SLIDE 1 Robustness issues in timed models
Nicolas Markey
LSV, CNRS & ENS Cachan, France
(based on joint works with Patricia Bouyer, Erwin Fang, Pierre-Alain Reynier, Ocan Sankur) (also starring Martin De Wulf, Laurent Doyen, Jean-Fran¸ cois Raskin)
QAPL’14 – Grenoble, France
SLIDE 2
Modelling real-time systems
SLIDE 3 Modelling real-time systems
H
s h
l d w e m
e l r e a l
i m e c
s t r a i n t s ?
SLIDE 4 Reasoning about real-time systems
Example (A computer mouse)
idle left right
left button? right button? left click! left button? left double click! right click! right button? right double click!
SLIDE 5 Reasoning about real-time systems
Timed automata [AD90]
A timed automaton is made of a transition system,
Example (A computer mouse)
idle left right
left button? right button? left click! left button? left double click! right click! right button? right double click!
SLIDE 6 Reasoning about real-time systems
Timed automata [AD90]
A timed automaton is made of a transition system, a set of clocks,
Example (A computer mouse)
idle left right
left button? right button? left click! left button? left double click! right click! right button? right double click! x
SLIDE 7 Reasoning about real-time systems
Timed automata [AD90]
A timed automaton is made of a transition system, a set of clocks, timing constraints on states and transitions.
Example (A computer mouse)
idle left
x≤300
right
x≤300
left button? x := 0 right button? x := 0 x = 300 left click! x ≤ 300 left button? left double click! x = 300 right click! x ≤ 300 right button? right double click! x
SLIDE 8
Discrete-time semantics
...because computers are digital!
SLIDE 9 Discrete-time semantics
...because computers are digital!
Example ([Alur91])
i
NOT
[1,2]
NOT
[1,2]
NOT
[1,2]
XOR
[1]
XOR
[1]
XOR
[1]
[1]
OR
[1]
- 8
- under discrete-time, the output never changes:
t
SLIDE 10 Discrete-time semantics
...because computers are digital!
Example ([Alur91])
i
NOT
[1,2]
NOT
[1,2]
NOT
[1,2]
XOR
[1]
XOR
[1]
XOR
[1]
[1]
OR
[1]
- 8
- under discrete-time, the output never changes:
t
SLIDE 11 Discrete-time semantics
...because computers are digital!
Example ([Alur91])
i
NOT
[1,2]
NOT
[1,2]
NOT
[1,2]
XOR
[1]
XOR
[1]
XOR
[1]
[1]
OR
[1]
- 8
- under discrete-time, the output never changes:
t i
SLIDE 12 Discrete-time semantics
...because computers are digital!
Example ([Alur91])
i
NOT
[1,2]
NOT
[1,2]
NOT
[1,2]
XOR
[1]
XOR
[1]
XOR
[1]
[1]
OR
[1]
- 8
- under discrete-time, the output never changes:
t i
SLIDE 13 Discrete-time semantics
...because computers are digital!
Example ([Alur91])
i
NOT
[1,2]
NOT
[1,2]
NOT
[1,2]
XOR
[1]
XOR
[1]
XOR
[1]
[1]
OR
[1]
- 8
- under discrete-time, the output never changes:
t i
SLIDE 14 Discrete-time semantics
...because computers are digital!
Example ([Alur91])
i
NOT
[1,2]
NOT
[1,2]
NOT
[1,2]
XOR
[1]
XOR
[1]
XOR
[1]
[1]
OR
[1]
- 8
- under discrete-time, the output never changes:
t i
SLIDE 15 Discrete-time semantics
...because computers are digital!
Example ([Alur91])
i
NOT
[1,2]
NOT
[1,2]
NOT
[1,2]
XOR
[1]
XOR
[1]
XOR
[1]
[1]
OR
[1]
- 8
- under continuous-time, the output can change to 1:
t i
SLIDE 16
Continuous-time semantics
...real-time models for real-time systems!
SLIDE 17 Continuous-time semantics
...real-time models for real-time systems!
Example
x=1 y:=0 x≤2, x:=0 y≥2, y:=0 x=0 ∧ y≥2 y x 1 1 2 2
SLIDE 18 Continuous-time semantics
...real-time models for real-time systems!
Example
x=1 y:=0 x≤2, x:=0 y≥2, y:=0 x=0 ∧ y≥2 y x 1 1 2 2
SLIDE 19 Continuous-time semantics
...real-time models for real-time systems!
Example
x=1 y:=0 x≤2, x:=0 y≥2, y:=0 x=0 ∧ y≥2 y x 1 1 2 2
SLIDE 20 Continuous-time semantics
...real-time models for real-time systems!
Example
x=1 y:=0 x≤2, x:=0 y≥2, y:=0 x=0 ∧ y≥2 y x 1 1 2 2
SLIDE 21 Continuous-time semantics
...real-time models for real-time systems!
Example
x=1 y:=0 x≤2, x:=0 y≥2, y:=0 x=0 ∧ y≥2 y x 1 1 2 2
SLIDE 22 Continuous-time semantics
...real-time models for real-time systems!
Example
x=1 y:=0 x≤2, x:=0 y≥2, y:=0 x=0 ∧ y≥2 y x 1 1 2 2
SLIDE 23 Continuous-time semantics
...real-time models for real-time systems!
Example
x=1 y:=0 x≤2, x:=0 y≥2, y:=0 x=0 ∧ y≥2 y x 1 1 2 2
SLIDE 24 Continuous-time semantics
...real-time models for real-time systems!
Example
x=1 y:=0 x≤2, x:=0 y≥2, y:=0 x=0 ∧ y≥2 y x 1 1 2 2
SLIDE 25 Continuous-time semantics
...real-time models for real-time systems!
Example
x=1 y:=0 x≤2, x:=0 y≥2, y:=0 x=0 ∧ y≥2 y x 1 1 2 2
SLIDE 26 Continuous-time semantics
...real-time models for real-time systems!
Example
x=1 y:=0 x≤2, x:=0 y≥2, y:=0 x=0 ∧ y≥2 y x 1 1 2 2
SLIDE 27 Continuous-time semantics
...real-time models for real-time systems!
Example
x=1 y:=0 x≤2, x:=0 y≥2, y:=0 x=0 ∧ y≥2 y x 1 1 2 2
SLIDE 28 Continuous-time semantics
...real-time models for real-time systems!
Example
x=1 y:=0 x≤2, x:=0 y≥2, y:=0 x=0 ∧ y≥2 y x 1 1 2 2
Theorem ([AD90,ACD93, ...])
Reachability in timed automata is decidable (as well as many other important properties).
SLIDE 29 Regions and zones
x=1 y:=0 x≤2, x:=0 y≥2, y:=0 x=0 ∧ y≥2
SLIDE 30 Regions and zones
x=1 y:=0 x≤2, x:=0 y≥2, y:=0 x=0 ∧ y≥2
SLIDE 31 Regions and zones
Zones
Zones are a coarser abstraction: (x ≥ 2) ∧ (0 ≤ y ≤ 3) ∧ (x − y ≤ 4)
y x
SLIDE 32 Regions and zones
Zones
Zones are a coarser abstraction: (x ≥ 2) ∧ (0 ≤ y ≤ 3) ∧ (x − y ≤ 4)
y x
Representation as DBM:
x y
−2
x
+∞ 4
y
3 +∞ ≡
x y
−2
x
7 4
y
3 1
SLIDE 33 Regions and zones
Zones
ℓ1 ℓ2
x≥1 ∧ y≤2 y:=0
The predecessors of (ℓ2, x ≤ 3 ∧ y − x ≤ 0) are computed as = Pretime ∩ Unresety
SLIDE 34 Regions and zones
Zones
ℓ1 ℓ2
x≥1 ∧ y≤2 y:=0
The predecessors of (ℓ2, x ≤ 3 ∧ y − x ≤ 0) are computed as = Pretime ∩ Unresety efficient implementations
SLIDE 35 Regions and zones
Zones
ℓ1 ℓ2
x≥1 ∧ y≤2 y:=0
The predecessors of (ℓ2, x ≤ 3 ∧ y − x ≤ 0) are computed as = Pretime ∩ Unresety efficient implementations successful applications
SLIDE 36 Outline of the talk
1
Discrete time vs. dense time
2
From models to implementations
3
Checking robust safety Enlarging clock constraints Shrinking clock constraints
4
Checking robust controllability Parametrized perturbations Permissive strategies
5
Conclusions and future works
SLIDE 37 Outline of the talk
1
Discrete time vs. dense time
2
From models to implementations
3
Checking robust safety Enlarging clock constraints Shrinking clock constraints
4
Checking robust controllability Parametrized perturbations Permissive strategies
5
Conclusions and future works
SLIDE 38
From models to implementations
Example: Patriot anti-ballistic-missile failure
25 February 1991, during Gulf war. 28 soldiers died.
SLIDE 39 From models to implementations
Example: Patriot anti-ballistic-missile failure
25 February 1991, during Gulf war. 28 soldiers died.
Problem: clock drift
Internal clock incremented by 1/10 every 1/10 s.
x=0.1,x:=0 clock+=0.1
SLIDE 40 From models to implementations
Example: Patriot anti-ballistic-missile failure
25 February 1991, during Gulf war. 28 soldiers died.
Problem: clock drift
Internal clock incremented by 1/10 every 1/10 s. Clock stored in 24-bit register: 1 10 − 1 10
≃ 10−7
x=0.1,x:=0 clock+=0.1
After 100 hours, the total drift was 0.34 seconds. The incoming missile could not be destroyed.
SLIDE 41
From models to implementations
the continuous-time semantics is a mathematical idealization it assumes zero-delay transitions; it assumes infinite precision of the clocks; it assumes immediate communication between systems.
SLIDE 42 From models to implementations
the continuous-time semantics is a mathematical idealization it assumes zero-delay transitions; it assumes infinite precision of the clocks; it assumes immediate communication between systems.
Example (Zeno behaviors)
x<1 ∧ y<1 x:=0 y=1 y x 1 1
SLIDE 43 From models to implementations
the continuous-time semantics is a mathematical idealization it assumes zero-delay transitions; it assumes infinite precision of the clocks; it assumes immediate communication between systems.
Example (Converge phenomena)
x≤1 x≤1 x≤1 x=1 x:=0 y=1 z:=0 z>0 y:=0 y x 1 1
SLIDE 44 From models to implementations
the continuous-time semantics is a mathematical idealization it assumes zero-delay transitions; it assumes infinite precision of the clocks; it assumes immediate communication between systems.
Example (Strict timing constraints)
Pid
xid≤2 r:=0 r==0 xid:=0 r:=id xid:=0 r:=0 xid:=0 r=id xid>2
When P1 and P2 run in parallel (sharing variable r), the state where both of them are in is not reachable. This property is lost when xid > 2 is replaced with xid ≥ 2.
SLIDE 45
From models to implementations
the continuous-time semantics is a mathematical idealization it assumes zero-delay transitions; it assumes infinite precision of the clocks; it assumes immediate communication between systems.
Parametrized semantics
parametrized discrete-time semantics: Does there exists a time step δ (sampling rate) under which the system behaves correctly?
SLIDE 46 From models to implementations
the continuous-time semantics is a mathematical idealization it assumes zero-delay transitions; it assumes infinite precision of the clocks; it assumes immediate communication between systems.
Parametrized semantics
parametrized discrete-time semantics: Does there exists a time step δ (sampling rate) under which the system behaves correctly?
- reachability is undecidable [CHR02]
- untimed-language inclusion is decidable [AKY10]
SLIDE 47 From models to implementations
the continuous-time semantics is a mathematical idealization it assumes zero-delay transitions; it assumes infinite precision of the clocks; it assumes immediate communication between systems.
Parametrized semantics
parametrized discrete-time semantics: Does there exists a time step δ (sampling rate) under which the system behaves correctly?
- reachability is undecidable [CHR02]
- untimed-language inclusion is decidable [AKY10]
parametrized continuous-time semantics: Does the system behave correctly under continuous- time semantics with imprecisions up to some δ?
SLIDE 48 Outline of the talk
1
Discrete time vs. dense time
2
From models to implementations
3
Checking robust safety Enlarging clock constraints Shrinking clock constraints
4
Checking robust controllability Parametrized perturbations Permissive strategies
5
Conclusions and future works
SLIDE 49
Enlarged semantics for timed automata
a transition can be taken at any time in [t − δ; t + δ].
SLIDE 50 Enlarged semantics for timed automata
a transition can be taken at any time in [t − δ; t + δ].
Example
y x 1 1 2 2 3 3 x=1 y:=0 x≤2, x:=0 y≥2, y:=0 x=0 ∧ y≥2
SLIDE 51 Enlarged semantics for timed automata
a transition can be taken at any time in [t − δ; t + δ].
Example
y x 1 1 2 2 3 3 y x 1 1 2 2 3 3 x∈[1−δ,1+δ] y:=0 x≤2+δ, x:=0 y≥2−δ, y:=0 x≤δ ∧ y≥2−δ
SLIDE 52 Enlarged semantics for timed automata
a transition can be taken at any time in [t − δ; t + δ].
Example
y x 1 1 2 2 3 3 y x 1 1 2 2 3 3 x∈[1−δ,1+δ] y:=0 x≤2+δ, x:=0 y≥2−δ, y:=0 x≤δ ∧ y≥2−δ
SLIDE 53 Enlarged semantics for timed automata
a transition can be taken at any time in [t − δ; t + δ].
Example
y x 1 1 2 2 3 3 y x 1 1 2 2 3 3 x∈[1−δ,1+δ] y:=0 x≤2+δ, x:=0 y≥2−δ, y:=0 x≤δ ∧ y≥2−δ
SLIDE 54 Enlarged semantics for timed automata
a transition can be taken at any time in [t − δ; t + δ].
Example
y x 1 1 2 2 3 3 y x 1 1 2 2 3 3 x∈[1−δ,1+δ] y:=0 x≤2+δ, x:=0 y≥2−δ, y:=0 x≤δ ∧ y≥2−δ
SLIDE 55 Enlarged semantics for timed automata
a transition can be taken at any time in [t − δ; t + δ].
Example
y x 1 1 2 2 3 3 y x 1 1 2 2 3 3 x∈[1−δ,1+δ] y:=0 x≤2+δ, x:=0 y≥2−δ, y:=0 x≤δ ∧ y≥2−δ
SLIDE 56 Enlarged semantics for timed automata
a transition can be taken at any time in [t − δ; t + δ].
Example
y x 1 1 2 2 3 3 y x 1 1 2 2 3 3 x∈[1−δ,1+δ] y:=0 x≤2+δ, x:=0 y≥2−δ, y:=0 x≤δ ∧ y≥2−δ
SLIDE 57 Enlarged semantics for timed automata
a transition can be taken at any time in [t − δ; t + δ].
Example
y x 1 1 2 2 3 3 y x 1 1 2 2 3 3 x∈[1−δ,1+δ] y:=0 x≤2+δ, x:=0 y≥2−δ, y:=0 x≤δ ∧ y≥2−δ
SLIDE 58 Enlarged semantics for timed automata
a transition can be taken at any time in [t − δ; t + δ].
Example
y x 1 1 2 2 3 3 y x 1 1 2 2 3 3 x∈[1−δ,1+δ] y:=0 x≤2+δ, x:=0 y≥2−δ, y:=0 x≤δ ∧ y≥2−δ
SLIDE 59 Enlarged semantics for timed automata
a transition can be taken at any time in [t − δ; t + δ].
Example
y x 1 1 2 2 3 3 y x 1 1 2 2 3 3 x∈[1−δ,1+δ] y:=0 x≤2+δ, x:=0 y≥2−δ, y:=0 x≤δ ∧ y≥2−δ
SLIDE 60 Enlarged semantics for timed automata
a transition can be taken at any time in [t − δ; t + δ].
Example
y x 1 1 2 2 3 3 y x 1 1 2 2 3 3 x∈[1−δ,1+δ] y:=0 x≤2+δ, x:=0 y≥2−δ, y:=0 x≤δ ∧ y≥2−δ
SLIDE 61 Enlarged semantics for timed automata
a transition can be taken at any time in [t − δ; t + δ].
Example
y x 1 1 2 2 3 3 y x 1 1 2 2 3 3 x∈[1−δ,1+δ] y:=0 x≤2+δ, x:=0 y≥2−δ, y:=0 x≤δ ∧ y≥2−δ
SLIDE 62 Enlarged semantics for timed automata
a transition can be taken at any time in [t − δ; t + δ].
Example
y x 1 1 2 2 3 3 y x 1 1 2 2 3 3 x∈[1−δ,1+δ] y:=0 x≤2+δ, x:=0 y≥2−δ, y:=0 x≤δ ∧ y≥2−δ
SLIDE 63 Enlarged semantics for timed automata
a transition can be taken at any time in [t − δ; t + δ].
Example
y x 1 1 2 2 3 3 y x 1 1 2 2 3 3
Theorem ([Pur98,DDMR04])
Parametrized robust safety is decidable.
SLIDE 64 Extended region automaton
For any location ℓ and any two regions r and r′, if r ∩ r′ = ∅ and (ℓ, r′) belongs to an SCC of R(A), then we add a transition (ℓ, r)
γ
− → (ℓ, r′).
y x 1 1 2 2 3 3
SLIDE 65 Extended region automaton
For any location ℓ and any two regions r and r′, if r ∩ r′ = ∅ and (ℓ, r′) belongs to an SCC of R(A), then we add a transition (ℓ, r)
γ
− → (ℓ, r′).
y x 1 1 2 2 3 3
SLIDE 66 Extended region automaton
For any location ℓ and any two regions r and r′, if r ∩ r′ = ∅ and (ℓ, r′) belongs to an SCC of R(A), then we add a transition (ℓ, r)
γ
− → (ℓ, r′).
y x 1 1 2 2 3 3
SLIDE 67 Extended region automaton
For any location ℓ and any two regions r and r′, if r ∩ r′ = ∅ and (ℓ, r′) belongs to an SCC of R(A), then we add a transition (ℓ, r)
γ
− → (ℓ, r′). γ
y x 1 1 2 2 3 3
SLIDE 68 Extended region automaton
For any location ℓ and any two regions r and r′, if r ∩ r′ = ∅ and (ℓ, r′) belongs to an SCC of R(A), then we add a transition (ℓ, r)
γ
− → (ℓ, r′). γ
y x 1 1 2 2 3 3
SLIDE 69 Extended region automaton
For any location ℓ and any two regions r and r′, if r ∩ r′ = ∅ and (ℓ, r′) belongs to an SCC of R(A), then we add a transition (ℓ, r)
γ
− → (ℓ, r′). γ
y x 1 1 2 2 3 3
SLIDE 70
Shrinking timing constraints
Counteracting guard enlargement
Shrinking turns constraints [a, b] into [a + δ, b − δ]. In particular, punctual constraints become empty.
SLIDE 71
Shrinking timing constraints
Counteracting guard enlargement
Shrinking turns constraints [a, b] into [a + δ, b − δ]. In particular, punctual constraints become empty.
Definition
A timed automaton is shrinkable if, for some δ > 0, its shrunk automaton (time-abstract) simulates the original automaton.
Theorem ([SBM11])
Shrinkability is decidable in EXPTIME.
SLIDE 72
Shrinking timing constraints
Counteracting guard enlargement
Shrinking turns constraints [a, b] into [a + δ, b − δ]. In particular, punctual constraints become empty.
Definition
A timed automaton is shrinkable if, for some δ > 0, its shrunk automaton (time-abstract) simulates the original automaton.
Theorem ([SBM11])
Shrinkability is decidable in EXPTIME. Main tools: parametrized shrunk DBMs max-plus fixpoint equations
SLIDE 73
Shrinking timing constraints
Counteracting guard enlargement
Shrinking turns constraints [a, b] into [a + δ, b − δ]. In particular, punctual constraints become empty.
Definition
A timed automaton is shrinkable if, for some δ > 0, its shrunk automaton (time-abstract) simulates the original automaton.
Theorem ([SBM11])
Shrinkability is decidable in EXPTIME. prototype tool: http://www.lsv.ens-cachan.fr/Software/shrinktech/
SLIDE 74 Shrinking timing constraints
Example
x≤2−k5δ y:=0 2−k1δ≤x≤4−k2δ 2−k3δ≤y≤4−k4δ
SLIDE 75 Shrinking timing constraints
Example
x≤2−k5δ y:=0 2−k1δ≤x≤4−k2δ 2−k3δ≤y≤4−k4δ k5δ
⊆ Unresety Pretime
k3δ k4δ k1δ k2δ
SLIDE 76 Shrinking timing constraints
Example
x≤2−k5δ y:=0 2−k1δ≤x≤4−k2δ 2−k3δ≤y≤4−k4δ k5δ
⊆ Unresety
(k2+k3)δ
SLIDE 77 Shrinking timing constraints
Example
x≤2−k5δ y:=0 2−k1δ≤x≤4−k2δ 2−k3δ≤y≤4−k4δ k5δ
⊆
(k2+k3)δ
SLIDE 78 Shrinking timing constraints
Example
x≤2−k5δ y:=0 2−k1δ≤x≤4−k2δ 2−k3δ≤y≤4−k4δ k5δ
⊆
(k2+k3)δ
SLIDE 79 Outline of the talk
1
Discrete time vs. dense time
2
From models to implementations
3
Checking robust safety Enlarging clock constraints Shrinking clock constraints
4
Checking robust controllability Parametrized perturbations Permissive strategies
5
Conclusions and future works
SLIDE 80
Game-based approach to robustness
Solving robust reachability
Player 1 proposes a delay d and a transition t; transition t is taken after some delay in [d − δ, d + δ] chosen by Player 2.
SLIDE 81 Game-based approach to robustness
Solving robust reachability
Player 1 proposes a delay d and a transition t; transition t is taken after some delay in [d − δ, d + δ] chosen by Player 2. Consider a transition with guard x ≤ 3 ∧ y ≥ 1: strict semantics
x=3 y=1
δ δ d loose semantics
x=3 y=1
d
SLIDE 82
Game-based approach to robustness
Solving robust reachability
Player 1 proposes a delay d and a transition t; transition t is taken after some delay in [d − δ, d + δ] chosen by Player 2.
Theorem ([BMS12,SBMR13])
Robust reachability is EXPTIME-complete in the loose semantics. Robust reachability and repeated reachability are PSPACE-complete in the strict semantics.
SLIDE 83
Shrunk DBMs for the loose semantics
Extend the region automaton into a 2-player turn-based game
x = y = 1 y := 0
SLIDE 84
Shrunk DBMs for the loose semantics
Extend the region automaton into a 2-player turn-based game
x = y = 1 y := 0 r0 r1 r2 r3 r′ r0 r′ r1, s1 r2, s2 r3, s3
SLIDE 85 Orbit graphs for the strict semantics
ℓ0 ℓ1 ℓ2
1<x<2 y:=0 y≥2,y:=0 x≤2,x:=0
y x 1 1 2 2
ℓ1 ∆
y x 1 1 2 2
ℓ1 e1
y x 1 1 2 2
ℓ2 ∆
y x 1 1 2 2
ℓ2 e2
y x 1 1 2 2
ℓ1 ∆
y x 1 1 2 2
ℓ1
SLIDE 86
Orbit graphs for the strict semantics
SLIDE 87
Orbit graphs for the strict semantics
Definition
A cycle π is forgetful if its orbit graph is strongly connected. A cycle π is aperiodic if πk is forgetful, for all k.
SLIDE 88
Orbit graphs for the strict semantics
Definition
A cycle π is forgetful if its orbit graph is strongly connected. A cycle π is aperiodic if πk is forgetful, for all k.
Theorem
The automaton is robustly controllable if, and only if, it has a reachable aperiodic cycle.
SLIDE 89
Synthesizing permissive strategies
Permissive strategies
Permissive strategies can propose several moves rather than a single one.
SLIDE 90 Synthesizing permissive strategies
Permissive strategies
Permissive strategies can propose several moves rather than a single one.
In the untimed setting... [BDMR09, BMOU11]
a b c d
1 8 1 6 1 2
SLIDE 91 Synthesizing permissive strategies
Permissive strategies
Permissive strategies can propose several moves rather than a single one.
In the untimed setting... [BDMR09, BMOU11]
a b c d
1 8 1 6 1 2
a c b d b
SLIDE 92 Synthesizing permissive strategies
Permissive strategies
Permissive strategies can propose several moves rather than a single one.
In the untimed setting... [BDMR09, BMOU11]
a b c d
1 8 1 6 1 2
a c b d b
6 6
SLIDE 93
Synthesizing permissive strategies
Permissive strategies
Permissive strategies can propose several moves rather than a single one.
In the timed setting...
Permissive strategies propose intervals of delays. Our setting: the penalty assigned to interval [a, b] is 1/(b − a).
SLIDE 94 Synthesizing permissive strategies
Permissive strategies
Permissive strategies can propose several moves rather than a single one.
In the timed setting...
ℓ0 ℓ1 ℓ2
a, x < 2 b, x ≤ 1 a, x ≤ 2 b, x := 0
SLIDE 95 Synthesizing permissive strategies
Permissive strategies
Permissive strategies can propose several moves rather than a single one.
In the timed setting...
ℓ0 ℓ1 ℓ2
a, x < 2 b, x ≤ 1 a, x ≤ 2 b, x := 0 Possible (memoryless) strategy: in ℓ0, play (a, [0, 2)); in ℓ1:
if x ≤ 1, play (b, [0, 1 − x]);
- therwise, play (a, [0, 2 − x]);
in ℓ2, play (b, [0, +∞))
SLIDE 96 Synthesizing permissive strategies
Permissive strategies
Permissive strategies can propose several moves rather than a single one.
In the timed setting...
ℓ0 ℓ1 ℓ2
a, x < 2 b, x ≤ 1 a, x ≤ 2 b, x := 0 Possible (memoryless) strategy: in ℓ0, play (a, [0, 2)); in ℓ1:
if x ≤ 1, play (b, [0, 1 − x]);
- therwise, play (a, [0, 2 − x]);
in ℓ2, play (b, [0, +∞))
SLIDE 97 Synthesizing permissive strategies
Permissive strategies
Permissive strategies can propose several moves rather than a single one.
In the timed setting...
ℓ0 ℓ1 ℓ2
a, x < 2 b, x ≤ 1 a, x ≤ 2 b, x := 0 Possible (memoryless) strategy: in ℓ0, play (a, [0, 1]); in ℓ1:
if x = 0, play (b, [0, 1]);
- therwise, play (a, [0, 2 − x]);
in ℓ2, play (b, [0, +∞))
SLIDE 98 Synthesizing permissive strategies
Permissive strategies
Permissive strategies can propose several moves rather than a single one.
In the timed setting...
ℓ0 ℓ1 ℓ2
a, x < 2 b, x ≤ 1 a, x ≤ 2 b, x := 0 Possible (memoryless) strategy: in ℓ0, play (a, [0, 1]); in ℓ1:
if x = 0, play (b, [0, 1]);
- therwise, play (a, [0, 2 − x]);
in ℓ2, play (b, [0, +∞))
SLIDE 99
Synthesizing permissive strategies
Permissive strategies
Permissive strategies can propose several moves rather than a single one.
In the timed setting... Theorem
For one-clock timed games: Memoryless optimal-penalty strategies exist. They can be computed in polynomial time.
SLIDE 100 Outline of the talk
1
Discrete time vs. dense time
2
From models to implementations
3
Checking robust safety Enlarging clock constraints Shrinking clock constraints
4
Checking robust controllability Parametrized perturbations Permissive strategies
5
Conclusions and future works
SLIDE 101
Conclusion and challenges
Conclusions
Robustness issues identified long ago... Several attempts, but no satisfactory solution yet!
SLIDE 102
Conclusion and challenges
Conclusions
Robustness issues identified long ago... Several attempts, but no satisfactory solution yet!
Challenges and open questions
symbolic algorithms; measuring robustness, using distances between automata; link between “syntactic distance” and “semantic distance” probabilistic approach to robustness; evaluate expected time before a new state is visited. investigate robustness in weighted timed automata; energy constraints; imprecision on cost rates; synthesis of robust strategies.
