Model file Model parser TM integrator Poly ODE 1 Poly ODE 2 Nonpoly ODE

Hybrid systems are dynamical systems which exhibit both continuous flow and discrete jumps. They are natural modeling formalism for the systems composed of a discrete controller interacting with a physical environment. Since hybrid systems often appear in safetycritical situations, it is non-trivial to study their behavior. A typical way to do that is to explore the reachable state space of a hybrid system, which is called reachability analysis. Unfortunately, such a job can not be done algorithmically, since the reachability problem on hybrid systems is undecidable [1]. The tool Flow∗ tries to compute an over-approximation for a bounded reachable set of a hybrid system. A reachable set w.r.t. a bounded time horizon [0, T ] and a maximum jump depth k is called bounded, it consists of the states each of which can be reached at some time t ∈ [0, T ] via at most k jumps from an initial state of the system. The over-approximation set computed by Flow∗ is a finite group of Taylor Model (TM) flowpipes. Each flowpipe over-approximates the exact reachable set in a small time interval. The hybrid system models considered by Flow∗ are described as follows. The continuous dynamics in a mode should be defined by a non-linear Ordinary Differential Equation (ODE). A mode invariant or a jump guard should be defined by polynomial constraints. A jump reset should be defined by a polynomial mapping. The initial set of a hybrid system can be given by an interval or a TM. We present a birdview of the tool in Figure 1. Flow∗ accepts two classes of input files. A model file describes a bounded reachability problem on a hybrid or continuous system. The tool tries to compute an over-approximation for the bounded reachable set. A TM file includes a state space definition as well as finitely many TM flowpipes. The tool reads those specifications and generates a plotting file for the flowpipes. In both of the cases, an unsafe set can be specified, and Flow∗ will conservatively check the emptiness of the intersection between flowpipes and the unsafe set. The output of Flow∗ consists of the following files. A plotting file which provides a 2D visualization of the flowpipes. The format of the plotting file can be determined by users, it can be a Gnuplot file or a Matlab file. A TM file which describes the state space of the system and contains all computed TM flowpipes. The file can be reused by Flow∗, or the content may also be extracted and analyzed by other tools. If an unsafe set is given and the tool detected some “unsafe” flowpipes, then a counterexample file is generated. The file includes all potential unsafe flowpipes as well as the (discrete) computation paths which lead to them. The two main components of Flow∗ are the TM integrator and the image computation module. In the module TM integrator, we provide three different schemes for the integration of non-linear ODEs. The functionalities of them are listed as follows.