Jesung Kim

Generating embedded software from hierarchical hybrid models

Benefits of high-level modeling and analysis are significantly enhanced if code can be generated automatically from a model such that the correspondence between the model and the code is precisely understood. For embedded control software, hybrid systems is an appropriate modeling paradigm because it can be used to specify continuous dynamics as well as discrete switching between modes. Establishing a formal relationship between the mathematical semantics of a hybrid model and the actual executions of the corresponding code is particularly challenging due to sampling and switching errors. In this paper, we describe an approach to compile the modeling language Charon that allows hierarchical specifications of interacting hybrid systems. We show how to exploit the semantics of Charon to generate code from a model in a modular fashion, and identify sufficient conditions on the model that guarantee the absence of switching errors in the compiled code. The approach is illustrated by compiling a model for coordinated motion of legs for walking onto Sonys AIBO robot.

Model-based testing and monitoring for hybrid embedded systems

We propose an integrated framework for testing and monitoring the model-based embedded systems. The framework incorporates three components: 1) model-based test generation for hybrid system, 2) run-time verification, and 3) modular code generation for hybrid systems. To analyze the behavior of a model-based system, the model of the system is augmented with a testing automaton that represents a given test case, and with a monitoring automaton that captures the formally specified properties of the system. The augmented model allows us to perform the model-level validation. In the next step, we use the modular code generator to convert the testing and monitoring automata into code that can be linked with the system code to perform the validation tasks on the implementation level. The paper illustrates our techniques by a case study on the Sony AIBO robot platform.

Testing and Monitoring Model-based Generated Program

We propose an integrated framework to test and monitor code generated from hybrid models for embedded systems. The framework consists of the following elements: First, we create a testing automaton as a controlled environment to produce test traces achieving the desired testing criteria; Second, we synthesize a monitoring automaton from the behavior specification to check the run-time behavior of the tested system in response to the test traces; Finally, since both automata are encoded in the same language as the system model, the same code generator may be used to generate a tester and a monitor from the testing automaton and the monitoring automaton. The tester and the monitor may be linked as needed with the code generated from the system model. Our approach yields self-testing and self-monitoring code which may be run both on the simulation level and on the code level. We discuss our approach in its full details through an example on a SONY AIBO robotic dog.

Run-Time Checking of Dynamic Properties

We consider a first-order property specification language for run-time monitoring of dynamic systems. The language is based on a linear-time temporal logic and offers two kinds of quantifiers to bind free variables in a formula. One kind contains the usual first-order quantifiers that provide for replication of properties for dynamically created and destroyed objects in the system. The other kind, called attribute quantifiers, is used to check dynamically changing values within the same object. We show that expressions in this language can be efficiently checked over an execution trace of a system.

Modular code generation from hybrid automata based on data dependency

Model-based automatic code generation is a process of converting abstract models into concrete implementations in the form of a program written in a high-level programming language. The process consists of two steps, first translating the primitives of the model into (approximately) equivalent implementations, and then scheduling the implementations of primitives according to the data dependency inherent in the model. When the model is based on hybrid automata that combine continuous dynamics with a finite state machine, the data dependency must be viewed in two aspects: continuous and discrete. Continuous data dependency is present between mathematical equations modeling time-continuous behavior of the system. On the other hand, discrete data dependency is present between guarded transitions that instantaneously change the continuous behavior of the system. While discrete data dependency has been studied in the context of code generation from modeling languages with synchronous semantics (e.g., ESTEREL), there has been no prior work that addresses both kinds of dependency in a single framework. In this paper we propose a code generation framework for hybrid automata which deals with continuous and discrete data dependency. We also propose techniques for generating modular code that retains modularity of the original model. The framework has been implemented based on the hybrid system modeling language CHARON, and experimented with Sonys robot platform AIBO.

Sound Code Generation from Communicating Hybrid Models

Precise translation from hybrid models to code is difficult because models are defined in the continuous-time domain whereas code executes on digital computers in a discrete fashion. Traditional approach is to associate the model with a sampling rate before code generation, and rely on an approximate algorithm that computes the next state numerically. Depending on the choice of the sampling rate and the algorithm, the behavior of the code may vary significantly due to numerical errors, but the discrepancy has been addressed informally, making the analysis results at the model level less meaningful for implementation. Formal relationship between the model and the code becomes even more unclear when components of the code execute concurrently. In this paper, we propose a formal framework that addresses the issue of soundness of concurrent programs generated from communicating hybrid models. The motivation is that concurrent programs executing in different rates may cause an erroneous transition when transition conditions are evaluated using values from different time instances. The essence of our technique is to refine the model by tightening transition conditions according to the maximum errors due to different sampling rates. We claim that the generated code has a trace of discrete transitions that is equivalent to one of the traces observable from the model, and that the values of variables are bounded. Our framework demonstrates how hybrid models defined in the continuous time domain are translated into discretized models with or without consideration of errors due to asynchronous sampling, and finally into executable code with real-time scheduling.

Code generation from hybrid systems models for distributed embedded systems

Code generation from hybrid system models is a promising approach to producing reliable embedded systems. This approach presents new challenges as the precise semantics of the model are hard to capture in the code. A framework for generating code was introduced for single threaded/processor environments. We extend it by considering code generation for distributed environments. We also define criteria for faithful implementation of the model. To this end, we define faulty and missed transitions. For preventing faulty transitions, we build on the idea of instrumentation we have developed for sound simulation of hybrid systems. Finally, we present sufficient conditions to avoid missed transitions and provide examples.

Distributed-code generation from hybrid systems models for time-delayed multirate systems

Hybrid systems are an appropriate formalism to model embedded systems as they capture the theme of continuous dynamics with discrete control. A simple extension, a network of communicating hybrid automata, allows for modeling distributed embedded systems. Although it is possible to generate code from such models, it is difficult to provide formal guarantees in the code with respect to the model. One of the reasons for this is that, the model is set in continuous time and concurrent execution with instantaneous communication, whereas the generated code is set in discrete time with delayed communication. This can introduce semantic differences between the model and the code such as missed transitions, faulty transitions, and altered continuous behavior. The goal of faithful code generation is to minimize these differences.In this paper, we propose a relaxed criteria of faithfulness, coined relative faithful implementation. Based on this criteria, we propose dynamically adjusting the guard at runtime using estimates of errors for preventing faulty transitions. We also identify a sufficient condition to ensure no missed transitions in the code.

Generating Sound and Resource-Aware Code from Hybrid Systems Models

Modern real-time embedded systems are complex, distributed, feature-rich applications. Model-based development of real-time embedded systems promises to simplify and accelerate the implementation process. Although there are appropriate models to design such systems and some tools that support automatic code generation from such models, several issues related to ensuring correctness of the implementation with respect to the model remain to be addressed. In this work, we investigate how to derive sampling rates for distributed real-time systems generated from a hybrid systems model such that there are no switching discrepancies and the resources spent in achieving this are a minimum. Of particular interest are the resulting mode switching semantics and we propose an approach to handle faulty transitions and compute execution rates for minimizing missed transitions.

Ensuring Sound Numerical Simulation of Hybrid Automata

A hybrid system is a dynamical system in which states can be changed continuously and discretely. Simulation based on numerical methods is the widely used technique for analyzing complicated hybrid systems. Numerical simulation of hybrid systems, however, is subject to two types of numerical errors: truncation error and round-off error. The effect of such errors can make an impossible transition step to become possible during simulation, and thus, to generate a simulation behavior that is not allowed by the model. The possibility of an incorrect simulation behavior reduces con.dence in simulation-based analysis since it is impossible to know whether a particular simulation trace is allowed by the model or not. To address this problem, we define the notion of Instrumented Hybrid Automata (IHA), which considers the effect of accumulated numerical errors on discrete transition steps. We then show how to convert Hybrid Automata (HA) to IHA and prove that every simulation behavior of IHA preserves the discrete transition steps of some behavior in HA; that is, simulation of IHA is sound with respect to HA.