text: although the present invention may be used with diagrams from any number of graphical environments , simulink / stateflow ( s / s ) diagrams are used as representative examples of such diagrams . simulink / stateflow ( s / s ) [ 2 ] diagrams are graphical representations of dynamical systems , and can capture both time - driven as well as event - driven dynamics of hybrid systems . stateflow diagrams are used for representing and simulating event - driven dynamics . the s / s diagrams can be simulated to generate sample - runs ( runs on sample times ) which provide a means for their validation . other means of validation include testing and verification . in order to be able to test a s / s diagram or verify an implementation of a s / s diagram , a model - based approach is desirable , where a model can be used for automated test generation or as a formal specification . simulink blocks can be time - driven or non time - driven . a time - driven block , such as an integrator block , represents the time - dependent mathematical relationships between its inputs and outputs . on the other hand , non time - driven block , such as a stateflow block or a discrete event subsystem block , may evolve upon the occurrence of events . here , we focus on study the semantic translation of time - driven blocks , and for conciseness , we write “ simulink blocks ” to mean only the “ time - driven simulink blocks ”. we propose an approach for translating the behaviors of a simulink diagram at ( discrete ) sample times to input / output - extended finite automata ( i / o - efa ) [ 9 , 15 ]. note that a simulink diagram can represent a hybrid system that combines event - driven discrete and time - dependent continuous behaviors , whereas i / o - efa is a model of a reactive untimed infinite state system . yet , since we are only interested in capturing the behaviors of a simulink diagram at sample times , an i / o - efa model ( which is untimed ) suffices . simulink provides a library of blocks ( such as transfer functions , discontinuities , math operations , logic and bit operations etc . ), which can be interconnected in a hierarchical fashion to form an overall simulink diagram . we consider the blocks in the simulink library to be “ atomic ”, and formally define an atomic - block . further we formulate two rules , namely connecting - rule and conditioning - rule , used in simulink for building complex blocks by combining the simpler ones , and formally define a class of simulink diagrams formed using these rules . this recursive view of defining the class of all simulink diagrams leads to a recursive translation in form of i / o - efa . in order to obtain an i / o - efa model recursively , we first present an algorithm for translating an atomic - block to an i / o - efa . next for each rule of combining simpler simulink diagrams to construct a complex simulink diagram , we develop a corresponding rule for combining the i / o - efa models of simpler simulink diagrams to build the i / o - efa model of the more complex simulink diagram . we introduce the concept of a step of an i / o - efa to emulate the computation of a simulink diagram at a sample time . a sequence of steps , namely , a step - trajectory , generates outputs over a sequence of sample times . we show that the translation approach is sound and complete : the input - state - output behavior of the i / o - efa , defined in terms of a step - trajectory , preserves the input - state - output behavior of the corresponding simulink diagram at each sample time ( assuming the same integration method for any of the continuous blocks with dynamics ). the translation approach is recursive . formal definitions of an atomic simulink block and a class of simulink diagrams formed using the identified connecting - rule and conditioning - rule are provided . these definitions can be used to create a more complex simulink diagram from the simpler ones . the model of i / o - efa is amenable to automated test generation [ 10 ] or verification [ 14 ]. the model can be directly supplied to a test generation or verification tool that accepts i / o - efa models or programming languages such as c / c ++ or java since an i / o - efa model can be easily translated into these languages . the translation approach has no special restriction on the types of simulink blocks . the approach supports virtually all blocks in simulink library ( in this patent we only consider time - driven blocks ) provided that the block can be mathematically written as input - state - output functions over time . also unlike [ 4 ], it does not require a clear separation between discrete and continuous dynamics for modeling hybrid systems . as an illustration , consider for example the bouncing ball example presented herein . the translation approach is sound and complete : the input - state - output behavior of an i / o - efa model , as defined in terms of a step - trajectory , preserves the input - state - output behavior of the corresponding simulink diagram at each sample time ( assuming the same integration method for any of the continuous blocks with dynamics ). the translation approach can handle the simulink features such as multi - rate diagrams , sample times with initial offsets , variable - step simulation etc . the translation approach is general in that it can be applied to other graphical modeling and simulation tools such as labview . we present the notion of an input - output extended finite automaton ( i / o - efa ) as a formal model of representation for a simulink diagram . i / o - efa is a model of a reactive untimed infinite state system in form of an automaton , extended with discrete variables such as inputs , outputs , and data . using i / o - efa as a model , many value - passing processes can be represented as finite graphs . an i / o - efa consists of locations ( i . e ., symbolic - state ), data ( i . e ., numeric - state ), numeric - inputs , numeric - outputs , symbolic - inputs , symbolic - outputs , transitions , an initial location , initial data values , and a final location . the locations ( symbolic - states ) together with the data ( numeric - states ) form the state - space of a i / o - efa . the locations are finite and form the vertices of the automaton graph . the edges of the graph represent transitions between the locations and are guarded by constraints over the data and the inputs . the occurrence of a transition triggers a data update and an output assignment . definition 1 an input / output extended finite automaton ( i / o - efa ) is a tuple l is the set of locations ( symbolic - states ), d = d 1 × . . . × d n is the set of typed data ( numeric - states ), u = u 1 × . . . × u m is the set of typed numeric - inputs , y = y 1 × . . . × y p is the set of typed numeric - outputs , σ is the set of symbolic - inputs , δ is the set of symbolic - outputs , l 0 εl is the initial location , d 0 ⊂ d is the set of initial - data values , l m εl is the final location , and e is the set of edges , and each eεe is a 7 - tuple , e =( o e , t e , σ e , δ e , g e , f e , h e ), where o e εl is the origin location , t e εl is the terminal location , σ e εσ ∪{ ε } is the symbolic - input , δ e εδ ∪{ ε } is the symbolic - output , g e ⊂ d × u is the enabling guard ( a predicate ), f e : d × u → d is the data - update function , h e : d × u → y is the output - assignment function . initially , p starts from the initial location l 0 and an initial data value d o εd 0 . while at a certain state ( l , d ) εl × d , a transition eεe such that o e = l is enabled if the input σ e arrives , and the data d and input u are such that the guard g e ( d , u ) holds . note when σ e = ε , the transition is enabled when only the guard g e ( d , u ) holds ; on the other hand when g e ( d , u )= true , then the transition is enabled when only σ e arrives . an enabled transition can be executed . the execution of an enabled transition e at the state ( o e , d ) causes p to transit to the location t e , the data value is updated to ƒ e ( d , u ), the output variable is assigned the value h e ( d , u ), and a discrete output δ e is emitted . simulink provides a library of blocks , which can be used as minimal systems , and the corresponding simulink diagrams will then be minimal simulink diagrams . we refer to such blocks as atomic blocks . the atomic - blocks can be composed in a recursive fashion to construct more complex simulink diagrams , and we discuss the rules of composition in the next section . an atomic - block can be stateful or stateless . a stateful block &# 39 ; s output depends on the history of its inputs . an example of a stateful block is the unit delay block . on the other hand , the output of a stateless block depends only on its current inputs . an example of a stateless block is the gain block , which simply outputs its input signal , multiplied with a constant called the gain . an atomic - block can be classified as continuous - time versus discrete - time , and is associated with a sample - period . for a continuous - time block , sample - period is the time between the instants when it is numerically simulated . for a discrete - time block , sample - period is the time between the instants when the corresponding discrete - time system evolves . definition 2 an atomic simulink block ψ can be represented as a tuple ( u ψ , y ψ , d ψ , d 0 ψ ,{( g i ψ , ƒ i ψ , h i ψ )} i = 1 q ψ ,( t ψ , t o ψ )), u ψ = u 1 ψ × . . . × u m ψ ψ is the set of typed inputs , y ψ = y 1 ψ × . . . × y p ψ ψ is the set of typed outputs , d ψ = d 1 ψ × . . . × d n ψ ψ is the set of typed data , d 0 ψ ⊂ d ψ is the set of initial data conditions , {( g i ψ , ƒ i ψ , h i ψ )} i = 1 q ψ is a set of triples , where g i ψ ⊂ d ψ × u ψ is a predicate representing an enabling guard , such that v i = 1 q ψ g i = true , ƒ i ψ : d ψ × u ψ → d ψ is a data - update function , h i ψ : d ψ × u ψ → y ψ is an output - assignment function . t ψ is the sample period and t 0 ψ is an offset ( it is assumed zero by default if unspecified ). remark 1 the kth sampling time occurs at kt ψ + t o ψ . the value of the input signal at the kth sampling time is denoted as u ( k )=( u 1 ( k ), . . . , u m ψ ( k )) εu ψ , and similarly for other signals . at the kth sampling time , if the data d ( k ) and the input u ( k )) are such that g i ψ ( d ( k ), u ( k )) holds , the next data , d ( k + 1 )= ƒ i ψ ( d ( k ), u ( k )), is computed , and the output value is assigned to y ( k )= h i ψ ( d ( k ), u ( k )). note that for continuous - time blocks , the data - update and output - assignment functions correspond to the ones obtained through discretization at sample times using an appropriate integration method . simulink allows different kinds of sample period that include discrete , continuous , inherited (− 1 ), constant ( inf ) and triggered etc . discrete sample periods are the only kind for which the evolution times of the corresponding system are known a priori . for blocks with other kinds of sample period , simulink determines the evolution times of the corresponding system from the block &# 39 ; s type or by its context within the model during the compilation phase of simulation . given a simulink diagram , the sample period of a non continuous - time block can be obtained from the get_param ( object , ‘ compiledsampletime ’) command after compiling the diagram . the sample - period of a continuous - time block , which is used in discretization , can be chosen to be the greatest common divisor of all non continuous - time blocks using the following rule [ 3 ]: for 1 ≦ i , j ≦ n , also note for a stateless atomic - block ψ , the set d ψ is empty ( and accordingly , there are no initial data conditions or data - update functions ). the integrator block provides a continuous - time integration of the input signal . it models the relations , { dot over ( d )}( t )= u ( t ) with d ( 0 )= d 0 , and y ( t )= d ( t ), where u is its input , d is its data , y is its output , t is the continuous - time variable , and d 0 is the initial data condition . using euler &# 39 ; s method the discretization is d ( k + 1 )= d ( k )+ t ψ u ( k ). thus , the integrator block can be represented as : ( u , y , d , d 0 ,{(−, d ( k + 1 )= d ( k )+ t ψ u ( k ), y ( k )= d ( k ))},( t ψ , t 0 ψ )), where t ψ is the sample - period and t 0 ψ is an offset . note that the integrator block can be configured further by setting certain parameters to have a more complex behavior . an example is the integrator block ψ 5 in fig3 . in example 1 we did not include this much detail for the sake of simplicity of illustration . we introduce the following concepts for the computation of an atomic block over sample times . definition 3 given an atomic - block ψ and an input uεu ψ , we call the computation of the corresponding output yεy ψ a step of ψ over u . y is called the output of a step of ψ over u . given an input sequence { u ( k )} k = 0 k , a step - trajectory of ψ over { u ( k )} k = 0 k is a sequence of steps of ψ , where the kth step ( 0 ≦ k ≦ k ) in the sequence is over the input u ( k ). letting y ( k ) ( 0 ≦ k ≦ k ) denote the output of ψ over u ( k ), { y ( k )} k = 0 k is called the output of step - trajectory of ψ over { u k } k = 0 k . a simulink diagram , also called a system - block , can be constructed by recursively composing atomic - blocks and other simpler system - blocks according to certain rules . the following two rules are the among the rules that simulink uses for the construction of complex simulink diagrams from the simpler ones : connecting - rule : a certain input of one system - block can be connected to a certain output of another system - block . the connections over a set of system - blocks ψ can be represented using a relation c ⊂ ( ψ × n ) 2 , where n denotes the set of port numbers . a connection c =(( ψ 1 , i ),( ψ 2 , j )) εc connects the output port i of system - block ψ 1 to an input port j of system - block ψ 2 . the “ c - connected ψ system ” thus formed is denoted ψ / c . note a possible choice for connections is the “ null - connection ”, and { ψ }/= ψ . conditioning - rule : a system - block can be made conditionally executable when a certain guard condition over certain variables , called control - inputs , holds . further the data may be reset when the guard condition holds , and the output may be reset when the guard condition is violated . given a system - block ψ , a conditioning over ψ is a 5 - tuple θ :=( u θ , g θ , ƒ θ , h θ ,( t θ , t o θ )), u θ = u 1 θ × . . . × u m θ θ is the set of conditioning - inputs ( also called control - inputs ), g θ ⊂ u θ is a condition ( predicate ) over u θ , ƒ θ : d ψ → d ψ is a data - resetting function , h θ : y ψ → y ψ is an output - resetting function , and t θ is a sample - period , t o θ is an offset . when g θ holds , ψ computes , and otherwise , h θ assigns the output . also , when g ø becomes true , the first computation of ψ is preceded by a data - update by ƒ θ . the “ θ - conditioned ψ ” system thus formed is denoted ψ θ . the conditioning - rule can be implemented by placing a system - block inside a certain subsystem block ( of simulink library ) which can be configured to specify the conditioning parameters . note a possible choice for conditioning is “ null - conditioning ”, denoted ⊥:=(−, true , id , id , ∞), in which case ψ ⊥= ψ . ( here id denotes the identity function .) next we formally define the class of simulink diagrams ( also referred to as system - blocks ) formed using the above rules . definition 4 a certain class of simulink diagrams ( also referred to as system - blocks ) is recursively defined as follows . 1 . ψ is an atomic - block , then ψ is a system - block . 2 . ψ is a set of system - blocks , c ⊂ ( ψ × n ) 2 is a set of interconnections , then c - connected ψ , denoted ψ / c , is a system - block . 3 . ψ is a system - block and θ is a conditioning over ψ , then θ - conditioned ψ , denoted ψ θ , is a system - block . inputs u ψ = π ∃((.,. ),( ψ , i )) εc u i ψ , outputs y ψ = π ψεψ y ψ , data d ψ = π ψεψ d ψ , initial data d 0 ψ = π ψεψ d ψ , and sample - period , t ψ and offset t o ψ are obtained using the rule defined in remark 1 over { t ψ , t o ψ | ψεψ }. note the above definition of t ψ ensures that each computation of each system - block ψεψ coincides with some computation of the connected system - block ψ ( i . e ., no computation of any system - block is missed ). inputs u ψ = u ψ × u θ , outputs y ψ = y ψ , data d ψ = d ψ , initial data d 0 ψ = d 0 ψ sample - period note by the simulink grammar , for a system - block ψ := ψ θ , t θ is either specified and in which case t ψ is inherited to be t θ , or is unspecified and in which case t ψ is inherited to be t ψ . similarly for t o ψ . consider the simulink diagram ψ of a counter shown in fig1 , where the unit delay block ψ 5 is a discrete - time atomic - block and the block ψ 1 is an enabled subsystem block . the output y 5 increases by 1 at each sample - period when the control input u is positive , and y 5 resets to its initial value when the control input u is not positive . the saturation block ψ 2 limits the value of y 5 in the range between − 0 . 5 and 7 . the sample - period of ψ 5 is 0 . 01 seconds and others are either constant ( inf ) or inherited (− 1 ). t o ψ 5 = 0 by default since unspecified . using get_param command after compiling ψ , t ψ = t ψ i = 0 . 01 for i = 1 , 2 , 3 , 4 , 5 . ψ belongs to the class of simulink diagrams defined in definition 4 : ψ 1 =({ ψ 3 , ψ 4 , ψ 5 }/ c 2 ) θ , where c 2 ={(( ψ 3 , •),( ψ 4 , •)), (( ψ 4 , •),( ψ 5 , •)), ( ψ 5 , •),( ψ 4 , •))}, θ =( u θ , u θ ( k )& gt ; 0 , d ( k )= d 0 , ( y 3 ( k ), y 4 ( k ), y 5 ( k ))=(−, −, y 50 ), −) c 1 ={(( ψ 1 , •),( ψ 2 , •))}, and ψ 2 , ψ 3 , ψ 4 , ψ 5 are atomic - blocks . note since we choose the pulse type of the source block pulse generator to be time based , ψ is a single - rate simulink diagram . thus the source block for generating the inputs and the sink block scope for displaying the outputs are not considered as part of the simulink diagram being translated , and hence not included in ψ . if the pulse type of the source block is chosen to be sample based and the sample time is different from 0 . 01 , then ψ becomes a multirate simulink diagram . consider the multirate simulink diagram ψ shown in fig2 , where blocks ψ 3 and ψ 7 are discrete - time blocks with sample - period of 0 . 01 and 0 . 025 seconds , respectively . the zero - order hold block ψ 8 is also a discrete - time block that samples the incoming signal at 0 . 01 . blocks ψ 5 and ψ 6 are continuous - time blocks . the sample - periods of other blocks are either constant ( inf ) or inherited (− 1 ). all offsets are 0 by default since unspecified . thus , t ψ i = 0 . 01 for i = 1 , 2 , 3 , 4 , 8 and t ψ 7 = 0 . 025 . since gcd ( 0 . 01 , 0 . 025 )= 0 . 005 , we opt to discretize ψ 5 and ψ 6 at a sample - period of 0 . 005 . then t ψ 5 = t ψ 6 = 0 . 005 , and also t ψ = 0 . 005 . ψ belongs to the class of simulink diagrams defined in definition 4 : ψ = ψ / c , where ψ ={ ψ 1 , ψ 2 , ψ 3 , ψ 4 , ψ 5 , ψ 6 , ψ 7 , ψ 8 } and c is omitted . u =, d = d 3 × d 5 × d 6 × d 7 with d 0 ={( 0 , 0 , 0 , 0 )}. note the sink block scope for displaying the outputs is not considered as part of the simulink diagram being translated , and hence not included in ψ . consider the simulink diagram ψ of a bouncing ball shown in fig3 . ψ models a hybrid - system of a bouncing ball that is thrown up with an initial velocity of 15 m / s from an initial height of 10 m . y 5 ( resp ., y 2 ) is the position ( resp ., velocity ) of the ball . ψ 2 and ψ 5 are continuous - time blocks . we have opted to discretize ψ 2 and ψ 5 at a sample period of 0 . 01 . the sample - periods of other blocks are either constant ( inf ) or inherited (− 1 ). then t ψ = t ψ i = 0 . 01 for 1 , . . . , 7 . ψ belongs to the class of simulink diagrams defined in definition 4 : ψ = ψ / c , where ψ ={ ψ 1 , ψ 2 , ψ 3 , ψ 4 , ψ 5 , ψ 6 , ψ 7 } and c is omitted . u =, d = d 1 × d 2 with d 0 ={( 15 , 10 )}. when system - blocks are composed using the connecting - rule to form a more complex system - block , the input of one system - block becomes the output of another system - block . to respect the interdependency of the inputs / outputs , simulink defines and uses the notion of an execution - order ( which it refers as sorted - order ) to determine the order in which the system - blocks included inside a connected system - block are executed . note that the conditioning - rule does not require defining a sorted - order since it is applied to a single system - block . given a system - block ψ / c formed using the connecting - rule , the sorted - order of the system - blocks { ψεψ } is given as an ordering function ord : ψ → n , where n is the set of natural numbers . the sorted - order induces a total - order over ψ , i . e ., for ψ , ψ ′ εψ , ord ( ψ )= ord ( ψ ′) if and only if ψ = ψ ′. accordingly ψεψ is executed before ψ ′ εψ if ord ( ψ )& lt ; ord ( ψ ′). the sorted - order value ord ( ψ ) can be displayed , as part of a label ascribed to a system - block ψεψ , by selecting the option sorted order from simulink block displays menu . assuming , without loss of generality of correctness of translation , that the optimization on conditional execution behaviors is turned off , the label ascribed to ψ has the format : id ( ψ / c ): ord ( ψ ): { id ( ψ )}, where id is a function that associates a certain identifier number to a system - block . the { id ( ψ )} part may be missing if ψ an atomic - block . whenever we need to indicate the label ascribed to ψεψ , we write it in the form : ψ [ id ( ψ / c ): ord ( ψ ){ id ( ψ )}]. the notion of sorted - order is essential in defining the step of a system - block . definition 5 given a system - block ψ and an input uεu ψ , the step of ψ over u is recursively defined as follows : if ψ is an atomic - block , then the step of ψ over u is as defined in definition 3 . if ψ = ψ / c is a connected system - block , then for j min ≦ j ≦ j max , where j min = min { ord ( ψ ): ψεψ } and j max = max { ord ( ψ ): ψεψ }, letting ψ j εψ denote the system - block with ord ( ψ j )= j , a step of ψ over u is a sequence of steps , whose jth element is the step of ψ j εψ over u j , the input of ψ j as determined by the set of connections c . if ψ = ψ θ is a conditioned system - block , then a step of ψ over u is the step of ψ ′ over u if g θ holds , and otherwise it is the execution of the output - resetting function h θ . also when g θ becomes true , the first execution of the step of ψ ′ over u is preceded by the execution of the data - resetting function ƒ θ . given an input sequence { u ( k )} k = 0 k , a step - trajectory of ψ over { u ( k )} k = 0 k is a sequence of steps of ψ , where the kth step ( 0 ≦ k ≦ k ) in the sequence is over the input u ( k ). letting y ( k ) ( 0 ≦ k ≦ k ) denote the output of ψ over u ( k ), { y ( k )} k = 0 k is called the output of step - trajectory of ψ over { u k } k = 0 k . note in the 2 nd item of definition 5 , when kt ψ + t 0 ψ = k ψ j t ψ j + t o ψ j a step of ψ j is computed by h i ψ j if g i ψ j holds , and k ψ j increases when k increases ; otherwise when kt ψ + t o ψ ≠ k ψ j t o ψ + t o ψ j , the output of ψ j remains its previous value , and k ψ j remains unchanged when k increases . consider the simulink diagram of ψ the counter shown in fig1 that was also discussed in example 2 , and its sorted - order displayed in fig1 . we have ψ 1 =( ψ 2 / c 2 ) θ =({ ψ 3 [ 1 : 0 ], ψ 4 [ 1 : 2 ], ψ 5 [ 1 : 1 ]}/ c 2 ) θ . a step of ψ ={ ψ 1 , ψ 2 }/ c 1 is a step of ψ 1 followed by a step of ψ 2 since ord ( ψ 1 )& lt ; ord ( ψ 2 )= 2 . a step of ψ 1 =({ ψ 3 , ψ 4 , ψ 5 }/ c 2 ) θ is obtained as follows : if g θ holds , the sequence of steps of ψ 3 , ψ 5 , ψ 4 is executed since ord ( ψ 3 )= 0 & lt ; ord ( ψ 5 )= 1 & lt ; ord ( ψ 4 )= 2 ; and otherwise , h θ computes . also when g θ becomes true , the first execution of the sequence of steps of ψ 3 , ψ 5 , ψ 4 is preceded by the computation of ƒ θ . consider the multirate simulink diagram ψ of fig2 that was also discussed in example 3 , and its sorted - order displayed in fig2 . it can be seen that ψ = ψ 1 [ 0 : 2 ], ψ 2 [ 0 : 6 ], ψ 3 [ 0 : 7 ], ψ 4 [ 0 : 8 ], ψ 5 [ 0 : 3 ], ψ 6 [ 0 : 4 ], ψ 7 [ 0 : 0 ], ψ 8 [ 0 : 5 ]}/ c . it then follows that a step of ψ is the sequence of steps of ψ 7 , ψ 1 , ψ 5 , ψ 6 , ψ 8 , ψ 2 , ψ 3 and ψ 4 . note for j = 1 , . . . , 8 , a step of ψ j is computed whenever kt ψ = k ψ j t ψ j , and otherwise , ψ j retains its previous values of the data and the output . consider the simulink diagram ψ of the bouncing ball of fig3 that was also discussed in example 4 , and its sorted - order displayed in fig3 . it can be seen that ψ ={ ψ 1 [ 0 : 7 ], ψ 2 [ 0 : 3 ], ψ 3 [ 0 : 2 ], ψ 4 [ 0 : 1 ], ψ 5 [ 0 : 5 ], ψ 6 [ 0 : 4 ], ψ 7 [ 0 : 0 ]}/ c . it then follows that a step of ψ is the sequence of steps of ψ 7 , ψ 4 , ψ 3 , ψ 2 , ψ 6 , ψ 5 and ψ 1 . we describe how a simulink diagram can be semantically translated to an i / o - efa . for any system - block ψ , its i / o - efa model is obtained by connecting two i / o - efa models , one for output - assignments and other for state - updates . we use l 0 − ψ , l m − ψ to denote the initial / final location for first i / o - efa , and l 0 + ψ , l m + ψ to denote the initial / final location for second i / o - efa . the two i / o - efa &# 39 ; s are connected using two edges : succession - edge connecting the final location l m − ψ of the first i / o - efa to the initial location l 0 + ψ to of the second i / o - efa , and time - advancement edge connecting the final location l m + ψ of the second i / o - efa to the initial location l 0 − ψ to of the first i / o - efa that increments time : k := k + 1 . translating atomic - blocks . fig4 depicts the two i / o - efa models connected by the succession and time - advancement edges for an atomic - block ψ . a formal description of the translation is provided in the following algorithm . algorithm 1 for an atomic - block ψ =( u ψ . y ψ , d ψ , d o ψ , {( g i ψ , ƒ i ψ , h i ψ )} i = 1 q ψ , ( t ψ , t o ψ )), p − ψ =( l − ψ ,−, u ψ , y ψ ,−,−, l 0 − ψ ,−, l m − ψ , e − ψ ), l − ψ ={ l 0 − ψ , l m − ψ } and e − ψ ={( l 0 − ψ , l m − ψ , −, −, g i ψ , −, h i ψ )| i ≦ q ψ }. p + ψ =( l + ψ , d p ψ , u ψ , y ψ ,−,−, l 0 + ψ , d 0 p ψ , l m + ψ , e + ψ ), l + ψ ={ l 0 + ψ , l m + ψ }, d p ψ := d ψ × k is the set of data , where k is the set of sampling times , d 0 p ψ := d 0 ψ ×{ 0 } is the set of initial - data conditions , and e + ψ ={( l 0 + ψ , l m + ψ , −, −, g i ψ , ƒ i ψ , −)| i ≦ q ψ }. p ψ =( l ψ , d p ψ , u ψ , y ψ ,−,−, l 0 ψ , d 0 p ψ , l m ψ , e ψ ), l ψ = l − ψ ∪ l + ψ , l 0 ψ = l 0 − ψ , l m ψ = l m + ψ , and e ψ = e − ψ ∪ e + ψ ∪{( l m − ψ , l 0 + ψ , −, −, −, −, −)}∪{( l m + ψ , l 0 − ψ −, −, −, −, k = k + 1 )}. translating for connecting - rule . in the i / o - efa models of a connected system - block ψ = ψ / c , the initial and final locations of the first ( resp ., second ) i / o - efa are the initial and final locations of the first ( resp ., second ) i / o - efa model of ψεψ that has the smallest and largest ord ( ψ )- value in ψ , respectively . also in order to preserve the sorted - order , there is an edge from the final location of the first ( resp ., second ) i / o - efa of ψεψ to the initial location of the first ( resp ., second ) i / o - efa of ψ ′ εψ if and only if ord ( ψ ′)= ord ( ψ )+ 1 . also in order to allow multirate system - blocks within a connected system - block , certain “ bypass ” edges are introduced within each system - block ψεψ connecting the initial location l 0 − ψ ( resp ., l 0 + ψ ) and final location l m − ψ ( resp ., l m + ψ ) of the first ( resp ., second ) i / o - efa of ψ . these edges are guarded by └ kt ψ + t 0 ψ ≠ k ψ t ψ + t 0 ψ ┘. implying that will be bypassed at those values of k when kt ψ + t 0 ψ is not equal to k ψ t ψ + t 0 ψ . in contrast , the converse guard condition of └ kt ψ + t o ψ = k ψ t ψ + t 0 ψ ┘ is introduced for the original set of edges originating at l 0 − ψ and l 0 + ψ . an illustration of the translating of ψ = ψ / c is depicted in fig5 , whereas a formalization is presented in algorithm 2 . without loss of generality , we assume that if (( ψ , i ),( ψ , j )) εc , then y i ψ = u j ψ , i . e ., the same variable has been used to denote the two signals . p − ψ =( l − ψ , d − p ψ , u ψ , y ψ ,−,−, l 0 − ψ , d 0 − p ψ , l m − ψ , e − ψ ), l − ψ :=∪ ψεψ l − ψ , d − p ψ := k × π ψεψ k ψ × t ψ t 0 ψ × π ψεψ t ψ × π ψεψ t 0 ψ , u ψ and y ψ are as defined in first part of remark 2 , l 0 − ψ = l 0 − ψ such that ord ( ψ )= min { ord ( ψ ): ψεψ }, d 0 − p ψ ={ 0 }× π ψεψ { 0 }× t ψ × t o ψ × π ψεψ t ψ × π ψεψ t o ψ , l m − ψ := l m − ψ such that ord ( ψ )= max { ord ( ψ ): ψεψ }, and e − ψ =∪ ψ {( l 0 − ψ , l m − ψ , −, −, [ kt ψ + t o ψ = k ψ t ψ + t o ψ ]̂ g i ψ , −, h i ψ )| i ≦ q ψ } ∪ {( l 0 − ψ , l m − ψ , −, −, └ kt ψ + t o ψ ≠ k ψ t ψ + t o ψ ┐, −, y ψ ( k )= y ψ ( k − 1 ))} ∪{( l m − ψ , l 0 − ψ ′, −, −, −, −, −)| ord ( ψ ′)= ord ( ψ )+ 1 ≦| ψ |, and ψ , ψ ′ εψ }. p + ψ =( l + ψ , d + p ψ , u ψ , y ψ ,−,−, l 0 + ψ , d 0 + p ψ , l m + ψ , e + ψ ), l + ψ :=∪ ψεψ l + ψ , d p ψ := d ψ × k × π ψεψ k ψ × t ψ × t o ψ × π ψεψ t ψ × π ψεψ t o ψ , where d ψ is as defined in first part of remark 2 , u ψ and y ψ are as defined in first part of remark 2 , l 0 + ψ = l 0 + ψ such that ord ( ψ )= min { ord ( ψ ): ψεψ }, d 0 + p ψ = d 0 ψ ×{ 0 }× π ψεψ { 0 }× t ψ × t o ψ × π ψεψ t ψ × π ψεψ t o ψ , where d 0 ψ is as defined in first part of remark 2 , l m + ψ := l m + ψ such that ord ( ψ )= max { ord ( ψ ): ψεψ }, and e + ψ =∪ ψ {( l 0 + ψ , l m + ψ , −, −, [ kt ψ + t o ψ = k ψ t ψ + t o ψ ]̂ g i ψ , ( d ψ ( k + 1 ), k ψ )=( θ i ψ , k ψ + 1 ), −)| i ≦ q ψ } ∪ ψ {( l 0 + ψ , l m + ψ , −, −, └ kt ψ + t o ψ ≠ k ψ t ψ + t o ψ ┐, d ψ ( k + 1 )= d ψ ( k ), −)} ∪{( l m + ψ , l 0 + ψ ′ , −, −, −, −, −)| ord ( ψ ′)= ord ( ψ )+ 1 ≦| ψ |, and ψ , ψ ′ εψ }. p ψ =( l ψ , d p ψ , u ψ , y ψ ,−,−, l 0 ψ , d 0 p ψ , l m ψ , e ψ ), l ψ := l − ψ ∪ l + ψ , d p ψ = d + p ψ , l 0 ψ = l 0 − ψ , d 0 p ψ = d 0 + p ψ , l m ψ := l m + ψ , and e ψ = e − ψ ∪ e + ψ ∪{( l m − ψ , l 0 + ψ , −, −, −, −, −)}∪{( l m + ψ , l 0 − ψ , −, −, −, −, k = k + 1 )}. remark 3 if ψ is a single - rate system - block , then the i / o - efa model of ψ = ψ / c presented in algorithm 2 can be simplified since in this case t ψ = t ψ and t o ψ = t o ψ for each ψεψ and so kt ψ + t o ψ = k ψ t ψ + t o ψ for each k . e − ψ =∪ ψ e − ψ ∪{( l m − ψ , l 0 − ψ ′ ,−,−,−,−,−)| ord ( ψ ′)= ord ( ψ )+ 1 ≦| ψ |, and ψ , ψ ′ εψ }, and e + ψ =∪ ψ e + ψ ∪{( l m + ψ , l 0 + ψ ′ ,−,−,−,−,−)| ord ( ψ ′)= ord ( ψ )+ 1 ≦| ψ |, and ψ , ψ ′ εψ }. consider ψ 2 / c 2 ={ ψ 3 , ψ 4 , ψ 5 }/ c 2 of example 2 , where ord ( ψ 3 )& lt ; ord ( ψ 5 )& lt ; ord ( ψ 4 ). the i / o - efa model for ψ 2 / c 2 , obtained using algorithm 2 for the connecting - rule and remark 3 , is shown in fig6 . the dotted boxes contain the 1st / 2nd i / o - efas of ψεψ 2 , and also of ψ 2 / c 2 . consider the multirate simulink diagram of fig2 that was discussed in example 3 . the i / o - efa model of ψ , obtained using algorithm 2 for the connecting - rule , is shown in fig7 . translating for conditioning - rule . in the translation of a conditioned system - block ψ = ψ θ , the 1st i / o - efa of ψ is the 1st i / o - efa of ψ together with ( i ) a newly added location l 0 − ψ , that also serves as the initial location of the first i / o - efa model of ψ , ( ii ) two newly added edges for capturing the conditional execution of ψ , and ( iii ) a “ bypass edge ” when the condition g θ doesn &# 39 ; t hold . the 2nd i / o - efa of ψ is the 2nd i / o - efa of ψ together with ( i ) a newly added location l 0 + ψ , that also serves as the initial location of the second i / o - efa model of ψ , ( ii ) a newly added edge for capturing the conditional execution of ψ , and ( iii ) a “ bypass edge ” when the condition g θ doesn &# 39 ; t hold . an extra binary - valued data - variable d θ , with initial value 0 , is introduced to keep track of the period over which g θ holds . an illustration of the translating of ψ = ψ θ is depicted in fig8 , whereas a formalization is presented in algorithm 3 . p − ψ =( l − ψ , d θ , u ψ , y ψ ,−,−, l 0 − ψ , d 0 θ , l m − ψ , e − ψ ), l − ψ = l − ψ ∪{ l 0 − ψ }, d θ ={ 0 , 1 }, u ψ and y ψ are as defined in second part of remark 2 , d 0 θ ={ 0 }, l m − ψ = l m − ψ , and e − ψ = e − ψ ∪{( l 0 − ψ , l 0 − ψ , −, −, g θ ̂[ d θ = 0 ],( ƒ θ ; d θ := 1 ), −)}∪ {( l 0 − ψ , l 0 − ψ , −, −, g θ ̂[ d θ = 1 ], −, −)}∪{( l 0 − ψ , l m − ψ , −, −, g θ , −, h θ )}. p + ψ =( l + ψ , d p ψ , u ψ , y ψ ,−,−, l 0 + ψ , d 0 p ψ , l m + ψ , e + ψ ), l + ψ = l + ψ ∪{ l 0 + ψ }, d p ψ = d p ψ × d θ , d 0 p ψ = d 0 p ψ × d 0 θ , l m + ψ = l m + ψ , and e + ψ = e + ψ ∪{( l 0 + ψ , l 0 + ψ , −, −, g θ , −, −)}∪ {( l 0 + ψ l m + ψ , −, −, g θ , ( d ψ ( k + 1 ), d θ )=( d ψ ( k ), 0 ), −)}. p ψ =( l ψ , d p ψ , u ψ , y ψ ,−,−, l 0 ψ , d 0 p ψ , l m ψ , e ψ ), l ψ = l − ψ ∪ l + ψ , l 0 ψ = l 0 − ψ , l m ψ = l m + ψ , and e ψ = e − ψ ∪ e + ψ ∪{( l m − ψ , l 0 + ψ , −, −, −, −, −)}∪{( l m + ψ , l 0 − ψ , −, −, −, −, k = k + 1 )}. remark 4 algorithms 1 , 2 and 3 provide translation under the fixed - step simulation semantics of simulink . the algorithms can be modified to follow the variable - step simulation semantics as well . the variable - step solvers in the simulink dynamically increase ( or reduce ) the step size ( i . e ., the value of t ψ ) if the error exceeds ( or falls under ) a specific limit er ceiling ( or er floor ) to see the modification , suppose the error calculation formula is ƒ e ( y ψ ( k ), y ψ ( k − 1 ), . . . , t ψ ). then the time - advancement edge ( l m + ψ , l 0 − ψ , −, −, −, −, k = k + 1 ) will be replaced by the following set of edges : {( l m + ψ , l 0 − ψ ,−,−,[ ƒ e er ceiling ], t ψ = t ψ / 2 , k = k + 1 ),( l m + ψ , l 0 − ψ ,−,−,[ θ e er floor ], t ψ = 2 * t ψ , k = k + 1 ) ( l m + ψ , l 0 − ψ ,−,−,[ er floor ƒ e eƒ ceiling ],−, k = k + 1 )}. consider ψ 1 =( ψ 2 / c 2 ) θ of example 2 . the i / o - efa model of ψ 2 / c 2 was obtained in example 8 , and the i / o - efa model of ψ 1 , obtained using algorithm 3 for the conditioning - rule , is shown in fig9 . the dotted boxes contain the 1st / 2nd i / o - efas of ψ 2 / c 2 , and also of ψ 1 . consider the simulink diagram ψ ={ ψ 1 , ψ 2 }/ c of the counter shown in fig1 that was also discussed in example 2 . the i / o - efa model for ψ 1 was obtained in example 10 , and the i / o - efa model of ψ , obtained using algorithm 2 for the connecting - rule and remark 3 , is shown in fig1 . consider the simulink diagram ψ of the bouncing ball of fig3 , and also discussed in example 4 . the i / o - efa model of ψ , obtained using algorithm 2 for the connecting - rule and remark 3 , is shown in fig1 . in order to show that the translating approach is sound and complete , we introduce the concept of a step and of a step - trajectory of an i / o - efa model of a system - block . in the i / o - efa model p ψ of a system - block ψ , each increment of k corresponds to an execution of a path π =( l 0 ψ , . . . , l m ψ , l 0 ψ ). a computation along the kth execution of such a path gives an output value y ( k ) for an input u ( k ). definition 6 given an i / o - efa model p ψ of a system - block ψ and input uε ∪ ψ , a step of p ψ over u is the computation of a sequence of edges starting from l 0 ψ and ending at l m ψ , followed by the time - advancement edge . given an input sequence { u ( k )} k = 0 k , a step - trajectory of p ψ over { u ( k )} k = 0 k is a sequence of steps , where the kth step ( 0 ≦ k ≦ k ) in the sequence is over the input u ( k ). letting y ( k ) ( 0 ≦ k ≦ k ) denote the output of ψ over u ( k ), { y ( k )} k = 0 k is called the output of step - trajectory of p ψ over { u k } k = 0 k . next we show that the input - output behavior of an i / o - efa model at a sampling time , defined in terms of a step , preserves the input - output behavior of the corresponding simulink diagram at the same sampling time , defined in terms of a step . lemma 1 given a system - block ψ and an input u ( k ) and at the kth sampling time , let y ψ ( k ) and y p ψ ( k ) be the outputs of the steps of ψ and p ψ , respectively , over u ( k ). then y ψ ( k )= y p ψ ( k ), where p ψ is obtained from the algorithms 1 , 2 and 3 . proof : if ψ is an atomic - block , then from algorithm 1 and definitions 5 and 6 , a step of both ψ and p ψ at the kth sampling time k compute : y ψ ( k )= h i ψ ( d ( k ), u ( k )), where if ψ = ψ / c , then from algorithms 2 and definitions 5 and 6 , a step of both ψ and p ψ over u ( k ) at the kth sampling time compute ( y ψ j min ( k ), . . . , y ψ j ( k ), . . . , y ψ j max ( k )), where ψ j εψ and : ( i ) if kt ψ + t o ψ = k ψ j t ψ j + t o ψ j : y ψ j ( k )=( d ( k ), u ( k )), where u r ψ j ( k )= y s ψ j ′ ( k ) if (( ψ j , r ),( ψ j ′ , s )) εc ( ii ) if kt ψ + t o ψ ≠ k ψ j + t o ψ j : y ψ j ( k )= y ψ j ( k − 1 ). if ψ = ψ θ , then from algorithms 3 and definitions 5 and 6 , a step of both ψ and p ψ over u ( k ) at the kth sampling time compute : the following proposition shows that the input - output behavior of an i / o - efa model over a sequence of sampling times , defined in terms of a step - trajectory , preserves the input - output behavior of the corresponding simulink diagram over the same sequence of sampling times , defined in terms of a step - trajectory . proposition 1 given a system - block ψ and an input sequence { u ( k )} k = 0 k , let { y ψ ( k )} k = 0 k and { y p ψ ( k )} k = 0 k be the outputs of step - trajectories of ψ and p ψ , respectively , over { u ( k )} k = 0 k . then { y ψ ( k )} k = 0 k ={ y p ψ ( k )} k = 0 k , where p ψ is as obtained from the algorithms 1 , 2 and 3 . proof : the proof follows from lemma 1 and definitions 5 and 6 . to validate our model , a simulation for a certain input sequence ( pulse with period 1 . 2 second and pulse width 25 %) was obtained for the simulink diagram ψ of fig1 ( using fixed - step discrete solver ) and is shown in fig1 . the simulation of the i / o - efa model p ψ was done in stateflow . since a step of p ψ is defined to be the execution of a cycle starting from and ending at the initial location and visiting the final location once , the sample period for the stateflow model of p ψ was scaled down by the length of the cycle ( the number of locations of p ψ ). the simulation result of p ψ ( using fixed - step discrete solver ) is also shown in fig1 . a simulation was obtained for the multirate simulink diagram ψ of fig2 ( using fixed - step continuous solver odel euler ) and is shown in fig1 . the simulation of the i / o - efa model p ψ was done in stateflow ( note the computer cannot check the equality of two floating numbers , one way to handle this is to duplicate the set of t ψ s and t o ψ s , relabel and amplify them to make them integers ). recall t ψ = 0 . 005 . the sample - period for the stateflow model of p ψ was scaled down by the number of locations of p ψ . the simulation result of p ψ ( using fixed - step discrete solver ) is also shown in fig1 . a simulation was obtained for the simulink diagram ψ of fig3 ( using fixed - step continuous solver odel euler ) and is shown in fig1 . the simulation of the i / o - efa model p ψ was done in stateflow . recall the sample - period of ψ is 0 . 01 . the sample - period for the stateflow model of p ψ was scaled down by the number of locations of p ψ . the simulation result of p ψ ( using fixed - step discrete solver ) is also shown in fig1 . we briefly introduce the works related to ours , discussing succinctly their features . [ 4 ] presented a translation algorithm for converting a restricted subclass of s / s diagrams into a semantically equivalent hybrid automaton . for the subclass of s / s diagrams considered there exists a clear separation between the discrete and the continuous dynamics : all mode changes are made through switches , and whose controlling variables are restricted to be the outputs of the stateflow modules . in general , however , the discrete modes do not have to be determined by the output variables of the stateflow modules , and switches do not have to be used to switch continuous dynamics . our approach does not require a clear separation between discrete and continuous dynamics for modeling hybrid systems . also our translation approach has no special restriction on the types of simulink blocks . the approach supports virtually all blocks in simulink library ( in this work we only consider time - driven blocks ) provided that the block can be mathematically written as input - state - output functions over time . [ 5 ] described a translation scheme for deriving hybrid automata models from s / s models . however , no formal algorithms are provided . we presented formal algorithms for the translation . [ 3 , 6 , 13 ] describes a technique for translating discrete - time simulink diagrams into lustre programs . lustre is a synchronous language and the translation is a mapping between elements of simulink diagrams ( for example , signals and atomic blocks ) and lustre programs ( for example , flows and operators / nodes ). the execution sequence of simulink blocks in the lustre programs is determined by lustre compiler . also only the discrete - time blocks are translated . in our approach , the execution sequence of simulink blocks is directly captured in the i / o - efa models . also , our approach supports virtually all time - driven blocks in simulink library . [ 7 ] mentioned a translation of s / s diagrams into the language of “ sal [ 1 ] for the purposes of test generation . however , the details of the translation were not given . [ 8 ] reported translation of simulink diagrams to a model of concurrent processes communicating with fifo queues or registers , called spi model , in contrast to i / o - efa model in our approach . there has also been work on code - generation for simulink diagrams [ 12 , 11 ]. one emphasis is in intellectual property reuse ( i . e ., code reuse for a group of atomic blocks ) and so their approach is modular . in contrast we focus on formal modeling of simulink diagrams with the goal of providing models that are readily amenable for further analysis ( verification , test - generation , etc .). we presented a recursive approach for translating a class of simulink diagrams as input / output - extended finite automata ( i / o - efa ), which is amenable to automated test generation or verification . we treat the blocks in the simulink library to be “ atomic ” and formulate two rules used in simulink for building complex blocks by combining the simpler ones . we provided a recursive and formal definition for the class of simulink diagrams formed using these rules . we presented algorithms for ( i ) translating an atomic - block as an i / o - efa , ( ii ) combining the i / o - efa models of simpler simulink diagrams to build the i / o - efa model of a more complex simulink diagram , constructed using certain rules of composition . we introduced the concept of a step ( resp ., step - trajectory ) of an i / o - efa to emulate the computation of a simulink diagram at a sample time ( resp ., over a sequence of sample times ). we showed that the translating approach is sound and complete : the input - output behavior of an i / o - efa model , as defined in terms of a step - trajectory preserves the input - output behavior of the corresponding simulink diagram at each sample time ( assuming the same integration method for any of the continuous blocks with dynamics ). finally , the translation approach has no specific restriction on the types of simulink blocks or the structure of simulink diagrams supported and can handle multirate simulink diagrams , sample times with initial offsets and variable - step simulation etc . although various embodiments have been shown and described in detail , the present invention is not to be limited to the specific embodiments shown as the present invention contemplates numerous variations , options , and alternatives in its implementation as may be appropriate in various situations . for example , the present invention contemplates that different types of diagrams may be used . the methodology may be implemented in various types of computing devices using any number of types of software to provide instruction sets for performing the logic of the methodologies described herein . sal homepage . http :// sal . csl . sri . com /. [ 2 ] simulink . http :// www . mathworks . com / products / simulink /. [ 3 ] p . caspi , a . curic , a . maignan , c . sofronis , and s . tripakis . translating discrete - time simulink to lustre . lecture notes in computer science , 2855 : 84 - 99 , 2003 . [ 4 ] a . agrawal , g . simon , and g . karsai . semantic translation of simulink / stateflow models to hybrid automata using graph transformations . electronic notes in theoretical computer science , 109 : 43 - 56 , december 2004 . [ 5 ] r . alur , a . kanade , s . ramesh , and k . c . shashidhar . symbolic analysis for improving simulation coverage of simulink / stateflow models . in emsoft &# 39 ; 08 : proceedings of the 7 th acm international conference on embedded software , pages 89 - 98 , new york , n . y ., usa , 2008 . acm . [ 6 ] p . caspi , a . curic , a . maignan , c . sofronis , s . tripakis , and p . niebert . from simulink to scade / lustre to tta : a layered approach for distributed embedded applications . sigplan not ., 38 ( 7 ): 153 - 162 , 2003 . [ 7 ] a . gadkari , s . mohalik , k . c . shashidhar , j . suresh a yeolekar , and s . ramesh . automatic generation of test cases using model checking for sl / sf models . workshop on model - driven engineering , verification , and validation , 2007 . [ 8 ] m . jersak , d . ziegenbein , f . wolf , k . richter , r . ernst , f . cieslog , j . teich , k . strehl , and l . thiele . embedded system design using the spi workbench . in proc . of the 3 rd international forum on design languages , 2000 . [ 9 ] r . kumar , c . zhou , and s . basu . finite bisimulation of reactive untimed infinite state systems modeled as automata with variables . in proceedings of the 25 th american control conference , pages 6057 - 6062 , minneapolis , minn ., june 2006 . [ 10 ] d . lee and m . yannakakis . principles and methods of testing finite state machines — a survey . proceedings of the ieee , 84 ( 8 ): 1090 - 1123 , 1996 . [ 11 ] r . lublinerman , c . szegedy , and s . tripakis . modular code generation from synchronous block diagrams — modularity vs . code size . in popl &# 39 ; 09 , 2009 . [ 12 ] r . lublinerman and s . tripakis . modular code generation from triggered and timed block diagrams . in real - time and embedded technology and applications symposium ( rtas &# 39 ; 08 ), 2008 . [ 13 ] n . scaife , c . sofronis , p . caspi , s . tripakis , and f . maraninchi . defining and translating a “ safe ” subset of simulink / stateflow into lustre . in proc . emsoft &# 39 ; 04 , 2004 . [ 14 ] t . takenaka , k . okano , t . higashino , and k . taniguchi . symbolic model checking of extended finite state machines with linear constraints over integer variables . syst . comput . japan , 37 ( 6 ): 64 - 72 , 2006 . [ 15 ] c . zhou and r . kumar . on identification of input / output extended automata with finite bisimilar quotients . in 2009 american control conference , st . louis , mo ., june 2009 .