![](bg2.png)
system, where S is finite and nonempty. I
1
,...,I
k
⊆ R
are compact intervals over which the continuous vari-
ables of a hybrid system range. Φ denotes the state
space of a hybrid system, i.e., Φ = S × I
1
× ··· × I
k
.
Definition 1. A hybrid system H is a tuple
(Flow,Jump, Init,Unsafe), where Flow ⊆ Φ × R
k
,
Jump ⊆ Φ× Φ, I ⊆ Φ, and Unsafe ⊆ Φ.
Informally speaking, the predicate Init specifies
the initial states of a hybrid system and Unsafe the
states that should not be reachable from an initial
state. The relation Flow specifies how the system may
developcontinuously by relating each state to the pos-
sible corresponding derivatives, and Jump specifies
how H may change states discontinuously by relating
each state to its possible successor states. Formally,
the behavior of H is defined as follows:
Definition 2
. A flow of length l ≥ 0 in a mode s ∈ S
is a function r : [0,l] → Φ such that the projection of
r to its continuous part is differentiable and for all
t ∈ [0,l], the mode of r(t) is s. A trajectory of H is a
sequence of flows r
0
,...,r
p
of lengths l
0
,... , l
p
such
that for all i ∈ {0,..., p},
1. if i > 0 then (r
i−1
(l
i−1
),r
i
(0)) ∈ Jump, and
2. if l
i
> 0 then (r
i
(t), ˙r
i
(t)) ∈ Flow, for all t ∈ [0, l
i
],
where ˙r
i
is the derivative of the projection of r
i
to
its continuous component.
Definition 3
. A (concrete) counterexample of a hy-
brid system H is a trajectory r
0
,...,r
p
of H such that
r
0
(0) ∈ Init and r
p
(l) ∈ Unsafe, where l is the length
of r
p
. H is safe if it does not have a counterexample.
We use the following constraint language to de-
scribe hybrid systems and corresponding safety veri-
fication problems. The variable s ranges over S and
the tuple of variables ~x = (x
1
,... , x
k
) ranges over
I
1
× ··· × I
k
, respectively. In addition, to denote the
derivatives of x
1
,... , x
k
we use the tuple of variables
˙
~x = ( ˙x
1
,... , ˙x
k
) that ranges over R
k
, and to denote the
targets of jumps, we use the primed variable s
′
and
the tuple of variables~x
′
= (x
′
1
,... , x
′
k
) that range over
S and I
1
× · · · × I
k
, respectively. Constraints are arbi-
trary Boolean combinations of equalities and inequal-
ities over terms that may contain function symbols,
such as +, ×, exp, sin, and cos.
We assume in the remainder of the text that a hy-
brid system is described by our constraint language.
That means, the flows of a hybrid system are given
by a constraint Flow(s,~x,
˙
~x), the jumps are given by a
constraint Jump(s,~x,s
′
,~x
′
), the initial states are given
by a constraint Init(s,~x), and a constraint Unsafe(s,~x)
describes the unsafe states. To simplify notation, we
do not distinguish between a constraint and the set it
represents.
Example 1. Consider the following simple hybrid
system with the modes m
1
,m
2
and the continuous
variables x
1
,x
2
which both range over the interval
[0,2], i.e, Φ = {m
1
,m
2
} × [0, 2] × [0, 2].
The set of initial states are given by the
Init(s, (x
1
,x
2
)) = (s = m
1
∧ x
1
= 0 ∧ x
2
= 0). The
constraint Unsafe(s,(x
1
,x
2
)) = (x
1
> 1.5∧ x
2
= 1.5)
describes the set of unsafe states. The hybrid sys-
tem can switch modes from m
1
to m
2
if x
2
= 1, i.e.,
Jump(s,(x
1
,x
2
),s
′
,(x
′
1
,x
′
2
)) = (s = m
1
∧ x
2
= 1) →
(s
′
= m
2
∧ x
′
1
= x
1
∧ x
′
2
= x
2
) . The continuous be-
havior is described by constants. In addition, for a
flow in mode m
1
, the constraint 0 ≤ x
1
≤ 1 must hold.
The corresponding flow constraint is
Flow(s,(x
1
,x
2
),(˙x
1
, ˙x
2
)) =
(s = m
1
→ ( ˙x
1
= 1 ∧ ˙x
2
= 1 ∧ 0 ≤ x
1
≤ 1)) ∧
(s = m
2
→ ( ˙x
1
= 1 ∧ ˙x
2
= −1)) .
Note that the constraint 0 ≤ x
1
≤ 1 in flow forces a
jump from mode m
1
to m
2
if x
1
becomes 1.
Obviously, this hybrid system is safe.
3 FORWARD SEARCH BASED
ABSTRACTION REFINEMENT
In this section, we review our previous ap-
proach (Ratschan and She, 2007) for verifying safety
of hybrid systems using constraint propagation based
abstraction refinement.
We abstract to systems of the following form:
Definition 4
. A discrete system over a finite set S is
a tuple (Trans,Init, Unsafe) where Trans ⊆ S × S and
Init ⊆ S, Unsafe ⊆ S. We call the set S the state space
of the system.
In contrast to Definition 1, here the state space is a
parameter. This will allow us to add new states to the
state space during abstraction refinement.
Definition 5
. A trajectory of a discrete system
(Trans, Init, Unsafe) over a set S is a function r :
{0, . . . , p} 7→ S such that for all t ∈ {1, . . . , p}, (r(t −
1),r(t)) ∈ Trans. The system is safe if and only if there
is no trajectory from an element of Init, to an element
of Unsafe.
When we use abstraction to analyze hybrid sys-
tems, the abstraction should over-approximate the
concrete system in a conservative way: if the abstrac-
tion is safe, then the original system should also be
safe. If the current abstraction is not yet safe, we re-
fine the abstraction, that is, we include more informa-
tion about the concrete system into it. This results in
Algorithm 1.
ICINCO 2008 - International Conference on Informatics in Control, Automation and Robotics
66