Formal semantics for hierarchical Simulink diagrams in Isabelle/HOL

Abstract

Simulink is widely used in the design of safety-critical embedded systems, including avionics and automotive applications. While it offers simulation for model validation, formal verification remains essential to rigorously ensure system correctness. Existing approaches often translate Simulink diagrams into third-party formal models, however, the lack of a rigorously defined semantics for Simulink can lead to inconsistencies between the original diagrams and their translated formal counterparts. In this paper, we present a formal semantic foundation for a core subset of Simulink by defining both denotational and operational semantics. The denotational semantics offers a mathematical interpretation of the diagram’s input–output behavior, faithfully capturing its hierarchical structure. In contrast, the operational semantics specifies the concrete execution of Simulink diagrams, resolving block execution order, solving continuous dynamics, and coordinating hybrid discrete-continuous interactions. Both semantics have been fully formalized in Isabelle/HOL, and we have established their consistency by proving the existence and uniqueness of the timed state trajectories defined by the denotational semantics. Furthermore, to facilitate application, we developed a translator that automatically converts Simulink graphical diagrams into their Isabelle representation. Our formal semantics supports the rigorous analysis of Simulink diagram properties, as demonstrated through a PID control example. The semantics also establishes a foundation for validating simulation results and ensuring consistency between Simulink models and other formal models, thus enabling sound verification.