2023Activity reportProjectTeamHYCOMES
RNSR: 201321225U Research center Inria Centre at Rennes University
 Team name: Modélisation hybride & conception par contrats pour les systèmes embarqués multiphysiques
 In collaboration with:Institut de recherche en informatique et systèmes aléatoires (IRISA)
 Domain:Algorithmics, Programming, Software and Architecture
 Theme:Embedded and Realtime Systems
Keywords
Computer Science and Digital Science
 A2. Software
 A2.1. Programming Languages
 A2.1.1. Semantics of programming languages
 A2.1.5. Constraint programming
 A2.1.9. Synchronous languages
 A2.1.10. Domainspecific languages
 A2.2. Compilation
 A2.2.1. Static analysis
 A2.2.8. Code generation
 A2.3. Embedded and cyberphysical systems
 A2.3.1. Embedded systems
 A2.3.2. Cyberphysical systems
 A2.3.3. Realtime systems
 A2.4. Formal method for verification, reliability, certification
 A2.4.1. Analysis
 A2.4.3. Proofs
 A2.5. Software engineering
 A2.5.1. Software Architecture & Design
 A2.5.2. Componentbased Design
 A6. Modeling, simulation and control
 A6.1. Methods in mathematical modeling
 A6.1.1. Continuous Modeling (PDE, ODE)
 A6.1.5. Multiphysics modeling
 A6.3. Computationdata interaction
 A6.3.4. Model reduction
 A8. Mathematics of computing
 A8.4. Computer Algebra
Other Research Topics and Application Domains
 B4. Energy
 B4.4. Energy delivery
 B4.4.1. Smart grids
 B5.1. Factory of the future
 B5.2. Design and manufacturing
 B5.9. Industrial maintenance
 B8. Smart Cities and Territories
 B8.1. Smart building/home
 B8.1.1. Energy for smart buildings
 B8.2. Connected city
 B8.3. Urbanism and urban planning
1 Team members, visitors, external collaborators
Research Scientists
 Benoit Caillaud [Team leader, INRIA, Senior Researcher, HDR]
 Albert Benveniste [INRIA, Emeritus, HDR]
 Yahao Chen [INRIA, ISFP, from Dec 2023]
 Khalil Ghorbal [INRIA, Researcher]
PhD Students
 Maxime Bridoux [INRIA]
 Joan Thibault [University of Rennes, until Apr 2023]
Technical Staff
 Mathias Malandain [Inria, Engineer, shared with the I4S projectteam]
Administrative Assistant
 Armelle Mozziconacci [CNRS]
2 Overall objectives
Hycomes was created as a local team of the Rennes  Bretagne Atlantique Inria research center in 2013 and has been created as an Inria ProjectTeam in 2016. The team is focused on two topics in cyberphysical systems design:
 Hybrid systems modeling, with an emphasis on the design of modeling languages in which software systems, in interaction with a complex physical environment, can be modelled, simulated and verified. A special attention is paid to the mathematical rigorous semantics of these languages, and to the correctness (wrt. such semantics) of the simulations and of the static analyses that must be performed during compilation. The Modelica language is the main application field. The team aims at contributing language extensions facilitating the modeling of physical domains which are poorly supported by the Modelica language. The Hycomes team is also designing new structural analysis methods for hybrid (aka. multimode) Modelica models. New simulation and verification techniques for large Modelica models are also in the scope of the team.
 Contractbased design and interface theories, with applications to requirements engineering in the context of safetycritical systems design. The objective of our research is to bridge the gap between systemlevel requirements, often expressed in natural, constrained or semiformal languages and formal models, that can be simulated and verified.
3 Research program
3.1 Hybrid Systems Modeling
Systems industries today make extensive use of mathematical modeling tools to design computer controlled physical systems. This class of tools addresses the modeling of physical systems with models that are simpler than usual scientific computing problems by using only Ordinary Differential Equations (ODE) and Difference Equations but not Partial Differential Equations (PDE). This family of tools first emerged in the 1980's with SystemBuild by MatrixX (now distributed by National Instruments) followed soon by Simulink by Mathworks, with an impressive subsequent development.
In the early 90's control scientists from the University of Lund (Sweden) realized that the above approach did not support component based modeling of physical systems with reuse 1. For instance, it was not easy to draw an electrical or hydraulic circuit by assembling component models of the various devices. The development of the Omola language by Hilding Elmqvist was a first attempt to bridge this gap by supporting some form of Differential Algebraic Equations (DAE) in the models. Modelica quickly emerged from this first attempt and became in the 2000's a major international concerted effort with the Modelica Consortium. A wider set of tools, both industrial and academic, now exists in this segment 2. In the Electronic Design Automation (EDA) sector, VHDLAMS was developed as a standard 71 and also enables the use of differential algebraic equations. Several domainspecific languages and tools for mechanical systems or electronic circuits also support some restricted classes of differential algebraic equations. Spice is the historic and most striking instance of these domainspecific languages/tools 3. The main difference is that equations are hidden and the fixed structure of the differential algebraic results from the physical domain covered by these languages.
Despite the fact that these tools are now widely used by a number of engineers, they raise a number of technical difficulties. The meaning of some programs, their mathematical semantics, is indeed ambiguous. A main source of difficulty is the correct simulation of continuoustime dynamics, interacting with discretetime dynamics: How the propagation of mode switchings should be handled? How to avoid artifacts due to the use of a global ODE solver causing unwanted coupling between seemingly non interacting subsystems? Also, the mixed use of an equational style for the continuous dynamics with an imperative style for the mode changes and resets, is a source of difficulty when handling parallel composition. It is therefore not uncommon that tools return complex warnings for programs with many different suggested hints for fixing them. Yet, these “pathological” programs can still be executed, if wanted so, giving surprising results — See for instance the Simulink examples in 28, 20 and 21.
Indeed this area suffers from the same difficulties that led to the development of the theory of synchronous languages as an effort to fix obscure compilation schemes for discrete time equation based languages in the 1980's. Our vision is that hybrid systems modeling tools deserve similar efforts in theory as synchronous languages did for the programming of embedded systems.
3.2 Background on nonstandard analysis
NonStandard analysis plays a central role in our research on hybrid systems modeling 20, 28, 22, 21, 26, 3. The following text provides a brief summary of this theory and gives some hints on its usefulness in the context of hybrid systems modeling. This presentation is based on our paper 2, a chapter of Simon Bliudze's PhD thesis 35, and a recent presentation of nonstandard analysis, not axiomatic in style, due to the mathematician Lindström 80.
Nonstandard numbers allowed us to reconsider the semantics of hybrid systems and propose a radical alternative to the superdense time semantics developed by Edward Lee and his team as part of the Ptolemy II project, where cascades of successive instants can occur in zero time by using ${\mathbb{R}}_{+}\times \mathbb{N}$ as a time index. In the nonstandard semantics, the time index is defined as a set $\mathbb{T}=\{n\partial \mid n\in {}^{*}\mathbb{N}\}$, where $\partial $ is an infinitesimal and ${}^{*}\mathbb{N}$ is the set of nonstandard integers. Remark that (1) $\mathbb{T}$ is dense in ${\mathbb{R}}_{+}$, making it “continuous”, and (2) every $t\in \mathbb{T}$ has a predecessor in $\mathbb{T}$ and a successor in $\mathbb{T}$, making it “discrete”. Although it is not effective from a computability point of view, the nonstandard semantics provides a framework that is familiar to the computer scientist and at the same time efficient as a symbolic abstraction. This makes it an excellent candidate for the development of provably correct compilation schemes and type systems for hybrid systems modeling languages.
Nonstandard analysis was proposed by Abraham Robinson in the 1960s to allow the explicit manipulation of “infinitesimals” in analysis 92, 58, 54. Robinson's approach is axiomatic; he proposes adding three new axioms to the basic ZermeloFraenkel (ZFC) framework. While the need for nonstandard analysis (in addition to the usual or standard analysis) has long agitated the mathematical community, it is not our purpose to debate such aspects. The important thing for us is that nonstandard analysis allows the use of the nonstandard discretization of continuous dynamics “as if” it was operational.
Not surprisingly, such an idea is not novel. Iwasaki et al. 73 first proposed using nonstandard analysis to discuss the nature of time in hybrid systems. Bliudze and Krob 34, 35 have also used nonstandard analysis as a mathematical support for defining a system theory for hybrid systems. They discuss in detail the notion of “system” and investigate computability issues. The formalization they propose closely follows that of Turing machines, with a memory tape and a control mechanism.
3.3 Structural Analysis of DAE Systems
The Modelica language is based on Differential Algebraic Equations (DAE). The general form of a DAE is given by:
where $F$ is a system of ${n}_{e}$ equations $\{{f}_{1},\cdots ,{f}_{{n}_{e}}\}$ and $x$ is a finite list of ${n}_{v}$ independent realvalued, smooth enough, functions $\{{x}_{1},\cdots ,{x}_{{n}_{v}}\}$ of the independent variable $t$. We use ${x}^{\text{'}}$ as a shorthand for the list of firstorder time derivatives of ${x}_{j}$, $j=1,\cdots ,{n}_{v}$. Highorder derivatives are recursively defined as usual, and ${x}^{\left(k\right)}$ denotes the list formed by the $k$th derivatives of the functions ${x}_{j}$. Each ${f}_{i}$ depends on the scalar $t$ and some of the functions ${x}_{j}$ as well as a finite number of their derivatives.
Let ${\sigma}_{i,j}$ denote the highest differentiation order of variable ${x}_{j}$ effectively appearing in equation ${f}_{i}$, or $\infty $ if ${x}_{j}$ does not appear in ${f}_{i}$. The leading variables of $F$ are the variables in the set
The state variables of $F$ are the variables in the set
A leading variable ${x}_{j}^{\left({\sigma}_{j}\right)}$ is said to be algebraic if ${\sigma}_{j}=0$ (in which case, neither ${x}_{j}$ nor any of its derivatives are state variables). In the sequel, $v$ and $u$ denote the leading and state variables of $F$, respectively.
DAE are a strict generalization of ordinary differential equations (ODE), in the sense that it may not be immediate to rewrite a DAE as an explicit ODE of the form $v=G\left(u\right)$. The reason is that this transformation relies on the Implicit Function Theorem, requiring that the Jacobian matrix $\frac{\partial F}{\partial v}$ to be full rank. This is, in general, not the case for a DAE. Simple examples, like the twodimensional fixedlength pendulum in Cartesian coordinates 88, exhibit this behaviour.
For a square DAE of dimension $n$ (i.e., we now assume ${n}_{e}={n}_{v}=n$) to be solved in the neighborhood of some $({v}^{*},{u}^{*})$, one needs to find a set of nonnegative integers $C=\{{c}_{1},\cdots ,{c}_{n}\}$ such that system
can locally be made explicit, i.e., the Jacobian matrix of ${F}^{\left(C\right)}$ with respect to its leading variables, evaluated at $({v}^{*},{u}^{*})$, is nonsingular. The smallest possible value of ${max}_{i}{c}_{i}$ for a set $C$ that satisfies this property is the differentiation index 46 of $F$, that is, the minimal number of time differentiations of all or part of the equations ${f}_{i}$ required to get an ODE.
In practice, the problem of automatically finding a minimal solution $C$ to this problem quickly becomes intractable. Moreover, the differentiation index may depend on the value of $({v}^{*},{u}^{*})$. This is why, in lieu of numerical nonsingularity, one is interested in the structural nonsingularity of the Jacobian matrix, i.e., its almost certain nonsingularity when its nonzero entries vary over some neighborhood. In this framework, the structural analysis (SA) of a DAE returns, when successful, values of the ${c}_{i}$ that are independent from a given value of $({v}^{*},{u}^{*})$.
A renowned method for the SA of DAE is the Pantelides method; however, Pryce's $\Sigma $method is introduced also in what follows, as it is a crucial tool for our works.
3.3.1 Pantelides method
In 1988, Pantelides proposed what is probably the most wellknown SA method for DAE 88. The main idea of his work is that the structural representation of a DAE can be condensed into a bipartite graph whose left nodes (resp. right nodes) represent the equations (resp. the variables), and in which an edge exists if and only if the variable occurs in the equation.
By detecting specific subsets of the nodes, called Minimally Structurally Singular (MSS) subsets, the Pantelides method iteratively differentiates part of the equations until a perfect matching between the equations and the leading variables is found. One can easily prove that this is a necessary and sufficient condition for the structural nonsingularity of the system.
The main reason why the Pantelides method is not used in our work is that it cannot efficiently be adapted to multimode DAE (mDAE). As a matter of fact, the adjacency graph of a mDAE has both its nodes and edges parametrized by the subset of modes in which they are active; this, in turn, requires that a parametrized Pantelides method must branch every time no modeindependent MSS is found, ultimately resulting, in the worst case, in the enumeration of modes.
3.3.2 Pryce's Sigmamethod
Albeit less renowned that the Pantelides method, Pryce's $\Sigma $method 89 is an efficient SA method for DAE, whose equivalence to the Pantelides method has already been established. This method consists in solving two successive problems, denoted by primal and dual, relying on the $\Sigma $matrix, or signature matrix, of the DAE $F$.
This matrix is given by:
where ${\sigma}_{ij}$ is equal to the greatest integer $k$ such that ${x}_{j}^{\left(k\right)}$ appears in ${f}_{i}$, or $\infty $ if variable ${x}_{j}$ does not appear in ${f}_{i}$. It is the adjacency matrix of a weighted bipartite graph, with structure similar to the graph considered in the Pantelides method, but whose edges are weighted by the highest differentiation orders. The $\infty $ entries denote nonexistent edges.
The primal problem consists in finding a maximumweight perfect matching (MWPM) in the weighted adjacency graph. This is actually an assignment problem for which several standard algorithms exist, such as the pushrelabel algorithm 67 or the EdmondsKarp algorithm 60 to only give a few. However, none of these algorithms are easily parametrizable, even for applications to mDAE systems with a fixed number of variables.
The dual problem consists in finding the componentwise minimal solution $(C,D)$ where $C=\{{c}_{1},\cdots ,{c}_{n}\}$ and $D=\{{d}_{1},\cdots ,{d}_{n}\})$ to a given linear programming problem, defined as the dual of the aforementioned assignment problem. This is performed by means of a fixpoint iteration (FPI) that makes use of the MWPM found as a solution to the primal problem, described by the set of tuples ${\left\{(i,{j}_{i})\right\}}_{i\in \{1,\cdots ,n\}}$:
 Initialize $\{{c}_{1},\cdots ,{c}_{n}\}$ to the zero vector.
 For every $j\in \{1,\cdots ,n\}$,$${d}_{j}\leftarrow \underset{i}{max}({\sigma}_{ij}+{c}_{i})$$
 For every $i\in \{1,\cdots ,n\}$,$${c}_{i}\leftarrow {d}_{{j}_{i}}{\sigma}_{i,{j}_{i}}$$
 Repeat Steps 2 and 3 until convergence is reached.
From the results proved by Pryce in 89, it is known that the above algorithm terminates if and only if it is provided a MWPM, and that the values it returns are independent of the choice of a MWPM whenever there exist several such matchings. In particular, a direct corollary is that the $\Sigma $method succeeds as long as a perfect matching can be found between equations and variables.
Another important result is that, if the Pantelides method succeeds for a given DAE $F$, then the $\Sigma $method also succeeds for $F$ and the values it returns for $C$ are exactly the differentiation indices for the equations that are returned by the Pantelides method. As for the values of the ${d}_{j}$, being given by ${d}_{j}={max}_{i}({\sigma}_{ij}+{c}_{i})$, they are the differentiation indices of the leading variables in ${F}^{\left(C\right)}$.
Working with this method is natural for our works, since the algorithm for solving the dual problem is easily parametrizable for dealing with multimode systems, as shown in our recent paper 45.
3.3.3 Block triangular decomposition
Once structural analysis has been performed, system ${F}^{\left(C\right)}$ can be regarded, for the needs of numerical solving, as an algebraic system with unknowns ${x}_{j}^{\left({d}_{j}\right)}$, $j=1\cdots n$. As such, (inter)dependencies between its equations must be taken into account in order to put it into block triangular form (BTF). Three steps are required:
 the dependency graph of system ${F}^{\left(C\right)}$ is generated, by taking into account the perfect matching between equations ${f}_{i}^{\left({c}_{i}\right)}$ and unknowns ${x}_{j}^{\left({d}_{j}\right)}$;
 the strongly connected components (SCC) in this graph are determined: these will be the equation blocks that have to be solved;
 the block dependency graph is constructed as the condensation of the dependency graph, from the knowledge of the SCC; a BTF of system ${F}^{\left(C\right)}$ can be made explicit from this graph.
3.4 ContractBased Design, Interfaces Theories, and Requirements Engineering
System companies such as automotive and aeronautic companies are facing significant difficulties due to the exponentially raising complexity of their products coupled with increasingly tight demands on functionality, correctness, and timetomarket. The cost of being late to market or of imperfections in the products is staggering as witnessed by the recent recalls and delivery delays that many major car and airplane manufacturers had to bear in the recent years. The root causes of these design problems are complex and relate to a number of issues ranging from design processes and relationships with different departments of the same company and with suppliers, to incomplete requirement specification and testing.
We believe the most promising means to address the challenges in systems engineering is to employ formal design methodologies that seamlessly and coherently combine the various viewpoints of the design space (behavior, time, energy, reliability, ...), that provide the appropriate abstractions to manage the inherent complexity, and that can provide correctbyconstruction implementations. The following issues must be addressed when developing new approaches to the design of complex systems:
 The overall design flows for heterogeneous systems and the associated use of models across traditional boundaries are not well developed and understood. Relationships between different teams inside a same company, or between different stakeholders in the supplier chain, are not supported by precise mathematical specifications of the components each party is expected to deliver.
 System requirements capture and analysis is in large part a heuristic process, where informal text and natural languagebased techniques in use today are facing significant challenges 76. Formal requirements engineering is in its infancy: mathematical models, formal analysis techniques and links to system implementation must be developed.
 Dealing with variability, uncertainty, and lifecycle issues, such as extensibility of a product family, are not welladdressed using available systems engineering methodologies and tools.
The challenge is to address the entire process and not to consider only local solutions of methodology, tools, and models that ease part of the design.
Contractbased design has been proposed as a new approach to the system design problem that is rigorous and effective in dealing with the problems and challenges described before, and that, at the same time, does not require a radical change in the way industrial designers carry out their task as it cuts across design flows of different types. Indeed, contracts can be used almost everywhere and at nearly all stages of system design, from early requirements capture, to embedded computing infrastructure and detailed design involving circuits and other hardware. Intuitively, a contract captures two properties, respectively representing the assumptions on the environment and the guarantees of the system under these assumptions. Hence, a contract can be defined as a pair $C=(A,G)$ of assumptions and guarantees characterizing in a formal way 1) under which context the design is assumed to operate, and 2) what its obligations are. Assume/Guarantee reasoning has been known for a long time, and has been used mostly in software engineering 86. However, contractbased design is not limited to types and values in a piece of software. It can also be used to capture its performances (time, memory consumption, energy) and reliability. This amounts to enrich a component's interface with, on one hand, formal specifications of the behavior of the environment in which the component may be instantiated and, on the other hand, of the expected behavior of the component itself. To leverage contractbased reasoning as a technique of choice for system engineers, we aim to develop:
 mathematical foundations of contracts, that enable the design of formal verification frameworks;
 System engineering methodologies and tools, that focus on requirements modeling, contract specification and verification, at multiple abstraction levels.
A detailed bibliography on contract and interface theories for embedded system design can be found in 5. In a nutshell, contract and interface theories fall into two main categories:

Assume/guarantee contracts.
By explicitly relying on the notions of assumptions and guarantees, A/Gcontracts are intuitive. This makes them appealing for the engineer. In A/Gcontracts, assumptions and guarantees are just properties regarding the behavior of a component and of its environment. The typical case is when these properties are formal languages or sets of traces. This includes the class of safety properties 77, 50, 84, 18, 52. Contract theories were initially developed as specification formalisms able to refuse some inputs from the environment 59. A/Gcontracts were advocated in 24 and are is still a very active research topic, with several contributions dealing with the timed 32 and probabilistic 42, 43 viewpoints in system design, and even hybrid systems design 87.

Automata theoretic interfaces.
Interfaces combine assumptions and guarantees in a single, automata theoretic specification. Most interface theories are based on Lynch's Input/Output Automata 83, 82. Interface Automata 13, 12, 14, 48 focus primarily on parallel composition and compatibility: two interfaces are compatible if there exists at least one environment where they can work together. The idea is that the resulting composition exposes as an interface the needed information to ensure that incompatible pairs of states cannot be reached. This can be achieved by using the possibility, for an Interface Automaton, to refuse some inputs from the environment in a given state. This amounts to the implicit assumption that the environment will never produce any of the refused inputs, when the interface is in this state. Modal Interfaces 90 inherit from both Interface Automata and the originally unrelated notion of Modal Transition System 79, 16, 36, 78. Modal Interfaces are strictly more expressive than Interface Automata by decoupling the I/O orientation of an event and its deontic modalities (mandatory, allowed or forbidden). Informally, a must transition is offered in every component that realizes the modal interface, while a may transition is optional. Research on interface theories is still very active. For instance, timed 15, 29, 31, 56, 55, 30, probabilistic 42, 57 and energyaware 49 interface theories have been proposed recently.
Requirements Engineering is one of the major concerns in large systems industries today, particularly so in sectors where certification prevails 93. Most requirements engineering tools offer a poor structuring of the requirements and cannot be considered as formal modeling frameworks today. They are nothing less, but nothing more than an informal structured documentation enriched with hyperlinks.
We see ContractBased Design and Interfaces Theories as innovative tools in support of Requirements Engineering. The Software Engineering community has extensively covered several aspects of Requirements Engineering, in particular:
 the development and use of large and rich ontologies; and
 the use of Model Driven Engineering technology for the structural aspects of requirements and resulting hyperlinks (to tests, documentation, PLM, architecture, and so on).
Behavioral models and properties, however, are not properly encompassed by the above approaches. This is the cause of a remaining gap between this phase of systems design and later phases where formal model based methods involving behavior have become prevalent. We believe that our work on contractbased design and interface theories is best suited to bridge this gap.
3.5 Efficient Symbolic Computation for Sparse Systems
This project consists in exploiting the parsimony of sparse systems to accelerate their symbolic manipulation (quantifiers elimination 53, differentialalgebraic reductions 94 etc.). Let us cite two typical examples as a motivation: Boolean functions ($a\vee b\wedge \neg c$) and polynomial systems with inequalities (${x}^{2}+y\le 1\wedge x+y=0$). We seek precisely to decompose these systems, automatically, in order to be able to manipulate them at an advantageous computational cost (in time and in memory) by attacking the pieces thus obtained rather than considering the system as a single monolithic block.
The current algorithms suffer from a theoretical complexity that is at best exponential (in the size of the input) limiting their use to instances of very modest size. The classic approach to overcome this problem is to develop/use numerical methods (with their limits and intrinsic problems) when possible of course. We aim to explore a different avenue.
In this project, we wish to exploit the structure of sparse systems to push the symbolic approach beyond its theoretical limits. The a priori limited application of our methods for dense systems is compensated by the fact that in practice, the problems are very often structured (in this regard, let us content ourselves with quoting the SAT solvers which successfully tackle industrial instances of a theoretically NPcomplete problem).
The idea of exploiting the structure to speed up calculations that are a priori complex is not new. It has notably been developed and successfully used in signal processing via Factor Graphs 81, where one restricts oneself to local propagation of information, guided by an abstract graph which represents the structure of the system overall. Our approach is similar: we basically seek to use expensive algorithms sparingly on only subsystems involving only a small number of variables, thus hoping to reduce the theoretical worst case. One could then legitimately wonder why it is not enough to apply what has already been done on Factor Graphs? The difficulty (and the novelty for that matter) lies in the implementation of this idea for the problems that interest us. Let's start by emphasizing that the propagation of information has a significantly different impact depending on the operator (or quantifier) to be eliminated: a minimization or a summation do not look like a projection at all! This will obviously not prevent us from importing good ideas applicable to our problems and vice versa.
More related to symbolic computation, to our knowledge, at least two recent attempts exist: chordal networks 51 which propose a representation of the ideals of the ring of polynomials (therefore algebraic sets), and triangular block shapes 97, initiated independently and under development in our team and which tackle Boolean functions, or, if you will, the algebraic sets over the field of Booleans. The similarity between the two approaches is striking and suggests that there is a common way of doing things that could be exploited beyond these two examples. It is this unification that interests us in the first place in this project.
We identify three research problems to explore: T1. Unify several optimization problems on graphs as a single problem parameterized by a cost function, we coin such a problem WAP, for weighted adjacency propagation. T2. Adapt (and possibly improve) the algorithm of 96 to WAP and consequently to all instances of the single problem detailed in T1. T3. Propose a unified and modular method consisting of: (1) an elimination algorithm, (2) a data structure and (3) an efficient algorithm to solve the problem (with an adequate cost function).
The work on chordal networks and our work on Boolean functions immediately become special cases. For example, for Boolean functions, one could use Binary Decision Diagrams (BDDs) 41 to represent each piece of the initial system. In fact, the final representation will no longer be a single monolithic BDD as is currently the case, but rather a graph of BDDs. In the same way, an algebraic set will be represented by a graph where each node is a Gröbner basis (or any other data structure used to represent systems of equations).
The structure of the system becomes thus apparent and is exploited to optimize the used representation, opening the way to a better understanding and therefore to a more efficient and better targeted manipulation. Let's remember a simple fact here: symbolic manipulation often solves the problem exactly (without approximation or compromise). Therefore, pushing the limits of applicability of these techniques to scale them can only be appreciated and will undoubtedly have a significant impact on all the areas where they apply and the list is as long as it is varied. (compilation, certification, validation, synthesis, etc.).
4 Application domains
The Hycomes team contributes to the design of mathematical modeling languages and tools, to be used for the design of cyberphysical systems. In a nutshell, two major applications can be clearly identified: (i) our work on the structural analysis of multimode DAE systems has a sizeable impact on the techniques to be used in Modelica tools; (ii) our work on the verification of dynamical systems has an impact on the design methodology for safetycritical cyberphysical systems. These two applications are detailed below.
4.1 Modelica
Mathematical modeling tools are a considerable business, with major actors such as MathWorks, with Matlab/Simulink, or Wolfram, with Mathematica. However, none of these prominent tools are suitable for the engineering of large systems. The Modelica language has been designed with this objective in mind, making the best of the advantages of DAEs to support a componentbased approach. Several industries in the energy sector have adopted Modelica as their main systems engineering language.
Although multimode features have been introduced in version 3.3 of the language 62, proper tool support of multimode models is still lagging behind. The reason is not a lack of interest from tool vendors and academia, but rather that multimode DAE systems poses several fundamental difficulties, such as a proper definition of a concept of solutions for multimode DAEs, how to handle mode switchings that trigger a change of system structure, or how impulsive variables should be handled. Our work on multimode DAEs focuses on these crucial issues 27.
Thanks to our IsamDAE software 45, 44, a larger class of Modelica models are expected to be compiled and simulated correctly. This should enable industrial users to have cleaner and simpler multimode Modelica models, with dynamically changing structure of cyberphysical systems. On the longer term, our ambition is to provide efficient codegeneration techniques for the Modelica language, supporting, in full generality, multimode DAE systems, with dynamically changing differentiation index, structure and dimension.
The Hycomes team also focuses on scalability problems related to the compilation and simulation of large Modelica models. Digital twins developed by industrial Modelica users in the energy sector tend to be extremely large models, with up to ${10}^{6}$ equations. Stateoftheart Modelica compilers can not handle such models and users are forced to partition their model into smaller parts and use complex cosimulation techniques to produce executable digital twins. This puts a heavy burden on digital twin developers, since both the partitioning and the implementation of cosimulation methods are manual, finely tailored to the model, and require a high degree of expertise.
The Hycomes team is working on a new generation of algorithms for the compilation of the Modelica language, that can scale up to large models. The key contributations are modular indexreduction 9 and blocktriangular equation sorting algorithms, that can be applied to incomplete (rectangular) DAE systems.
4.2 Dynamical Systems Verification
In addition to welldefined operational semantics for hybrid systems, one often needs to provide formal guarantees about the behavior of some critical components of the system, or at least its main underlying logic. To do so, we are actively developing new techniques to automatically verify whether a hybrid system complies with its specifications, and/or to infer automatically the envelope within which the system behaves safely. The approaches we developed have been already successfully used to formally verify the intricate logic of the ACAS X, a midair collision avoidance system that advises the pilot to go upward or downward to avoid a nearby airplane which requires mixing the continuous motion of the aircraft with the discrete decisions to resolve the potential conflict 74. This challenging example is nothing but an instance of the kind of systems we are targeting: autonomous smart systems that are designed to perform sophisticated tasks with an internal tricky logic. What is even more interesting perhaps is that such techniques can be often "reverted" to actually synthesize missing components so that some property holds, effectively helping the design of such complex systems.
5 Social and environmental responsibility
The expected impact of our research is to allow both better designs and better exploitation of energy production units and distribution networks, enabling largescale energy savings. At least, this is what we could observe in the context of the FUI ModeliScale collaborative project (2018–2021), focused on electric grids, urban heat networks and building thermal modeling.
The rationale is as follows: system engineering models are meant to assess the correctness, safety and optimality of a system under design. However, system models are still useful after the system has been put in operation. This is especially true in the energy sector, where systems have an extremely long lifespan (for instance, more than 50 years for some nuclear power plants) and are upgraded periodically, to integrate new technologies. Exactly like in software engineering, where a software and its model coevolve throughout the lifespan of the software, a coevolution of the system and its physical models has to be maintained. This is required in order to maintain the safety of the system, but also its optimality.
Moreover, physical models can be instrumental to the optimal exploitation of a system. A typical example are modelpredictive control (MPC) techniques, where the model is simulated, during the exploitation of the system, in order to predict system trajectories up to a boundedtime horizon. Optimal control inputs can then be computed by mathematical programming methods, possibly using multiple simulation results. This has been proved to be a practical solution 64, whenever classical optimal control methods are ineffective, for instance, when the system is nonlinear or discontinuous. However, this requires the generation of highperformance simulation code, capable of simulating a system much faster than realtime.
The structural analysis techniques implemented in IsamDAE 45 generate a conditional block dependency graph, that can be used to generate highperformance simulation code : static code can be generated for each block of equations, and a scheduling of these blocks can be computed, at runtime, at each mode switching, thanks to an inexpensive topological sort algorithm. Contrarily to other approaches (such as 63), no structural analysis, blocktriangular decompositions, or automatic differentiation has to be performed at runtime.
6 Highlights of the year
The most notable result of the Hycomes team, for 2023, is the design and implementation of a modular structural analysis algorithm for multimode DAE systems, that can scale up to systems with the order ${10}^{12}$ equations. This important breakthrough has been presented at the Modelica'23 conference 9. It lifts in effect the bottleneck of the structural analysis in the workflow of Modelica compilers.
7 New software, platforms, open data
7.1 New software
7.1.1 IsamDAE

Name:
Implicit Structural Analysis of Multimode DAE systems

Keywords:
Structural analysis, Differential algebraic equations, Multimode, Scheduling, Consistent initialization, Code generation

Scientific Description:
Modeling languages and tools based on Differential Algebraic Equations (DAE) bring several specific issues that do not exist with modeling languages based on Ordinary Differential Equations. The main problem is the determination of the differentiation index and latent equations. Prior to generating simulation code and calling solvers, the compilation of a model requires a structural analysis step, which reduces the differentiation index to a level acceptable by numerical solvers.
The Modelica language, among others, allows hybrid models with multiple modes, modedependent dynamics and statedependent mode switching. These Multimode DAE (mDAE) systems are much harder to deal with. The main difficulties are (i) the combinatorial explosion of the number of modes, and (ii) the correct handling of mode switchings.
The IsamDAE software aims at providing a compilation chain for mDAEbased modeling languages that make it possible to efficiently generate correct simulation code for multimode models. Novel structural analysis methods for mDAE systems were designed and implemented, based on an implicit representation of the varying structure of such systems. Several standard algorithms, such as J. Pryce's Sigmamethod and the DulmageMendelsohn decomposition, were adapted to the multimode case, using Binary Decision Diagrams (BDD) to represent the modedependent structure of an mDAE system.
IsamDAE determines, as a function of the mode, the set of latent equations, the leading variables and the state vector. This is then used to compute a conditional dependency graph (CDG) of the system, that can be used to generate simulation code with a modedependent scheduling of the blocks of equations. The software is also fit for generating simulation code for the hybrid dynamical system simulation tool Siconos, as well as handling the structural analysis of the multimode consistent initialization problem associated with an mDAE system.

Functional Description:
IsamDAE (Implicit Structural Analysis of Multimode DAE systems) is a software library implementing new structural analysis methods for multimode DAE systems, based on an implicit representation of incidence graphs, matchings between equations and variables, and block decompositions. The input of the software is a variable dimension multimode DAE system consisting in a set of guarded equations and guarded variable declarations. It computes a modedependent structural index reduction of the multimode system and is able to produce a modedependent graph for the scheduling of blocks of equations in long modes, check the structural nonsingularity of the associated consistent initialization problem, or generate simulation code for the nonsmooth dynamical system simulation tool Siconos.
IsamDAE is coded in OCaml, and uses the following packages: GuaCaml by Joan Thibault, MLBDD by Arlen Cox, Menhir by François Pottier and Yann RégisGianas, Pprint by François Pottier, Snowflake by Joan Thibault, XMLLight by Nicolas Cannasse and Jacques Garrigue.

Release Contributions:
New features:
* XML representations of the structure of a multimode DAE model are accepted as inputs by the IsamDAE tool, in order to enable weak coupling with tools based on existing DAEbased languages. IsamDAE distinguishes between MEL and XML inputs based on the extension of the input file (.mel versus .mdae.xml).
Bug fixes:
* A better handling of the model structure for consistent initialization prevents subtle bugs that were observed for a few models and initial events. Specific error messages are returned when initial equations involve variables that are not active in the corresponding modes.
Performance improvement:
* Better handling of sets of equations/variables labeled with propositional formulas, thanks to an adapted data structure.
Various:
* Verbosity option v now takes as a parameter an integer ranging from 0 ("quiet") to 5 ("deep debug"). The detailed output of CoSTreD is only available in "deep debug" mode.
 URL:
 Publications:

Contact:
Benoit Caillaud

Participants:
Benoit Caillaud, Mathias Malandain, Joan Thibault, Alexandre Rocca, Bertrand Provot
7.1.2 Snowflake

Name:
Snowflake : A Generic Symbolic Dynamic Programming framework

Keywords:
Ocaml, Symbolic computation, Binary decision diagram

Scientific Description:
Complex systems (either physical or logical) are structured and sparse, that is, they are build from individual components linked together, and any component is only linked to rather small number of other components with respects to the size of the global system.
RBTF exploits this structure, by overapproximating the relations between components as a tree (called decomposition tree in the graph literature) each node of this tree being a set of components of the initial systems. Then, starting from leaves, each subsystem is solved and the solutions are projected as a new constraints on their parents node, this process is iterated until all subsystems are solved. This step allows to condensate all constraints and check their satisfiability. We call this step the **Forward Reduction Process** (FRP).
Finally, we can propagate all the constraints back into their initial subsystem by performing those same projections in the reverse direction. That is, each subsystem updates its set of solutions given the information from its parent then sends the information to its children subsystems (possibly none, if its a leaf). We call this step the **Backward Propagation Process** (BPP).

Functional Description:
Snowflake interfaces a WAPsolver (Weighted Adjacency Propagation problem), a functorbased implementation of CoSTreD (Constraint System Tree Decomposition), along with a minimalist MLBDD (Arlen Cox's BDD package) toolbox.

Release Contributions:
2022/07 : published Research Report 9478 (https://hal.archivesouvertes.fr/hal03740562/) 2022/06/30 : renamed RBTF into CoSTreD 2022/06/19 : added basic constraint system export 2022/06/02 : add small graphviz interface 2022/06/02 : added small graphviz interface 2022/06/02 : added sorted test on input to MlbddUtils.subst
 URL:

Author:
Joan Thibault

Contact:
Joan Thibault
7.1.3 modularSigma

Name:
A modular Sigmamethod for the structural analysis of large DAE systems

Keywords:
Differential algebraic equations, Modularity

Scientific Description:
A key feature of the Modelica language is its objectoriented nature: components are instances of classes and they can aggregate other components, so that extremely large models can be efficiently designed as "trees of components". However, the structural analysis of Modelica models, a necessary step for generating simulation code, often relies on the flattening of this hierarchical structure, which undermines the scalability of the language and results in widelyused Modelica tools not being able to compile and simulate such large models. This software implements a new algorithm for the modular structural analysis of Modelica models. An adaptation of Pryce's Sigmamethod for nonsquare DAE systems, along with a carefully crafted notion of component interface, make it possible to fully exploit the object tree structure of a model. The structural analysis of a component class can be performed once and for all, only requiring the information provided by the interface of its child components. The resulting method alleviates the exponential computation costs that can be yielded by model flattening, hence, its scalability makes it ideally suited for the modeling and simulation of large cyberphysical systems.
Algorithms implemented in modularSigma are based on the Sigmamethod, which reduces the DAE structural indexreduction problem to two complementary linear programs: the primal problem amounts to the computation of a maximalweight perfect matching of the equationvariable incidence graph of the DAE, while the dual problem consists in the computation of the minimal solution of a difference bound matrix (DBM). Modularity is achieved thanks to a decomposition of both problems, using dynamic programming principles (akin to message passing techniques, that are often used in statistical estimation) and memoization of the intermediate results.

Functional Description:
The software performs the index reduction and the bloctriangular decomposition of large DAE systems, defined as the composition, hiding and renaming of incomplete (rectangular) DAE systems.

News of the Year:
The initial purpose of modularSigma has been to benchmark the algorithms detailed in the paper presented at the Modelica'23 conference.
 Publication:

Contact:
Benoit Caillaud

Participant:
Benoit Caillaud
7.1.4 PosInvSet

Name:
Positive Invariant Sets

Keywords:
Symbolic computation, Semialgebraic set, Differential equations

Functional Description:
Given a semialgebraic set S, that is a Boolean combination of equations and inequalities of polynomials, and a polynomial differential equation, we show that an algorithm can effectively decide whether S is a positive invariant set for the considered dynamic, that is, if the initial condition is in S, then the entire trajectory defined by the dynamics belongs to S.
We implemented in Mathematica two different procedures. Both require a backend algorithm for real quantifiers elimination (like the Cylindrical Algebraic Decomposition). One procedure form a monolithic request for the entire problem. The other chop the problem into small pieces following the Boolean structure of the input S.

Release Contributions:
Adaptation of the generic procedures to the linear case for scalability. The linear case means linear differential equations and semilinear sets for the set S.

Contact:
Khalil Ghorbal
8 New results
8.1 A Modular Structural Analysis of DAE Systems
Participants: Albert Benveniste, Benoît Caillaud, Mathias Malandain, Joan Thibault.
System modeling tools are key to the engineering of safe and efficient CyberPhysical Systems (CPS). Although ODEbased languages and tools, such as Simulink 85, are widely used in industry, there are two main reasons why DAEbased modeling is best suited to the modeling of such systems: it enables a modeling based on first principles of the physics; it is physicsagnostic, and consequently accomodates arbitrary combinations of physics (mechanics, electrokinetics, hydraulics, thermodynamics, chemical reactions, etc.).
The pioneering work by Hilding Elmqvist 61 led to the emergence of the Modelica community in the 1990s, and the DAEbased modeling language of the same name 17 has become a de facto standard, with its objectoriented nature enabling a componentbased modeling style. Its combined use with the portHamiltonian paradigm 91 results in a methodology that is instrumental to the scalable modeling of large systems, additionally ensuring that the model architecture preserves the system architecture, in stark contrast to ODEbased modeling 23, 25.
Consequently, DAEbased modeling requires that Modelica tools properly scale up to very large models. However, although Modelica enables the modeling of extremely large systems, its implementations 95, 66 are often not capable of compiling and simulating such large models. Scaling has been and still is a subject for sustained effort by the Modelica community 47, and although HPC issues belong to the landscape 37, a more specific issue is of uttermost importance for the Modelica language.
In the first steps of the compilation of a Modelica model, its hierarchical structure is flattened, thanks to a recursive syntactic inlining of the objects composing it. See 17, Section 5.6 for a complete definition of this flattening process. The result is an unstructured DAE that can be exponentially larger than the source model. The structural analyses that are required for the generation of simulation code (namely, the index reduction of the DAE system, followed by a blocktriangular form transformation of the reducedindex system) are then performed on this monolithic DAE model. As the compilation process does not fully take advantage of the hierarchical nature of the models it has to handle, the modeling capabilities offered by the Modelica language are undermined by performance issues on the structural analysis itself 70, 69. Additionally, model flattening poses a challenge when attempting to extend DAEbased modeling to higherorder modeling or dynamically changing systems 38, 40, 39.
In 9, a new modular structural analysis algorithm is proposed that takes full advantage of the object tree structure of a DAE model. The bedrock of this method is a novel concept of structural analysisaware interface for components. The essence of a component interface is to capture the necessary information about a Modelica class that needs to be exposed, in order to perform the structural analysis of a component comprizing instances of the former class, while hiding away useless information regarding the equations and all protected features it may contain.
In order to compute a component interface, one has to be able to perform the structural analysis of the possibly nonsquare DAE system that this component encapsulates, and to use the interfaces of the components it aggregates in this analysis. We base our algorithm on Pryce's $\Sigma $method for index reduction 89, which essentially consists in the successive solving of two dual linear integer programs. The striking difference with Pryce's algorithm is that these problems are solved by parts, in a scalable manner.
Putting all of this together, it is then possible to perform a modular structural analysis, in which structural analysis is performed at the class level, and the results can then be instantiated for each component of the system model, knowing its context. Hence, structural information at the system level is derived from composing the result of componentlevel analysis. Modular structural analysis yields huge gains in terms of memory usage and computational costs, as the analysis of a single largescale DAE is replaced with that of multiple smaller subsystems. Moreover, the analysis is performed at the class level, meaning that a single structural analysis is needed for all system components that are instances of the same class.
8.2 Fault Diagnosability Analysis of MultiMode Systems
Participants: Benoît Caillaud, Mathias Malandain.
A new collaboration between the Hycomes and the University of Linköping (Sweden) has started this year on the topic of system diagnosis, based on multimode DAE systems.
Fault detection and diagnosis are important for the health monitoring of physical systems. Modelbased approaches for singlemode, smooth, systems is a wellestablished field, supported by a large body of literature covering various approaches like structural methods 33, parity space techniques, and observerbased methods 72.
While singlemode systems are often described using differential algebraic equations (DAEs), the modeling of nonsmooth physical systems yields switched DAEs, also known as multimode DAEs (mDAEs), which combine continuous behaviors, defined as solutions of a set of DAE systems, with discrete mode changes 98, 27. Direct application of traditional fault diagnosis methods to all possible configurations of multimode systems quickly becomes intractable, as the number of modes tends to be exponential in the size of the system. The method proposed by 75 works around this issue by coupling a mode estimation algorithm with a singlemode diagnosis methodology, akin to justintime compilation in computer science. This approach unfortunately puts the burden on solving mode estimation problems, which often turn out to be intractable for the same reason.
Structural fault detectability and isolability is a graphbased method to evaluate diagnosability properties on DAEs 65. It is based on the DulmageMendelsohn decomposition (DM), a building block of the structural analysis of equation systems. In 11, we show how its extension to multimode systems, introduced in 4, can be applied in the context of structural fault detectability and isolability of mmDAEs 68. Building upon our previous research studies, the methods presented in this paper represent advancements in diagnostic methodologies for multimode systems, providing novel ways to study the diagnosability of multimode systems without enumerating their modes.
The case study used throughout this article is a model of a reconfigurable battery system, in which switching strategies enable to produce an AC output without relying on a central inverter 19. This model is parametrized by the number of battery cells, so that both the inherent complexity associated with the diagnostics of such systems and the scalability of our approaches can be addressed.
8.3 Mixed NondeterministicProbabilistic Automata
Participants: Albert Benveniste.
Graphical models in probability and statistics are a core concept in the area of probabilistic reasoning and probabilistic programminggraphical models include Bayesian networks and factor graphs. For modeling and formal verification of probabilistic systems, probabilistic automata were introduced. A coherent suite of models consisting of Mixed Systems, Mixed Bayesian Networks, and Mixed Automata is proposed in 8. This framework extends factor graphs, Bayesian networks, and probabilistic automata with the handling of nondeterminism. Each of these models comes with a parallel composition, and we establish clear relations between these three models. Also, we provide a detailed comparison between Mixed Automata and Probabilistic Automata.
8.4 On Continuous Solutions for Linear Complementarity Systems
Participants: Khalil Ghorbal.
Hybrid systems are dynamical systems alternating between continuoustime dynamics, called modes, and nonsmooth transitions between modes. Linear complementarity systems (LCS) form a special class of hybrid systems with an exponential number of modes and a linear differential algebraic equation in each mode. LCS are for instance used to describe mechanical and electrical systems featuring perfect contacts or ideal switches. For example, the ideal (Zener) diode is a 1dimensional LCS with two modes: a passing mode in one direction and a blocking mode in the other direction. While seemingly simple, little is known about the existence, and eventually uniqueness, of continuous solutions (in the state space). The only known sufficient condition is too strong as it requires the existence and uniqueness of solutions for the underlying linear complementarity problem (LCP) which, for a fixed matrix $M$ and a given vector $q$, asks whether there exists a pair of vectors $(w,z)$ satisfying $wMz=q$, $w,z\ge 0$, and $w.z=0$. $M$ is said to be a Qmatrix when a solution exists for all $q$. It's worth noting that characterizing Qmatrices is an open problem since the sixties even for low dimensions. Motivated by generalizing the known sufficient conditions for the existence of continuous solutions for LCS, we were naturally led to better understand Qmatrices. In this work, we focused on the regions where no solution for a given LCP exists. We showed that such holes occur only in specific locations. We then exploited this property to fully characterize Qmatrices for $n\le 3$.
Characterizing Qmatrices for any finite dimension $n$ is still an open problem despite a large palette of attempts ranging from linear algebra to convex analysis all the way to the homology of simplicial sets. The novelty of our approach 10 relies on using geometric and topological intuitions to locate the regions for which the LCP doesn't have a solution. This property allowed us to reduce the spatial case to finite planar problems that we were able to enumerate and solve. Our characterization is a program enumerating a long list of (symbolic) constraints on the entries of the matrix $M$. The matrix is a Qmatrix if and only if all the constraints are satisfied. Such approach is for instance useful to generate examples (or counterexamples) to either solve existing conjectures or to improve our current understanding of the problem. For instance, we were able to find an example of a nonregular Qmatrix in dimension 3 (the smallest dimension for which such an example was known was $n=5$). This is a joint work with Christelle Kozaily.
9 Dissemination
9.1 Promoting scientific activities
9.1.1 Scientific events: selection
Member of the conference program committees
Albert Benveniste has served on the program committee of the Modelica'23 conference, that was held in October 2023, in Aachen (Germany).
Khalil Ghorbal has served program committee of the TACAS'23 conference.
9.1.2 Journal
Member of the editorial boards
Benoît Caillaud has been appointed member of the editorial board of Research Directions: CyberPhysical Systems, a new openaccess journal published by Cambridge University Press. He is also serving on the board of the MDPI Computation journal.
Reviewer  reviewing activities
Benoît Caillaud has reviewed papers for the Discrete Event Dynamic Systems and the IEEE Transactions on Automatic Control journals.
9.1.3 Scientific expertise
Albert Benveniste is member of the French National Academy of Technology. He also serves of the Scientific Advisory Board of the aeronautic company Safran.
Benoît Caillaud has evaluated proposals submitted for funding to the ANR (the French national research funding agency).
9.1.4 Research administration
Khalil Ghorbal is the main organizer of 68NQRT, the seminar on formal methods, programming languages and software engineering of the Inria center of the University of Rennes and of the Language and Software Engineering department of the Irisa UMR.
9.2 Teaching  Supervision  Juries
9.2.1 Teaching
 Master degree in computer science: Khalil Ghorbal , Category Theory, Monads, and Computation, at ENS Rennes, France ;
 Agregation informatique: Khalil Ghorbal and Maxime Bridoux , oral examination and lecture preparation, at ENS Rennes, France.
9.2.2 Supervision
 Benoît Caillaud and Khalil Ghorbal are cosupervising the PhD work of Joan Thibault . Joan Thibault is expected to defend is PhD thesis in 2024, on efficient and scalable datastructures for solving Boolean constraint systems and some optimization problems on them.
 Khalil Ghorbal is supervising the PhD work of Maxime Bridoux , on the broad topic of efficient symbolic computation methods for sparse algebraic systems.
10 Scientific production
10.1 Major publications
 1 articleBuilding a Hybrid Systems Modeler on Synchronous Languages Principles.Proceedings of the IEEE1069September 2018, 15681592HALDOI
 2 articleNonstandard semantics of hybrid systems modelers.Journal of Computer and System Sciences783This work was supported by the SYNCHRONICS large scale initiative of INRIA2012, 877910HALDOIback to text
 3 articleThe mathematical foundations of physical systems modeling languages.Annual Reviews in Control502020, 72118HALDOIback to text
 4 articleAlgorithms for the Structural Analysis of Multimode Modelica Models.Electronics1117September 2022, 163HALDOIback to text
 5 articleContracts for System Design.Foundations and Trends in Electronic Design Automation12232018, 124400HALDOIback to text
 6 articleA Formally Verified Hybrid System for Safe Advisories in the NextGeneration Airborne Collision Avoidance System.International Journal on Software Tools for Technology Transfer196November 2017, 717741HALDOI
 7 articleOperational Models for PiecewiseSmooth Systems.ACM Transactions on Embedded Computing Systems (TECS)165sOctober 2017, 185:1185:19HALDOI
10.2 Publications of the year
International journals
 8 articleMixed NondeterministicProbabilistic Automata: Blending graphical probabilistic models with nondeterminism.Discrete Event Dynamic Systems2023October 2023, 158HALDOIback to text
International peerreviewed conferences
 9 inproceedingsTowards the separate compilation of Modelica: modularity and interfaces for the index reduction of incomplete DAE systems.Modelica 2023  15th International Modelica ConferenceAachen, Germany2023, 110HALback to textback to textback to text
Reports & preprints
 10 miscOn Covering Euclidean Spaces with Qarrangements of Cones.February 2024HALback to text
 11 miscFault Diagnosability Analysis of MultiMode Systems.2023HALDOIback to text
10.3 Cited publications
 12 inproceedingsGame Models for Open Systems.Verification: Theory and Practice2772Lecture Notes in Computer ScienceSpringer2003, 269289DOIback to text
 13 inproceedingsInterface automata.Proc. of the 9th ACM SIGSOFT International Symposium on Foundations of Software Engineering (FSE'01)ACM Press2001, 109120DOIback to text
 14 inproceedingsInterfacebased design.In Engineering Theories of Software Intensive Systems, proceedings of the Marktoberdorf Summer SchoolKluwer2004DOIback to text
 15 inproceedingsTimed Interfaces.Proc. of the 2nd International Workshop on Embedded Software (EMSOFT'02)2491Lecture Notes in Computer ScienceSpringer2002, 108122DOIback to text
 16 article20 Years of Modal and Mixed Specifications.Bulletin of European Association of Theoretical Computer Science1942008, URL: https://dblp.org/rec/journals/eatcs/AntonikHLNW08.bibback to text
 17 onlineModelica, A Unified ObjectOriented Language for Systems Modeling. Language Specification, Version 3.6.Accessed: 202306122023, URL: https://modelica.org/documents/MLS.pdfback to textback to text
 18 bookPrinciples of Model Checking.MIT Press, Cambridge2008, URL: https://mitpress.mit.edu/9780262026499/principlesofmodelchecking/back to text
 19 inproceedingsDesign and Analysis of BatteryIntegrated Modular Multilevel Converters for Automotive Powertrain Applications.2021 23rd European Conference on Power Electronics and Applications (EPE'21 ECCE Europe)IEEE2021, P1back to text
 20 articleBuilding a Hybrid Systems Modeler on Synchronous Languages Principles.Proceedings of the IEEE1069September 2018, 15681592HALDOIback to textback to text
 21 miscA TypeBased Analysis of Causality Loops In Hybrid Systems Modelers.Deliverable D3.1_1 v 1.0 of the Sys2soft collaborative project ''Physics Aware Software''December 2013HALback to textback to text
 22 miscSemantics of multimode DAE systems.Deliverable D.4.1.1 of the ITEA2 Modrio collaborative projectAugust 2013HALback to text
 23 incollectionMultiMode DAE Models  Challenges, Theory and Implementation.Computing and Software Science: State of the Art and Perspectives10000Lecture Notes in Computer ScienceSpringerOctober 2019, 283310HALDOIback to text
 24 inproceedingsMultiple Viewpoint ContractBased Specification and Design.Proceedings of the Software Technology Concertation on Formal Methods for Components and Objects (FMCO'07)5382Revised Lectures, Lecture Notes in Computer ScienceAmsterdam, The NetherlandsSpringerOctober 2008DOIback to text
 25 incollectionFrom Hybrid Automata to~DAEBased Modeling.Principles of Systems Design13660Lecture Notes in Computer ScienceSpringer Nature SwitzerlandDecember 2022, 320HALDOIback to text
 26 techreportStructural Analysis of Multimode DAE Systems: summary of results.RR9387Inria Rennes  Bretagne AtlantiqueJanuary 2021, 27HALback to text
 27 articleThe mathematical foundations of physical systems modeling languages.Annual Reviews in Control502020, 72118HALDOIback to textback to text
 28 inproceedingsA typebased analysis of causality loops in hybrid modelers.HSCC '14: International Conference on Hybrid Systems: Computation and ControlProceedings of the 17th international conference on Hybrid systems: computation and control (HSCC '14)Berlin, GermanyACM PressApril 2014, 13HALDOIback to textback to text
 29 inproceedingsA Compositional Approach on Modal Specifications for Timed Systems..11th International Conference on Formal Engineering Methods (ICFEM'09)5885LNCSRio de Janeiro, BrazilSpringerDecember 2009, 679697HALback to text
 30 articleModal eventclock specifications for timed componentbased design.Science of Computer Programming772012, 12121234HALDOIback to text
 31 inproceedingsRefinement and Consistency of Timed Modal Specifications..3rd International Conference on Language and Automata Theory and Applications (LATA'09)5457LNCSTarragona, SpainSpringerApril 2009, 152163HALDOIback to text
 32 inproceedingsA proposal for realtime interfaces in SPEEDS.Design, Automation and Test in Europe (DATE'10)IEEE2010, 441446DOIback to text
 33 inbookDiagnosis and FaultTolerant Control.Springer Berlin, Heidelberg09 2006, 109188DOIback to text
 34 articleModelling of Complex Systems: Systems as Dataflow Machines.Fundamenta Informaticae9122009, 251274HALDOIback to text
 35 phdthesisUn cadre formel pour l'étude des systèmes industriels complexes: un exemple basé sur l'infrastructure de l'UMTS.Ecole Polytechnique2006back to textback to text
 36 articleGraphical versus logical specifications.Theoretical Computer Science10611992, 320URL: https://www.sciencedirect.com/science/article/pii/030439759290276LDOIback to text
 37 inproceedingsSolving largescale Modelica models: new approaches and experimental results using OpenModelica.Proceedings of the 12th International Modelica Conference2017back to text
 38 inproceedingsHigherOrder Acausal Models.Proceedings of the 2nd International Workshop on EquationBased ObjectOriented Languages and Tools, EOOLT 2008, Paphos, Cyprus, July 8, 200829Linköping Electronic Conference ProceedingsLinköping University Electronic Press2008, 5969DOIback to text
 39 articleInteractive Programmatic Modeling.ACM Trans. Embed. Comput. Syst.2042021, 33:133:26DOIback to text
 40 phdthesisMetaLanguages and Semantics for EquationBased Modeling and Simulation.Linköping University, Sweden2010, URL: https://nbnresolving.org/urn:nbn:se:liu:diva58743back to text
 41 articleGraphBased Algorithms for Boolean Function Manipulation.IEEE Trans. Comput.358August 1986, 677691URL: http://dx.doi.org/10.1109/TC.1986.1676819DOIback to text
 42 inproceedingsCompositional design methodology with constraint Markov chains.QEST 2010Williamsburg, Virginia, United StatesSeptember 2010, URL: http://hal.inria.fr/inria00591578/enDOIback to textback to text
 43 articleConstraint Markov Chains.Theoretical Computer Science41234May 2011, 43734404URL: http://hal.inria.fr/hal00654003/enDOIback to text
 44 miscDemo: IsamDAE, an Implicit Structural Analysis Tool for Multimode DAE Systems.PosterApril 2020, 1HALback to text
 45 inproceedingsImplicit structural analysis of multimode DAE systems.HSCC 2020  23rd ACM International Conference on Hybrid Systems: Computation and ControlSydney New South Wales Australia, FranceACMApril 2020, 111HALDOIback to textback to textback to text
 46 articleThe index of general nonlinear DAEs.Numerische Mathematik722dec 1995, 173196URL: http://dx.doi.org/10.1007/s002110050165DOIback to text
 47 inproceedingsScalableTestGrids  An OpenSource and Flexible Benchmark Suite to Assess Modelica Tool Performance on LargeScale Power System Test Cases.Proceedings of the 14th International Modelica ConferenceLinköping Electronic Conference Proceedings181Linköping, SwedenModelica Association and Linköping University Electronic PressSeptember 2021, 351358DOIback to text
 48 phdthesisA Framework for Compositional Design and Analysis of Systems.EECS Department, University of California, BerkeleyDec 2007, URL: http://www.eecs.berkeley.edu/Pubs/TechRpts/2007/EECS2007174.htmlback to text
 49 inproceedingsResource Interfaces.Embedded Software, Third International Conference, EMSOFT 2003, Philadelphia, PA, USA, October 1315, 2003, Proceedings2855Lecture Notes in Computer ScienceSpringer2003, 117133DOIback to text
 50 inproceedingsCharacterization of Temporal Property Classes.ICALP623Lecture Notes in Computer ScienceSpringer1992, 474486DOIback to text
 51 articleChordal Networks of Polynomial Ideals.SIAM J. Appl. Algebra Geom.112017, 73110URL: https://doi.org/10.1137/16M106995XDOIback to text
 52 bookModel Checking.MIT Press1999, URL: https://mitpress.mit.edu/9780262038836/modelchecking/back to text
 53 articlePartial Cylindrical Algebraic Decomposition for Quantifier Elimination.J. Symb. Comput.1231991, 299328DOIback to text
 54 bookN. J.N. J. CutlandNonstandard analysis and its applications.Cambridge Univ. Press1988DOIback to text
 55 inproceedingsECDAR: An Environment for Compositional Design and Analysis of Real Time Systems.Automated Technology for Verification and Analysis  8th International Symposium, ATVA 2010, Singapore, September 2124, 2010. Proceedings2010, 365370DOIback to text
 56 inproceedingsTimed I/O automata: a complete specification theory for realtime systems.Proceedings of the 13th ACM International Conference on Hybrid Systems: Computation and Control, HSCC 2010, Stockholm, Sweden, April 1215, 20102010, 91100DOIback to text
 57 inproceedingsAbstract Probabilistic Automata.Verification, Model Checking, and Abstract Interpretation  12th International Conference, VMCAI 2011, Austin, TX, USA, January 2325, 2011. Proceedings6538Lecture Notes in Computer Science2011, 324339DOIback to text
 58 bookAnalyse non standard.Hermann1989, URL: https://www.editionshermann.fr/livre/analysenonstandardfrancinedienerback to text
 59 bookTrace Theory for Automatic Hierarchical Verification of SpeedIndependent Circuits.ACM Distinguished DissertationsMIT Press1989DOIback to text
 60 articleTheoretical improvements in algorithmic efficiency for network flow problems.Journal of the ACM1921972, 248264URL: http://dx.doi.org/10.1145/321694.321699DOIback to text
 61 phdthesisA structured model language for large continuous systems.Universiteit i Lund1978back to text
 62 inproceedingsModelica extensions for MultiMode DAE Systems.Proceedings of the 10th International Modelica Conference, March 1012, 2014, Lund, SwedenLinköping University Electronic Pressmar 2014DOIback to text
 63 inproceedingsModiadynamic modeling and simulation with julia.Juliacon'18University College London, UKAugust 2018, URL: https://elib.dlr.de/124133/back to text
 64 inproceedingsSurvey of industrial applications of embedded model predictive control.2016 European Control Conference (ECC)2016, 601601DOIback to text
 65 articleDiagnosability analysis considering causal interpretations for differential constraints.IEEE Transactions on Systems, Man, and CyberneticsPart A: Systems and Humans4252012, 12161229back to text
 66 articleThe OpenModelica Integrated Environment for Modeling, Simulation, and ModelBased Development.Modeling, Identification and Control4142020, 241295DOIback to text
 67 inproceedingsA new approach to the maximum flow problem.Proceedings of the eighteenth annual ACM symposium on Theory of computing (STOC'86)1986, URL: http://dx.doi.org/10.1145/12130.12144DOIback to text
 68 inproceedingsHierarchical Diagnosis Algorithm for ComponentBased MultiMode Systems.22nd IFAC World CongressIFAC2023back to text
 69 phdthesisCompiling Modelica: about the separate translation of models from Modelica to OCaml and its impact on variablestructure modeling.TU Berlin2019DOIback to text
 70 articleFaster Structural Analysis of DifferentialAlgebraic Equations by Graph Compression.IFACPapersOnLine4818th Vienna International Conference on Mathematical Modelling2015, 135140URL: https://www.sciencedirect.com/science/article/pii/S2405896315001019DOIback to text
 71 miscIEEE Standard VHDL Analog and MixedSignal Extensions, Std 1076.11999.1999, URL: http://dx.doi.org/10.1109/IEEESTD.1999.90578DOIback to text
 72 bookFaultDiagnosis Systems: An Introduction from Fault Detection to Fault Tolerance.Springer Berlin Heidelberg2006back to text
 73 inproceedingsModeling Time in Hybrid Systems: How Fast Is ``Instantaneous''?IJCAI1995, 17731781URL: https://www.ijcai.org/Proceedings/952/Papers/097.pdfback to text
 74 inproceedingsFormal verification of ACAS X, an industrial airborne collision avoidance system.2015 International Conference on Embedded Software, EMSOFT 2015, Amsterdam, Netherlands, October 49, 2015Amsterdam, NetherlandsIEEE2015, 127136HALDOIback to text
 75 articleStructural fault detection and isolation in hybrid systems.IEEE Transactions on Automation Science and Engineering1542017, 15851599back to text
 76 phdthesisPrincipe de transduction sémantique pour l'application de théories d'interfaces sur des documents de spécification.Université Rennes 1 ; Rennes 1April 2021HALback to text
 77 articleProving the Correctness of Multiprocess Programs.IEEE Trans. Software Eng.321977, 125143DOIback to text
 78 inproceedingsOn Modal Refinement and Consistency.Proc. of the 18th International Conference on Concurrency Theory (CONCUR'07)Springer2007, 105119DOIback to text
 79 inproceedingsA Modal Process Logic.Proceedings of the Third Annual Symposium on Logic in Computer Science (LICS'88)IEEE1988, 203210DOIback to text
 80 incollectionAn Invitation to Nonstandard Analysis.Nonstandard Analysis and its ApplicationsCambridge Univ. Press1988, 1105DOIback to text
 81 articleAn introduction to factor graphs.IEEE Signal Processing Magazine2112004, 2841DOIback to text
 82 inproceedingsInput/Output Automata: Basic, Timed, Hybrid, Probabilistic and Dynamic.CONCUR 2003  Concurrency Theory, 14th International Conference, Marseille, France, September 35, 2003, Proceedings2761Lecture Notes in Computer ScienceSpringer2003, 187188DOIback to text
 83 articleA Proof of the Kahn Principle for Input/Output Automata.Inf. Comput.8211989, 8192DOIback to text
 84 bookTemporal verification of reactive systems: Safety.Springer1995DOIback to text
 85 onlineSimulink official webpage.Accessed: 202306122023, URL: https://www.mathworks.com/products/simulink.htmlback to text
 86 articleApplying ``Design by Contract''.Computer2510October 1992, 4051URL: http://dx.doi.org/10.1109/2.161279DOIback to text
 87 articleMethodology for the Design of Analog Integrated Interfaces Using Contracts.IEEE Sensors Journal1212Dec. 2012, 33293345DOIback to text
 88 articleThe consistent initialization of differentialalgebraic systems.SIAM J. Sci. Stat. Comput.921988, 213231DOIback to textback to text
 89 articleA Simple Structural Analysis Method for DAEs.BIT Numerical Mathematics412March 2001, 364394URL: http://dx.doi.org/10.1023/a:1021998624799DOIback to textback to textback to text
 90 articleA Modal Interface Theory for Componentbased Design.Fundamenta Informaticae108122011, 119149URL: http://hal.inria.fr/inria00554283/enDOIback to text
 91 articleTwenty years of distributed portHamiltonian systems: a literature review.IMA J. Math. Control. Inf.3742020, 14001422DOIback to text
 92 bookNonStandard Analysis.Princeton Landmarks in Mathematics1996, URL: https://press.princeton.edu/books/paperback/9780691044903/nonstandardanalysisback to text
 93 articleIndustry needs and research directions in requirements engineering for embedded systems.Requirements Engineering172012, 5778URL: http://link.springer.com/article/10.1007/s007660110144xDOIback to text
 94 inproceedingsThe Ritt–Kolchin theory for differential polynomials.Differential Algebra and Related Topics2002, 170DOIback to text
 95 onlineDymola official webpage.Accessed: 202306122023, URL: https://www.3ds.com/productsservices/catia/products/dymola/back to text
 96 articlePositiveinstance driven dynamic programming for treewidth.J. Comb. Optim.3742019, 12831311DOIback to text
 97 articleLeveraging Structural Analysis for Quantified Boolean Formulae.Summer School on Modelling and Verification of Parallel Processes, Grenoble, France6http://khalilghorbal.info/assets/pdf/papers/RBTF_movep.pdf2020back to text
 98 inbookSwitched Differential Algebraic Equations.Dynamics and Control of Switched Electronic Systems: Advanced Perspectives for Modeling, Simulation and Control of Power ConvertersF.Francesco VascaL.Luigi IannelliLondonSpringer London2012, 189216DOIback to text