Discrete, Continuous and Hybrid-System Models

Introduction

A cyber-physical system (CPS) combines computation, communication, sensing, and actuation with physical processes. Its behavior is therefore expressed at several levels. A controller may execute software instructions at discrete instants, while a motor speed, temperature, pressure, or position changes continuously over time. Communication networks introduce events, delays, concurrency, and possible loss of coordination. A useful CPS model must represent these different forms of behavior without unnecessary detail.

This chapter develops the principal modeling abstractions used in CPS engineering: finite-state machines, discrete-event systems, continuous-time models, hybrid automata, concurrency, composition, and abstraction. These models support requirements analysis, simulation, verification, control design, fault analysis, and implementation planning.

A model is not the system itself. It is a deliberate simplification designed for a purpose. A model used to verify safety may preserve states and transitions but ignore numerical dynamics. A model used to tune a controller must preserve physical equations and timing. Sound CPS engineering depends on choosing an abstraction that is sufficiently accurate for the question being asked.

Learning Objectives

After studying this chapter, the reader should be able to:

1. Distinguish discrete, continuous, and hybrid system behavior.
2. Construct and interpret finite-state machines and labeled transition systems.
3. Explain discrete-event systems, guards, events, and supervisory control concepts.
4. Formulate basic continuous-time models using differential equations and state-space notation.
5. Describe hybrid automata using locations, flows, invariants, guards, and resets.
6. Analyze concurrency and explain why interleavings can create nondeterminism.
7. Compose component models and identify interface, synchronization, and deadlock issues.
8. Apply abstraction and refinement while preserving properties of interest.
9. Select appropriate models for practical mechatronic CPS applications.

1. Modeling Behavior in CPS

A system state is the information required to determine the possible future behavior of a model. It may include a physical variable, such as position, and logical variables, such as whether a valve is open. The state can be represented by a vector [[M:x]], a discrete symbol, or a combination of both.

A general state-transition model can be written as:

Here, [[M:x]] is the current state, [[M:u]] is a control input, [[M:w]] represents disturbances, [[M:y]] is the output, and [[M:v]] represents measurement noise. The functions [[M:f]] and [[M:g]] define state evolution and output generation. In a purely discrete model, the prime often means the next logical state. In a continuous model, it may denote a derivative, depending on notation; this distinction must always be stated.

The main modeling dimensions are:

A model should identify its system boundary, inputs, outputs, assumptions, and required fidelity. For example, a conveyor controller can be modeled as a three-state machine for startup logic, but a motor drive requires a continuous or hybrid model if speed and torque are relevant.

2. Finite-State Machines

A finite-state machine (FSM) represents behavior using a finite set of states and transitions. A labeled FSM can be specified by the tuple:

where [[M:Q]] is a finite set of states, [[M:Σ]] is an event or input alphabet, [[M:δ]] is the transition function, [[M:q₀]] is the initial state, and [[M:F]] is a set of accepting or terminal states when acceptance is relevant. For a deterministic FSM, [[M:δ(q, a)]] produces at most one next state for state [[M:q]] and input [[M:a]]. If several next states are possible, the machine is nondeterministic.

A transition is commonly written as:

The event triggers evaluation of the transition. A condition, or guard, must be true. The action may update outputs or variables. For example, a door controller may contain:

• Closed → Opening when an open command is received.
• Opening → Open when the position sensor reaches its limit.
• Open → Closing after a timer expires.
• Closing → Opening if an obstruction is detected.
• Closing → Closed when the closed-limit sensor is active.

The transition from Closing to Opening is particularly important because it encodes a safety response rather than merely normal operation.

Determinism and nondeterminism

A deterministic machine has one defined successor for each state and relevant input. Nondeterminism means that the model permits several possible successors. It can represent incomplete knowledge, an uncontrolled choice, or several possible implementation behaviors. Nondeterminism is not automatically an error; it becomes a concern when a safety property fails for one permitted behavior.

Mealy and Moore machines

In a Mealy machine, outputs depend on the current state and input. In a Moore machine, outputs depend primarily on the current state. Mealy models can respond immediately to an input but may produce transient output changes. Moore models often have simpler output reasoning but may require additional states. The choice depends on timing, implementation, and verification requirements.

FSM limitations

FSMs are effective for control modes, protocols, and operating procedures. They become unwieldy when many variables are represented explicitly. If a system has [[M:n]] independent Boolean conditions, a direct enumeration may require up to [[M:2^n]] logical combinations. This state-explosion problem motivates symbolic representations, hierarchical state machines, and abstraction.

3. Discrete-Event Systems

A discrete-event system (DES) changes state when events occur. Time between events may be irrelevant, variable, or determined by an external process. Examples include a robot receiving a work order, a network packet arriving, a safety interlock opening, or a production station completing a cycle.

A labeled transition system can be represented as:

where [[M:X]] is the set of states, [[M:E]] is the event set, [[M:f]] is the (possibly partial) transition function, and [[M:x₀]] is the initial state. The function is partial because an event may not be enabled in every state.

Events are often classified as:

• Controllable events: a supervisor can enable or disable them, such as starting a motor.
• Uncontrollable events: the system cannot prevent them, such as an emergency-stop signal or component failure.
• Observable events: the controller can detect them.
• Unobservable events: they occur internally or are hidden by the interface.

A controller should not attempt to disable an uncontrollable unsafe event; instead, it should prevent the system from reaching conditions in which that event causes unacceptable consequences.

Guards and enabling

A transition is enabled when its event occurs and its guard is true. If a transition has guard [[M:g(x)]], then it may fire only when:

Guards should be mutually exclusive when deterministic behavior is required. If two enabled transitions can fire, the model must specify priority, arbitration, or permitted nondeterminism.

Safety and liveness

A safety property states that something bad never happens, such as “the gripper never closes while a person is detected.” A liveness property states that something good eventually happens, such as “every accepted work order eventually reaches completion.” Safety violations can often be identified by reachable-state analysis; liveness analysis usually requires reasoning about cycles, fairness, timing, or progress assumptions.

4. Continuous-Time Models

Physical processes are naturally modeled with continuous variables and time. A general nonlinear state-space model is:

The vector [[M:x(t)]] is the state, [[M:u(t)]] is the input, [[M:y(t)]] is the output, [[M:f]] is the state derivative function, and [[M:h]] is the output function. The dot denotes differentiation with respect to time. The equations apply when the physical variables are sufficiently well represented by continuous functions and the model assumptions remain valid.

For a linear time-invariant system:

Matrices [[M:A]], [[M:B]], [[M:C]], and [[M:D]] describe system dynamics, input influence, output measurement, and direct feed-through. Their dimensions must be compatible. For example, if [[M:x]] has dimension [[M:n]] and [[M:u]] has dimension [[M:m]], then [[M:A]] is [[M:n×n]] and [[M:B]] is [[M:n×m]].

Worked example: a first-order thermal model

Consider a heated chamber with temperature [[M:T(t)]] in °C. A simplified energy balance is:

Here, [[M:Cₜ]] is thermal capacitance in J/°C, [[M:P(t)]] is heater power in W (J/s), [[M:K]] is thermal conductance in W/°C, and [[M:Tₐ]] is ambient temperature in °C. The equation assumes lumped temperature, constant parameters, and negligible delay in heat transfer.

At steady state, [[M:dT/dt = 0]]. Therefore:

If [[M:Tₐ = 20 °C]], [[M:P = 100 W]], and [[M:K = 2 W/°C]], then:

The units are consistent because W divided by W/°C gives °C. This model does not describe switching, saturation, or heater failure; those features require additional discrete logic or a hybrid model.

5. Hybrid Systems and Hybrid Automata

A hybrid system combines discrete modes with continuous evolution. A hybrid automaton can be described by:

where [[M:Q]] is a set of discrete locations, [[M:X]] is the continuous state space, [[M:Init]] defines initial states, [[M:Inv]] gives invariants for each location, [[M:E]] is the set of discrete edges, [[M:G]] gives edge guards, [[M:R]] gives reset maps, and [[M:Flow]] defines continuous dynamics in each location.

In a location [[M:q]], the continuous state follows:

while remaining within the invariant [[M:Inv(q)]]. A transition from [[M:q]] to [[M:q']] may occur when its guard is true. The reset map changes the state according to:

The superscripts minus and plus denote values immediately before and after the transition.

Example: thermostat

A thermostat has two locations: Heating and Off. Let [[M:T]] be temperature.

• In Heating, the heater supplies power and temperature follows the thermal equation.
• In Off, heater power is zero.
• Heating → Off when [[M:T ≥ T_high]]
• Off → Heating when [[M:T ≤ T_low]]

If [[M:T_low < T_high]], the separation creates hysteresis and reduces rapid switching near the target. A model without hysteresis may switch repeatedly because of sensor noise or numerical error.

The thermostat demonstrates why neither an FSM nor a continuous model alone is sufficient. The FSM captures mode logic, while the differential equation captures temperature evolution.

Hybrid-system concerns

Hybrid models introduce issues not present in either component alone:

• Zeno behavior: infinitely many discrete transitions occur in a finite time interval.
• Boundary ambiguity: a guard and invariant may become true simultaneously, creating several possible transitions.
• Reset discontinuity: physical variables may jump because of impacts, quantization, or switching approximations.
• Numerical sensitivity: simulation results can depend on step size and event-detection accuracy.

Engineers should state whether transitions are urgent, whether guards are closed or open, and how simultaneous events are prioritized.

6. Concurrency and Interaction

CPS components operate concurrently. A sensor task, control task, communication stack, and actuator may each have its own execution schedule. Concurrent behavior is not necessarily parallel hardware; it may also arise from interleaved execution on one processor.

If component A can perform events [[M:a₁]] and [[M:a₂]], while component B can perform [[M:b₁]] and [[M:b₂]], an interleaving model represents global executions as sequences that preserve the internal order of each component. For example, [[M:a₁ b₁ a₂ b₂]] and [[M:b₁ a₁ b₂ a₂]] may both be possible.

Concurrency creates three important concerns:

1. Race conditions: the result depends on event order.
2. Deadlock: components wait indefinitely for one another.
3. Starvation: one component is repeatedly denied access or service.

A shared resource should be protected by a mutual-exclusion mechanism, such as a lock or atomic transaction. However, locks must be designed carefully because circular waiting can produce deadlock. Timeouts, fixed resource ordering, and supervisory recovery are common mitigations.

Synchronization models

Components may synchronize by:

• shared variables;
• rendezvous, where both parties must participate;
• message passing through buffers;
• broadcast events;
• timed communication with explicit delays.

The selected model affects determinism and verification. An unbounded message buffer can make the state space infinite, whereas a bounded buffer permits finite-state analysis but may introduce overflow behavior that must be modeled.

7. Composition of Models

Composition constructs a system model from component models. If two components share events, composition may require synchronization. If their events are independent, they may proceed asynchronously.

For synchronous product, a global state is a pair [[M:(q₁, q₂)]]. A shared event may occur only when both components enable it. An independent event changes one component while the other remains unchanged. Formally, if component 1 can perform event [[M:e]] and component 2 does not participate, the global transition may be:

If both synchronize on [[M:e]], then:

Composition is useful because it exposes emergent behavior. Two individually safe components may deadlock when their assumptions are incompatible. For example, a robot controller may wait for a conveyor-ready signal while the conveyor controller waits for a robot-clear signal.

Interface contracts

An interface contract specifies assumptions and guarantees. A component may assume that an input arrives within a stated interval and guarantee that an output is produced within a deadline. Contracts make composition more systematic and reveal incompatible timing or data assumptions before implementation.

8. Abstraction and Refinement

Abstraction removes detail while preserving selected properties. A high-level model may represent a motor as states Stopped and Running, while a detailed model includes current, torque, speed, friction, saturation, and sensor dynamics.

Useful abstraction techniques include:

• State aggregation: combine states with equivalent behavior for the property being checked.
• Variable abstraction: retain ranges rather than exact values.
• Time abstraction: omit exact delays when only event order matters.
• Data abstraction: replace numerical values with categories such as Low, Normal, and High.
• Hierarchy: represent a subsystem by a mode at one level and expand it at another.

An abstraction is sound for a verification task if every behavior of the detailed system is represented appropriately by the abstract system. Over-approximation may introduce behaviors that cannot occur physically, but if the abstract model is proven safe, the detailed model is generally safe with respect to the modeled property. The converse is not necessarily true: an abstract model may report a false alarm.

Refinement adds detail while preserving required behavior. A refined controller should maintain the safety and interface properties promised by its abstract specification. Trace inclusion, simulation relations, and bisimulation are common formal relationships, although the appropriate relation depends on the property and model class.

9. Illustrative Case: Autonomous Conveyor–Robot Cell

Background

Consider an illustrative packaging cell containing an infeed conveyor, a six-axis robot, a gripper, a barcode reader, and a safety scanner. The cell must place accepted packages into cartons while preventing motion when a person enters the guarded area.

Problem

The system combines physical motion, discrete control, communication, and safety logic. A purely continuous model cannot express authorization states clearly, while a purely discrete model cannot predict whether the robot reaches a target before a deadline or whether motor speed exceeds a limit.

Analysis

The cell is modeled at three levels:

1. FSM for operating mode: Idle, Homing, Ready, Picking, Placing, Fault, and EmergencyStop.
2. DES for events: barcode-ready, pick-complete, place-complete, scanner-clear, scanner-blocked, and timeout.
3. Hybrid model for motion: robot position and velocity evolve continuously within motion modes; limits and collision zones act as guards and invariants.

The safety invariant is that commanded robot motion is permitted only when the scanner is clear and the emergency-stop circuit is healthy. A simplified condition is:

The expression is a logical safety condition, not a complete safety certification. Actual machinery must use appropriate safety-rated hardware, diagnostic coverage, validated risk reduction, and applicable regulations.

Approach and solution

The robot and conveyor controllers are composed through a handshake protocol:

1. The conveyor sends PackageReady.
2. The robot acknowledges and requests ConveyorStop.
3. The conveyor confirms Stopped.
4. The robot performs the pick and sends PickComplete.
5. The conveyor resumes only after the robot sends Clear.

A timeout transition sends the cell to Fault if an expected acknowledgment does not arrive. The safety scanner is modeled as an uncontrollable event source. If ScannerBlocked occurs, the system enters a safe state regardless of the current production phase.

Continuous simulation is used to check stopping distance and timing. If the robot speed is [[M:v]] and the total detection, communication, and braking delay is [[M:t_d]], a simplified delay distance is:

where [[M:d_d]] is in metres when [[M:v]] is in metres per second and [[M:t_d]] is in seconds. This is only the distance traveled during delay; a complete stopping analysis must include braking dynamics, deceleration limits, mechanical tolerances, and safety margins.

Outcome

The combined model exposes an interface error: the conveyor originally interpreted ConveyorStop as an immediate physical stop, while the robot assumed that the acknowledgment meant zero speed. The refined protocol distinguishes StopCommand from ConveyorAtRest. This prevents the robot from entering the pick region while the conveyor is still moving.

Learning points

• Different questions require different model types.
• Safety events must not be treated as ordinary controllable commands.
• Interface semantics must distinguish a request, an acknowledgment, and a verified physical condition.
• Hybrid simulation complements, but does not replace, formal logic and physical safety validation.

10. Verification, Simulation, and Implementation

Model checking explores reachable states and evaluates properties such as invariant safety conditions. Simulation generates representative trajectories and is especially valuable for continuous dynamics, controller tuning, and performance estimation. Testing executes the implemented system and reveals hardware, timing, integration, and environmental faults.

These methods are complementary:

A practical workflow is to define requirements, identify variables and events, build a minimal model, validate assumptions, analyze safety and liveness, refine important dynamics, and compare model predictions with measurements. Requirements should be traceable to model elements and test cases.

Model time carefully. A controller that samples every [[M:T_s]] seconds is discrete-time even when it controls a continuous plant. A simple discretization of the linear model using forward Euler is:

Here, [[M:T_s]] is the sampling period in seconds. This approximation assumes sufficiently small sampling intervals and appropriate numerical stability. It should not be used without checking discretization error and closed-loop stability.

11. Limitations, Governance, and Professional Practice

Models contain assumptions. Sensors may be idealized, communication delays may be fixed, and physical parameters may be treated as constant. If these assumptions are not documented, a mathematically correct analysis may still support an unsafe engineering decision.

Important professional practices include:

• document state variables, units, initial conditions, and boundaries;
• distinguish measured, estimated, commanded, and physically verified quantities;
• model faults, delays, packet loss, saturation, and sensor uncertainty when relevant;
• identify which events are controllable and which are not;
• preserve safety constraints during abstraction and refinement;
• validate models against experiments and historical faults;
• maintain version control and traceability from requirements to models and tests;
• use independent review for safety-critical logic.

CPS models also have governance implications. A model that controls access, medical equipment, industrial machinery, or autonomous motion may affect human safety and privacy. Data used for learning-based components should be governed for provenance, security, bias, and appropriate use. Artificial intelligence can assist with anomaly detection or model discovery, but learned behavior must be bounded by explicit safety constraints, monitored in operation, and validated under conditions not present in training data.

12. Contemporary Developments

Modern CPS engineering increasingly uses model-based systems engineering, digital twins, formal runtime monitoring, and co-simulation. A digital twin may combine a physical asset, real-time data, a dynamic model, and a historical record. Its usefulness depends on synchronization quality and model validity; it is not automatically a faithful replica.

Timed automata extend discrete models with clocks and timing constraints. Probabilistic models represent uncertain transitions or failure rates. Stochastic hybrid systems combine continuous dynamics with random events. These extensions are valuable for networked control, predictive maintenance, autonomous vehicles, and resilient infrastructure, but they require additional assumptions and computational methods.

Chapter Summary

Discrete models represent logical states and event-driven changes. Finite-state machines are suitable for modes, protocols, and operating procedures, while discrete-event systems emphasize event enabling, controllability, observability, safety, and liveness. Continuous-time models represent physical evolution through differential equations and state-space equations. Hybrid automata combine discrete locations with continuous flows, invariants, guards, and reset maps.

CPS components execute concurrently and interact through shared variables, messages, synchronization, and timed interfaces. Composition can reveal deadlock, race conditions, and incompatible assumptions that are invisible in isolated models. Abstraction reduces complexity, but it must preserve the properties being analyzed; refinement adds implementation detail while maintaining contractual behavior. In practice, simulation, model checking, testing, and formal reasoning should be combined. The model selected must match the engineering question, and assumptions must be documented, validated, and connected to safety and governance responsibilities.

Key Terms

Finite-state machine: A model with a finite set of states and transitions.

State: Information sufficient to characterize a model’s current condition.

Transition: A change from one state or mode to another.

Event: An occurrence that may trigger a discrete transition.

Guard: A condition that must be true for a transition to occur.

Action: An operation associated with a transition.

Discrete-event system: A system whose state changes in response to discrete events.

Controllable event: An event a supervisor can enable or disable.

Uncontrollable event: An event the supervisor cannot prevent.

Observable event: An event detectable by the controller.

Safety property: A property stating that an undesirable condition never occurs.

Liveness property: A property stating that a desired progress condition eventually occurs.

Continuous-time model: A model whose variables evolve over a continuous time domain.

State-space model: A model expressed through state and output equations.

Hybrid system: A system combining discrete and continuous behavior.

Invariant: A condition that must remain true during continuous evolution or operation.

Reset map: A rule specifying how continuous variables change at a discrete transition.

Concurrency: The execution of multiple interacting activities whose ordering may vary.

Composition: Construction of a system model from interacting component models.

Abstraction: Removal of detail while preserving selected behavior or properties.

Review Questions

Short Answer Questions

1. What distinguishes a finite-state machine from a continuous-time model?
2. Define a guard and explain its role in a transition.
3. What is the difference between a safety property and a liveness property?
4. Name the principal elements of a hybrid automaton.
5. Why can composition reveal deadlock even when individual components appear correct?

Long Answer Questions

1. Explain deterministic and nondeterministic finite-state machines, including a CPS example in which nondeterminism is useful.
2. Compare simulation, model checking, and testing as methods for analyzing CPS behavior.
3. Derive and interpret the first-order thermal model used in this chapter, including its assumptions and units.
4. Explain concurrency, race conditions, deadlock, and starvation in a networked mechatronic system.
5. Discuss how abstraction and refinement should be used when verifying a safety-critical CPS.

Analytical / Application Questions

1. Design a hybrid automaton for a battery charger with Charging, Complete, and Fault locations. Define at least two continuous variables, guards, invariants, and reset behavior.
2. A robot controller waits for a conveyor acknowledgment, while the conveyor waits for a RobotClear message. Model the interaction and propose a protocol change that prevents deadlock.
3. For a moving machine with speed 1.5 m/s and a total detection and braking delay of 0.4 s, calculate the distance traveled during the delay using [[M:d_d = vt_d]]. Explain why this is not by itself a complete stopping-distance calculation.

Multiple Choice Questions with Answers

Question 1

Which model is most directly suited to representing Idle, Running, and Fault controller modes?

A. Finite-state machine

B. Continuous differential equation only

C. Unbounded numerical optimization model

D. Static wiring diagram

Correct Answer: A. Finite-state machine

Question 2

In a discrete-event system, what is a guard?

A. A physical enclosure around an actuator

B. A condition that must be true for a transition to occur

C. A signal that is always uncontrollable

D. A numerical integration method

Correct Answer: B. A condition that must be true for a transition to occur

Question 3

Which item is a component of a hybrid automaton?

A. Only a truth table

B. Only a transfer function

C. A continuous flow associated with a discrete location

D. A database schema

Correct Answer: C. A continuous flow associated with a discrete location

Question 4

A safety property generally states that:

A. A desired event occurs at least once

B. An undesirable condition never occurs

C. Every component operates at maximum speed

D. All events are controllable

Correct Answer: B. An undesirable condition never occurs

Question 5

What is a likely consequence of two concurrent tasks accessing shared data without appropriate coordination?

A. Race condition

B. Guaranteed determinism

C. Automatic fault tolerance

D. Removal of all timing constraints

Correct Answer: A. Race condition

Question 6

If a system has three independent Boolean conditions and explicitly enumerates every combination, how many combinations are possible?

A. 3

B. 6

C. 8

D. 9

Correct Answer: C. 8

Question 7

For [[M:v = 1.5 m/s]] and [[M:t_d = 0.4 s]], what is the delay distance [[M:d_d = vt_d]]?

A. 0.375 m

B. 0.6 m

C. 1.9 m

D. 3.75 m

Correct Answer: B. 0.6 m

Question 8

In the thermal model [[M:Tₛₛ = Tₐ + P/K]], what happens to the steady-state temperature rise if heater power P is doubled while K remains constant?

A. It is halved

B. It remains unchanged

C. It doubles

D. It becomes zero

Correct Answer: C. It doubles

Question 9

Which event is normally uncontrollable by a production supervisor?

A. A commanded motor start

B. A software request to open a valve

C. An emergency-stop signal generated by a safety circuit

D. A scheduled production command

Correct Answer: C. An emergency-stop signal generated by a safety circuit

Question 10

What is the principal purpose of abstraction in CPS modeling?

A. To remove all safety requirements

B. To add irrelevant implementation detail

C. To reduce complexity while preserving selected properties

D. To guarantee that physical parameters are exact

Correct Answer: C. To reduce complexity while preserving selected properties