A new abstraction-refinement based verifier for modular linear hybrid automata and its implementation

Model-based compositional verification approaches and tools development for cyber-physical systems

“…Input: LHA A and its unsafe locations. unsat-core ← UnsatCore(S A , ce) ; 12 spec saf e ← spec saf e ∨ Encode(unsat-core) ; 13 end 14 until running time limit is reached ; 15 Terminate("Time out. ");…”

“…All the experiments were performed on a laptop computer with 8G memory and Intel Core @2.30GHz processor. does not reach the unsafe region [9,10,12,19,20,27,36,50]. In contrast, the alternative simulationbased verification approach, that can be applied in run-time, generates a finite set of simulation traces from current system states, then computes over-approximation sets around those simulation trajectories to cover for the infinite set of cases that were not simulated [51,52,53,54,55].…”

“…This chapter extends the conference version [12] in multiple ways. First, a new section on related works from the literature is added, covering recent and historical development of algorithms and tools with respect to both (variable) state and location reachability analysis for hybrid systems.…”

“…The safety property of the LTS is examined starting with the underlying discrete state automaton as the abstract model. There are several advantages of specification relaxation as opposed to the standard abstract model refinement: (i) Firstly, specification relaxation is more straightforward than model refinement, since all that needs to be done is to encode the counterexample to relax the specification, so in a next round it can no longer remain a counterexample; (ii) in fact in our approach we identify an unsatisfiable core (unsat-core) that is the minimal conflicting constraint set (see [10,12]) over the constraints derived from a counterexample path. By using the encoding of the "unsat-core" to relax the specification, we are able to rule out an entire set of counterexamples possessing the same "unsat-core"; (iii) since there is no change in the underlying abstract model, the counterexamples of newer iterations can still be interpreted over the same underlying discrete graph structure, aiding the understanding of the counterexample.…”

“…We refer to our approach counterexample fragment based specification relaxation (CEFSR). We also developed a prototype tool LhaVrf, based on the approach described above and extending the initial development reported in [12]: The symbolic model checker NuSMV is integrated for model checking, whereas the SMT (satisfiability modulo theory) solver Z3 [13] is integrated for counterexample validation and unsat-core identification. Our contributions that integrate past works and recent enhancements are summarized as follows:…”