apportées par le composant. On peut prouver ensuite en utilisant le système de preuves de la logique dynamique différentielle qu'un composant satisfait son contrat associé, i.e. que sous les hypothèses énoncées, les garanties seront toujours vérifiées pour n'importe quelle exécution du composant.

Nous avons démontré un théorème qui nous assure que sous l'hypothèse que chaque composant satisfait son contrat, la composition parallèle de ces composants satisfait la conjonction des contrats. La conjonction de deux contrats est le contrat où les hypothèses sont la conjonction des hypothèses respectives et les garanties sont la conjonction des garanties respectives. Ainsi, on conserve la satisfaction des contrats à travers la composition permettant d'obtenir la preuve de bon fonctionnement du système par construction. Cependant, plusieurs conditions sont requises pour que ce théorème soit applicable.

La première condition est que les composants ne partagent pas de sorties communes. Cela veut dire que deux composants ne doivent pas agir sur les mêmes parties du système. Par exemple, deux contrôleurs pour des cuves différentes ne doivent pas contrôler la même vanne. Il s'agit d'une bonne pratique de conception, deux composants agissant sur une même sortie amène des conflits et peut produire des comportements inattendus.

La second condition est que les garanties d'un composant ne doivent pas faire référence aux sorties d'un autre composant. Ainsi, les garanties d'un contrôleur d'une cuve ne doivent pas référer aux sorties d'un contrôleur d'une autre cuve. Il s'agit là aussi d'une bonne pratique de conception. Les garanties d'un composant doivent faire référence à ses propres sorties, i.e. celles sur lesquelles il a une capacité d'action.

La dernière condition est que les garanties d'un composant ne doivent pas infirmer les hypothèses d'un autre composant. En effet, cela veut dire qu'un composant ne se comporte pas de la manière attendue par le second composant. Il y a donc un problème de conception.

Ces trois conditions sont énoncées de manière syntaxique et peuvent donc être vérifiées par un ordinateur. Ainsi, il est possible d'implémenter complètement cette méthode pour conserver les contrats lors de la composition.

Pour résumer, nous avons proposé une approche permettant de modéliser et vérifier un système de manière modulaire. Nos définitions sont syntaxiques et l'approche peut donc être implémenté afin d'automatiser notre approche.

Nous avons implémenté un prototype dans le prouveur interactif de théorèmes KeYmaera X. Cela permet de montrer la faisabilité d'une telle implémentation. Nous avons étudié deux systèmes industriels afin de valider notre approche. Le premier est un régulateur de vitesse, le second une usine de traitements des eaux composée de plusieurs cuves d'eau en parallèle. L'étude de ces deux exemples a permis de montrer la viabilité de notre approche, mais a aussi mis en relief les améliorations possibles.

Un point particulièrement important concerne la classe des systèmes contrôlés par ordinateur. Il s'agit des systèmes où une grandeur physique, par exemple l'évolution du niveau d'eau d'une cuve, est régulé par un programme, par exemple le contrôleur du niveau d'eau. Le programme surveille l'évolution continue à l'aide d'un capteur qui mesure la valeur périodiquement. Le programme doit ensuite agir de manière à ce que les propriétés désirées soit toujours respectées. Ainsi, pour la cuve d'eau, on veut que le niveau d'eau ne déborde jamais. La caractéristique clé de ces systèmes est la relation périodique au temps. Le contrôleur doit avoir une information suffisamment souvent pour pouvoir réguler le système.

On a montré comment on pouvait améliorer notre approche précédente pour prendre en compte ces aspects temporels supplémentaires. Lors de la définition d'un contrôleur, l'ingénieur doit préciser sa période d'exécution, i.e. l'intervalle maximum entre deux exécutions du contrôleur. Lors de la définition de la partie dynamique, il doit fournir sa contrôlabilité. Il s'agit de la durée maximum pendant laquelle le système dynamique peut évoluer sans intervention du contrôleur et encore satisfaire les propriétés voulues. On a modifié notre opérateur de composition parallèle et démontré que l'on conserve la satisfaction des contrats lors de la composition sous les mêmes conditions. On requiert en plus que la période d'exécution du contrôleur soit inférieure à la contrôlabilité du système dynamique. Il s'agit encore une fois d'une bonne pratique de conception, un système ne satisfaisant pas cette condition aurait peu de chance de fonctionner.

On a ensuite généralisé cette adaptation. On associe une période d'exécution lors de la définition d'un composant discret et une contrôlabilité lors de la définition d'un composant continu. On modifie aussi légèrement notre opérateur de composition parallèle pour prendre en compte ces deux caractéristiques temporelles. Lors de la composition parallèle de deux systèmes discrets, la période d'exécution résultante est la somme des périodes d'exécution. En effet, on suppose que l'exécution se fait sur une seule unité de calcul et le parallélisme est obtenue par entrelacement. La contrôlabilité d'un composant continu résultant de la composition parallèle de deux composants continus est le minimum des contrôlabilités respectives.

Malgré ces ajouts, notre opérateur de composition parallèle reste commutatif et associatif.

De la même manière que l'on a généralisé la modélisation par composants à des systèmes avec des caractéristiques temporelles, on a généralisé notre théorème permettant de conserver la satisfaction des contrats lors de la composition. Étant donné la preuve de satisfaction des contrats respectifs, on peut exhiber la preuve de satisfaction de la conjonction des contrats. Les mêmes conditions que précédemment sont nécessaires ainsi que la période d'exécution résultante doit toujours être inférieure à la contrôlabilité résultante.

Finalement, on a adapté notre approche pour modéliser deux autres cas que l'on rencontre fréquemment dans les systèmes industriels : les modes de fonctionnement et la causalité temporelle. L'exemple récurrent des modes de fonctionnement est la présence d'un mode nominal, où le système fonctionne normalement, et d'un mode dégradé, où le système doit garantir uniquement des propriétés vitales. Par exemple, dans le cas de nos cuves d'eau interconnectés, le premier mode correspond au fonctionnement normal où les niveaux d'eau ne doivent pas déborder, mais aussi être suffisamment élevés pour garantir un débit minimal à la sortie de la cuve. Le mode dégradé correspond à une urgence, par exemple un bouton poussoir d'urgence enclenché, et toutes les vannes sont fermées. On veut juste alors garantir que les cuves ne débordent pas.

On modélise chaque mode comme étant un composant et on obtient le système comportant les deux modes de fonctionnement avec notre opérateur de composition parallèle. Mais on ne peut pas conserver les contrats lors de la composition. En effet, nos deux composants représentant chacun un mode ont des sorties communes, et les conditions de notre théorème de composition ne sont pas donc pas remplies. Mais ces deux modes ne s'exécutent pas vraiment en parallèle, ils sont même exclusifs; il n'est pas possible qu'ils se déroulent simultanément. On caractérise chaque mode avec une formule, et sous condition que les formules sont contradictoires, on peut conserver les contrats lors de la composition.

Nous avons aussi défini un opérateur de composition causale. Il est souhaitable parfois d'ordonnancer deux composants plutôt que de les exécuter en parallèle. Par exemple, un capteur doit toujours s'exécuter avant le programme utilisant les données du capteur pour réguler le système dynamique. Dans le cas contraire, le programme raisonnerait avec des données périmées et ne se comporterait pas comme attendu. Ce nouvel opérateur de composition reste compatible avec l'opérateur de composition parallèle et est toujours associatif, nécessaire pour la modularité de notre approche. Comme précédemment, nous avons démontré un théorème permettant de conserver les contrats lors de la composition.

En conclusion, nous avons développé une méthodologie modulaire fondée sur la composition pour modéliser formellement et vérifier des systèmes cyber-physiques. Nous avons illustré qu'elle peut être implémenté et modifié pour s'adapter à de nouveaux défis. Elle sert de base théorique pour développer un outil sur la modélisation formelle et la preuve de systèmes cyber-physiques.

Introduction

Programs are used to govern numerous parts of our society: in the monitoring of railway networks or money transfers for example. It is mandatory that they behave correctly. When we order online goods, we want to be sure that no one can access our personal information. Power grids, water-plant and planes are all supervised by complex programs; a bug may lead to disastrous and potentially deadly consequences. Such systems are called safety-critical.

To avoid bugs, software engineers have developed numerous testing procedures, but they are fundamentally limited. "The test of programs may be a very efficient way to show the presence of bugs, but is desperately inadequate to prove their absence" (Djikstra, 1972). A test can not ensure that every behavior of a program is correct since there is an infinity of behaviors, it only assesses that it works for the finite set of tested behaviors. Another approach is to use the so-called formal methods. Instead of testing if a program works correctly for some behaviors, it advocates the use of mathematics to prove that the program behaves correctly for every possible execution. They are costly, being thus applied for critical programs only.

Numerous approaches and tools have been developed these past decades, and great successes have been achieved. The CompCert compiler is a compiler for a consequent subset of the C language formally verified using the theorem prover Coq. The Communication-Based Train Control (CBTC) program running the lane 14 of Parisian subway has been entirely developed using the B method, an other formal verification technique. But they have been obtained at the cost of great effort and intensive research, and their systematic replication in the industry is still not feasible.

Most approaches to the problem of verification of program assumed it to be already written and try to prove that it behaves correctly. The conception of the program is usually achieved by an expert of the domain and the verification process by a proof engineer who is not familiar with the domain. The former conducts the development without thinking about the formal verification. The latter has to deconstruct the software in order to conduct the proof. It results in a huge amount of wasted time and resources, and possibly misunderstandings. The correct-by-construction approach advocates the idea that the design and the verification should not be separated, but rather conducted simultaneously. The verification provides significant insights for the development of the software which is in return produced with its verification as a goal. The B method follows this paradigm, which is believed to be the key point of its success.

In the case of the CBTC verification, only the program has been verified; the physical quantities involved (e.g. the speed of the train) are not considered or idealized. Programs as the CBTC do not simply perform a computation, they exhibit frequent interactions with the physical environment. The resulting behavior can not be fully understood without taking physical evolution into consideration. Since such programs are often critical, e.g. auto-pilot of planes or monitors of water-plant treatment, it is highly desirable to develop specific formal methods.

Systems where physical behavior, e.g. the speed of a train, is mixed with discrete behaviors, e.g. the CBTC, are called cyber-physical systems (CPS) or hybrid systems. The first behavior assumes a continuous model of time when the second possesses a discrete model of time. The difference of nature between theses two models render the formal design of hybrid systems very complex. Plus, many systems exhibit intangible interactions between discrete and continuous behavior. Reasoning about such systems demands tools capable to accommodate the different abstractions level such as the system level, processor level, logic level, etc.

In 2007, the Differential Dynamic Logic is defined by André Platzer to model and verify such systems. It provides a precise mathematical semantics and considers physical evolution on the same level as programming constructs. It features a proof system to ensure the correctness of behaviors which has been used to prove numerous use-cases, some of them unverified previously. The proof system has been implemented in the interactive theorem prover KeYmaera X. This theorem prover is designed toward automation which is a key functionality to make tractable proofs. Despite this, most of the problems are still intractable in practice and a methodology to tackle large problems is thus required. One of the most ancient method to address a difficult problem is to divide it into smaller parts, as exposed by Descartes in his book Discours de la méthode. Each part is easier to understand for a human, but also easier for a computer to treat. Seeking methods to efficiently break down a system is thus highly desirable. Numerous works have been produced for programs, but few have been done for cyber-physical systems and in Differential Dynamic Logic.

My main contribution is the definition of a modular component-based framework in Differential Dynamic Logic to model and prove correctness of Cyber-Physical Systems. It provides theoretical basis to represent parallel composition of Cyber-Physical systems and how to implement a correct-by-design approach.

Adressed problem

Cyber-Physical systems (or hybrid systems) are pervasive in our society. Autonomous vehicles, water-plant or train control systems are examples of such systems. It is important to have methods to faithfully model such systems and soundly reason on it. Furthermore, these methods should be scalable, i.e. applicable to industrial systems as a water-plant factory.

We present briefly the problem of the scalable verification of hybrid systems in Section 1.1. Verification of hybrid systems is an important subject and numerous solutions have been proposed. We present in Section 1.2 such solutions. Lastly, we detail our contribution in Section 1.3; it consists of a modular component-based framework, to address the problem of modeling and proof of hybrid systems.

Verification of Cyber-Physical Systems

In Subsection 1.1.1, we give a detailed presentation of hybrid systems and of the verification problem. We identify the challenges specific to this problem. We justify in Subsection 1.1.2 the interest of a formal treatment of hybrid systems and detail the need for proved systems. In Subsection 1.1.3, we detail briefly our approach.

Scalable verification of hybrid systems

Cyber-Physical Systems (CPS) (or hybrid systems) mix continuous behaviors with discrete behaviors. Continuous behaviors can be the speed of a vehicle or the water-level in a tank. Discrete behaviors can be computer programs as a tachymeter or a water-level controller. It can also be discontinuities between two continuous behaviors. In the bouncing ball example [START_REF] Platzer | Keymaera: A hybrid theorem prover for hybrid systems (system description)[END_REF], the fall and the bounce of the ball are two different continuous evolution and the transition is modeled by a discrete behavior.

The problem of verification of hybrid systems consists in the development of mathematical methods to ensure the correct behavior of such systems. Numerous methods have been proposed over the years for cyber systems, but much less for CPS. The reason is the complicated interaction between the continuous behaviors and discrete behaviors. They have a distinct model of time. Computers are assumed to function on a discrete basis. Between two operations, there is a gap. But a plant evolves continuously; the speed of a car does not jolt.

Numerous solutions have been proposed to answer the challenge of modeling and verification of CPS. But they are still not applicable to industrial systems as a water-plant factory due to an increasing complexity in the conception or/and the verification. There is a need for methodologies to scale up.

Interest of hybrid systems

Hybrid systems are ubiquitous and are used daily by everyone without knowing it. They perform numerous tasks, most of them being critical. It is thus mandatory to ensure that they behave correctly, i.e. they meet their requirements. The most common methods to verify it is the use of testing methods. But they are fundamentally limited since they can only show the presence of bugs, not their absence. Formal methods ensure such absence and are thus desirable for systems where the failure is not acceptable.

A massive amount of efforts have been put to the development of efficient verification tools and of methodologies for computer systems, but few for cyber-physical systems due to the complicated relation between continuous and discrete behaviors. Efficient verification tools reduce the proof effort to ensure that desired safety properties are satisfied. Methodologies provide designers with guidance to efficiently model and prove systems. There is a crucial need for efficient tools and methodologies to scale formal verification for hybrid systems.

Our approach: correct-by-design

The current process to obtain reliable cyber-physical systems is to first design the system, then to verify if meets its specification. But, once a system is designed, it is very difficult to prove its correctness with respect to the specification. The processing of a proof is very different from the design process and is often realized by a different person or team. Communication issues add up in the case of different teams restraining more an efficient processing of the proof. It is thus highly desirable to have methods to carry the design phase simultaneously with the verification phase. It is the correct-by-design spirit.

Numerous formal methods have been developed to ensure correctness of a system, but a few of them are scalable, i.e. that can be applied to realistic systems used in the industry and not just on toy examples. The correct-by-design approach has been used for most of the realistic systems verified by formal methods, e.g. the lane 14 of the Parisian subway. But it is not enough to ensure scalability and the other proven approach is the component-based approach.

State of the art

The most popular approach to tackle the issue of modeling and verification of hybrid systems has been the extension of existing formalisms with hybrid features, i.e. with differential equations. We present such formalisms and their extensions in the two Subsections 1.2.1 and 1.2.2. Yet, several formalisms are not adaptation of previous work. We present them in Subsection 1.2.3 s.

Formalisms for discrete systems

We present briefly formalisms primarily introduced to model and verify computer programs or discrete systems. They have been extended to hybrid systems.

Automata theory Automata theory denotes the approach where systems are modeled by automata and the verification is performed by model-checking [START_REF] Hopcroft | Introduction to automata theory, languages, and computation[END_REF]. It is widely used to model formal languages and plays a major role in the field of formal verification.

B/Event-B The B-method is a refinement-based approach to develop programs from an abstract specification [START_REF] Abrial | The B-book: assigning programs to meanings[END_REF]. It has been successfully used to develop the lane 14 of the Parisian subway.

Event-B is an extension with a more flexible approach to refinement [START_REF] Jean-Raymond | Modelling in event-b. system and software engineering[END_REF]. It is for example possible to introduce events during a refinement step.

Dynamic Logic Dynamic Logic is a deductive approach to the verification of infinite-state discrete systems [START_REF] Vaughan R Pratt | Dynamic logic[END_REF]. Its characteristics are to internalize the operational model of the system within logical formulas to the same level as the properties to be verified. A single formula thus represents a system with its environment, assumptions, model and guarantees of good behavior. It has been able to verify consequent Java programs [START_REF] Corina | Verification of java programs using symbolic execution and invariant generation[END_REF].

Action Systems Action Systems are a formalism describing general reactive systems in terms of atomic actions occurring during the execution of a system. The approach has been applied to parallel and distributed systems [START_REF] Back | Refinement calculus: a systematic introduction[END_REF].

It allows to model terminating or infinitely repeating systems, e.g. embedded systems. Since most of hybrid systems are reactive systems, several extensions to continuous behaviors have been proposed.

Communicating Sequential Processes Communicating Sequential Processes (CSP) is a formalism proposed by Hoare in 1978 [START_REF] Antony | Communicating sequential processes[END_REF] to describe concurrent aspects of programs. CSP allows to describe systems as independent component processes. It uses message-passing communication to model the interaction between processes. It is mainly used to model safetycritical systems.

Synchronous languages Synchronous languages have been developed to ensure the correctness of safety-critical embedded systems [START_REF] Berry | The esterel synchronous programming language: Design, semantics, implementation[END_REF][START_REF] Gautier | Signal: A declarative language for synchronous programming of real-time systems[END_REF][START_REF] Halbwachs | The synchronous data flow programming language lustre[END_REF]. They support functional concurrency and synchronicity. They aim to remain simple in order to facilitate the adoption by software engineers. They are founded on a solid mathematical basis which makes it amenable for proofs of correctness and certification purposes. Several successes in the industry have been obtained [START_REF] Benveniste | The synchronous languages 12 years later[END_REF].

Addition of continuous features

This section presents formalisms obtained by the addition of continuous features. The original formalisms are presented in Subsection 1.2.1. The approach consists of the adjunction of differential equations as a new language construct. Hybrid automata Hybrid automata is a formalism introduced in 1993 to model hybrid systems. It extends the notion of automata with differential equations [START_REF] Alur | Hybrid automata: An algorithmic approach to the specification and verification of hybrid systems[END_REF][START_REF] Thomas | The theory of hybrid automata[END_REF]. It has been one of the first formalisms for modeling systems with mixed discrete-continuous behavior and has attracted a lot of attention during the last decades. Hybrid automata have allowed the study of numerous sub-classes of hybrid systems and provided important theoretical results.

Once a system is modeled as a hybrid automaton, we verify properties by model-checking. The properties are usually expressed in the Real Arithmetic theory. For example, the modelchecker Hytech can verify properties on linear hybrid automaton [START_REF] Thomas A Henzinger | Hytech: A model checker for hybrid systems[END_REF].

Given two hybrid automata, it is possible to compose them in parallel to obtain a new system. The resulting hybrid automaton is exponential in size, and thus intractable; it is the state-space explosion problem. I/O hybrid automata I/O hybrid automata is an extension of hybrid automata where the inputs and outputs are explicit [START_REF] Lynch | Hybrid i/o automata[END_REF]. It has been developed to tackle the composability issue and it allows to use the notions from contract theory. The verification of systems is also performed by model-checking of desired properties.

Simulation-based verification

Verification by simulation [START_REF] Donzé | Systematic simulation using sensitivity analysis[END_REF][START_REF] Dragomir | Compositional semantics and analysis of hierarchical block diagrams[END_REF][START_REF] Girard | Approximate bisimulation: A bridge between computer science and control theory[END_REF][START_REF] Han | Reachability analysis of large-scale affine systems using low-dimensional polytopes[END_REF][START_REF] Nahhal | Test coverage for continuous and hybrid systems[END_REF] considers full set of time-bounded trajectories of a hybrid system evolving from an initial state. The verification is carried on by means of finite sample of initial states and a sensitivity argument. It starts with a sufficiently dense sample of initial states on which numerical simulation is applied to obtain the corresponding trajectories. The sensitivity argument is then used to over-approximate the "tube" of trajectories.

Verification of stochastic hybrid systems Stochastic behaviors are omnipresent in hybrid systems due to the inherent uncertainty of environment or simplifications tackle the complexity of modeling and verification. Stochastic hybrid systems exhibit a tight interaction of discrete, continuous and stochastic behaviors.

Hybrid automata have been extended to model such systems. The verification is then done through reachability analysis [START_REF] Abate | Probabilistic reachability and safety for controlled discrete time stochastic hybrid systems[END_REF][START_REF] Altman | Asymptotic optimization of a nonlinear hybrid system governed by a markov decision process[END_REF][START_REF] Bujorianu | Extended stochastic hybrid systems and their reachability problem[END_REF][START_REF] Fränzle | Measurability and safety verification for stochastic hybrid systems[END_REF][START_REF] Sproston | Decidable model checking of probabilistic hybrid automata[END_REF][START_REF] Zhang | Safety verification for probabilistic hybrid systems[END_REF] or simulation [START_REF] Meseguer | Specification and analysis of distributed objectbased stochastic hybrid systems[END_REF][START_REF] Zuliani | Bayesian statistical model checking with application to simulink/stateflow verification[END_REF]. Theses works have introduced different notion of hybrid automata which differ on the randomness is introduced.

Another possibility is to introduce stochastic differential equations which generalize differential equations [START_REF] Abate | Probabilistic reachability and safety for controlled discrete time stochastic hybrid systems[END_REF][START_REF] Bujorianu | Bisimulation for general stochastic hybrid systems[END_REF][START_REF] Hu | Towards a theory of stochastic hybrid systems[END_REF]. A compositional modeling framework have been proposed to handle the modeling of complex stochastic hybrid systems by André Platzer in dL [START_REF] Platzer | Stochastic differential dynamic logic for stochastic hybrid programs[END_REF] and the formalism HMODEST [START_REF] Moritz Hahn | A compositional modelling and analysis framework for stochastic hybrid systems[END_REF]. This last works extends the MODEST modeling language with differential equations. MODEST is high-level language inspired by process algebra and features compositional modeling as a native feature.

Hybrid Event-B Hybrid Event-B intends to apply the approach by refinement, characteristic of the B method, to hybrid systems [START_REF] Abrial | Formalizing hybrid systems with event-b[END_REF][START_REF] Banach | Core hybrid event-b i: single hybrid event-b machines[END_REF]. The development is carried as with Event-B, except that continuous behaviors can be specified.

Differential Dynamic Logic (dL) Differential Dynamic Logic (dL) is a hybrid extension of the Dynamic Logic. It is a logic-based approach to the modeling and verification of hybrid systems [START_REF] Platzer | Differential dynamic logic for verifying parametric hybrid systems[END_REF]. The theory is implemented in the theorem prover KeYmaera X [START_REF] Mitsch | The keymaera x proof ide-concepts on usability in hybrid systems theorem proving[END_REF] whose core has been formally verified in Coq and Isabelle [START_REF] Bohrer | Formally verified differential dynamic logic[END_REF].

Differential Dynamic Logic provides important theoretical results. It has proved that discrete systems, continuous systems and hybrid systems are equivalent in a proof-theoretic viewpoint [START_REF] Platzer | The complete proof theory of hybrid systems[END_REF]. More precisely, there is a sound and complete axiomatization of hybrid systems relative to continuous dynamical systems, and conversely, there is a sound and complete axiomatization of hybrid systems relative to discrete dynamical systems. These results increase the confidence in the ability of computers, intrinsically discrete, to handle the verification of hybrid systems.

Hybrid systems are modeled by the so-called hybrid programs. The discrete fragment is a small and Turing-complete programming language. It corresponds to the modeling part of Dynamic Logic, which has been successfully used to verify several Java programs in the theorem prover KeY [START_REF] Ahrendt | The key platform for verification and analysis of java programs[END_REF].

The continuous fragment is comprised of Ordinary Differentials Equations (ODEs). The instructions of the programming language are at the same level as discrete instructions. They can thus be combined freely with them. The differential equations are required to have a solution, but it is not mandatory to exhibit it to verify properties.

Properties are expressed in First-Order logic of Real Arithmetic augmented with a modality (r.s). Real Arithmetic allows to represent polynomials, but not trigonometric or exponen-tial functions. First-Order Logic connects real arithmetic terms. The modality articulates the behavior of hybrid programs with the properties.

A proof system under the form of a sequent calculus has been defined. Key aspects of sequent calculus are a syntactic deductive approach amenable to automation and an adaptability to extensions of logic. It features rules to handle First-Order logical connectives and structural properties of proofs and rules to reason on hybrid programs. The former are common to many other sequent calculus. The latter can be subdivided in two. One part is devoted to discrete instructions, and corresponds to rules in Dynamic Logic. The second part regroups rules to reason on ODEs. Among these, the rule of Differential Invariant stands out by its importance. It allows to prove that an ODE satisfies a property without having to provide the solution. It makes a parallel between the discrete iteration and an ODE. The sequent calculus has been proved sound, i.e. that every derived formula is semantically true.

Several extensions of dL have been proposed. In [START_REF] Platzer | A temporal dynamic logic for verifying hybrid system invariants[END_REF] and [START_REF] Jeannin | dtl 2: Differential temporal dynamic logic with nested temporalities for hybrid systems[END_REF], the authors proposed an extension of dL with the diamond -♦ -and the boxl -constructs of standard temporal logic [START_REF] Pnueli | The temporal logic of programs[END_REF]. This conservative extension allows to express that a property ϕ is true along all states of every trace of a hybrid program α -rαslϕ. Other extensions are Quantified Differential Dynamic Logic used to model distributed hybrid systems [START_REF] Platzer | Quantified differential dynamic logic for distributed hybrid systems[END_REF], or an extension for hybrid games [START_REF] Quesel | Playing hybrid games with keymaera[END_REF]. In [START_REF] Ruchkin | Architectural abstractions for hybrid programs[END_REF], the authors introduce architectural abstractions for hybrid programs. They address the issues caused by the monolithic approach of dL, difficulty of understanding and change, bu using component-based engineering.

The proof system has been first implemented in KeYmaera [START_REF] Platzer | Keymaera: A hybrid theorem prover for hybrid systems (system description)[END_REF], which is an extension of the KeY theorem prover [START_REF] Beckert | Verification of object-oriented software: The KeY approach[END_REF]. The theorem prover has been completely rewritten to become KeYmaera X [START_REF] Fulton | Keymaerax: An axiomatic tactical theorem prover for hybrid systems[END_REF]. The kernel asserting and checking the correctness of the proof has been reduced to several thousands of lines of code and has been verified in Coq and Isabelle [START_REF] Bohrer | Formally verified differential dynamic logic[END_REF]. KeYmaera X is aimed toward automation [START_REF] Mitsch | The keymaera x proof ide-concepts on usability in hybrid systems theorem proving[END_REF]. It uses back-end tools, Z3 [START_REF] De | Z3: An efficient smt solver[END_REF] and Mathematica [START_REF] Wolfram | The mathematica[END_REF], to respectively discard real arithmetic formula and reasoning on differential equations.

In [START_REF] Müller | A component-based approach to hybrid systems safety verification[END_REF], the authors introduced a commutative (non-associative) composition operator in dL. It allows to break down a system model into independent functional parts or components. Under a proof of the properties associated to these components as a contract, a theorem allows to transfer properties to the global system. A more recent work of A. Muller and A. Platzer [START_REF] Müller | Change and delay contracts for hybrid system component verification[END_REF] is more closely related to our contribution. It extends previous work on componentbased design in dL by presenting a way to handle retro-action along with a methodology to efficiently use it. It adds an important feature to earlier work [START_REF] Müller | A component-based approach to hybrid systems safety verification[END_REF] allowing to model a wider class of systems, but it still lacks modularity for design and proof automation capabilities as the composition is not associative.

Hybrid Action Systems Two different extensions of Action Systems have been introduced: Differential Action Systems and Continuous Action Systems.

Differential Action Systems are an extension of Action Systems with a new action: the differential action [START_REF] Rönkkö | Action systems with continuous behaviour[END_REF][START_REF] Rönkkö | Refinement and continuous behaviour[END_REF]. It represents differential equation. The weakest precondition reasoning associated for differential action is developed with it.

The approach taken by Continuous Action Systems [START_REF] Back | Continuous action systems as a model for hybrid systems[END_REF] is to enhance the variable with time-dependent attributes. They are seen as functions from R `, the time-domain, to continuous or discrete value domains. It allows to model real-time systems without adding new actions and thus not having to redesign a proof theory behind it.

Hybrid Communicating Sequential Processes Hybrid Communicating Sequential Processes is an extension of the process algebra CSP proposed in 1994 by Jifeng He [START_REF] Zhou Chaochen | A formal description of hybrid systems[END_REF][START_REF] Jifeng | From csp to hybrid systems[END_REF]. It integrates real-time and continuous constructs such differential equations to model continuous evolution. As a process algebra, HCSP features to construct complex systems out of simpler ones, notably using communication channels and a parallel composition operator which are native. It has been used to model several industrial systems such as the Chinese Train Control System [START_REF] Liu | A calculus for hybrid csp[END_REF] and a running aircraft [START_REF] Wang | A compositional modelling and verification framework for stochastic hybrid systems[END_REF].

In 2010, a Hoare-style calculus is introduced to reason about HCSP [START_REF] Dimitar P Guelev | Compositional hoare-style reasoning about hybrid csp in the duration calculus[END_REF][START_REF] Liu | A calculus for hybrid csp[END_REF][START_REF] Wang | An assume/guarantee based compositional calculus for hybrid csp[END_REF]. It makes an extensive use of the Duration Calculus [START_REF] Zhou Chaochen | A calculus of durations[END_REF] to record the execution history of HCSP process. The reasoning is a standard pre and post-conditions calculus. To reason about continuous evolution, the authors introduce differential invariant [START_REF] Platzer | Computing differential invariants of hybrid systems as fixedpoints[END_REF][START_REF] Sriram Sankaranarayanan | Constructing invariants for hybrid systems[END_REF]. They have extended their approach to take into account communication failures, or probability and stochastic behaviors [START_REF] Peng | Extending hybrid csp with probability and stochasticity[END_REF][START_REF] Wang | A compositional modelling and verification framework for stochastic hybrid systems[END_REF]. The calculus have been implemented in the theorem prover Isabelle [START_REF] Lawrence C Paulson | Isabelle: A generic theorem prover[END_REF] using both a shallow and deep embedding [START_REF] Wang | An improved hhl prover: an interactive theorem prover for hybrid systems[END_REF]. They make use of the SledgeHammer tool to automate consequent parts of the proof. They have used it to verify several industrial systems such as the Chinese Train Control System [START_REF] Liu | A calculus for hybrid csp[END_REF][START_REF] Wang | An assume/guarantee based compositional calculus for hybrid csp[END_REF] or the descent guidance control program of a lunar lander [START_REF] Zhao | Formal verification of a descent guidance control program of a lunar lander[END_REF].

A framework to link HCSP models to Simulink diagrams have been proposed Zou et al. [START_REF] Zou | Verifying simulink diagrams via a hybrid hoare logic prover[END_REF]. Simulink diagrams are prominent in the industry, and brings many benefits to validate systems by simulation, but they lack formal guarantees. Translating a Simulink model into an HCSP model allows to obtain them. They have extended it to take into account Stateflow diagrams [START_REF] Zou | Formal verification of simulink/stateflow diagrams[END_REF].

Yan, Zhan et al. show how to discretize continuous HCSP to discrete HCSP. From the discrete model, they generate executable code and prove that the generation does not alter the meaning of the program [START_REF] Yan | Approximate bisimulation and discretization of hybrid csp[END_REF][START_REF] Zou | Formal verification of simulink/stateflow diagrams[END_REF]. It leads to a toolcgain, MARS [START_REF] Chen | Mars: A toolchain for modelling, analysis and verification of hybrid systems[END_REF], within which it is possible to model a hybrid system with Simulink, translate it into an HCSP process, generates invariant and verify them using the implementation into Isabelle, and finally obtain executable SystemC code [START_REF] Yan | Synthesizing systemc code from delay hybrid csp[END_REF].

Extensions of synchronous languages

Zelus is an extension of Lustre with Ordinary Differential Equations [START_REF] Bourke | Zélus: A synchronous language with odes[END_REF]. It allows to model both continuous and discrete behaviors and stay compatible with synchronous programs.

Other approaches to verification of Cyber-Physical Systems

Other approaches have been proposed and are not the extension of a formalism with differential equation. They may be a new formalism as the δ-decidability. They may be also formalisms which have not been primarily intended for hybrid systems, but is expressive enough to be applied to, e.g. TLA or Coq. δ-decidability δ-decidability has been introduced by Sicun Gao, Jeremy Avigad and Edmond Clark in 2012 [START_REF] Gao | δ-complete decision procedures for satisfiability over the reals[END_REF][START_REF] Gao | Delta-decidability over the reals[END_REF]. It is a new decision procedure to decide the satisfiability of formulas of extensions of Real Arithmetic. Real Arithmetic is decidable, but extensions with trigonometric or exponential functions are undecidable. This undecidability holds for a precise and symbolic decision procedure. Most of the algorithms used for numerical computation are based on approximations and are precise only up to a certain error. The authors follow this idea to define a relaxed notion of correctness up to some error δ, hence the name of δ-decidability.

They define a procedure called the δ-decision problem. It either proves that the system is safe or states that it is unsafe under some perturbation which can be made arbitrarily small. It is implemented in the SMT solver dReal [START_REF] Gao | dreal: An smt solver for nonlinear theories over the reals[END_REF]. The procedure is fully automatic. It has been adapted for several extensions of the theory and provides a way to encode ODEs [START_REF] Gao | Satisfiability modulo odes[END_REF].

A system has to be modeled as one formula in the SMT solver dReal, and it is thus not compositional.

Linear Temporal Logic (LTL)

The Linear Temporal Logic (LTL) [START_REF] Pnueli | The temporal logic of programs[END_REF] is a modal logic devised to reason about temporal properties of a program. It allows to state properties such as "For every execution of the program, the property ϕ will hold" or "There is an execution of the program for which the property ϕ holds". A generic use is to design a system under the form of an automaton, and then to model-check a property expressed in LTL [START_REF] Edmund M Clarke | Another look at ltl model checking[END_REF][START_REF] Edmund M Clarke | Model checking[END_REF].

It is widely used to express properties of discrete fragment of hybrid systems. But it is not adapted to reason about complete hybrid systems which exhibit continuous behaviors since the properties of LTL are related to discrete executions of a program.

Temporal Logic of Actions (TLA and TLA+) Temporal Logic of Actions (TLA) is a formal specification language inspired by the Temporal Logic of A. Pnueli [START_REF] Pnueli | The temporal logic of programs[END_REF], and devised by L. Lamport in 1990 [START_REF] Lamport | The temporal logic of actions[END_REF]. The author intend to provide a mathematical setting to specify concurrent programs.

The extension TLA+ is designed to be more suitable for engineers by providing means to represent large formulas and systems [START_REF] Lamport | Specifying systems: the TLA+ language and tools for hardware and software engineers[END_REF]. Both formalisms feature a proof system to perform proofs. It has been used to specify hybrid systems in [START_REF] Ravn | Specifying and verifying requirements of real-time systems[END_REF], and a general approach to the verification of hybrid systems is proposed in [START_REF] Lamport | The temporal logic of actions[END_REF].

Modular proofs of hybrid systems in Coq

In [START_REF] Ricketts | Towards verification of hybrid systems in a foundational proof assistant[END_REF][START_REF] Ricketts | Modular deductive verification of sampled-data systems[END_REF], the authors follow the idea of modular proof of hybrid systems in the foundational proof assistant Coq. They have been able to verify the behavior of a drone.

Hybrid Algebras for hybrid systems Several attempts have been made toward the definition of a process algebra for hybrid systems. Brinksma and Krilavicius propose an extension of the classical processes algebra to hybrid processes [START_REF] Brinksma | Process algebraic approach to hybrid systems[END_REF][START_REF] Brinksma | Behavioural hybrid process calculus[END_REF], but their approach stays at the design level and does not provide any tool to prove properties. Peter Höfner presents algebraic approaches for several formalisms such as hybrid automata, CTL or Neighborhood Logic [START_REF] Höfner | Algebraic calculi for hybrid systems[END_REF]. R. Alur et al. have presented a theory of modular design and refinement from hierarchical state machines implemented in Charon [START_REF] Alur | Compositional modeling and refinement for hierarchical hybrid systems[END_REF], where verification of large systems would amount to non-modularly explore the state-space of its composed elements.

Abstract interpretation Abstract interpretation tackles the problem of verification of properties on a complex system by abstracting it [START_REF] Cousot | Abstract interpretation: a unified lattice model for static analysis of programs by construction or approximation of fixpoints[END_REF]. It aims to formalize the notion of approximation. The system is transferred into an abstract domain where it is easier to verify properties. The proof on the abstract domain transfers to the concrete domain. This approach has obtained some great successes [START_REF] Cousot | The astrée analyzer[END_REF]. Several specific abstract domains have been proposed for hybrid systems [START_REF] Alur | Discrete abstractions of hybrid systems[END_REF][START_REF] Halbwachs | Verification of linear hybrid systems by means of convex approximations[END_REF].

Contract-based design Contract-based design advocates the use of contracts to precisely define the inputs and outputs of a system. In the legal system, a contract formalizes the commitment of a supplier, an employee or a product, for example the supply of ten tons of steel per day to a car company by a smelting plant, the selling of five cars per day or the guarantee that the product will work perfectly fine for three years. It formalizes also the assumptions under which the output is guaranteed, for example, there is enough iron ore delivered to the smelting plant, that the employee is provided with a computer and a salary, or again that the product is used properly.

Contracts in systems are pairs of formulas pA, Gq which state the assumptions A under which the system operates, and its outputs satisfy the guarantees G. A and G are formulas of a logic defined according to the type of system under consideration. It is known also as pre and post-conditions and is used in several proof tools as [START_REF] Filliâtre | Why3-where programs meet provers[END_REF].

The meaning of a contract is intuitive to grasp and matches the current work-flow of engineers. It is natural to use it with a component-based approach. We associate to every component a contract representing the assumptions on its inputs and the guarantees on the outputs.

It has attracted a lot of attention in the field of embedded systems and hybrid systems because it is easily understandable by engineers and scalable. But a drawback is that it considers component as a black box, and just specifies the behaviors on inputs and outputs. To develop a system, we need to couple it with a modeling language to specify components, e.g. a Java program. To ensure that the properties defined in the contract are coherent and that the component satisfies them, we need a proof system. It can be a theorem prover as Coq [START_REF] Bertot | Interactive theorem proving and program development: Coq'Art: the calculus of inductive constructions[END_REF] or [START_REF] Lawrence C Paulson | Isabelle: A generic theorem prover[END_REF] or an SMT solver as [START_REF] De | Z3: An efficient smt solver[END_REF] or [START_REF] Gao | dreal: An smt solver for nonlinear theories over the reals[END_REF].

Benveniste et al. defined in 2012 a meta-theory of contracts to provide a unified framework for contract-based design [START_REF] Benveniste | Contracts for system design[END_REF]. It can be instantiated by different contract theories, e.g. A-G contracts or I{O contracts, and aims to ease the communication between separate teams of engineers.

Existing tools

This section is devoted to tools that have been developed to model and verify hybrid systems. There are general interactive theorem provers (Coq, Isabelle) or specific (KeYmaera, KeYmaera X). We present also model-checkers like HyTech, PHAVer or UPPAAL, and SMTsolvers like Z3 or dReal.

General theorem provers: Coq and Isabelle Coq and Isabelle [START_REF] Bertot | Interactive theorem proving and program development: Coq'Art: the calculus of inductive constructions[END_REF][START_REF] Coquand | The calculus of constructions[END_REF][START_REF] Lawrence C Paulson | Isabelle: A generic theorem prover[END_REF] are generic interactive proof assistants first released respectively in 1986 and 1989. Coq implements the Calculus of Inductive Functions. It is used for the formalization of mathematics and proof of mathematical theorems, but also to model and verify software. It provides interactive proof methods along with a tactic language. It has notably been used for the formalization of the proof of the four-color theorem [START_REF] Gonthier | A computer-checked proof of the four colour theorem[END_REF] and the verification of a C compiler [START_REF] Leroy | The compcert verified compiler. Documentation and user's manual[END_REF].

Isabelle is also an interactive theorem prover providing a meta-logic used to express mathematical formulas in a formal language. It features several proof tools and has been used for the proof of correctness of the seL4 microkernel [START_REF] Klein | sel4: Formal verification of an os kernel[END_REF].

KeYmaera KeYmaera is the first theorem prover to implement dL [START_REF] Platzer | Keymaera: A hybrid theorem prover for hybrid systems (system description)[END_REF]. As the Differential Dynamic Logic is an extension of Dynamic Logic, KeYmaera is an extension of the theorem prover KeY which implements Dynamic Logic. It is coupled with Mathematica [START_REF] Wolfram | The mathematica[END_REF] and Z3 [START_REF] De | Z3: An efficient smt solver[END_REF] to treat real arithmetic formulas.

It provides some automation, but is not designed toward this goal; most of the proofs require a manual effort. The kernel amounts to more than one hundred of thousand lines of codes and has not been verified. The proofs produced are not completely trustworthy.

KeYmaera has been completely redesigned into KeYmaera X.

KeYmaera X KeYmaera X is the successor of KeYmaera [START_REF] Fulton | Keymaerax: An axiomatic tactical theorem prover for hybrid systems[END_REF], but completely rewritten with clean foundations and automation in mind. It still uses Mathematica and Z3 as external solvers to discharge goals. The kernel numbers less than ten thousand lines of codes and has been formally verified in Coq and Isabelle [START_REF] Bohrer | Formally verified differential dynamic logic[END_REF]. A tactic mechanism, Bellerophon, has been added, which allows proof programming [START_REF] Fulton | Bellerophon: Tactical theorem proving for hybrid systems[END_REF].

dReal dReal is an SMT solver specialized in Real Arithmetic enriched with trigonometric functions or exponential functions [START_REF] Gao | dreal: An smt solver for nonlinear theories over the reals[END_REF]. It implements the mechanisms of δ-decidability. It has been used to verify hybrid systems that were outside of the scope of existing tools.

Z3 Z3 is a general SMT-solver developed by Microsoft [START_REF] De | Z3: An efficient smt solver[END_REF]. It is used as a back-end tool in KeYmaera and KeYmaera X to discharge real arithmetic formulas.

HyTech HyTech is a symbolic model checker for hybrid systems [START_REF] Thomas A Henzinger | Hytech: A model checker for hybrid systems[END_REF]. The systems are represented under the form of hybrid automata and safety or liveness properties are modelchecked against it. It has been used to verify multiple case studies such as the generic railroad crossing [START_REF] Heitmeyer | A benchmark for comparing different approaches for specifying and verifying real-time systems[END_REF][START_REF] Thomas A Henzinger | Hytech: the next generation[END_REF].

PHAVer PHAVer is another model checker for hybrid systems [START_REF] Frehse | Phaver: Algorithmic verification of hybrid systems past hytech[END_REF]. It uses the same core algorithm as HyTech, but adds several features to treat systems that were outside the capabilities of HyTech. It has been used to verify the navigation benchmark [START_REF] Fehnker | Benchmarks for hybrid systems verification[END_REF] or the bouncing ball system.

UPPAAL UPPAAL is a tool designed for the verification of real-time systems, but also modeling and simulation [START_REF] Kim G Larsen | Uppaal in a nutshell[END_REF]. The systems are modeled as a network of timed automata. It has been used to verify multiple use-cases such as a collision-avoidance protocol [START_REF] Aceto | Model checking via reachability testing for timed automata[END_REF][START_REF] Jensen | Modelling and analysis of a collision avoidance protocol using spin and uppaal[END_REF].

Conclusion

The formalisms in Section 1.2.2 and 1.2.3 have all proposed methods to model hybrid systems and means to verify some properties on them. Several ideas have been implemented and tested on various kinds of problems, allowing to evaluate their power. We have presented different verification and modeling tools in Section 1.2.4. To our understanding, there are two kinds of complexity that researchers have tried to tackle, mathematical and systemic. The mathematical complexity is about the kind of systems that are considered. Some formalisms are restricted to the linear differential equations and other handle larger classes of ODEs. The properties may be expressed only in Real Arithmetic, or others use trigonometric or exponential functions. From this point of view, dL and the δ-decidability approach provide great advances.

The systemic complexity refers to systems that do not possess theoretical mathematical difficulties, but where the size, often through repetition of similar components, is the main difficulty to handle. This problem is not restricted to hybrid systems and is encountered in diverse domains. For example, a factory is often a system with numerous captors, monitors, and actuators, each one being very simple to understand and handle, but the overall behavior is difficult to apprehend.

Two methods have emerged as an efficient way to tame systemic complexity: refinement and component-based approach. The former consists of starting with a simple system, easy to understand and verify. It is upgraded progressively, refined, until obtaining the desired system. Each upgrade is kept simple allowing to handle the growing complexity. This approach obtained successful results and the B method is its most famous representative. The latter tames the complexity by breaking a system into pieces, the so-called components, which are simple enough to be handled separately. It is a popular approach in computer science or engineering.

Contributions

Modular component-based approach in Differential Dynamic Logic We have defined a modular component-based approach to model and prove correctness of cyber-physical systems in Differential Dynamic Logic (dL). The modeling and the proof are carried together following correct-by-design principles.

We have defined a notion of component in dL which is able to model a wide variety of hybrid systems. We have defined a parallel composition operator to build a system from its parts and illustrated it with a cruise-controller example.

We have proved that the operator is commutative, which means that the order of composition is not important, and associative, which means that we can compose in a modular way. It allows to model a system by considering each component separately rather than in a monolithic way. To our knowledge, it is the first syntactic parallel composition operator in dL which is commutative and associative. Previous attempts do not yield associativity, and therefore modularity.

We have associated to every component a contract which specifies its assumptions and guarantees. The user is required to prove that the components satisfies its contract using the sequent calculus of dL.

We have demonstrated a composition theorem which ensures that we retain contracts through parallel composition; if two components satisfy their respective contract, then the component resulting from their parallel composition satisfies the conjunction of contracts. It allows to carry the proof of correctness of components during the construction of the system, reducing the proof effort to smaller systems, more likely to be tractable. Instead of proving the correctness of the complete system as in the monolithic approach, we have to prove the correctness of each part.

The proof that we retain contracts from composition is constructive; given the proof of satisfaction of respective contracts, we have showed how to obtain a proof of satisfaction of the conjunction of contracts. We have implemented this process as a prototype in KeYmaera X to show the feasibility of an automation of our process. We have studied a water-plant use-case to identify improvement points, leading us to new developments.

Extension of our modular component-based approach

We have adapted our parallel composition operator to modularly model Computer-Controlled Systems (CCS). They are systems where a continuous part, the plant, is regulated by a program, the controller, and regroups most of industrial systems. A key aspect of such system is the timing aspect; the controller must executes sufficiently often to ensure a correct functioning. But our parallel composition operator does not provide insights on the timing aspects.

We have presented how to systematically take into account timing aspects: the control period of the plant and the execution period of the controller. We have identified a framework to apply our parallel composition operator and demonstrated that we retain contracts through composition, all illustrated with a water-tank example.

We have extended the timing approach to handle systems where several plant and monitors are running in parallel. We keep track of the control period and execution period through composition to ensure it does not result in flawed systems. We have demonstrated that we still retain contract and illustrated how it applies to the water-plant example.

We have identified a framework to soundly and modularly represent modes in a cyberphysical systems via an composition operator adapted from the parallel composition operator. As previously, we can associate contracts and retain them through composition.

We have defined a causal composition operator to model the ordering of two components, e.g. a sensor before a monitor. It is an adaptation of the parallel composition operator and is thus compatible with it. We have showed that it is associative, hence modular, and that we retain contracts through composition.

Chapter 2

Introduction to Differential Dynamic Logic

Differential Dynamic Logic (dL) is an extension of the Dynamic Logic, DL, of V. Pratt [START_REF] Harel | Dynamic logic[END_REF][START_REF] Vaughan R Pratt | Dynamic logic[END_REF] obtained by the addition of Ordinary Differential Equations (ODEs). DL is a modal logic developed to model and verify imperative programs, in particular Java programs [START_REF] Ahrendt | The key platform for verification and analysis of java programs[END_REF]. dL extends it in both aspects; it allows the modeling of ODEs and interactions with regular programs, and it provides verification methods for hybrid systems.

dL has been proposed to model and verify hybrid systems. The dominant approach in the previous decade was the modeling of a hybrid system as a hybrid automaton and the model-checking of various properties. dL adopts a deductive approach to the problem of verification. It is designed to be a general framework for hybrid systems.

Hybrid systems are represented by so-called hybrid programs which can be discrete or continuous. Every system that can be represented under the form of a hybrid automaton can be represented by a hybrid program [START_REF] Platzer | Differential dynamic logic for verifying parametric hybrid systems[END_REF]. It allows the modeling of a wide variety of use-cases. We can model the speed of a car or its position relatively to a fixed point, essential for autonomous vehicles. We can also model the water-level of a tank in a water-treatment plant along with their control systems. An important aspect is the possibility to represent and reason on real time instead of a discretized version.

The properties are formulas of the First-Order Real Arithmetic augmented with the modality r.s. It allows to reason on the executions of a hybrid program. For example, we can express that at every point of time, the speed of a car stays in a safe range.

The verification of properties is achieved by a specific sequent calculus. It has been demonstrated sound and is implemented in the theorem prover KeYmaera X [START_REF] Fulton | Keymaerax: An axiomatic tactical theorem prover for hybrid systems[END_REF]. It features specific rules to reason on instructions of the language.

We present in Section 2.1 how to model hybrid systems with the help of hybrid programs. We show in Section 2.2 how to associate properties to hybrid systems, notably safety and liveness properties. The Section 2.3 is devoted to the presentation of the sequent calculus and its rules to prove properties on hybrid programs. We present theoretical results on dL in Section 2.4.

Modeling of Cyber-Physical Systems

Hybrid systems exhibit both discrete and continuous behaviors. This duality is expressed in dL by the modeling of ODEs and programs. We present in Subsection 2.1.1 how we model programs and in Subsection 2.1.2 how we represent differential equations. The Subsection 2.1.3 is devoted to examples of hybrid systems modeled in dL.

Discrete behaviors or programs

In this section, we define the syntax and the semantics of discrete programs. We illustrate the semantics with graphical examples and show how to implement the Fibonacci sequence and a car-controller example.

Programs are usual computer programs. They are defined from a small language which is Turing-complete; every program written in C or Java can be expressed in dL. It is easier to reason on a small language, and the lack of usability can be overcome by definition of macros. This small language is the same as in Dynamic Logic (DL) [108] [61].

Definition 1 (Syntax of discrete programs). α, β ::"

x :" θ |?ϕ | α; β | α Y β | α
where ϕ is a formula (Def. 6) and θ is a real arithmetic term (Def. 5).

x :" θ is the assignment of term θ to the variable x. ?ϕ tests if the formula ϕ is true. The operator ; denotes the sequence between two hybrid programs and Y is the non-deterministic choice between two hybrid programs. α ˚is the iteration of α an arbitrary finite number of times, possibly zero.

The semantics is a possible world Kripke semantics where worlds represent the possible system states and the accessibility relation between worlds is reachability by hybrid transitions. The states are tuples of variables to which are assigned real values. The value of a variable x in a state ω is denoted by vxw ω and of a term θ in a state ω is denoted by vθw ω .

The semantic of programs is given by the reachability relation ρ ν pαq. It denotes the set of states ω reachable by the program α starting from the state ν.

Definition 2 (Reachability semantic of discrete programs).

ρ ν px :" θq " tω | ω " ν except that vxw ω " vθw ν u ρ ν p?ϕq " tν | ν |ù ϕu ρ ν pα; βq " Ť ωPρν pαq ρ ω pβq ρ ν pα Y βq " ρ ν pαq Y ρ ν pβq ρ ν pα ˚q " Ť
nPN ρpα n q with α 0 "?J and α n`1 " α n ; α where ν |ù ϕ means that the state ν satisfies the formula ϕ.

We provide graphical examples of the reachability of each construct. The reachability set of the assignment from the state ν is all the states ω which are the same as ν, but for the value of x. For example, in the Figure 2.1, the value of x in the sate ω is now 42, but the value of y is unchanged.

The reachability set from the state ν of the test is the set formed of only the state ν, but which satisfies the formula ϕ. The values of the state are unchanged (cf Figure 2 x " 4 y " 3 . . .

x :" 42 Y y :" y `1

x :" 42 y :" y `1

Figure 2.4: Non-deterministic choice

A state ω is reachable from the state ν by α ˚if it is reachable by the program α n which is n consecutive executions of α. For example, ν 2 is reachable by y :" y `1 and ν 3 by y :" y `1; y :" y `1. They are both reachable states of py :" y `1q We can define the program that computes the Fibonacci sequence.

˚. v 1 x " 4 y " 2 . . . v 2 x " 4 y " 3 . . .
Example 1 (Fibonacci sequence).

Fibonacci fi pF n :" F n`1 ; F n`1 :" F n`2 ; F n`2 :" F n`1 `Fn q

We assume that the formulas F n " 0, F n`1 " 1 and F n`2 " 1 hold at the initialization.

We can also encode a simple speed-controller for a car.

Example 2 (Controller for a car).

`p?accel; a :" Aq Y a :" ´b˘I f the condition accel is true, the car may accelerate by A, but it can always brake by ´b.

Encoding of usual programming structure We retrieve the while and if-then-else structure with the following encoding. The interested reader can find more encoding in [61, p. 167].

if ϕ then α else β " p?ϕ; αq Y p?�ϕ; βq while ϕ do α " p?ϕ; αq ˚; ?�ϕ

Ordinary Differential Equations

In this section, we present the syntax and the semantic of Ordinary Differential Equations (ODEs) in dL. We illustrate it with several examples. The modeling of physical phenomena is mostly made by the use of differential equations since the foundational work of Leibniz and Newton. The idea is to consider any infinitesimal change in an equation to represent continuous motion. In mathematics, the change is made with respect to an arbitrary variable, but in physics, we are mostly interested by the change with respect to time. We adopt the convention that the variation of a quantity, represented by x, over the time is denoted by 9

x.

Definition 3 (Syntax of differential equation).

9 X " Θ X & H
where H is a formula of dL.

X is vector of variables px 1 , . . . , x n q and Θ X a vector pΘ 1 , . . . , Θ n q of terms of real arithmetic. The symbol & stands for a separator between the differential equation and the evolution domain H. It characterizes the domain in which it can evolve; if the formula H is not true, then the evolution is not considered. For example, the evolution domain of time, represented by the variable t, is t ě 0 since it does not make sense to consider negative time by convention.

We assume that every differential equation has a solution which is unique. We define accordingly the semantic using this solution. We define the reachability for a differential equation with only one variable, but it is easily generalized for a vector of variables. Definition 4 (Reachability semantics of differential equation). ρ ν p 9

x " θ x & Hq " tf prq | there is a function f : r0, rs Ñ S such that f ptq |ù 9

x " θ and f ptq |ù H for every t P r0, rsu S is the set of states. f ptq has to be understood as a solution of the differential equation. The reachable states are every point to which the dynamic system can evolve providing that the evolution domain still holds.

For example, in the Figure 2.6, ω is a reachable state where the value of x is f p2q, but the value of y stays unchanged. Another reachable state is the one where the value of x is f p2.1q and the value of y is unchanged. The behavior of an ODE can be understood as an assignment iterated, except that the iteration step is infinitesimal. t " 1 & t ě 0 t represents the time, and it evolves linearly. We consider also the time to be always positive by convention.

ν x " f p1q " 1 y " 2 . . . ω x " f p2q " 4 y " 2 . . . 9 x " 2t & t ě 0 t x v w ' 0 ' r f ptq H x
We are able to model more complex systems such as the speed of a car or the water-level in a tank or in several tanks.

Example 4 (Speed of a car). 9

x " v, 9 v " a & v ě 0 where x is the position of the car, v the velocity (speed) of the car and a the acceleration of the car.

It is a system of differential equations and we add in the evolution domain v ě 0 because a speed is always considered positive.

Example 5 (Water-Tank). 9 wl " f in ´f out & wl ě 0 where wl is the water-level, f in is the inlet flow and f out is the outlet flow. We assume that the water-level is always positive, i.e. that it is not below the bottom of tank.

Example 6 (Water-Plant). We can represent the water-level of a network of connected watertanks. For example, if the inlet flow of the second water-tank is the outlet flow of the first water-tank and similarly for the second and third water-tank.

$ & % wl 1 " f in 1 ´f out 1 wl 2 " f out 1 ´f out 2 & wl 1 ě 0 ^wl 2 ě 0 ^wl 3 ě 0 wl 1 " f out 2 ´f out 3
We can model continuous systems and discrete systems, but the very interest of hybrid systems is the interaction of the two. The next section is devoted to several examples of such interactions.

Blending discrete and continuous aspects

We present in this subsection several examples of standard hybrid systems. We present the bouncing-ball example where the discrete interaction is not provoked by humans, and the class of computer-controlled systems which are designed by humans. The bouncing-ball example is a popular and simple hybrid system where the discrete interaction does not come from a controller.

Example 7 (Bouncing ball). It models the velocity v and height h of a falling ball. The discrete interaction comes from the bouncing on the floor. The ball falls until it touches the floor (h " 0), then it bounces back. The velocity of the bouncing back is function of the falling velocity moderated by a damping factor c accounting for loss of kinetic energy.

p 9 h " v, 9
v " ´g & h ě 0; ?h " 0; v :" ´cvq g is the value of gravity. The differential equation evolves until the height h equals 0. Then, we can pass the test ?h " 0 and we assign the value ´cv to the velocity which accounts for the bouncing. The iteration constructs allows to consider an arbitrary large number of such sequences.

Modeling Computer-Controlled System Computer-Controlled systems are frequently encountered and regroup systems where a continuous behavior, so-called plant, is monitored by a controller, in this case a computer with sensors and actuators. The controller is triggered by a timing condition. It executes at least every ∆ units of time.

Example 8 (Time triggered). ppp?accel; a :" Aq Y a :" ´bq; t Ctrl :" t;

(Control)

9 x " v, 9 v " a, 9 t " 1 & v ě 0 ^t ě 0 ^t ´tCtrl ď ∆q ˚(Plant)
We are now able to model hybrid systems in dL, the next step is to express properties that such systems should satisfy, for example that the water-level of the tank is within some interval.

Expressing Properties in dL

First Order Real Arithmetic is a first-order logic with terms of Real Arithmetic. It allows to represent polynomial terms, but not trigonometric or exponential terms. We present it in Subsection 2.2.1. Formulas in dL are First Order Real Arithmetic formulas augmented with the modality r.s. rαsϕ means that the formula ϕ holds for every executions of the hybrid program α. We detail it in Subsection 2.2.2.

First-order Real Arithmetic

We define the syntax of terms of Real Arithmetic and their semantic. We define also the syntax of formulas of First-Order Real Arithmetic and their semantic. We present examples of properties that we can express and state the surprising result of Tarski about the decidability of the First Order Real Arithmetic.

Definition 5 (Terms of Real Arithmetic).

θ 1 , θ 2 ::" x | 0 | 1 | θ 1 `θ2 | θ 1 ´θ2 | θ 1 ˆθ2 | θ 1 ˜θ2
The variables x are valuated in R. We have the usual semantic for the operators `, ´, ˆ, ˜. It allows polynomials, e.g. x `x2 `x3 , but does not allow more complex expressions like logarithms, exponential or trigonometric functions. The valuation of a term θ at a state ν is denoted by vθw ν .

We define the formulas of Real Arithmetic by adding comparison operators between terms, ă, ď, ", ě, ą, and logical connectives.

Definition 6 (Formulas of First-Order Real Arithmetic). ϕ, ψ ::"

θ 1 " θ 2 | �ϕ | ϕ ^ψ | ϕ _ ψ | ϕ Ñ ψ | @xϕ | Dxϕ | K
where " P tă, ď, ", ě, ąu

We define the semantic only for the connectives ", K, ^, Ñ and @. The others can be deduced from it.

Definition 7 (Semantic of formulas). The satisfiability of formulas is provided for any state ν:

ν |ù θ 1 " θ 2 ô vθ 1 w ν " vθ 2 w ν , " P tă, ď, ", ě, ąu ν |ù ϕ ^ψ ô ν |ù ϕ and ν |ù ψ ν |ù ϕ Ñ ψ ô if ν |ù ϕ then ν |ù ψ ν |ù @x ϕ ô @ω such that @z, z ‰ x ñ vzw ω " vzw ν we have ω |ù ϕ ν * K

We can express that a quantity x is within an interval x P r´42, 42s as ´42 ď x ^x ď 42.

Example 9 (Water-level property). We require that the water-level wl in the water-tank stays between 3 and 7 : wl ě 3 ^wl ď 7. It means that there is always a sufficient outlet flow, and that it does not overflow.

Tarski Algebra Surprisingly, contrary to the First-Order Natural Arithmetic, the First-Order Real Arithmetic is decidable, it is the so-called Tarski's Miracle [START_REF] Tarski | A decision method for elementary algebra and geometry[END_REF]. The reason comes from the sign conservation between two zeros of a polynomial in R, which is not the case for the natural arithmetic.

Theorem (Tarski's Miracle). The First-Order Real Arithmetic is decidable, with a complexity doubly exponential in time.

Despite of the decidability result, it is still complex to prove formulas of Real Arithmetic. Much progress have been made these last decades with efficient SMT solvers like Z3 [START_REF] De | Z3: An efficient smt solver[END_REF].

We want to ultimately prove that a system satisfies a property for all its executions, i.e. that it is an invariant. For example, we want that the water-level wl stays always between 3 and 7. We need modality to express such statement.

A modal logic

We present in this section the syntax and the semantic of the modal operator r.s. It allows to express safety properties of a system. We show how to encode the notion of contract. We present also the modal operator x.y to express liveness properties.

Modal operator r.s We add to the definition of formula of the Real Arithmetic the modality rαsϕ which means that "for every reachable state by α, the formula ϕ is true". Definition 8 (Formulas of dL).

ϕ, ψ ::" rαsϕ | θ 1 " θ 2 | �ϕ | ϕ ^ψ | ϕ _ ψ | ϕ Ñ ψ | @xϕ | Dxϕ | K
where " P tă, ď, ", ě, ąu where α is a hybrid program (Def. 1 and Def. 3). We retrieve the Real Arithmetic formulas defined in Def. 6.

The semantic is defined as follows.

Definition 9 (Semantic).

ν |ù rαsϕ ô @ω P ρ ν pαq, ω |ù ϕ

The modality r.s articulates the behavior of hybrid programs and formulas of Real Arithmetic.

Example 10. The formula r 9

t " 1, 9

d " e, 9 e " ´d & t ě 0sd 2 `e2 ď r 2 means that the property d 2 `e2 ď r 2 is always true for any execution of 9

t " 1, 9

d " e, 9 e " ´d.

Example 11 (Satisfaction of the water-level property). The formula rW ater ´tanks3 ď wl ď 7 means that the water-tank system satisfies the water-level property.

Remark 1. In rαsϕ, the formula ϕ is required to hold only at the end state of the execution. For example, the formula rx :" ´1; x :" 42sx ě 0 is valid although x is negative in the middle of the execution. An extension of dL with temporal constructs has been proposed to take into account the intermediary states [START_REF] Platzer | A temporal dynamic logic for verifying hybrid system invariants[END_REF]. However, most of systems of interest are modeled as a iterated hybrid program α ‹ . The semantic of the iteration implies that ϕ will be required to hold at every possible executions of α, including the initial state since it is allowed to have zero iteration.

Assume-Guarantee reasoning The Assume-Guarantee reasoning is widely used to express properties under which a system works and the properties guaranteed. It consists in the specification of formulas which hold for the inputs, the assumptions, and for the outputs, the guarantees. A contract is the 2-tuple of assumptions and guarantees.

pF n " 0 ^Fn`1 " 1 ^Fn`2 " 1q Ñ rFibonaccisF n`2 " F n`1 `Fn
Liveness properties The modality r.s allows to express safety properties, i.e. true for every execution of the system under consideration. We may be interested by liveness properties, i.e. properties which have to hold for at least one execution of the system under consideration. The notion of liveness in dL differs from the one in LTL or CTL. In the former, it is "there is one execution of the system for which the desired property holds", but for the latter, it is that "for every execution of a system, there is a possible execution which leads to a state where the property is true". The liveness modality x.y is the dual of the safety modality. 2). We have also shown how to associate properties to hybrid programs. In order to verify that a hybrid program satisfies its properties, we need a proof system. The next section is devoted to the presentation of the rules of the sequent calculus of dL.

Proving properties in dL

This section is devoted to the detailed presentation of the proof system of dL. We present briefly the general characteristics and definitions of sequent calculus in Subsection 2.3.1. In Subsection 2.3.2, we present proof rules to prove First-Order Real Arithmetic formulas. We present structural rules in Subsection 2.3.3. Theses rules are used to clarify proofs. In Subsection 2.3.4, we present specific rules to reason on the execution of hybrid programs.

Generalities on sequent calculus

We present in this section generalities on sequent calculus along with the definition of a sequent and how to read proof rules. We also state the definition of soundness and completeness for a proof system. A sequent calculus is a deductive proof calculus which relies on proof rules. It is widely used to perform and represent proofs. Sequent calculus exhibits interesting aspects such as the fact that it is a syntactic approach and thus amenable to automation. It is also easy to implement proof strategies to augment its usability. Lastly, it is easily extendable to take into account other theories. Several theorem provers use sequents to represent proof reasoning, for example Coq [START_REF] Coquand | The calculus of constructions[END_REF], B-method [START_REF] Abrial | The B-book: assigning programs to meanings[END_REF], KeY [START_REF] Ahrendt | The key platform for verification and analysis of java programs[END_REF].

It is characterized by the use of sequents Γ $ ∆ where Γ (resp. ∆) is a finite set of formulas γ 1 , . . . , γ n (resp. δ 1 , . . . , δ m ). The meaning is "the conjunction of formulas in Γ implies the disjunction of formulas in ∆" and is thus equivalent to the formula

Ź 1ďiďn γ i Ñ Ž 1ďjďm δ j . Premise 1 . . .

Premise n Conclusion

Given a sequent, we can derive a proof tree by the use of proof rules. It is composed of n sequents above the bar, called premises, and one sequent under the bar, called the conclusion. The semantic is "If the premises are valid, the conclusion is valid".

The set of proof rules is the sequent calculus. An important property is the soundness of rules, i.e. that if the premises of a proof rule are valid, then the conclusion is valid.

Definition 13 (Soundness). A sequent calculus is sound if all its proof rules are sound. Equivalently, for any formula ϕ, if we have a derivation (denoted by $ ϕ), then the formula is valid (denoted by |ù ϕ).

It means that every formula proved with a sound sequent calculus is semantically valid. It links a syntactical and mechanical procedure with a semantic meaning. The converse is the completeness property. Every valid formula can be proved within the sequent calculus.

Definition 14 (Completeness).

A sequent calculus is complete if for any valid formula ϕ, i.e. |ù ϕ, we have a derivation, i.e. $ ϕ.

A sequent calculus for a logical theory which exhibits both properties implies that the theory is decidable.

First Order Real Arithmetic

We present the rules to handle First-Order Real Arithmetic formulas. We define closing rules which are leaves of a proof tree, then propositional rules which are for logical connectives �, Ñ, ^and _. We present quantifier rules for quantified formulas.

Closing rules Closing rules are rules which do not have any premises. They are used to close the proof tree, i.e. they are leaves. We present them in the Figure 2.7. The axiom rule ax means that "If ϕ is known and we try to prove ϕ, then the proof is valid". The rule K is the ex falso quod libet reasoning; if we have false in the hypothesis, we can derive every formula, and thus our current goal. The rule J is the inverse. We try to prove that the goal J is true, which is the case by definition.

K Γ, K $ ∆ J Γ $ J, ∆ ax Γ, ϕ $ ϕ, ∆ Real Arithmetic QE Γ $ θ 1 " θ 2 , ∆
The rule QE is slightly different. It is the rule to handle the validity of terms of real arithmetic. They are are premises, but we do not consider them because we assume that there is an external procedure to handle them. In KeYmaera X, it is achieved by Z3. The name QE stands for Quantifier Elimination. A first-order theory admits quantifier elimination if for each formula ϕ, a quantifier-free formula qelimpϕq can be effectively associated that is equivalent, i.e. ϕ ÐÑ qelimpϕq and has no other free variables. Real Arithmetic enjoys such property.

Propositional rules Propositional rules are for the logical connectives Ñ, �, ^and _. They are presented in the figures 2.8, 2.9, 2.10 and 2.11.

Γ, ϕ $ ψ, ∆ Ñ r Γ $ ϕ Ñ ψ, ∆ Γ $ ϕ, ∆ Γ, ψ $ ∆ Ñ l Γ, ϕ Ñ ψ $ ∆ Figure 2.8: Rules Ñ r and Ñ l
The rule Ñ r transcripts the semantic of a sequent. To prove the goal ϕ Ñ ψ is the same as assuming ϕ and trying to prove the goal ψ. We have a dual rule for the case where the formula is in the hypothesis, i.e. on the left of a sequent. It splits in two premises. The left premise asks to prove ϕ and the right premise assumes ψ; to be able to use ψ as an hypothesis, we have to prove that ϕ is true.

Γ, ϕ $ ∆ � r Γ $ �ϕ, ∆ Γ $ ϕ, ∆ � l Γ, �ϕ $ ∆ Figure 2.9: Rules � r and � l
The rule � l means "To prove ∆ knowing Γ and �ϕ, either Γ is sufficient or ϕ is true, thus �ϕ is false". We have the dual rule � r . We can derive them from the rules K and Ñ l :

Γ $ ϕ, ∆ � l Γ, �ϕ $ ∆ can be derived from Γ $ ϕ, ∆ K Γ, K $ ∆ Ñ l Γ, ϕ Ñ K $ ∆
The notion of derived rule is very important. It can be understood as "macros" for proof and it leads to proof programming [START_REF] Fulton | Bellerophon: Tactical theorem proving for hybrid systems[END_REF]. It is one of the strengths of sequent calculus, and it is necessary to scale to complex systems.

Γ $ ϕ, ∆ Γ $ ψ, ∆ ^r Γ $ ϕ ^ψ, ∆ Γ, ϕ, ψ $ ∆ ^l Γ, ϕ ^ψ $ ∆ Figure 2.

10: Rules ^r and ^l

The rule ^r has two premises; to prove the goal ϕ ^ψ, we have to prove the ϕ and ψ separately. The dual rule ^l transcripts the semantic of a sequent. The set of formulas on the left of $ are interpreted as a conjunction. Rules _ r and _ l are dual, and can be derived from ^r and ^l since we have ϕ _ ψ Ø �p�ϕ ^�ψq.

Γ $ ϕ, ψ, ∆ _ r Γ $ ϕ _ ψ, ∆ Γ, ϕ $ ∆ Γ, ψ $ ∆ _ l Γ, ϕ _ ψ $ ∆
Quantifier rules Quantifier rules handle formulas with a quantifier on topmost position.

Γ $ ϕpx{x 0 q, ∆ @ r Γ $ @xϕpxq, ∆ Γ, ϕpx{θq $ ∆ @ l Γ, @xϕpxq $ ∆
where x 0 is a fresh variable and θ is a chosen term of Real Arithmetic Figure 2.12: Rules @ r and @ l

The notation ϕpx{x 0 q means "the formula ϕ in which every occurrence of the variable x has been replaced by the variable x 0 ". It is a substitution. The interested reader can find more information in [94, p.65].

In the rule @ r , we replace every occurrences of x by a fresh variable x 0 . In mathematics, to prove a universal property, we chose to reason with a parameter which has no connections with the rest of the formula. It is similar to the α-renaming in the λ-calculus. For the rule @ l , we replace x with a chosen term of real arithmetic. If we assume a universal property, we can instantiate it to use in a proof.

The existential quantifier rules are dual of the universal quantifier rules. They can be derived also from the equivalence Dxϕpxq Ø �p@x, �ϕpxqq.

Γ $ ϕpx{θq, ∆ D r Γ $ Dxϕpxq, ∆ Γ, ϕpx{x 0 q $ ∆ D l Γ, Dxϕpxq $ ∆
where x 0 is a fresh variable and θ is a chosen term of Real Arithmetic

Invertible rules

The rule @ l is different from the previous rules; the proof engineer has to choose a term of real arithmetic. It is possible that the conclusion is provable, but that the premise is not. The proof tree 2.14 shows such possibility, where the instantiation of x has been made with a wrong variable z instead of choosing the variable y as in the proof tree 2.15. A rule is invertible if the conclusion is provable if and only if the premises are provable.

z 2 ě 0 $ y ě 0 @ l @x.x 2 ě 0 $ y ě 0
y 2 ě 0 $ y ě 0 @ l @x.x 2 ě 0 $ y ě 0 Figure 2.15: Right choice of variable in rule @ l
Invertible rules play an important role into the automation of proof. They can be applied safely since they do not change the provability of the considered formula, and a possible heuristic is to favor their use. The propositional rules and the rule @ r are invertible, but the rule @ l is not. The rules presented in the following subsection are not invertible.

Theorem (Soundness theorem). The rules presented in figures 2.7 to 2.13 are sound.

Proof. We detail the case of the rule ^r. The others can be found in [98, p. 97]. We reason by induction on the structure of the formula. To prove that ^r is sound, we assume that each premise is valid. We prove then that the conclusion is valid.

Assume that |ù ϕ _ ∆ and |ù ψ _ ∆. We want to prove |ù pϕ ^ψq _ ∆. We obtain it by application of the definition of the semantic of ^(def. 7).

Conclusion

The rules presented in figures 2.7 to 2.13 are sufficient to prove validity of First-Order Real Arithmetic formulas. For example, we can prove the validity of the formula `pp Ñ qq^pr Ñ sq^pp_rq ˘Ñ pq_sq (cf proof tree 2.16) or of the formula x " 3 Ñ @x, x 2 ě 0 (cf proof tree 2.17). ax r Ñ s, p $ p, q, s ax r Ñ s, q $ q, s Ñ l p Ñ q, r Ñ s, p $ q, s Similar to left branch p Ñ q, r Ñ s, r $ q, s _ l p Ñ q, r Ñ s, p _ r $ q, s _ r p Ñ q, r Ñ s, p _ r $ pq _ sq ^l p Ñ q, pr Ñ sq ^pp _ rq $ pq _ sq ^l pp Ñ qq ^pr Ñ sq ^pp _ rq $ pq _ sq Ñ r $ `pp Ñ qq ^pr Ñ sq ^pp _ rq ˘Ñ pq _ sq For the proof of `pp Ñ qq ^pr Ñ sq ^pp _ rq ˘Ñ pq _ sq, we apply mechanically the proof rules and there is no need for a human intervention. This proof may be perform automatically.

Real Arithmetic QE x " 3 $ x 2 0 ě 0 @ r x " 3 $ @x.x 2 ě 0 Ñ r $ x " 3 Ñ @x.x 2 ě 0 Figure 2
.17: Proof tree of the formula x " 3 Ñ @x.x 2 ě 0 For the proof of x " 3 Ñ @x.x 2 ě 0, we apply the logical rule Ñ r and @ r to obtain a Real Arithmetic term x 2 0 ě 0 to prove. It is a well-known result that the square of a value is always positive. It is thus closed by the rule QE.

Structural rules

We present in this subsection structural rules weakening and cut. they do not change the power of the proof system; a provable formula is still provable without theses rules. But they are important to structure a proof, hence for the scalability of proof of complex systems. We present how we can derive the modus ponens rule with the cut rule.

Weakening rules In the left branch of the proof tree 2.16, the formulas r Ñ s in the hypothesis and s in the goal are not used in the proof, and diminish the readability of a proof. We introduce the weakening rules to handle this problem. The rule W l allows to discard a formula in hypothesis. It is not invertible. The sequent in the conclusion can be valid, but the resulting sequent in the premise may not be. Nevertheless, the rule is still sound since, if we are able to prove a goal with a set of hypothesis Γ, we are able to prove it with one additional hypothesis. The rule W r is the dual.

Γ $ ∆ W r Γ $ ϕ, ∆ Γ $ ∆ W l Γ, ϕ $ ∆
Weakening rules are intended to improve readability, but are also precious allies in the conduction of proof in an interactive theorem prover. By discarding useless formulas, we narrow the proof search and help the computer to automatically prove a goal.

Cut rule

The Cut rule allows to introduce new formulas in a proof to strengthen hypotheses. It is the transcript of the use of lemmas in a standard mathematical proof.

Γ, ϕ $ ∆ Γ $ ϕ, ∆ Cut Γ $ ∆ Figure 2.

19: Cut rule

Examples Let us assume that we want to prove the validity of the formula x ě 0 Ñ x`y 2 ě 0, and we already have a proof Π of the formula @x, x 2 ě 0 (cf proof tree 2.17). We cut this formula in the proof tree to achieve our proof tree 2.20.

It is a very important rule for the structuring of proofs. It allows to focus on one part of the problem. The rule Cut is also very useful to define derived rules.

The modus ponens rule By using the Cut rule, we can define a specific proof rule for the Modus Ponens (MP) reasoning (cf Fig. 2

.21).

If we know ϕ Ñ ψ and ϕ, then we can deduce ψ. The proof rule derives from the proof tree 2.22. We have covered the proof rules for the standard logical connectives. The next step is to consider proof rules to reason about hybrid programs.

QE y 2 ě 0, x ě 0 $ x `y2 ě 0 @ l @x.x 2 , x ě 0 $ x `y2 ě 0 Π $ @x.x 2 ě 0 W l , W r x ě 0 $ @x.x 2 ě 0, x `y2 ě 0 Cut x ě 0 $ x `y2 ě 0 Ñ r $ x ě 0 Ñ x `y2 ě 0 Figure 2.20: Proof tree of x ě 0 Ñ x `y2 ě 0 Γ $ ϕ Ñ ψ, ∆ Γ $ ϕ, ∆ MP Γ $ ψ, ∆ Figure 2.21: Modus Ponens rule. ax Γ, ϕ $ ϕ, ψ, ∆ ax Γ, ψ $ ψ, ∆ Γ, ϕ Ñ ψ, ϕ $ ψ, ∆ Γ $ ϕ Ñ ψ, ∆ W l Γ, ϕ $ ϕ Ñ ψ, ∆ W r Γ, ϕ $ ϕ Ñ ψ, ψ, ∆ Cut Γ, ϕ $ ψ, ∆ Γ $ ϕ, ∆ W r Γ $ ϕ, ψ, ∆ Cut Γ $ ψ, ∆

Hybrid program rules

This subsection regroups the rules used to reason on runs of a hybrid program. We recall that rαsϕ means that "the formula ϕ holds for every run of the hybrid program α".

Assignment The assignment rule r:"s performs the change of value in the formula ϕ by replacing every occurrence of x in ϕ by the term θ. We have to be careful with the phenomenon of capture of variables as in the β-reduction in λ-calculus. We need a bound variable renaming process similar to α-conversion. Intuitively, bound variables are variables that can change over the execution of a given system.

Γ $ ϕpθq, ∆ r:"s Γ $ rx :" θsϕpxq, ∆

Bound variable renaming

Definition 16 (Bound variable). A variable x is bound if it is under the scope of a quantifier, e.g. @xϕpxq or Dxϕpxq, or if it is in the scope of a modality where x is the variable assigned, e.g. x :" θ, or the variable derived, e.g. 9

x " θ.

Bound variables of a hybrid program α are variables that depend of the execution of α. The renaming of bound variables is necessary to ensure soundness. For example, we have the two proof trees 2.24 and 2.25, one without taking care of renaming bound variables, the other one with renaming. The first one is obviously unsound and does not match the semantic of the assignment. In Figure 2.24, the value of the variable z assigned to x is not the same as the variable z in the second modality. It leads to a proof stuck, and there is thus no means to prove a formula clearly valid. In Figure 2.25, we rename the bound variable z in the second modality by a fresh variable u to avoid confusion. The renaming step will not be made explicit in the next sections, but is performed "on the fly".

x ą 0, z ą 0 $ z `z ą z `z r:"s x ą 0, z ą 0 $ rz :" z `zsz ą z r:"s x ą 0, z ą 0 $ rx :" zsrz :" z `xsz ą x
Real Arithmetic QE x ą 0, z ą 0 $ z `z ą z r:"s x ą 0, z ą 0 $ ru :" z `zsu ą z r:"s x ą 0, z ą 0 $ rx :" zsru :" z `xsu ą x Renaming z � u x ą 0, z ą 0 $ rx :" zsrz :" z `xsz ą x
Test, sequence and non-deterministic choice The rule r?s is equivalent to try to prove ψ under the assumption ϕ. It amounts to add ϕ as an hypothesis for the proof. The rule rYs creates two premises, one for the execution of α and one for the execution of β. We have to prove that ϕ holds for each possibility. y ą 0 $ x ě 0 Ñ rz :" x `y2 sz ě 0 r?s y ą 0 $ r?x ě 0srz :" x `y2 sz ě 0 r; s y ą 0 $ r?x ě 0; z :" x `y2 sz ě 0 y ą 0 $ x ă 0 Ñ rz :" x `y2 sz ě 0 r?s y ą 0 $ r?x ă 0srz :" x 2 `ysz ě 0 r; s y ą 0 $ r?x ă 0; z :" x 2 `ysz ě 0 rYs y ą 0 $ rp?x ě 0; z :" x `y2 q Y p?x ă 0; z :" x 2 `yqsz ě 0 We can prove that for every execution of the following if-then-else program : ?ϕ; x :" 0Y?�ϕ; x :" 1, the formula ϕ Ñ x " 0 ^�ϕ Ñ x " 1 holds. The proof is in the proof tree 2.30.

Γ $ ϕ Ñ ψ, ∆ r?s Γ $ r?ϕsψ, ∆
Γ $ rαsϕ, ∆ Γ $ rβsϕ, ∆ rYs Γ $ rα Y βsϕ, ∆
Real Arithmetic QE ϕ, ϕ $ 0 " 0 K K $ 0 " 1 �ϕ, ϕ $ 0 " 1 ^r, Ñ r ϕ $ ϕ Ñ 0 " 0 ^�ϕ Ñ 0 " 1 r:"s ϕ $ rx :" 0sϕ Ñ x " 0 ^�ϕ Ñ x " 1 r?s, Ñ r $ r?ϕsrx :" 0sϕ Ñ x " 0 ^�ϕ Ñ x " 1 r; s $ r?ϕ; x :" 0sϕ Ñ x " 0 ^�ϕ Ñ x " 1
Π rYs $ r?ϕ; x :" 0Y?�ϕ; x :" 1sϕ Ñ x " 0 ^�ϕ Ñ x " 1 Figure 2.30: Proof tree of r?ϕ; x :" 0Y?�ϕ; x :" 1sϕ Ñ x " 0 ^�ϕ Ñ x " 1

The branch Π in the proof tree 2.30 is, mutatis mutandis, developed as the left branch already detailed.

Γ $ ϕ, ∆ Γ $ @ α pϕ Ñ rαsϕq, ∆ [Ind] Γ $ rα ˚sϕ, ∆ Initial step Induction step Figure 2.31: Rule [Ind]
To prove that a formula ϕ holds for every run of α ‹ , we have to prove that it holds for zero iteration, the initial step, and that if it holds an arbitrary number n of iterations, then it holds for the next iteration, the induction step.

The skolemization of a formula ϕ by a set of variables tx 1 , . . . , x n u is the addition of universal quantification over these variables in front of ϕ, i.e. @x 1 , . . . @x n ϕ. It is a necessary abstraction to ensure soundness. If we do not add it, we can prove obviously false formulas as for example x " 1 Ñ rpx :" x ´1q ˚sx ě 0 (proof tree 2.32). In the Figure 2.32, the problem comes from that we can use the formula x " 1 to conclude the induction step, but it is the initial value of x.

Real Arithmetic

QE x " 1 $ x ě 0 Real Arithmetic QE x " 1 $ x ´1 ě 0 W l x " 1, x ě 0 $ x ´1 ě 0 r:"s x " 1, x ě 0 $ rx :" x ´1sx ě 0 Ñ r x " 1 $ x ě 0 Ñ rx :" x ´1sx ě 0 [Ind] x " 1 $ rpx :" x ´1q ˚sx ě 0 Ñ r $ x " 1 Ñ rpx :" x ´1q ˚sx ě 0
Fibonacci We can prove that our implementation of Fibonacci (Example 1) satisfies the property F n`2 " F n`1 `Fn . We use the following notations:

• Fibonacci fi pbodyq • where body fi F n :" F n`1 ; F n`1 :" F n`2 ; F n`2 :" F n`1 `Fn • Init fi F n " 0, F n`1 " 1, F n`2 " 1 • ϕ fi F n`2 " F n`1 `Fn
Our goal is to exhibit a proof tree of the sequent Init $ rFibonaccisϕ.

Π init Init $ ϕ Π Step Init $ @F n , F n`1 , F n`2 pϕ Ñ rbodysϕq [Ind]
Init $ rpbodyq ˚sϕ We apply the induction rule [Ind] and it results in two premises: Π Init and Π Step . We handle them separately in their respective branches 2.34 and 2.35.

Real Arithmetic

QE F n " 0, F n`1 " 1, F n`2 " 1 $ 1 " 1 `0 Evaluation of F n , F n`1 and F n`2 F n " 0, F n`1 " 1, F n`2 " 1 $ F n`2 " F n`1 `Fn Init $ ϕ Figure 2.34: Branch Π Init
For the initial step (branch Π init ), we verify that ϕ holds initially, i.e. if it is true after zero execution of the system. We just have to replace the variables F n , F n`1 and F n`2 in the right-hand side by their values in the left-hand side. We can conclude by trivial arithmetic. For the induction step (branch Π Step ), we apply the rule @ r , and thus replace every occurrence of variables F n , F n`1 and F n`2 by F 0 n , F 0 n`1 and F 0 n`2 which are assumed fresh. body 0 (resp. ϕ 0 ) is the program body (resp. formula ϕ) where this replacement has been made. We discard then the hypothesis Init which brings no information on the new variables and pass ϕ 0 in hypothesis by the use of the rule Ñ r . We rename the variables to avoid confusion for the multiple applications of rule r:"s.

ax $ F 0 n`2 `F 0 n`1 " F 0 n`2 `F 0 n`1 r; s, r:"s $ rF 1 n`2 :" F 0 n`2 `F 0 n`1 sF 1 n`2 " F 0 n`2 `F 0 n`1 r; s, r:"s $ rF 1 n`1 :" F 0 n`2 ; F 1 n`2 :" F 1 n`1 `F 0 n`1 sF 1 n`2 " F 1 n`1 `F 0 n`1 r:"s $ rF 0 n :" F 0 n`1 srF 1 n`1 :" F 0 n`2 ; F 1 n`2 :" F 1 n`1 `F 0 n sϕ 1 W l , r; s ϕ 0 $ rF 0 n :" F 0 n`1 ; F 1 n`1 :" F 0 n`2 ; F 1 n`2 :" F 1 n`1 `F 0 n sϕ 1 Renaming ϕ 0 $ rF 0 n :" F 0 n`1 ; F 0 n`1 :" F 0 n`2 ; F 0 n`2 :" F 0 n`1 `F 0 n sϕ 0 W l , Ñ r Init $ ϕ 0 Ñ rbody 0 sϕ 0 @ r Init $ @F n , F n`1 , F n`2 pϕ Ñ rbodysϕq
We deconstruct then the body with the rules r; s and r:"s until we obtain the formula

F 0 n`2 `F 0 n`1 " F 0
Induction rule with a stronger invariant There is an other version of the induction rule where a stronger invariant is introduced, the rule [Ind2]. We present it in the Figure 2.37.

Γ $ ϕ, ∆ Γ $ @ α pϕ Ñ rαsϕq, ∆ Γ $ @ α pϕ Ñ ψq, ∆ [Ind2] Γ $ rα ˚sψ, ∆ Figure 2.37: Rule [Ind2]
We introduce a stronger invariant ϕ instead of the previous invariant ψ. We have to prove the initial step and the induction step, but also to prove that ϕ implies ψ.

It can be obtained as a derived rule by the combination of rules [Gen] and [Ind] as shown in the Figure 2.38.

Γ $ ϕ, ∆ Γ $ @ α pϕ Ñ rαsϕq, ∆ [Ind] Γ $ rα ˚sϕ, ∆ Γ $ @ α pϕ Ñ ψq, ∆ [Gen] Γ $ rα ˚sψ, ∆ Figure 2.38: Derivation of rule [Ind2] Remark 3

. The main difficulty of the induction rule is the finding of a suitable invariant.

There exists some heuristics to guess invariant, but no complete algorithms.

ODESolve rule

The rule [ODESolve] asks to provide a solution of the ODE to prove that ϕ is invariant.

Γ $ @t ě 0 `p@0 ď s ď t, rx :" solpsqsHq Ñ rx :" solptqsϕ ˘, ∆

[ODEsolve] Γ $ r 9

x " f pxq & Hsϕ, ∆ In the rule 2.39, the formula solptq is the solution of the ODE 9

x " f pxq. We replace the occurrences of x by its solution in the evolution domain H and in the invariant ϕ. The skolemization is for soundness. t represents the evolution of time. The left part of the implication corresponds to the assumption that the evolution domain holds.

Example 13. We present in the Figure 2. [START_REF] Donzé | Systematic simulation using sensitivity analysis[END_REF]

an example of the use of the rule [ODESolve]. Consider the water-level ODE in the Example 5. The solution of the water-level ODE is

wl " pf in ´f outqt `4. We restrict its temporal evolution to one second by adding the formula 0 ď t ď 1 in the evolution domain. Init denotes the initial value of the water-level, wl " 4 and the value of the parameters f in " 0 (i.e. the inlet valve is closed) and f out " 0.75. QE Init, @s 0 ď s ď 1 $ pf in ´f outqt `4 ď 7 Ñ r Init $ p@s 0 ď s ď 1q Ñ pf in ´f outqt `4 ď 7 @ r Init $ @t ě 0 `p@s 0 ď s ď 1q Ñ pf in ´f outqt `4 ď 7 ˘r:"s, r:"s We apply the rule [ODESolve], then the assignment rule r:"s twice to replace the variables by their solution. We deconstruct the formula @t ě 0 `p@s 0 ď s ď 1q Ñ pf in´f outqt`4 ď 7 ˘, and then discharge it to an external solver, e.g. Z3.

Init $ @t ě 0 `p@srt :" ss0 ď t ď 1q Ñ rwl :" pf in ´f outqt `4swl ď 7 ˘[ODESolve] Init $ r 9 wl " f in ´f out & 0 ď t ď 1swl ď 7
Structural differential rules The Differential Cut rule [DC] and the Differential Weakening rule [DW] are two structural rules for the evolution domain. They are analogous to the rule Cut and the weakening rules W l and W r in Subsection 2.3.3.

The rule [DW] in Figure 2.41 means that the evolution domain is sufficiently strong to prove the guarantee without considering the behavior.

Γ $ @xpH Ñ ϕq, ∆ [DW] Γ $ r 9 x " f pxq & Hsϕ, ∆ Figure 2.41: Rule [DW]
We have an example of its use in the Figure 2.42. We need to have a strong evolution domain to apply the rule [DW]. But it is usually not the case when we model a hybrid system. It is typically reinforced by multiple application of the rule [DC].

Real Arithmetic

QE Init $ @wl, t `p0 ď t ď 1 ^wl ď 7 ^3 ď wlq Ñ 3 ď wl ď 7 ˘[DW] Init $ r 9 wl " f in ´f out, 9 t " 1 & 0 ď t ď 1 ^wl ď 7 ^3 ď wls3 ď wl ď 7
The rule [DC] in the Figure 2.43 introduces a new formula ψ in the evolution domain (right premise) provided we prove that the formula ψ is an invariant (left premise).

Γ $ r 9 x " f pxq & Hsψ, ∆ Γ $ r 9 x " f pxq & H ^ψsϕ, ∆ DC Γ $ r 9 x " f pxq & Hsϕ, ∆ Figure 2.43: Rule [DC]
As for the rule Cut (Figure 2.19), it is very useful for the structuration of proofs. We illustrate it in the Figure 2.44.

Example 14 (Water-level example). In the water-level example (cf Ex. 5 and 13), we want now prove that the water-level does not overflow (wl ď 7) and that it stays above a limit (3 ď wl) in order to keep a sufficient pressure on the outlet valve. We want a proof of the sequent Init $ r 9

wl " f in ´f out & 0 ď t ď 1s3 ď wl ď 7. With the help of the rule rDCs, we can consider each case separately.

In the Figure 2.44, we first apply the rule [DC] twice to isolate each case. Finally, we apply the rule [DW] since the evolution contain the formula 3 ď wl ď 7. The branch Π 1 is already considered in the Figure 2.40. Mutatis mutandis, the branch Π 2 is closed by the same reasoning. The branch Π 3 is trivially closed .

Π 1 Init $ r 9 wl " f in ´f out & 0 ď t ď 1swl ď 7 [DC] Init $ r 9 wl " f in ´f out & 0 ď t ď 1s3 ď wl ď 7 Π 2 Init $ r 9 wl " f in ´f out & 0 ď t ď 1 ^wl ď 7s3 ď wl [DC] Init $ r 9 wl " f in ´f out & 0 ď t ď 1 ^wl ď 7s3 ď wl ď 7 Π 3 Init $ @wl `p0 ď t ď 1 ^wl ď 7 ^3 ď wlq Ñ 3 ď wl ď 7 ˘[DW] Init $ r 9 wl " f in ´f out & 0 ď t ď 1 ^wl ď 7 ^3 ď wls3 ď wl ď 7
Γ $ ϕ, ∆ Γ $ @ α pH Ñ ϕ 1θ 9 x q, ∆ [DI] Γ $ r 9 x " θ & Hsϕ, ∆
Initial stepDifferential Induction step where ϕ 1θ 9

x means that we substitute every occurrence of 9

x by θ and ϕ 1 is the derivation of ϕ as in def. 17 and 18

Figure 2.45: Differential induction rule

The left premise is the initial step. It demands that ϕ holds at the initial time. In the right premise, the differential induction step, we derive the formula ϕ according to Definitions 17 and 18 which implement the idea of differential step. We replace then the occurrences of 9

x by θ.

Definition 17 (Derivation of terms).

prq 1 " 0 for r P Q pxq 1 " 9 x for variable x pa `bq 1 " paq 1 `pbq 1 pa ´bq 1 " paq 1 ´pbq 1 pa ¨bq 1 " paq 1 ¨b `a ¨pbq 1 pa{bq 1 " paq 1 ¨b´a¨pbq 1 b 2
They are the usual rules of the derivation calculus as taught in high school.

Example 15. If θ fi x 2 `y2 , then θ 1 fi 2x 9

x `2y 9 y

We define also the derivation of formulas.

Definition 18 (Derivation of formulas).

pθ 1 " θ 2 q 1 " pθ 1 q 1 " pθ 2 q 1 except if " is ‰ pF ^Gq 1 " pF q 1 ^pGq 1 pF _ Gq 1 " pF q 1 ^pGq 1 p@xF q 1 " @xpF q 1 pDxF q 1

" @xpF q 1

The rule [DI] allows to reason on differential equations without having to provide a solution.

Example 16. Let us consider the differential equations 9

d " e, 9 e " ´d which represent an object moving along a circle of radius r in the plane with coordinates d and e. The solution involves trigonometric functions, and therefore is very difficult to handle. We want to prove that d 2 `e2 " r 2 holds at any moment in the system. We apply the differential induction rule and then the several rules of derivation until the obtaining of a First-Order formula of the Real Arithmetic.

Real Arithmetic QE d " 0, e " 1, r " 1 $ d 2 `e2 " r 2
Real Arithmetic QE $ @d@e, p2de ´2de " 0q $ @d@e, p2de `2e ¨´d " 0q $ @d@e, p2dd 1 `2ee 1 " 0q e ´d

d 1 e 1 $ @d@e, pd 2 `e2 " r 2 q 1e ´d d 1 e 1 [DI] d " 0, e " 1, r " 1 $ r 9
d " e, 9 e " ´dsd 2 `e2 " r 2 d " e, 9 e " ´dsd 2 `e2 " r 2

Theoretical results

We state the soundness of the sequent calculus and its incompleteness. We present its relative completeness with respect to its discrete and continuous fragment. We present several sound extensions of dL and give a brief presentation of the theorem prover KeYmaera X.

Soundness theorem

The soundness theorem means that if we have a derivation of a sequent, then the sequent is valid.

Theorem (Soundness theorem). If Γ $ ϕ _ ∆, then Γ |ù ϕ _ ∆.
Proof. We have already stated that the rules for the first-order real arithmetic formulas are sound. The interested reader can refer to [98, p.97] for a more detailed presentation of the soundness of other rules.

This theorem is very important since it ensures that if we obtain a proof of a formula, then it is valid. The converse is not true. If a sequent is valid, there is not necessarily a derivation. As a consequence, the logic dL is incomplete.

Incompleteness theorem

Theorem (Incompleteness theorem). dL is incomplete, i.e. there exists a formula ϕ which is valid, but for whose it is impossible to derive a proof tree.

Proof. We reduce this result to the halt problem. Since the discrete part of dL is Turingcomplete, if we assume that it is complete, then the verification problem of programs is complete too. The halt problem is thus decidable which is absurd.

Although the sequent calculus is not complete, we have relative completeness with respect to the discrete or continuous fragment.

Relative completeness Relative completeness of a proof calculus with respect of an other proof calculus means that if the first is complete, then the second too. The sequent calculus of dL is relatively complete with respect to both its discrete and continuous fragment [START_REF] Platzer | The complete proof theory of hybrid systems[END_REF].

Theorem (Relative completeness with respect to the discrete fragment). If we assume the discrete fragment to be complete, then the sequent calculus of dL is complete.

Theorem (Relative completeness with respect to the continuous fragment). If we assume the continuous fragment to be complete, then the sequent calculus of dL is complete.

These results show that reasoning on hybrid systems, purely discrete systems or purely continuous systems is equivalent from a proof-theoretical view.

Extensions Several extensions of dL have been proposed to address fundamental problems. Each of these extensions has a sound sequent calculus and has been implemented in KeYmaera.

Differential temporal logic (dTL) is a conservative extension with temporal constructs. It allows to reason about the temporal behavior during the execution of a hybrid system [START_REF] Platzer | A temporal dynamic logic for verifying hybrid system invariants[END_REF] [START_REF] Jeannin | dtl 2: Differential temporal dynamic logic with nested temporalities for hybrid systems[END_REF]. It provides means to express more complex liveness specification.

Quantified differential dynamic logic (QdL) is an extension to handle distributed hybrid systems [START_REF] Platzer | Quantified differential dynamic logic for distributed hybrid systems[END_REF]. Differential dynamic game logic (dDGL) integrates several game constructs on top of dL allowing to analyze hybrid games [START_REF] Quesel | Playing hybrid games with keymaera[END_REF]. Finally, Stochastic differential dynamic logic (SdL) is designed to handle stochastic hybrid systems [START_REF] Platzer | Stochastic differential dynamic logic for stochastic hybrid programs[END_REF]. Security and privacy concerns are addressed by introducing the notion of hybrid dynamic information flows. It allows to reason about leakage of informations both in cyber channels and physical channels.

KeYmaera and KeYmaera X dL has been first implemented in KeYmaera [START_REF] Platzer | Keymaera: A hybrid theorem prover for hybrid systems (system description)[END_REF]. As dL is an extension of Dynamic logic, KeYmaera is an extension of the theorem prover Key which implements Dynamic logic [START_REF] Ahrendt | The key platform for verification and analysis of java programs[END_REF].

It has been completely rewritten to form KeYmaera X [47] [85]. It features a small kernel which has been verified in Coq and Isabelle [START_REF] Bohrer | Formally verified differential dynamic logic[END_REF] and a graphical interface. There is also a proof programming language Bellerophon [START_REF] Fulton | Bellerophon: Tactical theorem proving for hybrid systems[END_REF] which allows a user to define its own tactics.

The parallel composition of Cyber-Physical Systems (CPS) models the parallel execution of two CPS simultaneously. It is of paramount importance to scale to the modeling and proof of large systems since most of CPS run in parallel.

We present our methodology to modularly model and prove correctness of Cyber-Physical Systems. The Section 3.1 presents the definition of a component at the design level and its precise implementation into dL. The Section 3.2 is devoted to the definition of a parallel composition operator which allows to modularly model a CPS. We show how to retain properties of a component through composition in Section 3.3. We have exemplified each notion with a cruise-controller example. The Section 3.4 present a prototype implemented in the theorem prover KeYmaera X. It is prototype to automate the proof procedure. The Section 3.5 details the complete study of a second use case, a water-tank.

Definition of a component

A component is a part of a system which has a distinct behavior and communicates with other parts of the system via inputs and outputs. Properties are expressed on inputs and outputs. It is a popular way to tackle the complexity of large systems, especially in the industry. The basic idea is to decompose a system into several sub-systems which are easier to understand and reason about.

The concept of component is fuzzy. It can denote the part of a mathematical proof, for example an auxiliary lemma that we prove independently, or a module in a software, for example the payment of a donation on Wikipedia. In the industry, a component may be the speed sensor or the power engine in a car.

We provide a clear representation for a component at the design level in Subsection 3.1.1 and its logical equivalence in dL in Subsection 3.1.2. We detail in Subsection 3.1.2 the general form that a component exhibits in dL. We illustrate each notion and definition with a cruisecontroller example inspired from the use-case in the approach of Mueller et al. [START_REF] Müller | A component-based approach to hybrid systems safety verification[END_REF].

What is a component

A component is made up of three parts: a definition, an interface and a contract. The definition provides a name and a description of the behavior of the component. The contract describes the requirements attached of the component. It gives information on the purpose of the component. The interface indicates how it can interact with the rest of the system. The three parts can be interpreted from a dL formula, i.e. it is possible to work purely from dL logic. However, we add a supplementary layer, called textual representation, to reason on the system without having to work on dL formulas which might get more and more complex along the construction of the system.

The conception of a system consists of two phases: a design phase and a verifying phase. The design phase requires good understanding of the domain in order to develop a meaningful system. The methodologies used here should not depend of a particular logic. The proving phase is more technical and may require deep knowledge of proof theory.

Environment We assume that the designer provides a description of the environment in the form of a set of formulas denoted by E. It regroups the free variables that are not outputs of a component, the parameters. They cannot be controlled and are exterior to the considered system. For example, the gravity value g is a parameter in most of mechanical systems or the value of the speed limit S in our example. It is a value fixed by the government, a tachymeter cannot change it freely. Parameters can be constant or in a range of value if we want to represent uncertainty. Time We assume that the time evolves continuously and linearly. It is represented by the reserved variable t and its evolution is modeled by the differential equation 9

t " 1. We get inspiration from the meta-theory of contracts of Benveniste et al. [START_REF] Benveniste | Contracts for system design[END_REF]. The formulas are formulas of dL2 .

Name and behavior

Example 19 (Contract of the Tachymeter). We assume that the speed of the vehicle, s eng , does not exceed the speed limit S. Under this assumption on the real speed, the tachymeter guarantees that the target speed does not exceed the speed limit. It also guarantees that the measured speed is inferior to S and links the value of the acceleration to the measured and the target speed. The formulas A and G are usually denoted as pre-and post-conditions in the related work to Dynamic Logic [START_REF] Vaughan R Pratt | Dynamic logic[END_REF] and Differential Dynamic Logic [START_REF] Platzer | Logical Analysis of Hybrid Systems: Proving Theorems for Complex Dynamics[END_REF]. We have made the choice here to refer as assumptions and guarantees to emphasis that we develop a component-based approach.

Name

Graphical representation Another popular way to represent a component is graphically. It is a compact representation and similar to existing design methods as dataflow models.

The interface is represented by incoming arrows for the inputs and outgoing arrows for the outputs. The box is divided in three part: the name A, the behavior α and the assumptions and guarantees pA, Gq. The graphical representation of the component Engine is provided in the Figure 3.5. It is very similar to the meta-theory of contract defined by Benveniste et al. [START_REF] Benveniste | Contracts for system design[END_REF]. We have instantiated with the logic dL in our approach, but one can imagine to mix it with other approaches.

Engine 9 s eng " a, 9 t " 1 & 0 ď t ´ttach ď ε A eng : 0 ď s acm ď S0 ď s tach ď Sâ " s tach ´sacm ε G eng : 0 ď s eng ď S a s tach

Definition in dL

We show how to transcript our notion of component into a formula of dL. The behavior is already a hybrid program, but it should respect a particular form that we detail. The interface corresponds to bound and free variable of the behavior and the contract can be naturally expressed in dL as seen in Definition 10.

General form of a behavior in dL We define a general form that the behavior of a component should respect. To gain in clarity, we partition specifications α into their discrete and continuous parts disc α and cont α .

Definition 19 (General form of a behavior). The general form of a behavior α fi pcont α Y disc α q ˚consists of its partition into a continuous part cont α , of the form 9 X " θ X & H X , and the discrete part disc α .

Notice that the discrete part of a system disc α is itself defined by the union of discrete, functional, components.

Example 21 (Behavior of Tachymeter). We model the discrete controller of a cruise control system that is responsible for delivering a targeted speed to the vehicle engine (e.g. a car).

Tach fi `?t tach `ε ě t; s acm :" s eng ; s tach :" ˚; ?p0 ď s tach ď S ^´δ ď s tach ´sacm ď δq; a :" s tach ´sacm ε ; t tach :" t ˘The test ?t tach `ε ě t ensure that no more that ε seconds have passed since the last execution marked by t tach . We measure then the value of the speed s eng by memorizing it in the variable s acm (s acm :" s eng . It chooses an arbitrary value for s ctrl , the targeted speed, and checks if it is in the desired range r0, Ss, where S is the speed limit. It additionally checks that the difference between the speed measured by the tachymeter, s tach , and the targeted speed, s ctrl , is not too high, in order to ensure that the acceleration set is not too brutal and/or within the capabilities of the engine.

Example 22 (Behavior of Engine). We model the continuous acceleration of the engine by a guarded derivative:

9 s eng " a, 9 t " 1 & 0 ď t ´ttach ď ε
The differential equation describes the evolution of speed by a function of the acceleration over time.

We can model a large variety of hybrid systems as sensors, programs, plant.

Contract of a component in dL

To soundly ensure that a component satisfies its contract, we use the proof theory of dL.

A component A in an environment E is translated in dL as a formula of the form pE Âq Ñ rαsG where E is the environment, A and G are the assumptions and guarantees and α the behavior of the component. For example, the component Tachymeter is translated as pE ^Atach q Ñ rTachsG tach .

The interface is implicit. The inputs (resp. outputs) of a component correspond to the free variables (resp. bound variables) of the behavior. We have A.inputs Ď F V pαq and A.outputs Ď BV pαq. This notion is translated in dL by the notion of bounds and free variables. The bound variables of a hybrid program α are variables that can be changed during the execution of α, i.e. a variable on which the hybrid program acts. It is assimilated to outputs. The remaining variables are the free variables, i.e. all the variables that are not bound. The component cannot modify theses variables. We have to distinguish in these variables the parameters, which are part of the environment, and the inputs which are the variables that can potentially be outputs of other components.

It is now possible to precisely define the satisfaction of a contract by a component.

Definition 20 (Satisfaction of a contract).

A component A satisfies its contract pA, Gq if the formula pE ^Aq Ñ rαsG is valid.

We add the environment E in the formula because it is needed to achieve the proof. We prove the validity of the formula by using rules of the sequent calculus of dL [START_REF] Platzer | Logical Analysis of Hybrid Systems: Proving Theorems for Complex Dynamics[END_REF].

We refer to the behavior of the tachymeter by Tach in the next sections. We have:

Tach fi `?t tach `ε ě t; s acm :" s eng ; s tach :" ˚; ?p0 ď s tach ď S ^´δ ď s tach ´sacm ď δq; a :" s tach ´sacm ε ; t tach :" t ˘Example 23 (Satisfaction of the contract of the Tachymeter). To show that the Tachymeter component satisfies its contract, we prove the validity of the sequent:

E, A T ach $ rTachsG T ach
where:

Tach fi pBodyq Body fi ?t tach `ε ě t; s acm :" s eng ; s tach :" ˚; ?p0 ď s tach ď S ^´δ ď s tach ´sacm ď δq; a :"

s tach ´sacm ε ; t tach :" t A T ach fi 0 ď s eng ď S G T ach fi 0 ď s acm ď S ^0 ď s tach ď S ^a " s tach ´sacm ε E
fi S ą 0 ^ε ą 0 ^stach " s eng ^sacm " s eng ^a " 0

We distinguish the hybrid program Body in the loop from the behavior of the component Tach to clarify the proof. Body will occurs at multiple times. We use G T ach as an invariant for the application of the rule [Ind].

Π Init E, A T ach $ G T ach Π Step E, A T ach $ @s acm , s tach , a, t tach pG T ach Ñ rBodysG T ach q [Ind] E, A T ach $ rpBodyq ˚sG T ach
We obtain two sub-goals left. The left goal is the initial step where we have to prove that G T ach holds after zero execution of the Tachymeter. It is proved by the branch Π init . The second is the induction step. We assume that G T ach is true and we have to show that it still holds after one execution of the hybrid program Body. We skolemize the formula by every bound variable of Tach. It is closed by the branch Π step that we detail later.

We deal first with the branch Π init . We unfold the definition of G T ach and decompose the goals in three sub-goals with the rule ^r:

E, A T ach $ 0 ď s acm ď S E, A T ach $ 0 ď s tach ď S E, A T ach $ a " s tach ´sacm ε ^r E, A T ach $ 0 ď s tach ď S ^a " s tach ´sacm ε ^r E, A T ach $ 0 ď s acm ď S ^0 ď s tach ď S ^a " s tach ´sacm ε Unfolding of G T ach E, A T ach $ G T ach Π init
The three sub-goals 0 ď s acm ď S, 0 ď s tach ď S and a " s tach ´sacm ε are real arithmetic formulas which can be proved by an SMT solver. We detail the case of the first sub-goal; the two others are similar. It unfolds to the following sequent : S ą 0 ^ε ą 0, s tach " s eng , s acm " s eng , a " 0, 0 ď s eng ď S $ 0 ď s acm ď S We can replace s acm by s eng in the right-hand side of the sequent. We obtain 0 ď s eng ď S in the right-hand side and 0 ď s eng ď S is already present in the left-hand side. we conclude by applying the axiom rule.

We consider the induction step. We have to prove the sequent E, A T ach $ @s acm , s tach , a, t tach pG T ach Ñ rBodysG T ach q. We apply the skolemization rule @ r four times, denoted by @ 4 r . We obtain E, A T ach $ pG 0 T ach Ñ rbody 0 sG 0 T ach q.

E, A T ach $ G 0 T ach Ñ rBody 0 sG 0 T ach @ 4 r E, A T ach $ @s acm , s tach , a, t tach pG T ach Ñ rBodysG T ach q G 0 T ach (resp. Body 0 ) is G T ach where every occurrences of s acm , s tach , a, t tach have been replaced by the fresh variables s 0 acm , s 0 tach , a 0 , t 0 tach (resp. Body 0 ). We have: Body 0 fi ?t 0 tach `ε ě t; s 0 acm :" s eng ; s 0 tach :" ˚; ?p0 ď s 0 tach ď S ^´δ ď s 0 tach ´s0 acm ď δq; a 0 :"

s 0 tach ´s0 acm ε ; t 0 tach :" t G 0 T ach fi 0 ď s 0 acm ď S ^0 ď s 0 tach ď S ^a0 " s 0 tach ´s0 acm ε
We use the rule [BoxAnd] twice to split the conjunctions in the invariant.

E, A T ach , G 0 T ach $ rBody 0 s0 ď s 0 acm ď S [BoxAnd] E, A T ach , G 0 T ach $ rBody 0 sp0 ď s 0 acm ď S ^0 ď s 0 tach ď S ^a0 " s 0 tach ´s0 acm ε q Unfold G 0 T ach E, A T ach $ G 0 T ach Ñ rBody 0 sG 0 T ach Ñ r E, A T ach $ G 0 T ach Ñ rBody 0 sG 0 T ach E, A T ach , G 0 T ach $ rBody 0 s0 ď s 0 tach ď S E, A T ach , G 0 T ach $ rBody 0 sa 0 " s 0 tach ´s0 acm ε [BoxAnd] E, A T ach , G 0 T ach $ rBody 0 s0 ď s 0 tach ď S ^a0 " s 0 tach ´s0 acm ε
We detail the proof of the sub-goal E, A T ach , G 0 T ach $ rBody 0 s0 ď s 0 acm ď S in Figure 3.6. The two other sub-goals are similar. The basic idea is to unfold Body, the resulting sequent is composed of Real Arithmetic formulas and is trivial to prove.

The corresponding .kyx file can be found in the annexes 5.3.2 for the Tachymeter and 5.3.2 for the Engine.

Conclusion

We have presented how to represent a component A with its interface, contract and behavior. We have defined the meaning of A satisfying its contract. We have explained how it is translated in the dL framework. It gives us a strong logical basis to soundly reason on CPS. The next section is devoted to the presentation of the process of parallel composition to modularly build a system.

Parallel composition operator

The composition of components is the core aspect of the component-based approach; it is the mechanism that allow us to obtain a full system after having considered each of its components separately. It specifies how we connect components and what the resulting behavior is.

The operator achieving it shall be the more general possible in order to handle a wide variety of systems. The result of the composition of two components, the composite, shall be a component that we can composed later with another component. The operator must be modular, i.e. commutative and associative. If we compose two components A and B, then another one C, we shall obtain the same result as if we have composed first B and C together, and then A as illustrated in the Figure 3.7.

We present the parallel composition of components A and B in Subsection 3.2.1. The Subsection 3.2.2 is devoted to the definition of the operator ˝to compose behaviors in dL. We discuss the differences with the parallel composition of hybrid action systems in Subsection 3.2.3.

Parallel composition of components

When composing two components, there is no need to specify the inputs, the assumptions, the outputs, the guarantees and the behavior of the resulting component; these characteristics are automatically inherited from the composition. The inputs (resp. outputs) are the union of respective inputs (resp. outputs). The assumptions (resp. guarantees) are the conjunction of respective assumptions (resp. guarantees). The behavior is obtained by application of the operator ˝, defined in Subsection 3.2.2.

Our model of communication for our parallel composition operator is based on variablesharing and is thus very simple. An output can be the input of several components, and it is thus not possible to abstract matching inputs and outputs through composition. We outline how we can model communication channels in our paradigm in the Subsection 5.1.3 of future works.

Example 24 (Cruise-Control). The cruise-control system is obtained by parallel composition of components Tachymeter and Engine. It is itself a component, named Cruise-Control that may be composed later with other part of a vehicle, e.g. a power-train. The result of the composition is given in Figure 3.8.

A graphical representation is given in the Figure 3

.9. ax E, 0 ď s 0 eng ď S, G 0 T ach , t 0 tach `ε ě t, 0 ď x ď S ^´δ ď x ´s0 eng ď δ $ 0 ď s 0 eng ď S Unfold definition of A T ach E, A T ach , G 0 T ach , t 0 tach `ε ě t, 0 ď x ď S ^´δ ď x ´s0 eng ď δ $ 0 ď s 0 eng ď S r:"s E, A T ach , G 0 T ach , t 0 tach `ε ě t, 0 ď x ď S ^´δ ď x ´s0 eng ď δ $ rt 0 tach :" ts0 ď s 0 eng ď S r:"s E, A T ach , G 0 T ach , t 0 tach `ε ě t, 0 ď x ď S ^´δ ď x ´s0 eng ď δ $ ra 0 :" x´s 0 eng ε srt 0 tach :" ts0 ď s 0 eng ď S r; s E, A T ach , G 0 T ach , t 0 tach `ε ě t, 0 ď x ď S ^´δ ď x ´s0 eng ď δ $ ra 0 :" x´s 0 eng ε ; t 0 tach :" ts0 ď s 0 eng ď S rÑ r s E, A T ach , G 0 T ach , t 0 tach `ε ě t $ p0 ď x ď S ^´δ ď x ´s0 eng ď δq Ñ ra 0 :" x´s 0 eng ε ; t 0 tach :" ts0 ď s 0 eng ď S r?s E, A T ach , G 0 T ach , t 0 tach `ε ě t $ r?p0 ď x ď S ^´δ ď x ´s0 eng ď δqsra 0 :" x´s 0 eng ε ; t 0 tach :" ts0 ď s 0 eng ď S r; s E, A T ach , G 0 T ach , t 0 tach `ε ě t $ r?p0 ď x ď S ^´δ ď x ´s0 eng ď δq; a 0 :" x´s 0 eng ε ; t 0 tach :" ts0 ď s 0 eng ď S r@ r s E, A T ach , G 0 T ach , t 0 tach `ε ě t $ @xpr?p0 ď x ď S ^´δ

Definition in dL

We present in first part the parallel continuous composition operator to compose purely continuous behaviors of component, i.e. Ordinary Differential Equations (ODEs). We consider then the parallel composition operator for behaviors under the general form as in Definition 19.

Our parallel composition is largely inspired by the work of Ronkko et al. [START_REF] Rönkkö | Action systems with continuous behaviour[END_REF]. We compare the two approaches in the next Subsection 3.2.3.

A continuous parallel composition operator

We define the parallel composition ˝c between two continuous behaviors of a component. Recall that a continuous behavior α is a simple ODE, i.e. of the form 9

X " Θ X & H X .
Definition 21 (Definition of ˝c). Let α fi p 9 X " θ X & H X q and β fi p 9 Y " θ Y & H Y q be continuous behaviors of components A and B. Assume that X and Y are separated, i.e. X X Y " H. The parallel composition is:

α ˝c β fi p 9 X " Θ X , 9 Y " Θ Y & H X ^HY q
It is the system composed of the two differential equations in parallel. The resulting evolution domain is the conjunction of respective evolution domains. We require that the Engine 9 s eng " a, 9

t "

1 & 0 ď t ´ttach ď ε A eng : 0 ď s acm ď S0 ď s tach ď Sâ " s tach ´sacm ε G eng : 0 ď s eng ď S
Tachymeter `?t tach `ε ě t; s acm :" s eng ; s tach :" ˚; ?p0 ď s tach ď S ^´δ ď s tach ´sacm ď δq; a :" s tach ´sacm ε ; t tach :" t ˘Å tach : 0 ď s eng ď S G tach : 0 ď s acm ď S0 ď s tach ď Sâ " s tach ´sacm ε s eng a, s tach , s acm Figure 3.9: Cruise-control system derived variables are separated (X X Y " H), i.e. that they do not describe the evolution of the same system. It is a restriction that makes sense at the design level, but it is also mandatory to lift the contracts through composition. But occurrences of variables in X (resp. in Y ) can occur in Θ Y (resp. in Θ X ).

To illustrate the operator, assume that we want to set a time limit to our vehicle engine component.

Example 25 (Time limit to the engine vehicle). Assume that in the description of the engine, we did not make explicit the time and we do not have set a limit. We do not want to consider perpetual execution of Engine since the tachymeter controls it periodically. To obtain the behavior of the component Engine in 22, we consider the time as a component with output the variable t, and the representation of the passing of time is achieved by introducing the ODE 9

t " 1. We add the formula 0 ď t ´ttach ď ε in the evolution domain of 9 t " 1, where ε is the desired limit. Here, we limit the time with the formula 0 ď t ´ttach ď ε rather than t ď ε. It limits the time passed since the last execution of the Tachymeter component.

By composing this proposition with our example, we obtain the timed model:

p 9 s eng " aq ˝c p 9 t " 1 & 0 ď t ´ttach ď εq fi p 9 s eng " a, 9 t " 1 & 0 ď t ´ttach ď εq
We may also compose the speed with other physical parts of the vehicle like the temper-ature of the engine or the fuel's consumption.

Algebraic properties

The parallel continuous composition operator ˝c is commutative and associative. Commutativity means that we can compose two physical systems in any order. Associativity means that we can build a system step-by-step; we can compose two components together, add a third component later, and we still obtain the same system as if we have compose all together in the first place. It allows to hierarchy the composition of components.

Proposition 1 (Commutativity of ˝c). Let α and β be continuous behaviors of components A and B.

α ˝c β " β ˝c α
Proof. The idea is that the order of variables in an ODE is not important, we can re-arrange them to show associativity. Let α and β be continuous behaviors of components A and B, i.e. α fi 9

X " θ X & H X and β fi 9 Y " θ Y & H Y . p 9 X " θ X & H X q ˝c p 9 Y " θ Y & H Y q fi 9 X, 9 Y " θ X , θ Y & pH X ^HY q (definition of ˝c ) fi 9 Y , 9 X " θ Y , θ X & pH X ^HY q (re-arrangement) fi 9 Y , 9 X " θ Y , θ X & pH Y ^HX q (commutativity of ^) fi p 9 Y " θ Y & H Y q ˝c p 9 X " θ X & H X q (definition of ˝c )
Proposition 2 (Associativity of ˝c). Let α, β and γ be continuous behaviors of components A, B and C. pα ˝c βq ˝c γ " α ˝c pβ ˝c γq Proof. As for the proof of commutativity, the order of variables in an ODE is not important; we can re-arrange them to show associativity. Let α, β and γ be continuous behaviors of components A, B and C, i.e. α fi 9

X " θ X & H X , β fi 9 Y " θ Y & H Y and γ fi 9 Z " θ Z & H Z . pα ˝c βq ˝c γ fi p 9 X, 9 Y " θ X , θ Y & H X ^HY q ˝c γ punfold definition of ˝cq fi 9 X, 9 Y , 9 Z " θ X , θ Y , θ Z & H X ^HY ^HZ punfold definition of ˝cq fi α ˝c p 9 Y , 9 Z " θ Y , θ Z & H Y ^HZ q pfold definition of ˝cq fi α ˝c pβ ˝c γq pfold definition of ˝cq
We have presented the parallel composition operator for continuous behaviors of components. We have shown that it is associative and commutative, two mandatory conditions for the modularity. We present in the next section the parallel composition operator for behaviors of the general form.

A parallel composition operator

Recall that a behavior α is said of the general form if α fi pdisc α Y cont α q ˚(cf Definition 19. We define the parallel composition between such behaviors. The behavior is divided between its discrete part disc α and continuous part cont α . Due to their different nature, the composition between discrete parts of components differs from the composition between their continuous part.

Definition 22 (Parallel composition between general behaviors). Let α and β be general behaviors of components A and B, i.e. α fi pdisc α Y cont α q ˚and β fi pdisc β Y cont β q ˚. The parallel composition operator ˝is defined by:

α ˝β fi `disc α Y disc β Y pcont α ˝c cont β q ˘ẘhere ˝c is defined in Definition 21.
The composition between the discrete parts is a non-deterministic choice, which amounts to an interleaving of every discrete parts. This full interleaving allows to model parallel composition of discrete parts of hybrid systems. The continuous part are composed with ˝c. the discrete and continuous dynamics are then composed with the non-deterministic choice Y. Two examples of executions are given in the Figure 3.10. Cruise-control fi Engine ˝Tach fi ´`?t tach `ε ě t; s acm :" s eng ; s tach :" ˚; ?p0 ď s tach ď S ^´δ ď s tach ´sacm ď δq; a :" s tach ´sacm ε ; t tach :" t Y`9

α β ˝disc β cont α cont β disc α disc α disc β disc α cont β cont α disc α disc β
s eng " a, 9 t " 1 & 0 ď t ´ttach ď ε ˘¯T he tachymeter's behavior senses the speed s eng and decides of the targeted speed s tach . It set the acceleration a followed by the engine's behavior. The test t tach `ε ě t at the beginning of Tach ensures that there is at most ε seconds between two execution of the tachymeter. t tach records the last instant the controller have executed. α fi pdisc α Y cont α q ˚and β fi pdisc β Y cont β q ˚. We have:

Algebraic properties

α ˝β fi `disc α Y disc β Y pcont α ˝c cont β q ˘˚pUnfold definition of ˝q fi `disc β Y disc α Y pcont α ˝c cont β q ˘˚pCommutativity of Yq fi `disc β Y disc α Y pcont β ˝c cont α q ˘˚pCommutativity of
β fi pdisc β Y cont β q ˚and γ fi pdisc γ Y cont γ q ˚. pα ˝βq ˝γ fi ´`disc α Y disc β Y pcont α ˝c cont β q ˘˚¯˝γ pUnfold definition of ˝q fi ´pdisc α Y disc β q Y disc γ Y `pcont α ˝c cont β q ˝c cont γ ˘¯˚p Unfold definition of ˝q fi ´disc α Y pdisc β Y disc γ q Y `pcont α ˝c cont β q ˝c cont γ ˘¯˚p Associativity of Yq fi ´disc α Y pdisc β Y disc γ q Y `cont α ˝c pcont β ˝c cont γ q ˘¯˚p Associativity of ˝cq fi α ˝´`d isc β Y disc γ Y pcont β ˝c cont γ q ˘˚¯p
Fold definition of ˝q fi α ˝pβ ˝γq pFold definition of ˝q

Conclusion

We have defined a parallel composition operator for Cyber-Physical Systems.

It is syntactically defined, and thus amenable to automation. It enjoys two important algebraic properties: commutativity and associativity. The associativity property allows to consider the construction of a system step-by-step.

Comparison with the parallel composition of hybrid action systems

We compare our parallel composition operator ˝with the parallel composition for hybrid systems presented by Ronkko et al. [START_REF] Rönkkö | Action systems with continuous behaviour[END_REF]. We briefly present the hybrid action systems. The second part is devoted to a detailed comparison of both approaches.

Hybrid action systems

We first define what is a hybrid action system. It is used to model reactive components, possibly non-terminating.

Definition 23 (Action system). An action system is an initialized block of the form:

A " | r var X : T X :" E; do A 1 } . . . }A n od s | : Z var X : T declares the list of variables X of type T . The variables can be global or local. Global variables can be shared with other action systems. Z declares the imported global variables that are used in A 1 , . . . , A n , but do not belong to X. The action X :" E initializes the variables X by expressions E. After the initialization, the actions A 1 , . . . , A n are repeatedly executed when it is possible. There is no fairness assumption and the choice is non-deterministic.

Actions can be assignment X :" E, sequence A; B, non-deterministic choice }, or a guard p Ñ A where p is a predicate and A an action.

Example 27 (Tachymeter). The tachymeter example presented in the Example 21 is represented by the following action system: T ACH " | r var t tach : R, s acm : R, s tach : R, a : R s acm :" s eng , s tach :" s eng , a :" 0; do t tach `ε ě t Ñ `sacm :" s eng ; s tach :" ˚; p0 ď s tach ď S ^´δ ď s tach ´sacm ď δq Ñ pa :" s tach ´sacm ε ; t tach :" tq ˘od s | : s eng , ε, t, S, δ

We first declare the variables t tach , s acm , s tach , a since they are the bounds variables of the system and type them with R. Then we initialize them. The specification is very similar to our definition in Example 21. The two differences are that the test ?t tach `ε ě t; . . . is written t tach `ε ě t Ñ . . . and the iteration symbol ˚is not explicit since the semantic of do . . . od is the one of a while loop. Finally, we have to declare the variables s eng , ε, t, S, δ as imported.

Definition 24 (Differential action). A differential action is of the form e : 9

X " F pXq where e is a guard and 9

X " F pXq is a system of differential equations.

The notation in dL would be 9

X " F pXq & e.
Definition 25 (Hybrid action system). A hybrid action system is an initialized block of the form: H " | r var X : T X :" I; alt D with DA s | : Z alt D with DA is equivalent to do gD Ñ D}�gD Ñ DA od. All the discrete actions D must execute before the differential action may execute. Thus, discrete changes have a priority over continuous changes.

Time is assumed to pass linearly during a continuous evolution and do not evolves with a discrete change. It is the same assumption as in dL.

Differences with our approach

The methodology is similar. The parallel composition of discrete parts is their interleaving via the non-deterministic choice. They define a special parallel composition for continuous components and integrate it with the discrete case.

There are two main differences. Discrete changes have a priority in their system and it restricts the expressiveness of their approach. The second difference is that the parallel continuous composition is linear. Definition 26. Linear parallel composition The linear parallel composition of differential actions e 1 : 9

X " F pXq and e 2 : 9 X " GpXq result in the following action:

e 1 ^e2 : 9 X " F pXq `GpXq } e 1 ^�e 2 : 9 X " F pXq } �e 1 ^e2 : 9 X " GpXq
The linear parallel composition is associative. But it induces an exponentially increasing number of system of differential equation. It goes against the ideal of scalability. Plus, to our knowledge, most of the CPS of interest share the same evolution domain. They have made the choice of linear parallel composition to implement their approach in HyTech [START_REF] Thomas A Henzinger | Hytech: A model checker for hybrid systems[END_REF].

Relation to the meta-theory of Benveniste

In this section, we discuss how our contributions so far relate to the meta-theory of contract developed by Benveniste et al. [START_REF] Benveniste | Contracts for system design[END_REF].

Component The authors define a component as an open system with typed inputs and which generates outputs. Our definition of a component (Def. [START_REF] Benveniste | The synchronous languages 12 years later[END_REF]) is a reactive open system under the form of a hybrid program. The inputs are a part of the free variables of the hybrid program. They are not typed since every variable in dL is valuated in R. The outputs are defined by the bound variables of the hybrid program.

Environment In the meta-theory, the environment of a component corresponds to other components and the exterior world, i.e. variables that are not outputs of a component. In our work, the environment is only the exterior world. We dissociate the other components to clarify our approach.

Contract The authors define a contract as a pair composed of a subset of components and a subset of environment. It is a very abstract definition. The first subset is the one of components that implement the contract. The second subset represents the environments in which the contract can operate. When it comes to concrete contract-based design theories, they state two important properties. The contract needs to have a finite description that does not directly refer to the actual components. The implementation relation needs to be effectively computable.

In our work, a contract is defined by a pair of formulas pA, Gq. It is thus a finite description that does not refer to the component which is under the form of a hybrid program α. The implementation relation corresponds to the validity of the formula A Ñ rαsG. It is indeed computable since there is syntactic rules to decide it.

Composition of components

The authors define a composition operator to support horizontal processes. It must satisfies two important algebraic properties: commutativity and associativity. The operator we have defined in the Definition 22 exhibit theses two properties.

The authors define also a composability criterion. It must be a syntactic property on pairs of component that defines conditions under which the two components can interact. The two components must not share common outputs. It is one of the condition presented in the next section to be allowed to derive the satisfiability of the conjunction of contracts by the composition of components. They define also a compatibility criterion on contracts which is that there exists an environment in which the two contracts properly interact. It corresponds to the conditions pbq and pcq of the theorem of the next section.

The authors have presented a meta-theory for contracts listing the right properties that a contract-based theory must exhibit. Our component-based approach in dL matches the stated characteristics. They present also two other contract operators: contract refinement and contract conjunction. We think that it is possible to extend our approach to instantiate theses constructs.

Conclusion

After having presented the definition of a component in dL in Section 3.1, we have defined a parallel composition operator to build a system from its parts. The operator is associative and commutative, which is mandatory to modularly design a system. It is also syntactical, making it amenable to automation.

We want to prove that the system resulting from the composition of component is correct. Proving correctness of each individual component is not enough. We have to be able to transfer the correctness of the component to the global system. In the next section, we state and prove the theorem which allow to transfer the proof of correctness through composition. It provides a proof that the result of the composition of two components satisfies the contract pA α ^Aβ , G α ^Gβ q provided that each component satisfies their respective contracts pA α , G α q and pG α , G β q.

Modular proof

We want to transfer the proof of correctness of component through composition. More precisely, let A and B be components with behaviors α and β and contracts pA α , G α q and pA β , G β q. If A and B satisfy their respective contracts, then we want that the component AB resulting from the composition of A and B satisfies the contract pA α ^Aβ , G α ^Gβ q. In dL, it means that if we have a proof tree for the sequents E, A α $ rαsG α and E, A β $ rβsG β , then we want to automatically derive a proof tree for the sequent E, A α , A β $ rα ˝βspG α ^Gβ q.

We present in Subsection 3.3.1 the necessary syntactic conditions to prove the desired theorem. We prove a technical result in Subsection 3.3.2. We state and prove in Subsection 3.3.3 the theorem for the parallel continuous composition operator ˝c. In Subsection 3.3.4, we consider the case where both components are discrete, then in Subsection 3.3.5, the case where one component is discrete and the second one is continuous. Last, we consider the case where both components are general in Subsection 3.3.6.

Necessary conditions

There is three necessary conditions that components must respect to transfer the proof of correctness through composition. They must not share the same outputs. The guarantees of a component must not refer to the output of the other component. The assumptions of a component must be implied by the relevant guarantees of the other component.

No common outputs The outputs of each component must be dissociated. Otherwise, it means that two components A and B intervene on the same output, and thus have same the same purpose.

In dL, it means that the bound variables of each behaviors are distinct, i.e. BV pαq X BV pβq " H; the behaviors α and β cannot modify the same variable. Otherwise, the execution of α ˝β may make no sense and the sequent E, A α , A β $ rα ˝βspG α ^Gβ q may also be invalid although E, A α $ rαsG α and E, A β $ rβsG β are valid.

Example 28 (Composition with same outputs). Let α " px :" 10q ˚and β " px :" 100q ˚be two hybrid programs. We can easily prove rαspx ď 15q and rβspx ď 100q, but not rα ˝βspx ď 15 ^x ď 100q which is equivalent to rpx :" 10 Y x :" 100q ˚spx ď 15 ^x ď 100q. As soon as the last loop iteration assigns 100 to x, the left-handside px ď 15q of the formula does not hold anymore.

Guarantees do not refer to exterior outputs

The second condition requires that the guarantees of the component A do not refer to outputs of the component B, i.e. it does not depend of the behavior of an other component. The converse is also true. It would be aberrant for a tachymeter to refer to the fuel's level of a vehicle.

In dL, it means that variables occurring in G α (resp. G β ) must not be bound in β (resp. α). The condition amounts to:

V arpG α q X BV pβq " H and V arpG β q X BV pαq " H Example 29 (Guarantee dependent of another component). Let α " px :" 10q ˚and β " py :" 100q ˚be two hybrid programs. Assume that G β refers to bound variables of α, e.g. if G β fi x ě 42. It is easy to prove that it is an invariant of β, i.e. x ě 42 $ rpy :" 100q ˚sx ě 42 is valid. But it is not an invariant of the component α˝β; the sequent x ě 42 $ rpx :" 10; y :" 100q ˚sx ě 42 is not valid. As soon as the last loop iteration assigns 10 to x, the formula x ě 42 does not hold anymore.

It is graphically represented in the Figure 3.12. A correct guarantee would refer to the output y. For the continuous case, we request also that the evolution domain of the discrete fragment of a component does not refer to outputs of the other continuous fragment. We request that V arpH X q X BV pcont β q and V arpH Y q X BV pcont α q.

Assumptions are not falsified by exterior components A last condition is that the guarantees G α of a component A must implies the assumptions A β of the component B that refers to outputs of A, and conversely. It means that the execution of A do not break the assumptions under which B operated.

In dL, it is translated by the condition that the sequents A β $ @ α pG α Ñ A β q and A α $ @ β pG β Ñ A α q are valid.

Example 30 (Assumption not implied by other guarantee). Let α " px :" 10q ˚and β " py :" xq ˚be two behaviors, G α fi J, A β fi x " 4 and G β fi y " 4. The sequents $ rαsJ and x " 4 $ rβsy ě 4 are valid. Yet, the sequent x " 4 $ rpx :" 10 Y y :" xq ˚sy " 4 is clearly not valid. A first iteration assigns 10 to the variable x, then a second assigns x to y. We have then y " x " 10 which contradicts y " 4. We believe that theses conditions may be weakened if we develop a more complex model of communications such as in Hybrid Communicating Sequential Processes [START_REF] Jifeng | From csp to hybrid systems[END_REF]. HCSP processes uses outputs ch!e to send a message e along a channel ch and inputs ch?x to receive a message along the channels ch. Such channels are unique and thus to an output corresponds precisely an input. It allows a more subtle management of inputs and outputs during the composition. We detail some preliminary results in the future works Section 5.1.3.

We present in the next section a technical result needed to achieve the proofs in Subsection 3.3.3 and 3.3.6. They are related to the conditions we have presented.

Technical result

We state and demonstrate an useful technical result, the separation lemma, to achieve the proof of Theorems 1, 2, 3 and 4. It is to make use of the condition that the guarantee of a component must not refer to outputs of another component. We recall the definition of the skolemization of formulas, a notion needed in next subsections.

Definition 27 (Skolemization). We denote by @ α ϕ the skolemization of a formula with respect to the bound variables of its hybrid program α. (We will use the shorter notation ϕ α where unambiguous).

Example 31. Recall that BV pEngineq " ts eng u. The skolemization of G tach by the behavior Engine is G eng tach fi @s eng , G tach .

Separation lemma We need a lemma which state that if the guarantees G α of a component A do not refer to the outputs of the other component B, i.e. they are separated, then B does not affect G α .

Lemma 1 (Separation). Let α be a behavior of a component and ϕ a formula such that BV pαq X V arpϕq " H. Then the skolemization ϕ α is equivalent to ϕ, i.e. ϕ α Ø ϕ.

Proof. We prove the lemma by induction on the structure of the formula ϕ.

Let ϕ be an atomic formula, e.g. x ě θ. We have to prove that the equivalence @ α x ě θ ÐÑ x ě θ is valid. We recall that the bound variables of α are separated of the free variables of ϕ. We first prove that @ α x ě θ Ñ x ě θ. ax x ě θ $ x ě θ @ l @ α x ě θ $ x ě θ We apply the proof rule @ l to eliminate the quantification in the left-hand side of the sequent. Since the quantification is over variables that are not present in the atomic formula x ě θ, it leaves it unchanged. We conclude using the axiom rule. We reason similarly for the second implication x ě θ Ñ @ α x ě θ.

ax x ě θ $ x ě θ @ r x ě θ $ @ α x ě θ
We apply the proof rule @ r , and since the quantification is over variables that are not present in the atomic formula x ě θ, it leaves the right-hand side unchanged. We conclude using the axiom rule.

Let ϕ be the conjunction ϕ 1 ^ϕ2 and we assume that the formula ϕ α i Ø ϕ i (i " 1, 2) is valid under the assumption that BV pαq X V arpϕ i q (i " 1, 2) is empty. We have to prove that the formula @ α pϕ 1 ^ϕ2 q ÐÑ ϕ 1 ^ϕ2 is valid assuming that BV pαq X V arpϕ 1 ^ϕ2 q. By definition of quantification, @ α pϕ 1 ^ϕ2 q is equivalent to p@ α ϕ 1 q ^p@ α ϕ 2 q. By induction hypothesis, ϕ α i Ø ϕ i (i " 1, 2), and thus p@ α ϕ 1 q ^p@ α ϕ 2 q ÐÑ ϕ 1 ^ϕ2 . Let ϕ be an universally quantified formula @x, ϕ 0 . Again, we assume that the formula @ α ϕ 0 ÐÑ ϕ 0 is valid under the assumption that the intersection BV pαq X V arpϕ 0 q is empty. By definition, @ α @xϕ 0 is equivalent to @x@ α ϕ 0 . By applying the induction hypothesis, we obtain the formula @xϕ 0 .

For two continuous components

We first state the theorem for the composition of components at the textual representation level. We state and prove after the equivalent result with behaviors in dL 1.

Theorem. Let A and B be two components with continuous behaviors and respective contracts pA α , G α q and pA β , G β q. Assume that they both satisfy their contracts. Furthermore, assume that paq A.outputs X B.outputs " H, pb 1 q A.outputs is separated from G β and H Y , pb 2 q B.outputs is separated from G α and H X , pc 1 q G α must implies the assumptions A β that refers to outputs of A, pc 2 q G β must implies the assumptions A α that refers to outputs of B.

Then the component AB resulting from the parallel composition of A and B satisfies the conjunction of contracts pA α ^Aβ , G α ^Gβ q.

The conditions paq, pbq and pcq are detailed in Subsection 3.3.1. The first assumption paq assumes components to have separate internal variables and requires them to define disjoint output variables (i.e. unique definitions), which essentially amounts to good modeling practice. The second assumption pb 1 q (resp. pb 2 q) requires the safety property G α (resp. G β ) to guard the behavior of the system α (resp. β), i.e. its outputs, and of course not βs (resp. α).

It hence seems natural to require its separation with G β (resp. G α ). The condition pc 1 q (resp. pc 2 q) requires the assumptions A β (resp. A α ) to be implied by the guarantees G α (resp. G β ).

Recall that the behavior α of a component A is the form α fi 9 X " θ X & H X and that the behavior

β of a component B is of the form β fi 9 Y " θ Y & H Y .
Theorem 1. Let α and β be two continuous behaviors of components A and B with respective contracts pA α , G α q and pA β , G β q. Assume that we have two proof trees of E, A α $ rαsG α and E, A β $ rβsG β respectively, where E is the environment. Furthermore, assume that paq BV pαq X BV pβq " H, pb 1 q BV pαq X F V pG β q " H and BV pαq X F V pH Y q " H, pb 2 q BV pβq X F V pG α q " H and BV pβq X F V pH X q " H,

pc 1 q E, A α $ @ β pG β Ñ A α q, pc 2 q E, A β $ @ α pG α Ñ A β q.
Then it exists a proof tree of E, A α , A β $ rα ˝c βspG α ^Gβ q.

Proof. Let α and β be two continuous behaviors of components A and B, and assume that we have a proof tree P α of E, A α $ rαsG α and a proof tree

P β of E, A β $ rβsG β . We have α fi 9 X " θ X & H X and β fi 9 Y " θ Y & H Y .
The composition is still a continuous component and we want a proof tree of E, A α , A β $ rα ˝c βspG α ^Gβ q by using the proofs P α and P β . We inspect all the rules that can be applied in P α to prove the sequent E, A α $ rαsG α (resp. for the proof tree P β of E, A β $ rβsG β ) and for each particular association, we give a proof of E, A α , A β $ rα ˝c βspG α ^Gβ q.

Inspection of proof rules We can apply the following rules to the sequent E, A α $ rαsG α : differential invariant [DI], ODE solution [ODEsolve], differential weakening [DW], differential cut [DC], Cut and generalization [Gen]. The rules cut, generalization and differential cut do not decompose the ODE since we still have to prove rαsG α in one of the premises. For example, if we apply the rule Cut, we have the following proof tree:

E, A α $ rαsG α , ϕ E, A α , ϕ $ rαsG α Cut E, A α $ rαsG α
We still have to prove the modality rαsG α in the right premise. This careful inspection shows that there are only three rules to consider: We consider four cases :

• [DI]-[DI]
Where the two have been proved using the rule [DI]: we apply also the rule [DI] to the sequent representing the contract of the composite. It is divided in three sub-cases:

-Where both ODEs are independent, i.e. the output of one component is not an input of the other -Where one ODE refers to the other, but the converse is false, i.e. the input of one component is an input of the other -Where both ODEs refer to the other.

The first sub-case basically means that they do not interfere, the proof is thus simple.

For the second case, we use the fact that the guarantee of a component implies the assumptions of the other to guarantee a safe composition. In the last sub-case, we show that we get back to the second sub-case.

• If E, A α $ rαsG α and E, A β $ rβsG β are proved by using rule [DI], then we have a proof tree of this form for P α :

P H X E, A α , H X $ G α P 1 α E, A α , H α X $ pG 1α α q θ X 9 X Ñ r E, A α $ H α X Ñ pG 1α α q θ X 9 X @ r E, A α $ @ α pH X Ñ pG 1 α q θ X 9 X q [DI] E, A α $ r 9 X " θ X & H X sG α The notation ϕ θ X 9 X
stands for the formula ϕ where all the occurrences of 9 X are replaced by θ X . The left part of the tree is P H X and the right part P 1 α . We can derive a similar proof tree for E, A β $ rβsG β . We use these sub-parts to close goals of the proof tree of

E, A α , A β $ r 9 X, 9 Y " θ X , θ Y & H X ^HY spG α ^Gβ q. We have to prove the sequent E, A α , A β $ r 9 X, 9 Y " θ X , θ Y & H X ^HY spG α ^Gβ q.
We have to be very careful to the fact that the body of an ODE refers to a derived variable on the other component, e.g. if α fi 9

x " y and y is derived in β. When we reason individually on α, y is assumed to be constant, but when we compose it became a changing value. We have three possibilities : there is no references, one refers to the other but the converse is false, and they both refers to the other. We consider each possibility separately.

Systems are independent We consider the case where both systems are independent, e.g. α fi 9

x " 3t and β fi 9 y " 42. Thus we assume here that θ X (resp. θ Y ) does not refer to outputs of β (resp. αq, i.e. that F V pθ X q X BV pβq " H (resp. F V pθ Y q X BV pαq " H).

We first apply the rule [DI] with G α ^Gβ as invariant.

E, A α , A β , H X , H Y $ G α ^Gβ E, A α , A β $ @ αβ `pH X ^HY q Ñ pG 1 α ^G1 β q θ X θ Y 9 X 9 Y ˘[DI] E, A α , A β $ r 9 X, 9 Y " θ X , θ Y & H X ^HY spG α ^Gβ q
The left premise correspond to the initial step. We apply the rule ^r to split the goal and end up with the sequent

E, A α , A β , H X , H Y $ G α and E, A α , A β , H X , H Y $ G β .
By assumption, we have the proof tree P H X and P H Y to conclude.

P H X E, A α , A β , H X , H Y $ G α P H Y E, A α , A β , H X , H Y $ G β ^r E, A α , A β , H X , H Y $ G α ^Gβ
The second premise is the differential induction step. We have to prove the sequent

E, A α , A β $ @ αβ `pH X ^HY q Ñ pG 1 α ^G1 β q θ X θ Y 9 X 9 Y
˘to finish our proof tree.

Thanks to the condition paq and pbq, the formula pG

1 α ^G1 β q θ X θ Y 9 X 9 Y is equivalent to the formula pG 1 α q θ X 9 X ^pG 1 β q θ Y 9 Y
. Since the outputs of each component are dissociated and G α does not contain occurrences of bound variables of β, i.e. of Y , the substitution of 9 Y by θ Y does not have any effect on G α . Idem for G β .

We apply the rule @ r to eliminate the universal quantification in the goal. By applying the separation lemma (Lemma 1) to the evolution domain H X ^HY , the resulting sequent is

E, A α , A β $ pH α X ^Hβ Y q Ñ ppG 1 α q θ X 9 X ^pG 1 β q θ Y 9 Y
q αβ where the superscript α (resp. β) in G 1α α means that the bound variables of α (resp. β) occurring in G 1 α are replaced by fresh variables. The conditions pb1q and pb2q allows to apply the separation lemma to pG 1 α q θ X 9 X

and pG 1 β q θ Y 9 Y

. Thus, we have the sequent

E, A α , A β $ pH α X ^Hβ Y q Ñ pppG 1 α q θ X θ Y 9 X 9 Y q α ^ppG 1 β q θ X θ Y 9 X 9 Y q β q. E, A α , A β $ pH α X ^Hβ Y q Ñ pppG 1 α q θ X 9 X q α ^ppG 1 β q θ X 9 X q β q @ r E, A α , A β $ @ αβ `pH X ^HY q Ñ pG 1 α ^G1 β q θ X θ Y 9 X 9 Y
We apply successively the rules Ñ r and ^l to pass the left-hand side of the implication on the hypothesis.

E, A α , A β , H α X , H β Y $ ppG 1 α q θ X 9 X q α ^ppG 1 β q θ X 9 X q β ^l E, A α , A β , H α X ^Hβ Y $ ppG 1 α q θ X 9 X q α ^ppG 1 β q θ X 9 X q β Ñ r E, A α , A β $ pH α X ^Hβ Y q Ñ pppG 1 α q θ X 9 X q α ^ppG 1 β q θ X 9 X q β q
We split the conjunction. The left premise is closed by P 1 α . the second premise is closed by

P 1 β . E, A α , A β , H αβ X , H β Y $ ppG 1 α q θ X 9 X q αβ P 1 β E, A α , A β , H αβ X , H β Y $ ppG 1 β q θ Y 9 Y q β ^r E, A α , A β , H αβ X , H β Y $ ppG 1 α q θ X 9 X q αβ ^ppG 1 β q θ Y 9 Y q β
For the left goal, either θ X does not refer initially to bound variables of β, and we can thus conclude by P 1 α . Either, occurrences of y have been replaced by f pzq and we can thus conclude by the proof tree p 1 α 0.

Application of rule [DI]

Initial step

P H X P H Y

Differential induction step

Separation lemma (with conditions paq, pb1q and pb2q) One system is dependent of the other We assume here that one system is dependent of the other, e.g. the speed equations 9 v " a, 9

x " v. Here the second part of the equation refers to the derived variable in the first part. More formally, we assume that F V pθ X q X BV pβq " tyu and F V pθ Y q X BV pαq " H. It is easy to generalize it to a set of variables.

If we conduct the proof as in the previous case, we will have trouble with the skolemization step. Indeed, y will be captured and it will not be possible to use A α to retrieve the proof tree P 1 α . Before applying the differential induction rule [DI], we introduce G β in the evolution domain thanks to the rule (Cut).

E, A α , A β $ r 9 X, 9 Y " θ X , θ Y & H X ^HY sG β [DC] E, A α , A β $ r 9 X, 9 Y " θ X , θ Y & H X ^HY spG α ^Gβ q E, A α , A β $ r 9 X, 9 Y " θ X , θ Y & H X ^HY ^Gβ spG α ^Gβ q
The left premise is closed exactly as for the case where the continuous systems are independent. By assumption, α will not interfere and the proof follows without trouble.

We introduce now the formula A α in the evolution domain of the right premise. The skolemization step will now include A α and we will be able to retrieve the proof tree P 1 α .

E, A α , A β $ r 9 X, 9 Y " θ X , θ Y & H X ^HY ^Gβ sA α [DC] E, A α , A β $ r 9 X, 9 Y " θ X , θ Y & H X ^HY ^Gβ spG α ^Gβ q E, A α , A β $ r 9 X, 9 Y " θ X , θ Y & H X ^HY ^Gβ ^Aα spG α ^Gβ q
The left premise is closed by an application of the proof rule [DW] and the use of the condition pcq.

E, A α , A β $ @ αβ `pH X ^HY ^Gβ q Ñ A α ˘[DW] E, A α , A β $ r 9 X, 9 Y " θ X , θ Y & H X ^HY ^Gβ sA α
For the right premise, we now apply the differential induction rule [DI] to the sequent

E, A α , A β $ r 9 X, 9 Y " θ X , θ Y & H X ^HY ^Gβ ^Aα spG α ^Gβ q. E, A α , A β $ pH X ^HY ^Gβ ^Aα q Ñ pG α ^Gβ q [DI] E, A α , A β $ r 9 X, 9 Y " θ X , θ Y & H X ^HY ^Gβ ^Aα spG α ^Gβ q E, A α , A β $ @ αβ `pH X ^HY ^Gβ ^Aα q Ñ pG 1 α ^G1 β q θ X θ Y 9 X 9 Y
We now apply the skolemization step as in the previous case and we can conclude.

Both systems are dependent of the other We consider now the case where both systems are dependent of the other, e.g. 9

x " y, 9 y " x. Recall that we assume that our ODEs possess a solution f ptq. Assume that f ptq is such solution for the differential equation 9 y " x. We can then replace y in the differential equation 9

x " y by f ptq. Notice that f ptq may contain occurrences of x. We have now the following system 9

x " f ptq, 9 y " x and we are in the second situation that have already been considered.

(rule [ODESolve])

We consider the case where E, A α $ r 9

X " θ X & H X sG α is proved by the use of the rule [ODEsolve], which means that we find an explicit solution w.r.t. time to the ODE and we replace each occurrence of X in G α by this solution. We show that, given a proof using the rule [ODEsolve], we can derive a proof using the differential invariant rule [DI]. This leads us back to the previous situation. We do the proof with only one variable, X. It is easy to generalize it to a system of ODEs. Our reasoning is inspired from [98, p. 247]. By hypothesis, we have the following rule for [ODEsolve]

E, A α $ @t ě 0p@0 ď t ď t, pH X q yp tq X q Ñ pG α q yptq X [ODEsolve] E, A α $ r 9 X " θ X & H X sG α
yptq is the solution of the ODE 9 X " θ X . Let us introduce a fresh variable t to stand for time in the ODE. It will be evaluated after the rule [DI] by using the differential auxiliaries rule [DA].

E, A α $ r 9 X " θ X , 9 t " 1 & H X sG α [DA] E, A α $ r 9 X " θ X & H X sG α
Also, the solution of the ODE shall contain an occurrence of the initial value. To remember it, we use the auxiliary variable rule [IA].

E, A α $ rX 0 :" Xsr 9 X " θ X , 9 t " 1 & H X sG α [IA] E, A α $ r 9 X " θ X , 9 t " 1 & H X sG α
The proof tree of E, A α $ rαsG α using the rule [DI] is in the Figure 3.3.3. To introduce the solution as an invariant, we use the generalization rule [gen].

Π 1 E, A α , X 0 " ypt 0 q $ G 0 α Ñ r E, A α $ X 0 " ypt 0 q Ñ G 0 α @ r E, A α $ @X@t, X " yptq Ñ G α ax E, A α , H X $ X " yp0q ax E, A α , H X $ θ X " θ X (i) E, A α , H X $ pX " yptqq 1θ X 1 9 X 9 t Ñ r E, A α $ H X Ñ pX " yptqq 1θ X 1 9 X 9 t @ r E, A α $ @X, H X Ñ pX " yptqq 1θ X 1 9 X 9 t [DI] E, A α $ r 9 X " θ X , 9 t " 1 & H X sX " yptq [gen] E, A α $ r 9 X " θ X , 9 t " 1 & H X sG α
By hypothesis, we assume a proof P of $ ϕ ypt 0 q X . Here, t 0 is the fresh variable introduced by the rule @ r , idem for X 0 and ϕ 0 . On the branch Π 1 , we apply exactly the same logical rules that the ones applied in P . For the logical connectives, there is no problem since the structure is similar. We need to pay a little more attention to the case of arithmetic over reals. Indeed, suppose we have proved ypt 0 q ď θ X in P . Then, we will have to prove X 0 ď θ in the proof of G 0 α . Fortunately, we also know that X 0 " yptq by hypothesis. Hence the conclusion by applying basic arithmetic.

For the left premise of rule [DI], we must remember that it is here to prove the initial condition: the property at time t " 0, i.e. to ensure that the initials conditions prove the (inductive) safety property. But the value of X is exactly yp0q, so we can conclude with the axiom rule. For the right premise, we just perform the substitution and the step (i) is justified by the same reasoning as for [DI].

([DW]-[DW])

We still need to prove the differential weakening case. The proofs are of the following form:

P α E, A α , H α X $ G α α Ñ r E, A α $ H α X Ñ G α α @ r E, A α $ @ α pH X Ñ G α q [DW] E, A α $ r 9 X " θ X & H X sG α
Once E, A α $ rαsG α and E, A β $ rβsG β are both proved by the mean of differential weakening, then the proof of the composition is the following:

P α E, A α , A β , H α X , H β Y $ G α α P β E, A α , A β , H α X , H β Y $ G β β ^r E, A α , A β $ pH α X ^Hβ Y q Ñ pG α α ^Gβ β q @ r E, A α , A β $ @ αβ `pH X ^HY q Ñ pG α ^Gβ q ˘[DW] E, A α , A β $ rα ˝c βspG α ^Gβ q
It is a very simple case, where the evolution domains are sufficient to prove the safety properties. We first apply the differential weakening rule [DW]. Then the quantification rule which results in the sequent E, A α , A β $ pH α X ^Hβ Y q Ñ pG α α ^Gβ β q thanks to the separation lemma and conditions paq, pb1q and pb2q. We split then the conjunction and ends up with premises

E, A α , A β , H α X , H β Y $ G α α and E, A α , A β , H α X , H β Y $ G β β .
They are closed by the proof tree P α and P β .

([DI]-[DW])

Assume that E, A α $ rαsG α have been proved by the use of rule [DI] and E, A β $ rβsG β by rule [DW]. The idea is to add G α into the evolution domain of α ˝c β using the differential cut rule [DC].

E, A α , A β $ r 9 X, 9 Y " θ X , θ Y & H X ^HY sG α [DC] E, A α , A β $ r 9 X, 9 Y " θ X , θ Y & H X ^HY spG α ^Gβ q E, A α , A β $ r 9 X, 9 Y " θ X , θ Y & H X ^HY ^Gα spG α ^Gβ q
The left premise requires to prove that G α is an invariant of α ˝c β. We can follow the methodology for the case where both components have been proved by differential induction with J as invariant of G β . The right premise requires to prove that G α ^Gβ is an invariant of α ˝c β. We apply the differential weakening rule [DW].

E, A α , A β $ @ αβ `pH X ^HY ^Gα q Ñ pG α ^Gβ q ˘[DW] E, A α , A β $ r 9 X, 9 Y " θ X , θ Y & H X ^HY ^Gα spG α ^Gβ q
We apply the skolemization step with the rule @ r and, thanks to the separation lemma (cf Lemma 1) with conditions paq, pb1q and pb2q, we obtain the sequent

E, A α , A β $ pH α X Ĥβ Y ^Gα α q Ñ pG α α ^Gβ β q. E, A α , A β $ pH α X ^Hβ Y ^Gα α q Ñ pG α α ^Gβ β q @ r E, A α , A β $ @ αβ `pH X ^HY ^Gα q Ñ pG α ^Gβ q
We apply successively the rules Ñ r , ^l and ^r.

ax E, A α , A β , H α X , H β Y , G α α $ G α α P β E, A α , A β , H α X , H β Y , G α α $ G β β ^r E, A α , A β , H α X , H β Y , G α α $ G α α ^Gβ β ^l E, A α , A β , H α X , H β Y ^Gα α $ G α α ^Gβ β ^l E, A α , A β , H α X ^Hβ Y ^Gα α $ G α α ^Gβ β Ñ r E, A α , A β $ pH α X ^Hβ Y ^Gα α q Ñ pG α α ^Gβ β q
The left branch is closed by the rule ax. The right sequent is closed by P β as in the case of [DW]-[DW].

When we compose two components with continuous behaviors, the Theorem 1 ensures that the resulting component satisfies the conjunction of contracts. We have a similar result for the composition of purely discrete components in Subsection 3.3.4.

For two discrete components

As in the previous subsection, we have a theorem ensuring that we retain contracts through parallel composition of purely discrete components. The conditions are similar to the Theorem 1.

Theorem. Let A and B be two discrete components with respective contracts pA α , G α q and pA β , G β q. Assume that they both satisfy their contracts. Furthermore, assume that paq A.outputs X B.outputs " H, pb 1 q A.outputs is separated from G β pb 2 q B.outputs is separated from G α , pc 1 q G α must implies the assumptions A β that refer to outputs of A pc 2 q G β must implies the assumptions A α that refer to outputs of B.

Then the component AB resulting from the parallel composition of A and B satisfies the conjunction of contracts pA α ^Aβ , G α ^Gβ q.

We have the equivalent theorem with the behaviors in dL.

Theorem 2. Let α and β be two discrete behaviors of components A and B with respective contracts pA α , G α q and pA β , G β q. Assume that we have two proof trees of E, A α $ rαsG α and E, A β $ rβsG β respectively, where E is the environment. Furthermore, assume that paq BV pαq X BV pβq " H, pb 1 q BV pαq X F V pG β q " H, pb 2 q BV pβq X F V pG α q " H,

pc 1 q E, A α $ @ β pG β Ñ A α q, pc 2 q E, A β $ @ α pG α Ñ A β q.
Then it exists a proof tree of E, A α , A β $ rα ˝βspG α ^Gβ q.

The conditions are similar to the Theorem 1, except for conditions pb1q and pb2q where we do not refer to the evolution domain as it is non-existent since we are working with purely discrete components.

Proof. Assume α fi rpdisc α q ˚s and β fi rpdisc β q ˚s are two behaviors of component A and B respecting the conditions above. The composition α ˝β is given by the behavior pdisc α Y disc β q ˚. Given the proof of contracts E, A α $ rαsG α and E, A β $ rβsG β , we want to prove the sequent E, A α , A β $ rα ˝βspG α ^Gβ q.

An application of the rule [Ind] have been necessary to prove the sequent E, A α $ rpdisc α q ˚sG α . It results in two premises : the initial step and the induction step. We assume that we have a proof tree P initα such that the premise corresponding to the initial step is closed by P initα . For the second premise, we apply the proof rule @ r to skolemize bound variables of α. We recall that the superscript α on a formula or a hybrid program means that we have replaced every occurrences of bound variables of α by fresh variables. The remaining goal E, A α , G α α $ rdisc α α sG α α is closed by the proof tree P indα .

P initα E, A α $ G α P indα E, A α , G α α $ rdisc α α sG α α Ñ r E, A α $ G α α Ñ rdisc α α sG α α @ r E, A α $ @ α pG α Ñ rdisc α sG α q [Ind] E, A α $ rpdisc α q ˚sG α
We apply a similar reasoning to the proof of the sequent β fi rpdisc β q ˚s. We have thus the proof tree P init β and P ind β .

To prove the sequent E, A α , A β $ rpdisc α Y disc β q ˚spG α ^Gβ q, we apply the rule [Ind].

E, A α , A β $ G α ^Gβ E, A α , A β $ @ αβ `pG α ^Gβ q Ñ rdisc α Y disc β spG α ^Gβ q ˘[Ind] E, A α , A β $ rpdisc α Y disc β q ˚spG α ^Gβ q
The left premise corresponds to the initial step. We have to prove that both guarantees hold after zero executions. We split the goal with the rule ^r and obtain two premises that correspond to the initial step of each individual proof. They are closed by using the proof trees P initα and P init β .

P initα E, A α , A β $ G α P init β E, A α , A β $ G β ^r E, A α , A β $ G α ^Gβ
The right premise corresponds to the induction step. We first apply the skolemization step with the rule @ r to the sequent E, A α , A β $ @ αβ `pG α ^Gβ q Ñ rdisc α Y disc β spG α ^Gβ q ˘.

E, A α , A β $ pG αβ α ^Gαβ β q Ñ rdisc αβ α Y disc αβ β spG αβ α ^Gαβ β q E, A α , A β $ @ αβ `pG α ^Gβ q Ñ rdisc α Y disc β spG α ^Gβ q
We can apply the separation lemma (cf Lemma 1) since the bound variables are dissociated (condition paq) and the variables of G α (resp. G β ) are different from the bound variables of β (resp. α) (conditions pb 1 q and pb 2 q). Thus, the sequent

E, A α , A β $ pG αβ α ^Gαβ β q Ñ rdisc αβ α Y disc αβ β spG αβ α ^Gαβ β q is equivalent to E, A α , A β $ pG α α ^Gβ β q Ñ rdisc αβ α Y disc αβ β spG α α ^Gβ β q.
We apply the rule Ñ r to this sequent followed by the rule ^l to pass in the hypothesis pG α α

^Gβ β q. E, A α , A β , G α α , G β β $ rdisc αβ α Y disc αβ β spG α α ^Gβ β q ^l E, A α , A β , G α α ^Gβ β $ rdisc αβ α Y disc αβ β spG α α ^Gβ β q Ñ r E, A α , A β $ pG α α ^Gβ β q Ñ rdisc αβ α Y disc αβ β spG α α ^Gβ β q
The next step is to split disc αβ α Y disc αβ β with the non-deterministic rule rYs to consider separately their action. We obtain two premises which are similar to handle. We consider only the case of the left premise, i.e. the sequent E, A α , A β , G α α , G β β $ rdisc αβ α spG α α ^Gβ β q, the second one is closed by the same reasoning.

E, A α , A β , G α α , G β β $ rdisc αβ α spG α α ^Gβ β q E, A α , A β , G α α , G β β $ rdisc αβ β spG α α ^Gβ β q rYs E, A α , A β , G α α , G β β $ rdisc αβ α Y disc αβ β spG α α ^Gβ β q
We have to prove the sequent E, A α , A β , G α α , G β β $ rdisc αβ α spG α α ^Gβ β q. We split the guarantees by using the rule [BoxAnd] since they are of different nature. G α α is a guarantee of the component A and we have already a proof by assumption. G β β is a guarantee of the component B, but it is not affected by the execution of α thanks to the conditions paq and pbq.

E, A α , A β , G α α , G β β $ rdisc αβ α sG α α E, A α , A β , G α α , G β β $ rdisc αβ α sG β β [BoxAnd] E, A α , A β , G α α , G β β $ rdisc αβ α spG α α ^Gβ β q
We have a proof tree P indα of E, A α , G α α $ rdisc α α sG α α and we want to close the left premise :

E, A α , A β , G α α , G β β $ rdisc αβ α sG α α .
Here disc α α differs from disc αβ α by the variables of β that are captured by the skolemization. We can not make use of the assumption A α to conclude since it may refer to bound variables of β.

The condition pcq states that the sequent A α $ G β β Ñ A β α is valid. We introduce the formula G β β Ñ A β α with the cut rule (Cut).

E, A α , A β , G α α , G β β , G β β Ñ A β α $ rdisc αβ α sG α α E, A α , A β , G α α , G β β $ rdisc αβ α sG α α , G β β Ñ A β α (Cut) E, A α , A β , G α α , G β β $ rdisc αβ α sG α α
The right premise is closed by the assumption that we have a proof of G β β Ñ A β α . For the left premise, we can deduce the formula A β α in the hypothesis thanks to an application of the rule Ñ l . The left premise is closed by the rule ax.

ax E, A α , A β , G α α , G β β $ G β β , rdisc αβ α sG α α E, A α , A β , G α α , G β β , A β α $ rdisc αβ α sG α α Ñ l E, A α , A β , G α α , G β β , G β β Ñ A β α $ rdisc αβ α sG α α
We are left with the right sequent

E, A α , A β , G α α , G β β , G β β Ñ A β α , A β α $ rdisc αβ α sG α α ,
and by assumption we have a proof P α of it.

To prove the remaining sequent E, A α , A β , G α α , G β β $ rdisc αβ α sG β β , we symbolically execute disc αβ α . Since G β β does not contain any bound variables of α (and thus of disc αβ α ), it is not affected. We conclude then by the rule ax.

ax E, A α , A β , G α α , G β β $ G β β Symbolic execution E, A α , A β , G α α , G β β $ rdisc αβ α sG β β
We have a summary of the structure of the proof tree in the Figure 3.15.

For a discrete component and a continuous component

We consider the case where one discrete component A is composed with a continuous component B. We mix here reasoning for discrete and continuous composition, and thus have to be very careful for the composition. As for the two previous section, we state the theorem for the components expressed with the textual representation and the equivalent results with behaviors.

Theorem. Let A be a discrete component and B be a continuous component with respective contracts pA α , G α q and pA β , G β q. Assume that they both satisfy their contracts. Furthermore, assume that paq A.outputs X B.outputs " H, pb 1 q A.outputs is separated from G β pb 2 q B.outputs is separated from G α , pc 1 q G α must implies the assumptions A β that refer to outputs of A pc 2 q G β must implies the assumptions A α that refer to outputs of B.

Then the component AB resulting from the parallel composition of A and B satisfies the conjunction of contracts pA α ^Aβ , G α ^Gβ q.

Application of rule [Ind]

Initial step

P Initα P Init β

Induction step

Separation lemma (with conditions paq, pb1q and pb2q)

Application of rule rYs Theorem 3. Let α be the discrete behaviors of a component A and β be the continuous behavior of a component B with respective contracts pA α , G α q and pA β , G β q. Assume that we have two proof trees of E, A α $ rαsG α and E, A β $ rpβq ˚sG β respectively, where E is the environment. Furthermore, assume that paq BV pαq X BV pβq " H, pb 1 q BV pαq X F V pG β q " H and BV pαq X F V pH Y q " H, pb 2 q BV pβq X F V pG α q " H,

pc 1 q E, A α $ @ β pG β Ñ A α q, pc 2 q E, A β $ @ α pG α Ñ A β q.
Then it exists a proof tree of E, A α , A β $ rα ˝βspG α ^Gβ q.

We also require that the bound variables of the discrete behavior do not occur in the evolution domain H Y of β. It is similar to the condition pb1q of the Theorem 1.

There is a major point to consider in this theorem. Instead of assuming having a proof of the sequent E, A β $ rβsG α , we assume having a proof of E, A β $ rpβq ˚sG α . Indeed, when we compose, the differential equation is now under an iteration. Thus, it may not access to assumptions due to supplementary skolemization. We provide a counter-example to show that without this assumption, the theorem does not hold.

Example 32 (Counter-example). Assume that the behavior of our continuous component is 9 x " y & x " y. Its contract is pJ, x ď 10q and the initial value of x is 0. It is simple to obtain a proof of the sequent x " 0 $ r 9

x " y & x " ysx ď 10. Indeed, we have that 9

x " 0, and thus x does not evolve. Since it is initialized at 0, we have that x ď 10.

Let compose it with a behavior disc α of a discrete component and with contract pJ, Jq. The behavior resulting from the composition is pdisc α Y 9

x " y & x " yq ˚. We want to prove the following sequent:

x " 0 $ rpdisc α Y 9

x " y & x " yq ˚sx ď 10

We start by applying the induction rule [Ind] and obtain two sub-goals, one for the initial step, the other for the induction step.

x " 0 $ x ď 10

x " 0 $ @x, px

ď 10 Ñ rdisc α Y 9 x " y & x " ysx ď 10q [Ind] x " 0 $ rpdisc α Y 9 x " y & x " yq ˚sx ď 10
Consider the induction step. We apply the rule @ r and replace the variable x by the fresh variable x 0 . We then split the behavior between disc α and 9

x " y & x " y by using the rule rYs.

x " 0 $ x 0 ď 10 Ñ rdisc α sx 0 ď 10

x " 0 $ x 0 ď 10 Ñ r 9

x 0 " y & x 0 " ysx 0 ď 10 rYs x " 0, x 0 ď 10 $ rdisc α Y 9

x 0 " y & x 0 " ysx 0 ď 10 Ñ r x " 0 $ x 0 ď 10 Ñ rdisc α Y 9

x 0 " y & x 0 " ysx 0 ď 10 @ r x " 0 $ @x, px ď 10 Ñ rdisc α Y 9

x " y & x " ysx ď 10q

The sequent x " 0 $ x 0 ď 10 Ñ r 9

x 0 " y & x 0 " ysx 0 ď 10 is clearly not valid. For example, if x 0 " 1 at the initialization, then we have x 0 ď 10, y " 1, and thus 9

x 0 " 1. As x 0 is evolving linearly, we have that the formula x 0 ď 10 will not hold at some point.

Proof. The behavior α is of the form pdisc α q ˚since it is a purely discrete component. We assume to have a proof tree of the sequent E, A α $ rpdisc α q ˚sG α . It is the same assumption as in the proof of Theorem 2.

Π initα E, A α $ G α Π indα E, A α , G α α $ rdisc α α sG α α Ñ r E, A α $ G α α Ñ rdisc α α sG α α @ r E, A α $ @ α pG α Ñ rdisc α sG α q [Ind] E, A α $ rpdisc α q ˚sG α
The behavior β of the continuous component B is of the form 9

Y " θ Y & H Y . We assume to have a proof tree of the sequent E, A β $ rp 9

Y " θ Y & H Y q ˚sG β . It has the following shape.

Π init β E, A β $ G β Π step β E, A β , G β β $ rp 9 Y " θ Y q β & H β Y sG β β Ñ r E, A β $ G β β Ñ rp 9 Y " θ Y q β & H β Y sG β β @ r E, A β $ @ β pG β Ñ r 9 Y " θ Y & H Y sG β q [Ind] E, A β $ rp 9 Y " θ Y & H Y q ˚sG β
We first apply the induction rule and then the skolemization step (rule @ r ). Notice that occurrences of bound variables of β in H Y are replaced by fresh variables, which is the meaning of the notation H β Y . Recall that the parallel composition of α and β results in the behavior `disc α Y p 9

Y " θ Y & H Y q ˘˚. We provide a proof tree for the sequent

E, A α , A β $ r `disc α Y p 9 Y " θ Y & H Y q ˘˚spG α ^Gβ q.
We first apply the induction rule [Ind] with pG α ^Gβ q as invariant.

E, A α , A β $ G α ^Gβ E, A α , A β $ @ αβ `pG α ^Gβ q Ñ rdisc α Y p 9 Y " θ Y & H Y qspG α ^Gβ q Ȇ, A α , A β $ r `disc α Y p 9 Y " θ Y & H Y q ˘˚spG α ^Gβ q
We obtain two sub-goals, one corresponding for the initial step and one for the induction step. The first sub-goal is handled as in the proof of the previous Theorem 2. We split the formula G α ^Gβ using the rule ^and then use the proof tree Π initα and Π init β to conclude.

We consider the second sub-goal E, A α , A β $ @ αβ `pG α ^Gβ q Ñ rdisc α Y p 9 Y " θ Y & H Y qspG α ^Gβ q ˘. We apply the rule @ r to replace all occurrences of bound variables of α and β in the formula pG α ^Gβ q Ñ rdisc α Y p 9

Y " θ Y & H Y qspG α ^Gβ q. We denote by G αβ α the effect of this replacement on the formula G α .

The step piq is the application of the separation Lemma 1. Indeed, from conditions pb1q and pb2q, we deduce that G αβ α is equivalent to G α α . It justifies the fact that we obtain the sequent

E, A α , A β $ pG α α ^Gβ β q Ñ rdisc αβ α Y `p 9 Y " θ Y q αβ & H β Y ˘spG α α ^Gβ β q.
We apply successively the rules Ñ r and ^l to pass the formula pG α α ^Gβ β q into the hypothesis.

E, A α , A β , G α α , G β β $ rdisc αβ α Y `p 9 Y " θ Y q αβ & H β Y ˘spG α α ^Gβ β q ^l E, A α , A β , G α α ^Gβ β $ rdisc αβ α Y `p 9 Y " θ Y q αβ & H β Y ˘spG α α ^Gβ β q E, A α , A β $ pG α α ^Gβ β q Ñ rdisc αβ α Y `p 9 Y " θ Y q αβ & H β Y ˘spG α α ^Gβ β q piq E, A α , A β $ pG αβ α ^Gαβ β q Ñ rdisc αβ α Y `p 9 Y " θ Y q αβ & H β Y ˘spG αβ α ^Gαβ β q @ r E, A α , A β $ @ αβ `pG α ^Gβ q Ñ rdisc αβ α Y `p 9 Y " θ Y q αβ & H β Y ˘spG α ^Gβ q Ȏur next step is to split the hybrid program disc αβ α Y `p 9 Y " θ Y q αβ & H β
Y ˘in two with the non-deterministic choice rule rYs. We have two cases to consider: the execution of the discrete part and the execution of the continuous part.

E, A α , A β , G α α , G β β $ rdisc αβ α spG α α ^Gβ β q E, A α , A β , G α α , G β β $ rp 9 Y " θ Y q αβ & H β Y spG α α ^Gβ β q rYs E, A α , A β , G α α , G β β $ rdisc αβ α Y `p 9 Y " θ Y q αβ & H β Y ˘spG α α ^Gβ β q
The left sub-goal, E, A α , A β , G α α , G β β $ rdisc αβ α spG α α ^Gβ β q, is handled as in the proof of the Theorem 2. We detail the proof tree for the right sub-goal,

E, A α , A β , G α α , G β β $ rp 9 Y " θ Y q αβ & H β Y spG α α ^Gβ β q. We first split the formula G α α ^Gβ
β under the modality with the rule [BoxAnd]. We then carefully consider the two sub-goals.

E, A α , A β , G α α , G β β $ rp 9 Y " θ Y q αβ & H β Y sG α α E, A α , A β , G α α , G β β $ rp 9 Y " θ Y q αβ & H β Y sG β β [BoxAnd] E, A α , A β , G α α , G β β $ rp 9 Y " θ Y q αβ & H β Y spG α α ^Gβ β q
For the first sub-goal,

E, A α , A β , G α α , G β β $ rp 9 Y " θ Y q αβ & H β Y sG α α , remember that G α does not contain any occurrences of bound variables of 9 Y " θ Y & H Y .
Thus the evolution of the differential equation does not affect G α α . We symbolically execute it to obtain the sequent which is closed by the axiom rule.

ax E, A α , A β , G α α , G β β $ G α α Symbolic execution E, A α , A β , G α α , G β β $ rp 9 Y " θ Y q αβ & H β Y sG α α It remains to prove the sequent E, A α , A β , G α α , G β β $ rp 9 Y " θ Y q αβ & H β Y sG β β .
Using the condition pc2q, we obtain A β β in the hypothesis. We conclude with the branch Π step β .

For two general components

We have shown in Subsection 3.3.3 how to retain contracts in the case of the parallel composition of two continuous components. We have proved a similar theorem in Subsection 3.3.4 for the case of the parallel composition of two purely discrete components. In Subsection 3.3.5, we have proved how to retain contracts when we compose discrete component with continuous component. We state the main theorem which reunite the previous results for the case of the parallel composition of general components, i.e. with both discrete and continuous aspects.

Theorem. Let A and B be two components with behaviors of the general form and respective contracts pA α , G α q and pA β , G β q. Assume that they both satisfy their contracts. Furthermore, assume that paq A.outputs X B.outputs " H, pb 1 q A.outputs is separated from G β pb 2 q B.outputs is separated from G α , pc 1 q G α must implies the assumptions A β that refers to outputs of A pc 2 q G β must implies the assumptions A α that refers to outputs of B.

Then the component AB resulting from the parallel composition of A and B satisfies the conjunction of contracts pA α ^Aβ , G α ^Gβ q.

Recall that the behavior α of a general component is of the form pdisc α Y cont α q ˚, where cont α is a differential equation with evolution domain H X . Theorem 4. Let α and β be two behaviors of general form of components A and B with respective contracts pA α , G α q and pA β , G β q. Assume that we have two proof trees of E, A α $ rαsG α and E, A β $ rβsG β respectively, where E is the environment. Furthermore, assume that paq BV pαq X BV pβq " H, pb 1 q BV pαq X F V pG β q " H and BV pαq X F V pH Y q " H, pb 2 q BV pβq X F V pG α q " H and BV pβq X F V pH X q " H,

pc 1 q A α $ @ β pG β Ñ A α q, pc 2 q A β $ @ α pG α Ñ A β q.
Then it exists a proof tree of E, A α , A β $ rα ˝βspG α ^Gβ q.

The proof uses the same mechanism as in the proofs of Theorems 1, 2 and 3.

Proof. Recall that the behavior α of component A is of the form pdisc α Y cont α q ˚. As in previous theorems, we assume to have a proof tree of the sequent E, A α $ rpdisc α Y cont α q ˚sG α . It is of the following form:

Π initα E, A α $ G α Π ind discα E, A α , G α α $ rdisc α α sG α α Π ind contα E, A α , G α α $ rcont α α sG α α rYs E, A α , G α α $ rdisc α α Y cont α α sG α α Ñ r E, A α $ G α α Ñ rdisc α α Y cont α α sG α α @ r E, A α $ @ α pG α Ñ rdisc α Y cont α sG α [Ind] E, A α $ rpdisc α Y cont α q ˚sG α
We have the same for the proof of the sequent E, A β $ rpdisc β Y cont β q ˚sG β Recall that the behavior of the resulting component is

α ˝β fi `disc α Y disc β Y pcont α ˝c cont β q ˘˚.
We apply the induction rule [Ind]. We obtain two sub-goals: the initial step piq and the induction step piiq. The first step piq is handled exactly as for the discrete case or for the continuous case with rule [DI].

For the last sequent E, A α , A β $ @ αβ `pG α ^Gβ q Ñ rpdisc α Y disc β q Y cont αβ spG α ^Gβ q ˘, we first apply the skolemization rule, and then the non-deterministic choice rule rYs (cf Figure 3.17).

As shown in the Figure 3.17

E, A α , A β $ G α ^Gβ piiq E, A α , A β $ @ αβ `pG α ^Gβ q Ñ rpdisc α Y disc β q Y pcont α ˝c cont β qspG α ^Gβ q [Ind] E, A α , A β $ rpdisc α Y disc β Y cont α ˝c cont β q ˚spG α ^Gβ q
rYs E, A α , A β , G αβ α ^Gαβ β $ rpdisc αβ α Y disc αβ β q Y cont αβ αβ spG αβ α ^Gαβ β q Ñ r E, A α , A β $ pG αβ α ^Gαβ β q Ñ rpdisc αβ α Y disc αβ β q Y cont αβ αβ spG αβ α ^Gαβ β q @ r E, A α , A β $ @ αβ `pG α ^Gβ q Ñ rpdisc α Y disc β q Y cont αβ spG α ^Gβ q Ȇ, A α , A β , G αβ α ^Gαβ β $ rdisc αβ α Y disc αβ β spG αβ α ^Gαβ β q E, A α , A β , G αβ α ^Gαβ β $ rcont αβ αβ spG αβ α ^Gαβ β q Figure 3
.17: Induction step

The proof follows the distinction between the discrete part and the continuous one. We now consider the proof of the Cruise-Control component.

Example 33 (Contract of the cruise-control). The Tachymeter and Engine components respect the conditions of the Theorem 4:

• The outputs are separated. We have BV pEngineq " ts eng u and BV pTachq " ts acm , s tach , au, thus BV pEngineq X BV pTachq " H.

• The guarantees do not refers to exterior outputs. We have V arpG eng q " ts eng u and V arpG tach q " ts acm , s tach , au. It is easy to check that BV pEngineq X V arpG tach q " H and BV pTachq X V arpG eng q " H.

• The guarantees imply the assumptions. We have A eng fi G tach and A tach fi G eng . It is thus trivial to verify A eng $ @ tach pG tach Ñ A eng q and A tach $ @ eng pG tach Ñ A eng q.

Thus, by application of the Theorem 4, the following sequent is valid:

E, A cruise $ rCruise-controlsG cruise
where A cruise fi A eng ^Atach and G cruise fi G eng ^Gtach . The Cruise-Control satisfies its contract, and we have obtained this proof automatically.

We have exhibited in this section a methodology to lift the contracts of individual components through composition. If components A and B satisfies their respective contracts pA α , G α q and pA β , G β q, then the compound component AB resulting from the parallel composition satisfies the contract pA α ^Aβ , G α ^Gβ q.

The next section is devoted to the presentation of the implementation of a prototype in KeYmaera X. We have successfully passed the cruise-controller example.

A prototype in KeYmaera X

We have implemented a prototype using the tactic language Bellerophon in KeYmaera X to demonstrate the feasibility of our approach. We present the tactic language Bellerophon in Subsection 3.4.1 and exemplify with the Fibonacci Example 1. We present the structure of our prototype in Subsection 3.4.2. The cruise-controller have been verified using this example.

Presentation of Bellerophon

Bellerophon is a tactic language for the proof of hybrid systems and a library implemented in KeYmaera X. It is both a stand-alone language and a Domain-Specific Language in the Scala programming language [START_REF] Fulton | Bellerophon: Tactical theorem proving for hybrid systems[END_REF][START_REF] Fulton | Keymaerax: An axiomatic tactical theorem prover for hybrid systems[END_REF].

It has been developed to provide decision procedures and heuristics for the theorem proving of hybrid systems in KeYmaera X. It aims to ease proof automation.

It uses built-in tactics that can be combined through several tactic combinators. Builtin tactics directly manipulate the KeYmaera X core to transform formulas in a validitypreserving manner. They correspond either to specific rules of the sequent calculus, e.g. the tactic andR which corresponds to the rule ^r, or correspond to heuristics, e.g. the tactic prop corresponds to the repeated application of propositional rules until they are not applicable.

Definition 28 (Tactic combinators).

e 1 , e 2 ::" τ | epvq | e 1 &e 2 | e 1 |e 2 | e ˚|?peq |ă pe 1 , e 2 , . . . , e n q | abbrvP pxq " ϕ in e τ is a built-in tactic. epvq applies a tactic e to a list of positions or formulas. e 1 &e 2 is the sequential composition of two tactics; it applies the tactic e 2 on the output of e 1 . e 1 |e 2 applies e 2 if e 1 fails. e ˚repeatedly applies the tactic e as long as it is applicable. ?peq applies e if it does not result in a error. ă pe 1 , e 2 , . . . , e n q is used when there is n subgoals; it applies e 1 to the first subgoal, e 2 to the second subgoal, etc. abbrvP pxq " ϕ in e replaces all occurrences of ϕ with P pxq in the current subgoal, and then applies e. After e, remaining occurrences of P pxq are uniformly substituted back to ϕ. Example 34 (Fibonacci example). Remember that the hybrid program representing the Fibonacci sequence is Fibonacci fi pF n :" F n`1 ; F n`1 :" F n`2 ; F n`2 :" F n`1 `Fn q ˚(cf Definition 1) and we want to prove the following formula pF n " 0 ^Fn`1 " 1 ^Fn`2 " 1q Ñ rFibonaccisF n`2 " F n`1 `Fn (cf proof tree 2.33).

We can find the .kyx file of the Fibonacci example in the annex 5.3.2. It is proved in KeYmaera X by the following tactic: implyR(1) ; loop({`Fn2=Fn1+Fn`}, 1) ; <( QE, closeId, composeb(1) ; assignb(1) ; composeb(1) ; assignb(1) ; assignb(1) ; QE )

The tactic implyR( 1) is the application of the rule Ñ r to pass the initial values in the hypothesis. Then, the tactic loop({`Fn2=Fn1+Fn`}, 1) apply the rule [Ind2] with F n2 " F n1`F n as invariant. It opens three sub-goals.

The first one requires that the invariant F n2 " F n1 `F n holds at the initialization. We apply the rule QE to apply Real Arithmetic and conclude. The second sub-goal is trivial since the invariant introduced in [Ind2] is the same as the original formula.

The third sub-goal deal with the induction step. We deconstruct step-by-step the hybrid program by applying the tactics composeb(1) and assignb(1) corresponding to rules r; s and r:"s. We conclude then by the rule QE.

Implementation in KeYmaera X

We detail how we have implemented the process described in the proof of Theorems 1, 2, 3 and 4. We define a tactic corresponding for each case; one for the case where both components are continuous, one where both are discrete, one for the case of one discrete component and one continuous component and one for the case of general components.

Continuous-continuous case

We follow the structure of the proof of the Theorem 1. In the theorem, we assume to have a proof of the satisfaction of contract for each component. We have discussed that the proof can be achieved by using either the Differential Induction rule [DI], the rule [ODESolve] where we provide a solution of the differential equation and the Differential Weakening rule [DW]. We consider each association that can arise, e.g. the use of rule [DI] for both proof of satisfaction of their respective contracts by components, and show how to exhibit a proof tree from them.

We define a tactic continuousComposition which try a sub-tactic for each possible association. We have a sub-tactic for the case where both proofs use the Differential Induction rule [DI], one for the case where both proofs use the Differential Weakening rule [DW], and one for the case where one proof use the Differential Induction rule and the other one the Differential Weakening rule. We do not consider the case where we use the rule [ODESolve] since we can always relate it to the case of Differential Induction rule [DI]. Finally, we combine each sub-tactic with the combinator |.

val continuousComposition: BelleExpr = ( di2 | dw2 | dwdi | didw )
We detail each sub-tactic di2, dw2, dwdi and didw.

DI-DI

We consider the case where both cases have been proved with the differential induction rule [DI]. We require the user to provide the tactic used to proved the initial step (tactic baseStep1) and the differential induction step (tactic diffInductionStep1). They correspond to the proof trees P H X and P 1 α in the proof of Theorem 1. We have the same for the second component (baseStep2 and diffInductionStep2).

. )

We follow the procedure presented in the proof of the Theorem 1. We apply the Differential Induction rule [DI] (tactic dI('diffInd)(1)) and consider the initial step and the differential induction step. We split the goal corresponding to the initial step with the rule ^r (tactic andR('R)) and use our two assumptions baseStep1 and baseStep2 to conclude. In the induction step, the sequent is of the form

E, A α , A β $ r 9 X :" θ X ; 9 Y :" θ Y sG 1 α ^G1 β .
We perform all the assignments with the tactic chase('R) and split the resulting goal in two. We use then our assumptions diffInductionStep1 and diffInductionStep2.

) & chase('R) & andR('R) <( diffInductionStep1, diffInductionStep2 )
) )

The Differential Induction rule in KeYmaera X is implemented by the tactic dI with several degrees of automation. We have chosen to consider only the case corresponding to the version of the rule we have presented in the Chapter 2, the other cases are for future works.

DW-DW

We consider the case where the proof of satisfaction of contracts of both components have been achieved with the Differential Weakening rule [DW]. We follow the structure of the proof of the Theorem 1. First, we require the user to provide the tactics tacticDW1 and tacticDW2 used to achieve each respective proof. We follow the structure of the proof of the Theorem 1. We first add the guarantee of the first component into the evolution domain using the Differential Cut rule [DC] (tactic dC(invariant1)( 1)). It results in two sub-goals. We close the first sub-goal by applying the Differential Weakening rule [DW] (tactic dW('R)) and split the current goal in two parts. The first part is trivial to handle since it requires to prove the formula G α (equivalent to invariant1) under the assumption G α , hence the use of the tactic master(). The second part is closed by using our assumptions baseStep1 and diffInductionStep1. We define also a symmetrical tactic dwdi for the inverse case.

Conclusion

We have presented how to implement several of the possible associations considered in the proof of the Theorem 1. The implementation is not complete and does not cover every possibility in KeYmaera X, but it shows the feasibility of such implementation.

Discrete-discrete case

We present the tactic corresponding to the case where both components are purely discrete. The behavior α of the first component is assumed to be purely discrete and is of the form α fi pdisc α q ˚. Given the contract pA α , G α q, its satisfaction is obtained by the proof of the sequent E, A α $ rpdisc α q ˚sG α . The proof tree is obtained by the use of Induction rule [Ind] and is closed by the branches Π Initα and Π Stepα . We require to the user to provide the tactics corresponding to these two steps. We also require to have the guarantee G α . In a .kyx file, the sequent is of the form $ A Ñ rαsG. We apply the rule Ñ r (tactic implyR(1) to pass the left-hand side of the implication on the hypothesis. We then apply the induction rule [Ind] with the conjunction of guarantees. It yields three steps: the initial step, the use step and the induction step. For the first one, we split the goal in two with the rule ^r (tactic andR('R)) and then use our assumptions (tactics baseStep1 and baseStep2). The second one corresponds to the case where we want to strengthen the invariant, but we do not need it here, hence the use of the tactic master() to close this trivial goal. For the third one, we apply the induction tactic detailed below.

val inductionStepTactic: BelleExpr = ( choiceb(1) & andR('R) <( boxAnd(1) & andR('R) <( inductionStep1, V(1) & master() ), boxAnd(1) & andR('R) <( V(1) & master(), inductionStep2 ) ) )
We follow the structure in the proof of Theorem 2. Recall that the sequent we want to prove is of the form E, A α , A β , G α , G β $ rdisc α Y disc β spG α ^Gβ q. We first apply the non-deterministic choice rule rYs (tactic choiceb(1)) and split the resulting goal in two with the rule ^r (tactic andR('R)). We obtain two branches which are similar. In the first one, we split the formula under the modality with the rBoxAnds rule (tactic boxAnd(1)) and the rule ^r. It yields two cases; one where we have to prove that G α holds after one execution of disc α and one where we have to prove that G β holds after one execution of disc α . We use our assumption inductionStep1 for the first case. For the second, we apply the symbolic execution (tactic V(1)) and then apply the tactic master().

Discrete-continuous case

The exact same tactic can be applied for the composition of a discrete component with a continuous component. Indeed, given a continuous component with behavior β and contract pA β , G β q, we require to have a proof of the sequent E, A β $ rβ ˚sG β instead of a proof of the sequent E, A β $ rβsG β . The tactic inductionStep1 corresponds to the branch Π ind β . The tactic related to the continuous nature are present in the induction step.

General case

We present the tactic corresponding to the case where both components are general, i.e. with discrete and continuous evolution. We follow the structure of the proof of the Theorem 4. As previously, we require the user to provide the tactics baseStep1, discInductionStep1 and contInductionStep1 which corresponds to the proof trees Π initα , Π ind discα and Π ind contα . We have the corresponding tactics baseStep2, discInductionStep2 and contInductionStep2 for the second component.

. )

We also require the user to provide the guarantees invariant1 and invariant2 for each contract. We apply the induction rule (tactic loop) with the conjunction of guarantees (And(invariant1, invariant2)) as invariant. We consider the three resulting sub-goals. The first two are handled exactly as in the case of composition of discrete components. For the third sub-goal corresponding to the induction step, we use the non-deterministic choice rule rYs (tactic choiceb) to separate the discrete part from the continuous part. We apply the tactic inductionStepTactic for the discrete part. It is exactly the same as in the case of purely discrete components. For the continuous part, we use the tactic continuousComposition.

Conclusion

We have presented the implementation of a prototype for our parallel composition operator. It follows the structure of the proofs of Theorems 1, 2, 3 and 4 and shows the feasibility of an implementation. Yet, it not a complete and usable implementation. We have to take care of all variations of rules in KeYmaera X. There is also other problems due to the implementation of a theoretical process into an actual implementation, e.g. there is a difference between formulas G α ^Gβ ^Gγ and pG α ^Gβ q ^Gγ although they are theoretically equivalent. We leave to future works such complete implementation.

Study of a water-plant example

We present a water-plant example. It is a use-case with four components to exemplify associativity. It is composed of two water-tanks with their respective controllers. The water-tank example in Figure 3.18 is a simple example of a cyber-physical system. The water-level wl 1 inside the tank can go down or up depending if the inlet valve f in is open or not. There is a hole at the bottom of the tank which provokes an assumed constant outlet flow f out 1 . The inlet valve is commanded by a monitor, which is a standard computer program. It decides the opening according to the value of the measured water-level wlm 1 by the sensor which repeatedly senses the value of the water-level. The controller is made of the monitor, the sensor and the actuator. It is a time-triggered example.

Flow out (fout)

Water-level A second version is possible where the actuation is on the outlet flow f out 1 and the inlet flow f in is assumed to be constant. When connecting theses two version together, we obtain a simple water-plant as in Figure 3.19.

We detail in Subsection 3.5.1 the environment under which the water-plant operates and the initial conditions. The Subsections 3.5.2 and 3.5.3 are devoted respectively to the presentation of the water-level and of the controller component. We compose them in Subsection 3.5.4 to obtain the water-tank example. In Subsection 3.5.5, we present the water-plant obtained by the composition of two water-tanks. The last Subsection 3.5.6 discuss some limitations and the solutions that we provide in the Chapter 4.

Environment and initial conditions

We present the environment under which the water-plant should operate. It refers to global variables that are not modified by any components, e.g. the maximum water-level allowed.

$ ' ' ' ' ' ' & ' ' ' ' ' ' % wl 1 " 5 wl 2 " 5 wlm 1 " 5 wlm 2 " 5 f in " 0 f out 2 " 0
The formula E wp is thus the following conjunction: δ 1 " 0.03 ^δ2 " 0.02 ^wlmax 1 " wlmax 2 " 7 ^wlmin 1 " wlmin 2 " 3 ^f out 1 " 0.75 ^t " t ctrl 1 " t ctrl 2 " 0 ^wl 1 " wl 2 " 5 ^wlm 1 " wlm 2 " 5 ^f in " f out 2 " 0

Water-level

The Water-level1 component is the continuous evolution of the water-level of the first tank. It depends of the inlet and outlet flow.

I/O and contract

The Water-level1 component is defined in the Figure 3.20. The inputs are the value of the measured water-level (wlm 1 ) by the controller and the inlet flow (f in). The assumptions A wl 1 correspond to the guarantees G ctrl 1 provided by the controller. There is only one output: the water-level wl 1 . The guarantee G wl 1 ensures that the water-level stays within the defined range r3, 7s. We add the solution of the differential equation as a guarantee. It is necessary to specify the relation between the measured water-level and the real water-level because we are in a time-triggered version. It requires a deep knowledge of the timing behavior of the system. The behavior is denoted by Wl1 and is detailed in the Definition 29.

Name: Water-level1 Inputs:

f in // inlet flow wlm 1 // measured water-level Assumptions: G ctrl 1 Outputs: wl 1 // water-level Guarantees: 3 ď wl 1 ď 7 wl 1 " pf in ´f out 1 qpt ´tctrl 1 q `wlm 1 Behavior: Wl1 We can notice that the solution of the differential equation introduced as a guarantee of the Water-level1 component refers to f in and wlm 1 which are outputs of the controller (cf Figure 3.18). It is not an issue with respect to the Theorem 4 since we show that the solution is also a guarantee of the controller.

Behavior of Water-level1

The behavior of the Water-level1 component is a differential equation. It is defined as the difference between the inlet flow f in and the outlet flow f out 1 .

Definition 29 (Water-level behavior). The behavior Wl1 of the water-level of the first tank is defined by the following differential equation:

9 wl 1 " f in ´f out 1 , 9 t " 1 & pwl 1 ě 0 ^t ě 0 ^0 ď t ´tctrl 1 ď δ 1 q
The evolution of the component is the difference between the inlet flow f in and the outlet flow f out 1 . We add in the evolution domain the formula 0 ď t ´tctrl 1 ď δ 1 which restricts the evolution of the water-level to a duration of δ 1 seconds. We use a similar mechanism in the cruise-controller example (cf Example 26).

Implementation We have implemented the component as a model in KeYmaera X. The corresponding .kyx file is in the annex 5.3.2. The proof that the component Water-level1 satisfies its contract is achieved with the proof tactic master in KeYmaera X. The Figure 3.21 sum it up with the green tick meaning that we have a proof of the satisfaction of the contract.

Water-level1

Wl1

A wl 1 : G ctrl 1 G wl 1 : 3 ď wl 1 ď 7 wl 1 " pf in ´f out 1 qpt ´tctrl 1 q `wlm 1 � f in

I/O and contract

The component is detailed in the Figure 3.22. The only input is the water-level wl 1 . The assumption A ctrl 1 correspond to the guarantee of the water-level. It requires that the water-level stays in the predefined range r3, 7s and that the solution of the differential equation is respected. The outputs are the measured water-level (wlm 1 ) and the inlet flow (f in). The guarantees G ctrl 1 state that wlm 1 is within the range r3, 7s. They also state that if the measured water-level is below 3.5 (wlm 1 ď 3.5), then the inlet valve is opened (f in " 1). Conversely, if the measured water-level is above 6.5 (wlm 1 ě 3.5), then the inlet valve is closed (f in " 0). If the water-level is between these two values (3.5 ď wlm 1 ď 6.5), the inlet valve can be either closed or opened (f in " 1 _ f in " 0). Finally, we add the solution of the differential equation as a guarantee. It is indeed a guarantee since after the execution of the controller, we have t " t ctrl 1 (thus t ´tctrl 1 " 0) and wl 1 " wlm 1 .

Name: Controller Inputs: wl 1 // measured water-level Assumptions: G wl 1 Outputs: f in // flow in wlm 1 // measured water-level Guarantees: 3 ď wlm 1 ď 7 3.5 ě wlm 1 Ñ f in " 1 wlm 1 ě 6.5 Ñ f in " 0 p3.5 ď wlm 1 ď 6.5q Ñ pf in " 0 _ f in " 1q wl 1 " pf in ´f out 1 qpt ´tctrl 1 q `wlm 1 Behavior: WlCtrl1 `?t ď t ctrl 1 `δ1 ; wlm 1 :" wl 1 ; p?wlm 1 ě 6.5; f in :" 0q Y p?wlm 1 ď 3.5; f in :" 1q; t ctrl 1 :" t ˘It is made up of three parts : a temporal part, a sensing and the decision part. The temporal part is the test ?t ď t ctrl 1 `δ1 and the assignment t ctrl 1 :" t. The test ensures that the component executes at most every δ 1 seconds. The assignment remembers the last execution. The sensing is implemented by wlm 1 :" wl 1 where the value of the water-level wl 1 is assigned to the variable wlm 1 . The decision part is a standard if-then-else encoding.

Implementation We have implemented the component as a model in KeYmaera X. The corresponding .kyx file is in the annex 5.3.2. The proof that the component Controller1 satisfies its contract is achieved with the proof tactic master in KeYmaera X. The Figure 3.23 sum it up with the green tick meaning that we have a proof of the satisfaction of the contract.

Water-tank

The Water-tank1 component is obtained by the parallel composition of the Water-level1 component and the Controller1 component.

Parallel composition of the controller with the Water-level The inputs (resp. outputs) of the Water-tank1 component are the union of the inputs (resp. outputs) of the Water-level1 component and the Controller1 component. The assumptions A wt 1 (resp.

Controller1

WlCtrl1 A summary of the parallel composition is given in the Figure 3.24. Notice that for now, we have a proof of satisfaction of their contract by the components Water-level1 and Controller1. We do not still have a proof that the component Water-tank1 satisfies its contract.

A ctrl 1 : G wl 1 G ctrl 1 : wlm 1 ď 3.5 Ñ f in " 1 6.5 ď wlm 1 Ñ f in " 0 p3.5 ě wlm 1 ě 6.5q Ñ pf in " 0 _ f in " 1q 3 ď wlm 1 ď 7 wl 1 " pf in ´f out 1 qpt ´tctrl 1 q `wlm 1 � wl 1 f in wlm 1
Behavior of Water-tank The behavior WT1 of the Water-tank component is presented in the Definition 31.

Definition 31 (Water-tank behavior). The behavior WT1 of the first tank results from the parallel composition of Wl1 and WlCtrl1.

ˆ`?t ď t ctrl 1 `δ1 ; wlm 1 :" wl 1 ; p?wlm 1 ě 6.5; f in :" 0q Y p?wlm 1 ď 3.5; f in :" 1q; t ctrl 1 :" t Y`9 wl 1 " f in ´f out 1 , 9

t " 1 & pwl 1 ě 0 ^t ě 0 ^δ1 ě t ´tctrl 1 ě 0 ^t ě t ctrl 1 q ˘˙T he addition of temporal constraints makes sense once we have composed the components. The variable t ctrl 1 remembers the instant of the last execution of the controller. It is then equal to t. The water-level evolves along the time, and the difference between t and t ctrl 1 grows until it reaches δ 1 . Then we know that the controller has to execute.

Application of the composition theorem

The conditions of the Theorem 4 are respected. The outputs of both components are separated. The guarantees G wl 1 of the Water-level1 do not refer to the outputs of the Controller1 and the inverse is also true. The guarantee wl 1 " pf in ´f out 1 qpt ´tctrl 1 q `wlm 1 contains occurrences of outputs of both components, but we have proved that it is a guarantee of both component. It is thus not a problem to the application of the theorem. The guarantees G wl 1 implies the assumptions A ctrl 1 trivially since they correspond, and the inverse is true. We have thus automatically the proof of satisfaction of the conjunction of contracts by the resulting component thanks to the application of the theorem.

We have sum up in the Figure 3.25 the Water-tank1 component. We have now a proof of satisfaction of its contract thanks to the application of the Theorem 4.

Water-level1

Wl1

A wl 1 : G ctrl 1 G wl 1 : 3 ď wl 1 ď 7 wl 1 " pf in ´f out 1 qpt ´tctrl 1 q `wlm 1 Controller1 WlCtrl1 A ctrl 1 : G wl 1 G ctrl 1 : wlm 1 ď 3.5 Ñ f in " 1 6.5 ď wlm 1 Ñ f in " 0 p3.5 ě wlm 1 ě 6.5q Ñ pf in " 0 _ f in " 1q 3 ď wlm 1 ď 7 wl 1 " pf in ´f out 1 qpt ´tctrl 1 q `wlm 1 wl 1 f in,
A wt 1 : A wl 1 ^Actrl 1 G wt 1 : G wl 1 ^Gctrl 1 � wl 1 wlm 1 f in wl 1 wlm 1 f in Figure 3.25: Graphical representation of the Water-tank1 component
Implementation in KeYmaera X We have implemented in KeYmaera X the component resulting from the composition 5.3.2. At the end of the file, in commentary, there is the tactic used to achieve the proof. We have followed strictly our procedure detailed in the proof of the Theorem 4. It requires a minimal supplementary proof effort from the proof of each component. It may be automated.

The water-tank file shows us that even a simple example quickly grows in size. Our approach requires that the engineer only consider the basic component, here the water-level and the controller, which are much simpler to understand and prove.

Water-Plant

We compose two water-tanks with our parallel composition operator. It follows an intuitive design in the sense that we first compose the Water-level1 component with the Controller1 component to obtain a first tank Water-tank1, then compose it with a second water-tank obtained by similar mean.

Water-level1 Controller1

Water-tank1

b b

Water-level2 Controller2

Water-tank2

b

Second water-tank The second water-tank is a lot similar to the first one, but it is the outlet valve that can be closed or open by the controller, the inlet flow is assumed to be constant. A detailed .kyx file are given for the second water-level 5.3.2, the second controller 5.3.2 and the second water-tank resulting from their composition 5.3.2.

We have summed up in the Figure 3.26. Definition 32 (Water-plant behavior). The behavior WP of the water-plant results from the parallel composition of WT1 and WT2, where WT1 results from the parallel composition of Wl1 and WlCtrl1 and WT2 results from the parallel composition of Wl2 and WlCtrl2.

Water-tank2

Wl2 ˝WlCtrl2 A wt 2 : A wl 2 ^Actrl 2 G wt 2 : G wl 2 ^Gctrl 2 � wl 2 wlm 2 f out 2 wl 2 wlm 2 f out 2
WP fi WT1 1 ˝WT2 fi pWl1 ˝WlCtrl1q ˝pWl2 ˝WlCtrl2q fi ¨´`? t ď t ctrl 1 `δ1 ; wlm 1 :" wl 1 ; p?wlm 1 ě 6.5; f in :" 0q Y p?wlm 1 ď 3.5; f in :" 1q; t ctrl 1 :" t Y `?t ď tctrl 2 `δ2 ; wlm 2 :" wl 2 ; p?wlm 2 ě 6.5; f out 2 :" 1q Y p?wlm 2 ď 3.5; f out 2 :" 0q; tctrl 2 :" t Y`9

wl 1 " f in ´f out 1 , 9 wl2 " f out 1 ´f out 2 , 9 t " 1 & pwl 1 ě 0 ^t ě 0 ^δ1 ě t ´tctrl 1 ě 0 ^t ě t ctrl 1 ^wl 2 ě 0 ^δ2 ě t ´tctrl 2 ě 0 ^t ě tctrl 2 q ˘¯˚‹ ‹ ‹ ‹ ‹ ‹ ‹ ‹ ‹ ‹ '
In particular, we have an example of the parallel composition of two continuous components with the water-levels composed in parallel.

Application of the theorem The conditions of the Theorem 4 are respected. The outputs of both components are separated. The guarantees G wt 1 of the Water-tank1 do not refer to the outputs of the Water-tank2 and the inverse is also true. The sequent E wp , A wt 2 $ @ wt 1 pG wt 1 Ñ A wt 2 q is valid since the outputs of the first water-tank are separated from the variables in A wt 2 . The inverse is also true. We have thus automatically the proof of satisfaction of the conjunction of contracts by the resulting component thanks to the application of the theorem. It is summed up in the Figure 3.27. Implementation in KeYmaera X We have implemented in KeYmaera X the component resulting from the composition 5.3.2. At the end of the file, in commentary, there is the tactic used to achieve the proof. We have followed strictly our procedure detailed in the proof of the Theorem 4. It requires a minimal supplementary proof effort from the proof of each component. It may be automated.

Water-plant

WT1 ˝WT2 A wp : A wt 1 ^Awt 2 G wp : G wt 1 ^Gwt 2 � wl 1 , wl 2 wlm 1 , wlm 2 f in, f out 2 wl 1 , wl 2 wlm 1 , wlm 2 f in, f out 2

Discussion

Monolithic approach VS Modular approach The source files 5.3.2 show that the design of even a simple water-plant may result in a model quite complex to model. The proof is also difficult to automate. New improvements in KeYmaera X can drastically improve the readability and help to scale, but the same problem will arise for system more complex.

We strongly think that our component-based approach allows to handle both design and proof complexity of systems made up of simple and repetitive parts.

Improvement points

Our two examples, the cruise-control and the water-tank shares the same structure : a continuous evolution (the plant) is monitored by a discrete controller. It is a frequent design in Cyber-physical Systems and is referred to as Computer-Controlled Systems. It includes most of the industrial systems.

In both examples, we have to add a machinery to ensure that the controller executes periodically. This addition is not a function problem, but an architecture problem and the designer should have tools to automate it. It is the subject of Section 4.1.

When we compose several CCS together as in our water-plant Example 32, the controller might be executed on the same computation unit and therefore their execution period may be modified by the parallel execution. We answer to this problem in Section 4.2.

A common design in critical system is the addition of an emergency mode to the nominal mode. The natural way to express it in our framework is to compose in parallel the emergency mode with the nominal mode. But we have to be careful since they have the same outputs. We present a solution in Section 4. [START_REF] Abrial | The B-book: assigning programs to meanings[END_REF].

When designing such system, one may want to define a causal relation between components. We propose in Section 4.4 the definition of a causal composition operator compatible with the previously defined framework.

We have presented a parallel composition operator in Chapter 3. The water-plant example in Section 3.5 shows that our approach still requires that the engineer have to reason on nonfunctional problems to achieve its design and proof. We present in this chapter adaptations of the parallel composition operator to remediate to the problems identified in Subsection 3.5.6.

In Sections 4.1 and 4.2, we show how to adapt the results of the previous Chapter 3 to systematically model Computer-Controlled Systems (CCS) in a modular approach. The idea is to analyse the control period of the plant, i.e. the period of time it can evolve without intervention of the controller, and the reactivity of the controller, i.e. the execution period of the controller. We retain the associativity property and the ability to retain contracts through composition. To clearly separate the design part of a system and its representation in dL, we continue to use the textual representation of components.

In Section 4.3, we show how to express modes in a systematic and modular way by adapting the parallel composition operator

˝. An usual decomposition of a controller is Sensor -> Program -> Actuator. But the three components are not in parallel, but in sequence. In Section 4.4, we define a causal composition operator by adapting our parallel composition operator to enforce an order. It features associativity, essential for modularity, and a theorem allowing to transfer automatically guarantees of each component to the resulting compound component under relaxed conditions.

Computer-Controlled Systems

We present a component-based approach to model and verify Computer-Controlled Systems (CCS). We aim to simplify the reasoning on such systems and provide methodological insights for designers and proof engineers.

We adapt our previous work by taking into account the period of execution of the controller. We describe the integration and show that it cover the standard encoding of CCS in dL. We adapt the composition Theorem 4 to show that we retain contracts through composition of components. We exemplify it with the water-tank example.

Modeling Computer-Controlled Systems

We present how we model Computer-Controlled System. A CCS is classically composed of a controller and a plant as in Figure 4.1. The former regulates the behavior of the latter through an actuation. For example, the controller in the water-tank example regulates the water-level by opening or closing a faucet. The key trait of CCS is the periodic execution of the controller to regulates the controller.

We associate a periodic value ∆ Ctrl (resp. ∆ P lant ) to the controller (resp. the plant). For the control part, it is the execution period, i.e. the maximal allowed time between two executions of the controller. For the plant, it is the duration in which it can freely evolve and still satisfies the safety property, the control period. We add timing constraints to model this requirement.

We use the water-tank example of Section 3.5, except that we distinguish the execution period from the control period. These two notions were conflated in our previous example.

Time. We assume that the passing of time is accessible for every component through the differential equation 9t " 1 & t ě 0. The variable t represents the time passing linearly and is a global read-only variable. It is initialized to 0.

Controller. We assume that a designer provides the functional behavior of a controller as a discrete program Ctrl and the associated period ∆ Ctrl . The functional behavior represents one execution of the controller. We add timing constraints to model the periodic execution of the controller.

The controller acts every ∆ Ctrl units of time. To ensure this periodic execution, we use a fresh variable t ctrl . It works as a time-stamp saying that Ctrl has executed. We add at the end the assignment t ctrl :" t, which signals that the controller has executed. We add the guard ?t ď t ctrl `∆Ctrl before the controller Ctrl, which requires that at most ∆ Ctrl units of time have passed since the last execution. It results in the following canonical structure for the controller, which is referred later as the behavior of the controller.

Definition 33 (Controller). The canonical structure of a controller is given by the hybrid program:

Ctrl fi p?t ď t ctrl `∆Ctrl ; Ctrl; t ctrl :" tq This definition allows Zeno behaviors, i.e. repetitive executions of the controller without having the continuous systems to evolve. It is a problem when we want to implement a real controller, but we are here interested into the verification of safety properties. Having a more general modeling is thus not a problem. We could forbid this Zeno behavior by adding the test t ctrl ă t in the guard. Another possibility is to replace the test t ď t ctrl `∆Ctrl with the test t " t ctrl `∆Ctrl . It assumed here that the controller executes every ∆ Ctrl units of time which is unrealistic if we want to obtain a real implementation later.

For example, consider the controller for the water-level of a tank in a water-plant. If the level reaches a maximum (resp. minimum) threshold, here 6.5 (resp. 3.5), then we close the inlet faucet f in (resp. we open the inlet faucet).

Example 35 (Water-level controller). The functional behavior is :

Body W lCtrl fi wlm :" wl; `p?wlm ě 6.5; f in :" 0q Y p?wlm ď 3.5; f in :" 1q Ȋt describes how the component operates, but does not refer to structural constraints like the execution period. The period ∆ wlCtrl of the controller is 0.05 sec. We augment the functional behavior Body W lCtrl with the period to obtain the behavior WlCtrl: ¨?t ď t ctrl `0.05; wlm :" wl; p?wlm ě 6.5; f in :" 0q Y p?wlm ď 3.5; f in :" 1q; t ctrl :" t 'Å t most every 0.05 seconds, the water-level controller samples the current water-level and decides accordingly to open or close the inlet valve.

Retro-action It is possible to take account of the retro-action. Instead of using the last sensing in the modeling, we use the previous one, i.e. the sensing performed ∆ Ctrl units of time before. We use a temporary variable to memorize it. It accurately models the fact that the actuation of controller at a time t 0 is in function of the sensing at t 0 ´∆Ctrl .

Example 36 (Water-tank controller with retro-action). The behavior of the water-tank controller with retro-action is: ¨?t ď t ctrl `∆Ctrl ; prewlm :" wlm; wlm :" wl; p?prewlm ě 6.5; f in :" 0q Y p?prewlm ď 3.5; f in :" 1q;

t ctrl :" t ‹ ‹ ' In
the example, the level of water of the tank is assigned to the variable wlm, then to the variable prewlm. wlm is here to stock the value for one more iteration of the controller and simulates a retro-action.

Plant. We assume that a designer provides the functional behavior of the plant as a differential equation ODE & H and the control period ∆ P lant . We implement it by adding the formula t ď ∆ P lant in the evolution domain.

Definition 34 (Plant). The canonical structure of a plant is:

Plant fi ODE, 9 t " 1 & H ^t ď ∆ P lant
The addition of the formula t ď ∆ P lant adequately models that we consider an evolution of the system in the duration of the control period.

The value of the control period ∆ P lant is obtained by external methods and is not computed by our methodology. In practice, it is mostly obtained from the knowledge of engineers of the field with some tolerance.

The evolution of the water-level is the difference between the inlet flow f in and the outlet flow f out. The water-level is assumed to always be positive.

Example 37 (Water-level). The functional behavior of the water-level is the following differential equation:

9 wl " f in ´f out & wl ě 0
The control period ∆ wl of the water-level is 0.2 sec. The behavior Wl of the water-level component is thus given by:

9 wl " f in ´f out, 9 t " 1 & wl ě 0 ^t ď 0.2
Our proposed modeling is sufficient to reason on the system. Indeed, when we compose the plant with the controller, we iterate the interaction. Thus, considering only the evolution on the duration ∆ P lant amounts to consider one step of the loop Plant-Controller.

Full system The full system is obtained by applying our parallel composition operator on the plant and the controller with a slight difference.

Definition 35 (Computer-Controlled System). The canonical structure of the behavior of a Computer-Control System is:

CCS fi `pP lant, 9

t " 1 & H ^0 ď t ´tctrl ď ∆ Ctrl q Yp?t ď t ctrl `∆Ctrl ; Ctrl; t ctrl :" tq ˘The controller and the plant interact by the use of the variable t ctrl . At the beginning of one loop iteration, we have t " t ctrl and thus t ´tctrl " 0. The difference t ´tctrl grows along the evolution of time until the point t ´tctrl " ∆ Ctrl . Then, the controller has to act, but it can act before.

The difference with the parallel composition operator in Definition 22 is that we replace the formula t ě ∆ P lant by the formula 0 ď t ´tctrl ď ∆ Ctrl . We detail in the proof of the Theorem 6 why this replacement is safe.

For our system to fit the desired modeling, we must have ∆ Ctrl ď ∆ P lant , i.e. that the reactivity of the controller is shorter to the control period of the plant. Otherwise, there may be runs of the whole system where the controller can not execute and the system is stuck. Yet, we do not forbid such composition, but we will not be able to retain the contracts through composition.

Example 38 (Water-tank). We compose the water-level with the water-level controller to obtain the water-tank system. The behavior Water-tank resulting from the composition of the water-level and the water-level controller is:

ˆp 9
wl " f in ´f out & wl ě 0 ^0 ď t ´tctrl ď 0.05q Y p?t ď t ctrl `0.05; wlm :" wl; p?wlm ě 6.5; f in :" 0q Y p?wlm ď 3.5; f in :" 1q; t ctrl :" tq ˙The composition is safe because the period of the controller (∆ W lCtrl " 0.05) is inferior to the control period of the plant (∆ wl " 0.2).

We retain the general structure of component in Chapter 3 which is essential to obtain modularity. Yet, one may ask if we accurately capture all CCS systems. We show in the next subsection that we capture all systems that are encoded by the standard encoding of CCS that we repeatedly found in the literature in dL. It gives us confidence that our proposed approach captures such systems.

Coverage of the standard encoding

We first define what we call the standard encoding of Computer-Controlled Systems in dL. It is a recurrent structure in the literature. We then show that our modeling proposition can model every system that can be modeled with the standard encoding.

Definition 36 (Standard encoding). The standard encoding of a CCS is:

pCtrl; t ctrl " t; P lant, 9 t " 1 & H ^0 ď t ´tctrl ď ∆ Ctrl q
The alternation of the controller and the plant is obtained by the use of the sequence operator ; . Notice that a similar encoding is used to represent the cyclic relation to time. We have a notification variable t ctrl that is reset to t after the execution of the controller. This modeling is simple, yet very efficient in a monolithic approach. But we think that it is not the appropriate approach if we want to use a component-based approach.

Remember that ρpαq, where α is an hybrid program, is the set of reachable states of α (cf Definitions 2 and 4). We show that the set of reachable states of the standard encoding of CCS is included in the set of reachable states of our encoding. It means that a system that can be modeled with the standard encoding can also modeled with our approach.

Theorem 5 (Coverage of the standard encoding). Every system that can be modeled with the standard encoding may be modeled with our encoding, i.e. ρ `pCtrl; t ctrl " t; P lant, 9

t

" 1 & H ^0 ď t ´tctrl ď ∆ Ctrl q ˚Ď ρ `ppP lant, 9 t " 1 & H ^0 ď t ´tctrl ď ∆ Ctrl q Y p?t ď t ctrl `∆; Ctrl; t ctrl :" tqq ˚Proof.
We prove the equivalence by unfolding the semantic definition of our proposed encoding and show that one of the subset of reachable states of our encoding matches exactly the set of reachable states of the standard encoding. First, we add the test ?t ď t ctrl `∆Ctrl in front of the standard encoding. It does not change the reachability, but is here to simplify the identification to our encoding. We have the following equality. ρ `pCtrl; t ctrl " t; P lant, 9

t

" 1 & H ^0 ď t ´tctrl ď ∆ Ctrl q ˚"
ρ `p?t ď t ctrl `∆Ctrl ; Ctrl; t ctrl " t; P lant, 9 t " 1 & H ^0 ď t ´tctrl ď ∆ Ctrl q ˚The right-hand side is trivially included in the left-hand side since we just add information, and thus potentially reduces the set of worlds. For the other inclusion, if it is not true, then there is a world w in ρ `pCtrl; t ctrl " t; P lant, 9

t " 1 & H ^0 ď t ´tctrl ď ∆ Ctrl q ˚˘such that w |ù t ď t ctrl `∆Ctrl , but it contradicts the assumption that the continuous behaviors evolve in a world where t ď t ctrl `∆Ctrl is true. We have thus the other inclusion.

We have to prove:

ρ `p?t ď t ctrl `∆Ctrl ; Ctrl; t ctrl " t; P lant, 9 t " 1 & H ^0 ď t ´tctrl ď ∆ Ctrl q ˚Ď ρ `ppP lant, 9 t " 1 & H ^0 ď t ´tctrl ď ∆ Ctrl q Y p?t ď t ctrl `∆; Ctrl; t ctrl :" tqq ˚We adopt the following abbreviations:

P " P lant, 9 t " 1 & H ^0 ď t ´tctrl ď ∆ Ctrl C "?t ď t ctrl `∆Ctrl ; Ctrl; t ctrl :" t
Thus, the standard encoding corresponds to pC; P q ˚and our encoding corresponds to pC Y P q ˚. We unfold the semantic definition of the iteration. We obtain the following equality:

ρ `pC Y P q ˚" Ť nPN ρ `pC Y P q n
We have thus ρ `pC Y P q 2 ˘Ď ρ `pC Y P q ˚˘. We unfold ρ `pC Y P q 2 ˘: ρ `pC Y P q 2 " ρ `pC Y P q; pC Y P q " ρpC; Cq Y ρpC; P q Y ρpP ; Cq Y ρpP ; P q Thus the left-hand side is included in the right-hand side.

Example 41 (Contract of the water-level). From the Example 3.20, the contract of the water-level is:

$ & % A wl : G wlCtrl G wl : 3 ď wl ď 7 wl " pf in ´f outqpt ´tctrl q `wlm

We have already a proof of the sequent:

E wt , A wl $ rWlsG wl
Full system The contract for the full system is the conjunction of the assumptions and of the guarantees. As in Section 3.3, we want that the system CCS as defined in Definition 35 satisfies the conjunction of contracts pA Ctrl ^AP lant , G Ctrl ^GP lant q. We adapt the Theorem 4 by adding the condition that the execution period must be shorter than the control period, i.e. ∆ Ctrl ď ∆ plant , to retain contracts.

Theorem 6 (Safe composition of a Plant and a Controller). Let P lant and Ctrl be two behaviors as defined previously with respective contracts pA P lant , G P lant q and pA Ctrl , G Ctrl q.

Assume that we have two proof trees of E, A P lant $ rP lantsG P lant and E, A Ctrl $ rCtrlsG Ctrl respectively, where E is the environment. Furthermore, assume that paq BV pP lantq X BV pCtrlq " H, pb 1 q BV pP lantq X F V pG Ctrl q " H, pb 2 q BV pCtrlq X F V pG P lant q " H and BV pCtrlq X F V pHq, pc 1 q A P lant $ @ Ctrl pG Ctrl Ñ A P lant q, pc 2 q A Ctrl $ @ P lant pG P lant Ñ A Ctrl q, pdq ∆ Ctrl ď ∆ plant .

Then it exists a proof tree of E, A P lant , A Ctrl $ rCCSspG P lant ^GCtrl q.

The first assumption paq assumes components to have separate internal variables and requires them to define disjoint output variables (i.e. unique definitions), which essentially amounts to good modeling practice. The second assumption pb 1 q (resp. pb 2 q) requires the safety property G Ctrl (resp. G P lant ) to guard the behavior of the system α (resp. β), i.e. its outputs, and of course not βs (resp. α). It hence seems natural to require its separation with G P lant (resp. G Ctrl ). The condition pc 1 q (resp. pc 2 q) requires the assumptions A β (resp. A α ) to be implied by the guarantees G Ctrl (resp. G P lant ).

Proof. We re-use the result of the Theorem 4. In order to do so, we have to justify our slight change where we replace the formula t ď ∆ P lant with the formula 0 ď t ´tCtrl ď ∆ Ctrl in the Definition 35.

First, the condition pdq tells us that ∆ Ctrl ď ∆ P lant . Thus, if the sequent E, A P lant $ rP lant, 9

t " 1 & H ^t ď ∆ P lant sG P lant is valid, we have that the sequent E, A P lant $ rP lant, 9

t " 1 & H ^t ď ∆ Ctrl sG P lant is valid too. It shorten the amount of time that the plant is allowed to evolve. So if we have proved that it satisfies the guarantees for a defined amount of time, we have trivially that it satisfies guarantees for a smaller amount of time.

We can then safely replace the formula t ď ∆ Ctrl by 0 ď t ´tctrl ď ∆ Ctrl in the evolution domain since it represents the same amount of time. It is now possible to apply the Theorem 4 to conclude.

Example 42 (Contract of the water-tank). From the Example 3.25, the contract of the water-tank resulting from the composition of the water-level and the controller is:

" A wt : A wl ^AwlCtrl G wt : G wl ^GwlCtrl
The conditions of the Theorem 6 are satisfied. The conditions paq to pc2q are already considered in the previous section. Plus, we have that ∆ wlCtrl ď ∆ wl We have a proof of the following sequent: E, A wt $ rWater-tanksG wt

Conclusion

We have presented how we can adapt our parallel composition operator to modularly model and prove a Computer-Controlled System and reason on a non-functional property like the execution period and the control period. But the presentation in this section is only for two elements, and we want to extend this approach with to a plant where several systems Plant-Controller are composed in parallel. The next section is devoted to the presentation of parallel composition with a systematic integration of timed constraints.

Parallel composition in a timed framework

We want to extend the integration of temporal considerations for every component in a timed framework. Reasoning on temporal executions of CPS is an important step during the design of such systems and this extension aims to ease its development.

When we execute two programs in parallel on one CPU, their execution periods, that we identify to Worst Case Execution Time (WCET), is augmented. The computation resources may be preempted by the other program and the first program has to wait. More precisely, the resulting execution period is the sum of respective WCET. We have also to take into consideration if the composition with the continuous part is still valid, i.e. that the resulting execution period is still inferior to the control period of the plant.

The parallel composition operator in Definition 22 is too general to handle this kind of reasoning. We present in the next section its adaptation by extending the idea of Section 4.1 and exemplify it with the water-plant example. We retain the algebraic properties, commutativity and associativity, as well as the theorem guaranteeing that the conjunction of contracts is preserved through composition.

In Subsection 4.2.1, we defined how we integrate systematically the notion of execution periods and control period to obtain a so-called timed component. The Subsection 4.2.2 details the parallel composition between discrete timed components and we show that we retain associativity and the composition theorem. The Subsection 4.2.3 is similar, but for continuous timed component. The Subsection 4.2.4 show how we associate a discrete component and a continuous component, where each of them may result from previous compositions. It is a generalization of Section 4.1. Finally, the Subsection 4.2.5 show how to aggregate all the previous definitions to obtain a parallel composition of timed general components.

Definition of a timed component

In this subsection, we present the definition of a component with the timed information and how it is translated in dL. The designer should only provide the textual representation and the translation in the dL framework is handled automatically.

We associate to every atomic component a duration which is assumed to be provided by the designer. For the discrete case, it is called the execution period and is understood as the time the component takes to execute. We may assimilate it to WCET. In the continuous case, it is the control period of the continuous system, i.e. the duration during which the continuous component can evolves freely without an intervention of a controller. We extend the definition by adding tests and assignment in a similar manner that in Section 4.1.1. To keep the structure of components and the associated properties, we add tests and assignment to discrete atomic sub-component along with the execution period provided by the designer. The execution period of a compound component is obtained through composition of atomic components.

Textual representation For a discrete component, ∆ α represents the execution period of the component. We just add this information to our previously defined textual representation in Subsection 3.1.1. For example, for the first water-level controller, we add that the execution period ∆ W lCtrl1 is 0.03 seconds.

Example 43 (Textual representation of water-level controller). From the Example 3.22, the water-level controller of the first tank is defined by: Component: Controller1 Period: ∆ W lCtrl1 " 0.03 Inputs:

wl 1 Assumptions: G wl 1 Outputs: f in wlm 1 Guarantees: 3 ď wlm 1 ď 7 3.5 ě wlm 1 Ñ f in " 1 wlm 1 ě 6.5 Ñ f in " 0 p3.5 ď wlm 1 ď 6.5q Ñ pf in " 0 _ f in " 1q wl 1 " pf in ´f out 1 qpt ´tctrl 1 q `wlm 1 Functional behavior: Body W lCtrl1 fi wlm 1 :" wl 1 ; p?wlm 1 ě 6.5; f in :" 0q Y p?wlm 1 ď 3.5; f in :" 1q

We have the same for the water-level controller WlCtrl2 of the second tank for which the execution ∆ W lCtrl2 is 0.02.

For a continuous component, ε α represents the control period of the component. As for the discrete case, we add this information in the textual representation. For example, for the water-level component of the first tank, we have ε W l 1 " 0.2. composition operator b detailed below. We use a different symbol to mark that we are in a timed framework.

As in Definition 22, the timed parallel composition consists of the non-deterministic choice between each behaviors α and β. The parallelism occurs by the interleaving of traces. The only difference is that we replace the occurrences of ∆ α (resp. ∆ β ) by ∆ αβ . The execution period of each sub-components is now the execution period of the whole discrete system.

The notation α ∆ αβ ∆α represent the program α where every occurrences of ∆ α is replaced by ∆ αβ . Recall that the general form of a discrete behavior α is given by pα

1 Y . . . Y α n q ˚,
where α i are composed of functional behaviors of sub-components of α augmented with the test ?t ď t α i `∆α and the assignment t α i :" t.

Definition 39 (Parallel composition of discrete components). Let α and β be two behaviors of discrete compound components A and B with respective periods ∆ α and ∆ β . The parallel composition α b β is given by:

´α1 ∆ αβ ∆α Y . . . Y α n ∆ αβ ∆α Y β 1 ∆ αβ ∆ β Y . . . Y β m ∆ αβ ∆ β ¯ẘhere ∆ αβ " ∆ α `∆β .
For example, we can compose the two water-level controller in parallel.

Example 46 (Composition of two water-level controllers). We want to compose Controller1 and Controller2 on one CPU. The functional behavior of the first controller is Body W lCtrl1 and is Body W lCtrl2 for the second controller. The first controller has a period ∆ W lCtrl1 of 0.03 seconds, and the second has a period ∆ W lCtrl2 of 0.02 seconds. The behavior resulting from the parallel composition of each respective behaviors is: `p?t ď t Ctrl1 `0.05; Body W lCtrl1 ; t Ctrl1 :" tq Y p?t ď t Ctrl2 `0.05; Body W lCtrl2 ; t Ctrl2 :" tq ˘Ålgebraic

properties We retain the algebraic properties of the parallel composition operator ˝(cf Propositions 3 and 4). The commutativity means that the order of composition is not important. The associativity ensure that we can build a system step-by-step. We retain the two algebraic properties because the sum operation is also commutative and associative. In our definition, it is equivalent to update the period with ∆ α `∆β or ∆ β `∆α .

Proof. We first consider the case of commutativity. The behavior resulting from the parallel composition of A with B is `α1

∆ αβ ∆α Y . . . Y α n ∆ αβ ∆α Y β 1 ∆ αβ ∆ β Y . . . Y β m ∆ αβ
∆ β ˘˚and the one resulting from the parallel composition of A with B is `β1

∆ αβ ∆ β Y . . . Y β m ∆ αβ ∆ β Y α 1 ∆ αβ ∆α Y . . . Y α n ∆ αβ ∆α ˘˚.
We have the following equality:

∆ αβ " ∆ α `∆β " ∆ β `∆α " ∆ βα
The behaviors are thus equivalent because of the commutativity of the non-deterministic choice operator Y.

For the associativity, the key point is that the sum operation is associative, i.e. that:

p∆ α `∆β q `∆γ " ∆ α `p∆ β `∆γ q
The proof is then similar to the proof of associativity of the parallel composition operator in Proposition 4.

Composition theorem

The contract for the timed parallel composition of components A and B is the conjunction of respective assumptions and guarantees. As in Section 3.3, we want that the component resulting from the parallel composition as in Definition 39 satisfies the conjunction of contracts pA α ^Aβ , G α ^Gβ q. We adapt the Theorem 4 by adding the condition that the execution period of a component must not occurs in its functional behavior, nor its guarantees, to retain contracts. Theorem 7. Let α and β be two behaviors of discrete components A and B with respective contracts pA α , G α q and pA β , G β q and respective periods ∆ α and ∆ β . Assume that we have a proof tree of E, A α $ rαsG α and E, A β $ rβsG β . Then, under the conditions: paq BV pαq X BV pβq " H, pb 1 q BV pαq X F V pG β q " H, pb 2 q BV pβq X F V pG α q " H, pc 1 q A α $ @ β pG β Ñ A α q, pc 2 q A β $ @ α pG α Ñ A β q, pdq The period ∆ α (resp. ∆ β ) does not occur in the functional behavior of A or G α (resp. functional behavior of B or G β ).

We automatically obtain a proof tree of the sequent:

E, A α , A β $ rα b βspG α ^Gβ q
The three first conditions are similar to the Theorem 4. The fourth condition forbids the occurrences of period ∆ α in the functional behavior α or the guarantee G α . It is not restrictive on the design of hybrid systems since a component should not rely on its execution period or guarantee a property related to it. The period of execution of a program in a CPU is extremely difficult to plan and may vary because of others programs.

The proof of the theorem is similar to the Theorem 4 once we have dealt with the update of the execution period induced by the parallel composition.

Proof. Recall that α and β are behaviors of discrete component and are thus of the form pα 1 Y . . . Y α n q ˚and pβ 1 Y . . . Y β m q ˚. Without loss of generality, we can assume that n " m " 1, the reasoning still works for an arbitrary n and m. α 1 is of the form ?t ď t α 1 `∆α ; Body α 1 ; t α 1 :" t.

Substituting ∆ α by ∆ αβ does not break the guarantee G α . More precisely, if the sequent E, A α $ rpα 1 q ˚sG α is valid, then the sequent E, A α $ rpα 1 ∆ αβ ∆α q ˚sG α is valid too.

The condition pdq ensures that ∆ α does not occur in the functional behavior Body α 1 of α 1 , i.e. it occurs only in the test ?t ď t α 1 `∆α . Thus the substitution does not affect the functional behavior α 1 , and the same proof rules used to prove the sequent E, A α $ rpα 1 q ˚sG α can be used to prove the sequent E, A α $ rpα 1 ∆ αβ ∆α q ˚sG α . We have thus a proof of E, A α $ rpα 1 ∆ αβ ∆α q ˚sG α and of E, A β $ rpβ 1 ∆ αβ ∆ β q ˚sG β . We apply the Theorem 4 to conclude.

Example 47 (Proof of the composition of two controllers). We want to apply the Theorem 7 to the timed parallel composition of two controllers as in the Example 46. The conditions paq to pc2q are trivially satisfied since the two water-level controllers are independent. The condition pdq is also verified since neither the execution period ∆ wlCtrl1 or ∆ wlCtrl2 occurs in the functional behaviors of both water-level controllers. Thus the component resulting from the parallel composition of Controller1 and Controller2 satisfies the contract pA W lCtrl1 ÂW lCtrl2 , G W lCtrl1 ^GW lCtrl2 q.

Conclusion

We have presented how we can compose discrete components and update their execution period during the parallel composition. We present next how we compose continuous components and still keep track of the control period, then how to compose continuous and discrete components.

Timed parallel composition of continuous components

When composing in parallel two continuous components, the control period of the resulting system is the minimum of respective control period. It is necessary to consider the minimum to retain safety guarantees. Indeed, if a property is guaranteed for some duration, it is also guaranteed for a shorter amount of time.

Modeling We present the textual representation of the parallel composition of two continuous components, then define the resulting behavior. The resulting inputs (resp. outputs) is the union of respective inputs (resp. outputs) as for the parallel composition of discrete components (cf Definition 38). Similarly, the resulting assumption (resp. guarantee) is the conjunction of assumptions (resp. guarantee). The control period ε αβ is the minimum of respective control period ε α and ε β . Recall that the behavior α of a continuous component is differential equation: 9

X " θ X , 9 t " 1 & H X ^0 ď t ď ε α .

Definition 41 (Parallel composition of continuous components). Let α and β be two behaviors of continuous components A and B with control period ε α and ε β . The parallel composition α b β is:

9 X " θ X , 9 Y " θ Y & H X ^HZ ^0 ď t ď minpε α , ε β q
For example, we have the parallel composition of the two water-level components. The resulting control period is the minimum of respective control period, here 0.1 seconds.

Example 48 (Composition of the two water-level). We compose the components Water-level1 and Water-level2. They have respective control period ε wl 1 " 0.2 and ε wl2 " 0.1. The control period of the resulting component is thus minp0.2, 0.15q " 0.1 seconds. The resulting continuous component is:

9 wl 1 " f in ´f out 1 , 9 wl 2 " f out 1 ´f out 2 , 9 t " 1 & wl 1 ě 0 ^wl 2 ě 0 ^0 ď t ď 0.15
Algebraic properties As for the timed parallel composition of discrete components, we retain commutativity and associativity for the timed parallel composition of continuous component.

Proposition 6 (Commutativity and Associativity). Let α, β and γ be behaviors of continuous components A, B and C, and of respective control period ε α , ε β and ε γ .

α b β " β b α (Commutativity) pα b βq b γ " α b pβ b γq (Associativity)
Proof. Recall that the behavior α of a continuous component is the differential equation:

9 X " θ X , 9 t " 1 & H X ^0 ď t ď ε α . Idem for β of the form 9 Y " θ Y , 9 t " 1 & H Y ^0 ď t ď ε β and γ of the form 9 Z " θ Z , 9 t " 1 & H Z ^0 ď t ď ε γ .
We first prove the commutativity property. The basic idea is that the operator minp., .q is commutative and associative.

We unfold the left-hand side and show it is equivalent to the right-hand side.

α b β fi 9 X " θ X , 9 Y " θ Y & H ^0 ď t ď minpε α , ε β q piq fi 9 Y " θ Y , 9 X " θ X & H ^0 ď t ď minpε α , ε β q piiq fi 9 Y " θ Y , 9 X " θ X & H ^0 ď t ď minpε β , ε α q piiiq fi β b α
The step piq consists of the unfolding of the definition of the parallel composition operator b for continuous behaviors. The second step piiq is the reordering of variables in the ODE. The step piiiq replace minpε α , ε β q by minpε β , ε α q since they are equal. Finally, we fold the definition to obtain β b α.

For the associativity, we unfold the definition and use the associativity of the minp., .q operator to show that pα b βq b γ " α b pβ b γq.

pα b βq b γ fi `9 X " θ X , 9 Y " θ Y & H ^ControlP eriod αβ ˘b γ pUnfoldingq fi 9 X " θ X , 9 Y " θ Y , 9 Z " θ Z & H ^ControlP eriod pαβqγ pUnfoldingq fi 9 X " θ X , 9 Y " θ Y , 9 Z " θ Z & H ^ControlP eriod αpβγq piq fi α b `9 Y " θ Y , 9 Z " θ Z & H ^ControlP eriod βγ ˘pFoldingq fi α b pβ b γq pFoldingq
The step piq use the equality minpminpε α , ε β q, ε γ q " minpε α , minpε β , ε γ qq. We deduce that ControlP eriod pαpβγq " 0 ď t ď minpminpε α , ε β q, ε γ q " 0 ď t ď minpε α , minpε β , ε γ qq " ControlP eriod αpβγq Modular proof As for the timed parallel composition of discrete components, we retain contracts through the timed parallel composition of continuous components. Theorem 8. Let α and β be two behaviors of continuous components A and B with respective contracts pA α , G α q and pA β , G β q. Assume that we have a proof tree of E, A α $ rαsG α and E, A β $ rβsG β . Then, under the conditions: paq BV pαq X BV pβq " H, pb 1 q BV pαq X F V pG β q " H and BV pαq X F V pH Y q " H pb 2 q BV pβq X F V pG α q " H and BV pβq X F V pH X q " H, pc 1 q A α $ @ β pG β Ñ A α q, pc 2 q A β $ @ α pG α Ñ A β q.

We automatically obtain a proof tree of the sequent:

E, A α , A β $ rα b βspG α ^Gβ q
We still have the restriction on separated outputs and that the guarantees of a component must not refer to the outputs of an other component. We also require that the guarantee of a component does not break the assumption under which the second component operates.

Proof. α b β is the same as α 1 ˝β1 where α 1 fi 9

X " θ X & H X ^ControlP eriod αβ and β 1 fi 9

Y " θ Y & H Y ^ControlP eriod αβ . ˝c is the parallel continuous composition in Definition 21. If we have a proof of E, A α $ rα 1 sG α and E, A β $ rβ 1 sG β , we can conclude by the Theorem 1.

We show that if we have a proof tree Π α of E, A α $ rαsG α , then we have a proof tree of E, A α $ rα 1 sG α .

If minpε α , ε β q " ε α , then α 1 " α and we have nothing to prove.

If minpε α , ε β q " ε β , we have α 1 fi 9 X " θ X & H X ^0 ď t ď ε β . By assumption, we have a proof of the sequent E, A α $ r 9

X " θ X & H X ^0 ď t ď ε α sG α . Since ε α ě ε β , α 1 considers the evolution of the differential equation during a shorter amount of time, we can then deduce the validity of the sequent E, A α $ rα 1 sG α .

Example 49 (Composition of two water-level). We want to apply the Theorem 8 to the timed parallel composition of two water-level as in the Example 48. The conditions paq to pc2q are trivially satisfied since the two water-level are independent. Thus the component resulting from the parallel composition of Water-level1 and Water-level2 satisfies the contract pA W l1 ÂW l2 , G W l1 ^GW l2 q.

Conclusion We have presented how to integrate timing aspects in our component-based approach for purely discrete systems and purely continuous systems. But the main interest of hybrid systems is when the systems are hybrid, i.e. when there is an interaction between continuous components and discrete components. It is also during this phase that a lot of problems can arise and that our approach help to solve.

Timed parallel composition of a discrete and a continuous component

In this section, we present the composition of a discrete and a continuous component. It is almost the same as the presentation in Section 4.1, but a more general integration of the notion of control period and execution periods to pass to the composition of different hybrid systems. We require that the control period of the continuous component is smaller to the execution period of the discrete component to be able to retain contracts through composition.

Modeling We present the textual representation of the parallel composition of a discrete component with a continuous component, then define the resulting behavior in Definition 39.

Definition 42 (Parallel composition of a discrete and a continuous component). The control period and the execution period do not change. The behavior of the resulting component is defined using these two values. A discrete component may be the result of the parallel composition of several discrete sub-components and the behavior α of a component A is of the following form: pα 1 Y . . . Y α n q ˚, where α i represent the behavior of sub-components. Each of them have a notification variable t α i associated.

Definition 43 (Discrete-Continuous). Let α be the behavior of a discrete component A with execution period ∆ α and β be the behavior of a continuous component B with control period ε β . The parallel composition α b β is:

`α1 Y . . . Y α n Y 9 X " θ & H ^ControlP eriod αβ ˘ẘhere ControlP eriod αβ " Ź 1ďiďn 0 ď t ´tα i ď ∆ α .
The control period formula ControlP eriod αβ is the conjunction of control period formulas for each sub-component behavior α i of α. It is necessary to retain the associativity as shown in the next Subsection 4.2.5. A simple example of the parallel composition of a discrete component and a continuous components is the water-tank as in the Example 38. The execution period ∆ wp is the execution period of the parallel composition of both controllers, i.e. ∆ wlCtrl1 `∆wlCtrl2 " 0.03 `0.02 " 0.05. The control period ε wp is the control period of the parallel composition of the two water-level, i.e. minpε wl1 , ε wl2 " minp0.2, 0.1q " 0.1.

Modular proof

As for the two previous case, we have a theorem ensuring that we retain contracts through composition. It is in fact almost the same as Theorem 6. The difference is that we explicitly distinguish the notion of control period and of execution period. Plus, we are not restricted to a system with one controller and one plant, but possibly several controllers already in parallel with several plants already in parallel as in Example 51.

Theorem 9. Let α and β be two behaviors of a discrete component A and a continuous component B with respective contracts pA α , G α q and pA β , G β q, control period ε β and execution period ∆ α . Assume that we have a proof tree of E, A α $ rαsG α and E, A β $ rβsG β . Then, under the conditions: paq BV pαq X BV pβq " H, pb 1 q BV pαq X F V pG β q " H and BV pαq X F V pH β q, pb 2 q BV pβq X F V pG α q " H,

pc 1 q A α $ @ β pG β Ñ A α q, pc 2 q A β $ @ α pG α Ñ A β q, pdq ε β ě ∆ α .
We automatically obtain a proof tree of the sequent:

E, A α , A β $ rα b βspG α ^Gβ q
Proof. The proof is exactly the same as for Theorem 6.

Example 52 (Water-plant). The parallel composition of components Controller12 and Water-level12 satisfies the conditions paq to pc 2 q of the Theorem 9 as presented in Subsection 3.5.5. Plus, we have seen in the Example 51 that the execution period ∆ wp is 0.05 and the control period ε wp is 0.1. We have ε wp ě ∆ wp ; the condition pdq is thus respected. By application of the Theorem 9, the component Water-plant satisfies the contract pA wlCtrl1 ^AwlCtrl2 ^Awl1 ^Awl2 , G wlCtrl1 ^GwlCtrl2 ^Gwl1 ^Gwl2 q. The two ways to obtain the water-plant system are equivalent thanks to the commutativity and associativity properties that we retain.

Timed parallel composition of two general components

Algebraic properties

We retain the commutativity and associativity properties necessary to a modular component-based approach.

Proposition 7 (Commutativity and associativity). Let α, β and γ be behaviors of general components A, B and C, of respective execution periods ∆ α , ∆ β and ∆ γ , and of respective control period ε α , ε β and ε γ .

α b β " β b α (Commutativity) pα b βq b γ " α b pβ b γq (Associativity)
Proof. Recall that the behaviors α, β and γ are of the respective canonical form `disc α Yp 9

X " Θ X & H X ^ControlP eriod α q ˘˚, `disc β Y p 9 Y " Θ Y & H Y ^ControlP eriod β q ˘˚and `disc γ Y p 9 Z " Θ Z & H Z ^ControlP eriod γ q ˘˚.
The proof of commutativity is obtained by first unfolding the definition (step piq). We use the commutativity of the Y operator to reorder the discrete parts (step piiq). We reorder the variables in the differential equation and use the commutativity of the conjunction ^to pass from H X ^HY to H Y ^HX (step piiiq). The fourth step pivq is justified by the equalities ControlP eriod αβ " ControlP eriod βα and ∆ αβ " ∆ βα . We fold the definition to obtain β b α (step pvq).

α b β " `pdisc α q ∆ αβ ∆α Y pdisc β q ∆ αβ ∆ β Y 9 X " θ X , 9 Y " θ Y & H X ^HY ^ControlP eriod αβ ˘˚piq " `pdisc β q ∆ αβ ∆ β Y pdisc α q ∆ αβ ∆α Y 9 X " θ X , 9 Y " θ Y & H X ^HY ^ControlP eriod αβ ˘˚piiq " `pdisc β q ∆ αβ ∆ β Y pdisc α q ∆ αβ ∆α Y 9 Y " θ Y , 9 X " θ X & H Y ^HX ^ControlP eriod αβ ˘˚piiiq " `pdisc β q ∆ βα ∆ β Y pdisc α q ∆ βα ∆α Y 9 Y " θ Y , 9 X " θ X & H Y ^HX ^ControlP eriod βα ˘˚pivq " β b α pvq
To prove the associativity property, we first unfold the definition of the parallel composition (steps piq and piiq). We use the equalities ControlP eriod pαβqγ " ControlP eriod αpβγq and ∆ pαβqγ " ∆ αpβγq in the step piiiq. We fold the definition in the steps pivq and pvq.

pα b βq b γ " ´`pdisc α q ∆ αβ ∆α Y pdisc β q ∆ αβ ∆ β Y 9 X " θ X , 9 Y " θ Y & H X ^HY ^ControlP eriod αβ ˘˚¯b γ piq " `pdisc α q ∆ pαβqγ ∆α Y pdisc β q ∆ pαβqγ ∆ β Y pdisc γ q ∆ pαβqγ ∆γ Y 9 X " θ X , 9 Y " θ Y , Z " θ Z & H X ^HY ^HZ ^ControlP eriod pαβqγ ˘˚piiq " `pdisc α q ∆ αpβγq ∆α Y pdisc β q ∆ αpβγq ∆ β Y pdisc γ q ∆ αpβγq ∆γ Y 9 X " θ X , 9 Y " θ Y , Z " θ Z & H X ^HY ^HZ ^ControlP eriod αpβγq ˘˚piiiq " α b ˆ`pdisc β q ∆ βγ ∆ β Y pdisc γ q ∆ βγ ∆γ Y 9 Y " θ Y , Z " θ Z & H Y ^HZ ^ControlP eriod βγ ˘˚˙p ivq " α b pβ b γq pvq
Modular proof We retain also the respective contracts through the timed parallel composition.

Theorem 10. Let α and β be two behaviors of general components A and B with respective contracts pA α , G α q and pA β , G β q, control period ε α and ε β , and execution periods ∆ α and ∆ β . Assume that we have a proof tree of E, A α $ rαsG α and E, A β $ rβsG β . Then, under the conditions:

paq BV pαq X BV pβq " H, pb 1 q BV pαq X F V pG β q " H, pb 2 q BV pβq X F V pG α q " H,

pc 1 q A α $ @ β pG β Ñ A α q, pc 2 q A β $ @ α pG α Ñ A β q,
pdq The period ∆ α (resp. ∆ β ) does not occur in the functional behavior of A or G α (resp. functional behavior of A or G β ),

peq minpε α , ε β q ě ∆ α `∆β .
We obtain automatically a proof tree of the sequent:

E, A α , A β $ rα b βspG α ^Gβ q
The conditions are the aggregations of the conditions of Theorem 7 and Theorem 8. The proof of this theorem is achieved by applying the three theorems of the previous subsections.

Proof. Remember that α and β are behaviors of general components. They respect the canonical form, and thus we have

α fi `disc α Y p 9 X " Θ X & H X ^ControlP eriod α q ˘ånd β fi `disc β Y p 9 Y " Θ Y & H Y ^ControlP eriod β q ˘˚.
We want to prove the validity

of the sequent E, A α , A β $ r `pdisc α q ∆ αβ ∆α Y pdisc β q ∆ αβ ∆ β Y p 9 X " θ X , 9 Y " θ Y & H X ^HY ĈontrolP eriod αβ q ˘˚spG α ^Gβ q.
The behavior resulting from the parallel composition is given by `pdisc α q

∆ αβ ∆α Ypdisc β q ∆ αβ ∆ β Y p 9 X " θ X , 9
Y " θ Y & H X ^HY ^ControlP eriod αβ q ˘˚and it can be expressed as the successive composition of discrete parts on one side, the continuous part on the other side, and then the composition of both sides. More precisely, it is equivalent to

`pdisc α q ˚b pdisc β q ˚˘b `p 9 X " θ X & H X ^ControlP eriod α q b p 9 Y " θ Y & H Y ^ControlP eriod β q
We successively apply the Theorems 7, 8 and 9 to conclude.

Example 54 (Water-plant). We already a proof that the water-tank1 component satisfies its contract pA wt1 , G wt1 q and that the water-tank2 component satisfies its contract pA wt2 , G wt2 q.

The conditions of the Theorem 10 are verified and we have that the resulting component Water-plant satisfies the conjunction of contracts pA wt1 ^Awt2 , G wt1 ^Gwt2 q.

Conclusion

In this section, we have presented how to extend our previous component-based approach to take into account the timing constraints inherent to the design of a Computer-Controlled System. We have proved that we retain the commutativity and associativity properties, essential to scale up to realistic systems. Finally, we state and prove theorems to retain contracts through the parallel conditions. Theses results give us confidence in the ability of our approach to be adapted to new challenges that will arise when confronted to realistic industrial systems. The next two sections present two adaptions of our parallel composition operator to handle modes and causal composition. It features composition theorems with relaxed condition to retain contracts.

Handling of modes

Complex computer-controlled systems often exhibits several modes. For example, in a waterplant, there is the nominal mode where the treatment of water is working normally and the water-level in tanks should be between a predefined range. And there is the error mode for when there is an anomaly, e.g. a worker push an emergency button, and we just want to ensure that there is no overflow by closing all the inlet faucets. It allows to model systems in a degraded environment and still ensure some important safety properties.

The obvious approach will be to model each mode as a component behavior, and then apply our parallel composition operator to obtain the global system. But by design, two distinct modes have the same outputs and it is not possible to apply the Theorem 4 since the condition paq (the outputs must be separated) is not satisfied. The trick is that the two modes do not execute simultaneously. They are exclusive; we cannot be in the two cases at the same time. We exploit this exclusion to slightly alter our definition of component in Subsection 3.1.1 similarly to our work in the previous Sections 4.1 and 4.2. We prove a similar result to Theorem 4 while relaxing the condition of the disjoints outputs for this design.

Here, we present our approach only with discrete components. To our knowledge, the definition of modes is for discrete systems since it is a design choice performed by an engineer. The change of mode of a plant is enforced by the actuation of a controller.

Modular modeling

The designer provides an event E under the form of a formula which characterizes a mode, e.g. Error " 0. Each event is added in the guard as for the time test in Section 4.2. The events can change from one to the other at every execution cycle.

We define a component A as in Subsection 3.1.1 to which we add a event E α . From this specification, we derive a behavior as a hybrid program which models the desired working. We complicate the water-tank example by adding to the nominal mode, (cf Subsection 3.5.3), an emergency mode. The event formula is error " 0 for the nominal mode and error " 1 for the error mode. We introduce the variable error representing the pushing of an emergency button. It is assumed to be an external variable; we add in the environment the fact that error " 1 _ error " 0.

Component

Example 55 (Error mode). The functional behavior of the error mode is f in :" 0; f out :" 0. We close both the inlet and outlet faucet and the system does not evolve anymore. It implies that the variable f out is no longer part of the environment, but an output of the component Error. The behavior is p?error " 1; f in :" 0; f out :" 0q

The composition of two modes is obtained by applying our parallel composition operator as in Definition 22.

Definition 48 (Mode composition). Let A and B be two discrete components with respective behavior α fi `Ť 1ďiďn ?E α ; α i ˘˚and β fi p Ť 1ďjďm ?E β ; β j ˘˚, and respective events E α and E β .

The behavior of the composition of A and B is defined as:

α ˝β fi `ď 1ďiďn ?E α ; α i Y ď 1ďjďm ?E β ; β j ˘We
use the parallel composition operator of Definition 22. We do not explicitly require that the events should be exclusive for the composition. We can model systems where two modes can overlap, but we will not be able to retain contracts through the parallel composition.

Example 56 (Composition of component Controller and component Error). From Definition 30, remember that the functional behavior of the water-level controller component, Controller, is: wlm :" wl; p?wlm ě 6.5; f in :" 0q Y p?wlm ď 3.5; f in :" 1q;

We drop the timing constraint for the sake of clarity, but they can be added without problem. By applying the Definition 48, the behavior of the resulting component is ˆp?error " 1; f in :" 0; f out :" 0q Y `?error " 0; wlm :" wl; p?wlm ě 6.5; f in :" 0q Y p?wlm ď 3.5; f in :" 1q ˘˙4

.

Modular proof

As in Section 3.3, we associate contracts to each component and prove that each component satisfies it. To obtain automatically the satisfaction of the conjunction of contracts by the global system, we have the following theorem.

Theorem 11. Let α and β be two behaviors of discrete components A and B with respective contracts pA α , G α q and pA β , G β q, mode events E α and E β . Assume that we have a proof tree of E, A α $ rαsG α and E, A β $ rβsG β . Then, under the conditions:

paq pE α ^Eβ q Ñ K, pb 1 q F V pG α q X ´BV pβqz `BV pαq X BV pβq ˘¯" H, pb 2 q F V pG β q X ´BV pαqz `BV pβq X BV pαq ˘¯" H, pc 1 q A α $ @ β pG β Ñ A α q, pc 2 q A β $ @ α pG α Ñ A β q.
We have a proof of:

E, A α , A β $ rα b βspE α Ñ G α ^Eβ Ñ G β q
We relax the condition that the outputs must be separated, i.e. that BV pαqXBV pβq " H. To still guarantee the soundness of the composition, we add the requirement that the two events are exclusive, i.e. pE α ^Eβ q Ñ K. Since the we relax the condition on separated outputs, we have to be more careful for the statement of conditions pb1q and pb2q. Indeed, the guarantee G α of a component may refer to a common output of both components, e.g. f in in our water-tank example. So, we forbid G α to refer to outputs of B that are not also outputs of A, hence the conditionF V pG α q X ´BV pβqz `BV pαq X BV pβq ˘¯" H.

Proof. Let α and β be two behaviors. They respect the canonical form `Ť 1ďiďn ?E α ; α i ˘˚and `Ť 1ďjďm ?E β ; β j ˘˚. To simplify the proof, we assume that n and m are reduced to 1, i.e.

α fi `?E α ; α 1 ˘˚. The reasoning can be applied for arbitrary n and m.

We assume that we have a proof tree for the sequent E, A α $ rp?E α ; α 1 q ˚sG α . The proof tree is of the form

Π Initα E, A α $ G α Π Stepα E, A α $ @ α pG α Ñ r?E α ; α 1 sG α q [Ind] E, A α $ rp?E α ; α 1 q ˚sG α
We apply the induction rule and obtain two goals, the initial step E, A α $ G α and the induction step E, A α $ @ αβ pG α Ñ r?E α ; α 1 sG α q. We assume that they are closed by the branches Π Initα and Π Stepα . We have a similar proof tree for the sequent E, A β $ rp?E β ; β 1 q ˚sG β with the branches Π Init β and Π Step β .

We want to derive a proof tree of the sequent E, A α , A β $ r `p?E α ; α 1 qYp?E β ; β 1 q ˘˚spE α Ñ G α ^Eβ Ñ G β q. We use the notation G αβ fi E α Ñ G α ^Eβ Ñ G β to shorten the representation of the guarantees. We first apply the induction rule.

E, A α , A β $ G αβ E, A α , A β $ @ αβ `Gαβ Ñ rp?E α ; α 1 q Y p?E β ; β 1 qsG αβ ˘[Ind] E, A α , A β $ r `p?E α ; α 1 q Y p?E β ; β 1 q ˘˚sG αβ
We first consider the left premise which corresponds to the initial step. We unfold the notation G αβ and separate the conjunction to finally retrieve our assumptions Π Initα and Π Init β to close the proof tree.

Π Initα E, A α , A β , E α $ G α Ñ r E, A α , A β $ E α Ñ G α Π Init β E, A α , A β , E β $ G β Ñ r E, A α , A β $ E β Ñ G β ^r E, A α , A β $ E α Ñ G α ^Eβ Ñ G β Unfold G αβ E, A α , A β $ G αβ
We now consider the second premise which corresponds to the induction step. We want to derive a proof tree for the sequent E, A α , A β $ @ αβ `Gαβ Ñ rp?E α ; α 1 q Y p?E β ; β 1 qsG αβ ˘. We apply the skolemization rule @ r . As in the previous section, we denote with the superscript α that a formula ϕ has seen all the occurrences of bound variables of α replaced by fresh variables. Thus G αβ α means that every occurrences of bound variables of both α and β in G α have been replaced by fresh variables.

E, A α , A β $ pE αβ α Ñ G αβ α ^Eαβ β Ñ G αβ β q Ñ rp?E α ; α 1 q αβ Y p?E β ; β 1 q αβ spE αβ α Ñ G αβ α ^Eαβ β Ñ G αβ β q @ r E, A α , A β $ @ αβ `pE α Ñ G α ^Eβ Ñ G β q Ñ rp?E α ; α 1 q Y p?E β ; β 1 qspE α Ñ G α ^Eβ Ñ G β q ˘Unfold G αβ E, A α , A β $ @ αβ `Gαβ Ñ rp?E α ; α 1 q Y p?E β ; β 1 qsG αβ We
can apply the separation lemma (cf Lemma 1), thanks to the condition pbq, to replace G αβ α by G α α . The variables of Gα that may be captured by the quantification on bound variables of β are already captured by the quantification on bound variables of β. Idem for the replacement of G αβ β by G β β . We apply the right implication rule Ñ r to the sequent

E, A α , A β $ pE αβ α Ñ G α α ^Eαβ β Ñ G β β q Ñ rp?E α ; α 1 q αβ Y p?E β ; β 1 q αβ spE αβ α Ñ G α α ^Eαβ β Ñ G β β q.
We then split the program p?E α ; α 1 q αβ Y p?E β ; β 1 q αβ in two with the non-deterministic choice rule rYs.

rYs E, A α , A β , E αβ α Ñ G α α ^Eαβ β Ñ G β β $ rp?E α ; α 1 q αβ Y p?E β ; β 1 q αβ spE αβ α Ñ G α α ^Eαβ β Ñ G β β q Ñ r E, A α , A β $ pE αβ α Ñ G α α ^Eαβ β Ñ G β β q Ñ rp?E α ; α 1 q αβ Y p?E β ; β 1 q αβ spE αβ α Ñ G α α ^Eαβ β Ñ G β β q E, A α , A β , E αβ α Ñ G α α ^Eαβ β Ñ G β β Ñ G αβ β $ rp?E α ; α 1 q αβ spE αβ α Ñ G α α ^Eαβ β Ñ G β β q E, A α , A β , E αβ α Ñ G α α ^Eαβ β Ñ G β β $ rp?E β ; β 1 q αβ spE αβ α Ñ G α α ^Eαβ β Ñ G β β q
We have two cases to consider. We only consider the first one, the sequent

E, A α , A β , E αβ α Ñ G α α ^Eαβ β Ñ G β β $ rp?E α ; α 1 q αβ spE αβ α Ñ G α α ^Eαβ β Ñ G β β q; the second case is similar. We split the invariant pE αβ α Ñ G α α ^Eαβ β Ñ G β β q
with the rule [BoxAnd] and consider separately each premise.

E, A α , A β , E αβ α Ñ G α α , E αβ β Ñ G β β $ rp?E α ; α 1 q αβ spE αβ α Ñ G α α q [BoxAnd] E, A α , A β , E αβ α Ñ G α α , E αβ β Ñ G β β $ rp?E α ; α 1 q αβ spE αβ α Ñ G α α ^Eαβ β Ñ G β β q E, A α , A β , E αβ α Ñ G α α , E αβ β Ñ G β β $ rp?E α ; α 1 q αβ spE αβ β Ñ G β β q
We close the first premise E, A α , A β , E αβ α Ñ G α α , E αβ β Ñ G β β $ rp?E α ; α 1 q αβ spE αβ α Ñ G α α q with the branch Π Stepα . For the second premise, we make use of the assumption that the events E α and E β are exclusive.

First, notice that p?E α ; α 1 q αβ is equivalent to ?E αβ α ; α αβ 1 . We apply the sequential composition rule r; s followed by the text rule r?s. We apply then the rule Ñ r to pass the left-hand side of the implication in the hypothesis.

E, A α , A β , E αβ α Ñ G α α , E αβ β Ñ G β β , E αβ α $ rα αβ 1 spE αβ β Ñ G β β q Ñ r E, A α , A β , E αβ α Ñ G α α , E αβ β Ñ G β β $ E αβ α Ñ rα αβ 1 spE αβ β Ñ G β β q r?s E, A α , A β , E αβ α Ñ G α α , E αβ β Ñ G β β $ r?E αβ α srα αβ 1 spE αβ β Ñ G β β q r; s E, A α , A β , E αβ α Ñ G α α , E αβ β Ñ G β β $ r?E αβ α ; α αβ 1 spE αβ β Ñ G β β q
We symbolically execute α αβ 1 . Since E β does not refer to bound variables of α, the symbolic execution of α αβ 1 does not modify E αβ β . We have to derive a proof tree for the sequent

E, A α , A β , E αβ α Ñ G α α , E αβ β Ñ G β β , E αβ α $ E αβ β Ñ pG β β q α αβ 1 .
We pass the event E αβ β in the left-hand side of the sequent with the rule Ñ r and conclude by ex falso quod libet (rule K). Indeed, we have that E α and E β are exclusive, thus E αβ α and E αβ β also.

A Causal Composition operator

When building a system from components, we may want to enforce a special ordering between two components because they have a causal relation, for example the composition of a sensor and the associated monitor. The parallel composition operator is not fitted for that. In this section, we present how we adapt it by adding ordering constraints to obtain a so-called a causal composition operator. We work in the framework of timed parallel composition defined in Section 4.2. We make advantage of the notion of notification already introduced. Hence, one is able to freely combine our causal composition operator with the timed parallel composition operator. We exemplify the causal composition by breaking the water-level controller into three components, a sensor, a monitor and an actuator. We want the sensor to run before the monitor since the monitor needs value from the sensor to decide what to do. The actuator have to run after the monitor since it needs the decision of the monitor to actuate on the system. Such decomposition has the advantage that each component performs exactly one task, but our previous parallel composition operator was not fitted for that.

Modular Modelling

We define the causal composition operator for discrete components. To our knowledge, it is not clear if an extension to continuous systems makes sense. Indeed, a design justification for the ordering of two continuous evolution is not obvious. But it may be interesting for the structuring of the proof for a continuous evolution with different stages, e.g. the growth of a bacterial population is first a lag phase, then exponential, followed by a stationary phase and then a death phase as the resources rarefy.

Recall that the behavior α of a timed discrete component A and execution period ∆ α is of the form `p?t ď t α 1 `∆α ; α 1 ; t α 1 :" tq Y . . . Y p?t ď t αn `∆α ; α n ; t αn :" tq ˘˚. α i are functional behaviors of sub-components of A. The test ?t ď t α i `∆α requires that at most ∆ α units of time have passed since the last execution of α. The assignment t α i :" t remembers the instant of the last execution of α.

Example 59 (Behavior of the water-level sensor). The functional behavior of the water-level sensor component, denoted Sensor, is wlm :" wl. Its execution period is 0.01 seconds and the notification is the variable t sens . Thus, its behavior is: p?t ď t sens `0.01; wlm :" wl; t sens :" tq Example 60 (Behavior of the water-level monitor). The functional behavior of the water-level monitor component, denoted Monitor is the functional behavior of the controller component as in Subsection 3.5.3, but without the sensing part. It is p?wlm 1 ě 6.5; f in :" 0q Y p?wlm 1 ď 3.5; f in :" 1q where the inlet valve is open or closed according to the value send by the sensor. Its execution period is 0.02 seconds. Thus, the behavior of the water-level monitor is: `?t ď t ctrl `0.02; p?wlm ě 6.5; f in :" 0q Y p?wlm ď 3.5; f in :" 1q; t ctrl :" t ˘The execution period of a compound component obtained by the causal composition of two components A and B is the sum of respective execution periods.

Definition 49. The component resulting from the causal composition of two discrete components A and B is:

of a instant execution of the first component after the execution of the second component and for the possible already existing ordering constraints. They may be equal to J. In our definition with discrete atomic components, we have Lapse α fi t β ă t, Lapse β fi J, Ord α fi J and Ord β fi t β ď t α . may result from previous parallel composition, and thus be made of several elements that are independent, we have to forbid each of them to execute instantaneously after the execution of β. We also add the ordering constraint p Ź 1ďiďn t α i ě t β j q in front of each sub-behaviors β j of β. Indeed, we have to constraint each of its sub-components to start before the end of execution of α.

Algebraic properties

We show in this subsection that we retain the associativity property, essential to achieve a truly modular component-based approach. We lose the property of commutativity, but it is expected since we want to ensure a particular order between two components.

Proposition 8 (Non-commutativity and associativity). Let α, β and γ be behaviors of discrete components A, B and C, of respective execution periods ∆ α , ∆ β and ∆ γ .

α d β ‰ β d α (Non-commutativity) pα d βq d γ " α d pβ d γq (Associativity)
The associativity property ensures that the modularity is preserved with the addition of the causal composition operator.

Proof. Recall that the behavior α respects the following form ´ď 1ďiďn `?Lapse α i β ^pt ď t α i `∆α q ∆α`∆ β ∆α ^Ord α i ; α i ; t α i :" t ˘¯T he behaviors β and γ respect a similar form.

For the proof of non-commutativity, it is a negative result and we just have to exhibit a counter-example to associativity. For that, we chose to reason with two discrete atomic components to be in the case of Definition 50, simpler to handle. It means that n " m " 1 and thus α is of the form p?t ď t α 1 `∆α ; α 1 ; t α 1 :" tq ˚and β is p?t ď t β 1 `∆β ; β 1 ; t β 1 :" tq ˚.

We show that there exists reachable states of α d β that are not reachable by β d α. We have:

α

Modular proof

We present a version of the Theorem 4 where we relax the condition that the guarantee of B must not refer to the outputs of A. The idea is to temporally characterize the execution of the component B (or of one of its sub-components). At this instant, we know that A has not executed, and we thus refers to outputs of A.

Recall that the behavior β of a discrete component B respects the following form `Ť 1ďjďm p?Lapse β j t ď t β j `∆β ^Ord β j ; β j ; t β j :" tq ˘˚. It is characterized by the formula Ž 1ďjďm t β j " t, hence the following theorem.

Theorem 12. Let α and β be two behaviors of discrete components A and B with respective contracts pA α , G α q and pA β , G β q and respective execution periods ∆ α and ∆ β . Assume that we have a proof of E, A α $ rαsG α and E, A β $ rβsG β . Then, under the conditions:

paq BV pαq X BV pβq " H, pbq BV pβq X F V pG α q " H, pc 1 q A α $ @ β pG β Ñ A α q pc 2 q A β $ @ α pG α Ñ A β q
We have a proof of:

E, A α , A β $ rα d βs `Gα ^p ł 1ďjďm t β j " tq Ñ G β q Proof.
For simplicity, we assume that the behaviors α and β are atomic. It is straightforward to generalize. We recall that the behaviors α and β respect the following canonical form p?t ď t α 1 `∆α `∆β ; α 1 ; t α 1 :" tq ˚and p?t ď t β 1 `∆α `∆β ; β 1 ; t β 1 :" tq ˚. G β is of the form t β 1 " t Ñ ϕ β 1 .

By assumption, we have a proof tree of the sequents E, A α $ rp?t ď t α 1 `∆α `∆β ; α 1 ; t α 1 :" tq ˚sG α and E, A β $ rp?t ď t β 1 `∆α `∆β ; β 1 ; t β 1 :" tq ˚spt β 1 " t Ñ G β q.

The proof tree of E, A α $ rp?t ď t α 1 `∆α `∆β ; α 1 ; t α 1 :" tq ˚sG α is of the following form:

Π Initα E, A α $ G α Π Stepα E, A α $ @ α pG α Ñ r?t ď t α 1 `∆α ; β 1 ; t α 1 :" tsG α q [Ind] E, A α $ rp?t ď t α 1 `∆α ; α 1 ; t α 1 :" tq ˚sG α
We have a similar proof tree for the sequent E, A β $ rp?t ď t β 1 `∆α `∆β ; β 1 ; t β 1 :"

tq ˚spt β 1 " t Ñ G β q. Using the branches Π Initα , Π Init β , Π Stepα and Π Step β , we derive a proof tree for the sequent E, A α , A β $ rα 1 d β 1 spG α ^tβ 1 " t Ñ G β q.
We unfold the definition of α d β before applying the induction rule [Ind]. We adopt the notation body α fi p?t β 1 ă t ď t α 1 `∆α `∆β ; α 1 ; t α 1 :" tq and body β fi p?t ď t β 1 `∆α `∆β tβ

1 ď t α 1 ; β 1 ; t β 1 :" tq. E, A α , A β $ G α ^tβ 1 " t Ñ G β E, A α , A β $ @ αβ `pG α ^tβ 1 " t Ñ G β q Ñ rbody α Y body β spG α ^tβ 1 " t Ñ G β q ˘[Ind] E, A α , A β $ r `body α Y body β ˘˚spG α ^tβ 1 " t Ñ G β q Unfolding E, A α , A β $ rα d βspG α ^tβ 1 " t Ñ G β q
The two premises correspond to the initial step and the induction step. We first consider the case of the initial step. We split the conjunction using the rule ^r. We close each premise with the branches Π Initα and Π Init β .

Π Initα E, A α , A β $ G α Π Init β E, A α , A β $ t β 1 " t Ñ G β ^r E, A α , A β $ G α ^tβ 1 " t Ñ G β
It remains the induction step to consider. We first apply the rule @ r to replace occurrences of bound variables of α and β by fresh variables. We separate then the program by applying the non-deterministic choice rule rYs.

rYs E, A α , A β , G αβ α ^pt β 1 " t Ñ G β q αβ $ rbody αβ α Y body αβ β spG αβ α ^pt β 1 " t Ñ G β q αβ q Ñ r E, A α , A β $ pG αβ α ^pt β 1 " t Ñ G β q αβ q Ñ rbody αβ α Y body αβ β spG αβ α ^pt β 1 " t Ñ G β q αβ q @ r E, A α , A β $ @ αβ `pG α ^pt β 1 " t Ñ G β qq Ñ rbody α Y body β spG α ^pt β 1 " t Ñ G β qq Ȇ, A α , A β , G αβ α ^pt β 1 " t Ñ G β q αβ $ rbody αβ α spG αβ α ^pt β 1 " t Ñ G β q αβ q E, A α , A β , G αβ α ^pt β 1 " t Ñ G β q αβ $ rbody αβ β spG αβ α ^pt β 1 " t Ñ G β q αβ q
We have two cases to consider, the case where there is one execution of α and the case where there is one execution of β. The second case is similar to the reasoning in Theorem 4. This reasoning can not be applied to the first case since G β may refer to bound variables of α and thus be modified.

We first unfold the notation body α . We split the guarantee in the sequent E, A α , A β , G αβ α pt β 1 " t Ñ G β q αβ $ rp?t β 1 ă t ď t α 1 `∆α `∆β ; α 1 ; t α 1 :" tq αβ spG αβ α ^pt β 1 " t Ñ G β q αβ q with the rule [BoxAnd]. It yields two goals. Using the condition pbq, we have that

G αβ α is equivalent to G α α . The goal E, A α , A β , G α α ^pt β 1 " t Ñ G β q αβ $ rp?t β 1 ă t ď t α 1 `∆α `∆β ; α 1 ; t α 1 :" tq αβ sG α α is closed by the branch Π Stepα . Π Stepα E, A α , A β , G α α ^pt β 1 " t Ñ G β q αβ $ rp?t β 1 ă t ď t α 1 `∆α `∆β ; α 1 ; t α 1 :" tq αβ sG α α E, A α , A β , G αβ α ^pt β 1 " t Ñ G β q αβ $ rp?t β 1 ă t ď t α 1 `∆α `∆β ; α 1 ; t α 1 :" tq αβ sG αβ α [BoxAnd] E, A α , A β , G αβ α ^pt β 1 " t Ñ G β q αβ $ rp?t β 1 ă t ď t α 1 `∆α `∆β ; α 1 ; t α 1 :" tq αβ spG αβ α ^pt β 1 " t Ñ G β q αβ q Unfolding E, A α , A β , G αβ α ^pt β 1 " t Ñ G β q αβ $ rbody αβ α spG αβ α ^pt β 1 " t Ñ G β q αβ q E, A α , A β , G αβ α ^Gαβ β $ rp?t β 1 ă t ď t α 1 `∆α `∆β ; α 1 ; t α 1 :" tq αβ sG αβ β
It remains to derive a proof tree for the sequent E, A α , A β , G αβ α ^pt β 1 " t Ñ G β q αβ $ rp?t β 1 ă t ď t α 1 `∆α `∆β ; α 1 ; t α 1 :" tq αβ spt β 1 " t Ñ G β q αβ . We first weaken the left side of our sequent with the rule W l because these formulas will not be needed. We symbolically execute p?t β 1 ă t ď t α 1 `∆α `∆β ; α 1 ; t α 1 :" tq αβ which yields in the hypothesis the formulas t β 1 ň t and t ď t α 1 `∆α `∆β .

We apply the rule Ñ r and have two contradictory formulas in the left-side of the sequent. We can thus apply the ex falso quod libet (rule K) to conclude.

K t β 1 ă t, t ď t α 1 `∆α `∆β , t β 1 " t $ G β Ñ r t β 1 ă t, t ď t α 1 `∆α `∆β $ t β 1 " t Ñ G αβ β Symbolic execution $ rp?t β 1 ă t ď t α 1 `∆α `∆β ; α 1 ; t α 1 :" tq αβ spt β 1 " t Ñ G β q αβ W l E, A α , A β , G αβ α ^pt β 1 " t Ñ G β q αβ $ rp?t β 1 ă t ď t α 1 `∆α `∆β ; α 1 ; t α 1 :" tq αβ spt β 1 " t Ñ G β q αβ

Conclusion

We have presented how to order discrete components using notifications introduced in Section 4.2. For a causal composition of a component A with a component B, we relax the condition stating that guarantees of a component B must not refer to outputs of a component A.

Chapter 5

Future works

In this chapter, we present research directions following our work. There is two categories of directions; one where we extend the expressiveness of our framework to take into account more systems, and one where we validate our approach against use cases. For each direction discussed, it is yet unclear if the results hold or whether it will prove to be useful.

We organize them in three sections. Section 5.1 presents research ideas continuing the results of Chapter 3. The Section 5.2 presents research ideas continuing the results of Chapter 4. The last Section 5.3 presents possible ideas on integrating refinement into component-based approach.

Continuing from the results on parallel composition

There are three main directions to investigate from the results of Chapter 3. Recall that we have defined a parallel composition operator to modularly model cyber-physical systems and a composition theorem ensuring that the component resulting from a parallel composition of two components satisfies the conjunction of respective contracts, allowing a modular proof of correctness of the system. We have also described a prototype to implement the process of construction of a proof of satisfaction of respective contracts.

First, we may want to modify our continuous composition operator ˝c to take into account a wider variety of models. We discuss possible ideas and difficulties that can be encountered. Secondly, we think that it is possible to relax the condition of Theorem 4 requiring that the guarantee of a component must not refer to outputs of an other component. Last, we discuss improvement points of the implementation of our prototype.

Extending the parallel continuous composition with complementary domains

When composing in parallel two continuous components, we define the resulting behavior, a differential equation, on the conjunction of evolution domains. The main reason for this choice is that we consider systems with distinct outputs. We also require that the evolution domain of a continuous behavior must not refer to outputs of other components. These requirements are crucial to ensure that the resulting component satisfies the conjunction of contracts. Given these conditions, two evolution domains should not interfere, making the choice of considering the conjunction of evolution domains not too restrictive. Given two continuous components, the parallel composition of their behaviors is defined to be the system of both differential equations on the conjunction of evolution domains. We recall the definition of parallel continuous composition. Let α fi 9

X " θ X & H X and β fi 9

Y " θ Y & H Y be continuous behaviors of components A and B. The parallel composition is:

α ˝c β fi 9 X " Θ X , 9 Y " Θ Y & H X ^HY
There exist systems that we would like to compose in parallel, but for which this operator is not fitted. For example, consider two water-levels, one running during the duration r0, 5s, the other one running during the duration r3, 7s. We want to model the system during the duration r0, 7s. Yet, if we apply the parallel composition operator, we obtain the execution only on the duration r3, 5s.

Example 62 (Two water-levels). Let 9 wl 1 " f in 1 ´f out 1 , 9 t " 1 & 0 ď t ď 5 and 9 wl 2 " f in 2 ´f out 2 , 9

t " 1 & 3 ď t ď 7 be two behaviors.

Their parallel composition results in the following differential equation: We lose the evolution of the first water-level on the duration r0, 3s and the evolution of the second water-level on the duration r5, 7s.

9
There is one global variable that is read by every component: the time. A restriction may arise from time-related properties as in Example 62. In our work, we are mainly interested in systems that run for an arbitrary long period of time, and this kind of time-related properties is unlikely to arise. Yet, it may be interesting to investigate how to modularly model this kind of systems.

Extension with complementary domains A possible adaptation is to consider the evolution on complementary domains as in the work of Ronkko et al. [START_REF] Rönkkö | Action systems with continuous behaviour[END_REF]. The continuous parallel composition of two differential equations 9

X " θ X & H X and 9 Y " θ Y & H Y would be given by

`p 9 X " θ X , 9 Y " θ Y & H X ^HY q Y p 9 X " θ X & H X ^HY q Y p 9 Y " θ Y & H X ^HY q ˘We
have three differential equations separated with a non-deterministic choice. The notation H X means the complement of the domain defined by H X . We iterate the whole to allows to pass freely from a differential equation to another one during the execution. The proposed definition still matches our general form of behavior.

Example 63 (Two water-levels on complementary domains). Applying it to the two waterlevel example results in the following model: 'O n the duration r0, 3q, we consider only the execution of the first water-level, and reciprocally we consider only the execution of the second water-level in the duration p5, 7s. For the duration r3, 5s, we have both executions in parallel. We pass from one equation to the other with the passing of time.

¨9 wl 1 " f in 1 ´f
There are several points to investigate. First, we have chosen to not specify the evolution of the differential equation 9

X " θ X on the evolution domain H X . An other option, the linear continuous parallel composition in the work of Ronkko et al. [START_REF] Rönkkö | Action systems with continuous behaviour[END_REF], is to specify that 9

X " 0 on the complementary domain H X . It means that we assume that the system does not evolve when it is not on its evolution domain.

Although the linear parallel composition is more restrictive, it also has more interesting properties. According to Ronkko et al., it is associative when the case where the evolution is not specified does not enjoy associativity. We think that this result may extend to the definition presented in this subsection. Such property would have to be investigated to determine whether this extension of the continuous parallel composition is useful to our modular component-based approach.

A very important point of our approach is the guarantee that the component resulting from the parallel composition of two components satisfies the conjunction of respective contracts. It remains to investigate whether such result holds for both versions of the extension of the parallel continuous composition operator with complementary domains.

Lastly, we have to be cautious is that this extension of continuous parallel composition does not build models with a combinatorial size, obliterating the scalability of such system. Considering complementary domains may lead to such problem ad it may be possible to have to consider methods to tame it.

Relaxing conditions of composition theorem

One of the necessary conditions to retain contracts through parallel composition is that the guarantees of a component must not refer to the outputs of an other component. It is also a good design practice. Yet, we may want express a guarantee according to outputs of other component. For example, the water-level controller has the guarantee wlm ď 3.5 Ñ f in " 1 which means that if the water-level measured wlm is below 3.5, we have to open the inlet valve (f in " 1). Assume we split the controller in two sub-components, a sensor to measure the value and a monitor deciding the course of action according to the value of the sensor. Then the guarantee wlm ď 3.5 Ñ f in " 1 is the one of the monitor, but it refers to an output of another component, the sensor.

But we think that it is possible to relax this condition. Assume that the guarantee G α of a component A is of the form p Ñ ϕ α where p is a literal and ϕ α is a formula. Instead of requiring that there is no occurrences of outputs of another component B in p Ñ ϕ α , we forbid such occurrences only in ϕ α . We can refer to outputs of B in p. The idea behind this relaxation is that p is a "hidden hypothesis". We require thus that p is implied by the guarantees of A.

Conjuncture 1. Let α and β be two behaviors of general form of components A and B with respective contracts pA α , G α q and pA β , G β q. Assume that G α is of the form p α Ñ ϕ α and G β of the form p β Ñ ϕ β . Assume that we have two proof trees of E, A α $ rαsG α and E, A β $ rβsG β respectively, where E is the environment. Furthermore, assume that paq BV pαq X BV pβq " H, pb 1 q BV pαq X F V pϕ β q " H, pb 2 q BV pβq X F V pϕ α q " H, pc 1 q E, A α $ @ β `Gβ Ñ pA α ^pα q ˘, pc 2 q E, A β $ @ α `Gα Ñ pA β ^pβ q ˘.

Then it exists a proof tree of E, A α , A β $ rα ˝c βspG α ^Gβ q.

Proof sketch We provide a proof sketch of the conjuncture. Recall that the behavior α is of the form pdisc α Y cont α q ˚and β is of the form pdisc β Y cont β q. The parallel composition α ˝β results in the behavior `disc α Y disc β Y pcont α ˝c cont β q ˘˚. The idea of the proof is to use the conjunction of guarantees G α ^Gβ as an invariant for the induction rule. We separate disc α , disc β and cont α ˝c cont β with the non-deterministic choice rule rYs. We have to prove the sequent E, A α , A β , G αβ α , G αβ β $ rdisc αβ α spG αβ α ^Gαβ β q. We have similar sequents for the branches corresponding to disc β and cont α ˝c cont β . We split the formula under the modality with the [BoxAnd] rule to distinct the cases of G αβ α and G αβ β .

To prove the sequent E, A α , A β , G αβ α , G αβ β $ rdisc αβ α sG αβ β , we use the separation lemma in the proof of Theorem 4 and the fact that G β does not refer to bound variables of disc α , and thus is not modified by the execution of disc α . Here, since G β refers to bound variables of disc α , we cannot apply this mechanism immediately, we have to be more cautious.

We first unfold the formula G αβ β . The step piq is the application of the separation lemma (cf Lemma 1 to the formula ϕ αβ β . We then symbolically execute disc α which does not modify ϕ β β , but may modify p αβ β . To mark this possible change, we use the superscript discα . A consequence is that p αβ β and pp αβ β q discα are possibly different formulas, and we can not use them to conclude. Remember that we have the condition pc 2 q which allow us to obtain the formula p β from G α , and thus p αβ β from G αβ α . The conclusion is straightforward. The technical reason is that the literal p is in negative position. It is thus possible to extend it to the more general condition: "Occurrences of outputs of the component B can only occurs into negative formulas".

E, A α , A β , G αβ α , p αβ β Ñ ϕ β β , pp αβ β q discα $ ϕ β β Ñ r E, A α , A β , G

Addition of communication channels

Our model of communication is based on shared variables. It is a simplistic model and is not realistic to tackle more complex systems. We present in this subsection how we can define communicating channels in a similar manner to the primitives of HCSP. We present how it can be used to revisit our composition theorem 4. We also outline how it will be possible to integrate communication delays.

Definition of communicating channels

We follow the encoding proposed by Guelev et al. [START_REF] Dimitar P Guelev | Compositional hoare-style reasoning about hybrid csp in the duration calculus[END_REF] to model inputs and outputs with several dedicated shared variables.

ch!e means that we send the value e along the channel ch and ch?x means that we assign the value received on the channel ch to the variable x. A very naive way to encode this is by ch!e fi ch :" e and ch?x fi x :" ch which is just variable sharing with one extra step. In such setting, the sender does not care if the value has been received. It may send several times a value (e.g. a sensor which repeatedly measure some physical variable sent to a controller) when the receiver only receive one of them (e.g. , the controller use one of two updates). It is a very loose specification.

A less naive encoding is given by: ch!e fi?rcv " 1; ch :" e; rcv :" 0 ch?x fi?rcv " 0; x :" ch; rcv :" 1 where rcv is a dedicated variable accounting to know if the value has been received or not.

With this encoding a sensor can not send a new value unless the controller has acknowledged to have receive one. Yet, it is not the way communications are modeled in HCSP. In Hybrid Communicating Sequential Processes, a communication channel is blocking, i.e. that a process can not continue if the reception has not been acknowledged. For example, in the program ch!e; α, α can not execute until e has been received by the other side of the channel. The proposed encoding is the following one:

ch!e fi ch :" e; ch! :" J; await ch?; await �ch?; ch! :" K ch?e fi ch? :" J; await ch!; x :" ch; ch? :" K; await �ch! where ch? and ch! are dedicated boolean variables. await ch? means that we wait for the variable ch? to be true, i.e. that the receiver is ready. Then, we wait that the receiver signals that it has effectively received the value (�ch? is true). For the receiver, the encoding is a mirror.

Alas, this encoding is not directly usable in dL. Indeed, it uses the fact that parallelism is a base feature of the formalism. If we directly use this definition, we would never receive the acknowledgment sent by the receiver since we do not let a possibility to the receiver to executes. We need to adapt the encoding to comply with our notion of parallelism based on the non-deterministic choice operator.

The idea is to separate the encoding of ch!e and ch?x of α by the non-deterministic choice operator Y to retrieve our framework. We have to add ordering constraints to ensure that ch!e executes before α. We make extensive use of guards in a similar manner to the encoding of Section 4.2. We proposed the following encoding:

ch!e fi p?ch? " J ^ch! " K; ch :" e; ch! :" Jq Yp?pch? " K ^ch! " Jq _ pch? " J ^ch! " Jq; ch! :" Kq ch?x fi p?ch! " J ^ch? " J; x :" ch; ch? :" Kq Yp?ppch? " K ^ch! " Jq _ pch? " K ^ch! " Kq ^x " ch; ch? :" J

We also use two dedicated boolean variables ch! and ch? to perform the ordering constraints. The two constructs in the right-hand side of the non-deterministic choice operator Y are here to account for the waiting periods await �ch? and await ch!. Using the nondeterministic choice operator allows time to flow between two executions.

We show how it interacts with other constructs. Let α and β be discrete programs. We define ch!e; α and ch?x; β as following: ch!e; α fi p?ch? " J ^ch! " K; ch :" e; ch! :" Jq Yp?pch? " K ^ch! " Jq _ pch? " J ^ch! " Jq; α; ch! :" Kq ch?x; β fi p?ch! " J ^ch? " J; x :" ch; ch? :" Kq Yp?ppch? " K ^ch! " Jq _ pch? " K ^ch! " Kqq ^x " ch; β; ch? :" J

We do not use the sequence operator ; as it does not allow time to flow between communications. But the proposed encoding is equivalent in terms of reachability semantic. Remember that we assume our components to always be iterated an arbitrary number of times. Thus we compare the reachability set of pch!e; αq ˚and `p?ch? " J ^ch! " K; ch :" e; ch! :" Jq Y p?ch? " K ^ch! " J; α; ch! :" Kq ˘˚.

Conjuncture 2.

ρ ´`ch!e; α ˘˚¯" ρ ´`p?ch? " J^ch! " K; ch :" e; ch! :" JqYp?ch? " K^ch! " J; α; ch! :" Kq ˘˚W e can use the same idea to encode the other usual interactions such as non-deterministic choice and iteration.

Revisiting the parallel composition Since we have an explicit notion of communication channels, we can assume that they are unique and more subtle during the composition for the resulting inputs and outputs. When composing two components with matching inputs and outputs, we can hide it at the level of the component resulting from the parallel composition. The communication channel is internalized and communicates no more with the exterior. The In the Figure 5.1, the channel ch 1 is hidden by the composition. It helps the scalability of our method since it allows to hide variables that are of no use during after the composition. Such process is not possible using our simple model of communications based on shared variables. Indeed, an output may be used by several components and hiding it during the composition may forbid associative composition and incremental design.

Communication delays Communication delays are a serious issue for the design of hybrid systems in a compositional manner. The addition of new components may introduce delays that were not expected and cause malfunction. We show how to add delays to our communication channels using the work of Section 4.2.

Assume that the sending of a message takes ∆ 1 units of time and the acknowledgment ∆ 2 units of time. We add two special notification variables t ch! and t ch? to remember the last execution. We add the tests ?t ď t ch! `∆1 and ?t ď t ch? `∆2 in the guards and the assignment t ch! :" t and t ch? :" t as following:

ch!e fi p?ch? " J ^ch! " K ^t ď t ch! `∆1 ; ch :" e; ch! :" J; t ch! :" tq Yp?pch? " K ^ch! " Jq _ pch? " J ^ch! " Jq; ch! :" Kq ch?x � qp?ch! " J ^ch? " J ^t ď t ch? `∆2 ; x :" ch; ch? :" K; t ch? :" tq Yp?ppch? " K ^ch! " Jq _ pch? " K ^ch! " Kqq ^x " ch; ch? :" J

We detail the case of ch!e; α where α (resp. β) is a discrete program and has an execution period of δ α (resp. ∆ β ).

ch!e fi p?ch? " J ^ch! " K ^t ď t ch! `∆1 ; ch :" e; ch! :" J; t ch! :" tq Yp?ppch? " K ^ch! " Jq _ pch? " J ^ch! " Jqq ^t ď t α `∆α ; α; t α :" t; ch! :" Kq ch?x fi p?ch! " J ^ch? " J ^t ď t ch? `∆2 ; x :" ch; ch? :" K; t ch? :" tq Yp?ppch? " K ^ch! " Jq _ pch? " K ^ch! " Kqq ^x " ch ^t ď t β `∆β ; β; t β :" t; ch? :" J Our composition operator can be modified accordingly to take into account communication delays.

Conclusion

We have presented ideas on the integration of communications channels in our framework, improving further the usability of our work. It allows the modeling of communication delays. It may also served as a basis to take into account privacy and security concerns. Indeed, being able to model a communication channel allows the modeling of attackers.

Implementation

We have presented in Section 3.4 a prototype implementing the process of construction of a proof of satisfaction of the conjunction of contracts in KeYmaera X. It shows feasibility of an automation of our approach, yet we are far from an usable tool. We discuss several directions to improve our prototype.

First, we need to take into account all the subtleties of the implementation of dL in KeYmaeraX. This theorem prover is in active development, and it is difficult to keep track of all introduced variations of proof rules.

A second is to implement the effect of the parallel composition operator. For now, each component are defined in the form of a .kyx file and the component resulting of the parallel composition is manually defined in a separate .kyx file. Since the parallel composition operator is syntactically defined, there should not be theoretical issues to this work.

With the two previous steps achieved, it will allow to test the effectiveness of our approach against more use-cases. It will help to define by practice for which kind of systems our approach is really effective and compare it with the component-based approach of Mueller et al. [START_REF] Müller | A component-based approach to hybrid systems safety verification[END_REF] and the standard approach in KeYmaera X.

Improving extensions of the parallel composition

We discuss research directions coming from results of Chapter 4. In this chapter, we have defined extensions of our parallel composition operator to take into accounts several category of systems. We have first defined a framework to take into account timing aspect inherent to Computer-Controlled Systems (CCS). We have also presented how to adapt the approach to model modes in a system and causality relations between discrete components.

First, we discuss in Subsection 5.2.1 how to handle timing aspects of CCS when there is more than one computation unit. In Subsection 5.2.2, we investigate the extension to continuous component our approach to handle modes in Cyber-Physical Systems. Last, we discuss also a possible extension of our causal composition operator to continuous component in Subsection 5.2.3.

Timed parallel composition with several CPUs

We have presented in Section 4.2 how to take into account execution periods during parallel composition. We are in the context of Computer-Controlled Systems where discrete components are in fact programs. For that, we have assumed that we execute the programs on one CPU, leading that the resulting execution period of two programs in parallel is the sum of respective execution periods. An interesting point to investigate is if we assume that each program have its own CPU. Thus the resulting execution period from the parallel composition would be the maximum of each resulting periods.

Given this slight change in the definition of a timed parallel composition operator (cf Definition 46), we should retain the commutativity and associativity properties. Also, we should still be able to guarantee that the component resulting from this parallel composition satisfies the conjunction of respective contracts, i.e. a theorem similar to Theorem 10.

Yet, it seems a little unrealistic to assume that every program is executed on its own CPU and it may be too restrictive to assume that they all execute on one CPU. An interesting point to investigate would be how we can define a timed parallel composition operator when we have two CPUs, three CPUs, or a fixed number n of CPUs. More generally, how it is possible to integrate results on WCET calculus in our framework.

Modes for continuous systems

We have defined modes only for discrete systems in Section 4.3. It is justified by the fact that modes are inherently human-made constructs, and thus it seems unnatural to define modes on continuous components. Yet, there may be systems outside our knowledge to which such modeling will be useful. It may also be useful as a proof artifact.

A possible modeling would be to add the events E in the evolution domain. To accounts for the two possible modes, we would have to split our continuous system in two differential equation and use the non-deterministic choice operator for consistency with our previous definition. It is somehow similar to the idea in Subsection 5.1.1.

Given two behaviors 9 X " θ X & H X and 9 Y " θ Y & H Y , and a mode event E, the mode composition would result in the following behavior

`p 9 X " θ X & H X ^Eq Y p 9 Y " θ Y & H Y ^�Eq ˘154
It is unclear how it would interact with discrete components, and whether it is associative. Also, it is not clear whether the same reasoning as in Subsection 4.3.2 can be applied to retain contracts through composition.

Causal composition for continuous components

As for the mode structure, we have defined the causal composition for discrete components. We think that an extension to continuous component is possible, but it is not clear if there is a need for it. However, it may be useful as a proof artifact.

Causal composition of two components means that one has to execute before the other one. The obvious choice to model it is to use the sequence operator ; of dL. But, it does not fit our general form of a component's behavior with the use of non-deterministic choice. A possibility is to make profit of the control period notion to temporally separate them.

Definition 52 (Continuous causal composition). Let α fi 9

X " θ X & H X ^t ď ∆ α be the behavior of a component A with control period ∆ α and β fi 9

Y " θ Y & H Y ^t ď ∆ β be the behavior of a component B with control period ∆ β . The continuous causal composition of these behaviors would be:

`p 9 X " θ X & H X ^t ď ∆ α q Y p 9 Y " θ Y & H Y ^∆α ď t ď ∆ β `∆α q ˘We
first execute α, then β. It is similar to the idea of continuous composition presented in Subsection 5.1.1. Yet, there is several issues with this definition. First, it is incompatible with the rest of the framework where the continuous part is only one differential equation. This seems more compatible if we have already extended the definition of the continuous parallel composition as discussed in Subsection 5.1.1. A second issue is how it would interact with the discrete part. Two last issues are whether this composition is associative and whether the component resulting from this composition would satisfies the conjunction of contracts.

Toward integration of refinement into component-based approach 5.3.1 Refinement in dL

In [START_REF] Mitsch | Refactoring, refinement, and reasoning[END_REF], the authors define a notion of refinement for hybrid programs. A hybrid program α refines a hybrid program β if the set of reachable states of α is included in the set of reachable states of β. Recall that we note ρpαq the set of reachable states of α. In [START_REF] Loos | Differential refinement logic[END_REF], the authors integrate the notion of refinement as a first-class formula of the system and provide an extension of the sequent calculus to syntactically reason on refinement. The formula stating that α refines β is denoted by α ď β. Its semantic follows from the previous definition.

Definition 54 (Semantic α ď β). ν |ù α ď β iff tω | pν, ωq P ρpαqu Ď tω | pν, ωq P ρpβqu Our initial goal was how to modularly design and prove correctness of Cyber-Physical Systems (CPS)? Such systems feature physical evolution with discrete interactions. Such systems are pervasive, but their dual nature make them hard to model and verify. We are more specifically interested into what we call structural complexity. It refers to systems where blocks are elementary and the complexity of the system arise from their repetitive composition. The challenge is to come up with a correct-by-design methodology usable by an engineer. For that, it must follow as much as possible the usual workflow of designer of Cyber-Physical Systems while integrating proof methods to ensure correctness of the system.

To tackle the structural complexity, we have developed a modular component-based approach in the Differential Dynamic Logic (dL) presented in the Chapter 3. We have shown also how to adapt it to several common design patterns in the Chapter 4.

More precisely, we have defined a notion of component at a high-level specification, the so-called textual representation, and at a low-level specification, the so-called behavior, as a hybrid program of dL. We have defined what it means for a component to satisfy its contract and exemplified it with a cruise-control example.

We have defined how to compose parallel components by mean of a parallel composition operator. We have shown that it is commutative, meaning that the order of composition is not important, and associative, meaning that we can incrementally design a system. We hence have a truly modular design method for CPS.

On top of that, we have stated and demonstrated a theorem that allows to construct contracts through composition. Given two components that satisfy their respective contracts, the component resulting from the parallel composition satisfies the conjunction of contracts. The theorem operates under conditions that correspond to required properties for a meaningful composition. It has also been exemplified with the cruise-control example.

To assess the feasibility of a possible implementation of our method, we have developed a small prototype using the tactic language defined in KeYmaera X. Although it is just a working prototype, it comforts us to think that a full-fledged implementation is possible.

Finally, to explore the possibility of our methodology, we have studied a small water-plant example where two water-tanks are linked together and they have their water-level controller. It shows that our methodology is general, and requires a lot of supplementary efforts from the designer to conceive Computer-Controlled Systems, a special class of Cyber-Physical Systems widely used in industrial systems.

To remedy such facts, we have studied several adaptations of our parallel composition operator to take into account the timing constraints on executions of a system, the introduction of modes and the causal composition of two components.

For each adaptation, we have presented how to modularly model and prove correctness of considered systems. We have be careful to retain the associativity property and that the adapted composition remains syntactic. We have also stated and demonstrated for each case a theorem ensuring that the component resulting from the composition satisfies the conjunction of respective contracts.

GV [START_REF]Proof measurement and estimation[END_REF] ; master, master ) ), GV [START_REF]Proof measurement and estimation[END_REF] ; master ), choiceb [START_REF]Proof measurement and estimation[END_REF] ; andR [START_REF]Proof measurement and estimation[END_REF]

` 1 Figure 2

 12 Figure 2.5: Iteration

Figure 2 . 6 :

 26 Figure 2.6: Differential equation

9

 9

Figure 2 . 7 :

 27 Figure 2.7: Closing rules

Figure 2 .

 2 Figure 2.11: Rules _ r and _ l

Figure 2 .

 2 Figure 2.13: Existential rules

Figure 2 . 14 :

 214 Figure 2.14: Wrong choice of variable in rule @ l

Figure 2 . 16 :

 216 Figure 2.16: Proof tree of the formula `pp Ñ qq ^pr Ñ sq ^pp _ rq ˘Ñ pq _ sq

Figure 2 . 18 :

 218 Figure 2.18: Rules W r and W l

Figure 2 . 22 :

 222 Figure 2.22: Proof tree for the derivation of the Modus Ponens rule

Figure 2 .

 2 Figure 2.23: r:"s rule

Figure 2 . 24 :

 224 Figure 2.24: No bound variable renaming

Figure 2 . 25 :

 225 Figure 2.25: With bound variable renaming

Figure 2 . 26 :Figure 2 . 27 :

 226227 Figure 2.26: Rules for the test

Figure 2 . 28 :

 228 Figure 2.28: Rules for the non-deterministic assignment

Figure 2 . 29 :

 229 Figure 2.29: Example of use of rules r?s, r; s and rYs

Figure 2 . 32 :

 232 Figure 2.32: Incorrect proof without skolemisation

Figure 2 . 33 :

 233 Figure 2.33: Proof tree for Fibonacci

Figure 2 . 35 :

 235 Figure 2.35: Branch Π Step

Figure 2 . 39 :

 239 Figure 2.39: Rule [ODEsolve]

Figure 2 . 40 :

 240 Figure 2.40: Example of use of the rule [ODESolve]

Figure 2 . 42 :

 242 Figure 2.42: Example of use of the rule [DW]

Figure 2 . 44 :

 244 Figure 2.44: Example of use of rule [DC]

Figure 2 . 46 :

 246 Figure 2.46: Proof tree of d " 0, e " 1, r " 1 $ r 9d " e, 9 e " ´dsd 2 `e2 " r 2

Figure 3 . 4 :

 34 Figure 3.4: Textual definition of the Engine

Figure 3 . 5 :

 35 Figure 3.5: Graphical representation of the engine

Figure 3 . 8 :

 38 Figure 3.8: Cruise-control defined by composition of Engine and Tachymeter

Figure 3 . 10 :

 310 Figure 3.10: Possible executions of the parallel composition We exemplify the parallel composition of behaviors with both discrete and continuous part by considering the composition of the Engine's behavior with the Tachymeter's behavior. Example 26 (Behavior of the Cruise-control). The Cruise-control component is made up of the Tachymeter and the Engine. It is itself a component that can be composed with other components like the fuel consumption monitor. Its behavior Cruise-control is obtained by the composition of Engine and Tach.

  As in the continuous case, the parallel composition operator ˝is commutative and associative. Proposition 3 (Commutativity). Let α and β be behaviors of components A and B. α ˝β " β ˝α Proof. The commutativity property results from the commutativity of the operator Y and the commutativity of the operator ˝c. Let α and β be behaviors of components A and B, i.e.

  ˝cq fi β ˝α pFold definition of ˝q Proposition 4 (Associativity). Let α, β and γ be behaviors of components A, B and C. pα ˝βq ˝γ " α ˝pβ ˝γq Proof. The associativity property results from the associativity of the operator Y and the associativity of the operator ˝c. Let α, β and γ be behaviors of components A, B and C, i.e. α fi pdisc α Y cont α q ˚,

Åα:✗Figure 3 . 11 :

 311 Figure 3.11: Unsafe composition with common outputs This example provides us with a first necessary condition toward automated derivation of proof trees.

A✗Figure 3 . 12 :

 312 Figure 3.12: Unsafe composition with a guarantee referring to an exterior output

Figure 3 . 13 :

 313 Figure 3.13: Guarantee does not imply the assumption

  [DI], [ODEsolve] and [DW]. We first consider the case where E, A α $ rαsG α and E, A β $ rβsG β are proved by the rule [DI]. For the rule [ODEsolve], we show how to construct a proof using [DI] rule instead. Last, we consider the case where one have been proved by rule [DI] and the other by rule [DW] and the case where both sequents have been proved by rule [DW].

  [ODEsolve] The case where one component have been proved by the rule [ODEsolve]: we use a result of A. Platzer stating that if we have a proof with the rule [ODEsolve], then we have a proof with the differential induction rule [DI]. We can thus get back to the first case. • [DW]-[DW] Where both proofs have been achieved by the use of the differential weakening rule: we apply the rule [DW] to the sequent representing the contract of the composite and we retrieve our assumptions easily. • [DI]-[DW] One sequent have been proved by the differential induction rule and the second by the differential weakening rule: we introduce the guarantee of the first one in the evolution domain with the differential cut rule and apply then the rule [DW] ([DI]-[DI])

1 βFigure 3 . 14 :

 1314 Figure 3.14: Summary of the proof for the case [DI]-[DI]

Figure 3 . 15 :

 315 Figure 3.15: Summary of the proof for the discrete case

  , we have two premises to consider. The left premise E, A α , A β , G αβ α Ĝαβ β $ rdisc αβ α Ydisc αβ β spG αβ α ^Gαβ β q is exactly similar to the induction step of the case where both components are discrete and is closed using Π ind discα and Π ind disc β . The right premise E, A α , A β , pG αβ α ^Gαβ β q $ rcont αβ αβ spG αβ α ^Gαβ β q is closed by applying the Theorem 1 and using the proof trees Π ind contα and Π ind cont β .

  piq

Figure 3 . 16 :

 316 Figure 3.16: Application of the rule [Ind] for the general case

/ *

 * Base case of the first tactic */ val baseStep1: BelleExpr = ( /* To fill by the user */ ... ) /* Differential induction step of the first tactic */ val diffInductionStep1: BelleExpr = ( /* To fill by the user */ ..

  val di2: BelleExpr = ( print("Try DI2 tactic") & implyR(1) & dI('diffInd)(1) <( print("Base step") & andR('R) <( baseStep1, baseStep2 ), print("Differential Induction step"

  We apply the tactic dW('R) corresponding to the Differential Weakening rule[DW]. We use the tactics tacticDW1 and tacticDW2 to close the proof.val dw2: BelleExpr = ( print("Try DW2 tactic") & implyR(1) & dW('R) & implyR(1) & andR(1) <( tacticDW1, tacticDW2 ) )DI-DW We consider the case where the proof of satisfaction of contract of the first component has been achieved with the Differential Induction rule [DI] and the one for the second component has been achieved with the Differential Weakening rule[DW]. We require the user to provide the tactic used to proved the initial step (tactic baseStep1) and the differential induction step (tactic diffInductionStep1). We require also that she provides the guarantee invariant1 of the first contract and the tactic tacticDW2 used to achieve the second proof. /* Base case of the first tactic */ val baseStep1: BelleExpr = ( /* To fill by the user */ ... ) /* Differential induction step of the first tactic */ val diffInductionStep1: BelleExpr = ( /* To fill by the user */ ... ) val invariant1: Formula = /* To fill by the user */ ... val tacticDW2: BelleExpr = ( /* To fill by the user */ ... )

  val didw: BelleExpr = ( print("Try DIDW tactic") & implyR(1) & dC(invariant1)(1) <( dW('R) & implyR('R) & andR(1) <( master(), tacticDW2 ), dI('diffInd)(1) <( print("Base step") & baseStep1, print("Differential Induction step") & chase('R) & diffInductionStep1, ) ) )

/ *

 * Base case of the first tactic */ val baseStep1: BelleExpr = ( /* To fill by the user */ ... ) /* Induction step of the second tactic */ val inductionStep1: BelleExpr = ( /* To fill by the user */ ... ) val invariant1: Formula = /* To fill by the user */ ... We have similar tactics (baseStep2, inductionStep2 and invariant2) for the other component. The tactic to obtain the proof of satisfaction of the conjunction of contracts by the composition of components is given in the tactic discDiscCase. val discDiscCase: BelleExpr = ( print("Try Discrete-Discrete tactic") & implyR(1) & loop(And(invariant1, invariant2))('R) <( print("Base step") & andR('R) <( baseStep1, baseStep2 ), print("Use step") & master(), print("Induction step") & inductionStepTactic ) )

/ *

 * Base case of the first tactic */ val baseStep1: BelleExpr = ( /* To fill by the user */ ... ) /* Discrete induction step of the first tactic */ val discInductionStep1: BelleExpr = ( /* To fill by the user */ ... ) /* Continuous induction step of the first tactic */ val contInductionStep1: BelleExpr = ( /* To fill by the user */ ..

  val generalCase: BelleExpr = ( print("Try General tactic") & implyR(1) & loop(And(invariant1, invariant2))('R) <( print("Base step") & andR('R) <( baseStep1, baseStep2 ), print("Use step") & master(), print("Induction step") & choiceb(1) & andR('R) <( inductionStepTactic, continuousComposition ) ) )

Figure 3 . 18 :

 318 Figure 3.18: Schema of water-Tank

Figure 3 . 20 :

 320 Figure 3.20: Water-level component

wlm 1 wl 1 Figure 3 . 21 :

 1321 Figure 3.21: Graphical representation of the Water-level1 component

Figure 3 . 22 :

 322 Figure 3.22: Controller component

Figure 3 . 23 :

 323 Figure 3.23: Graphical representation of the Controller1 component

wlm 1 ��Figure 3 . 24 :

 1324 Figure 3.24: Parallel composition of Water-level1 with the Controller1

Figure 3 . 26 :

 326 Figure 3.26: Graphical representation of the Water-tank2 component

Figure 3 . 27 :

 327 Figure 3.27: Graphical representation of the Water-plant component

Figure 4 . 1 :

 41 Figure 4.1: Structure of a CCS

Proposition 5 (

 5 Commutativity and Associativity). Let α, β and γ be behaviors of discrete components A, B and C, and of respective periods ∆ α , ∆ β and ∆ γ . α b β " β b α (Commutativity) pα b βq b γ " α b pβ b γq (Associativity)

Example 50 (

 50 Water-tank). The component Water-tank1 is obtained by the composition of components Controller1 and Water-levell1. It is similar the behavior in Example 38. Example 51 (Water-plant). In Example 46, we have composed the two water-level controllers. Let denote the resulting component by Controller12. In Example 48, we have composed the two water-level. Let denote the resulting component by Water-level12. By composing Controller12 with Water-level12, we obtain the water-plant component Water-plant.

A

  general component can be discrete and continuous, e.g. a CCS. The behavior α of such component has the canonical form pdisc α Y cont α q ˚. If we want to add a discrete component, e.g. a program monitoring an other plant but which have to run on this CPU, in parallel, then we have to be careful that the new duration of execution of the resulting discrete subcomponent does not exceed the control period of the plant.Modeling We present the definition of timed parallel composition for general components. It aggregates the previous definitions.Definition 44 (Parallel composition of two general components ). The component AB resulting from the parallel composition of a general componentA and a general component B is defined by: Compound Component: AB Control period: minpε α , ε β q Period: ∆ α `∆β Inputs: A.inputs Y B.inputs Assumptions: A α ^Aβ Outputs: A.outputs Y B.outputs Guarantees: G α ^Gβ Functional behavior: α b β

Figure 5 Figure 5 . 1 :

 551 Figure 5.1: Parallel composition with communication channels

Definition 53 (

 53 Refinement). A hybrid program α refines a hybrid program β, denoted by α Ď β, if ρpαq Ď ρpβq

  3.3 Modular proof . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.3.1 Necessary conditions . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.3.2 Technical result . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.3.3 For two continuous components . . . . . . . . . . . . . . . . . . . . . . 3.3.4 For two discrete components . . . . . . . . . . . . . . . . . . . . . . . 3.3.5 For a discrete component and a continuous component . . . . . . . . . 3.3.6 For two general components . . . . . . . . . . . . . . . . . . . . . . . . 3.4 A prototype in KeYmaera X . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.4.1 Presentation of Bellerophon . . . . . . . . . . . . . . . . . . . . . . . . 3.4.2 Implementation in KeYmaera X . . . . . . . . . . . . . . . . . . . . . 3.5 Study of a water-plant example . . . . . . . . . . . . . . . . . . . . . . . . . . 3.5.1 Environment and initial conditions . . . . . . . . . . . . . . . . . . . . 3.5.2 Water-level . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .2.3 Causal composition for continuous components . . . . . . . . . . . . . 5.3 Toward integration of refinement into component-based approach . . . . . . . 5.3.1 Refinement in dL . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.3.2 Refinement and parallel composition . . . . . . . . . . . . . . . . . . .

	Chapter 1

3.5.3 Controller . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.5.4 Water-tank . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.5.5 Water-Plant . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.5.6 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

  .26). In the Figure2.3, ν 3 is a reachable state from ν 2 by y :" y `1 and ν 2 is a reachable state of ν 1 by x :" 42. Thus ν 3 is a reachable state from ν 1 by the program x :" 42; y :" y `1. from the state ν by α Y β is either a reachable state of α or of β. In the Figure2.4, ω 1 is a reachable state from ν by x :" 42 and ω 2 is a reachable state from ν by y :" y `1. Thus, ω 1 and ω 2 are reachable states of x :" 42 Y y :" y `1.

	x :" 42; y :" y	`1
	ν x " 4 y " 2 . . . Figure 2.1: Assignment ω x " 42 y " 2 . . . x :" 42 A reachable state of α; β from a state ν is a state reachable by β from a reachable state of ν x " 4 y " 2 . . . ?ϕ Figure 2.2: Test x " 4 y " 2 . . . ν 2 x " 42 y " 2 . . . ν 3 x " 42 y " 3 . . . x :" 42 y :" y `1 Figure 2.3: Sequence A reachable state ν x " 4 y " 2 ω 1 x " 42 y " 2 . . . α. ν 1 . . . ω 2

  A component is defined by a name and a behavior. The behavior is the functional modeling of the component. It is represented as a hybrid program of dL 1 and defines the evolution of the component trough time. We adopt the convention of denoting a generic component by a capital letter and the associated behavior with its equivalent in the greek alphabet. Tach fi `?t tach `ε ě t; s acm :" s eng ; s tach :" ˚; ?p0 ď s tach ď S ^´δ ď s tach ´sacm ď δq; a :" s tach ´sacm

	Name: Tachymeter
	Inputs:
	s eng
	Outputs:
	s acm
	s tach
	a
	Behavior:

Example 17 (Name and behavior of the Tachymeter component). The Tachymeter is a software which senses the speed of the vehicle every ε seconds. It decides the speed that should be attained by the vehicle after ε seconds and set up the acceleration given to the engine. Its behavior is defined by the hybrid program denoted Tach. We give a detailed presentation in Example 21.

Name: Tachymeter Behavior:

Tach fi `?t tach `ε ě t; s acm :" s eng ; s tach :" ˚; ?p0 ď s tach ď S ^´δ ď s tach ´sacm ď δq; a :" s tach ´sacm ε ; t tach :" t ˘Figure

3.1: Tachymeter

Interface The interface of a component describes how it interacts with the world. It specifies the inputs and the outputs along with the properties associated to every component. Example 18 (Interface of the Tachymeter). The component Tachymeter possess one input and three outputs. The input s eng represents the actual speed of the engine and the output s acm the measured speed. s tach is the target speed the vehicle should attain after ε seconds and a the acceleration to follow to reach the target speed. ε ; t tach :" t ˘Figure 3.2: Tachymeter with inputs and outputs Contract We associate properties to a component by using contracts. A contract is a pair of formulas pA, Gq, called the assumptions A and the guarantees G. Guarantees are properties on the outputs of the component. Assumptions are properties that the inputs are presumed to satisfy.

  ?p0 ď s tach ď S ^´δ ď s tach ´sacm ď δq; a :" s tach ´sacm Engine representing the speed of the vehicle regulated by the Tachymeter component.Example 20 (Engine component). The inputs of the engine are the outputs of the tachymeter, and reciprocally the output s eng is the input of the tachymeter. The assumptions of the engine are the guarantees of the tachymeter. It assumes that the targeted speed s tach and the measured speed s acm provided by the Tachymeter do not exceed the speed limit S. Reciprocally, the guarantees of Engine, i.e. that the actual speed s eng does not exceed the speed limit, correspond to the assumptions of the Tachymeter component. The behavior Engine is the differential equation detailed later inExample 22.

	: Tachymeter Inputs: s eng Assumptions: 0 ď s eng ď S Outputs: a s tach s acm Guarantees: 0 ď s ε Inputs: a s tach s acm Assumptions: We can also define the component Name: Engine ; t tach :" t 3.3: Complete representation of the tachymeter ˘Figure 0 ď s

acm ď S ^0 ď s tach ď S ^a " s tach ´sacm ε Behavior: Tach fi `?t tach `ε ě t; s acm :" s eng ; s tach :" ˚; acm ď S ^0 ď s tach ď S ^a " s tach ´sacm ε Outputs: s eng Guarantees: 0 ď s eng ď S Behavior: Engine fi 9 s eng " a, 9 t " 1 & 0 ď t ´ttach ď ε

  Definition 40 (Parallel composition of continuous components). The component resulting from the parallel composition of two continuous components A and B is:

	Compound Component: AB
	Control period:
	minpε α , ε β q
	Inputs:
	A.inputs Y B.inputs
	Assumptions:
	A α ^Aβ
	Outputs:
	A.outputs Y B.outputs
	Guarantees:
	G α ^Gβ
	Functional behavior:
	α b β

  We recall that α is the functional behavior of a discrete component and may result from multiple previous compositions. It is thus of the form α fi α 1 Y. . .Yα n where α i are behaviors of functional sub-components.Definition 47 (Mode). Let α be the functional behavior of a discrete component A with event E α . The canonical structure of a mode is given by the hybrid program:

	A α ^Aβ
	Outputs:
	A.outputs Y B.outputs
	Guarantees:
	G α ^Gβ
	Functional behavior:
	α
	´Ť 1ďiďn	?E
	: A
	Event:
	E α
	Inputs:
	A.inputs Y B.inputs
	Assumptions:

α ; α i ¯We distribute the event formula E α to every sub-components α i of the component α.

  Definition 51. (Discrete causal composition). Let α and β be two discrete behaviors of components A and B with execution periods ∆ α and ∆ β . They respect the canonical form `Ť 1ďiďn p?Lapse α i ^t ď t α i `∆α ^Ord α i ; α i ; t α i :" tq ˘˚for the behavior α and we have `Ť 1ďjďm p?Lapse β j ^t ď t β j `∆β ^Ord β j ; β j ; t β j :" tq ˘˚for the behavior β. t β j ă tq ^Lapse α i ^t ď t α i `∆α `∆β ^Ord α i ; α i ; t α

	The causal composition α d β is defined by:
	¨Ť 1ďiďn	`?p	Ź

1ďjďm i :" t Y Ť 1ďjďm `?Lapse β j ^t ď t β j `∆α `∆β ^Ord β j ^p Ź 1ďiďn t α i ě t β j q; β j ; t β j :" t ˘‹ '

We add the constraint p Ź 1ďjďm t β j ă tq in front of each sub-behaviors α i of α. Since α

  d β fi `p?t β 1 ă t ď t α 1 `∆α `∆β ; α 1 ; t α 1 :" tq Yp?t ď t β 1 `∆α `∆β ^tβ 1 ď t α 1 ; β 1 ; t β 1 :" tq ˘ånd on the other side: β d α fi `p?t α 1 ă t ď t β 1 `∆β `∆α ; β 1 ; t β 1 :" tq Yp?t ď t α 1 `∆β `∆α ^tα 1 ď t β 1 ; α 1 ; t α 1 :" tq ˘In the first case, a sole execution of α is possible, thus ρp?t β ă t ď t α `∆α `∆β ; α; t α :" tq Ď ρpα d βq. But in the second case, a sole execution of α is not possible. We must have β executed before executing α, thus ρp?t β ă t ď t α `∆α `∆β ; α; t α :" tq Ę ρpβ d αq.For the associativity property, we unfold the definition of each successive causal composition. We denote the formula p Ź 1ďjďm t β j ă tq ^Lapse α i by Lapse α i β . In the similar manner, we denote the formula Ordβ j ^p Ź Lapse γ k ^t ď t γ k `∆β `∆γ ^Ord βγ k ; γ k ; t γ k :" t ˘¯˚"´Ť 1ďiďn `?Lapse α i β ^Lapse α i β ^t ď t α i `∆α `p∆ β `∆γ q ^Ord α i ; α i ; t α Lapse β j γ ^t ď t β j `∆α `p∆ β `∆γ q ^Ord αβ j ; β j ; t β Lapse γ k ^t ď t γ k `∆α `p∆ β `∆γ q ^Ord αγ k ^Ord βγ k ; γ k ; t γ k :" t ˘¯S ince p∆ α `∆β q `∆γ " ∆ α `p∆ β `∆γ q, we conclude that pα d βq d γ " α d pβ d γq because the unfolded definition are equivalent.

1ďiďn t α i ě t β j q by Ord αβ j .

We unfold twice the definition of d for pα d βq d γ.

pα d βq d γ " ˆ´Ť 1ďiďn `?Lapse α i β ^t ď t α i `∆α `∆β ^Ord α i ; α i ; t α i :" t Y Ť 1ďjďm `?Lapse β j ^t ď t β j `

∆α `∆β ^Ord αβ j ; β j ; t β j :" t ˘¯˚˙d γ " ´Ť 1ďiďn `?Lapse α i β ^Lapse α i γ ^t ď t α i `p∆ α `∆β q `∆γ ^Ord α i ; α i ; t α i :" t Y Ť 1ďjďm `?Lapse β j γ ^t ď t β j `p∆ α `∆β q `∆γ ^Ord αβ j ; β j ; t β j :" t Y Ť 1ďkďp `?Lapse γ k ^t ď t γ k `p∆ α `∆β q `∆γ ^Ord αγ k ^Ord βγ k ; γ k ; t γ k :" t ˘¯W e expand the definition for α d pβ d γq α d pβ d γq " α d ˆ´Ť 1ďjďm `?Lapse β j γ ^t ď t β j `∆β `∆γ ^Ord β j ; β j ; t β j :" t Y Ť 1ďkďp `?i :" t Y Ť 1ďjďm `?j :" t Y Ť 1ďkďp `?

  wl 1 " f in 1 ´f out 1 , 9 wl 2 " f in 2 ´f out 2 , 9 t " 1 & 0 ď t ď 5 ^3 ď t ď 7which is equivalent to9 wl 1 " f in 1 ´f out 1 , 9 wl 2 " f in 2 ´f out 2 , 9 t " 1 & 3 ď t ď 5

  out 1 , 9 t " 1 & 0 ď t ă 3 Y 9 wl 1 " f in 1 ´f out 1 , 9 wl 2 " f in 2 ´f out 2 , 9 t " 1 & 3 ď t ď 5 Y 9 wl 2 " f in 2 ´f out 2 , 9 t " 1 & 5 ă t ď 7

Remark 2. The rules r:"s, r?s, r; s and rYs decompose the system without any choice involved. They are syntactically directed and thus amenable to automation.Iteration The rule [Ind] for the iteration is presented in the Figure2.31. The reasoning is standard induction. We have two premises, one for the initial step and one for the induction step. The notation @ α ϕ is the skolemization of the formula ϕ by the bound variables of the hybrid program α.

n`2 `F 0 n`1 . We conclude by the rule ax.GeneralizationThe rule [Gen] allows to replace the invariant ψ by another invariant ϕ if we prove that ϕ is stronger that ψ.Γ $ rαsϕ, ∆ Γ $ @ α pϕ Ñ ψq, ∆ [Gen] Γ $ rαsψ, ∆Figure 2.36: [Gen] rule The skolemization in the right premise of the rule presented in Figure 2.36 is for soundness purposes as the rule in [Ind] (cf Fig. 2.31).

The syntax of hybrid programs can be found in Definitions 1 and 3

The syntax of formulas of dL can be found in Definition 8

Remerciements

We have presented a modular framework to model and prove correctness of Cyber-Physical Systems. We have showed it was adaptable if necessary. Yet, we have to validate it against more complex use cases to determine its effectiveness. For that, a complete implementation will be necessary. Validation against use cases will also help to determine if there is a need for more extensions of our framework or if the presented approach is sufficient.

Mes remerciements vont aussi à David MENTRE pour

We precise also how the time evolves and the initial conditions of the system. We denote with E wp the conjunction of all formulas.

Environment The environment is composed of parameters that are not outputs of components. The parameter δ 1 is the execution period of the first controller and δ 2 the execution period of the second controller. wlmax1 and wlmin1 are respectively the maximum threshold and the minimum threshold of the first tank that the water-level is allowed to reach. We have the same values for the second tank The outlet flow f out 1 of the first tank is assumed to be constant and is at 0.75.

δ 1 " 0.03 δ 2 " 0.02 wlmax 1 " 7 ^wlmin 1 " 3 wlmax 2 " 7 ^wlmin 2 " 3 f out 1 " 0.75

We will frequently replace wlmax 1 and wlmin 1 by their respective values 7 and 3.

Time

We assume that the time is passing linearly and is represented by the variable t. The variable t ctrl 1 represents the last instant of execution of the controller. We use a similar mechanism in the cruise-control system (cf Example 26). They are both initialized to 0.

Initial conditions

We provide initial values for each outputs. We assume that both waterlevels have the value 5 and that the variable memorizing respective water-levels is equal to 5 also at the initialization. We also assume that the inlet valve f in and the outlet valve f out 2 are both closed.

Chapter 4

Extensions of our framework

Modular proof of a Computer-Controlled System

The Subsection 4.1.1 have presented how to modularly model a CCS. We want now to be able to still retain contracts through composition. This subsection presents an adaptation of the Theorem 4 to transfer the respective contract of the plant and the controller through composition.

Environment. We assume that the designer provides a description of the environment, which is denoted by E. It contains all the variables that are not outputs of a component. They cannot be controlled and are exterior to the considered system. A classical example in hybrid systems is the gravity value g. The environment also regroups the initial values of the system.

Example 39 (Water-tank environment). In the water-tank, the environment E wt is the outlet flow f out which is equal to 0 or 1. There is also the control period ∆ Ctrl of the plant which is 0.2 sec and the period ∆ Ctrl of the controller which is 0.05. The initial value of the water-level wl and the measured water-level wlm are 5. The inlet valve f in is closed at the initialization.

E wt fi f out " 0.75 ^∆wlCtrl " 0.05 ^∆wl " 0.2 ^wl " wlm " 5 ^f in " 0

Controller We assume that the designer provides the assumptions A Ctrl and guarantees G Ctrl on the controller. Following the restriction of the Theorem 4, guarantees must not refer to outputs of the plant. Remember that the controller is said to satisfy its contract (Definition 20) if the following formula is valid:

We prove the validity by using the sequent calculus of dL, implemented in KeYmaera X.

Example 40 (Contract of the water-level controller). From the Example 3.22, the contract of the water-level controller is:

We have already a proof of the sequent:

Plant Similarly to the controller, we assume that the designer provides assumptions A P lant and guarantees G P lant on the plant. Again, the guarantees of the plant must not refer to the outputs of the controller. The plant satisfies its contract if the following formula is valid:

We prove the validity by using the sequent calculus of dL, implemented in KeYmaera X. Guarantees: 3 ď wl 1 ď 7 wl 1 " pf in ´f out 1 qpt ´tctrl 1 q `wlm 1 Functional behavior:

where G ctrl 1 are the guarantees of the component Controller1.

We have the same for the water-level Wl2 of the second tank for which the control period ε W l2 is 0.1.

Behavior of a timed component

To every discrete atomic component A of functional behavior α, we associate a fresh variable t α which is used to specify the time stamp of the component in an execution cycle.

Definition 37 (Behavior of an atomic component). Let A be an atomic component of duration ∆ α and functional behavior α. If α is discrete, then the behavior is:

X " θ & H, then the behavior is:

The variable t represents the time and it is assumed to be a read-only variable. We add a guard in front of a discrete functional behavior α to test if ∆ α units of times have passed since the last execution of α. It ensures that the discrete program executes periodically every ∆ α units of time. We add the assignment t α :" t which had to be understood as a time stamp signaling that α has executed.

Given the functional behavior of the Controller1 and the Water-level1 provided previously, and their respective execution period ∆ W lCtrl1 and ε W l1 , we have the following behaviors.

Example 45 (Behavior of the Controller1 and the Water-level1). The behavior WlCtrl1 of the atomic component Controller1 is:

The behavior Wl1 of the atomic component Water-level1 is:

We have considered how to integrate temporal considerations on components provided by the engineer. The other way to obtain a component is by parallel composition. The parallel composition is different following that it is between purely discrete components, purely continuous components or a mix of both. We detail the several case in the next subsections.

Timed parallel composition for discrete components

We adapt the parallel composition operator for discrete component by taking into account their respective execution period ∆. We assume that the discrete components are executed on one computation unit (e.g. one CPU). The resulting period is the sum of each respective periods since it is the Worst Case Execution Time (WCET) for the interleaving on one CPU.

The problem is different if we dispose of several computation units. It is possible to run two components truly in parallel and the resulting WCET will be the maximum of respective WCET.

Modeling We first define the parallel composition of discrete components. The main difference with the definition of a parallel composition operator in Section 3.2 is the presence of the execution period and it is modified through composition. There is no need to specify the period, the inputs, the assumptions, the outputs, the guarantees and the behavior of the resulting component, these characteristics are automatically inherited from the composition. The inputs (resp. outputs) are the union of respective inputs (resp. outputs). The assumptions (resp. guarantees) are the conjunction of respective assumptions (resp. guarantees). The parallel composition of discrete components is performed on one CPU, which means interleaving. The resulting period is the sum of respective periods. We explain in the next sections how it unfolds in dL. The behavior is given by the parallel The resulting control period is the minimum of respective control period as in Definition 40. The resulting execution period is the sum of respective execution periods as in Definition 39.

Definition 38 (Parallel composition of discrete components). The component resulting from the parallel composition of two discrete components

To define the parallel composition α b β of the behaviors α and β, we define the formula ControlP eriod αβ according to every possible association of α and β being discrete, continuous or general behaviors. Recall that the the canonical form of the discrete part of α (resp.

Definition 45 (ControlP eriod αβ ). Let α and β be behaviors of components A and B. Their respective execution periods are defined by ∆ α and ∆ β and their respective control period by ε α and ε β . The formula ControlP eriod αβ is defined by:

The first case where α and β are both continuous is presented in Subsection 4.2.3. The second and third case, where one is discrete and the other continuous, is presented in Subsection 4.2.2. The fourth and fifth case is the conjunction of the two following formulas, Ź 1ďjďm p0 ď t ´tβ j ď ∆ α `∆β q and pControlP eriod α q ∆α`∆ β ∆α . The resulting execution period is the sum of each respective period since both α and β exhibit discrete behaviors. The left conjunct is obtained as in the second case, but with the updated value for the execution period. The right conjunct is the control period formula of α already obtained by parallel composition with also an updated value for the execution period. The control period formula in the last case, when both α and β are general, is just the conjunction of both control period formulas with an update on the execution period.

Having defined the formula ControlP eriod αβ for every possible associations, we define the parallel composition for general components.

Definition 46 (Parallel composition of general behaviors). Let α and β be behaviors of general components. Remember that they respect the canonical form

In Example 51, we obtain the water-plant example by first composing the two controllers and the two water-level separately and then composing each resulting component. Here, we assume that we have composed the water-level of the first tank with its controller, the water-level of the second tank with its controller, resulting in two general components representing the first tank and the second tank. We can now compose them to obtain the water-plant system.

Example 57 (Contract for the error mode). The contract pA err , G err q for the Error component is:

It is simple to verify that Error satisfies its contract. As we consider the two components without a context, we can drop the assumption on the outputs of the water-level, we restrict the contract of Controller as following:

Example 58 (Composition of Error and Controller components). The event error " 0 and error " 1 are exclusive. G err does not refer to outputs of Controller other that f in which is the common output. Also, G ctrl does not refer to outputs of Error other that f in.

The condition pcq is also verified trivially. Thus we have that the component ControllerError resulting from the composition of Controller and Error satisfies the contract `Aerr ^Actrl , perror " 0 Ñ A ctrl q ^perror " 1 Ñ A err q ˘.

Conclusion

Compared to the previous theorem on parallel composition, we drop the assumptions that the outputs of the two components must be different, and still retain that the compound component satisfies the conjunction of respective guarantees.

We have presented how to handle two modes, but we think it is easy to generalize. To retain the associativity of the parallel composition operator ˝, we must be careful that each added event is mutually exclusive with all the other existing events. We think that a similar mechanism can be extended to components of the general form with the event being incorporated in the evolution of the continuous evolution. Yet, a mode is typically two possible functioning flow of a system and is something decided by a human.

When we reason on modes, we do not want to loose the reasoning on temporal constraints as presented in Section 4.2. We think it is possible to integrate both aspects, but it requires extra carefulness to mix theses methods. For example, the notification variable t ctrl must be shared with the component Error.

Fault-tolerance may also be handled using our mechanism of modes. The appearance of a fault is modeled as one mode of functioning and the composition is carried accordingly. We first present the definition for the case of two atomic discrete components to clearly identify the additions enforcing the ordering. We generalize it in the Definition 51. We proceed as for the timed parallel composition with the update of the execution period, but we also add ordering constraints in the test in front of the functional behavior.

Definition 50 (Causal composition of discrete atomic component). Let α and β be two functional behaviors of discrete atomic components A and B with respective periods ∆ α and ∆ β . Their causal composition α d β is given by: ˆp?t β ă t ď t α `∆α `∆β ; α; t α :" tq Y p?t ď t β `∆α `∆β ^tβ ď t α ; β; t β :" tq ˙Ås for the timed parallel composition, we replace the occurrences of ∆ α and ∆ β by the sum ∆ α `∆β . We add two supplementary formulas: t β ă t in the guard of α and t β ď t α in the guard of β. The second formula constraint β to wait that α has executed, i.e. that the value of t α is greater meaning that it has executed more recently. It rules out traces where β executes before α.

The formula t β ă t requires that a non-zero amount of time has passed since the last execution of β before executing again α. We have to remember that we are in a context where we model systems that take real time. It is thus not too restrictive to add the assumption that a small lapse of time have passed since the last execution.

Example 61 (Sensor-Monitor). We causally compose the Sensor component with the Monitor component. The resulting component SensorMonitor has the following behavior. The resulting execution period is 0.01 `0.02 " 0.03. ˆp?t ď t sens `0.03; wlm :" wl; t sens :" tq Y p?t ď t ctrl `0.03; p?wlm ě 6.5; f in :" 0q Y p?wlm ď 3.5; f in :" 1q; t ctrl :" tq ˙We generalize it for discrete general components. Remember that the canonical form of a discrete behavior with execution period ∆ α is α fi `Ť 1ďiďn p?t ď t α i `∆α ; α i ; t α i :" tq ˘˚. The α i are functional behaviors of discrete atomic sub-components. But the component may result from the causal composition of several of its sub-components. We thus have to add the formula Lapse α i and Ord α i accounting respectively for the forbidding An important rule associated to this formula is the rule rďs. To prove that ϕ holds for all executions of α, it is sufficient to prove that ϕ holds for all executions of β and that α refines β.

The rule is correct. Indeed, if ϕ holds for every executions of β, and that executions of α are just a subset of executions of β, ϕ holds also for all executions of α.

The authors provide also rules to derive the validity of formula α ď β following the structure of α and β. For example, we have the following rule.

To show that α 1 ; β 1 refines α 2 ; β 2 , we have to show that α 1 refines α 2 and, after all runs of α 1 , that β 1 also refines β 2 .

Refinement and parallel composition

When designing an industrial system, it is common to update a component, e.g. a sensor is updated with a new model that samples twice faster. Yet, we do not want to redo all our design and proof only to u pdate one component. A very interesting feature would be to say that if the behavior of a component B refines the behavior of a component A, with same contract and input/outputs, then we can replace A by B. We think that our parallel component-based operator enjoys this property. /* assumption that the measured water-level is in the range [START_REF] Abrial | The B-book: assigning programs to meanings[END_REF][START_REF] Altman | Asymptotic optimization of a nonlinear hybrid system governed by a markov decision process[END_REF]